docs: close the plan-bookkeeping drift and state the tier truth (§8.5, §8.6, #522 )

Bookkeeping: 13 .tasks.json files closed — the 8 the audit named, plus mesh-phase4 (Task 9 landed 3a590a0c), the 4th stillpending phase file, and historian-tcp-transport closed as OBSOLETE (it targets the retired Wonderware sidecar; there is no Wonderware backend in the tree). Each carries a closureNote naming the evidence rather than just a status flip. 11 archreview live gates written back from STATUS.md, which had recorded them passed since 2026-07-13/15 without ever updating the task files: R2-01 #11, R2-02 #15/#18, R2-05 T15, R2-06 T12, R2-07 T5/T6/T12/T14, R2-11 T22/T24. R2-03 and R2-10 were deliberately NOT closed. STATUS.md's headline says "every Round-2 live gate is now GREEN", but its own per-item detail says R2-03 is "live-blocked on this data-less rig" and R2-10 verified the pipeline with "breaker-OPEN state not forced". Both now carry an openNote recording the actual blocker. The point of the sweep: ~140 phantom pending tasks are gone, so the genuinely unexecuted 19-task AdminUI follow-ups plan is now the largest open item in docs/plans/ instead of being buried under work that shipped months ago. Tier truth: docs/v2/driver-stability.md now states that its tier table is aspirational — every driver runs Tier A because no factory passes a tier, so MemoryRecycle and ScheduledRecycleScheduler have never engaged, and the config parser validates a RecycleIntervalSeconds that does nothing. It also corrects a staleness the audit missed: the separate-Windows-service hosting it describes for Tier C no longer exists (Galaxy moved to the mxaccessgw sidecar in PR 7.2, FOCAS went in-process with its managed wire client). docs/drivers/README.md already said Tier A for both, so the two no longer contradict. No runtime change — enabling recycle on two live drivers wants its own live gate, not a docs-pass side effect. Keep-or-delete tracked as Gitea #522.
fix(adminui): guard the driver dispatch maps and close G-1..G-6 (§8.4)
2026-07-27 19:54:41 -04:00 · 2026-07-27 19:52:02 -04:00 · 2026-07-27 19:32:46 -04:00 · 2026-07-27 18:57:09 -04:00 · 2026-07-27 18:47:34 -04:00 · 2026-07-27 18:36:48 -04:00
441 changed files with 76124 additions and 5443 deletions
@@ -58,3 +58,6 @@ lib/
 # Session working notes — never stage (pending.md's own hard rule; R2-12/U-4)
 /pending.md
 /current.md
+
+# Subagent-driven-development git worktrees
+.worktrees/
@@ -55,6 +55,28 @@ about OtOpcUa changes here — remote/push status, the driver set, the Galaxy da
 shared-lib consumption, or per-project commands — update the **OtOpcUa entry in
 `../scadaproj/CLAUDE.md`** in the same change so the index never drifts from this repo.

+**The index edit belongs on `scadaproj`'s `main`, and must be pushed.** `scadaproj` is a
+separate repo with its own checkout, so committing there inherits whatever branch it
+happens to be on — which is usually *not* `main` and is often an unrelated feature branch
+with no upstream. That silently drifts the index for as long as that branch stays
+unmerged, which is the exact failure the rule above exists to prevent. Do this explicitly:
+
+```bash
+cd ~/Desktop/scadaproj
+git rev-parse --abbrev-ref HEAD            # note it, to restore afterwards
+git stash list                             # never commit onto a dirty unrelated branch
+git checkout main && git pull
+#   …edit the OtOpcUa entry in CLAUDE.md…
+git commit -am "docs(index): <what changed about OtOpcUa>"
+git push origin main
+git checkout -                             # restore the original branch
+```
+
+Observed 2026-07-27: the `Sql` poll driver's index entry had sat unpushed on an unrelated
+feature branch since 2026-07-24 because it was committed onto the current checkout, so the
+index disagreed with reality for three days despite this rule. If you find index commits
+stranded on a feature branch, cherry-pick them onto `main` rather than merging that branch.
+
 ## Architecture Overview

 ### Data Flow
@@ -131,7 +153,50 @@ Galaxy `mx_data_type` values map to OPC UA types (Boolean, Int32, Float, Double,

 ### Change Detection

-`DeployWatcher` (`src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Galaxy/Browse/DeployWatcher.cs`) polls the gateway's deploy-event signal and raises `IRediscoverable.OnRediscoveryNeeded` when the Galaxy redeploys. The server's `DriverHost` consumes the signal and rebuilds the address space.
+`DeployWatcher` (`src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Galaxy/Browse/DeployWatcher.cs`) polls the gateway's deploy-event signal and raises `IRediscoverable.OnRediscoveryNeeded` when the Galaxy redeploys.
+
+**The signal is consumed as an operator prompt, not as an address-space rebuild** (§8.2, 2026-07-27).
+`DriverInstanceActor` subscribes in `PreStart` and unsubscribes in `PostStop` — the detach is
+load-bearing, because the `IDriver` instance outlives the actor when the host respawns a child around
+the same driver object. A raise is recorded and rides the driver-health snapshot
+(`DriverHealthChanged.RediscoveryNeededUtc` / `.RediscoveryReason`) to the AdminUI `/hosts` page as a
+**"re-browse" chip**.
+
+⚠️ **It is advisory: a Galaxy redeploy still does NOT change the served address space.** v3 authors raw
+tags explicitly through the `/raw` browse-commit flow, so an operator must re-browse the device and
+commit. Injecting nodes at runtime would materialise nodes nobody approved and no deployment artifact
+records.
+
+Two gotchas if you touch this:
+
+- `PublishHealthSnapshot` dedups on a health fingerprint. The rediscovery timestamp **must** stay in
+  that tuple, or a raise on an otherwise-unchanged Healthy driver is swallowed and never reaches the
+  operator. Pinned by `DriverInstanceActorRediscoverySignalTests`.
+- The shared test `StubDriver.GetHealth()` returns `DateTime.UtcNow`, so its fingerprint differs on
+  every call and the dedup never engages — a test built on it passes vacuously. The rediscovery tests
+  use a stub with stable health for exactly this reason.
+
+**#507 is closed as superseded, and the injection path is deleted.** Its retained code read
+`EquipmentNode.DriverInstanceId` and `EquipmentTags`, both *structurally empty* in v3
+(`AddressSpaceComposer.cs`, `DeploymentArtifact.cs`), so removing the guard would have changed a log
+line and injected nothing. Gone with it: `HandleDiscoveredNodes`, `PartitionDiscoveredByDeviceHost`,
+`ApplyDiscoveredPlansForDriver`, the redeploy re-inject tail, `DiscoveredNodeMapper`,
+`AddressSpaceApplier.MaterialiseDiscoveredNodes`, the connect-time discovery loop
+(`StartDiscovery`/`RediscoverTick`/`DiscoveredNodesReady`/`TriggerRediscovery`), and the 18
+`DiscoveryInjectionDormantV3` tests — v2 characterization tests asserting an equipment-rooted graft
+(`EquipmentRootNodeId == "EQ-1"`) that v3 cannot produce. `ITagDiscovery` itself stays: the `/raw`
+browse picker drives it through `Commons/Browsing/DiscoveryDriverBrowser`, which never went through
+the actor.
+
+**Deliberately NOT built: a discovered-vs-authored drift detector.** Modbus, S7, MQTT, AbLegacy and Sql
+all *echo authored config* from `DiscoverAsync` rather than browsing the device, so such a diff is
+permanently empty for them — another plausible-looking inert seam. `IRediscoverable` is the
+trustworthy signal because the driver asserts it deliberately.
+
+⚠️ **`IHostConnectivityProbe` is still unconsumed.** `GetHostStatuses()` has no production call site and
+nothing ever writes a `DriverHostStatus` row (the table was re-created in the v3 initial migration, so
+confirm intent before deleting). The separable `OnHostStatusChanged` event is the useful half. Tracked
+as Gitea **#521**.

 ## mxaccessgw

@@ -168,13 +233,29 @@ central SQL Server.
 > recipes (S7 blackhole, GLAuth outage, HistorianGateway LiveIntegration), the integration-test
 > harness, the docker-dev rig, and the deploy setup. Start there; the sections below + `docs/v2/dev-environment.md` carry the detail.

-> **Migrated 2026-04-28**: Docker config + host moved off this dev VM (DESKTOP-6JL3KKO) onto the shared Linux Docker host (`DOCKER`, 10.100.0.35) so the dev VM could shed WSL2/Hyper-V and have its GPU re-attached via ESXi passthrough. Docker Desktop is no longer installed here. All checked-in `appsettings.json` defaults, fixture-class default endpoints, and `e2e-config.sample.json` were rewritten to target `10.100.0.35`. The driver fixture compose files under `tests/.../Docker/docker-compose.yml` now carry a `project: lmxopcua` label on every service. See `docs/v2/dev-environment.md` for the full rewrite (header dated 2026-04-28).
+> **Migrated 2026-04-28**: Docker config + host moved off this dev VM (DESKTOP-6JL3KKO) onto the shared Linux Docker host (`DOCKER`, 10.100.0.35) so the dev VM could shed WSL2/Hyper-V and have its GPU re-attached via ESXi passthrough. Docker Desktop is no longer installed here. All checked-in `appsettings.json` defaults, fixture-class default endpoints, and `e2e-config.sample.json` were rewritten to target `10.100.0.35`. See `docs/v2/dev-environment.md` for the full rewrite (header dated 2026-04-28).
+
+> ⚠️ **The `project: lmxopcua` label is aspirational, not universal.** This note used to claim every fixture compose file carries it. As of 2026-07-24 only the **MQTT** fixture actually does — `grep -rn "labels:" tests --include=*.yml` matches `Driver.Mqtt.IntegrationTests/Docker/docker-compose.yml` and nothing else. So `docker ps --filter label=project=lmxopcua` returns the MQTT fixture alone, not the fleet. Add the label when you touch an older fixture; until then enumerate by container name.

 Docker workloads run on a shared Linux host at **`10.100.0.35`** — not on this VM. Stacks live at `/opt/otopcua-<driver>/` on the host and carry the `project=lmxopcua` label so they're discoverable via `docker ps --filter label=project=lmxopcua`.

-**`docker -H ssh://...` does NOT work from this VM.** Windows OpenSSH ↔ docker.exe stdio bridging hangs (`docker system dial-stdio` runs server-side but no API data flows). Use the helper below — it SSHes into the docker host and runs `docker compose` server-side.
+**`docker -H ssh://...` does NOT work from the Windows VM.** Windows OpenSSH ↔ docker.exe stdio bridging hangs (`docker system dial-stdio` runs server-side but no API data flows). Use the helper below — it SSHes into the docker host and runs `docker compose` server-side.

-**Use `lmxopcua-fix.ps1` (in `~/bin`) to control fixtures from this VM:**
+> **On macOS there is no `lmxopcua-fix` — drive the host over SSH directly.** The helper is a Windows-VM
+> script; `~/bin` is empty on the Mac and the commands below will not resolve. Use passwordless SSH
+> (and `rsync` in place of `sync`), which is what `infra/README.md` §1 documents as the Mac path:
+>
+> ```bash
+> ssh dohertj2@10.100.0.35 'docker ps --format "{{.Names}}\t{{.Status}}"'
+> ssh dohertj2@10.100.0.35 'cd /opt/otopcua-mqtt && docker compose up -d'
+> rsync -av tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.IntegrationTests/Docker/ \
+>     dohertj2@10.100.0.35:/opt/otopcua-mqtt/          # the `sync` step, by hand
+> ```
+>
+> A local container runtime *does* exist on the Mac (OrbStack), so the `docker-dev/` rig itself runs
+> locally there — it is only the shared **fixtures** that live on `10.100.0.35`.
+
+**Use `lmxopcua-fix.ps1` (in `~/bin`) to control fixtures from the Windows VM:**

 ```powershell
 lmxopcua-fix ls                            # list all lmxopcua-tagged containers on the host
@@ -195,6 +276,16 @@ lmxopcua-fix sync modbus                   # rsync this repo's tests/.../Docker/
 - AB CIP: `10.100.0.35:44818` (`AB_SERVER_ENDPOINT`)
 - S7: `10.100.0.35:1102` (`S7_SIM_ENDPOINT`)
 - OPC UA reference (opc-plc): `opc.tcp://10.100.0.35:50000` (`OPCUA_SIM_ENDPOINT`)
+- MQTT (Mosquitto, **auth on both listeners — no anonymous fallback**): `10.100.0.35:8883` TLS+auth
+  (`MQTT_FIXTURE_ENDPOINT`) · `10.100.0.35:1883` plaintext-but-authenticated (`MQTT_FIXTURE_PLAIN_ENDPOINT`).
+  Also needs `MQTT_FIXTURE_USERNAME` / `MQTT_FIXTURE_PASSWORD`, and `MQTT_FIXTURE_CA_CERT` to pin the
+  fixture CA (`scp dohertj2@10.100.0.35:/opt/otopcua-mqtt/secrets/ca.crt`). A co-running publisher loops
+  JSON under `otopcua/fixture/…`.
+- MQTT **Sparkplug B**: the same broker, plus the `sparkplug` compose profile's `otopcua-sparkplug-sim`
+  (project-owned C# edge-node simulator) — group **`OtOpcUaSim`**, edge nodes **`EdgeA`**/**`EdgeB`**,
+  `EdgeA` device **`Filler1`**, ~2 s cadence. It subscribes to `spBv1.0/OtOpcUaSim/NCMD/{node}` and
+  re-births on request. **Births are never retained**, so `docker restart otopcua-sparkplug-sim` is how
+  you force a fresh one while a browse window is open.

 Override any endpoint via the env var to point at a real PLC. The local OtOpcUa server runs on this VM at `opc.tcp://localhost:4840` — **that's not on the docker host**.

@@ -221,14 +312,27 @@ The server supports non-transparent warm/hot redundancy via the `Redundancy` sec

 **Two corrections landed 2026-07-21 — both were total-outage or wrong-node defects, and both are worth knowing before touching this area.**

- **Downing is `auto-down`, not `keep-oldest`.** `Cluster:SplitBrainResolverStrategy` (default `auto-down`) selects the provider via `ServiceCollectionExtensions.BuildDowningHocon`; an unknown value fails host start. A two-node pair running the previous `keep-oldest` + `down-if-alone` **could not survive a crash of the oldest node**: Akka's `KeepOldest.OldestDecision` only lets `down-if-alone` rescue a side holding ≥ 2 members, so the 1-vs-1 survivor downs *itself* and exits. `down-if-alone` is a 3+-node feature. The accepted trade for `auto-down` is dual-active during a genuine network partition. **Its live gate is still open** — the pathology only appears 1-vs-1 and docker-dev is a single six-node mesh, so the crash-the-oldest drill is deferred to the per-cluster mesh work.
+- **Downing is `auto-down`, not `keep-oldest`.** `Cluster:SplitBrainResolverStrategy` (default `auto-down`) selects the provider via `ServiceCollectionExtensions.BuildDowningHocon`; an unknown value fails host start. A two-node pair running the previous `keep-oldest` + `down-if-alone` **could not survive a crash of the oldest node**: Akka's `KeepOldest.OldestDecision` only lets `down-if-alone` rescue a side holding ≥ 2 members, so the 1-vs-1 survivor downs *itself* and exits. `down-if-alone` is a 3+-node feature. The accepted trade for `auto-down` is dual-active during a genuine network partition. **Its live gate is CLOSED** — Phase 7 drill D4 (2026-07-24) ran the 1-vs-1 crash-the-oldest survival drill on the three-mesh docker-dev rig and every survivor stayed Up, never self-downing (`c50ebcf7`; `docs/plans/2026-07-24-mesh-phase7-failover-drills.md`).
 - **The Primary is the oldest Up `driver` member, not the role leader.** `RedundancyStateActor` previously used `ClusterState.RoleLeader("driver")` (lowest *address*), while `ClusterSingletonManager` places singletons on the *oldest*. They agree only on a freshly-formed cluster and diverge after any restart, so the Primary-gated data plane (writes, alarm acks, alerts emit, alarm-history drain) could enable on a node not hosting the singletons. `NodeRedundancyState.IsRoleLeaderForDriver` was renamed **`IsDriverPrimary`**.

 **A third bootstrap gap closed 2026-07-22 — downing was never the whole story, and the fix changed twice.** Even under `auto-down`, a node cold-starting while its peer was dead **never came Up**: Akka runs `FirstSeedNodeProcess` — the only bootstrap path that can form a *new* cluster when no peer answers `InitJoin` — exclusively when `seed-nodes[0]` is the node’s own address; every other node runs `JoinSeedNodeProcess` and retries `InitJoin` forever. **`Cluster:SeedNodes` is therefore ORDERED: every node that is one of its own seeds lists ITSELF first, partner second** (docker-dev `central-2` was swapped; site nodes list only `central-1` and are legitimately not seeds). `AkkaClusterOptionsValidator` (`AddValidatedOptions`/`ValidateOnStart` in `AddOtOpcUaCluster`) enforces it at boot — **conditionally** (self must be entry 0 only *if* self is in the list, or every site node would refuse to start), matching on `PublicHostname`+`Port`, never the `0.0.0.0` bind address. The earlier fix — a `Cluster:SelfFormAfter` timer calling `Cluster.Join(SelfAddress)` — is **deleted**: it sat outside Akka’s join handshake, so it could not tell "no seed answered" from "a seed answered and the join is in flight", and it islanded a manually-failed-over node live before a TCP reachability guard patched that one shape. Pinned by `SelfFirstSeedBootstrapTests` (real in-process clusters, incl. a falsifiability control proving peer-first ordering never forms) + `AkkaClusterOptionsValidatorTests`. See `docs/Redundancy.md` §"Bootstrap: self-first seed ordering".

+**Simultaneous cold-start splits — the bootstrap guard closes it (opt-in, `Cluster:BootstrapGuard:Enabled`, default OFF).** Self-first on BOTH nodes means when both cold-start at the same instant, each runs `FirstSeedNodeProcess`, times out, and forms its OWN 1-node cluster → two Primaries in one pair (the Phase 6 live gate reproduced this on docker; two separate clusters do NOT auto-merge). The guard prevents it without losing cold-start-alone: the lexicographically **lower** `host:port` node is the preferred founder (self-first, forms immediately); the **higher** node TCP-probes the partner's Akka port up to `PartnerProbeSeconds` (25s) — **reachable ⇒ peer-first (join the founder)**, **unreachable ⇒ self-first (partner dead, form alone)**. The order is chosen BEFORE the single `JoinSeedNodes`, from an explicit reachability signal — it never re-forms mid-handshake (the `SelfFormAfter` failure mode). When on, Akka gets NO config seeds (`BuildClusterOptions` empties `ClusterOptions.SeedNodes`) and `ClusterBootstrapCoordinator` drives the join. Residual trade (accepted, operator-visible via a warning + restart-recovers): the higher node hangs if the founder dies in the probe→join window. docker-dev: **site-a = guard demo** (guard on, serialization removed); **site-b = A/B control** (guard off, `depends_on: service_healthy` serialization). The guard is the production-faithful fix (compose `depends_on` doesn't exist on real VMs). Pinned by `ClusterBootstrapGuardTests` + `ClusterBootstrapCoordinatorTests` (real 2-node clusters, incl. the higher-node-cold-start-alone case). See `docs/Redundancy.md` §"Bootstrap guard".
+
 Assert the **effective** cluster config off a running `ActorSystem` (as `SplitBrainResolverActivationTests` does), never the typed options or the akka.conf text — several HOCON fragments compete and the losing one still reads correctly in the file.

-**Still per-Akka-cluster, not per application `Cluster`.** One Primary is elected across the whole Akka mesh, so a fleet running several application clusters in one mesh (what docker-dev models) gets one Primary among all driver nodes. The fix is the per-cluster mesh workstream: `docs/plans/2026-07-21-per-cluster-mesh-design.md` (Phases 0a/0b/1 done; 2 code-complete behind a dark switch; 3–7 not started).
+**RESOLVED by per-cluster mesh Phase 6 (2026-07-24) — no longer per-Akka-cluster.** The "one Primary across the whole Akka mesh" limitation described above is gone; see the Phase 6 paragraph immediately below.
+
+**Per-cluster mesh Phase 6 (2026-07-24) — the fleet is now three independent 2-node meshes, not one.** The single fleet-wide Akka mesh was split into one mesh per application `Cluster`: the central pair (`admin,driver,cluster-MAIN`), site-a (`driver,cluster-SITE-A`), site-b (`driver,cluster-SITE-B`) — same `ActorSystem` name, separated purely by per-pair self-first seeds (each node's `Cluster:SeedNodes` lists itself first, its own pair partner second, never a node from another cluster's pair). Consequences:
+
+- **The redundancy singleton is cluster-scoped and spawned per driver node.** `RedundancyStateActor` is now a `cluster-{ClusterId}`-scoped singleton (falls back to plain `driver` for a legacy node), so each pair elects and publishes its **own** Primary on its own mesh's DPS. **Two or more Primaries exist fleet-wide, one per pair — by design, not a bug.** ⚠️ **Wiring landmine (fixed `3a4ed8dd`, caught by the live gate):** the singleton's cluster-role *scope* is computed at `AddAkka`-configurator time, so it must come from `AkkaClusterOptions` (config) — **never** by resolving `IClusterRoleInfo` from the SP there. `ClusterRoleInfo` depends on the `ActorSystem`, and that lambda runs *while the ActorSystem is being built*, so resolving it recurses into ActorSystem construction and **stack-overflows every node at boot** (compiles clean; the rehome tests passed a hand-built fake straight into the extension, mocking around the composition-root line). Keep `WithOtOpcUaClusterRedundancySingleton`/`BuildClusterRedundancySingletonOptions` taking `AkkaClusterOptions`.
+- `ClusterNodeAddressReconciler` is **own-cluster-scoped** — an admin node can only reconcile `ClusterNode` rows in its own cluster; it has no gossip visibility into another mesh.
+- `CentralCommunicationActor` creates **one `ClusterClient` per application `Cluster`** and fans commands across them (closing the `TODO(Phase 6)` Phase 2 left behind), rather than one fleet-wide client.
+- **`SplitTopologyTransportValidator` fails host start** on a node carrying a `cluster-{ClusterId}` role unless it also runs the split-safe transports: `MeshTransport:Mode=ClusterClient`, `Telemetry:Mode=Grpc` (driver), `TelemetryDial:Mode=Grpc` (admin). A DPS transport on a cluster-role node would try to gossip across a partition that no longer exists.
+- **The compiled transport-mode defaults were deliberately NOT flipped** — `MeshTransport:Mode`/`Telemetry:Mode`/`TelemetryDial:Mode` all still default to `Dps`; a blast-radius assessment showed flipping the default breaks every integration test and appsettings profile that leaves the key unset. The validator + explicit per-deployment config is the guardrail, not a default flip.
+- **Secrets replication is pair-local** — each pair replicates its own Akka DPS secrets within itself; there is no fleet-wide/cross-cluster sync after the split (sites have no SQL, so no SQL-hub, consistent with Phase 4).
+
+See `docs/Redundancy.md` §"Per-cluster meshes (Phase 6)", `docs/Configuration.md` §"Per-cluster mesh split (Phase 6)", and `docs/plans/2026-07-24-mesh-phase6-partition-and-colocation.md`.

 ## Mesh command transport (`MeshTransport`)

@@ -246,12 +350,14 @@ change, not a redeploy. Things worth knowing before touching it:
  `DeploymentArtifact.ResolveClusterScope`). `ClusterClient.Send` delivers to exactly **one** registered
  actor — it would deploy to a single node while every other node silently kept its old configuration,
  and the deployment could still seal green.
- **Exactly ONE fleet-wide ClusterClient while the fleet is one mesh.** A receptionist serves its whole
-  cluster, so `SendToAll` reaches every registered node-comm actor regardless of which node's address was
-  dialled. One client per application `Cluster` — the obviously-right-looking shape, and what Phase 6
-  wants — would fan each command out once per cluster (N× duplicate dispatch *and* N× duplicate ack).
-  Marked `TODO(Phase 6)` in `CentralCommunicationActor.RebuildClient`. **Corollary:** the contact set does
-  not scope delivery; excluding a `MaintenanceMode` node from the contacts does not stop it receiving.
+- **RESOLVED by Phase 6 — one `ClusterClient` per application `Cluster`, not one fleet-wide.** When
+  this was written the fleet was still one mesh, so a receptionist served the whole cluster and
+  `SendToAll` reached every registered node-comm actor regardless of which node's address was dialled;
+  the `TODO(Phase 6)` in `CentralCommunicationActor.RebuildClient` asked for one client per application
+  `Cluster` instead. Phase 6 split the fleet into one mesh per `Cluster` and shipped exactly that — see
+  the [Redundancy](#redundancy) section's Phase 6 paragraph above. The `SendToAll`-within-a-mesh
+  behaviour below is otherwise unchanged; a `MaintenanceMode` node still isn't excluded from delivery
+  within its own mesh.
 - **Inbound commands re-emit on the node's `EventStream`, not on their DPS topic** — DPS is mesh-wide and
  central `SendToAll`s to every node, so a DPS re-publish would deliver N copies to every subscriber.
  Node-side subscribers (`DriverHostActor`, `ScriptedAlarmHostActor`) accept both.
@@ -317,7 +423,7 @@ Flip only the site nodes with `OTOPCUA_CONFIG_MODE=FetchAndCache` at `docker com

 ## Live telemetry transport (`Telemetry` / `TelemetryDial`)

-Per-cluster mesh **Phase 5** (code-complete on `feat/mesh-phase5`, live gate pending) added a second
+Per-cluster mesh **Phase 5** (merged `35552a96`; live gate PASSED `f134935f`) added a second
 transport for the four live-observability channels the AdminUI's `/alerts`, `/script-log`, and
 `/hosts` panels feed on, selected by `Telemetry:Mode` (node/serve side) and `TelemetryDial:Mode`
 (central/dial side): `Dps` — the four existing DPS SignalR bridges, **the default**, today's
@@ -427,7 +533,8 @@ unaffected (it keeps ConfigDb via its admin role). Consequences:
 - **Scripted-alarm Part 9 condition state moved to LocalDb.** `LocalDbAlarmConditionStateStore`
  (replicated `alarm_condition_state` table, pair-local like the Phase-2 alarm S&F buffer) replaces
  `EfAlarmConditionStateStore` on every driver-role node, fused central included. The DB-backed
-  `ScriptedAlarmState` table is now unused (dropping it is a deferred follow-up, tracked as Task 9).
+  `ScriptedAlarmState` table **was dropped** (Task 9, `3a590a0c`, migration
+  `20260723183050_DropScriptedAlarmStateTable`); `EfAlarmConditionStateStore` is deleted.
 - **Central persists deploy acks.** `DriverHostActor` no longer writes `NodeDeploymentState` to SQL on
  a driver-only node — `ConfigPublishCoordinator.PersistNodeAck` (already fed by every ApplyAck) is
  the system of record.
@@ -436,8 +543,8 @@ unaffected (it keeps ConfigDb via its admin role). Consequences:
  `OtOpcUaGroupRoleMapper` falls back to the `Security:Ldap:GroupToRole` appsettings baseline only —
  the same rows a driver node never received via config either, so this is not a regression.

-Code-complete on `feat/mesh-phase4`; the table-drop (Task 9) and the live gate (Task 10) are still
-open. See `docs/plans/2026-07-23-mesh-phase4-cut-driver-configdb.md` and
+Merged to master (`26fad75c`); **live gate PASSED** (`1281aebf` — driver nodes run ConfigDb-free) and
+Task 9 landed (`3a590a0c`). See `docs/plans/2026-07-23-mesh-phase4-cut-driver-configdb.md` and
 `docs/plans/2026-07-22-per-cluster-mesh-program.md` §Phase 4.

 ## LDAP Authentication
@@ -75,8 +75,26 @@
    <PackageVersion Include="Microsoft.NET.Test.Sdk" Version="17.12.0" />
    <PackageVersion Include="Microsoft.Playwright" Version="1.51.0" />
    <PackageVersion Include="Moq" Version="4.20.72" />
+    <!--
+      MQTT client for the Mqtt / Sparkplug B driver. MQTTnet v5 is the first line shipping a
+      net10.0 TFM (lib/net10.0, and an EMPTY net10.0 dependency group — zero transitive
+      packages, so it cannot participate in a diamond under this repo's deliberately-OFF
+      CentralPackageTransitivePinningEnabled). Sparkplug B payloads are hand-rolled rather than
+      taken from SparkplugNet, whose newest release (1.3.10) still pins MQTTnet 4.3.6.1152 and
+      ships net6.0/net8.0 only.
+    -->
+    <PackageVersion Include="MQTTnet" Version="5.2.0.1603" />
+    <!-- Driver.MTConnect carries NO backend NuGet. The TrakHound MTConnect.NET-Common/-HTTP pins
+         Task 0 added were removed in Task 7 (2026-07-24): neither package can parse an MTConnect
+         document (the XML formatter ships in a third, unreferenced package) nor frame the /sample
+         multipart stream socket-free. The driver uses HttpClient + System.Xml.Linq only. See the
+         Task 0 CORRECTION block in docs/plans/2026-07-24-mtconnect-driver.md. -->
    <PackageVersion Include="Novell.Directory.Ldap.NETStandard" Version="3.6.0" />
    <PackageVersion Include="OPCFoundation.NetStandard.Opc.Ua.Client" Version="1.5.378.106" />
+    <!-- Core carries Opc.Ua.StatusCodes, the oracle StatusCodeParityTests checks the drivers'
+         hard-coded uint constants against. Referenced by that TEST project only — the drivers
+         themselves stay SDK-free by design and keep spelling status codes as bare uints. -->
+    <PackageVersion Include="OPCFoundation.NetStandard.Opc.Ua.Core" Version="1.5.378.106" />
    <PackageVersion Include="OPCFoundation.NetStandard.Opc.Ua.Configuration" Version="1.5.378.106" />
    <PackageVersion Include="OPCFoundation.NetStandard.Opc.Ua.Server" Version="1.5.378.106" />
    <!-- OpenTelemetry.Api < 1.15.3 has GHSA-g94r-2vxg-569j (header-parsing memory DoS). The trio
@@ -140,7 +158,7 @@
    <PackageVersion Include="xunit" Version="2.9.3" />
    <PackageVersion Include="xunit.runner.visualstudio" Version="3.0.2" />
    <PackageVersion Include="xunit.v3" Version="1.1.0" />
-    <PackageVersion Include="ZB.MOM.WW.Health" Version="0.1.0" />
+    <PackageVersion Include="ZB.MOM.WW.Health" Version="0.3.0" />
    <!--
      LocalDb: embedded SQLite node-local cache + optional 2-node gRPC replication. The core
      package floors the native SQLitePCLRaw.lib.e_sqlite3 at 2.1.12, so consumers inherit the
@@ -148,8 +166,8 @@
    -->
    <PackageVersion Include="ZB.MOM.WW.LocalDb" Version="0.1.3" />
    <PackageVersion Include="ZB.MOM.WW.LocalDb.Replication" Version="0.1.3" />
-    <PackageVersion Include="ZB.MOM.WW.Health.Akka" Version="0.1.0" />
-    <PackageVersion Include="ZB.MOM.WW.Health.EntityFrameworkCore" Version="0.1.0" />
+    <PackageVersion Include="ZB.MOM.WW.Health.Akka" Version="0.3.0" />
+    <PackageVersion Include="ZB.MOM.WW.Health.EntityFrameworkCore" Version="0.3.0" />
    <PackageVersion Include="ZB.MOM.WW.Telemetry" Version="0.1.0" />
    <PackageVersion Include="ZB.MOM.WW.Telemetry.Serilog" Version="0.1.0" />
    <PackageVersion Include="ZB.MOM.WW.MxGateway.Client" Version="0.1.1" />
@@ -1,6 +1,6 @@
 # OtOpcUa

-OPC UA server (.NET 10 AnyCPU) that exposes a fleet of industrial drivers as a single OPC UA address space. Drivers ship in-process for AVEVA System Platform Galaxy (via the sibling `mxaccessgw` repo), Modbus TCP, Siemens S7, Allen-Bradley CIP (ControlLogix / CompactLogix), Allen-Bradley Legacy (SLC 500 / MicroLogix), Beckhoff TwinCAT (ADS), FANUC FOCAS, and OPC UA Client (gateway).
+OPC UA server (.NET 10 AnyCPU) that exposes a fleet of industrial drivers as a single OPC UA address space. Drivers ship in-process for AVEVA System Platform Galaxy (via the sibling `mxaccessgw` repo), Modbus TCP, Siemens S7, Allen-Bradley CIP (ControlLogix / CompactLogix), Allen-Bradley Legacy (SLC 500 / MicroLogix), Beckhoff TwinCAT (ADS), FANUC FOCAS, OPC UA Client (gateway), and MQTT (broker subscribe; Sparkplug B in progress).

 A cross-platform client stack (.NET 10) — shared library, CLI, and Avalonia desktop app — connects to any OPC UA server.

@@ -15,7 +15,7 @@ A cross-platform client stack (.NET 10) — shared library, CLI, and Avalonia de
                    |   address space + capability fan-out|
                    +-------------------------------------+
                    |    |    |    |    |    |    |    |
-              Galaxy  Modbus  S7  AbCip AbLeg TwinCAT FOCAS OpcUaClient
+          Galaxy Modbus S7 AbCip AbLeg TwinCAT FOCAS OpcUaClient MQTT
                |
                v
       mxaccessgw (sibling repo, gRPC)
@@ -91,7 +91,7 @@ See [docs/Client.CLI.md](docs/Client.CLI.md) and [docs/Client.UI.md](docs/Client
 |---|---|
 | Driver specs (per-driver capability surface, config, addressing) | [docs/v2/driver-specs.md](docs/v2/driver-specs.md) |
 | Galaxy driver | [docs/drivers/Galaxy.md](docs/drivers/Galaxy.md) |
-| Modbus / S7 / AbCip / AbLegacy / TwinCAT / FOCAS / OpcUaClient | [docs/drivers/](docs/drivers/) |
+| Modbus / S7 / AbCip / AbLegacy / TwinCAT / FOCAS / OpcUaClient / MQTT | [docs/drivers/](docs/drivers/) |
 | Galaxy parity rig (mxaccessgw setup) | [docs/v2/Galaxy.ParityRig.md](docs/v2/Galaxy.ParityRig.md) |
 | Galaxy performance + tracing | [docs/v2/Galaxy.Performance.md](docs/v2/Galaxy.Performance.md) |

@@ -29,6 +29,11 @@
    <Project Path="src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Modbus/ZB.MOM.WW.OtOpcUa.Driver.Modbus.csproj" />
    <Project Path="src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Modbus.Addressing/ZB.MOM.WW.OtOpcUa.Driver.Modbus.Addressing.csproj" />
    <Project Path="src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Modbus.Contracts/ZB.MOM.WW.OtOpcUa.Driver.Modbus.Contracts.csproj" />
+    <Project Path="src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Sql/ZB.MOM.WW.OtOpcUa.Driver.Sql.csproj" />
+    <Project Path="src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Sql.Browser/ZB.MOM.WW.OtOpcUa.Driver.Sql.Browser.csproj" />
+    <Project Path="src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Sql.Contracts/ZB.MOM.WW.OtOpcUa.Driver.Sql.Contracts.csproj" />
+    <Project Path="src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.MTConnect/ZB.MOM.WW.OtOpcUa.Driver.MTConnect.csproj" />
+    <Project Path="src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.MTConnect.Contracts/ZB.MOM.WW.OtOpcUa.Driver.MTConnect.Contracts.csproj" />
    <Project Path="src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.S7/ZB.MOM.WW.OtOpcUa.Driver.S7.csproj" />
    <Project Path="src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.S7.Contracts/ZB.MOM.WW.OtOpcUa.Driver.S7.Contracts.csproj" />
    <Project Path="src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.AbCip/ZB.MOM.WW.OtOpcUa.Driver.AbCip.csproj" />
@@ -42,6 +47,9 @@
    <Project Path="src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.csproj" />
    <Project Path="src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.Contracts/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.Contracts.csproj" />
    <Project Path="src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.Browser/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.Browser.csproj" />
+    <Project Path="src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.csproj" />
+    <Project Path="src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Contracts/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Contracts.csproj" />
+    <Project Path="src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Browser/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Browser.csproj" />
  </Folder>
  <Folder Name="/src/Drivers/Driver CLIs/">
    <Project Path="src/Drivers/Cli/ZB.MOM.WW.OtOpcUa.Driver.Cli.Common/ZB.MOM.WW.OtOpcUa.Driver.Cli.Common.csproj" />
@@ -90,6 +98,11 @@
    <Project Path="tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Modbus.Tests/ZB.MOM.WW.OtOpcUa.Driver.Modbus.Tests.csproj" />
    <Project Path="tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Modbus.Addressing.Tests/ZB.MOM.WW.OtOpcUa.Driver.Modbus.Addressing.Tests.csproj" />
    <Project Path="tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Modbus.IntegrationTests/ZB.MOM.WW.OtOpcUa.Driver.Modbus.IntegrationTests.csproj" />
+    <Project Path="tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Sql.Tests/ZB.MOM.WW.OtOpcUa.Driver.Sql.Tests.csproj" />
+    <Project Path="tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Sql.Browser.Tests/ZB.MOM.WW.OtOpcUa.Driver.Sql.Browser.Tests.csproj" />
+    <Project Path="tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Sql.IntegrationTests/ZB.MOM.WW.OtOpcUa.Driver.Sql.IntegrationTests.csproj" />
+    <Project Path="tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.MTConnect.Tests/ZB.MOM.WW.OtOpcUa.Driver.MTConnect.Tests.csproj" />
+    <Project Path="tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.MTConnect.IntegrationTests/ZB.MOM.WW.OtOpcUa.Driver.MTConnect.IntegrationTests.csproj" />
    <Project Path="tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.S7.Tests/ZB.MOM.WW.OtOpcUa.Driver.S7.Tests.csproj" />
    <Project Path="tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.S7.IntegrationTests/ZB.MOM.WW.OtOpcUa.Driver.S7.IntegrationTests.csproj" />
    <Project Path="tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.AbCip.Tests/ZB.MOM.WW.OtOpcUa.Driver.AbCip.Tests.csproj" />
@@ -104,6 +117,9 @@
    <Project Path="tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.IntegrationTests/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.IntegrationTests.csproj" />
    <Project Path="tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.Browser.Tests/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.Browser.Tests.csproj" />
    <Project Path="tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.Browser.IntegrationTests/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.Browser.IntegrationTests.csproj" />
+    <Project Path="tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Tests/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Tests.csproj" />
+    <Project Path="tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.IntegrationTests/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.IntegrationTests.csproj" />
+    <Project Path="tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.IntegrationTests/SparkplugSimulator/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.SparkplugSimulator.csproj" />
  </Folder>
  <Folder Name="/tests/Drivers/Driver CLIs/">
    <Project Path="tests/Drivers/Cli/ZB.MOM.WW.OtOpcUa.Driver.Cli.Common.Tests/ZB.MOM.WW.OtOpcUa.Driver.Cli.Common.Tests.csproj" />
@@ -9,78 +9,110 @@
    },
    {
      "id": 1,
-      "subject": "RED: connect-timeout regression tests T1+T3 (read/write degrade instead of throwing OCE) — must FAIL at f6eaa267",
+      "subject": "RED: connect-timeout regression tests T1+T3 (read/write degrade instead of throwing OCE) \u2014 must FAIL at f6eaa267",
      "status": "completed",
-      "blockedBy": [0]
+      "blockedBy": [
+        0
+      ]
    },
    {
      "id": 2,
      "subject": "RED: poll-loop-survival test T2 (subscription survives connect-timeout outage) + caller-cancel pinning test T4",
      "status": "completed",
-      "blockedBy": [0, 1]
+      "blockedBy": [
+        0,
+        1
+      ]
    },
    {
      "id": 3,
      "subject": "GREEN: EnsureConnectedAsync + InitializeAsync connect-timeout OCE -> TimeoutException conversion (STAB-14 root fix)",
      "status": "completed",
-      "blockedBy": [1, 2]
+      "blockedBy": [
+        1,
+        2
+      ]
    },
    {
      "id": 4,
      "subject": "Defensive when-filters on ensure-wrapper OCE rethrows (:488/:1000) + poll-loop OCE catches (:1383/:1396/:1404)",
      "status": "completed",
-      "blockedBy": [3]
+      "blockedBy": [
+        3
+      ]
    },
    {
      "id": 5,
      "subject": "Finding-1 close gate: full S7 unit + CLI test-project sweep green",
      "status": "completed",
-      "blockedBy": [4]
+      "blockedBy": [
+        4
+      ]
    },
    {
      "id": 6,
-      "subject": "RED: framing-fault classification Theory T5 (TPKT/TPDU/WrongNumberOfBytes/PlcException-WrongNumberReceivedBytes reopen) — must FAIL",
+      "subject": "RED: framing-fault classification Theory T5 (TPKT/TPDU/WrongNumberOfBytes/PlcException-WrongNumberReceivedBytes reopen) \u2014 must FAIL",
      "status": "completed",
-      "blockedBy": [0]
+      "blockedBy": [
+        0
+      ]
    },
    {
      "id": 7,
      "subject": "GREEN: broaden IsS7ConnectionFatal to the ISO-on-TCP framing surface (NOT InvalidDataException) + xmldoc (STAB-15a)",
      "status": "completed",
-      "blockedBy": [6]
+      "blockedBy": [
+        6
+      ]
    },
    {
      "id": 8,
      "subject": "RED->GREEN: cancellation-during-I/O marks handle dead (T6 read + T7 write; per-item OCE catches set _plcDead before propagating)",
      "status": "completed",
-      "blockedBy": [7]
+      "blockedBy": [
+        7
+      ]
    },
    {
      "id": 9,
      "subject": "RED->GREEN: probe marks handle dead under the gate (T8 persistent probe fault + T9 probe timeout; ProbeLoopAsync inner catch restructure, STAB-15b)",
      "status": "completed",
-      "blockedBy": [8]
+      "blockedBy": [
+        8
+      ]
    },
    {
      "id": 10,
      "subject": "Doc: R2-09 connect-throttle seam note on EnsureConnectedAsync <remarks> (STAB-8 S7 part, note-only)",
      "status": "completed",
-      "blockedBy": [3]
+      "blockedBy": [
+        3
+      ]
    },
    {
      "id": 11,
      "subject": "Env-gated live connect-timeout outage test (S7_TIMEOUT_OUTAGE_START_CMD/STOP_CMD blackhole design; skips cleanly offline)",
-      "status": "deferred-live",
+      "status": "completed",
      "note": "env-gated; runs in serial live pass (integration suite; serialized heavy pass). Test authored + committed; verified it SKIPs cleanly offline.",
-      "blockedBy": [5]
+      "blockedBy": [
+        5
+      ],
+      "closureNote": "LIVE GATE CLOSED 2026-07-15 \u2014 S7 blackhole run via `docker pause` on the 10.100.0.35 s7_1500 fixture. Found + fixed a real read-leg wall-clock gap (PR #453). STATUS.md 'docker-dev live-/run pass'."
    },
    {
      "id": 12,
      "subject": "Close-out: whole-suite sweep + update archreview STATUS.md and 05 prior-finding table (STAB-14/15 FIXED, STAB-8 seam noted)",
      "status": "completed",
      "note": "S7 unit 246/246 green; S7 CLI 48/49 (1 pre-existing unrelated comment-scan failure, see deviations); solution BUILD clean (0 errors). Whole-solution dotnet test NOT run per controller memory-constraint (integration suites deferred to serial heavy pass).",
-      "blockedBy": [5, 7, 8, 9, 10, 11]
+      "blockedBy": [
+        5,
+        7,
+        8,
+        9,
+        10,
+        11
+      ]
    }
  ],
-  "lastUpdated": "2026-07-13"
+  "lastUpdated": "2026-07-27"
 }
@@ -1,25 +1,170 @@
 {
  "planPath": "archreview/plans/R2-02-resilience-config-hardening-plan.md",
  "tasks": [
-    { "id": 0, "subject": "S-6 brick-repro test (RED): parsed timeoutSeconds:0 / breakerFailureThreshold:1 must not brick capability calls — ResilienceConfigBrickTests, expect 2 failures on f6eaa267", "status": "completed", "blockedBy": [] },
-    { "id": 1, "subject": "Add ResiliencePolicyRanges constants to Core.Abstractions (single source of truth for parser/builder/AdminUI, derived from Polly.Core 8.6.6 validation)", "status": "completed", "blockedBy": [] },
-    { "id": 2, "subject": "S-6 parser: clamp timeout/retry/breaker overrides with appending diagnostics (timeout<=0 -> tier default; breaker==1 -> 2; caps) + 8 parser tests", "status": "completed", "blockedBy": [0, 1] },
-    { "id": 3, "subject": "S-6 builder: belt-and-braces clamp in Build so pipeline construction can never throw ValidationException + Build_NeverThrows_ForHostileDirectOptions (turns task 0 green)", "status": "completed", "blockedBy": [0, 1] },
-    { "id": 4, "subject": "S-6 production-wiring guard: DriverCapabilityInvokerFactory.Create with hostile JSON yields a working invoker + logged clamp diagnostic; re-run ResilienceInvokerFactoryRegistrationTests", "status": "completed", "blockedBy": [2, 3] },
-    { "id": 5, "subject": "S-6 AdminUI: ResilienceFormModel.Validate() range messages (via ResiliencePolicyRanges through the transitive Core.Abstractions ref) + warning block in DriverResilienceSection", "status": "completed", "blockedBy": [1] },
-    { "id": 6, "subject": "S-8 parser layer: force Write/AlarmAcknowledge retryCount overrides to 0 with diagnostic (spec invariant, honest dead-knob surfacing) + tests + GetTierDefaults doc", "status": "completed", "blockedBy": [2] },
-    { "id": 7, "subject": "S-8 dispatch layer: flip HandleWriteAsync to isIdempotent:false — RED the DriverInstanceActorResilienceWiringTests expectation first, then flip; full Runtime suite green", "status": "completed", "blockedBy": [6] },
-    { "id": 8, "subject": "S-8/P-4 invoker: cache the no-retry options snapshot once per invoker + add RecordCallStart/Complete tracker accounting to the non-idempotent arm + 2 CapabilityInvokerTests", "status": "completed", "blockedBy": [7] },
-    { "id": 9, "subject": "S-8 docs + form: fix WriteIdempotentAttribute's false 'reads via reflection' claim; note the non-idempotent production default; disable Write/Ack retry cells in the razor", "status": "completed", "blockedBy": [7, 5] },
-    { "id": 10, "subject": "U-6 delete (Core): remove BulkheadMaxConcurrent/MaxQueue from DriverResilienceOptions + parser shape/merge/doc-example; add BulkheadKeys_InStoredJson_AreIgnored (migration-free contract)", "status": "completed", "blockedBy": [2, 6] },
-    { "id": 11, "subject": "U-6 delete (AdminUI): strip bulkhead fields from ResilienceFormModel + the two razor inputs; update ResilienceFormModelTests", "status": "completed", "blockedBy": [5, 10] },
-    { "id": 12, "subject": "U-6 doc sweep (seam xmldocs, OTOPCUA0001 message + analyzer tests, operator docs; leave migrations/WedgeDetector/historical plans) + Options_properties_are_exactly_the_pipeline_wired_set knob-inertness guard", "status": "completed", "blockedBy": [10, 11] },
-    { "id": 13, "subject": "C-7 RED tests: unknown top-level key / unknown capability / unknown per-policy field survive round-trip; malformed JSON sets ParseFailed and ToJson returns the original text", "status": "completed", "blockedBy": [11] },
-    { "id": 14, "subject": "C-7 implement: JsonObject-bag FromJson/ToJson (TagConfigJson idiom), ParseFailed + RawStoredJson, blank->null contract preserved, parser-interop test green", "status": "completed", "blockedBy": [13] },
-    { "id": 15, "subject": "C-7 razor: ParseFailed warning banner + input lockout + explicit discard button; raw pane shows the stored ResilienceConfig; live-/run on docker-dev :9200 (rebuild BOTH centrals; SQL-mangle + unknown-key survival checks; also drive task 5 warnings and task 9 disabled cells)", "status": "deferred-live", "note": "docker-dev :9200 live-/run; serial live pass", "blockedBy": [14] },
-    { "id": 16, "subject": "S-7 builder: add options-generation to PipelineKey + GetOrCreate(optionsGeneration=0) + thread through CapabilityInvoker; StaleGeneration_ReCache_IsNotServed_ToNewGeneration", "status": "completed", "blockedBy": [3] },
-    { "id": 17, "subject": "S-7 factory: Interlocked per-Create generation stamp + Respawn_interleaved_with_old_invoker_call_still_applies_new_options wiring proof; update Invalidate comment (cleanup, not correctness)", "status": "completed", "blockedBy": [16] },
-    { "id": 18, "subject": "Wrap-up: whole-solution build (0 warnings, analyzer silent) + full dotnet test gate; record the pass + the two report anchor drifts in archreview/plans/STATUS.md", "status": "deferred-live", "note": "integration/full sweep; serialized heavy pass", "blockedBy": [4, 8, 9, 12, 15, 17] }
+    {
+      "id": 0,
+      "subject": "S-6 brick-repro test (RED): parsed timeoutSeconds:0 / breakerFailureThreshold:1 must not brick capability calls \u2014 ResilienceConfigBrickTests, expect 2 failures on f6eaa267",
+      "status": "completed",
+      "blockedBy": []
+    },
+    {
+      "id": 1,
+      "subject": "Add ResiliencePolicyRanges constants to Core.Abstractions (single source of truth for parser/builder/AdminUI, derived from Polly.Core 8.6.6 validation)",
+      "status": "completed",
+      "blockedBy": []
+    },
+    {
+      "id": 2,
+      "subject": "S-6 parser: clamp timeout/retry/breaker overrides with appending diagnostics (timeout<=0 -> tier default; breaker==1 -> 2; caps) + 8 parser tests",
+      "status": "completed",
+      "blockedBy": [
+        0,
+        1
+      ]
+    },
+    {
+      "id": 3,
+      "subject": "S-6 builder: belt-and-braces clamp in Build so pipeline construction can never throw ValidationException + Build_NeverThrows_ForHostileDirectOptions (turns task 0 green)",
+      "status": "completed",
+      "blockedBy": [
+        0,
+        1
+      ]
+    },
+    {
+      "id": 4,
+      "subject": "S-6 production-wiring guard: DriverCapabilityInvokerFactory.Create with hostile JSON yields a working invoker + logged clamp diagnostic; re-run ResilienceInvokerFactoryRegistrationTests",
+      "status": "completed",
+      "blockedBy": [
+        2,
+        3
+      ]
+    },
+    {
+      "id": 5,
+      "subject": "S-6 AdminUI: ResilienceFormModel.Validate() range messages (via ResiliencePolicyRanges through the transitive Core.Abstractions ref) + warning block in DriverResilienceSection",
+      "status": "completed",
+      "blockedBy": [
+        1
+      ]
+    },
+    {
+      "id": 6,
+      "subject": "S-8 parser layer: force Write/AlarmAcknowledge retryCount overrides to 0 with diagnostic (spec invariant, honest dead-knob surfacing) + tests + GetTierDefaults doc",
+      "status": "completed",
+      "blockedBy": [
+        2
+      ]
+    },
+    {
+      "id": 7,
+      "subject": "S-8 dispatch layer: flip HandleWriteAsync to isIdempotent:false \u2014 RED the DriverInstanceActorResilienceWiringTests expectation first, then flip; full Runtime suite green",
+      "status": "completed",
+      "blockedBy": [
+        6
+      ]
+    },
+    {
+      "id": 8,
+      "subject": "S-8/P-4 invoker: cache the no-retry options snapshot once per invoker + add RecordCallStart/Complete tracker accounting to the non-idempotent arm + 2 CapabilityInvokerTests",
+      "status": "completed",
+      "blockedBy": [
+        7
+      ]
+    },
+    {
+      "id": 9,
+      "subject": "S-8 docs + form: fix WriteIdempotentAttribute's false 'reads via reflection' claim; note the non-idempotent production default; disable Write/Ack retry cells in the razor",
+      "status": "completed",
+      "blockedBy": [
+        7,
+        5
+      ]
+    },
+    {
+      "id": 10,
+      "subject": "U-6 delete (Core): remove BulkheadMaxConcurrent/MaxQueue from DriverResilienceOptions + parser shape/merge/doc-example; add BulkheadKeys_InStoredJson_AreIgnored (migration-free contract)",
+      "status": "completed",
+      "blockedBy": [
+        2,
+        6
+      ]
+    },
+    {
+      "id": 11,
+      "subject": "U-6 delete (AdminUI): strip bulkhead fields from ResilienceFormModel + the two razor inputs; update ResilienceFormModelTests",
+      "status": "completed",
+      "blockedBy": [
+        5,
+        10
+      ]
+    },
+    {
+      "id": 12,
+      "subject": "U-6 doc sweep (seam xmldocs, OTOPCUA0001 message + analyzer tests, operator docs; leave migrations/WedgeDetector/historical plans) + Options_properties_are_exactly_the_pipeline_wired_set knob-inertness guard",
+      "status": "completed",
+      "blockedBy": [
+        10,
+        11
+      ]
+    },
+    {
+      "id": 13,
+      "subject": "C-7 RED tests: unknown top-level key / unknown capability / unknown per-policy field survive round-trip; malformed JSON sets ParseFailed and ToJson returns the original text",
+      "status": "completed",
+      "blockedBy": [
+        11
+      ]
+    },
+    {
+      "id": 14,
+      "subject": "C-7 implement: JsonObject-bag FromJson/ToJson (TagConfigJson idiom), ParseFailed + RawStoredJson, blank->null contract preserved, parser-interop test green",
+      "status": "completed",
+      "blockedBy": [
+        13
+      ]
+    },
+    {
+      "id": 15,
+      "subject": "C-7 razor: ParseFailed warning banner + input lockout + explicit discard button; raw pane shows the stored ResilienceConfig; live-/run on docker-dev :9200 (rebuild BOTH centrals; SQL-mangle + unknown-key survival checks; also drive task 5 warnings and task 9 disabled cells)",
+      "status": "completed",
+      "note": "docker-dev :9200 live-/run; serial live pass",
+      "blockedBy": [
+        14
+      ],
+      "closureNote": "LIVE GATE CLOSED 2026-07-13 \u2014 range-validation banner verified on the docker-dev Modbus driver's Resilience overrides (`timeoutSeconds:0`). STATUS.md 'docker-dev live-/run pass'."
+    },
+    {
+      "id": 16,
+      "subject": "S-7 builder: add options-generation to PipelineKey + GetOrCreate(optionsGeneration=0) + thread through CapabilityInvoker; StaleGeneration_ReCache_IsNotServed_ToNewGeneration",
+      "status": "completed",
+      "blockedBy": [
+        3
+      ]
+    },
+    {
+      "id": 17,
+      "subject": "S-7 factory: Interlocked per-Create generation stamp + Respawn_interleaved_with_old_invoker_call_still_applies_new_options wiring proof; update Invalidate comment (cleanup, not correctness)",
+      "status": "completed",
+      "blockedBy": [
+        16
+      ]
+    },
+    {
+      "id": 18,
+      "subject": "Wrap-up: whole-solution build (0 warnings, analyzer silent) + full dotnet test gate; record the pass + the two report anchor drifts in archreview/plans/STATUS.md",
+      "status": "completed",
+      "note": "integration/full sweep; serialized heavy pass",
+      "blockedBy": [
+        4,
+        8,
+        9,
+        12,
+        15,
+        17
+      ],
+      "closureNote": "LIVE GATE CLOSED 2026-07-13 \u2014 S-8 verified: Write and AlarmAcknowledge RETRIES cells disabled ('never'). STATUS.md 'docker-dev live-/run pass'."
+    }
  ],
-  "lastUpdated": "2026-07-12"
+  "lastUpdated": "2026-07-27"
 }
@@ -3,7 +3,7 @@
  "tasks": [
    {
      "id": "R2-03-T1",
-      "subject": "S13 stale-Good repro test at host level (RED — must fail on f6eaa267): fail-after-success evaluator, publish probe sees Good then expects Bad AttributeValueUpdate",
+      "subject": "S13 stale-Good repro test at host level (RED \u2014 must fail on f6eaa267): fail-after-success evaluator, publish probe sees Good then expects Bad AttributeValueUpdate",
      "status": "completed",
      "blockedBy": []
    },
@@ -62,7 +62,7 @@
    },
    {
      "id": "R2-03-T9",
-      "subject": "P7 wiring-guard rewrite (RED): ApplyVirtualTags clears the compile cache only when the expression set changes — identical redeploy must NOT clear; expression edit must; shared-expression removal must not",
+      "subject": "P7 wiring-guard rewrite (RED): ApplyVirtualTags clears the compile cache only when the expression set changes \u2014 identical redeploy must NOT clear; expression edit must; shared-expression removal must not",
      "status": "completed",
      "blockedBy": [
        "R2-03-T3"
@@ -86,7 +86,8 @@
        "R2-03-T8",
        "R2-03-T10"
      ],
-      "note": "integration/full sweep; serialized heavy pass (build clean, Runtime.Tests 372/372, RoslynVirtualTagEvaluatorTests 20/20 verified locally; whole-solution/cross-suite sweep deferred per controller memory constraint)"
+      "note": "integration/full sweep; serialized heavy pass (build clean, Runtime.Tests 372/372, RoslynVirtualTagEvaluatorTests 20/20 verified locally; whole-solution/cross-suite sweep deferred per controller memory constraint)",
+      "openNote": "STILL OPEN \u2014 live-blocked on a data-less rig: every materialised node reads Bad_WaitingForInitialData because no driver data flows, so a VT cannot be staged Good->Bad. Needs a reachable driver fixture feeding the VT. Unit-verified meanwhile."
    },
    {
      "id": "R2-03-T12",
@@ -95,8 +96,9 @@
      "blockedBy": [
        "R2-03-T11"
      ],
-      "note": "docker-dev live-/run; serial live pass"
+      "note": "docker-dev live-/run; serial live pass",
+      "openNote": "STILL OPEN \u2014 same blocker as T11. Confirmed still open 2026-07-27 (deferment.md \u00a78.5)."
    }
  ],
-  "lastUpdated": "2026-07-13"
+  "lastUpdated": "2026-07-27"
 }
@@ -1,22 +1,146 @@
 {
  "planPath": "archreview/plans/R2-05-adminui-authz-plan.md",
-  "lastUpdated": "2026-07-12",
+  "lastUpdated": "2026-07-27",
  "tasks": [
-    { "id": "T1", "subject": "Add AdminUiPolicies constants class (Security/Auth/AdminUiPolicies.cs)", "status": "completed", "blockedBy": [] },
-    { "id": "T2", "subject": "Policy-semantics unit test AdminUiPoliciesTests (RED: ConfigEditor/AuthenticatedRead unregistered)", "status": "completed", "blockedBy": ["T1"] },
-    { "id": "T3", "subject": "Reflection PageAuthorizationGuardTests (RED: must list ~35 ungated/mis-idiom pages)", "status": "completed", "blockedBy": ["T1"] },
-    { "id": "T4", "subject": "Register ConfigEditor + AuthenticatedRead policies; switch existing AddPolicy literals to constants (GREEN for T2)", "status": "completed", "blockedBy": ["T2"] },
-    { "id": "T5", "subject": "_Imports.razor usings (Authorization + Security.Auth) + de-dupe Deployments/Alerts in-file @using", "status": "completed", "blockedBy": ["T1"] },
-    { "id": "T6", "subject": "Gate UNS pages with ConfigEditor (GlobalUns, EquipmentPage)", "status": "completed", "blockedBy": ["T4", "T5"] },
-    { "id": "T7", "subject": "Gate cluster editors with ConfigEditor (NewCluster, ClusterEdit, NodeEdit, NamespaceEdit, AclEdit)", "status": "completed", "blockedBy": ["T4", "T5"] },
-    { "id": "T8", "subject": "Gate driver pages + routers with ConfigEditor (8 driver pages, DriverTypePicker, DriverEditRouter)", "status": "completed", "blockedBy": ["T4", "T5"] },
-    { "id": "T9", "subject": "Converge Deployments/Scripts/ScriptEdit from Roles-string to ConfigEditor policy", "status": "completed", "blockedBy": ["T4", "T5"] },
-    { "id": "T10", "subject": "Read pages to AuthenticatedRead (16 incl. Home insert) + RoleGrants to FleetAdmin constant", "status": "completed", "blockedBy": ["T4", "T5"] },
-    { "id": "T11", "subject": "Guard GREEN checkpoint + full AdminUI.Tests; commit the gate", "status": "completed", "blockedBy": ["T3", "T6", "T7", "T8", "T9", "T10"] },
-    { "id": "T12", "subject": "Converge non-page literals to constants (ScriptAnalysisEndpoints, imperative DriverOperator x4, Certificates FleetAdmin x2)", "status": "completed", "blockedBy": ["T11"] },
-    { "id": "T13", "subject": "Docs: CLAUDE.md ScriptAnalysis gate sentence, docs/security.md, STATUS.md R2-05 row", "status": "completed", "blockedBy": ["T11"] },
-    { "id": "T14", "subject": "Full-solution test sweep (dotnet test ZB.MOM.WW.OtOpcUa.slnx)", "status": "completed", "blockedBy": ["T12", "T13"], "note": "Impacted unit suites authoritative + green: AdminUI.Tests 517/517, Security.Tests 80/80. One whole-solution sweep ran BEFORE the controller's no-whole-solution/no-IntegrationTests constraint arrived; all failures are pre-existing/env and outside the R2-05 diff (Core.Abstractions.Tests InterfaceIndependence flags pre-existing Historian.* namespace types; Runtime historian retry timing; OpcUaClient.Browser needs a live OPC endpoint; AbCip/OpcUaServer/Host IntegrationTests need Docker fixtures). Will NOT be re-run per constraint." },
-    { "id": "T15", "subject": "Live /run positive pass on docker-dev :9200 (rebuild BOTH centrals; auto-admin drives all page tiers; negative proof stays in T2/T3)", "status": "deferred-live", "blockedBy": ["T14"], "note": "docker-dev live authz /run; serial live pass. Heavy integration/Playwright-dependent gate — controller runs serialized. docker-dev DisableLogin=true auto-authenticates as full-access admin, so role-deny differentiation is NOT observable there; the negative proof is CI-side (T2 AdminUiPoliciesTests + T3 PageAuthorizationGuardTests, both green). This pass only regression-checks over-gating (a typo'd policy name would render the deny slot even for the auto-admin)." },
-    { "id": "T16", "subject": "Merge + bookkeeping (flip 04/C-1 row, record Reservations/ClusterRedundancy corrections)", "status": "completed", "blockedBy": ["T15"] }
+    {
+      "id": "T1",
+      "subject": "Add AdminUiPolicies constants class (Security/Auth/AdminUiPolicies.cs)",
+      "status": "completed",
+      "blockedBy": []
+    },
+    {
+      "id": "T2",
+      "subject": "Policy-semantics unit test AdminUiPoliciesTests (RED: ConfigEditor/AuthenticatedRead unregistered)",
+      "status": "completed",
+      "blockedBy": [
+        "T1"
+      ]
+    },
+    {
+      "id": "T3",
+      "subject": "Reflection PageAuthorizationGuardTests (RED: must list ~35 ungated/mis-idiom pages)",
+      "status": "completed",
+      "blockedBy": [
+        "T1"
+      ]
+    },
+    {
+      "id": "T4",
+      "subject": "Register ConfigEditor + AuthenticatedRead policies; switch existing AddPolicy literals to constants (GREEN for T2)",
+      "status": "completed",
+      "blockedBy": [
+        "T2"
+      ]
+    },
+    {
+      "id": "T5",
+      "subject": "_Imports.razor usings (Authorization + Security.Auth) + de-dupe Deployments/Alerts in-file @using",
+      "status": "completed",
+      "blockedBy": [
+        "T1"
+      ]
+    },
+    {
+      "id": "T6",
+      "subject": "Gate UNS pages with ConfigEditor (GlobalUns, EquipmentPage)",
+      "status": "completed",
+      "blockedBy": [
+        "T4",
+        "T5"
+      ]
+    },
+    {
+      "id": "T7",
+      "subject": "Gate cluster editors with ConfigEditor (NewCluster, ClusterEdit, NodeEdit, NamespaceEdit, AclEdit)",
+      "status": "completed",
+      "blockedBy": [
+        "T4",
+        "T5"
+      ]
+    },
+    {
+      "id": "T8",
+      "subject": "Gate driver pages + routers with ConfigEditor (8 driver pages, DriverTypePicker, DriverEditRouter)",
+      "status": "completed",
+      "blockedBy": [
+        "T4",
+        "T5"
+      ]
+    },
+    {
+      "id": "T9",
+      "subject": "Converge Deployments/Scripts/ScriptEdit from Roles-string to ConfigEditor policy",
+      "status": "completed",
+      "blockedBy": [
+        "T4",
+        "T5"
+      ]
+    },
+    {
+      "id": "T10",
+      "subject": "Read pages to AuthenticatedRead (16 incl. Home insert) + RoleGrants to FleetAdmin constant",
+      "status": "completed",
+      "blockedBy": [
+        "T4",
+        "T5"
+      ]
+    },
+    {
+      "id": "T11",
+      "subject": "Guard GREEN checkpoint + full AdminUI.Tests; commit the gate",
+      "status": "completed",
+      "blockedBy": [
+        "T3",
+        "T6",
+        "T7",
+        "T8",
+        "T9",
+        "T10"
+      ]
+    },
+    {
+      "id": "T12",
+      "subject": "Converge non-page literals to constants (ScriptAnalysisEndpoints, imperative DriverOperator x4, Certificates FleetAdmin x2)",
+      "status": "completed",
+      "blockedBy": [
+        "T11"
+      ]
+    },
+    {
+      "id": "T13",
+      "subject": "Docs: CLAUDE.md ScriptAnalysis gate sentence, docs/security.md, STATUS.md R2-05 row",
+      "status": "completed",
+      "blockedBy": [
+        "T11"
+      ]
+    },
+    {
+      "id": "T14",
+      "subject": "Full-solution test sweep (dotnet test ZB.MOM.WW.OtOpcUa.slnx)",
+      "status": "completed",
+      "blockedBy": [
+        "T12",
+        "T13"
+      ],
+      "note": "Impacted unit suites authoritative + green: AdminUI.Tests 517/517, Security.Tests 80/80. One whole-solution sweep ran BEFORE the controller's no-whole-solution/no-IntegrationTests constraint arrived; all failures are pre-existing/env and outside the R2-05 diff (Core.Abstractions.Tests InterfaceIndependence flags pre-existing Historian.* namespace types; Runtime historian retry timing; OpcUaClient.Browser needs a live OPC endpoint; AbCip/OpcUaServer/Host IntegrationTests need Docker fixtures). Will NOT be re-run per constraint."
+    },
+    {
+      "id": "T15",
+      "subject": "Live /run positive pass on docker-dev :9200 (rebuild BOTH centrals; auto-admin drives all page tiers; negative proof stays in T2/T3)",
+      "status": "completed",
+      "blockedBy": [
+        "T14"
+      ],
+      "note": "docker-dev live authz /run; serial live pass. Heavy integration/Playwright-dependent gate \u2014 controller runs serialized. docker-dev DisableLogin=true auto-authenticates as full-access admin, so role-deny differentiation is NOT observable there; the negative proof is CI-side (T2 AdminUiPoliciesTests + T3 PageAuthorizationGuardTests, both green). This pass only regression-checks over-gating (a typo'd policy name would render the deny slot even for the auto-admin).",
+      "closureNote": "LIVE GATE CLOSED 2026-07-13 (partial by design) \u2014 every config/read page renders under the all-roles multi-role-test session, so named-policy gating does not over-gate a legitimate admin. The DENY direction is unobservable on docker-dev (DisableLogin=true), as documented."
+    },
+    {
+      "id": "T16",
+      "subject": "Merge + bookkeeping (flip 04/C-1 row, record Reservations/ClusterRedundancy corrections)",
+      "status": "completed",
+      "blockedBy": [
+        "T15"
+      ]
+    }
  ]
 }
@@ -1,16 +1,16 @@
 {
  "planPath": "archreview/plans/R2-06-serverhistorian-failfast-plan.md",
-  "lastUpdated": "2026-07-12",
+  "lastUpdated": "2026-07-27",
  "tasks": [
    {
      "id": "T1",
-      "subject": "RED: misconfig repro test — HistorianGatewayClientAdapter.Create with empty/malformed Endpoint must throw a named InvalidOperationException (currently UriFormatException; test MUST fail on current code)",
+      "subject": "RED: misconfig repro test \u2014 HistorianGatewayClientAdapter.Create with empty/malformed Endpoint must throw a named InvalidOperationException (currently UriFormatException; test MUST fail on current code)",
      "status": "completed",
      "blockedBy": []
    },
    {
      "id": "T2",
-      "subject": "GREEN: adapter guard — Uri.TryCreate + InvalidOperationException naming ServerHistorian:Endpoint in HistorianGatewayClientAdapter.Create (defense in depth)",
+      "subject": "GREEN: adapter guard \u2014 Uri.TryCreate + InvalidOperationException naming ServerHistorian:Endpoint in HistorianGatewayClientAdapter.Create (defense in depth)",
      "status": "completed",
      "blockedBy": [
        "T1"
@@ -50,7 +50,7 @@
    },
    {
      "id": "T7",
-      "subject": "U-7 pin: GatewayTagProvisionerTests Boolean_definition_carries_explicit_Int1_presence (asserts HistorianDataType.Int1 AND HasDataType — 0.2.0 proto3-optional presence witness; pin, no RED phase)",
+      "subject": "U-7 pin: GatewayTagProvisionerTests Boolean_definition_carries_explicit_Int1_presence (asserts HistorianDataType.Int1 AND HasDataType \u2014 0.2.0 proto3-optional presence witness; pin, no RED phase)",
      "status": "completed",
      "blockedBy": []
    },
@@ -89,12 +89,13 @@
    {
      "id": "T12",
      "subject": "OPERATOR GATE: run Category=LiveIntegration on the VPN against a 0.2.0 gateway (all 6 tests, incl. Boolean EnsureTags + retype probe); record the observed retype policy back into docs/Historian.md + STATUS.md; also discharges 06/U-2's full documented run",
-      "status": "deferred-live",
+      "status": "completed",
      "blockedBy": [
        "T9",
        "T11"
      ],
-      "note": "DONE 2026-07-13 on VPN vs a real 0.2.0 gateway (deployed locally in Docker → real AVEVA historian on wonder-sql-vd03 + Runtime SQL). 5/6 green. Found+FIXED a real OtOpcUa bug (PR #439, master 666908d7): GatewayTagProvisioner sent StorageRateMs=0 → gateway EnsureTags threw ArgumentOutOfRangeException → ALL historized-tag provisioning silently failed; stamp 1000ms + regression test. U-7 retype policy ANSWERED: EnsureTags is a real upsert; in-place retype between SUPPORTED types is ACCEPTED (Float→Double=success); but Int1 (0.2.0 Boolean target) is NOT creatable on this histsdk (ProtocolEvidenceMissingException — Int1-only; Int2/UInt2/Int4/UInt4/Float/Double all provision), so a pre-bump Float Boolean asked to become Int1 FAILS the provision (not silently retyped/data-lost). The 1 red test (Boolean→Int1) is a gateway histsdk type-support gap, not OtOpcUa. Deployment fixes: FQDN host + libgssapi-krb5-2/gss-ntlmssp in the gateway image + wonderapp SQL login for Runtime. Full record in STATUS.md."
+      "note": "DONE 2026-07-13 on VPN vs a real 0.2.0 gateway (deployed locally in Docker \u2192 real AVEVA historian on wonder-sql-vd03 + Runtime SQL). 5/6 green. Found+FIXED a real OtOpcUa bug (PR #439, master 666908d7): GatewayTagProvisioner sent StorageRateMs=0 \u2192 gateway EnsureTags threw ArgumentOutOfRangeException \u2192 ALL historized-tag provisioning silently failed; stamp 1000ms + regression test. U-7 retype policy ANSWERED: EnsureTags is a real upsert; in-place retype between SUPPORTED types is ACCEPTED (Float\u2192Double=success); but Int1 (0.2.0 Boolean target) is NOT creatable on this histsdk (ProtocolEvidenceMissingException \u2014 Int1-only; Int2/UInt2/Int4/UInt4/Float/Double all provision), so a pre-bump Float Boolean asked to become Int1 FAILS the provision (not silently retyped/data-lost). The 1 red test (Boolean\u2192Int1) is a gateway histsdk type-support gap, not OtOpcUa. Deployment fixes: FQDN host + libgssapi-krb5-2/gss-ntlmssp in the gateway image + wonderapp SQL login for Runtime. Full record in STATUS.md.",
+      "closureNote": "LIVE GATE CLOSED 2026-07-13 (6/6) \u2014 vs. the local 0.2.0 gateway + real historian over VPN. STATUS.md 'docker-dev live-/run pass'."
    }
  ]
 }
@@ -1,6 +1,6 @@
 {
  "planPath": "archreview/plans/R2-07-surgical-pure-adds-plan.md",
-  "lastUpdated": "2026-07-12",
+  "lastUpdated": "2026-07-27",
  "tasks": [
    {
      "id": "T1",
@@ -45,20 +45,22 @@
    {
      "id": "T5",
      "subject": "Phase 1: over-the-wire SubscriptionSurvivalTests \u2014 subscribe, pure-add, item survives + new node browsable",
-      "status": "deferred-live",
+      "status": "completed",
      "blockedBy": [
        "T4b"
      ],
-      "note": "authored + compiles (dotnet build green); NOT run \u2014 *.IntegrationTests suite leaks ~16GB/run per the memory constraint. MUST run in the serial heavy integration pass (single-test, boots one in-process server + client)."
+      "note": "authored + compiles (dotnet build green); NOT run \u2014 *.IntegrationTests suite leaks ~16GB/run per the memory constraint. MUST run in the serial heavy integration pass (single-test, boots one in-process server + client).",
+      "closureNote": "LIVE GATE CLOSED 2026-07-13 \u2014 central-1 boot logged PureAdd (added=91, rebuild=False)."
    },
    {
      "id": "T6",
      "subject": "Phase 1: MANDATORY live-/run gate on docker-dev (rebuild BOTH centrals; Client.CLI subscribe survives +1-tag deploy; kind=PureAdd rebuild=False) \u2014 Phase 1 shippable boundary",
-      "status": "deferred-live",
+      "status": "completed",
      "blockedBy": [
        "T5"
      ],
-      "note": "docker-dev live /run surgical-path; serial heavy pass \u2014 F10b inertness risk, MUST run (subscribe survives +1-tag deploy; central log kind=PureAdd, rebuild=False; new node browsable/Good)."
+      "note": "docker-dev live /run surgical-path; serial heavy pass \u2014 F10b inertness risk, MUST run (subscribe survives +1-tag deploy; central log kind=PureAdd, rebuild=False; new node browsable/Good).",
+      "closureNote": "LIVE GATE CLOSED 2026-07-13 \u2014 deleting a UNS virtual tag logged PureRemove (removed=1, rebuild=False) and the node vanished from the address space."
    },
    {
      "id": "T7",
@@ -104,11 +106,12 @@
    {
      "id": "T12",
      "subject": "Phase 2: remove-side subscription-survival integration test + live-/run remove gate (kind=PureRemove rebuild=False) \u2014 Phase 2 shippable boundary",
-      "status": "deferred-live",
+      "status": "completed",
      "blockedBy": [
        "T11"
      ],
-      "note": "remove-side SubscriptionSurvivalTests authored + compiles (dotnet build green); NOT run \u2014 *.IntegrationTests memory constraint. Live docker-dev pure-remove gate (survivor subscription uninterrupted; central log kind=PureRemove, rebuild=False; removed node reads BadNodeIdUnknown) MUST run in the serial heavy pass \u2014 F10b inertness risk."
+      "note": "remove-side SubscriptionSurvivalTests authored + compiles (dotnet build green); NOT run \u2014 *.IntegrationTests memory constraint. Live docker-dev pure-remove gate (survivor subscription uninterrupted; central log kind=PureRemove, rebuild=False; removed node reads BadNodeIdUnknown) MUST run in the serial heavy pass \u2014 F10b inertness risk.",
+      "closureNote": "LIVE GATE CLOSED 2026-07-13 \u2014 surgical add AND remove both execute in prod with no full rebuild; the remove path's 3 new sink members are wired, not inert."
    },
    {
      "id": "T13",
@@ -121,11 +124,12 @@
    {
      "id": "T14",
      "subject": "Phase 3: mixed-deploy integration test + live-/run mixed gate + STATUS.md/P1 close-out \u2014 plan complete",
-      "status": "deferred-live",
+      "status": "completed",
      "blockedBy": [
        "T13"
      ],
-      "note": "mixed-deploy SubscriptionSurvivalTests authored + compiles (dotnet build green); docs close-out DONE (STATUS.md + 03/P1 marked REMEDIATED + plan deviations). Live docker-dev mixed gate (one deploy +1/-1; kind=AddRemoveMix, rebuild=False; survivor uninterrupted) MUST run in the serial heavy pass \u2014 F10b inertness risk."
+      "note": "mixed-deploy SubscriptionSurvivalTests authored + compiles (dotnet build green); docs close-out DONE (STATUS.md + 03/P1 marked REMEDIATED + plan deviations). Live docker-dev mixed gate (one deploy +1/-1; kind=AddRemoveMix, rebuild=False; survivor uninterrupted) MUST run in the serial heavy pass \u2014 F10b inertness risk.",
+      "closureNote": "LIVE GATE CLOSED 2026-07-13 \u2014 see T5/T6/T12. STATUS.md 'docker-dev live-/run pass'."
    }
  ]
 }
@@ -1,17 +1,94 @@
 {
  "planPath": "archreview/plans/R2-10-resilience-observability-plan.md",
-  "lastUpdated": "2026-07-12",
+  "lastUpdated": "2026-07-27",
  "tasks": [
-    { "id": "T1", "subject": "Tracker: LastBreakerClosedUtc + IsBreakerOpen + RecordBreakerClose (Core, TDD in DriverResilienceStatusTrackerTests)", "status": "completed", "blockedBy": [] },
-    { "id": "T2", "subject": "Builder: OnClosed records breaker-close on the tracker (TDD in DriverResiliencePipelineBuilderTests)", "status": "completed", "blockedBy": ["T1"] },
-    { "id": "T3", "subject": "Invoker: successful Execute* resets ConsecutiveFailures (TDD in CapabilityInvokerTests)", "status": "completed", "blockedBy": ["T1"] },
-    { "id": "T4", "subject": "Commons: DriverResilienceStatusChanged record + driver-resilience-status TopicName", "status": "completed", "blockedBy": [] },
-    { "id": "T5", "subject": "Host: DriverResilienceStatusPublisherService (BuildMessages mapping + 5s DPS timer shell; TDD mapping in Host.IntegrationTests)", "status": "completed", "blockedBy": ["T1", "T4"] },
-    { "id": "T6", "subject": "Host DI: register the publisher in AddOtOpcUaDriverFactories + ResilienceStatusReaderRegistrationTests wiring guard (tracker HAS a production reader)", "status": "completed", "blockedBy": ["T5"] },
-    { "id": "T7", "subject": "AdminUI: IDriverResilienceStatusStore + InMemory impl + AddOtOpcUaDriverStatusServices registration (TDD mirroring DriverStatusSnapshotStoreTests)", "status": "completed", "blockedBy": ["T4"] },
-    { "id": "T8", "subject": "AdminUI: DriverResilienceStatusBridge DPS actor + spawn in WithOtOpcUaSignalRBridges", "status": "completed", "blockedBy": ["T7"] },
-    { "id": "T9", "subject": "AdminUI: resilience chip section in DriverStatusPanel.razor (in-process store read; no bUnit — verified by T10)", "status": "completed", "blockedBy": ["T7"] },
-    { "id": "T10", "subject": "Live-/run gate on docker-dev: rebuild BOTH centrals, S7 dead-endpoint breaker-open, both-replica chips, recovery clear, staleness dim", "status": "deferred-live", "blockedBy": ["T6", "T8", "T9"] },
-    { "id": "T11", "subject": "Docs + review ledger: mark 03/U10 + 04/U-5 remediated; update STATUS.md + FOLLOWUP-10", "status": "completed", "blockedBy": ["T10"] }
+    {
+      "id": "T1",
+      "subject": "Tracker: LastBreakerClosedUtc + IsBreakerOpen + RecordBreakerClose (Core, TDD in DriverResilienceStatusTrackerTests)",
+      "status": "completed",
+      "blockedBy": []
+    },
+    {
+      "id": "T2",
+      "subject": "Builder: OnClosed records breaker-close on the tracker (TDD in DriverResiliencePipelineBuilderTests)",
+      "status": "completed",
+      "blockedBy": [
+        "T1"
+      ]
+    },
+    {
+      "id": "T3",
+      "subject": "Invoker: successful Execute* resets ConsecutiveFailures (TDD in CapabilityInvokerTests)",
+      "status": "completed",
+      "blockedBy": [
+        "T1"
+      ]
+    },
+    {
+      "id": "T4",
+      "subject": "Commons: DriverResilienceStatusChanged record + driver-resilience-status TopicName",
+      "status": "completed",
+      "blockedBy": []
+    },
+    {
+      "id": "T5",
+      "subject": "Host: DriverResilienceStatusPublisherService (BuildMessages mapping + 5s DPS timer shell; TDD mapping in Host.IntegrationTests)",
+      "status": "completed",
+      "blockedBy": [
+        "T1",
+        "T4"
+      ]
+    },
+    {
+      "id": "T6",
+      "subject": "Host DI: register the publisher in AddOtOpcUaDriverFactories + ResilienceStatusReaderRegistrationTests wiring guard (tracker HAS a production reader)",
+      "status": "completed",
+      "blockedBy": [
+        "T5"
+      ]
+    },
+    {
+      "id": "T7",
+      "subject": "AdminUI: IDriverResilienceStatusStore + InMemory impl + AddOtOpcUaDriverStatusServices registration (TDD mirroring DriverStatusSnapshotStoreTests)",
+      "status": "completed",
+      "blockedBy": [
+        "T4"
+      ]
+    },
+    {
+      "id": "T8",
+      "subject": "AdminUI: DriverResilienceStatusBridge DPS actor + spawn in WithOtOpcUaSignalRBridges",
+      "status": "completed",
+      "blockedBy": [
+        "T7"
+      ]
+    },
+    {
+      "id": "T9",
+      "subject": "AdminUI: resilience chip section in DriverStatusPanel.razor (in-process store read; no bUnit \u2014 verified by T10)",
+      "status": "completed",
+      "blockedBy": [
+        "T7"
+      ]
+    },
+    {
+      "id": "T10",
+      "subject": "Live-/run gate on docker-dev: rebuild BOTH centrals, S7 dead-endpoint breaker-open, both-replica chips, recovery clear, staleness dim",
+      "status": "deferred-live",
+      "blockedBy": [
+        "T6",
+        "T8",
+        "T9"
+      ],
+      "openNote": "PARTIAL \u2014 the resilience PIPELINE is live-verified (Polly CircuitBreaker -> Retry -> Timeout -> CapabilityInvoker in central-1 stack traces), but breaker-OPEN state was never forced: R2-09's ConnectionBackoff throttles retries so failures don't accumulate fast enough to open the Polly breaker. The reliable trigger is a rapid idempotent write to a dead endpoint. Confirmed still open 2026-07-27 (deferment.md \u00a78.5)."
+    },
+    {
+      "id": "T11",
+      "subject": "Docs + review ledger: mark 03/U10 + 04/U-5 remediated; update STATUS.md + FOLLOWUP-10",
+      "status": "completed",
+      "blockedBy": [
+        "T10"
+      ]
+    }
  ]
 }
@@ -1,30 +1,213 @@
 {
  "planPath": "archreview/plans/R2-11-tagconfig-consolidation-plan.md",
-  "lastUpdated": "2026-07-12",
+  "lastUpdated": "2026-07-27",
  "tasks": [
-    { "id": "T1",  "subject": "Golden TagConfig corpus + compose→encode→decode parity characterization test (Runtime.Tests, green on unmodified tree)", "status": "completed", "blockedBy": [] },
-    { "id": "T2",  "subject": "FullName-semantics characterization for EquipmentNodeWalker (Core.Tests) + DraftValidator Galaxy rule (Configuration.Tests)", "status": "completed", "blockedBy": [] },
-    { "id": "T3",  "subject": "TagConfigIntent + TagAlarmIntent in Commons/Types (TDD; port composer semantics verbatim + OpcUaServer ExtractTag* test tables)", "status": "completed", "blockedBy": [] },
-    { "id": "T4",  "subject": "DeviceConfigIntent (TryExtractHost/NormalizeHost) in Commons/Types (TDD)", "status": "completed", "blockedBy": [] },
-    { "id": "T5",  "subject": "AddressSpaceComposer swap: single TagConfigIntent.Parse per tag, delete 4 Extract* statics (P-1 parse-once)", "status": "completed", "blockedBy": ["T1", "T3"] },
-    { "id": "T6",  "subject": "Device-host re-home: composer TryExtractDeviceHost/NormalizeDeviceHost → DeviceConfigIntent; update DriverHostActor + DeploymentArtifact callers", "status": "completed", "blockedBy": ["T4", "T5"] },
-    { "id": "T7",  "subject": "DeploymentArtifact swap: delete 4 private mirrors, parse once per tag element via TagConfigIntent", "status": "completed", "blockedBy": ["T5"] },
-    { "id": "T8",  "subject": "DraftValidator swap: Configuration→Commons ProjectReference; ExtractTagConfigFullName → TagConfigIntent.ExplicitFullName (null-on-absent preserved)", "status": "completed", "blockedBy": ["T2", "T3"] },
-    { "id": "T9",  "subject": "EquipmentNodeWalker.ExtractFullName delegates to TagConfigIntent; repoint tree-wide canonical-parser doc cites", "status": "completed", "blockedBy": ["T2", "T3"] },
-    { "id": "T10", "subject": "Retire OpcUaServer.Tests ExtractTag*Tests (authority moved to Commons.Tests); verify zero 'MUST parse identically' hits", "status": "completed", "blockedBy": ["T3", "T5"] },
-    { "id": "T11", "subject": "TagConfigJson strict-capable readers in Core.Abstractions (TryReadEnum Absent/Valid/Invalid, ReadEnumOrDefault, ReadWritable, DescribeInvalidEnum) (TDD)", "status": "completed", "blockedBy": [] },
-    { "id": "T12", "subject": "Modbus equipment-tag parser: freeze test, shared readers, honour writable key, Inspect warnings", "status": "completed", "blockedBy": ["T11"] },
-    { "id": "T13", "subject": "S7 equipment-tag parser: freeze test, shared readers, honour writable key, Inspect warnings (+ amend Contracts banner)", "status": "completed", "blockedBy": ["T11"] },
-    { "id": "T14", "subject": "AbCip equipment-tag parser: freeze test, shared readers (writable already honoured), Inspect warnings", "status": "completed", "blockedBy": ["T11"] },
-    { "id": "T15", "subject": "AbLegacy equipment-tag parser: freeze test, shared readers, honour writable key, Inspect warnings", "status": "completed", "blockedBy": ["T11"] },
-    { "id": "T16", "subject": "TwinCAT equipment-tag parser: freeze test, shared readers, honour writable key, Inspect warnings", "status": "completed", "blockedBy": ["T11"] },
-    { "id": "T17", "subject": "FOCAS equipment-tag parser: force Writable:false (05/UNDER-1 correction), shared readers, Inspect warnings (+ amend Contracts banner)", "status": "completed", "blockedBy": ["T11"] },
-    { "id": "T18", "subject": "FOCAS capability-matrix pre-flight on the equipment-tag _parseRef resolve path (BadNodeIdUnknown on rejection)", "status": "completed", "blockedBy": ["T17"] },
-    { "id": "T19", "subject": "Modbus probe parses the factory DTO shape (timeoutMs round-trip; OpcUaClient parity rule)", "status": "completed", "blockedBy": [] },
-    { "id": "T20", "subject": "EquipmentTagConfigInspector DriverType-dispatch map in ControlPlane (+6 Contracts references)", "status": "completed", "blockedBy": ["T12", "T13", "T14", "T15", "T16", "T17"] },
-    { "id": "T21", "subject": "AdminOperationsActor deploy-gate wiring + Deployment:TagConfigValidationMode (Warn default | Error opt-in); actor-level consuming test", "status": "completed", "blockedBy": ["T20"] },
-    { "id": "T22", "subject": "AdminUI writable checkbox in the six driver-typed tag editors (models + razor; live /run verify at execution)", "status": "deferred-live", "blockedBy": [] },
-    { "id": "T23", "subject": "Docs + decision record: two-mode rollout, unknown-keys non-goal, FOCAS writable migration note, STATUS.md/00-INDEX.md entries + Phase-C follow-up", "status": "completed", "blockedBy": ["T17", "T21"] },
-    { "id": "T24", "subject": "Final sweep: zero parity-comment/ReadEnum-copy grep hits; whole-solution build + test gate", "status": "deferred-live", "blockedBy": ["T5", "T6", "T7", "T8", "T9", "T10", "T12", "T13", "T14", "T15", "T16", "T17", "T18", "T19", "T21", "T22", "T23"] }
+    {
+      "id": "T1",
+      "subject": "Golden TagConfig corpus + compose\u2192encode\u2192decode parity characterization test (Runtime.Tests, green on unmodified tree)",
+      "status": "completed",
+      "blockedBy": []
+    },
+    {
+      "id": "T2",
+      "subject": "FullName-semantics characterization for EquipmentNodeWalker (Core.Tests) + DraftValidator Galaxy rule (Configuration.Tests)",
+      "status": "completed",
+      "blockedBy": []
+    },
+    {
+      "id": "T3",
+      "subject": "TagConfigIntent + TagAlarmIntent in Commons/Types (TDD; port composer semantics verbatim + OpcUaServer ExtractTag* test tables)",
+      "status": "completed",
+      "blockedBy": []
+    },
+    {
+      "id": "T4",
+      "subject": "DeviceConfigIntent (TryExtractHost/NormalizeHost) in Commons/Types (TDD)",
+      "status": "completed",
+      "blockedBy": []
+    },
+    {
+      "id": "T5",
+      "subject": "AddressSpaceComposer swap: single TagConfigIntent.Parse per tag, delete 4 Extract* statics (P-1 parse-once)",
+      "status": "completed",
+      "blockedBy": [
+        "T1",
+        "T3"
+      ]
+    },
+    {
+      "id": "T6",
+      "subject": "Device-host re-home: composer TryExtractDeviceHost/NormalizeDeviceHost \u2192 DeviceConfigIntent; update DriverHostActor + DeploymentArtifact callers",
+      "status": "completed",
+      "blockedBy": [
+        "T4",
+        "T5"
+      ]
+    },
+    {
+      "id": "T7",
+      "subject": "DeploymentArtifact swap: delete 4 private mirrors, parse once per tag element via TagConfigIntent",
+      "status": "completed",
+      "blockedBy": [
+        "T5"
+      ]
+    },
+    {
+      "id": "T8",
+      "subject": "DraftValidator swap: Configuration\u2192Commons ProjectReference; ExtractTagConfigFullName \u2192 TagConfigIntent.ExplicitFullName (null-on-absent preserved)",
+      "status": "completed",
+      "blockedBy": [
+        "T2",
+        "T3"
+      ]
+    },
+    {
+      "id": "T9",
+      "subject": "EquipmentNodeWalker.ExtractFullName delegates to TagConfigIntent; repoint tree-wide canonical-parser doc cites",
+      "status": "completed",
+      "blockedBy": [
+        "T2",
+        "T3"
+      ]
+    },
+    {
+      "id": "T10",
+      "subject": "Retire OpcUaServer.Tests ExtractTag*Tests (authority moved to Commons.Tests); verify zero 'MUST parse identically' hits",
+      "status": "completed",
+      "blockedBy": [
+        "T3",
+        "T5"
+      ]
+    },
+    {
+      "id": "T11",
+      "subject": "TagConfigJson strict-capable readers in Core.Abstractions (TryReadEnum Absent/Valid/Invalid, ReadEnumOrDefault, ReadWritable, DescribeInvalidEnum) (TDD)",
+      "status": "completed",
+      "blockedBy": []
+    },
+    {
+      "id": "T12",
+      "subject": "Modbus equipment-tag parser: freeze test, shared readers, honour writable key, Inspect warnings",
+      "status": "completed",
+      "blockedBy": [
+        "T11"
+      ]
+    },
+    {
+      "id": "T13",
+      "subject": "S7 equipment-tag parser: freeze test, shared readers, honour writable key, Inspect warnings (+ amend Contracts banner)",
+      "status": "completed",
+      "blockedBy": [
+        "T11"
+      ]
+    },
+    {
+      "id": "T14",
+      "subject": "AbCip equipment-tag parser: freeze test, shared readers (writable already honoured), Inspect warnings",
+      "status": "completed",
+      "blockedBy": [
+        "T11"
+      ]
+    },
+    {
+      "id": "T15",
+      "subject": "AbLegacy equipment-tag parser: freeze test, shared readers, honour writable key, Inspect warnings",
+      "status": "completed",
+      "blockedBy": [
+        "T11"
+      ]
+    },
+    {
+      "id": "T16",
+      "subject": "TwinCAT equipment-tag parser: freeze test, shared readers, honour writable key, Inspect warnings",
+      "status": "completed",
+      "blockedBy": [
+        "T11"
+      ]
+    },
+    {
+      "id": "T17",
+      "subject": "FOCAS equipment-tag parser: force Writable:false (05/UNDER-1 correction), shared readers, Inspect warnings (+ amend Contracts banner)",
+      "status": "completed",
+      "blockedBy": [
+        "T11"
+      ]
+    },
+    {
+      "id": "T18",
+      "subject": "FOCAS capability-matrix pre-flight on the equipment-tag _parseRef resolve path (BadNodeIdUnknown on rejection)",
+      "status": "completed",
+      "blockedBy": [
+        "T17"
+      ]
+    },
+    {
+      "id": "T19",
+      "subject": "Modbus probe parses the factory DTO shape (timeoutMs round-trip; OpcUaClient parity rule)",
+      "status": "completed",
+      "blockedBy": []
+    },
+    {
+      "id": "T20",
+      "subject": "EquipmentTagConfigInspector DriverType-dispatch map in ControlPlane (+6 Contracts references)",
+      "status": "completed",
+      "blockedBy": [
+        "T12",
+        "T13",
+        "T14",
+        "T15",
+        "T16",
+        "T17"
+      ]
+    },
+    {
+      "id": "T21",
+      "subject": "AdminOperationsActor deploy-gate wiring + Deployment:TagConfigValidationMode (Warn default | Error opt-in); actor-level consuming test",
+      "status": "completed",
+      "blockedBy": [
+        "T20"
+      ]
+    },
+    {
+      "id": "T22",
+      "subject": "AdminUI writable checkbox in the six driver-typed tag editors (models + razor; live /run verify at execution)",
+      "status": "completed",
+      "blockedBy": [],
+      "closureNote": "LIVE GATE CLOSED 2026-07-13 \u2014 the typed Modbus tag editor shows the Writable toggle and saving persists `writable: yes`."
+    },
+    {
+      "id": "T23",
+      "subject": "Docs + decision record: two-mode rollout, unknown-keys non-goal, FOCAS writable migration note, STATUS.md/00-INDEX.md entries + Phase-C follow-up",
+      "status": "completed",
+      "blockedBy": [
+        "T17",
+        "T21"
+      ]
+    },
+    {
+      "id": "T24",
+      "subject": "Final sweep: zero parity-comment/ReadEnum-copy grep hits; whole-solution build + test gate",
+      "status": "completed",
+      "blockedBy": [
+        "T5",
+        "T6",
+        "T7",
+        "T8",
+        "T9",
+        "T10",
+        "T12",
+        "T13",
+        "T14",
+        "T15",
+        "T16",
+        "T17",
+        "T18",
+        "T19",
+        "T21",
+        "T22",
+        "T23"
+      ],
+      "closureNote": "LIVE GATE CLOSED 2026-07-13 \u2014 see T22. STATUS.md 'docker-dev live-/run pass'."
+    }
  ]
 }
@@ -0,0 +1,593 @@
+# Deferment register — new drivers, open issues, deferred work
+
+> **Scope.** A source-verified inventory of what is unfinished in this repo: the status of the
+> recently-added drivers, every open tracker issue, in-code deferrals, open live gates, and the
+> documentation that misstates any of it.
+>
+> **Method.** Five parallel agents swept the tree independently; every claim below was checked
+> against **source** (`src/`, `tests/`, `git log`), not against documentation. Where a doc and the
+> code disagreed, the code won and the doc is listed in §7. Findings that could not be verified
+> without hardware or a live rig are marked **CANNOT VERIFY** rather than asserted.
+>
+> **Baseline.** `master` @ `90bdaa44`, 2026-07-27. All local branches are merged into master; the
+> only unmerged remotes are three abandoned branches (`origin/auto/driver-gaps` 184 commits behind
+> since 2026-04-26, `origin/auto/driver-gaps-stash`, `origin/refactor/galaxy-mxgateway-client-rename`).
+
+---
+
+## 0. The short version
+
+The driver runtime is in good shape — **no new driver contains a stub, a `NotImplementedException`,
+or an unregistered factory.** What is unfinished clusters into four groups, in descending order of
+how much they should worry you:
+
+| # | Theme | Why it matters |
+|---|---|---|
+| **1** | **Three subsystems are fully authored, persisted, and shipped — and never executed.** Node ACLs, `IRediscoverable`/`IHostConnectivityProbe`, and `DriverTypeRegistry`. | An operator can author a rule, save it, deploy it green, and have it do **nothing**. §3 |
+| **2** | **AdminUI authoring-dispatch gaps.** Calculation is offered in the driver picker but has no config form; three drivers have no device form; CSV + browse-commit dispatch maps miss the new drivers. | The "registered but unauthorable" class that has now bitten twice. §1.2 |
+| **3** | **17 open issues, all confirmed still open**, several broader than filed. | §2 |
+| **4** | **Bookkeeping drift.** 8 `.tasks.json` files show ~140 "pending" tasks for work that shipped; 5 CLAUDE.md status claims are stale. | Someone follows the tracker and rebuilds a shipped driver. §6, §7 |
+
+Nothing here is a data-loss or outage defect. The sharpest edge is §3 — silent non-enforcement.
+
+---
+
+## 1. New drivers — source-verified status
+
+Cross-cutting facts, verified once: all 12 driver types register in one place
+(`src/Server/ZB.MOM.WW.OtOpcUa.Host/Drivers/DriverFactoryBootstrap.cs:147-164`); all 12 register a
+probe (`:119-130`) via `AddOtOpcUaDriverProbes()`, called from **both** the driver path (`:93`) and
+the admin path — **no probe is admin-node-missing**. `DriverTypeNames`
+(`src/Core/ZB.MOM.WW.OtOpcUa.Core.Abstractions/DriverTypeNames.cs`) is guarded bidirectionally by
+reflection in `tests/Core/…Core.Abstractions.Tests/DriverTypeNamesGuardTests.cs`.
+
+### 1.1 Status table
+
+| Driver | Verdict | Merged | Capabilities | Notes |
+|---|---|---|---|---|
+| **MTConnect** | Complete-with-gaps | `90bdaa44` (#506) | `IDriver, IReadable, ISubscribable, ITagDiscovery, IHostConnectivityProbe, IRediscoverable` (`MTConnectDriver.cs:63`) | No `IWritable` **by design** (`:50`). No device form. |
+| **MQTT / Sparkplug B** | **Complete** | `c3a2b0f7` | `+ IRediscoverable, IAsyncDisposable` (`MqttDriver.cs:65-66`) | Cleanest of the five: picker + driver form + device form + tag editor all present. 8 open follow-up issues. |
+| **Sql** | Complete-with-gaps | `4ad54037`, follow-ups `28c28667` | `IDriver, ITagDiscovery, IReadable, ISubscribable, IHostConnectivityProbe` (`SqlDriver.cs:28-29`) | No device form; no browse-commit branch; stale comments. |
+| **Modbus RTU-over-TCP** | **Complete** | `0f38f486` (#495) | transport mode inside Modbus (`ModbusTransportMode.cs`, `ModbusRtuOverTcpTransport.cs`) | Parses transport **by name** (`ModbusDriverFactoryExtensions.cs:77-78`) — dodges the systemic numeric-enum authoring bug. |
+| **Calculation** | **Partial (authoring gap)** | pre-existing | `IDriver, IDependencyConsumer, ISubscribable, IReadable` (`CalculationDriver.cs:38`) | **Registered + offered in the picker, but has no config form.** See §1.2. |
+
+`IWritable` is absent from MTConnect, MQTT, Sql and Calculation. In all four this is **structural and
+documented**, not a stub (`MTConnectDriver.cs:50`, `MqttDriver.cs:483`, `SqlDriver.cs:15`).
+
+**Zero `NotImplementedException`** across all five drivers. Every `NotSupportedException` is either a
+`catch` filter or a deliberate domain error.
+
+### 1.2 Gaps found — AdminUI authoring & dispatch layer
+
+Every gap below is in the **authoring/dispatch layer, not driver runtime code**.
+
+| # | Gap | Evidence | Impact |
+|---|---|---|---|
+| G-1 | **`DriverConfigModal.razor` has no `Calculation` case** — falls to the `default` "No typed config form" warning; no `CalculationDriverForm.razor` exists | `DriverConfigModal.razor:34-72`, default arm `:69-71` | `CalculationDriverOptions.RunTimeout` (`CalculationDriverOptions.cs:19`) is **unauthorable via the UI**. Create/rename still work, so degraded — not a hard block. **This is the same class as the Sql picker defect, one modal further downstream.** |
+| G-2 | **`DeviceModal.razor` is missing Sql, MTConnect, Calculation** | `DeviceModal.razor:42-74`, default arm `:71-73` | Mitigated: Sql/MTConnect hold connection at the **driver** level, and Test Connect still works via `BuildMergedProbeConfig` (`:180-184`). |
+| G-3 | **`DriverConfigModal.razor:77` tells Sql/MTConnect operators the wrong thing** — the single-connection branch is hardcoded to `Galaxy or Mqtt`, so Sql/MTConnect users are told the endpoint lives on the *device* when they just authored it on the driver | `DriverConfigModal.razor:77`, `:86-88` | Actively misleading, compounds G-2. |
+| G-4 | **No parity test guards `DriverConfigModal` or `DeviceModal`** — `RawDriverTypeDialogCoverageTests`/`…ParityTests` assert `DriverTypeNames` ↔ **picker** parity only | — | **This is exactly why G-1 and G-2 survived review.** The guard pattern exists and simply was not extended to the two downstream dispatch maps. |
+| G-5 | **`CsvColumnMap` has no typed columns for Sql, MQTT, MTConnect** | `CsvColumnMap.cs:340-452` | CSV import/export degrades to the raw `TagConfigJson` fallback while the 7 older drivers get typed columns. |
+| G-6 | **`RawBrowseCommitMapper` has no Sql branch** — falls to the generic `WriteSingleKey("address", …)` whose comment claims "Browsable drivers are all handled above" | `RawBrowseCommitMapper.cs:121-141`, fallback `:145` | Untrue since `SqlDriverBrowser` was registered (`EndpointRouteBuilderExtensions.cs:83`). Same failure mode the MTConnect branch (`:135-139`) was added to avoid: typed editor opens empty, blanks the field on save. |
+| G-7 | **`EquipmentTagConfigInspector` covers only 6 driver types** | `:24-29` | Pre-existing (OpcUaClient + Galaxy absent too); no new driver was added. |
+
+### 1.3 Stale in-code comments (harmless at runtime, misleading to the next reader)
+
+- `DriverTypeNames.cs:22-25` — Calculation described as "not-yet-registered"; it registers at `DriverFactoryBootstrap.cs:149`.
+- `TagConfigEditorMap.cs:25-28` + `TagConfigValidator.cs:27-28` — "`DriverTypeNames.Sql` deliberately absent until Task 11"; the constant exists (`DriverTypeNames.cs:57`) and the values are identical, so behaviour is correct.
+- `RawDriverTypeDialog.razor:2-4, 59-60` — "its factory lands in Wave C".
+- `CsvColumnMap.cs:322-324` — hardcodes `CalculationDriverType = "Calculation"` "Not yet a `DriverTypeNames` constant"; it has been one since `DriverTypeNames.cs:54`.
+- ~~`SqlDriver.cs:218-220` — justifies not re-parsing config on the premise "the factory builds a fresh
+  instance", **disproved** by `DriverInstanceActor.cs:316` + `DriverHostActor.cs:2565`.~~ ✅ **Fixed** —
+  the comment now says the premise was false when written and is true *now* because a config change
+  respawns. See §9.
+
+---
+
+## 2. Open tracker issues — all 17 verified against source
+
+**No issue was found stale.** 11 CONFIRMED, 4 PARTIALLY (core claim holds, a sub-claim is wrong or
+incomplete), 2 CANNOT VERIFY (correctly filed as hardware/fixture-gated).
+
+| # | Title (abbrev.) | Verdict | Key evidence | Kind |
+|---|---|---|---|---|
+| **518** | `IRediscoverable` + `IHostConnectivityProbe` have no consumer; CLAUDE.md wrong | **CONFIRMED — worse than filed** | Only `+=` in `src/` are Galaxy self-wiring (`GalaxyDriver.cs:586`, `:221`). `GetHostStatuses()` has **zero call sites** outside the interface + implementations; `DriverHostStatuses` DbSet is referenced only by its declaration and a test. | Defect + doc error |
+| **507** | Discovered-node injection inert in v3 | **CONFIRMED** | `DriverHostActor.cs:986-1002` hard-`return;` + `#pragma warning disable CS0162` (restored `:1077`) | Deferred (deliberate guard) |
+| **519** | No Bad/Uncertain **sub-code** reaches a client | **CONFIRMED** | Collapse at `DriverInstanceActor.cs:1033-1041` (`statusCode >> 30`), re-expand at `OtOpcUaNodeManager.cs:3318-3322`. Enum is 3-state at `IOpcUaAddressSpaceSink.cs:165`. **Wider than filed** — `StatusFromQuality` also used at `:429/:506/:576/:761`, so alarm-condition Quality collapses too. | Design consequence |
+| **517** | Health published AFTER teardown | **CONFIRMED, fleet-wide** | `ModbusDriver.cs:244-250`, `MTConnectDriver.cs:579-590`, `S7Driver.cs:292-326` — all `Teardown…` then `WriteHealth(Unknown)`; `GetHealth()` is a plain field read | Defect (race) |
+| **516** | Driver config edits silently discarded | **CONFIRMED — survey now complete** | `DriverInstanceActor.cs:316` (only `_driver` assignment) + `DriverHostActor.cs:2565` (`Tell` existing child, no respawn) + `:653/:660` (green seal). **Affected: Modbus, FOCAS, OpcUaClient, + AbLegacy (issue missed it), + Sql (deliberate/documented).** AbCip/TwinCAT re-parse ✅; Galaxy fails **loud** (throws, `GalaxyDriver.cs:600-641`) | Defect |
+| **515** | Sparkplug `DataSet`/`Template`/`PropertySet` | **CONFIRMED** | `SparkplugCodec.cs:207-210` decode to `Unsupported` — visible refusal, not silent drop. *(`PropertySet` isn't a `ValueOneofCase`; it rides `metric.Properties`)* | Deferred feature |
+| **514** | Rebirth unarmable on a plant that hasn't birthed | **CONFIRMED** | `RawBrowseModal.razor:119-120` disabled; `_rebirthTarget` set only by tree-click handlers (`:432`, `:437`, `:439-451`). Empty tree ⇒ permanently disabled | Defect (chicken-and-egg) |
+| **513** | Meaningless `payloadFormat` in Sparkplug blob | **CONFIRMED** | `MqttTagConfigModel.cs:210` unconditional `Set`, vs. mode-aware `:216` | Defect (cosmetic) |
+| **512** | `.Browser` → `.Driver` layering | **CONFIRMED** | `…Mqtt.Browser.csproj:43` (**not :44**), boxed "KNOWN, DELIBERATE EXCEPTION" at `:16-42` | Deferred refactor |
+| **511** | `ActAsPrimaryHost` does nothing | **CONFIRMED** | Option at `MqttDriverOptions.cs:193`, round-tripped in the UI, handled only by a warning at `MqttDriver.cs:933-948`. No STATE publish, no Last Will | Deferred feature |
+| **510** | `_canRebirth` captured at browse-open | **CONFIRMED** | `RawBrowseModal.razor:377` sole `true` assignment; failure path `:516-539` never re-evaluates | Defect (stale affordance) |
+| **509** | Metric name with `/` unbrowse-committable | **CONFIRMED** | `RawBrowseCommitMapper.cs:63` uses browse name verbatim → `RawPaths.cs:39` rejects `/` → `RawTreeService.cs:976` **all-or-nothing** kills the whole batch | Defect |
+| **508** | MQTT write-through | **CONFIRMED** | `MqttDriver.cs:66` — no `IWritable`; consequence at `DriverInstanceActor.cs:673-677` | Deferred feature |
+| **507**→ see above | | | | |
+| **491** | Continuous-historization live gate | **CANNOT VERIFY** (needs VPN'd gateway) | Code **is** complete: `AddressSpaceApplier.cs:238`→`:540`→`ActorHistorizedTagSubscriptionSink.cs:27-38`→`ContinuousHistorizationRecorder.cs:84`, wired `ServiceCollectionExtensions.cs:435` | Deferred test |
+| **489** | Hot-rebind renamed raw tag | **CONFIRMED** | No implementation exists | Deferred feature |
+| **481** | Comms-loss → scripted-alarm quality (Layer 4) | **CONFIRMED** | `DriverHostActor.cs:1356-1379` iterates `_alarmNodeIdByDriverRef` only. **Issue is wrong that the per-driver ref set is missing** — `_nodeIdByDriverRef` exists at `:193`; only the fan-out into the mux is absent, so the work is *smaller* than filed | Deferred feature |
+| **468** | Wave-0 browser tree render | **CANNOT VERIFY** (fixture) | Code path present (`AbCipDriver.cs:1092-1095`, `LibplctagTagEnumerator.cs:29-37`); `ab_server` returns `ErrorUnsupported` for CIP Symbol Object enumeration | Deferred verification |
+
+### 2.1 Cross-cutting observations
+
+1. **#518 → #507 are the same failure, stacked.** The event has no subscriber *and* its downstream
+   handler hard-returns. **Fixing either alone changes nothing observable** — schedule them together.
+2. **#516 is a superset of part of #489.** For the five drivers that discard reinit config, the
+   renamed-tag-never-rebinds symptom follows mechanically (their `_tagsByRawPath` still keys on the
+   old RawPath). Re-scope #489 after #516.
+3. **#519 and #481 share the same `statusCode >> 30` collapse idiom** at three independent sites
+   (`DriverInstanceActor.cs:1033`, `ScriptedAlarmEngine.cs:745`, `:777`). Widening the status path
+   must cover all three.
+
+---
+
+## 3. Dead seams — authored, shipped, never executed
+
+**The most consequential category in this register**, and the one nothing in the code flags. Three
+subsystems are fully built and reachable by operators, but no production code path executes them.
+
+### 3.1 Node-level ACLs are authorable, deployed — and unenforced
+
+- `IPermissionEvaluator`, `TriePermissionEvaluator`, `PermissionTrieCache`, `PermissionTrieBuilder`
+  have **zero references outside `src/Core/ZB.MOM.WW.OtOpcUa.Core/Authorization/` and their own
+  tests** (independently re-verified for this report: every other grep hit is a `bin/`/`obj/` XML doc artifact).
+- `OtOpcUaNodeManager` contains **no reference to `Permission` or `Evaluator` at all.**
+- Meanwhile `ClusterAcls.razor` + `AclEdit.razor` let operators author `NodeAcl` rows, and
+  **`ConfigComposer.cs:51` snapshots them into every deployment artifact.**
+
+**Impact:** an operator authors a deny rule, deploys it green, and it has no effect. Actual
+enforcement is coarse LDAP roles plus the realm-qualified `WriteOperate` gate in the node manager —
+and that is a **write** gate; reads carry no per-node ACL check.
+**`docs/ReadWriteOperations.md:13,21` states the opposite** (see §7.1) — it is the single
+highest-risk doc error found.
+
+### 3.2 `IRediscoverable` + `IHostConnectivityProbe` raise into the void
+
+Gitea #518/#507. Nine drivers raise; nothing consumes. `DriverHostStatus` table exists
+(`OtOpcUaConfigDbContext.cs:48`, migration `20260715230637_V3Initial.cs:108`) with a doc-comment
+claiming a writer — **nothing ever writes a row.**
+
+**Impact:** an Agent/PLC/Galaxy restart leaves a stale address space behind a Healthy driver, and the
+per-host connectivity table is permanently empty.
+
+### 3.3 `DriverTypeRegistry` is vestigial
+
+Independently verified for this report: `src/Core/…Core.Abstractions/DriverTypeRegistry.cs:20` is
+referenced **only** by `tests/Core/…/DriverTypeRegistryTests.cs`. Nothing registers metadata at
+startup; nothing validates `DriverInstance.DriverType` against it. Its `AllowedNamespaceKinds` field
+was retired with the v3 `Namespace` entity (`DriverTypeRegistry.cs:97`).
+
+**Knock-on:** the driver **stability tier** does not come from here either. The live source is
+`DriverFactoryRegistry.cs:46` (`DriverTier tier = DriverTier.A`) and **no factory in `src/Drivers/`
+passes a tier** — so all 12 drivers run Tier A, and the Tier-C-only protections are dormant for
+every driver: `MemoryRecycle.cs:54` (`when _tier == DriverTier.C`) and
+`ScheduledRecycleScheduler.cs:43` (refuses unless Tier C). `docs/v2/driver-stability.md` still
+assigns Galaxy and FOCAS to Tier C.
+
+### 3.4 Related dead/dormant code
+
+| Item | Evidence |
+|---|---|
+| `IDriverConfigEditor` — interface, zero implementors, zero production consumers | `Core.Abstractions/IDriverConfigEditor.cs:9`; superseded by `TagConfigEditorMap` / `DriverConfigModal` |
+| `GenericDriverNodeManager` — explicitly **not** a production dispatch path | `Core/OpcUa/GenericDriverNodeManager.cs:71` ("verified 07/#10: zero production references") |
+| `IDriverSupervisor` — Tier-C recycle machinery has **zero implementations**, yet the parser still validates `RecycleIntervalSeconds` | archreview 01/U-2 |
+| Resilience **bulkhead** — documented, defaulted, parsed, AdminUI-authorable; `Build` never adds a concurrency limiter | archreview 01/U-6 |
+| `WriteIdempotentAttribute` — zero readers; write dispatch hardcodes `isIdempotent: true` | archreview 01/S-8 = 03/S12 |
+| ~60 lines of unreachable code retained behind #507's guard | `DriverHostActor.cs:1002`, `#pragma warning disable CS0162` |
+| Three empty `Driver.Historian.Wonderware*` directories (0 `.cs`, no `.csproj`, absent from `.slnx`) | verified for this report — only stale `bin/`+`obj/` remain |
+
+---
+
+## 4. In-code deferrals by subsystem
+
+The tree is unusually clean on classic markers: **9 `TODO`s across 1,812 files; zero
+`FIXME`/`HACK`/`XXX`/`WORKAROUND`; zero `#if false`; zero `[Obsolete]` on project code; zero
+commented-out DI registrations.** Real deferred work lives in prose doc-comments and skipped tests.
+
+### 4.1 Highest-consequence
+
+| Item | Evidence |
+|---|---|
+| **Telemetry snapshot cache never evicted** — a decommissioned driver replays last-known Health/Resilience to new subscribers forever | `TelemetryLocalHub.cs:40` `TODO(mesh-phase5+)` — self-declared, bounded, "pre-production, accepted" |
+| **Device host recovered by string-matching instead of `DeviceConfig`** — 7 of the repo's 9 TODOs are this one item, across 4 drivers | `FocasDriver.cs:137,287`; `TwinCATDriver.cs:775`; `AbLegacyDriver.cs:557`; `AbCipDriver.cs:89,1272` + `AbCipDriverOptions.cs:130` — all `TODO(v3 WaveC)` |
+| **Galaxy writes can never confirm a COM commit** — empty status array ⇒ provisional Good, metered `galaxy.writes.unconfirmed` | `GatewayGalaxyDataWriter.cs:44,328,354` — **cross-repo**, blocked on mxaccessgw |
+| **Subscription liveness undetectable** — `ISubscriptionHandle` is opaque | `DriverInstanceActor.cs:527` (#488) — well-reasoned, deferred "until a real occurrence" |
+| **`/raw` "Browse device" is still a placeholder** despite the universal discovery browser landing | `RawTree.razor:15,426` — **verify**; may be reachable now via `DiscoveryDriverBrowser` |
+
+### 4.2 Per-driver
+
+- **S7** — array **writes** unsupported entirely (`S7Driver.cs:1139`); several array *read* types unsupported (`:386,404,413,419,428,442,465,807,959`) — all fail fast at config-validation; legacy C-area counter reinterpretation live-hardware-gated (`:759`); Counter BCD on S7-300/400 undecoded.
+- **AbCip** — ALMD-only alarm projection, ALMA deferred (`AbCipAlarmProjection.cs:16,324`); no CIP Template Object reader, UDT layouts declaration-driven (`AbCipDriverOptions.cs:172`); whole-UDT writer deferred (`LibplctagTagRuntime.cs:190`); `AckCmd` pulse must be wired client-side (`:30`).
+- **Sql** — `SqlTagModel.Query` deferred to P3, **enforced end-to-end** across parser, validator, planner and editor (`SqlProvider.cs:22,37`; `SqlEquipmentTagParser.cs:24,103`; `SqlGroupPlanner.cs:44,249`; `SqlTagConfigModel.cs:114`) — exemplary deferral discipline. Postgres/ODBC dialects deferred behind `ISqlDialect`.
+- **MTConnect** — `TIME_SERIES` vectors deferred to P1.5; `DATA_SET`/`TABLE` coded `BadNotSupported` with a null value rather than approximated (`MTConnectObservationIndex.cs:53,272`) — deliberately chosen over a Good-coded lie. `RawTagEntry.DeviceName` ignored for routing (two `/raw` Devices under one driver share an Agent connection) — "a design change, not a bug fix". No DataType-vs-blob validation at authoring.
+- **MQTT** — `MaxPayloadBytes` is a constructor knob, not operator-facing (`MqttSubscriptionManager.cs:170`).
+- **TwinCAT** — Flat-mode struct expansion carries a **LIVE RISK** note, unverified against a real TC3 target (`AdsTwinCATClient.cs:270`); VirtualTree-mode browse unverified; TC2 coverage, multi-hop AMS route and lab rig all hardware-blocked (`docs/v3/twincat-backlog.md`).
+- **FOCAS** — forces read-only regardless of authored `writable:true`; servo-load semantics inferred from the wire, unconfirmed against a real CNC (`FocasWireClient.cs:944`); `"Backend": "unimplemented"` is a **deliberate fail-fast stub**, not unfinished work.
+- **Historian.Gateway** — String/DateTime/Reference writes deferred, gated on the analog SQL write path; `UInt16 → Uint4` widening because the `UInt2` write path is deferred upstream (`HistorianTypeMapper.cs:27-51`).
+
+### 4.3 Fleet-wide OPC UA gaps
+
+- **Array writes deferred across all drivers**; **multi-dimensional arrays (`ValueRank>1`) unsupported**; **array historization** is an opaque blob with no per-element history (`docs/Uns.md:288-292`, `AddressSpaceApplier.cs:873`, `OtOpcUaNodeManager.cs:1764`).
+- **`HistoryUpdate`** — permission bit `1<<12` shipped but excluded from every composite bundle; no service surface (`NodePermissions.cs:34`).
+- **`Utils.Log*` is `[Obsolete]`** in SDK 1.5.378, suppressed at 8 sites in `OtOpcUaNodeManager` pending an `ITelemetryContext` rewire.
+
+### 4.4 Skipped tests — 36, from 4 reason constants
+
+| Count | Reason | Assessment |
+|---|---|---|
+| 18 | `DiscoveryInjectionDormantV3` | **Real** — blocked on #507 |
+| 13 | `EquipmentTagsDarkBatch4` | **STALE** — the reason says these unblock "at Batch 4"; Batch 4 shipped as v3.0 and the path was *retired* (`AddressSpaceApplier.cs:415` calls it "the vestigial equipment-tag path"). These will never unskip as written — delete or rewrite the reason. |
+| 4 + 1 | `EquipmentDeviceBindingRetired`, `DarkBatch4` | Intentional tombstones preserving retirement rationale — fine as-is |
+
+Plus **4 whole OpcUaClient test suites that are scaffold-only**, awaiting an in-process OPC UA server
+fixture that was never built (`OpcUaClientSubscribeAndProbeTests`, `…DiscoveryTests`,
+`…ReadWriteTests`, `…HistoryTests`, all `:10`).
+
+All env-gated integration suites **skip cleanly** when their vars are absent. The MTConnect gate is
+notably a **real `/probe` reachability + payload-shape check** (`MTConnectAgentFixture.cs:42`), not
+mere env-var presence, so it cannot pass vacuously.
+
+---
+
+## 5. Open live gates
+
+| Gate | Status | Evidence |
+|---|---|---|
+| **Continuous-historization value capture** (#491) | **OPEN** — code complete, unproven in production | `CLAUDE.md:710`; no gate-passed commit exists |
+| **Wave-0 universal discovery browser** full tree render (#468) | **OPEN** — fixture-blocked | tracking doc §Wave 0; named as blocking BACnet browse |
+| **archreview R2-03** — VT Good→Bad on a data-fed rig | **OPEN** — explicitly "live-blocked on this data-less rig" | `archreview/plans/STATUS.md` |
+| **archreview R2-10** — force breaker-OPEN live | **OPEN** — breaker-OPEN state never forced live | `archreview/plans/R2-10-*.tasks.json` |
+| **Driver-reconfigure-while-faulted** Task 3 | **OPEN** — task subject literally "DEFERRED" | `2026-07-14-driver-reconfigure-while-faulted-plan.md.tasks.json` |
+| Galaxy `ScanStateProbeParityTests` | **OPEN** — licence-gated (one `$WinPlatform` on this box) | `docs/v2/Galaxy.ParityRig.md:180` |
+| **v2 GA exit criteria** — FOCAS live-CNC wire smoke (#54), OPC UA CTT/compliance pass, Ignition 8.3 redundancy cutover | **OPEN** — manual/hardware/external-tool | `docs/v2/v2-release-readiness.md:105-120` |
+| mesh Phase 4 | ✅ **PASSED** `1281aebf` | CLAUDE.md said open — **corrected**, §7.2 |
+| mesh Phase 5 | ✅ **PASSED** `f134935f` | CLAUDE.md said pending — **corrected**, §7.2 |
+| auto-down 1-vs-1 crash-the-oldest | ✅ **PASSED** — Phase 7 drill D4, `c50ebcf7` | CLAUDE.md said open — **corrected**, §7.2 |
+
+**Note on the 14 archreview `deferred-live` tasks across 8 plans:** `archreview/plans/STATUS.md:242-305`
+records a 2026-07-13 live pass closing several (R2-02, R2-07, R2-11, R2-04, R2-05-partial) and
+2026-07-15 closures for R2-01/R2-08/R2-06 — **but the `.tasks.json` files were never updated.** Only
+R2-03 and R2-10 have no closure record anywhere.
+
+---
+
+## 6. Plan bookkeeping — stale vs. live
+
+**59 of 78 `docs/plans/*.tasks.json` are 100 % complete.** Of the remaining 19, most are stale
+bookkeeping, not backlog.
+
+### 6.1 STALE — work shipped, file never updated (~140 phantom "pending" tasks)
+
+| File | Recorded | Reality |
+|---|---|---|
+| `2026-07-24-mtconnect-driver.md.tasks.json` | 23 pending | Merged at master tip `90bdaa44`, 5-leg live gate PASSED |
+| `2026-07-24-mqtt-sparkplug-driver.md.tasks.json` | 27 pending | All 27 done, both phases live-gated |
+| `2026-07-24-sql-poll-driver.md.tasks.json` | 22 pending | Merged `4ad54037` + follow-ups `28c28667` |
+| `2026-07-24-modbus-rtu-driver.md.tasks.json` | 11 pending | Merged `0f38f486` (#495), live gate PASSED |
+| `2026-06-26-otopcua-historian-gateway-integration.md.tasks.json` | 21 pending | Shipped as PR #423, live-validated |
+| `2026-06-15/16-stillpending-phase-{0-1,2,3,4}.md.tasks.json` | 12+9+10+8 pending | Shipped — audit §D cites `1e95856b`, `ada01e1a`, `fc8121cb`, `3e609a2b`, `70e6d3d2`, `c236263e`, `bd8fee61`, `5e27b5f7`, `fcb38014` |
+| `2026-07-22-per-cluster-mesh-program.md.tasks.json` | Phase 2 in_progress, 3–7 pending | Plan body `:331-342` says **program COMPLETE** |
+| `2026-06-12-historian-tcp-transport.md.tasks.json` | 12 pending | **OBSOLETE** — targets the retired Wonderware sidecar |
+
+### 6.2 GENUINELY LIVE
+
+| File | Open | Note |
+|---|---|---|
+| **`2026-05-29-adminui-followups.md.tasks.json`** | **19 pending / 0 completed** | **The largest unexecuted plan in the tree.** Generic `CollectionEditor<TRow>`; per-driver device/tag editors ×7; typed resilience form; `RoleMapper.Merge` + DB-backed LDAP→role mapping + `RoleGrants.razor` + FleetAdmin authz. **Several items look superseded by v3's `TagConfigEditorMap` — verify overlap before executing.** |
+| `2026-06-19-followups-batch.md.tasks.json` | 4 pending + 1 partial | B4 F10b surgical DataType/IsArray writes and B5 alarm-severity `SetSeverity` are **OPEN-by-choice, not built** |
+| `2026-06-26-otopcua-fixedtree-followups.md.tasks.json` | 1 pending | Task 11 build + regression |
+| `2026-05-26-akka-hosting-alignment-plan.md.tasks.json` | 5 partial | F8/F9/F10/F13/F14 — oldest open items; **likely superseded by v3, verify** |
+| `2026-05-28-adminui-driver-pages-plan.md.tasks.json` | 1 partial | 10.4 manual smoke checklist |
+
+`docs/plans/2026-07-23-mesh-phase4-…tasks.json` Task 9 was the only `deferred`-flagged mesh task —
+**it has since landed** (`3a590a0c`), so that file is now stale too.
+
+### 6.3 Review-directory state
+
+- **`code-reviews/`** — 51 modules, **zero Open findings**. One textual "Left Open pending a decision"
+  survives in a finding body (`Configuration/findings.md:254`, LDAP collation) whose status field
+  reads Deferred — the only index inconsistency.
+- **`code-reviews/` coverage gap** — **10 shipped source projects have never been reviewed**:
+  `Driver.Calculation`, `Driver.Historian.Gateway`, `Driver.Mqtt` (+`.Browser`, `.Contracts`),
+  `Driver.MTConnect` (+`.Contracts`), `Driver.Sql` (+`.Browser`, `.Contracts`). Meanwhile three
+  modules review the **retired** Wonderware backend.
+- **`archreview/`** — `00-OVERALL.md:60-79` carries an explicit "Carried open … no remediation branch
+  targeted them" block. The largest coherent batch is the **failure-visibility trio**: 01/S-1
+  (`AddressSpaceApplier` swallows every sink failure, deploy reports Applied even when broken), 03/S4
+  (primary gate default-allow on unknown role), 06/S-1 (Galaxy optimistic write success).
+- **`stillpending.md` does not exist** — the backlog is `docs/plans/2026-06-18-stillpending-backlog-audit.md`.
+
+---
+
+## 7. Documentation corrections
+
+### 7.1 Applied in this pass
+
+| File | Was | Now |
+|---|---|---|
+| `CLAUDE.md` §Change Detection (`:156`) | "The server's `DriverHost` consumes the signal and rebuilds the address space" | ⚠️ nothing consumes it; names `DriverHostActor.cs:986`, #518/#507, and the four affected drivers |
+| `CLAUDE.md` §Redundancy (`:272`) | auto-down "live gate is still open … docker-dev is a single six-node mesh" | gate **CLOSED** by Phase 7 drill D4 (`c50ebcf7`); the six-node-mesh claim also contradicted CLAUDE.md's own Phase 6 paragraph |
+| `CLAUDE.md` §Telemetry (`:383`) | Phase 5 "code-complete on `feat/mesh-phase5`, live gate pending" | merged `35552a96`; live gate PASSED `f134935f` |
+| `CLAUDE.md` §Phase 4 (`:493`, `:502-503`) | `ScriptedAlarmState` "dropping it is a deferred follow-up, tracked as Task 9"; "Task 9 and the live gate (Task 10) are still open" | table **dropped** (`3a590a0c`, migration `20260723183050_DropScriptedAlarmStateTable`); live gate PASSED `1281aebf` |
+| `docs/plans/2026-07-24-driver-expansion-tracking.md` | Modbus RTU "pending merge"; SQL poll "📝 Plan ready (22 tasks)"; **an "Executing a plan" table instructing you to rebuild both** | both marked ✅ Done with merge SHAs; the two shipped rows struck from the command table; Wave 1/2 headings and §Next actions corrected |
+| `docs/drivers/README.md` | `DriverTypeRegistry` "registered at startup"; "namespace kinds (Equipment + SystemPlatform)"; no Sql/Calculation rows; "Modbus TCP" only | registry marked vestigial + tier truth; namespace line corrected to Raw+UNS; Sql + Calculation rows added; Modbus row covers RTU-over-TCP |
+| `docs/drivers/TwinCAT.md` (`:95`, `:99-103`, `:151`) | "so the address space is rebuilt" / "so Core rebuilds the address space" | raises-but-unconsumed caveat, mirroring the wording `Mqtt.md`/`MTConnect.md` already use correctly |
+| `docs/drivers/Galaxy.md` (`:73`) | `IRediscoverable` row with no caveat | same caveat added |
+| `docs/v2/Runtime.md` (`:106`) | "named-pipe IPC to the Wonderware historian sidecar + `SqliteStoreAndForwardSink`" | gRPC to HistorianGateway + `LocalDbStoreAndForwardSink` |
+| **`docs/ReadWriteOperations.md`** (`:13`, `:21` + banner) | "ACL enforcement (`WriteAuthzPolicy` + `AuthorizationGate`) runs before the source branch"; "**A denied read never hits the driver**" | Both struck through and corrected; banner states plainly that **no per-node ACL gate exists on any operation** and that `GenericDriverNodeManager` is test scaffolding. **This was the highest-risk doc error found.** |
+| **`docs/IncrementalSync.md`** (banner) | whole "Rebuild flow" + generation-publish path presented as current | Banner: `GenericDriverNodeManager` is non-production, rediscovery has no consumer, `sp_PublishGeneration`/`sp_ComputeGenerationDiff` `RAISERROR`, `DraftRevisionToken` gone; names the one live path (deploy artifact) |
+| **`docs/AddressSpace.md`** (banner) | "single custom namespace"; `Phase7Applier`/`Phase7Composer`/`GalaxyTagPlan`; `SystemPlatform` | Banner: two namespaces w/ `V3NodeIds`, the `AddressSpace*` rename (`40e8a23e`), `AddressSpaceComposition` as the result type, `SystemPlatform` retired |
+| `docs/v2/phase-7-status.md`, `v2-release-readiness.md`, `redundancy-interop-playbook.md`, `AdminUI-rebuild-plan.md` (banners) | present-tense claims about types that no longer exist | Dated "⚠️ Historical" banners naming the specific dead types. `v2-release-readiness.md`'s banner also flags that its `:41` "ACL enforcement Closed" row is false, while noting its unchecked GA exit criteria **are** still live. (`docs/StatusDashboard.md` already self-declares Superseded — left alone.) |
+| `docs/OpcUaServer.md` (`:14`, `:51`), `docs/README.md` (`:65`), `docs/drivers/OpcUaClient-Test-Fixture.md` (`:127`) | `WriteAlarmState`; `LdapUserAuthenticator` ×2; `RedundancyCoordinator` | `WriteAlarmCondition`; `LdapOpcUaUserAuthenticator`; `RedundancyStateActor` + `IRedundancyRoleView` |
+| `docs/Historian.md` | no mention of #491 or the provisioning gap | ⚠️ block added: continuous value capture is **code-complete but unproven in production**, with the wiring chain; plus the `EnsureTags`-skips-existing-tags gap |
+
+### 7.2 Recorded, NOT applied — needs a decision or a rewrite, not a line edit
+
+The three highest-priority items in this list were **bannered rather than rewritten** in this pass
+(cheap, stops the misleading, preserves the record) — the underlying rewrite is still owed. They now
+appear in §7.1 as well.
+
+| Priority | File | Problem |
+|---|---|---|
+| **1 (security-relevant)** | `docs/ReadWriteOperations.md:13,21` | **Bannered + struck through.** Claimed ACL enforcement via `WriteAuthzPolicy` + `AuthorizationGate` + `NodeScopeResolver` and that "a denied read never hits the driver". All four names have zero hits in `src/`; §3.1 shows there is no read-path ACL gate at all. **Still owed:** a proper §-rewrite against the real node-manager write gate. Same false claim at `docs/v2/v2-release-readiness.md:41` (bannered). |
+| **2** | `docs/IncrementalSync.md` | **Bannered.** Entire "Rebuild flow" (`:37-47`) built on non-production `GenericDriverNodeManager`; `:26-34` cites `sp_PublishGeneration`/`sp_ComputeGenerationDiff`, both retired stubs that `RAISERROR` (`20260715230637_V3Initial.StoredProcedures.cs:194`); `:31` cites `DraftRevisionToken` (0 hits); `:49-51` describes a `ScopeHint` no consumer reads. **Still owed:** rewrite around the deploy-artifact path, or archive to `docs/v1/`. |
+| **2** | `docs/AddressSpace.md` | **Bannered.** v2-era throughout: `:7,42` claim a single namespace (v3 has two); `:7,48,70` cite `Phase7Applier` + `GalaxyTagPlan` + a nonexistent file path; `:62-64` repeats the rediscovery claim. **Still owed:** rewrite §"Root folder" + §"NodeId scheme" against `V3NodeIds` / `AddressSpaceRealm`. |
+| 3 | 6 docs, ~20 citations | **`Phase7*` → `AddressSpace*`** rename (`40e8a23e`). Mostly mechanical, **except three that are not renames** and need the real member identified first: `Phase7CompositionResult` → **`AddressSpaceComposition`** (`AddressSpaceComposer.cs:13`, verified for this report); `Phase7Composer.ExtractTagFullName` → nearest live seam is `ScriptTagCatalog.ExtractFullNameFromTagConfig`; **`Phase7EngineComposer.RouteToHistorianAsync` is simply gone** — the real seam is `HistorianAdapterActor` → `IAlarmHistorianSink`. |
+| 3 | `docs/v2/driver-specs.md` | Covers 8 of 12 drivers (missing MQTT, MTConnect, Sql, Calculation, and the Modbus `Transport` selector) while `docs/drivers/README.md` calls it authoritative "for **every** driver". Either add four sections or downgrade the claim. |
+| 3 | `docs/v2/driver-stability.md:47-54` | Puts Galaxy and FOCAS in Tier C; `docs/drivers/README.md` says Tier A for both. **Moot at runtime** — see §3.3 — but the two docs contradict each other. |
+| 3 | `docs/drivers/Sql.md`, `docs/drivers/Calculation.md` | **Do not exist.** Sql is documented only in design/plan/research files; Calculation only at `docs/Raw.md:66-69`. |
+| — | `docs/operations/2026-07-16-secrets-clustered-master-key.md:38` | `NoOpSecretReplicator` exists **only** in a test. **Investigate before editing** — the sentence makes a security-relevant claim ("no built-in cross-node replication today"), so it needs the real behaviour identified, not a rename. Left untouched deliberately. |
+| — | `docs/v2/driver-specs.md` §2 | `docs/drivers/Modbus.md:10-11` points readers here for the Modbus config shape, and this file omits the `Transport` selector. Folded into the driver-specs item above. |
+
+---
+
+## 8. Recommended sequencing
+
+1. ~~**§3.1 ACL enforcement** — decide: wire `IPermissionEvaluator` into `OtOpcUaNodeManager`, or
+   remove the authoring UI and say plainly that ACLs are not enforced. Either way fix
+   `docs/ReadWriteOperations.md` first; it is the one that could mislead a security review.~~
+   ✅ **Done** — decided *make non-enforcement explicit*; wire-up tracked as Gitea **#520**. See §9.
+   (`docs/ReadWriteOperations.md` was **not** the sharpest one — `docs/security.md` was.)
+2. ~~**#518 + #507 together** — neither fix is observable alone.~~ ✅ **Done.** The framing was right
+   that they had to be handled together, but wrong about the resolution: **#507 was not revivable**,
+   so it was deleted rather than fixed. See §9.
+3. ~~**#516** — silent config discard on 5 drivers; then re-scope #489, which it partly subsumes.~~
+   ✅ **Done.** See §9. #489 is still open and should now be re-scoped.
+4. ~~**G-4** — extend the existing picker-parity test to `DriverConfigModal` + `DeviceModal`; it would
+   have caught G-1 and G-2 for free, and this class has now recurred twice.~~ ✅ **Done**, together with
+   G-1, G-2, G-3, G-5 and G-6. See §9.
+5. ~~**Bookkeeping sweep** — mark the 8 stale `.tasks.json` files complete so the 19-task AdminUI plan
+   (§6.2) is visible as the real backlog it is.~~ ✅ **Done.** See §9.
+6. ~~**§3.3 tier truth** — either pass real tiers at factory registration or delete the Tier-C
+   machinery; today it is documented, authorable and dormant.~~ ✅ **Documented**; the keep-or-delete
+   code decision is Gitea **#522**. See §9.
+
+---
+
+## 9. Execution log
+
+Remediation of §8, on branch `feat/deferment-remediation`. Status is updated in the **same commit** as
+the work, so this register never disagrees with the tree.
+
+| §8 item | Status | Commit |
+|---|---|---|
+| 1. ACL enforcement decision | ✅ **Done** — decided *make non-enforcement explicit*; Gitea **#520** tracks the wire-up | `d1e88dc4` |
+| 2. #518 + #507 | ✅ **Done** — `IRediscoverable` consumed as a re-browse prompt; #507's injection path **deleted**; `IHostConnectivityProbe` half split to Gitea **#521** | `09a401b8`, `97c9f4b4` |
+| 3. #516 config discard | ✅ **Done** — seam respawn + re-parse on 3 drivers; Sql/FOCAS deliberately respawn-only | `2dc19f30` |
+| 4. G-4 dispatch-map parity | ✅ **Done** — G-1…G-6 all closed, live-verified on docker-dev | `abacf4cf` |
+| 5. Bookkeeping sweep | ✅ **Done** — 13 plan files closed, 11 archreview gates written back | `03658c2e` |
+| 6. Tier truth | ✅ **Done** — docs reconciled; keep-or-delete is Gitea **#522** | `03658c2e` |
+
+### 2026-07-27 — §8.1 ACL non-enforcement made explicit
+
+Decision: **do not wire the evaluator, do not delete it** — state plainly that it does not run, and
+track the wire-up as **Gitea #520**.
+
+Applied:
+
+- `docs/security.md` — the `NodeScope`/`PermissionTrie`/"Dispatch gate" block now leads with a
+  **What is enforced today** table (the three real checks) before the design material, which is
+  labelled *Designed but not wired*.
+- `docs/ReadWriteOperations.md` — **rewritten**, not bannered.
+- `docs/v2/acl-design.md` — ⚠️ NEVER WIRED banner.
+- `docs/v2/v2-release-readiness.md` §"Security — Phase 6.2 dispatch wiring" — the CLOSED claim marked
+  as not holding.
+- `ClusterAcls.razor` + `AclEdit.razor` — warning alerts stating rules are stored and deployed but
+  never evaluated.
+
+**Four things this pass found that §7 and the original audit missed** — all worse than what was
+already recorded:
+
+1. **`docs/security.md` was the highest-risk doc, not `ReadWriteOperations.md`.** `:115` claimed an
+   anonymous session is "default-denie[d] any node a session has no ACL grant for". The opposite is
+   true: an anonymous session can Browse, Read, Subscribe and HistoryRead the **entire** address
+   space. It is refused only writes and alarm acks — and only because it carries no roles.
+2. **Three of the five documented data-plane role strings do nothing.** `OpcUaDataPlaneRoles` declares
+   exactly `WriteOperate` and `AlarmAck`. `ReadOnly`, `WriteTune` and `WriteConfigure` are compared
+   against nowhere in `src/`, so mapping a group to `WriteTune` grants nothing and mapping one to
+   `ReadOnly` restricts nothing. The doc called all five "exact, case-insensitive, and **code-true**".
+3. **`ReadWriteOperations.md` was fiction well beyond the ACL claims.** `OnReadValue` has **zero**
+   occurrences in `src/` — the whole documented read path did not exist. Reads never reach a driver at
+   all: the node manager is push-model and the SDK serves a client Read from the cached pushed value.
+   `WriteAuthzPolicy`, `_sourceByFullRef`, `_writeIdempotentByFullRef` and `IRoleBearer` are likewise
+   zero-hit, and `CapabilityInvoker` is not referenced by the `OpcUaServer` project at all.
+4. **`v2-release-readiness.md` claimed a whole enforcement layer shipped.** Beyond the `:41` row §7.1
+   already flagged, `:46-50` describe `FilterBrowseReferences`, `GateCallMethodRequests`,
+   `MapCallOperation`, `AuthorizationBootstrap` and `Node:Authorization:*` config keys as Closed or
+   Partial. None of them exist. Whatever landed on the v2 branch did not survive into the shipped tree.
+
+Also recorded in #520 and not previously known: every existing evaluator unit test runs in
+`PermissionTrieBuilder`'s no-`scopePaths` *deterministic test mode*, so the production hierarchy path
+is effectively untested; and `NodeAcl.ScopeId` has no FK or existence check, so scope ids dangle
+silently.
+
+### 2026-07-27 — §8.2 rediscovery as a signal; injection deleted
+
+Decision: **signal, not mutation.**
+
+`DriverInstanceActor` now consumes `IRediscoverable.OnRediscoveryNeeded` (attach in `PreStart`, detach
+in `PostStop`) and carries it on the driver-health snapshot to `/hosts` as a **re-browse chip**. It is
+advisory — the served address space is unchanged, because v3 authors raw tags through `/raw`
+browse-commit and a runtime graft would materialise nodes nobody approved.
+
+**#507's injection path was deleted, not fixed.** §2 recorded it as a "deferred (deliberate guard)".
+That was too generous: its two inputs — `EquipmentNode.DriverInstanceId` and `EquipmentTags` — are
+*structurally empty* in v3, so removing the guard would have changed a log line and injected nothing.
+Deleted with it: `HandleDiscoveredNodes`, `PartitionDiscoveredByDeviceHost`,
+`ApplyDiscoveredPlansForDriver`, the redeploy re-inject tail, `DiscoveredNodeMapper`,
+`AddressSpaceApplier.MaterialiseDiscoveredNodes`, `OpcUaPublishActor.MaterialiseDiscoveredNodes`, the
+connect-time discovery loop, and 4 files' worth of tests. `ITagDiscovery` stays — the `/raw` browse
+picker drives it through `Commons/Browsing/DiscoveryDriverBrowser`, which never went through the actor.
+
+**§4.4's "18 `DiscoveryInjectionDormantV3` — Real, blocked on #507" was wrong.** They were v2
+characterization tests asserting an equipment-rooted graft (`EquipmentRootNodeId == "EQ-1"`) that v3
+cannot produce. They could never have unskipped as written; they are deleted. Skipped tests in
+`Runtime.Tests` went 31 → 13.
+
+**The planned drift detector was deliberately NOT built.** The plan proposed diffing each connect-time
+discovery pass against the authored raw tags. Reading the drivers killed it: **Modbus, S7, MQTT,
+AbLegacy and Sql all echo authored config from `DiscoverAsync`** rather than browsing the device, so
+the diff is permanently empty for them. It would have been another plausible-looking inert seam —
+precisely the class this register exists to remove. That also removed the last consumer of the
+connect-time loop, which is why the loop went too: it was browsing real devices up to ~15× per connect
+and dropping the result.
+
+Two traps worth keeping:
+
+- `PublishHealthSnapshot` dedups on a health fingerprint, and a rediscovery raise changes none of the
+  four fields it hashed. The timestamp had to join the tuple or the dedup swallows the signal.
+  **Verified by reverting the one line — 3 of the 5 new tests go red.**
+- The shared `StubDriver.GetHealth()` returns `DateTime.UtcNow`, so its fingerprint differs every call
+  and the dedup never engages. A dedup test built on it would pass whether or not the fix is present;
+  the new tests use a stub with stable health.
+
+`IHostConnectivityProbe` was **not** resolved — it is a keep-or-delete decision, and the
+`DriverHostStatus` table was re-created deliberately in the v3 initial migration, so deleting on
+inference would be wrong. Split to Gitea **#521** with both options costed.
+
+### 2026-07-27 — §8.5 bookkeeping + §8.6 tier truth
+
+**13 plan files closed.** The 8 the register named, plus `mesh-phase4` (Task 9 landed `3a590a0c`), the
+4th `stillpending` phase file, and `historian-tcp-transport` closed as **OBSOLETE** (it targets the
+retired Wonderware sidecar; there is no Wonderware backend in the tree). Each carries a `closureNote`
+naming the evidence, so the next reader can check rather than trust.
+
+**11 archreview live gates written back** from `STATUS.md`, which had recorded them passed since
+2026-07-13/15 without ever updating the `.tasks.json` files: R2-01 #11, R2-02 #15/#18, R2-05 T15,
+R2-06 T12, R2-07 T5/T6/T12/T14, R2-11 T22/T24.
+
+**R2-03 and R2-10 were NOT closed** — and reading `STATUS.md` rather than trusting its own headline
+("Every Round-2 live gate is now GREEN") is what kept that honest. Its per-item detail says R2-03 is
+"live-blocked on this data-less rig" and R2-10 verified the pipeline but "breaker-OPEN state not
+forced". Both now carry an `openNote` recording the blocker: R2-03 needs a reachable driver fixture
+feeding a VT; R2-10 needs a rapid idempotent write to a dead endpoint, because R2-09's
+`ConnectionBackoff` throttles retries so failures never accumulate fast enough to open the Polly breaker.
+
+**Net effect (the point of the sweep):** ~140 phantom pending tasks are gone, so the genuinely
+unexecuted **19-task AdminUI follow-ups plan** is now the largest open item in `docs/plans/` rather than
+being buried. The remaining open plans are 8, and one of those (`mesh-phase6` Task 6) is a documented
+`resolved-no-flip` decision rather than work.
+
+**Tier truth:** `docs/v2/driver-stability.md` now states plainly that its tier table is aspirational —
+every driver runs Tier A, and `MemoryRecycle` / `ScheduledRecycleScheduler` have never engaged. It also
+corrects a second stale claim the register did not flag: the **separate-Windows-service hosting** it
+describes for Tier C no longer exists (Galaxy went to the mxaccessgw sidecar in PR 7.2; FOCAS went
+in-process when its managed wire client landed). No runtime change — turning recycle on for two live
+drivers deserves its own live gate, not a docs-pass side effect. Tracked as Gitea **#522**.
+
+### 2026-07-27 — §8.4 dispatch-map parity (G-1 … G-6)
+
+**The maps had to become data before they could be guarded.** A Razor `@switch` compiles into
+`BuildRenderTree`'s IL, so nothing can enumerate its cases — that is the whole reason G-1 and G-2
+survived review while the sibling picker guard stayed green (the picker test works only because
+`RawDriverTypeDialog` keeps its data in a *field* the markup enumerates). Both modals now render from
+`DriverConfigFormMap` / `DeviceFormMap` via `<DynamicComponent>`, and being `public` those maps need
+none of the picker test's `BindingFlags.NonPublic` fragility.
+
+| Gap | Resolution |
+|---|---|
+| G-1 | `CalculationDriverForm.razor` added — `RunTimeout` was unauthorable through the UI. |
+| G-2 | Sql / MTConnect / Calculation are declared **single-connection** rather than given hollow device forms — each holds one connection at the driver level, so a per-device endpoint editor would be meaningless. |
+| G-3 | `DriverConfigModal`'s hardcoded `Galaxy or Mqtt` replaced by `DeviceFormMap.IsSingleConnection`. |
+| G-4 | `DriverFormMapParityTests` (5 cases, both directions) + `DriverDispatchMapParityTests` (3). |
+| G-5 | `CsvColumnMap` entries for Sql, Mqtt, MTConnect. |
+| G-6 | `RawBrowseCommitMapper` Sql branch — **and the browser end too**, which the register missed. |
+
+**G-6 was bigger than filed.** The register said the mapper lacked a Sql branch. It also turned out that
+`SqlBrowseSession` emitted **no `AddressFields` at all**, so a browsed leaf carried only a column name —
+and a column name alone cannot address a Sql tag, which needs its table. The browser now travels
+schema/table/column and the mapper builds a `WideRow` `SqlTagConfigModel` from them. A branch alone
+would have produced a half-built blob.
+
+**Two extra findings while writing the guards:**
+
+- The G-6 test found **Modbus and Calculation** also fall through to the generic `{"address": …}` key.
+  Both are correct — neither is browsable — so the test asserts the fall-through set **equals** a
+  documented non-browsable list, in both directions. A one-way check would let a newly-browsable driver
+  be quietly added to the exclusion list instead of getting a branch.
+- `TagConfigDriverTypeNameGuardTests` was **hollow**: it enumerated a hand-written `TheoryData` that had
+  already drifted (omitting Galaxy, Sql and Mqtt), so it guarded against renames but not gaps — a new
+  `DriverTypeNames` constant would simply never appear. Now enumerated from the map, paired with a
+  coverage test in the other direction.
+
+**Live-verified on docker-dev** (`localhost:9200`, central pair rebuilt), because this repo has no bUnit
+and no unit test can cover Blazor parameter binding: opened Calculation's config — the form renders where
+it previously showed "No typed config form" — typed `3500`, saved, reopened, and the value **persisted**,
+proving the `DynamicComponent` two-way binding round-trips. Sql's form renders fully (regression check on
+the conversion) and now reads "This driver holds a single connection, authored above" (G-3). The rebuilt
+image also showed `RediscoveryNeededUtc`/`RediscoveryReason` on the wire, confirming §8.2 end-to-end.
+
+### 2026-07-27 — §8.3 #516 driver config edits silently discarded
+
+Decision: **both** — per-driver re-parse *and* the seam respawn. Reading the drivers split the
+"per-driver" half in two, which the register did not anticipate:
+
+- **Re-parse in place** (`Modbus`, `AbLegacy`, `OpcUaClient`) — `ParseOptions` extracted from each
+  factory, called from `InitializeAsync` behind a `HasConfigBody` guard so `"{}"` still keeps the
+  constructor options.
+- **Respawn-only, deliberately NOT re-parsed** (`Sql`, `FOCAS`) — each builds **more than options**
+  from config: Sql's `ISqlDialect` + resolved connection string, FOCAS's client-factory backend, both
+  injected at construction. Adopting new options alone would run a **new tag set against an old
+  connection**. Half a re-parse is worse than none. Their doc-comments now say so.
+
+**The seam respawn is the load-bearing half.** `DriverSpawnPlanner` now routes a changed
+`DriverConfig` to `ToStop` + `ToSpawn`, making the factory the single parse authority.
+`ToApplyDelta` is consequently always empty from the reconcile path. This **reverses the deliberate
+decision documented at `DriverSpawnPlan.cs:49-50`** ("a pure DriverConfig change stays an in-place
+delta — no reconnect"). That reasoning was right about resilience and wrong about the driver; the
+accepted price is a reconnect on every config edit.
+
+Two seals removed from `ApplyChildDelta`: it overwrote the cached `Spec` **synchronously, before the
+child had dequeued the message**, so the host immediately believed the new config was live and the
+next reconcile computed no delta — sealing the drift permanently; and it `Tell`d with no
+`Receive<ApplyResult>` registered, so a failed reinit (including Galaxy's deliberate
+`NotSupportedException`) dead-lettered.
+
+**A new visibility gap this change exposed, not created:** a factory throw is a *config* error
+(`TryCreate` is pure parsing; device I/O happens later), and `SpawnChild` catches it and silently
+substitutes a stub. Previously only a brand-new driver could hit it; now an ordinary config edit can.
+Raised from `Warning` to `Error` with an actionable message. It still does **not** fail the
+deployment — making it do so would let one malformed driver block a fleet deploy, so that is a
+deliberate follow-up rather than a drive-by change.
+
+**Tests.** Every pre-existing reinit test in the five suites passes `"{}"` — precisely the input a
+guarded re-parser treats as "keep the constructor options", so they were blind to this defect *by
+construction*. The new tests pass **changed** JSON. The Modbus one was verified falsifiable by
+deleting the re-parse line (goes red). Two existing tests asserted the old behaviour and were
+rewritten: `DriverSpawnPlannerTests` (two cases), and
+`DriverHostActorUnreadableArtifactTests.Dropping_a_drivers_last_tag_does_clear_its_subscription` —
+a **positive control** for a sibling absence assertion, whose observable moved from `UnsubscribeAsync`
+to `ShutdownAsync` because the teardown now happens by stopping the child rather than emptying its
+desired set. Same event, different route; the control still calibrates the settle window.
+
+Full-solution run: only pre-existing environment failures remain — `Host.IntegrationTests` (3,
+verified identical on the pre-change tree) and `Driver.AbLegacy.IntegrationTests` (4, docker
+fixture-gated, and notably these **fail rather than skip**, unlike every other fixture-gated suite).
+
+---
+
+*Generated 2026-07-27 against `master` @ `90bdaa44` by five parallel source-verification agents.
+Every `path:line` reference was read from source. Items marked CANNOT VERIFY require hardware, a
+VPN'd gateway, or a live rig and are listed as unproven rather than assumed.*
@@ -100,9 +100,11 @@ The `-v` drops the SQL volume; remove it to keep ConfigDb state across restarts.

 ## Failover smoke

-1. Watch the Traefik dashboard at `http://localhost:8089`. Both `central-1` and `central-2` should be listed as healthy in the `otopcua-admin` service.
-2. `docker compose -f docker-dev/docker-compose.yml stop central-1` — `central-2` should pick up the admin role-leader within ~15 s (Akka split-brain stable-after). Traefik will route traffic to `central-2` once its `/health/active` returns 200.
-3. `docker compose -f docker-dev/docker-compose.yml start central-1` — `central-1` rejoins as a follower; `central-2` keeps the leader role until something disturbs it.
+1. Watch the Traefik dashboard at `http://localhost:8089`. Exactly ONE of `central-1` / `central-2` is UP in the `otopcua-admin` service — the admin role-leader. The standby is DOWN by design: `/health/active` answers 503 on it, which is how Traefik pins browser traffic to the leader. (Before `ZB.MOM.WW.Health` 0.2.1 the standby answered 200, so both showed UP and this pinning silently never worked — see `lmxopcua#494`.)
+2. `docker compose -f docker-dev/docker-compose.yml stop central-1` — `central-2` picks up the admin role-leader within ~15 s (Akka split-brain stable-after) and Traefik flips it to UP. Verified 2026-07-24: the swap completed inside 20 s with **no gap** — `http://localhost:9200/` answered 200 continuously across the failover.
+3. `docker compose -f docker-dev/docker-compose.yml start central-1` — `central-1` rejoins and **reclaims** the admin role-leader, and Traefik flips back. It does not stay with `central-2`: Akka's `RoleLeader` is the lowest-address member, so the outcome is deterministic rather than sticky.
+
+> **Cold-boot caveat.** Starting both central nodes simultaneously from stopped can leave each self-forming its own 1-member cluster (self-first seed lists), in which case BOTH are their own role-leader and both answer `/health/active` 200. Check `entries["akka"].data.memberCount` on `/health/ready` — it should read 2. Restarting either node makes it join the survivor.

 ## Resource limits & dev logging

@@ -0,0 +1,34 @@
+# Isolated MQTT/Sparkplug live-gate overlay (Task 26).
+#
+# Runs the MAIN central pair ONLY, from this worktree's image, under its own
+# compose project + offset host ports, so the shared `otopcua-dev` rig and the
+# sibling driver worktrees that share `otopcua-host:dev` are untouched.
+#
+#   docker build -f docker-dev/Dockerfile --target runtime -t otopcua-host:mqtt .
+#   docker compose -p otopcua-mqtt -f docker-dev/docker-compose.yml \
+#                  -f docker-dev/docker-compose.mqtt.yml \
+#                  up -d sql migrator cluster-seed central-1 central-2
+#
+#   AdminUI  -> http://localhost:9210   (login disabled; auto-admin)
+#   OPC UA   -> opc.tcp://localhost:4850 (central-1) / :4851 (central-2)
+#   SQL      -> localhost,14350
+#
+# `!override` on every `ports` list: compose MERGES list-valued keys by
+# appending, so a plain re-declaration keeps the base file's "14330:1433" /
+# "4840:4840" and collides with the running `otopcua-dev` rig.
+services:
+
+  sql:
+    ports: !override
+      - "14350:1433"
+
+  central-1:
+    image: otopcua-host:mqtt
+    ports: !override
+      - "4850:4840"
+      - "9210:9000"
+
+  central-2:
+    image: otopcua-host:mqtt
+    ports: !override
+      - "4851:4840"
@@ -0,0 +1,45 @@
+# Isolated MTConnect live-gate overlay (Task 21).
+#
+# Runs the MAIN central pair ONLY, from this worktree's image, under its own
+# compose project + offset host ports, so the shared `otopcua-dev` rig and the
+# three sibling driver worktrees that share `otopcua-host:dev` are untouched.
+# Mirrors how the mqtt-sparkplug worktree isolated itself (`otopcua-host:mqtt`,
+# project `otopcua-mqtt`, ports 9210/4850).
+#
+#   docker build -f docker-dev/Dockerfile --target runtime -t otopcua-host:mtconnect .
+#   docker compose -p otopcua-mtc -f docker-dev/docker-compose.yml \
+#                  -f docker-dev/docker-compose.mtconnect.yml \
+#                  up -d sql migrator cluster-seed central-1 central-2
+#
+#   AdminUI  -> http://localhost:9220   (login disabled; auto-admin)
+#   OPC UA   -> opc.tcp://localhost:4860 (central-1) / :4861 (central-2)
+#   SQL      -> localhost,14340
+#
+# Both MAIN nodes run because `cluster-seed` declares MAIN as a 2-node cluster:
+# ConfigPublishCoordinator sources its expected-ack set from enabled ClusterNode
+# rows, so deploying with one node down fails at the apply deadline.
+#
+# Traefik is deliberately not started — central-1 publishes its AdminUI port
+# directly, which removes the :9200 round-robin that otherwise makes it
+# ambiguous which node served a request.
+
+# NOTE: `!override` is required on every `ports` list. Compose MERGES list-valued
+# keys by appending, so a plain re-declaration would keep the base file's
+# "14330:1433" / "4840:4840" alongside the offsets and collide with the running
+# `otopcua-dev` rig ("Bind for 0.0.0.0:14330 failed: port is already allocated").
+services:
+
+  sql:
+    ports: !override
+      - "14340:1433"
+
+  central-1:
+    image: otopcua-host:mtconnect
+    ports: !override
+      - "4860:4840"
+      - "9220:9000"
+
+  central-2:
+    image: otopcua-host:mtconnect
+    ports: !override
+      - "4861:4840"
@@ -1,29 +1,67 @@
-# docker-dev/ — Mac-friendly single-mesh hub-and-spoke fleet for v2 development + manual UI exercise.
+# docker-dev/ — Mac-friendly THREE-mesh hub-and-spoke fleet for v2 development + manual UI exercise.
 #
-# Topology: ONE Akka mesh seeded by `central-1`. Logical separation between
-# tenants is by ServerCluster.ClusterId rows (MAIN / SITE-A / SITE-B) in the one
-# shared `OtOpcUa` ConfigDb — NOT by separate meshes. All six host nodes join the
-# same gossip ring and the central UI deploys to every cluster over it.
+# Topology (per-cluster mesh Phase 6, 2026-07-24): THREE independent 2-node Akka
+# meshes, not one six-node mesh. Every node still runs the same ActorSystem name
+# `otopcua` and all six containers still sit on the ONE shared docker-dev network
+# — separation is purely by per-pair self-first Cluster__SeedNodes partitioning,
+# never by network isolation. This is deliberately faithful to production, where
+# the three meshes are separated by a WAN, not a firewall: nothing here stops
+# central-1 opening a bare TCP connection to site-a-1's Akka port, it just never
+# tries, because no seed list and no gossip ever names it.
+#
+#   MAIN     central-1 + central-2   (fused admin+driver, roles admin,driver,cluster-MAIN)
+#   SITE-A   site-a-1 + site-a-2     (driver-only, roles driver,cluster-SITE-A)
+#   SITE-B   site-b-1 + site-b-2     (driver-only, roles driver,cluster-SITE-B)
+#
+# Each pair seeds ONLY itself (self-first, partner-second) — no node lists a node
+# outside its own mesh as a seed. Logical/tenant separation (ServerCluster.ClusterId
+# rows MAIN / SITE-A / SITE-B in the one shared `OtOpcUa` ConfigDb) now COINCIDES
+# with mesh separation: a `cluster-<ClusterId>` Akka role marks which mesh + which
+# ServerCluster row a node belongs to (RoleParser.ClusterRolePrefix = "cluster-").
+#
+# Since central no longer shares a gossip ring with the site meshes, it reaches
+# them over the three explicit split-topology transports instead of gossip:
+#   - Command plane:   MeshTransport__Mode=ClusterClient (central dials each site
+#                       mesh's ClusterClientReceptionist; DPS is gossip-only and
+#                       would not cross the mesh boundary at all now)
+#   - Live telemetry:  Telemetry__Mode=Grpc on every driver node (all six) +
+#                       TelemetryDial__Mode=Grpc on the admin pair (central-1/2)
+#                       — the site node hosts the gRPC server, central dials in
+#   - Deployed config:  ConfigSource__Mode=FetchAndCache on the site nodes (already
+#                       true since Phase 3/4 — driver-only nodes have no ConfigDb
+#                       connection at all); central stays ConfigSource-less/Direct
+#                       and keeps serving via ConfigServe.
+# SplitTopologyTransportValidator (Cluster project) REFUSES to start any node
+# carrying a `cluster-*` role that is left on a DPS-shaped transport — these
+# three flips are therefore mandatory here, not optional dark switches.
 #
 # Stack:
 #   sql           SQL Server 2022 — hosts the one ConfigDb every node uses
 #   cluster-seed  one-shot mssql-tools job that INSERTs the ServerCluster +
 #                 ClusterNode rows scoping each tenant, then exits (idempotent)
 #
-#   central-1, central-2   OTOPCUA_ROLES=admin,driver — the ONLY UI + deploy
-#                          singleton, plus the MAIN cluster's OPC UA publishers.
-#                          Reachable at http://localhost:9200 (via Traefik).
-#                          Both are Akka seed nodes, each listing ITSELF first
-#                          (2026-07-22) so either can cold-start while the other
-#                          is down; the site nodes seed off central-1 only.
-#   site-a-1, site-a-2     OTOPCUA_ROLES=driver — driver-only members of the same
-#   site-b-1, site-b-2     mesh, scoped to SITE-A / SITE-B by ClusterId. They
-#                          serve no UI and authenticate no users; the central
-#                          cluster manages and deploys to them over the mesh.
+#   central-1, central-2   OTOPCUA_ROLES=admin,driver,cluster-MAIN — the ONLY UI +
+#                          deploy singleton, plus the MAIN cluster's OPC UA
+#                          publishers. Reachable at http://localhost:9200 (via
+#                          Traefik). Both are Akka seed nodes for the MAIN mesh
+#                          ONLY, each listing ITSELF first (2026-07-22) so either
+#                          can cold-start while the other is down.
+#   site-a-1, site-a-2     OTOPCUA_ROLES=driver,cluster-SITE-A — driver-only
+#   site-b-1, site-b-2     OTOPCUA_ROLES=driver,cluster-SITE-B — members of their
+#                          OWN 2-node mesh (self-first seeded within the pair, NOT
+#                          off central). They serve no UI, but they DO expose OPC UA
+#                          data-plane endpoints (4842-4845) and authenticate those
+#                          users against the same shared GLAuth (via the *ldap-env
+#                          anchor); central manages + deploys to them over the
+#                          ClusterClient/gRPC/FetchAndCache transports above, not
+#                          gossip.
 #
 #   Auth is real LDAP against the shared GLAuth on the Linux Docker host
 #   (10.100.0.35:3893, dc=zb,dc=local) — there is no LDAP container here.
-#   Only the admin-role central nodes carry the Security__Ldap__* block.
+#   EVERY host node carries the Security__Ldap__* block (shared *ldap-env anchor):
+#   the driver-only site nodes serve OPC UA endpoints too, and LDAP options are
+#   validated at boot on all of them (a node with no LDAP config crashes with
+#   OptionsValidationException — transport None + AllowInsecure false).
 #   Sign in `multi-role` / `password`.
 #
 #   traefik    PathPrefix(`/`) → central-1 / central-2 (the single UI route).
@@ -45,17 +83,12 @@
 # listener, verified free against every other per-node port: Akka 4053, ConfigServe 4055 on
 # central, LocalDb sync 9001 on site-a, OPC UA 4840, HTTP 9000) + Telemetry__ApiKey
 # (committed dev key, matches the SQL password / secrets KEK / ConfigServe key exception).
-# central-1/central-2 also carry the matching TelemetryDial__ApiKey. Both Telemetry__Mode and
-# TelemetryDial__Mode are left UNSET here, so every node defaults to "Dps" (dark — telemetry
-# keeps riding the existing DistributedPubSub topic). The ClusterNode.GrpcPort column (seeded
-# by docker-dev/seed/seed-clusters.sql) points central's dial supervisor at each node's :4056.
-# Unlike MeshTransport/ConfigSource, no `${VAR:-Dps}` interpolation is wired for either Mode key
-# (a bare shell export does nothing here — these keys aren't referenced anywhere in this file, so
-# there is nothing for it to substitute into). To run the Phase 5 live gate, manually add
-# `Telemetry__Mode: "Grpc"` to the `environment:` block of all six driver nodes (central-1,
-# central-2, site-a-1, site-a-2, site-b-1, site-b-2) and `TelemetryDial__Mode: "Grpc"` to
-# central-1's and central-2's blocks — or supply both via a docker-compose.override.yml carrying
-# the same keys — then `docker compose -f docker-dev/docker-compose.yml up -d` to recreate.
+# central-1/central-2 also carry the matching TelemetryDial__ApiKey. As of Phase 6, Telemetry__Mode
+# is set to "Grpc" on all six nodes and TelemetryDial__Mode is set to "Grpc" on central-1/central-2
+# ONLY — SplitTopologyTransportValidator requires it once a node carries a cluster-* role, so this
+# is no longer an optional live-gate step (see the Phase 5 comment history in git blame for the
+# prior dark-switch shape). The ClusterNode.GrpcPort column (seeded by
+# docker-dev/seed/seed-clusters.sql) points central's dial supervisor at each node's :4056.
 #
 # Usage:
 #   docker compose -f docker-dev/docker-compose.yml up -d --build
@@ -84,11 +117,57 @@ name: otopcua-dev
 # AnnounceInterval is shortened to 5s (default 30s) so anti-entropy convergence is
 # observable quickly during dev exercise. Each node keeps its own local SQLite store
 # (Secrets:SqlitePath=otopcua-secrets.db, per-container); replication syncs them.
+#
+# Per-cluster mesh Phase 6: this DPS topic now rides each pair's OWN 2-node mesh, not one
+# shared six-node mesh — so secret replication is PAIR-LOCAL. central-1/central-2 replicate
+# with each other; site-a-1/site-a-2 replicate with each other; site-b-1/site-b-2 replicate
+# with each other. There is no cross-cluster secret sync after the split (by design — the site
+# meshes don't share a gossip ring with central or with each other, consistent with Phase 4's
+# "driver-only nodes have no SQL, hence no SQL-backed cross-mesh hub" posture). No code change
+# was needed for this — Enabled=true + the same KEK on every node is still correct; it just now
+# converges within three independent 2-node groups instead of one six-node group.
 x-secrets-env: &secrets-env
  Secrets__Replication__Enabled: "true"
  Secrets__Replication__AnnounceInterval: "00:00:05"
  ZB_SECRETS_MASTER_KEY: "${OTOPCUA_SECRETS_KEK:-ZYGhIX0luS/XsevpCB2W18jYHMcqO6AjM9oXy+T6Zp4=}"

+# EVERY node that serves an OPC UA endpoint authenticates data-plane users against the shared GLAuth —
+# that includes the driver-only site nodes (ports 4842-4845), not just the admin/central pair. LDAP
+# options are validated at host start on ALL of them (Enabled=true by appsettings default, Transport=None,
+# AllowInsecure=false ⇒ OptionsValidationException), so a node that carries no LDAP config crashes at boot.
+# This anchor is merged into every host node's environment (via `<<: [*secrets-env, *ldap-env]`). Central
+# still also lists the block inline for readability; the explicit keys win over the merge, same values.
+x-ldap-env: &ldap-env
+  Security__Ldap__Enabled: "true"
+  Security__Ldap__DevStubMode: "false"
+  Security__Ldap__Server: "10.100.0.35"
+  Security__Ldap__Port: "3893"
+  Security__Ldap__Transport: "None"
+  Security__Ldap__AllowInsecure: "true"
+  Security__Ldap__SearchBase: "dc=zb,dc=local"
+  Security__Ldap__ServiceAccountDn: "cn=serviceaccount,dc=zb,dc=local"
+  Security__Ldap__ServiceAccountPassword: "serviceaccount123"
+  Security__Ldap__GroupToRole__ReadOnly: "ReadOnly"
+  Security__Ldap__GroupToRole__WriteOperate: "WriteOperate"
+  Security__Ldap__GroupToRole__WriteTune: "WriteTune"
+  Security__Ldap__GroupToRole__WriteConfigure: "WriteConfigure"
+  Security__Ldap__GroupToRole__AlarmAck: "AlarmAck"
+
+# Readiness gate for a pair FOUNDER node (site-a-1 / site-b-1): passes once its Akka port 4053 is bound.
+# The partner (site-a-2 / site-b-2) waits on this via `depends_on: { condition: service_healthy }` so the
+# founder forms its 2-node mesh FIRST and the partner JOINS it — instead of both self-first seeds racing
+# and each forming its own single-node cluster (the split brain the Phase 6 live gate observed: 250/250,
+# both Primary). `service_started` is NOT enough — it fires the instant the container launches, long
+# before Akka binds. The image ships bash but no nc/curl, so the probe uses bash's /dev/tcp. start_period
+# gives the founder a head start to not just bind but FORM (a 1-node cluster forms within the same second
+# as the bind), so the partner's InitJoin lands on an existing cluster and is ack'd.
+x-akka-founder-healthcheck: &akka-founder-healthcheck
+  test: ["CMD-SHELL", "bash -c '</dev/tcp/localhost/4053' || exit 1"]
+  interval: 3s
+  timeout: 2s
+  retries: 20
+  start_period: 8s
+
 services:

  sql:
@@ -155,8 +234,9 @@ services:

  # ── Central cluster (2-node fused admin+driver) ─────────────────────────────
  # The only UI + deploy singleton; also the MAIN cluster's OPC UA publishers.
-  # central-1 seeds the single Akka mesh that every other node joins; central-2 is a seed too
-  # (listing itself first), so it can form the mesh alone if central-1 is down.
+  # Per-cluster mesh Phase 6: central-1 and central-2 form their OWN 2-node "MAIN" Akka mesh,
+  # NOT a shared mesh with the site nodes — each lists itself first as seed, so either can
+  # cold-start while the other is down, and the site meshes are never in this pair's seed list.

  central-1: &otopcua-host
    build:
@@ -188,10 +268,16 @@ services:
      sql: { condition: service_healthy }
      migrator: { condition: service_completed_successfully }
    environment:
-      <<: *secrets-env
-      OTOPCUA_ROLES: "admin,driver"
+      <<: [*secrets-env, *ldap-env]
+      OTOPCUA_ROLES: "admin,driver,cluster-MAIN"
      ASPNETCORE_URLS: "http://+:9000"
      ConnectionStrings__ConfigDb: "Server=sql,1433;Database=OtOpcUa;User Id=sa;Password=OtOpcUa!Dev123;TrustServerCertificate=True;"
+      # Sql poll driver — the named connection string a Sql driver instance references by
+      # `connectionStringRef: "DevSql"`. Resolved in-process by SqlConnectionStringResolver (driver
+      # node) and SqlDriverBrowser (AdminUI browse), env-only, never persisted to ConfigDb. Points at
+      # the rig's own `sql` container, a SEPARATE `DevSql` database seeded with dbo.TagValues (KeyValue)
+      # + dbo.LatestStatus (WideRow). Committed-dev-secret exception, same as ConfigDb above.
+      Sql__ConnectionStrings__DevSql: "Server=sql,1433;Database=DevSql;User Id=sa;Password=OtOpcUa!Dev123;TrustServerCertificate=True;"
      Cluster__Hostname: "0.0.0.0"
      Cluster__Port: "4053"
      Cluster__PublicHostname: "central-1"
@@ -203,18 +289,22 @@ services:
      ConfigServe__GrpcListenPort: "4055"
      ConfigServe__ApiKey: "configserve-docker-dev-key"
      ConfigSource__Mode: "Direct"
-      # Per-cluster mesh Phase 5 (gRPC live-telemetry stream). DARK SWITCH — Telemetry:Mode is left
-      # unset here (defaults to "Dps"), so the node keeps publishing telemetry on the existing
-      # DistributedPubSub topic; the dedicated gRPC listener below binds regardless (the node "always
-      # hosts" per docs/Telemetry.md) so flipping the mode later is a config change, not a redeploy.
-      # Port 4056 checked free against every other port this node binds: Akka 4053, ConfigServe 4055,
-      # OPC UA 4840 (container-internal), HTTP 9000. TelemetryDial__ApiKey (below) is central's
-      # dial-side key and must equal every node's Telemetry:ApiKey (fail-closed interceptor).
+      # Per-cluster mesh Phase 5/6 (gRPC live-telemetry stream). central-1 carries a cluster-*
+      # role + admin, so SplitTopologyTransportValidator requires BOTH Telemetry:Mode=Grpc
+      # (it is also a driver node, publishing MAIN's own telemetry) AND TelemetryDial:Mode=Grpc
+      # (it is the admin-role dialer for every site node). The dedicated gRPC listener below binds
+      # regardless of mode (the node "always hosts" per docs/Telemetry.md). Port 4056 checked free
+      # against every other port this node binds: Akka 4053, ConfigServe 4055, OPC UA 4840
+      # (container-internal), HTTP 9000. TelemetryDial__ApiKey (below) is central's dial-side key
+      # and must equal every node's Telemetry:ApiKey (fail-closed interceptor).
      Telemetry__GrpcListenPort: "4056"
+      Telemetry__Mode: "Grpc"
      Telemetry__ApiKey: "telemetry-docker-dev-key"
+      TelemetryDial__Mode: "Grpc"
      TelemetryDial__ApiKey: "telemetry-docker-dev-key"
      # Both redundancy peers are seeds (#459 / ScadaBridge parity) so a restarted node can
-      # re-join the mesh via EITHER peer, not only central-1.
+      # re-join the MAIN mesh via EITHER peer — NOT via a site node; the site meshes are never in
+      # this pair's seed list (per-cluster mesh Phase 6).
      #
      # ORDER IS LOAD-BEARING (2026-07-22): each node lists ITSELF first. Akka runs
      # FirstSeedNodeProcess — the only path that can form a NEW cluster when no peer answers
@@ -223,19 +313,25 @@ services:
      # boot by AkkaClusterOptionsValidator; see docs/Redundancy.md.
      Cluster__SeedNodes__0: "akka.tcp://otopcua@central-1:4053"
      Cluster__SeedNodes__1: "akka.tcp://otopcua@central-2:4053"
+      # Per-cluster mesh Phase 6: cluster-MAIN marks this node as a member of the MAIN mesh
+      # (RoleParser.ClusterRolePrefix = "cluster-"), read by SplitTopologyTransportValidator to
+      # require ClusterClient/Grpc transports, and by ClusterRoleInfo to scope redundancy +
+      # ClusterNodeAddressReconcilerActor to ClusterId=MAIN.
      Cluster__Roles__0: "admin"
      Cluster__Roles__1: "driver"
-      # Mesh command transport (per-cluster mesh Phase 2). DARK SWITCH: the rig comes up on "Dps",
-      # the transport this repo has always used, and every node keeps its ClusterClient wiring built
-      # and its comm actor registered with the receptionist either way. Flip the whole rig with
-      # OTOPCUA_MESH_MODE=ClusterClient at `docker compose up` — no compose edit, and no rebuild.
+      Cluster__Roles__2: "cluster-MAIN"
+      # Mesh command transport (per-cluster mesh Phase 2, made mandatory by Phase 6). Central no
+      # longer shares a gossip ring with the site meshes, so DPS (gossip-only) cannot reach them —
+      # ClusterClient is the only transport that can. SplitTopologyTransportValidator refuses to
+      # start any node carrying a cluster-* role that is left on Dps, so this is fixed, not an
+      # env-var-overridable default, on every node in this file.
      #
      # Contact points are node ADDRESSES ONLY. "/system/receptionist" is appended at construction
      # time, and MeshTransportOptionsValidator refuses to start a node whose contact carries an
      # actor-path suffix, because a doubled suffix resolves to nothing and drops every ack in
      # silence. Both central nodes are listed so a driver node's client can rotate to whichever one
      # is up — that rotation is why the comm actors are per-node and NOT cluster singletons.
-      MeshTransport__Mode: "${OTOPCUA_MESH_MODE:-Dps}"
+      MeshTransport__Mode: "${OTOPCUA_MESH_MODE:-ClusterClient}"
      MeshTransport__CentralContactPoints__0: "akka.tcp://otopcua@central-1:4053"
      MeshTransport__CentralContactPoints__1: "akka.tcp://otopcua@central-2:4053"
      Security__Jwt__SigningKey: "docker-dev-signing-key-with-at-least-32-bytes-of-utf8-content-12345"
@@ -297,10 +393,16 @@ services:
      central-1: { condition: service_started }
      migrator: { condition: service_completed_successfully }
    environment:
-      <<: *secrets-env
-      OTOPCUA_ROLES: "admin,driver"
+      <<: [*secrets-env, *ldap-env]
+      OTOPCUA_ROLES: "admin,driver,cluster-MAIN"
      ASPNETCORE_URLS: "http://+:9000"
      ConnectionStrings__ConfigDb: "Server=sql,1433;Database=OtOpcUa;User Id=sa;Password=OtOpcUa!Dev123;TrustServerCertificate=True;"
+      # Sql poll driver — the named connection string a Sql driver instance references by
+      # `connectionStringRef: "DevSql"`. Resolved in-process by SqlConnectionStringResolver (driver
+      # node) and SqlDriverBrowser (AdminUI browse), env-only, never persisted to ConfigDb. Points at
+      # the rig's own `sql` container, a SEPARATE `DevSql` database seeded with dbo.TagValues (KeyValue)
+      # + dbo.LatestStatus (WideRow). Committed-dev-secret exception, same as ConfigDb above.
+      Sql__ConnectionStrings__DevSql: "Server=sql,1433;Database=DevSql;User Id=sa;Password=OtOpcUa!Dev123;TrustServerCertificate=True;"
      Cluster__Hostname: "0.0.0.0"
      Cluster__Port: "4053"
      Cluster__PublicHostname: "central-2"
@@ -309,29 +411,33 @@ services:
      ConfigServe__GrpcListenPort: "4055"
      ConfigServe__ApiKey: "configserve-docker-dev-key"
      ConfigSource__Mode: "Direct"
-      # Per-cluster mesh Phase 5 (gRPC live-telemetry stream) — see central-1. DARK SWITCH: Mode
-      # stays unset (⇒ Dps); the dedicated :4056 listener binds regardless.
+      # Per-cluster mesh Phase 5/6 (gRPC live-telemetry stream) — see central-1. central-2 carries
+      # a cluster-* role + admin, so both Telemetry:Mode=Grpc and TelemetryDial:Mode=Grpc are
+      # required (SplitTopologyTransportValidator); the dedicated :4056 listener binds regardless.
      Telemetry__GrpcListenPort: "4056"
+      Telemetry__Mode: "Grpc"
      Telemetry__ApiKey: "telemetry-docker-dev-key"
+      TelemetryDial__Mode: "Grpc"
      TelemetryDial__ApiKey: "telemetry-docker-dev-key"
      # Both redundancy peers are seeds (#459 / ScadaBridge parity) — see central-1. SELF FIRST:
      # central-2 lists itself as seed-nodes[0], which is what lets it cold-start while central-1
-      # is down (it previously listed central-1 first and simply never came Up in that case).
+      # is down (it previously listed central-1 first and simply never came Up in that case). Per
+      # per-cluster mesh Phase 6, central-2's seed list contains ONLY the MAIN pair — no site node.
      Cluster__SeedNodes__0: "akka.tcp://otopcua@central-2:4053"
      Cluster__SeedNodes__1: "akka.tcp://otopcua@central-1:4053"
+      # Per-cluster mesh Phase 6: cluster-MAIN marks this node as a member of the MAIN mesh — see
+      # central-1's Cluster__Roles comment.
      Cluster__Roles__0: "admin"
      Cluster__Roles__1: "driver"
-      # Mesh command transport (per-cluster mesh Phase 2). DARK SWITCH: the rig comes up on "Dps",
-      # the transport this repo has always used, and every node keeps its ClusterClient wiring built
-      # and its comm actor registered with the receptionist either way. Flip the whole rig with
-      # OTOPCUA_MESH_MODE=ClusterClient at `docker compose up` — no compose edit, and no rebuild.
+      Cluster__Roles__2: "cluster-MAIN"
+      # Mesh command transport (per-cluster mesh Phase 2, made mandatory by Phase 6) — see central-1.
      #
      # Contact points are node ADDRESSES ONLY. "/system/receptionist" is appended at construction
      # time, and MeshTransportOptionsValidator refuses to start a node whose contact carries an
      # actor-path suffix, because a doubled suffix resolves to nothing and drops every ack in
      # silence. Both central nodes are listed so a driver node's client can rotate to whichever one
      # is up — that rotation is why the comm actors are per-node and NOT cluster singletons.
-      MeshTransport__Mode: "${OTOPCUA_MESH_MODE:-Dps}"
+      MeshTransport__Mode: "${OTOPCUA_MESH_MODE:-ClusterClient}"
      MeshTransport__CentralContactPoints__0: "akka.tcp://otopcua@central-1:4053"
      MeshTransport__CentralContactPoints__1: "akka.tcp://otopcua@central-2:4053"
      Security__Jwt__SigningKey: "docker-dev-signing-key-with-at-least-32-bytes-of-utf8-content-12345"
@@ -379,18 +485,20 @@ services:
      - otopcua-localdb-central-2:/app/data

  # ── Site A cluster (2-node driver-only) ─────────────────────────────────────
-  # Driver-only members of the single mesh, scoped to SITE-A by ClusterId. No UI,
-  # no user auth — managed + deployed to by the central cluster over the mesh.
-  # All site nodes seed central-1.
+  # Per-cluster mesh Phase 6: site-a-1 and site-a-2 form their OWN 2-node "SITE-A" Akka mesh,
+  # separate from MAIN and SITE-B — self-first seeded WITHIN the pair, never off central. No UI,
+  # no user auth; central manages + deploys to this mesh over ClusterClient/gRPC/FetchAndCache,
+  # not gossip (central and site-a share no seed list, so they never form one ring).

  site-a-1:
    <<: *otopcua-host
+    healthcheck: *akka-founder-healthcheck
    depends_on:
      sql: { condition: service_healthy }
      central-1: { condition: service_started }
      migrator: { condition: service_completed_successfully }
    environment:
-      OTOPCUA_ROLES: "driver"
+      OTOPCUA_ROLES: "driver,cluster-SITE-A"
      # Per-cluster mesh Phase 4: driver-only site nodes hold NO ConfigDb connection string. Their
      # config comes from central via ConfigSource:Mode=FetchAndCache (gRPC fetch → LocalDb cache), their
      # scripted-alarm condition state lives in LocalDb, and central persists their deploy acks. Direct
@@ -406,32 +514,41 @@ services:
      ConfigSource__CentralFetchEndpoints__0: "http://central-1:4055"
      ConfigSource__CentralFetchEndpoints__1: "http://central-2:4055"
      ConfigSource__ApiKey: "configserve-docker-dev-key"
-      # Per-cluster mesh Phase 5 (gRPC live-telemetry stream) — see central-1/central-2. DARK
-      # SWITCH: Telemetry:Mode stays unset (⇒ Dps); the dedicated :4056 listener binds regardless
-      # (the node "always hosts" per docs/Telemetry.md). Port checked free against this node's
-      # other ports: Akka 4053, OPC UA 4840, HTTP 9000, LocalDb sync 9001 (below). ApiKey must
-      # equal central's TelemetryDial:ApiKey (fail-closed interceptor).
+      # Per-cluster mesh Phase 5/6 (gRPC live-telemetry stream) — see central-1/central-2. This
+      # node carries cluster-SITE-A + driver, so SplitTopologyTransportValidator requires
+      # Telemetry:Mode=Grpc (mandatory, not a dark switch, as of Phase 6). The dedicated :4056
+      # listener binds regardless (the node "always hosts" per docs/Telemetry.md). Port checked
+      # free against this node's other ports: Akka 4053, OPC UA 4840, HTTP 9000, LocalDb sync 9001
+      # (below). ApiKey must equal central's TelemetryDial:ApiKey (fail-closed interceptor).
      Telemetry__GrpcListenPort: "4056"
+      Telemetry__Mode: "Grpc"
      Telemetry__ApiKey: "telemetry-docker-dev-key"
-      # Site nodes are deliberately NOT seeds — they join the central pair's mesh. The self-first
-      # seed rule is conditional for exactly this reason (it binds only when a node's own address
-      # is in its own seed list), so these configs are exempt rather than broken.
-      Cluster__SeedNodes__0: "akka.tcp://otopcua@central-1:4053"
+      # Per-cluster mesh Phase 6: site-a-1 seeds its OWN "SITE-A" mesh (itself first, site-a-2
+      # second) — it no longer seeds off central-1. Central is reached over ClusterClient/gRPC/
+      # FetchAndCache, never gossip; central and site-a share no seed list.
+      Cluster__SeedNodes__0: "akka.tcp://otopcua@site-a-1:4053"
+      Cluster__SeedNodes__1: "akka.tcp://otopcua@site-a-2:4053"
+      # Simultaneous-cold-start split-brain guard (SITE-A enablement demo). With the pair no longer
+      # startup-serialized, this is what stops both self-first seeds forming their own 1-node cluster:
+      # the lower-address node (site-a-1) founds immediately; the higher (site-a-2) probes site-a-1 and
+      # joins it when reachable, or forms alone only if site-a-1 is truly down. Akka gets NO config
+      # seeds when this is on (BuildClusterOptions); ClusterBootstrapCoordinator issues JoinSeedNodes.
+      Cluster__BootstrapGuard__Enabled: "true"
      Cluster__Roles__0: "driver"
-      # Mesh command transport (per-cluster mesh Phase 2). DARK SWITCH: the rig comes up on "Dps",
-      # the transport this repo has always used, and every node keeps its ClusterClient wiring built
-      # and its comm actor registered with the receptionist either way. Flip the whole rig with
-      # OTOPCUA_MESH_MODE=ClusterClient at `docker compose up` — no compose edit, and no rebuild.
+      Cluster__Roles__1: "cluster-SITE-A"
+      # Mesh command transport (per-cluster mesh Phase 2, made mandatory by Phase 6) — see
+      # central-1/central-2. Central dials this mesh's ClusterClientReceptionist via the contact
+      # points below; there is no gossip path anymore.
      #
      # Contact points are node ADDRESSES ONLY. "/system/receptionist" is appended at construction
      # time, and MeshTransportOptionsValidator refuses to start a node whose contact carries an
      # actor-path suffix, because a doubled suffix resolves to nothing and drops every ack in
      # silence. Both central nodes are listed so a driver node's client can rotate to whichever one
      # is up — that rotation is why the comm actors are per-node and NOT cluster singletons.
-      MeshTransport__Mode: "${OTOPCUA_MESH_MODE:-Dps}"
+      MeshTransport__Mode: "${OTOPCUA_MESH_MODE:-ClusterClient}"
      MeshTransport__CentralContactPoints__0: "akka.tcp://otopcua@central-1:4053"
      MeshTransport__CentralContactPoints__1: "akka.tcp://otopcua@central-2:4053"
-      <<: *secrets-env
+      <<: [*secrets-env, *ldap-env]
      # Quiet EF/AspNetCore SQL flood — see central-1 (Serilog override). mem_limit/
      # mem_reservation are inherited from the *otopcua-host anchor.
      Serilog__MinimumLevel__Override__Microsoft.EntityFrameworkCore: "Warning"
@@ -489,8 +606,13 @@ services:
      sql: { condition: service_healthy }
      central-1: { condition: service_started }
      migrator: { condition: service_completed_successfully }
+      # SITE-A is the BOOTSTRAP-GUARD enablement demo: NO startup serialization on the pair — both
+      # nodes start simultaneously (the exact race that split-brained in the Phase 6 gate). The
+      # Cluster:BootstrapGuard (enabled in both site-a env blocks) is the ONLY thing preventing the
+      # split: it makes the lower-address node the founder and the higher-address node probe-then-join.
+      # site-b keeps the depends_on:service_healthy serialization + guard OFF, as the A/B control.
    environment:
-      OTOPCUA_ROLES: "driver"
+      OTOPCUA_ROLES: "driver,cluster-SITE-A"
      # Per-cluster mesh Phase 4: no ConfigDb string on driver-only site nodes (see site-a-1).
      Cluster__Hostname: "0.0.0.0"
      Cluster__Port: "4053"
@@ -501,26 +623,33 @@ services:
      ConfigSource__CentralFetchEndpoints__0: "http://central-1:4055"
      ConfigSource__CentralFetchEndpoints__1: "http://central-2:4055"
      ConfigSource__ApiKey: "configserve-docker-dev-key"
-      # Per-cluster mesh Phase 5 (gRPC live-telemetry stream) — see central-1/site-a-1. DARK
-      # SWITCH: Telemetry:Mode stays unset (⇒ Dps); the dedicated :4056 listener binds regardless.
+      # Per-cluster mesh Phase 5/6 (gRPC live-telemetry stream) — see central-1/site-a-1.
+      # Telemetry:Mode=Grpc is mandatory as of Phase 6 (cluster-SITE-A + driver); the dedicated
+      # :4056 listener binds regardless.
      Telemetry__GrpcListenPort: "4056"
+      Telemetry__Mode: "Grpc"
      Telemetry__ApiKey: "telemetry-docker-dev-key"
-      Cluster__SeedNodes__0: "akka.tcp://otopcua@central-1:4053"
+      # Per-cluster mesh Phase 6: site-a-2 seeds its OWN "SITE-A" mesh (itself first, site-a-1
+      # second) — it no longer seeds off central-1.
+      Cluster__SeedNodes__0: "akka.tcp://otopcua@site-a-2:4053"
+      Cluster__SeedNodes__1: "akka.tcp://otopcua@site-a-1:4053"
+      # Bootstrap-guard enablement demo — see site-a-1. site-a-2 is the HIGHER address, so the guard
+      # makes it probe site-a-1 and join it (peer-first) rather than race-form its own cluster.
+      Cluster__BootstrapGuard__Enabled: "true"
      Cluster__Roles__0: "driver"
-      # Mesh command transport (per-cluster mesh Phase 2). DARK SWITCH: the rig comes up on "Dps",
-      # the transport this repo has always used, and every node keeps its ClusterClient wiring built
-      # and its comm actor registered with the receptionist either way. Flip the whole rig with
-      # OTOPCUA_MESH_MODE=ClusterClient at `docker compose up` — no compose edit, and no rebuild.
+      Cluster__Roles__1: "cluster-SITE-A"
+      # Mesh command transport (per-cluster mesh Phase 2, made mandatory by Phase 6) — see
+      # central-1/site-a-1.
      #
      # Contact points are node ADDRESSES ONLY. "/system/receptionist" is appended at construction
      # time, and MeshTransportOptionsValidator refuses to start a node whose contact carries an
      # actor-path suffix, because a doubled suffix resolves to nothing and drops every ack in
      # silence. Both central nodes are listed so a driver node's client can rotate to whichever one
      # is up — that rotation is why the comm actors are per-node and NOT cluster singletons.
-      MeshTransport__Mode: "${OTOPCUA_MESH_MODE:-Dps}"
+      MeshTransport__Mode: "${OTOPCUA_MESH_MODE:-ClusterClient}"
      MeshTransport__CentralContactPoints__0: "akka.tcp://otopcua@central-1:4053"
      MeshTransport__CentralContactPoints__1: "akka.tcp://otopcua@central-2:4053"
-      <<: *secrets-env
+      <<: [*secrets-env, *ldap-env]
      Serilog__MinimumLevel__Override__Microsoft.EntityFrameworkCore: "Warning"
      Serilog__MinimumLevel__Override__Microsoft.AspNetCore: "Warning"
      GALAXY_MXGW_API_KEY: "${GALAXY_MXGW_API_KEY:-mxgw_otopcua2_GI7-tNozYE6cXGUSgEzL3AHDV7bYcYIHdMwKYgyHdX4}"
@@ -563,15 +692,18 @@ services:
      - otopcua-localdb-site-a-2:/app/data

  # ── Site B cluster (2-node driver-only) ─────────────────────────────────────
+  # Per-cluster mesh Phase 6: site-b-1 and site-b-2 form their OWN 2-node "SITE-B" Akka mesh,
+  # separate from MAIN and SITE-A — same shape as site-a-1/site-a-2, see that pair's header.

  site-b-1:
    <<: *otopcua-host
+    healthcheck: *akka-founder-healthcheck
    depends_on:
      sql: { condition: service_healthy }
      central-1: { condition: service_started }
      migrator: { condition: service_completed_successfully }
    environment:
-      OTOPCUA_ROLES: "driver"
+      OTOPCUA_ROLES: "driver,cluster-SITE-B"
      # Per-cluster mesh Phase 4: no ConfigDb string on driver-only site nodes (see site-a-1).
      Cluster__Hostname: "0.0.0.0"
      Cluster__Port: "4053"
@@ -582,26 +714,30 @@ services:
      ConfigSource__CentralFetchEndpoints__0: "http://central-1:4055"
      ConfigSource__CentralFetchEndpoints__1: "http://central-2:4055"
      ConfigSource__ApiKey: "configserve-docker-dev-key"
-      # Per-cluster mesh Phase 5 (gRPC live-telemetry stream) — see central-1/site-a-1. DARK
-      # SWITCH: Telemetry:Mode stays unset (⇒ Dps); the dedicated :4056 listener binds regardless.
+      # Per-cluster mesh Phase 5/6 (gRPC live-telemetry stream) — see central-1/site-a-1.
+      # Telemetry:Mode=Grpc is mandatory as of Phase 6 (cluster-SITE-B + driver); the dedicated
+      # :4056 listener binds regardless.
      Telemetry__GrpcListenPort: "4056"
+      Telemetry__Mode: "Grpc"
      Telemetry__ApiKey: "telemetry-docker-dev-key"
-      Cluster__SeedNodes__0: "akka.tcp://otopcua@central-1:4053"
+      # Per-cluster mesh Phase 6: site-b-1 seeds its OWN "SITE-B" mesh (itself first, site-b-2
+      # second) — it no longer seeds off central-1.
+      Cluster__SeedNodes__0: "akka.tcp://otopcua@site-b-1:4053"
+      Cluster__SeedNodes__1: "akka.tcp://otopcua@site-b-2:4053"
      Cluster__Roles__0: "driver"
-      # Mesh command transport (per-cluster mesh Phase 2). DARK SWITCH: the rig comes up on "Dps",
-      # the transport this repo has always used, and every node keeps its ClusterClient wiring built
-      # and its comm actor registered with the receptionist either way. Flip the whole rig with
-      # OTOPCUA_MESH_MODE=ClusterClient at `docker compose up` — no compose edit, and no rebuild.
+      Cluster__Roles__1: "cluster-SITE-B"
+      # Mesh command transport (per-cluster mesh Phase 2, made mandatory by Phase 6) — see
+      # central-1/site-a-1.
      #
      # Contact points are node ADDRESSES ONLY. "/system/receptionist" is appended at construction
      # time, and MeshTransportOptionsValidator refuses to start a node whose contact carries an
      # actor-path suffix, because a doubled suffix resolves to nothing and drops every ack in
      # silence. Both central nodes are listed so a driver node's client can rotate to whichever one
      # is up — that rotation is why the comm actors are per-node and NOT cluster singletons.
-      MeshTransport__Mode: "${OTOPCUA_MESH_MODE:-Dps}"
+      MeshTransport__Mode: "${OTOPCUA_MESH_MODE:-ClusterClient}"
      MeshTransport__CentralContactPoints__0: "akka.tcp://otopcua@central-1:4053"
      MeshTransport__CentralContactPoints__1: "akka.tcp://otopcua@central-2:4053"
-      <<: *secrets-env
+      <<: [*secrets-env, *ldap-env]
      Serilog__MinimumLevel__Override__Microsoft.EntityFrameworkCore: "Warning"
      Serilog__MinimumLevel__Override__Microsoft.AspNetCore: "Warning"
      GALAXY_MXGW_API_KEY: "${GALAXY_MXGW_API_KEY:-mxgw_otopcua2_GI7-tNozYE6cXGUSgEzL3AHDV7bYcYIHdMwKYgyHdX4}"
@@ -634,8 +770,12 @@ services:
      sql: { condition: service_healthy }
      central-1: { condition: service_started }
      migrator: { condition: service_completed_successfully }
+      # Serialize the SITE-B pair's startup so site-b-1 forms the mesh first and site-b-2 JOINS it — see
+      # the identical comment on site-a-2. Without this both self-first seeds form their own single-node
+      # cluster on simultaneous start (split brain).
+      site-b-1: { condition: service_healthy }
    environment:
-      OTOPCUA_ROLES: "driver"
+      OTOPCUA_ROLES: "driver,cluster-SITE-B"
      # Per-cluster mesh Phase 4: no ConfigDb string on driver-only site nodes (see site-a-1).
      Cluster__Hostname: "0.0.0.0"
      Cluster__Port: "4053"
@@ -646,26 +786,30 @@ services:
      ConfigSource__CentralFetchEndpoints__0: "http://central-1:4055"
      ConfigSource__CentralFetchEndpoints__1: "http://central-2:4055"
      ConfigSource__ApiKey: "configserve-docker-dev-key"
-      # Per-cluster mesh Phase 5 (gRPC live-telemetry stream) — see central-1/site-a-1. DARK
-      # SWITCH: Telemetry:Mode stays unset (⇒ Dps); the dedicated :4056 listener binds regardless.
+      # Per-cluster mesh Phase 5/6 (gRPC live-telemetry stream) — see central-1/site-a-1.
+      # Telemetry:Mode=Grpc is mandatory as of Phase 6 (cluster-SITE-B + driver); the dedicated
+      # :4056 listener binds regardless.
      Telemetry__GrpcListenPort: "4056"
+      Telemetry__Mode: "Grpc"
      Telemetry__ApiKey: "telemetry-docker-dev-key"
-      Cluster__SeedNodes__0: "akka.tcp://otopcua@central-1:4053"
+      # Per-cluster mesh Phase 6: site-b-2 seeds its OWN "SITE-B" mesh (itself first, site-b-1
+      # second) — it no longer seeds off central-1.
+      Cluster__SeedNodes__0: "akka.tcp://otopcua@site-b-2:4053"
+      Cluster__SeedNodes__1: "akka.tcp://otopcua@site-b-1:4053"
      Cluster__Roles__0: "driver"
-      # Mesh command transport (per-cluster mesh Phase 2). DARK SWITCH: the rig comes up on "Dps",
-      # the transport this repo has always used, and every node keeps its ClusterClient wiring built
-      # and its comm actor registered with the receptionist either way. Flip the whole rig with
-      # OTOPCUA_MESH_MODE=ClusterClient at `docker compose up` — no compose edit, and no rebuild.
+      Cluster__Roles__1: "cluster-SITE-B"
+      # Mesh command transport (per-cluster mesh Phase 2, made mandatory by Phase 6) — see
+      # central-1/site-a-1.
      #
      # Contact points are node ADDRESSES ONLY. "/system/receptionist" is appended at construction
      # time, and MeshTransportOptionsValidator refuses to start a node whose contact carries an
      # actor-path suffix, because a doubled suffix resolves to nothing and drops every ack in
      # silence. Both central nodes are listed so a driver node's client can rotate to whichever one
      # is up — that rotation is why the comm actors are per-node and NOT cluster singletons.
-      MeshTransport__Mode: "${OTOPCUA_MESH_MODE:-Dps}"
+      MeshTransport__Mode: "${OTOPCUA_MESH_MODE:-ClusterClient}"
      MeshTransport__CentralContactPoints__0: "akka.tcp://otopcua@central-1:4053"
      MeshTransport__CentralContactPoints__1: "akka.tcp://otopcua@central-2:4053"
-      <<: *secrets-env
+      <<: [*secrets-env, *ldap-env]
      Serilog__MinimumLevel__Override__Microsoft.EntityFrameworkCore: "Warning"
      Serilog__MinimumLevel__Override__Microsoft.AspNetCore: "Warning"
      GALAXY_MXGW_API_KEY: "${GALAXY_MXGW_API_KEY:-mxgw_otopcua2_GI7-tNozYE6cXGUSgEzL3AHDV7bYcYIHdMwKYgyHdX4}"
@@ -106,6 +106,28 @@ IF NOT EXISTS (SELECT 1 FROM dbo.ClusterNode WHERE NodeId = 'site-b-2:4053')
        (NodeId, ClusterId, Host, OpcUaPort, DashboardPort, AkkaPort, GrpcPort, ApplicationUri, ServiceLevelBase, Enabled, CreatedBy)
    VALUES ('site-b-2:4053', 'SITE-B', 'site-b-2', 4840, 8081, 4053, 4056, 'urn:OtOpcUa:site-b-2', 150, 1, 'docker-dev-seed');

+------------------------------------------------------------------------------
+-- Backfill: GrpcPort on rows that predate the column (#493)
+--
+-- Every insert above is INSERT-if-not-exists, which is the right shape for a re-runnable seed
+-- but means a *new nullable* column never reaches rows created by an earlier version of this
+-- file. On a persisted volume that is exactly what happened when Phase 5 added GrpcPort: the
+-- six ClusterNode rows already existed, so they kept NULL, TelemetryNodeSource found no dial
+-- targets, and TelemetryDial:Mode=Grpc silently connected to nothing (throttled Warning per
+-- node — the code degrades gracefully, so nothing failed loudly).
+--
+-- Backfills NULL only. It must not overwrite a port an operator set deliberately on a
+-- long-lived dev volume; a NULL is the unambiguous "this row predates the column" marker.
+--
+-- AkkaPort deliberately has no equivalent here: it is NOT NULL with a default of 4053, so
+-- pre-existing rows already carry a usable value and there is nothing to backfill.
+------------------------------------------------------------------------------
+
+UPDATE dbo.ClusterNode
+   SET GrpcPort = 4056          -- matches Telemetry__GrpcListenPort on all six nodes in docker-compose.yml
+ WHERE GrpcPort IS NULL
+   AND CreatedBy = 'docker-dev-seed';
+
 ------------------------------------------------------------------------------
 -- Galaxy MxAccess gateway — INTENTIONALLY NOT SEEDED (retired 2026-06-15)
 --
@@ -1,5 +1,27 @@
 # Address Space

+> ⚠️ **Accuracy warning (audited 2026-07-27) — this page is v2-era and contradicts the shipped v3
+> address space.** Corrections, in order of how badly they mislead:
+>
+> - **There is no "single custom namespace".** v3 exposes **two**:
+>   `https://zb.com/otopcua/raw` (`s=<RawPath>`) and `https://zb.com/otopcua/uns`
+>   (`s=<Area>/<Line>/<Equipment>/<EffectiveName>`), registered together at
+>   `OtOpcUaNodeManager.cs:45`. Identity authority is `V3NodeIds` + `AddressSpaceRealm`. The retired
+>   `https://zb.com/otopcua/ns` survives only in a comment marking it retired (`V3NodeIds.cs:17`).
+> - **`Phase7Applier` / `Phase7Composer` / `GalaxyTagPlan` do not exist**, nor do the file paths cited
+>   for them. Renamed by `40e8a23e` to `AddressSpaceApplier` / `AddressSpaceComposer`
+>   (`src/Server/ZB.MOM.WW.OtOpcUa.OpcUaServer/`); the composition result type is
+>   `AddressSpaceComposition` (`AddressSpaceComposer.cs:13`).
+> - **The `SystemPlatform` namespace kind is retired** — Galaxy is a standard Equipment-kind driver.
+> - **`GenericDriverNodeManager` is test scaffolding**, not a production dispatch path
+>   (`GenericDriverNodeManager.cs:71`).
+> - **The §Rediscovery section is wrong**: nothing consumes `OnRediscoveryNeeded`
+>   ([#518](https://gitea.dohertylan.com/dohertj2/lmxopcua/issues/518)), and the driver list is stale
+>   (MQTT and MTConnect now raise it too).
+>
+> For the current design see the "v3 OPC UA Address Space (Batch 4)" section of `CLAUDE.md`,
+> `docs/Raw.md`, and `docs/Uns.md`.
+
 Address-space construction is a two-layer system. The **driver-facing layer** is the streaming builder: a driver implements `ITagDiscovery.DiscoverAsync` (`src/Core/ZB.MOM.WW.OtOpcUa.Core.Abstractions/ITagDiscovery.cs`) and emits `Folder` / `Variable` / `AddProperty` calls into an `IAddressSpaceBuilder` as it walks its backend — no buffering of the whole tree. `GenericDriverNodeManager` (`src/Core/ZB.MOM.WW.OtOpcUa.Core/OpcUa/GenericDriverNodeManager.cs`) wraps that builder to capture alarm-condition sinks and routes alarm events from the driver to them. The **SDK materialization layer** turns the resulting node descriptions into live OPC UA nodes: `OpcUaPublishActor` drives the write-only `IOpcUaAddressSpaceSink`, whose production binding `SdkAddressSpaceSink` (`src/Server/ZB.MOM.WW.OtOpcUa.OpcUaServer/SdkAddressSpaceSink.cs`) forwards to `OtOpcUaNodeManager` (`src/Server/ZB.MOM.WW.OtOpcUa.OpcUaServer/OtOpcUaNodeManager.cs`), a `CustomNodeManager2` subclass that owns the `FolderState` / `BaseDataVariableState` instances. The same code path serves Galaxy object hierarchies, Modbus PLC registers, AB CIP tags, TwinCAT symbols, FOCAS CNC parameters, and OPC UA Client aggregations — Galaxy is one driver of seven, not the driver.

 ## Root folder
@@ -103,13 +103,40 @@ The checked-in `appsettings*.json` files are deliberately thin: they carry only
 | `Hostname` | string | `0.0.0.0` | Bind hostname. |
 | `Port` | int | `4053` | Cluster transport port. **Duplicated as `ClusterNode.AkkaPort` in the Config DB** — see the note below. |
 | `PublicHostname` | string | `127.0.0.1` | Hostname advertised in cluster gossip; must be reachable by peers. **Duplicated as `ClusterNode.Host`** — see the note below. |
-| `SeedNodes` | string[] | `[]` | Seed nodes for bootstrapping. **Ordered:** a node that appears in its own list must be entry 0 (only `seed-nodes[0]` can form a new cluster), or the host refuses to start — see [Redundancy.md § Bootstrap: self-first seed ordering](Redundancy.md#bootstrap-self-first-seed-ordering). |
-| `Roles` | string[] | `[]` | Cluster roles for this node. When empty, falls back to `OTOPCUA_ROLES`. Allowed values: `admin`, `driver`, `dev`. |
+| `SeedNodes` | string[] | `[]` | Seed nodes for bootstrapping. **Ordered:** a node that appears in its own list must be entry 0 (only `seed-nodes[0]` can form a new cluster), or the host refuses to start — see [Redundancy.md § Bootstrap: self-first seed ordering](Redundancy.md#bootstrap-self-first-seed-ordering). **Per-pair since Phase 6:** each application `Cluster`'s pair is its own Akka mesh, so a node's `SeedNodes` lists only itself (first) and its own pair partner (second) — never a node from another cluster's pair. |
+| `Roles` | string[] | `[]` | Cluster roles for this node. When empty, falls back to `OTOPCUA_ROLES`. Allowed values: `admin`, `driver`, `dev`, plus a per-cluster `cluster-{ClusterId}` role (e.g. `cluster-MAIN`, `cluster-SITE-A`) — see [Per-cluster mesh split (Phase 6)](#per-cluster-mesh-split-phase-6-cluster-clusterid-roles--splittopologytransportvalidator) below. |

 > The full redundancy model (ServiceLevel tiers, split-brain, peer discovery) is in [`Redundancy.md`](Redundancy.md). The OPC UA peer-URI advertising lives in the `OpcUa:PeerApplicationUris` key above.

 > **`Port` / `PublicHostname` are stored twice.** The node binds from these keys; the fleet's `ClusterNode` row records the same address as `AkkaPort` / `Host` so that **central can dial the node without sharing a gossip ring with it** — which is what [per-cluster mesh Phase 2](plans/2026-07-21-per-cluster-mesh-design.md) needs. Nothing in the schema makes the two agree, so `ClusterNodeAddressReconcilerActor` (admin-role singleton) compares them against live membership and logs an Error on mismatch. If you change `Cluster:Port` or `Cluster:PublicHostname` on a node, **update its `ClusterNode` row too** — a node binding 4054 with a row saying 4053 still gossips fine today, and fails silently in Phase 2. The row's `NodeId` is `host:port` and is also the deploy path's ack identity, so a drifted node's deployment acks stop matching as well. See [`config-db-schema.md` § `ClusterNode`](v2/config-db-schema.md#clusternode).

+### Per-cluster mesh split (Phase 6): `cluster-{ClusterId}` roles + `SplitTopologyTransportValidator`
+
+- **Purpose:** [per-cluster mesh](plans/2026-07-22-per-cluster-mesh-program.md) **Phase 6** split the
+  single fleet-wide Akka mesh into one independent 2-node mesh per application `Cluster`. A node's
+  `Cluster:Roles` now carries a `cluster-{ClusterId}` role alongside `driver` (and `admin` for a fused
+  central node) — e.g. `driver,cluster-SITE-A` — and its `Cluster:SeedNodes` lists only itself and its
+  own pair partner (see the `Roles`/`SeedNodes` rows above). Nodes in different clusters never gossip
+  with each other.
+- **`SplitTopologyTransportValidator`** (`src/Core/ZB.MOM.WW.OtOpcUa.Cluster/`, wired at
+  `ValidateOnStart` alongside the other `Cluster`-family validators) fails host start on any node
+  carrying a `cluster-{ClusterId}` role unless it is also configured for the split-safe transports:
+  `MeshTransport:Mode = ClusterClient`, `Telemetry:Mode = Grpc` on a driver node, `TelemetryDial:Mode =
+  Grpc` on an admin node. A DPS-mode transport on a cluster-role node would try to gossip across a
+  partition boundary that no longer exists, so the validator fails closed rather than let commands or
+  telemetry silently vanish. A legacy node with no `cluster-{ClusterId}` role is exempt and may stay on
+  `Dps`.
+- **The compiled transport-mode defaults were deliberately NOT flipped.** `MeshTransport:Mode`,
+  `Telemetry:Mode`, and `TelemetryDial:Mode` (documented below) all still default to `Dps` — a
+  blast-radius assessment found that flipping the compiled default would break every integration test
+  and every existing `appsettings.json` profile that leaves these keys unset. `SplitTopologyTransportValidator`
+  plus explicit per-deployment configuration is the guardrail, not a default flip; every node that
+  actually carries a `cluster-{ClusterId}` role must set the split-safe modes explicitly.
+- See [`Redundancy.md` § Per-cluster meshes (Phase 6)](Redundancy.md#per-cluster-meshes-phase-6) for the
+  full runtime picture (one Primary per pair, the cluster-scoped `RedundancyStateActor` singleton,
+  `ClusterNodeAddressReconciler` own-cluster-scoping, and central's one-`ClusterClient`-per-`Cluster`
+  fan-out).
+
 ### `MeshTransport` (central↔node command transport)

 - **Purpose:** selects how central's three command channels (`deployments`, `driver-control`, `alarm-commands`) and the node's `deployment-acks` reply reach the other side — over the mesh-wide DistributedPubSub, or over an Akka `ClusterClient` that does **not** require central and the node to share a gossip ring. The second option is what [per-cluster mesh](plans/2026-07-21-per-cluster-mesh-design.md) Phase 6 needs once the meshes split.
@@ -114,6 +114,21 @@ source it from there.
 > hardcodes OPC-DA Good, `192`). Capturing real per-node quality will not persist until the gateway honors
 > the field — see `GatewayHistorianValueWriter`'s remarks (archreview 06/C-7).

+> ⚠️ **Continuous value capture is code-complete but UNPROVEN IN PRODUCTION
+> ([#491](https://gitea.dohertylan.com/dohertj2/lmxopcua/issues/491)).** The recorder, the FasterLog
+> outbox, the gateway value-writer and the deploy-time historized-ref feed
+> (`AddressSpaceApplier.FeedHistorizedRefs` → `ActorHistorizedTagSubscriptionSink` →
+> `ContinuousHistorizationRecorder.UpdateHistorizedRefs`) are all wired, and the recorder converges to
+> the deployed ref set from the first deploy onward. What has **not** run is the end-to-end live gate
+> (deploy → dependency-mux value delta → outbox append → `WriteLiveValues`) plus a restart-convergence
+> test. **Reads and alarm-writes are live-validated; treat value capture as unproven rather than
+> absent.** See the "KNOWN LIMITATION 2" section of `CLAUDE.md`.
+>
+> **Related, separately open:** `EnsureTags` provisioning fires only for **newly-added** historized
+> tags (`AddressSpaceApplier` iterates the added set), so flipping an **existing** tag to
+> `"isHistorized": true` never provisions it — see
+> `docs/plans/2026-06-27-historian-gateway-integration-issues.md` Issue 5.
+
 ---

 ## Tag auto-provisioning (EnsureTags)
@@ -1,5 +1,26 @@
 # Incremental Sync

+> ⚠️ **Accuracy warning (audited 2026-07-27) — most of this page describes machinery that is retired
+> or was never wired.** Read it as v2-era design history, not as current behaviour.
+>
+> - **"Rebuild flow" (below) is not a production path.** It is built on `GenericDriverNodeManager`,
+>   which is Core test scaffolding with **zero production references**
+>   (`GenericDriverNodeManager.cs:71`). Its `_variablesByFullRef` / `_sourceByFullRef` fields do not
+>   exist in `src/`.
+> - **Driver-backend rediscovery has no consumer.** Nothing in `src/Server/` or `src/Core/`
+>   subscribes to `IRediscoverable.OnRediscoveryNeeded`; `DriverHostActor.HandleDiscoveredNodes`
+>   (`DriverHostActor.cs:986-1002`) short-circuits unconditionally. The `ScopeHint` is read by
+>   nothing. Drivers that raise it today: Galaxy, TwinCAT, MQTT/Sparkplug, MTConnect
+>   ([#518](https://gitea.dohertylan.com/dohertj2/lmxopcua/issues/518),
+>   [#507](https://gitea.dohertylan.com/dohertj2/lmxopcua/issues/507)).
+> - **The generation-publish path is retired.** `sp_PublishGeneration` and
+>   `sp_ComputeGenerationDiff` are stubs that `RAISERROR`
+>   (`20260715230637_V3Initial.StoredProcedures.cs:194`); `DraftRevisionToken` does not exist.
+>
+> **The one live rebuild path in v3** is the deploy artifact: `ConfigComposer` →
+> `Deployment.ArtifactBlob` → `DriverHostActor` apply → `AddressSpaceComposer` /
+> `AddressSpaceApplier` diff-apply.
+
 Two distinct change-detection paths feed the running server: driver-backend rediscovery (Galaxy's `time_of_last_deploy`, TwinCAT's symbol-version-changed) and generation-level config publishes from the Admin UI. Both flow into re-runs of `ITagDiscovery.DiscoverAsync`, but they originate differently.

 ## Driver-backend rediscovery — IRediscoverable
@@ -11,7 +11,7 @@ In v2 the Server and Admin processes were fused into a single role-gated `ZB.MOM
 - `CreateMasterNodeManager` constructs one `OtOpcUaNodeManager` (`src/Server/ZB.MOM.WW.OtOpcUa.OpcUaServer/OtOpcUaNodeManager.cs`) — a `CustomNodeManager2` subclass that owns the writable address space under the namespace `https://zb.com/otopcua/ns` and a single `OtOpcUa` root folder organized under the standard `Objects` folder. It is wrapped in a `MasterNodeManager` with no additional core managers.
 - `OtOpcUaSdkServer.NodeManager` exposes the live node manager after `StartAsync`, so the hosting layer can wrap it in a `SdkAddressSpaceSink` (`src/Server/ZB.MOM.WW.OtOpcUa.OpcUaServer/SdkAddressSpaceSink.cs`) and hand it to `OpcUaPublishActor`.

-Address-space population is push-driven: drivers stream discovery and data-change events through the Akka actor system (`DriverInstanceActor` → `OpcUaPublishActor`), and `OpcUaPublishActor` writes them into the node manager through the `IOpcUaAddressSpaceSink` seam. `OtOpcUaNodeManager.EnsureFolder` / `EnsureVariable` materialize the UNS folder + variable hierarchy; `WriteValue` / `WriteAlarmState` push runtime values and fire `ClearChangeMasks` so subscribed clients see updates.
+Address-space population is push-driven: drivers stream discovery and data-change events through the Akka actor system (`DriverInstanceActor` → `OpcUaPublishActor`), and `OpcUaPublishActor` writes them into the node manager through the `IOpcUaAddressSpaceSink` seam. `OtOpcUaNodeManager.EnsureFolder` / `EnsureVariable` materialize the UNS folder + variable hierarchy; `WriteValue` / `WriteAlarmCondition` push runtime values and fire `ClearChangeMasks` so subscribed clients see updates.

 The driver-agnostic walk that turns a driver's discovery into folder/variable calls lives in `GenericDriverNodeManager` (`src/Core/ZB.MOM.WW.OtOpcUa.Core/OpcUa/GenericDriverNodeManager.cs`): it walks `ITagDiscovery.DiscoverAsync` into an `IAddressSpaceBuilder`, captures alarm-condition sinks for variables flagged via `IVariableHandle.MarkAsAlarmCondition`, subscribes to `IAlarmSource.OnAlarmEvent`, and routes each alarm transition to the sink registered for its `SourceNodeId`.

@@ -48,7 +48,7 @@ The server binds a TCP endpoint at `opc.tcp://{PublicHostname}:{OpcUaPort}/OtOpc

 `OpcUaApplicationHost` subscribes to `SessionManager.ImpersonateUser` after `ApplicationInstance.Start`. The handler (`HandleImpersonation`) deals with the token types as follows:

- `UserNameIdentityToken` → the password is decrypted, then `IOpcUaUserAuthenticator.AuthenticateUserNameAsync` validates the credential (`LdapUserAuthenticator` in production, a stub in tests). On success a `UserIdentity` carrying the token is attached and the LDAP-derived roles are logged; on failure `ImpersonateEventArgs.IdentityValidationError` is set to `BadIdentityTokenRejected`.
+- `UserNameIdentityToken` → the password is decrypted, then `IOpcUaUserAuthenticator.AuthenticateUserNameAsync` validates the credential (`LdapOpcUaUserAuthenticator` in production, a stub in tests). On success a `UserIdentity` carrying the token is attached and the LDAP-derived roles are logged; on failure `ImpersonateEventArgs.IdentityValidationError` is set to `BadIdentityTokenRejected`.
 - `AnonymousIdentityToken` and X.509 tokens → the handler returns without intervening, so the SDK's default validation stands.

 Decryption failures and authenticator exceptions also map to `BadIdentityTokenRejected`.
@@ -62,7 +62,7 @@ For Modbus / S7 / AB CIP / AB Legacy / TwinCAT / FOCAS / OPC UA Client specifics
 | [Configuration.md](v1/Configuration.md) | appsettings bootstrap + Config DB + Admin UI draft/publish (v1 archive — `OTOPCUA_GALAXY_*` env vars now live in mxaccessgw config) |
 | [Uns.md](Uns.md) | The global `/uns` master tree — manage Area/Line/Equipment/Tag/VirtualTag fleet-wide; replaces the per-cluster UNS/Equipment/Tags tabs |
 | [security.md](security.md) | Transport security profiles, LDAP auth, ACL trie, role grants, OTOPCUA0001 analyzer |
-| [Redundancy.md](Redundancy.md) | `RedundancyCoordinator`, `ServiceLevelCalculator`, apply-lease, Prometheus metrics |
+| [Redundancy.md](Redundancy.md) | `RedundancyStateActor` (cluster-scoped singleton), `ServiceLevelCalculator`, `IRedundancyRoleView`, per-cluster meshes, Prometheus metrics |
 | [Reservations.md](Reservations.md) | Fleet-wide ZTag / SAPID external-ID reservations — publish-time claim, release flow |
 | [ServiceHosting.md](ServiceHosting.md) | Single fused `OtOpcUa.Host` binary install/uninstall with `OTOPCUA_ROLES` gating; the historian backend is the external HistorianGateway |
 | [StatusDashboard.md](StatusDashboard.md) | Pointer — superseded by [v2/admin-ui.md](v2/admin-ui.md) |
@@ -1,67 +1,120 @@
 # Read/Write Operations

-The v2 server routes OPC UA Read and Write operations to each driver's `IReadable` and `IWritable` capabilities through `CapabilityInvoker` so the Polly pipeline (retry / timeout / breaker) applies uniformly across Galaxy, Modbus, S7, AB CIP, AB Legacy, TwinCAT, FOCAS, and OPC UA Client drivers. The per-variable `OnReadValue` and `OnWriteValue` hooks described in the sections below live in `DriverNodeManager` (the planned ADR-002 Phase 7 Stream G successor to the v1 `DriverNodeManager`); `GenericDriverNodeManager` (`src/Core/ZB.MOM.WW.OtOpcUa.Core/OpcUa/GenericDriverNodeManager.cs`) handles address-space population and alarm routing during discovery. The current `OtOpcUaNodeManager` (`src/Server/ZB.MOM.WW.OtOpcUa.OpcUaServer/OtOpcUaNodeManager.cs`) is a push-model `CustomNodeManager2` that receives values from the Akka actor layer via `WriteValue`; OPC UA client reads return the cached pushed value.
+> **Rewritten 2026-07-27** against `src/Server/ZB.MOM.WW.OtOpcUa.OpcUaServer/OtOpcUaNodeManager.cs`.
+> The previous revision described a v2-era `DriverNodeManager` with per-variable `OnReadValue` hooks,
+> an `AuthorizationGate`/`WriteAuthzPolicy` ACL pair and a `NodeSourceKind` dispatch switch. **None of
+> those exist** — `OnReadValue`, `WriteAuthzPolicy`, `_sourceByFullRef`, `_writeIdempotentByFullRef`
+> and `IRoleBearer` all have zero occurrences in `src/`. The read path in particular worked nothing
+> like the way it was documented. See `deferment.md` §3.1 and §7.

-## Driver vs virtual dispatch
+## The shape of it: push for reads, pull for writes

-Per [ADR-002](v2/implementation/adr-002-driver-vs-virtual-dispatch.md), a single `DriverNodeManager` routes reads and writes across both driver-sourced and virtual (scripted) tags. At discovery time each variable registers a `NodeSourceKind` (`src/Core/ZB.MOM.WW.OtOpcUa.Core.Abstractions/DriverAttributeInfo.cs`) in the manager's `_sourceByFullRef` lookup; the read/write hooks pattern-match on that value to pick the backend:
+The live server is `OtOpcUaNodeManager`, a **push-model** `CustomNodeManager2`. This asymmetry is the
+single most important thing on this page:

- `NodeSourceKind.Driver` — dispatches to the driver's `IReadable` / `IWritable` through `CapabilityInvoker` (the rest of this doc).
- `NodeSourceKind.Virtual` — dispatches to `VirtualTagSource` (`src/Core/ZB.MOM.WW.OtOpcUa.Core.VirtualTags/VirtualTagSource.cs`), which wraps `VirtualTagEngine`. Writes are rejected with `BadUserAccessDenied` before the branch per Phase 7 decision #6 — scripts are the only write path into virtual tags.
- `NodeSourceKind.ScriptedAlarm` — dispatches to the Phase 7 `ScriptedAlarmReadable` shim.
+- **Reads never reach a driver.** There is no `Read` override and no `OnReadValue` / `OnSimpleReadValue`
+  handler anywhere in the node manager. Driver values are *pushed in* from the Akka actor layer
+  (`DriverInstanceActor` polls or subscribes, `DriverHostActor` fans the value to the raw NodeId and
+  every referencing UNS NodeId), and a client Read is served by the OPC UA SDK straight from the
+  cached node value. A client read therefore costs nothing on the wire to the device, and cannot fail
+  with a device error — it returns whatever quality was last pushed.
+- **Writes are synchronous pull-through.** A client write runs `OnWriteValue` → role gate → driver.

-ACL enforcement (`WriteAuthzPolicy` + `AuthorizationGate`) runs before the source branch, so the gates below apply uniformly to all three source kinds.
+Everything the old page said about `CapabilityInvoker` wrapping OPC UA reads was misplaced: the
+invoker is real, but it lives on the **driver-actor** side wrapping the poll/subscribe calls. The
+`OpcUaServer` project does not reference it at all.

-## OnReadValue
+## Read path

-The hook is registered on every `BaseDataVariableState` created by the `IAddressSpaceBuilder.Variable(...)` call during discovery. When the stack dispatches a Read for a node in this namespace:
+1. The SDK resolves the NodeId in the Raw (`ns=2`) or UNS (`ns=3`) namespace.
+2. It returns the cached `DataValue` — value, `StatusCode` and source timestamp as last pushed.
+3. **No authorization check runs.** Not a per-node ACL, not a role check, nothing. Any admitted
+   session — including an Anonymous one — can read every node in the address space. The only gating is
+   the `AccessLevels` bitmask set at materialization, which is a per-node *capability* declaration, not
+   a per-user decision.

-1. If the driver does not implement `IReadable`, the hook returns `BadNotReadable`.
-2. The node's `NodeId.Identifier` is used directly as the driver-side full reference — it matches `DriverAttributeInfo.FullName` registered at discovery time.
-3. (Phase 6.2) If an `AuthorizationGate` + `NodeScopeResolver` are wired, the gate is consulted first via `IsAllowed(identity, OpcUaOperation.Read, scope)`. A denied read never hits the driver.
-4. The call is wrapped by `_invoker.ExecuteAsync(DriverCapability.Read, ResolveHostFor(fullRef), …)`. The resolved host is `IPerCallHostResolver.ResolveHost(fullRef)` for multi-host drivers; single-host drivers fall back to `DriverInstanceId` (decision #144).
-5. The first `DataValueSnapshot` from the batch populates the outgoing `value` / `statusCode` / `timestamp`. An empty batch surfaces `BadNoData`; any exception surfaces `BadInternalError`.
+Authored `NodeAcl` deny rules have **no effect on reads** (or on anything else — see
+[docs/security.md](security.md) § Data-Plane Authorization).

-The hook is synchronous — the async invoker call is bridged with `AsTask().GetAwaiter().GetResult()` because the OPC UA SDK's value-hook signature is sync. Idempotent-by-construction reads mean this bridge is safe to retry inside the Polly pipeline.
+## Write path — `OnEquipmentTagWrite`

-## OnWriteValue
+The handler is attached in `EnsureVariable` **only when the tag was materialized `writable`**, and
+re-attached or cleared by `UpdateTagAttributes` on an in-place edit. A non-writable node has no
+handler, so the SDK rejects the write before any of this runs.

-`OnWriteValue` follows the same shape with two additional concerns: authorization and idempotence.
+1. **Role gate.** `EvaluateEquipmentWriteGate(identity, gatewayWired)` requires the session identity to
+   be a `RoleCarryingUserIdentity` carrying the `WriteOperate` role. No identity or no role ⇒
+   `BadUserAccessDenied`, fail-closed. Gate passed but no write gateway wired (admin-only node,
+   pre-boot) ⇒ `BadNotWritable`.
+   - This is a **server-wide** check. It takes no node and no realm: a session that may write one tag
+     may write every writable tag on that node.
+   - `WriteTune` and `WriteConfigure` are **never checked**. `OpcUaDataPlaneRoles` declares only
+     `WriteOperate` and `AlarmAck`; the classification tiers exist in the permission vocabulary but no
+     code path reads them.
+2. **Optimistic local apply.** The new value is written to the node so subscribers see it immediately.
+3. **Realm-qualified dispatch.** `RealmOf(node.NodeId)` selects Raw or UNS, and the value routes to the
+   backing driver ref through the node write gateway. Both NodeIds for a fanned value resolve to the
+   same driver ref, so a write via either one reaches the same device point.
+4. **Write-outcome self-correction.** If the device write fails, the optimistic value is **reverted**
+   on the raw NodeId and every referencing UNS NodeId through the shared fan-out, so a failed write
+   cannot leave a phantom Good value behind. (Galaxy is the exception: its write is fire-and-forget, so
+   it can never surface a write failure.)

-### Authorization (two layers)
+`OnWriteValue` is invoked by the SDK **while holding the node-manager `Lock`**, so the handler must not
+block. Anything asynchronous is dispatched fire-and-forget with the revert wired as a continuation.

-1. **SecurityClassification gate.** Every variable stores its `SecurityClassification` in `_securityByFullRef` at registration time (populated from `DriverAttributeInfo.SecurityClass`). `WriteAuthzPolicy.IsAllowed(classification, userRoles)` runs first, consulting the session's roles via `context.UserIdentity is IRoleBearer`. `FreeAccess` passes anonymously, `ViewOnly` denies everyone, and `Operate / Tune / Configure / SecuredWrite / VerifiedWrite` require `WriteOperate / WriteTune / WriteConfigure` roles respectively. Denial returns `BadUserAccessDenied` without consulting the driver — drivers never enforce ACLs themselves; they only report classification as discovery metadata (see `docs/security.md`).
-2. **Phase 6.2 permission-trie gate.** When `AuthorizationGate` is wired, it re-runs with the operation derived from `WriteAuthzPolicy.ToOpcUaOperation(classification)`. The gate consults the per-cluster permission trie loaded from `NodeAcl` rows, enforcing fine-grained per-tag ACLs on top of the role-based classification policy. See `docs/v2/acl-design.md`.
+## Alarm method calls

-### Dispatch
-
-`_invoker.ExecuteWriteAsync(host, isIdempotent, callSite, …)` honors the `WriteIdempotentAttribute` semantics per decisions #44-45 and #143:
-
- `isIdempotent = true` (tag flagged `WriteIdempotent` in the Config DB) → runs through the standard `DriverCapability.Write` pipeline; retry may apply per the tier configuration.
- `isIdempotent = false` (default) → the invoker builds a one-off pipeline with `RetryCount = 0`. A timeout may fire after the device already accepted the pulse / alarm-ack / counter-increment; replay is the caller's decision, not the server's.
-
-The `_writeIdempotentByFullRef` lookup is populated at discovery time from the `DriverAttributeInfo.WriteIdempotent` field.
-
-### Per-write status
-
-`IWritable.WriteAsync` returns `IReadOnlyList<WriteResult>` — one numeric `StatusCode` per requested write. A non-zero code is surfaced directly to the client; exceptions become `BadInternalError`. The OPC UA stack's pattern of batching per-service is preserved through the full chain.
-
-## Array element writes
-
-Array-element writes via OPC UA `IndexRange` are driver-specific. The OPC UA stack hands the dispatch an unwrapped `NumericRange` on the `indexRange` parameter of `OnWriteValue`; `DriverNodeManager` passes the full `value` object to `IWritable.WriteAsync` and the driver decides whether to support partial writes. Galaxy performs a read-modify-write inside the Galaxy driver (MXAccess has no element-level writes); other drivers generally accept only full-array writes today.
+Part 9 condition methods (Acknowledge / Confirm / AddComment / OneShotShelve / TimedShelve / Unshelve)
+are gated by a second role check requiring `AlarmAck` — one role covering all five methods; the
+`operation` argument is passed to the router but the gate does not consult it. Scripted alarms go
+through `HandleAlarmCommand`, driver-fed native alarms through `HandleNativeAlarmAck`; both fail closed
+with `BadUserAccessDenied`.

 ## HistoryRead

-`DriverNodeManager.HistoryReadRawModified`, `HistoryReadProcessed`, `HistoryReadAtTime`, and `HistoryReadEvents` route through the driver's `IHistoryProvider` capability with `DriverCapability.HistoryRead`. Drivers without `IHistoryProvider` surface `BadHistoryOperationUnsupported` per node. See `docs/v1/HistoricalDataAccess.md`.
+Four overrides — `HistoryReadRawModified`, `HistoryReadProcessed`, `HistoryReadAtTime`,
+`HistoryReadEvents` — route to the **server-wide** `IHistorianDataSource` (the HistorianGateway-backed
+reader, or `NullHistorianDataSource` when `ServerHistorian:Enabled=false`, which returns `GoodNoData`).
+This is not a per-driver `IHistoryProvider` dispatch.
+
+**No authorization check runs on any of the four.** Unlike `OnWriteValue`, the SDK does *not* hold the
+node-manager `Lock` while invoking them, so these paths may await.
+
+See [docs/Historian.md](Historian.md).

 ## Failure isolation

-Per decision #12, exceptions in the driver's capability call are logged and converted to a per-node `BadInternalError` — they never unwind into the master node manager. This keeps one driver's outage from disrupting sibling drivers in the same server process.
+Exceptions in a driver capability call are logged and converted to a per-node bad status rather than
+unwinding into the master node manager, so one driver's outage cannot disrupt sibling drivers in the
+same process.
+
+## What is *not* enforced anywhere
+
+Collected here because the previous revision of this page claimed several of these:
+
+| Surface | Check |
+|---|---|
+| Read, Browse, TranslateBrowsePaths | none |
+| CreateMonitoredItems / Subscribe / TransferSubscriptions | none |
+| HistoryRead (all four variants) | none |
+| Non-Value attribute writes | none (the handler is on `OnWriteValue`) |
+| Value write | `WriteOperate` role, server-wide |
+| Alarm methods | `AlarmAck` role, server-wide |
+| Per-node ACLs (`NodeAcl` / `PermissionTrie`) | **authored and deployed, never evaluated** |

 ## Key source files

- `src/Core/ZB.MOM.WW.OtOpcUa.Core/OpcUa/GenericDriverNodeManager.cs` — address-space population and alarm routing during discovery
- `src/Server/ZB.MOM.WW.OtOpcUa.OpcUaServer/OtOpcUaNodeManager.cs` — push-model `CustomNodeManager2`; `EnsureVariable` / `WriteValue` are the v2 read/write path
- `src/Core/ZB.MOM.WW.OtOpcUa.Core/Authorization/` — permission trie + evaluator (`PermissionTrie`, `PermissionTrieCache`, `TriePermissionEvaluator`) that gates Read/Write/Subscribe per the session's resolved LDAP groups
- `src/Core/ZB.MOM.WW.OtOpcUa.Core/Resilience/CapabilityInvoker.cs` — `ExecuteAsync` / `ExecuteWriteAsync`
- `src/Core/ZB.MOM.WW.OtOpcUa.Core.Abstractions/IReadable.cs`, `IWritable.cs`, `WriteIdempotentAttribute.cs`
+- `src/Server/ZB.MOM.WW.OtOpcUa.OpcUaServer/OtOpcUaNodeManager.cs` — the live node manager;
+  `EnsureVariable` / `WriteValue` / `OnEquipmentTagWrite` / `EvaluateEquipmentWriteGate` and the four
+  HistoryRead overrides
+- `src/Server/ZB.MOM.WW.OtOpcUa.OpcUaServer/Security/RoleCarryingUserIdentity.cs`,
+  `Security/OpcUaDataPlaneRoles.cs` — how roles reach the gates
+- `src/Server/ZB.MOM.WW.OtOpcUa.OpcUaServer/AddressSpaceApplier.cs` — materialization; where the write
+  handler is attached per realm
+- `src/Server/ZB.MOM.WW.OtOpcUa.Runtime/Drivers/DriverHostActor.cs` — the push side: value fan-out to
+  raw + UNS NodeIds
+- `src/Core/ZB.MOM.WW.OtOpcUa.Core/Resilience/CapabilityInvoker.cs` — driver-side resilience pipeline
+  (**not** on the OPC UA read path)
+- `src/Core/ZB.MOM.WW.OtOpcUa.Core/Authorization/` — the permission trie + evaluator, built and
+  unit-tested but with **zero production consumers**
@@ -108,22 +108,59 @@ plane (writes, alarm acks, the alerts emit, the alarm-history drain) on the wron
 *higher* address so the two orderings genuinely disagree. `NodeRedundancyState.IsRoleLeaderForDriver`
 was renamed `IsDriverPrimary` to stop the name asserting the old derivation.

-> **KNOWN LIMITATION — the election is per *Akka* cluster, not per application `Cluster`.**
-> The election yields exactly **one** Primary across the whole Akka cluster. A fleet that
-> runs several application clusters (each with its own redundant pair) inside one Akka cluster —
-> which is what `docker-dev/docker-compose.yml` models, with MAIN, SITE-A and SITE-B — therefore has
-> one Primary among *all* its driver nodes, not one per pair. Every consumer of the role inherits
-> this: `ServiceLevel`, the `alerts` emit gate, and the inbound device-write gate below.
+> **RESOLVED by Phase 6 — the election is now per application `Cluster`, not per Akka mesh.**
+> Phase 6 of the per-cluster mesh program split the single fleet-wide Akka mesh into one independent
+> 2-node mesh per application `Cluster` (see [Per-cluster meshes (Phase 6)](#per-cluster-meshes-phase-6)
+> below). `RedundancyStateActor` is now a `cluster-{ClusterId}`-scoped singleton spawned on every driver
+> node, so each pair elects its own Primary — the whole-Akka-cluster mismatch this block used to describe
+> no longer exists. See `docs/plans/2026-07-24-mesh-phase6-partition-and-colocation.md`.
 >
-> The unit of redundancy everywhere else in the product is the application `Cluster` (`ClusterId`) —
-> it owns drivers, devices and `ClusterNode` rows, and the LocalDb deployment-artifact cache is
-> already keyed by it *so that a pair shares one entry*. Scoping the election the same way is the
-> fix; `RedundancyStateActor` is an admin-role singleton in the same assembly as
-> `AdminOperationsActor`, which already reads and groups `ClusterNodes` by cluster.
->
-> Surfaced by the LocalDb Phase 2 live gate, where it stopped the alarm-history drain on every node
-> in the fleet — see `docs/plans/2026-07-20-localdb-phase2-live-gate.md`. The alarm drain no longer
-> depends on this (it defers only to a node that shares its queue), but the other three gates still do.
+> Originally surfaced by the LocalDb Phase 2 live gate, where the old whole-mesh election stopped the
+> alarm-history drain on every node in the fleet — see `docs/plans/2026-07-20-localdb-phase2-live-gate.md`.
+
+## Per-cluster meshes (Phase 6)
+
+The fleet no longer runs one Akka mesh. Phase 6 split it into **three independent 2-node meshes** — the
+central pair (roles `admin,driver,cluster-MAIN`), the site-a pair (`driver,cluster-SITE-A`), and the
+site-b pair (`driver,cluster-SITE-B`) — all sharing the same `ActorSystem` name (`otopcua`) on one network,
+separated purely by **per-pair self-first seed partitioning**: each node's `Cluster:SeedNodes` lists only
+itself and its own pair partner, so gossip never crosses a pair boundary (see
+[Bootstrap: self-first seed ordering](#bootstrap-self-first-seed-ordering)).
+
+Consequences:
+
+- **One Primary per pair — two or more Primaries fleet-wide, by design.** Each mesh runs its own
+  election, so a three-mesh fleet has three Primaries, one per application `Cluster`. This is correct,
+  not a regression of the old single-Primary assumption.
+- **`RedundancyStateActor` is a `cluster-{ClusterId}`-scoped singleton**, spawned on every driver node
+  (falling back to the plain `driver` role for a legacy node not carrying a cluster role). Each pair
+  elects and publishes its own `redundancy-state` on its own mesh's DPS — the DPS topic name is
+  unchanged, but it no longer reaches past the pair.
+- **`ClusterNodeAddressReconciler` is own-cluster-scoped** — an admin node can only reconcile
+  `ClusterNode` rows belonging to its own cluster; it has no gossip visibility into another mesh to
+  reconcile against.
+- **`CentralCommunicationActor` creates one `ClusterClient` per application `Cluster`** and fans
+  commands across them, rather than one fleet-wide client. Central reaches a site mesh over
+  `ClusterClient` (commands), gRPC (telemetry — see `docs/Telemetry.md`), and `ConfigServe` (config
+  fetch — see [`ConfigSource`/`ConfigServe`](../CLAUDE.md#config-source-configsource--configserve)),
+  never over gossip.
+- **`SplitTopologyTransportValidator` fails host start** on a node carrying a `cluster-{ClusterId}`
+  role unless it is also configured for the split-safe transports: `MeshTransport:Mode = ClusterClient`,
+  `Telemetry:Mode = Grpc` (driver nodes), `TelemetryDial:Mode = Grpc` (admin nodes). A DPS-mode transport
+  on a cluster-role node would silently try to gossip across a partition that no longer exists, so the
+  validator fails closed instead. Legacy/non-cluster-role nodes are exempt.
+- **The compiled transport-mode defaults were deliberately NOT flipped** — `MeshTransport:Mode`,
+  `Telemetry:Mode`, and `TelemetryDial:Mode` all still default to `Dps`. A blast-radius assessment
+  found flipping the compiled default would break every integration test and every existing
+  `appsettings.json` profile that doesn't explicitly set these keys. The guardrail is the validator
+  above plus explicit per-deployment configuration, not a default flip.
+
+### Secrets replication is pair-local
+
+Akka DPS secret replication is scoped to each 2-node mesh: a pair replicates its own secrets to its
+own partner and no further. There is no fleet-wide or cross-cluster secret sync after the split — by
+design, consistent with Phase 4 (site nodes have no SQL, so there is no SQL-backed hub to fan a
+cross-mesh sync through).

 ## Data flow

@@ -316,18 +353,17 @@ advertises `ServiceLevel` 250. OPC UA clients re-select.
 | Confirmation | A dialog naming the node, and what follows (restart, ServiceLevel 250 moves, clients re-select). |
 | Audit | Written through the shared `ZB.MOM.WW.Audit.IAuditWriter` seam **before** the Leave — action `cluster.manual-failover`, actor, target. A *refused* failover changes nothing and writes nothing. |

-> **Mesh-scope caveat.** Until the per-cluster mesh work lands
-> (`docs/plans/2026-07-21-per-cluster-mesh-design.md`), the Primary is elected once per Akka mesh rather than
-> per application `Cluster` row — so on a fleet running several clusters in one mesh this button acts on the
-> whole mesh's Primary, which may belong to a different cluster than the page you are on. The panel says so.
-> Phase 6 of the mesh program removes both the caveat and this notice.
+Phase 6 of the mesh program (see [Per-cluster meshes (Phase 6)](#per-cluster-meshes-phase-6)) split
+the fleet into one 2-node mesh per application `Cluster`, so the button now acts on **this pair's own**
+Primary — there is no longer a whole-mesh vs. per-cluster ambiguity to caveat.

 > **Live gate outstanding.** The auto-down change is verified by unit tests against the effective
-> configuration, and by the sister project's live drill on an equivalent Akka version and topology. It has
-> **not** yet been drilled on an OtOpcUa two-node rig — the docker-dev rig runs a single six-node mesh, where
-> the 1-vs-1 pathology cannot occur. The drill (kill the oldest container of a genuine two-node cluster;
-> assert the survivor stays up, takes the singletons, and reports the primary `ServiceLevel`) should run
-> alongside the per-cluster mesh work, which makes every mesh exactly two nodes. See
+> configuration, and by the sister project's live drill on an equivalent Akka version and topology. It
+> was **not** drillable on an OtOpcUa rig before Phase 6, because the docker-dev rig ran a single
+> six-node mesh where the 1-vs-1 pathology cannot occur. **Phase 6 has landed and every mesh is now
+> exactly two nodes**, so the drill (kill the oldest container of a genuine two-node cluster; assert
+> the survivor stays up, takes the singletons, and reports the primary `ServiceLevel`) is finally
+> testable — deferred to Phase 7's failover drill. See
 > `docs/plans/2026-07-21-per-cluster-mesh-design.md` §6.2 / Phase 0a.

 ## Bootstrap: self-first seed ordering
@@ -365,11 +401,61 @@ Comparing against `Cluster:Hostname` would be worse than wrong: in docker-dev it
 no seed URI anywhere, so the rule would silently exempt the entire rig.

 Sequential recovery is island-free by construction: a `FirstSeedNodeProcess` node self-joins only when **no**
-seed answered, so a peer booting after the survivor formed simply joins it as the youngest member. Both
-nodes cold-starting *simultaneously* converge on one cluster while they are mutually reachable — the
-`InitJoin` handshake resolves it before either self-join deadline expires. The residual risk is a boot-time
-**partition** (both cold-starting, mutually unreachable): both form, which is the same dual-active class the
-`auto-down` strategy already accepts, with the same recovery (restart one side).
+seed answered, so a peer booting after the survivor formed simply joins it as the youngest member.
+
+**Simultaneous cold-start CAN split — this is the residual gap the bootstrap guard below closes.** When
+BOTH nodes start from nothing at the same instant, each runs `FirstSeedNodeProcess`, and if neither has
+formed before the other's `seed-node-timeout` expires, EACH self-joins and forms its own single-node
+cluster — two Primaries in one pair. On in-process loopback the `InitJoin` handshake usually resolves fast
+enough to converge, but the Phase 6 live gate reproduced the split reliably on the docker-dev rig (real
+container start timing + DNS): both nodes logged `JOINING itself … forming a new cluster` and both advertised
+ServiceLevel 250. Two independent clusters do **not** auto-merge, so the split persists until an operator
+restarts one side.
+
+### Bootstrap guard (`Cluster:BootstrapGuard`, opt-in)
+
+The guard eliminates the simultaneous-start split without giving up cold-start-alone. It is a **dark switch,
+default off** — a node with `Cluster:BootstrapGuard:Enabled=false` (the default) keeps Akka's config-driven
+self-first auto-join exactly as above.
+
+When enabled, the node is given **no config seed nodes** (so Akka does not auto-join), and
+`ClusterBootstrapCoordinator` picks the join order from a deterministic address tie-break plus a reachability
+probe:
+
+- The node with the lexicographically **lower** canonical `host:port` is the **preferred founder**: it joins
+  self-first and forms immediately if no peer answers — no probe, no delay.
+- The **higher** node probes its partner's Akka port (a plain TCP connect; the partner binds its port well
+  before it forms) for up to `PartnerProbeSeconds` (default 25 s): **reachable ⇒ peer-first** (it joins the
+  founder, never races it); **unreachable after the window ⇒ self-first** (the partner is genuinely down, so
+  it forms alone — cold-start-alone preserved for the higher node too).
+
+The order is decided **before** issuing a single `Cluster.JoinSeedNodes`, from an explicit reachability
+signal — it never re-decides mid-handshake, the failure mode that retired the `SelfFormAfter` watchdog.
+
+**Residual trade-off (accepted, operator-visible):** once the higher node commits peer-first it cannot
+self-form (Akka's `JoinSeedNodeProcess` retries forever). If the founder dies in the small probe→join window,
+the higher node hangs unjoined; the coordinator logs a clear WARNING after a bounded grace, and a **restart
+recovers it** (the guard re-runs, finds the founder down, and forms alone). Config keys:
+
+| Key | Default | Notes |
+|---|---|---|
+| `Cluster:BootstrapGuard:Enabled` | `false` | Dark switch. Only meaningful on a node that is one of its own two pair seeds; inert elsewhere. |
+| `Cluster:BootstrapGuard:PartnerProbeSeconds` | `25` | Higher node's probe window. Must comfortably exceed the founder's process-start-to-Akka-bind time, or a slow-but-alive founder is mistaken for dead and the split re-opens. Validated `> 0` at boot. |
+| `Cluster:BootstrapGuard:PartnerProbeIntervalMs` | `500` | Interval between probes. |
+| `Cluster:BootstrapGuard:ProbeConnectTimeoutMs` | `1000` | Per-probe TCP connect timeout. |
+
+On the docker-dev rig the **site-a pair is the enablement demo** (guard on, startup serialization removed so
+both nodes cold-start simultaneously); **site-b keeps the `depends_on: service_healthy` startup serialization
+with the guard off**, as the A/B control. Either mechanism prevents the split; the guard is the one that also
+works on production hardware, where compose `depends_on` does not exist.
+
+The alternative to the guard is **operational**: stagger the two VMs' service-manager start, or bring the
+designated founder VM up first — see the Phase 7 co-located operator runbook
+(`docs/plans/2026-07-24-mesh-phase7-failover-drills.md`).
+
+The residual risk that remains even with the guard is a boot-time **partition** (both cold-starting, mutually
+unreachable from the start): both form, which is the same dual-active class the `auto-down` strategy already
+accepts, with the same recovery (restart one side).

 Pinned by `SelfFirstSeedBootstrapTests` (`tests/Core/ZB.MOM.WW.OtOpcUa.Cluster.Tests/`), which starts real
 in-process clusters through the production bootstrap at production failure-detection timings: a lone
@@ -102,6 +102,45 @@ Persisted scope per plan decision #14: `Enabled`, `Acked`, `Confirmed`, `Shelvin

 Every mutation the state machine produces is immediately persisted inside the engine's `_evalGate` semaphore, so the store's view is always consistent with the in-memory state.

+### Post-(re)load condition-node re-assert (#487)
+
+A deploy that triggers a **full address-space rebuild** clears `_alarmConditions` and re-materialises every
+condition node fresh — inactive, acked, confirmed, unshelved. The engine, reloading in parallel, restores each
+alarm's persisted state and re-derives `Active` from the predicate, so it ends up *correct*; but a still-active
+alarm has **no transition to report**, so `LoadAsync` yields `EmissionKind.None` and `OnEngineEmission` drops it.
+Nothing then writes the node. Before this fix, an active alarm with static dependencies read **normal** to every
+OPC UA client after such a deploy, until its next real transition — which for a static-dependency alarm may
+never come.
+
+`ScriptedAlarmHostActor.ReassertConditionNodes` closes it. After each load completes it reads
+`ScriptedAlarmEngine.GetProjections()` — a plain read returning `ScriptedAlarmProjection` (condition state +
+the definition's severity + the resolved message template + last-observed worst-input quality) — and sends one
+`OpcUaPublishActor.AlarmStateUpdate` per alarm that is **not** in the Part 9 no-event position.
+
+Four properties are load-bearing:
+
+- **Node-only.** It sends `AlarmStateUpdate` and nothing else — never the `alerts` topic, never the telemetry
+  hub. `alerts` is the historization path, so an alerts row per alarm per deploy would append a duplicate
+  historian / AVEVA record every time anyone deploys. This is why the re-assert reads a projection instead of
+  re-emitting: `ScriptedAlarmProjection` carries no `EmissionKind`, so there is nothing for the emission
+  machinery — or a future refactor — to mistake for a transition.
+- **Only non-normal alarms.** An alarm in the no-event position (enabled, inactive, acked, confirmed,
+  unshelved) already matches what the materialise built, so it is skipped. That keeps a never-fired alarm
+  byte-identical to a deploy without this pass — including its Message, which the materialise seeds with the
+  alarm's display name — and writes nothing at all on the common all-normal deploy.
+- **Ordering.** `DriverHostActor` tells `RebuildAddressSpace` to the publish actor *before* it tells
+  `ApplyScriptedAlarms` to the host, and the re-assert runs later still (after an awaited `LoadAsync` pipes
+  back). Both are local `Tell`s, which enqueue synchronously, so the re-materialise is already queued ahead of
+  these writes.
+- **No duplicate Part 9 events.** `WriteAlarmCondition`'s delta-gate compares the incoming snapshot against
+  the node's *current* state: a re-assert onto a freshly materialised (normal) node is a genuine delta and
+  fires exactly one condition event — correct, since the rebuild reset what clients see — while a re-assert
+  onto a surgically-preserved node that already holds the same state is suppressed. The write is ungated by
+  redundancy role, like every other node write here; the Secondary keeps its address space warm for failover.
+
+The timestamp carried is the condition's own `LastTransitionUtc`, **not** the deploy instant, so a client
+reading `Time` / `ReceiveTime` after a rebuild still sees when the alarm actually went active.
+
 ## Source integration

 `ScriptedAlarmSource` (`ScriptedAlarmSource.cs`) adapts the engine to the driver-agnostic `IAlarmSource` interface. The existing `AlarmSurfaceInvoker` + `GenericDriverNodeManager` fan-out consumes it the same way it consumes Galaxy / AB CIP / FOCAS sources — there is no scripted-alarm-specific code path in the server plumbing. From that point on, the flow into `AlarmConditionState` nodes, the `AlarmAck` session check, and the Historian sink is shared — see [AlarmTracking.md](AlarmTracking.md).
@@ -128,6 +128,39 @@ transports. ScadaBridge itself has since closed that gap with this identical
 interceptor pattern, so Phase 5 ships authenticated from the start rather than deferring auth to a
 later hardening pass. See the design doc's superseded note for the full history.

+## Upgrading an existing deployment: populate `ClusterNode.GrpcPort` first (#493)
+
+`GrpcPort` is a **nullable column added by Phase 5**, and nothing backfills it onto rows that
+already existed. On an upgraded deployment every `ClusterNode` row therefore carries `NULL`,
+central finds **no dial targets**, and flipping `TelemetryDial:Mode` to `Grpc` connects to
+nothing. Fresh installs are unaffected. `AkkaPort` did not have this problem only because it is
+`NOT NULL` with a default of 4053.
+
+Nothing fails loudly, which is what makes this worth stating up front — the code degrades
+gracefully, once per node, throttled:
+
+```
+ClusterNode <id> has no GrpcPort; it exposes no telemetry stream and is skipped in this dial refresh
+(further skips of this node are silent)
+```
+
+Other symptoms: no `ESTABLISHED` sockets on the telemetry port (a `LISTEN` but nothing else in
+`docker exec <node> cat /proc/net/tcp6`), and the `/alerts` / `/script-log` pill never turning
+live in `Grpc` mode.
+
+**Before flipping any node to `Grpc`**, set each driver node's `GrpcPort` to that node's own
+`Telemetry:GrpcListenPort` — via the AdminUI node editor, or directly:
+
+```sql
+UPDATE dbo.ClusterNode SET GrpcPort = <that node's Telemetry:GrpcListenPort> WHERE NodeId = '<node>';
+```
+
+There is deliberately **no EF data migration** backfilling this. The correct value is that node's
+own listener port, which is per-deployment configuration the database cannot derive; a migration
+could only invent one, and a *wrong* dial target is worse than the `NULL` the dialer already skips
+explicitly. The docker-dev seed does backfill (`GrpcPort IS NULL AND CreatedBy = 'docker-dev-seed'`
+→ 4056) because there the port is fixed by `docker-compose.yml` and therefore actually knowable.
+
 ## Reconnect and reliability

 Central's `TelemetryDialSupervisor` (an admin-role actor) runs **one reconnecting dialer per
@@ -70,7 +70,7 @@ Project root files:
 | Capability | Implementation entry point |
 |------------|---------------------------|
 | `ITagDiscovery` | `Browse/GalaxyDiscoverer.cs` |
-| `IRediscoverable` | `Browse/DeployWatcher.cs` |
+| `IRediscoverable` | `Browse/DeployWatcher.cs` — consumed as an **operator prompt**: a Galaxy redeploy raises a "re-browse" chip on `/hosts`. ⚠️ It does **not** rebuild the address space — re-browse the device under `/raw` and commit ([#518](https://gitea.dohertylan.com/dohertj2/lmxopcua/issues/518)) |
 | `IReadable` | `Runtime/GalaxyMxSession.cs` |
 | `IWritable` | `Runtime/GatewayGalaxyDataWriter.cs` |
 | `ISubscribable` | `Runtime/GatewayGalaxySubscriber.cs` (driven by `EventPump`) |
@@ -0,0 +1,349 @@
+# MTConnect Driver
+
+Getting-started guide for the MTConnect Agent driver (P1 Agent MVP). This is
+the short path — for the full design rationale read
+[`docs/plans/2026-07-15-mtconnect-driver-design.md`](../plans/2026-07-15-mtconnect-driver-design.md)
+and the build-vs-plan record in
+[`docs/plans/2026-07-24-mtconnect-driver.md`](../plans/2026-07-24-mtconnect-driver.md); for the
+fixture recipe read
+[`tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.MTConnect.IntegrationTests/Docker/README.md`](../../tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.MTConnect.IntegrationTests/Docker/README.md)
+(not duplicated here).
+
+> **Live gate:** see the LIVE-GATE RESULT note in the plan's Task 21
+> (`docs/plans/2026-07-24-mtconnect-driver.md`) for the docker-dev `/run` verification outcome
+> (browse picker / typed editor / deploy / read / subscribe against the real Agent fixture).
+
+## What it talks to
+
+A **MTConnect Agent** — the vendor-neutral read-only telemetry endpoint that
+front-ends a machine tool (or fronts an adapter that itself talks to the
+machine over SHDR). The driver speaks plain HTTP + XML against the Agent's
+three standard REST paths:
+
+- `/probe` — the static device model (Device → Component → DataItem tree)
+- `/current` — a snapshot of every DataItem's latest observation
+- `/sample` — a `multipart/x-mixed-replace` long-poll stream of observation
+  deltas, keyed by a monotonic sequence number
+
+v1 is **agent-first and read-only** — Discover + Read + Subscribe, no Write —
+because the mainstream Agent surface has no "set value" operation.
+
+## Built vs. planned — read this before trusting the design doc's §2
+
+The design doc ([`2026-07-15-mtconnect-driver-design.md`](../plans/2026-07-15-mtconnect-driver-design.md))
+picked the **TrakHound `MTConnect.NET-Common` / `-HTTP`** NuGet packages (MIT,
+`netstandard2.0`) as the primary path, with a hand-rolled fallback. **The
+hand-rolled fallback is what shipped.** Task 6/7 of the implementation plan
+found by reflection + live invocation that the pinned TrakHound packages
+ship **no XML formatter** (`Document Formatter Not found for "xml"` — the
+formatter lives in a separate `MTConnect.NET-XML` package the design didn't
+pin) and that `MTConnectHttpClientStream` exposes no injectable `HttpClient`
+handler, so it cannot be unit-tested behind the driver's `IMTConnectAgentClient`
+seam. Both package references were dropped. There is **no TrakHound
+dependency anywhere in the shipped driver** — probe/current/sample parsing is
+hand-rolled `System.Xml.Linq` plus a multipart boundary reader, entirely
+behind `IMTConnectAgentClient`. See the CORRECTION block under Task 0 of the
+implementation plan for the full record.
+
+**Namespace-agnostic parsing.** Every parser matches XML elements on
+`LocalName` only, ignoring the document's XML namespace entirely, so
+MTConnect 1.3 through 2.x documents all parse without a schema-version
+branch. This is deliberate, not sloppy: a real Agent injects vendor-extension
+`Component`s in a foreign namespace whose child `DataItems` elements inherit
+the *default* namespace, and namespace-strict matching would silently drop
+the whole vendor component (and every DataItem beneath it) rather than fail
+loudly. Attributes are read **unqualified** for the same reason — so an
+`xsi:type` attribute is never mistaken for a DataItem's own `type`.
+
+## Project split
+
+| Project | Target | Role |
+|---------|--------|------|
+| `src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.MTConnect/` | net10.0 | In-process driver — `MTConnectDriver`, the hand-rolled `IMTConnectAgentClient` (probe/current/sample), the observation index, the factory |
+| `src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.MTConnect.Contracts/` | net10.0 | `MTConnectDriverOptions`, `MTConnectTagDefinition`, and the pure `MTConnectDataTypeInference` table shared by the driver, browse-commit, and the AdminUI typed editor |
+
+No `.Browser` project — browse comes free from the Wave-0 universal
+discovery browser (see [Browse](#browse--free-via-the-universal-browser)
+below).
+
+## Capability surface
+
+`MTConnectDriver : IDriver, IReadable, ISubscribable, ITagDiscovery, IHostConnectivityProbe, IRediscoverable`
+(`src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.MTConnect/MTConnectDriver.cs`).
+
+Deliberately **not** `IWritable` — the Agent surface is read-only by design.
+Write-back exists only via optional, rarely-deployed MTConnect *Interfaces*
+(a request/response handshake, not a "set value" operation), and is out of
+scope for this build — see [Deferred](#deferred-not-in-this-build).
+
+| Capability | Path | Notes |
+|------------|------|-------|
+| `ITagDiscovery` | `DiscoverAsync` — streams `/probe`'s Device→Component→DataItem tree into the address-space builder | `SupportsOnlineDiscovery = true`, `RediscoverPolicy = Once` |
+| `IReadable` | `ReadAsync` → one `/current` per call | **Not the production data path** — see below |
+| `ISubscribable` | `SubscribeAsync`/`OnDataChange` — the shared `/sample` long-poll pump | **The production data path** |
+| `IHostConnectivityProbe` | periodic `/probe` under `Probe.*` | No consumer wires it today — see [Known limitations](#known-limitations) |
+| `IRediscoverable` | watches the Agent's `Header.instanceId` | No consumer wires it today — see [Known limitations](#known-limitations) |
+
+**`IReadable.ReadAsync` is never called by the running server.** The
+production data plane is entirely `ISubscribable` — `DriverInstanceActor`
+subscribes once and lives off `OnDataChange`. `ReadAsync` exists for the
+Client CLI (`... read -n ...`) and for the unit/integration suites; it is
+correct and tested, just not on the hot path.
+
+## Minimum deployment
+
+```jsonc
+"Drivers": {
+  "mtconnect-1": {
+    "Type": "MTConnect",
+    "Config": {
+      "AgentUri": "http://10.100.0.35:5000",
+      "DeviceName": null,
+      "RequestTimeoutMs": 5000,
+      "SampleIntervalMs": 1000,
+      "SampleCount": 1000,
+      "HeartbeatMs": 10000,
+      "Probe":     { "Enabled": true, "IntervalMs": 5000, "TimeoutMs": 2000 },
+      "Reconnect": { "MinBackoffMs": 0, "MaxBackoffMs": 30000, "BackoffMultiplier": 2.0 },
+      "Tags": []
+    }
+  }
+}
+```
+
+`RawTags[]` is not authored by hand — `DriverDeviceConfigMerger` injects it
+at deploy time from the tags authored on the `/raw` tree.
+
+### Config keys
+
+Read off `MTConnectDriverOptions` / `MTConnectDriverConfigDto`
+(`src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.MTConnect.Contracts/MTConnectDriverOptions.cs`,
+`src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.MTConnect/MTConnectDriver.cs`):
+
+| Key | Default | Notes |
+|---|---|---|
+| `AgentUri` | — (required) | Agent base URI; the driver appends `/probe`, `/current`, `/sample` |
+| `DeviceName` | `null` | Scopes requests to `{AgentUri}/{DeviceName}/...`; `null` = whole Agent |
+| `RequestTimeoutMs` | `5000` | Per-call deadline for `/probe` and `/current` |
+| `SampleIntervalMs` | `1000` | The Agent's `/sample?interval=` query param |
+| `SampleCount` | `1000` | The Agent's `/sample?count=` query param |
+| `HeartbeatMs` | `10000` | The Agent's `/sample?heartbeat=` query param — also the watchdog's liveness window |
+| `Probe.Enabled` / `Probe.IntervalMs` / `Probe.TimeoutMs` | `true` / `5000` / `2000` | Background connectivity-probe knobs (mirrors `ModbusProbeOptions`) |
+| `Reconnect.MinBackoffMs` / `MaxBackoffMs` / `BackoffMultiplier` | `0` / `30000` / `2.0` | Geometric backoff after a failed request or a dropped `/sample` stream |
+| `Tags[]` | `[]` | Pre-v3 / CLI authoring surface — one `MTConnectTagDefinition` per DataItem `id` |
+| `RawTags[]` | `[]` (deploy-injected) | The v3 data-plane binding — see below |
+
+**All timing knobs are validated strictly positive** at `InitializeAsync`
+(`RequirePositive`, mirroring the arch-review 01/S-6 lesson: a `0` timeout
+does not mean "wait forever," it faults the driver). This applies to
+`RequestTimeoutMs`, `HeartbeatMs`, `SampleIntervalMs`, `SampleCount`, and
+(when the probe is enabled) `Probe.Interval` / `Probe.Timeout`.
+
+**No save-time gate on a blank `AgentUri` in the AdminUI.** The driver form
+renders an inline validation notice (`_form.Validate()`), but
+`DriverConfigModal.SaveAsync` has no per-form validation seam to block the
+Save button on it — no sibling driver form has one either. A blank
+`AgentUri` saves cleanly and fails at deploy with the driver's own error
+message, not at authoring time.
+
+## Data plane
+
+### FullName == DataItem `id`
+
+`FullName` (both `MTConnectTagDefinition.FullName` and every `RawTags[]`
+blob's identifier) is the MTConnect `DataItem@id` attribute — the value the
+universal browser commits and the key the driver resolves reads/subscribes
+against. `MTConnectTagConfigModel.FromJson` (the AdminUI typed editor) tries
+three spellings in order — `fullName` → `dataItemId` → `address` — and takes
+the first non-blank one, normalising onto `fullName` on save. `address` is
+accepted because that's the field name `RawBrowseCommitMapper` writes for a
+driver with no typed editor path, so a browse-committed tag stays readable
+even before the editor round-trips it.
+
+### Coercion-type precedence
+
+The driver keys its data plane by **RawPath** (the v3 raw-tag identity), not
+by DataItem id directly, resolving RawPath → dataItemId internally. Each raw
+tag's coercion type (the `DriverDataType` its Agent observation is parsed
+into) is resolved in this order, first non-null wins:
+
+1. The `RawTags[]` blob's `driverDataType` or `dataType` field (both
+   spellings accepted — the typed editor writes `dataType`, the driver's own
+   `tags[]` shape uses `driverDataType`).
+2. A matching `Tags[]` entry naming the same DataItem id.
+3. The Agent's own `/probe` declaration, via `MTConnectDataTypeInference.Infer`
+   (category/type/units/representation → `DriverDataType`).
+4. `DriverDataType.String` — the coercion that cannot fail.
+
+### Quality mapping
+
+`UNAVAILABLE` — MTConnect's one explicit "I have no value" sentinel — maps to
+**`BadNoCommunication`** (`0x80310000`). This is deliberately distinct from
+the fleet-standard `BadCommunicationError` (`0x80050000`, used elsewhere for
+the driver's *own* transport failure to the Agent): `UNAVAILABLE` means the
+Agent is reachable and answered, it just has no device-backed value for that
+item. A `CONDITION` observation's value is taken from its **element name**
+(`<Normal/>` → the string `"Normal"`, `<Fault/>` → `"Fault"`); a `<Unavailable/>`
+condition element normalises onto the same `UNAVAILABLE` sentinel as every
+other category so one comparison covers all three.
+
+Other status codes an observation can surface:
+
+| Code | Meaning |
+|---|---|
+| `BadTypeMismatch` (`0x80740000`) | The Agent's text isn't a value of the tag's coerced type at all |
+| `BadOutOfRange` (`0x803C0000`) | The Agent reported a number the coerced type can't represent |
+| `BadNotSupported` (`0x803D0000`) | A shape this build doesn't materialize — a `TIME_SERIES` vector, or a structured `DATA_SET`/`TABLE` observation (deferred to P1.5; see [Known limitations](#known-limitations)) |
+| `BadWaitingForInitialData` | Tag is authored but the Agent hasn't reported it yet |
+| `BadNodeIdUnknown` | DataItem id is neither authored nor ever observed |
+
+### Subscribe — the `/sample` pump
+
+One shared `/sample` long-poll stream per driver instance (the Agent streams
+the whole device model regardless of which subset is subscribed, so
+per-tag streams would be wasted round-trips), run under a heartbeat
+watchdog — `HttpClient.Timeout` cannot bound a long-lived stream, so a
+missing chunk **and** missing keep-alive heartbeat within
+`HeartbeatMs × N` is what detects a frozen peer.
+
+Ring-buffer overflow (the Agent's circular observation buffer wrapped past
+what the driver's cursor expects) is detected **two ways**, both triggering a
+`/current` re-baseline before the stream resumes:
+
+1. `IMTConnectAgentClient.IsSequenceGap` — the next chunk's `firstSequence`
+   is newer than the driver's expected cursor.
+2. An `MTConnectError` document reporting `OUT_OF_RANGE` — real Agents return
+   this both under HTTP 200 (a normal MTConnect error document) and as a bare
+   HTTP 400, and the client handles both.
+
+**An Agent `instanceId` change means the Agent restarted**, and is checked
+**before** the sequence-gap check (a restart also usually trips the gap, so
+the two need disambiguating, not just OR-ing together). On a changed
+`instanceId` the driver clears its cached probe model and raises
+`OnRediscoveryNeeded`, which surfaces a **re-browse prompt** on the AdminUI
+`/hosts` page — see [Known limitations](#known-limitations) for what that does
+and does not do.
+
+## Browse — free via the universal browser
+
+MTConnect ships **no bespoke browser project**. Setting
+`ITagDiscovery.SupportsOnlineDiscovery => true` is the entire integration:
+the Wave-0 `DiscoveryDriverBrowser` sees a driver whose `TryCreate` succeeds
+and whose instance reports online discovery, renders the AdminUI **Browse**
+button, constructs the driver, runs `InitializeAsync` (the `/probe` connect)
+ `DiscoverAsync` into a `CapturingAddressSpaceBuilder`, then tears the
+throwaway instance down. Each captured leaf's NodeId is the DataItem `id`,
+committed directly as `TagConfig.FullName` on pick. See
+[`docs/plans/2026-07-15-universal-discovery-browser-design.md`](../plans/2026-07-15-universal-discovery-browser-design.md).
+
+## CONDITION modelling (v1: plain String)
+
+Each `CONDITION` DataItem materializes as a `String` variable whose value is
+the current state word — `Normal` / `Warning` / `Fault` / `UNAVAILABLE`.
+There is no native OPC UA Part 9 alarm plumbing in this build;
+`DriverAttributeInfo.IsAlarm = true` is still stamped on a CONDITION leaf so
+the browse side-panel flags it and a future upgrade to native alarms doesn't
+need re-authoring. See [Deferred](#deferred-not-in-this-build).
+
+## Known limitations
+
+These are real, not placeholders — read them before relying on the driver
+for anything beyond values-and-conditions.
+
+1. **A restarted Agent prompts an operator; it does not re-shape the address
+   space.** `DriverInstanceActor` now consumes `OnRediscoveryNeeded`
+   (2026-07-27), so a changed `instanceId` raises a "re-browse" chip against
+   this driver on `/hosts` carrying the reason. It is **advisory**: v3 authors
+   raw tags through the `/raw` browse-commit flow, so until an operator
+   re-browses the Agent and commits, any DataItem that appeared or vanished is
+   not reflected in the served tree. A runtime graft was deliberately rejected
+   — it would materialise nodes nobody approved and no deployment artifact
+   records.
+
+   **`IHostConnectivityProbe` is still unconsumed** — `GetHostStatuses()` has
+   no production call site and nothing writes a `DriverHostStatus` row. That
+   half remains a fleet-wide gap affecting every driver that implements it
+   (Gitea #521).
+2. **`RawTagEntry.DeviceName` is accepted on the wire shape but ignored for
+   routing.** One driver instance owns exactly one Agent client scoped by
+   `MTConnectDriverOptions.DeviceName` (the top-level config key); the
+   per-tag `RawTagEntry.DeviceName` field the v3 raw-tag identity carries is
+   never read by the driver. Two `/raw` Devices authored under one MTConnect
+   driver instance both resolve to the same one Agent connection. Real
+   per-device routing (a client per device) would be a design change, not a
+   bug fix.
+3. **Nothing validates a raw tag's declared OPC UA `DataType` against the
+   blob's coercion type.** The `/probe`-sourced inference
+   (`MTConnectDataTypeInference`) narrows how often an author picks a wrong
+   type, but it doesn't close the gap — an authored `DataType` mismatched
+   against the actual Agent observation still surfaces as `BadTypeMismatch`
+   /`BadOutOfRange` at runtime rather than at authoring time.
+4. **`sampleCount` is not a legal `DataItem` attribute.** It belongs on a
+   `TIME_SERIES` *observation*, not the device-model declaration. A real
+   Agent that meets `sampleCount` on a `DataItem` declaration logs `The
+   following keys were present and not expected: sampleCount` and **drops
+   the entire data item** from the served model. A live TIME_SERIES tag
+   therefore always resolves to `ArrayDim = null` (variable-length array) in
+   practice — the fixture's canned `probe.xml`/`Devices.xml`, which does
+   declare a `sampleCount`, is unrealistic on this point and exists only to
+   pin the parsing rule itself.
+5. **CONDITION is a plain `String`, not a native Part 9 alarm** (see above).
+6. **`TIME_SERIES` arrays and structured `DATA_SET`/`TABLE` observations
+   surface as `BadNotSupported`**, not an approximation — see the Quality
+   mapping table.
+
+## Deferred (not in this build)
+
+- **Write-back (MTConnect Interfaces).** Design
+  [§3.6](../plans/2026-07-15-mtconnect-driver-design.md#36-iwritable--not-implemented-v1):
+  the mainstream Agent surface is read-only by design; Interfaces is a rare,
+  optional request/response handshake that would mislead if modelled as
+  `IWritable`. Revisit only on a concrete deployment need.
+- **P1.5 fast-follow** (design
+  [§9](../plans/2026-07-15-mtconnect-driver-design.md#9-phasing--effort)):
+  CONDITION → native OPC UA Part 9 alarms via `IAlarmSource` (the Galaxy
+  native-alarm pattern); `TIME_SERIES` SAMPLE arrays materialized as real
+  OPC UA arrays; EVENT controlled-vocabulary values → OPC UA enumerations.
+- **P2 (on demand): SHDR adapter ingest.** A `SourceMode: "Agent" | "Shdr"`
+  switch that opens the raw pipe-delimited SHDR TCP socket directly. Loses
+  auto-discovery (no device model without an Agent in front, so
+  `SupportsOnlineDiscovery` would have to report `false` and tags would be
+  authored by hand, like Modbus). Niche; not built.
+
+## Testing
+
+- **Unit tests** — `tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.MTConnect.Tests/`
+  (canned-XML fixtures, no network) — 491/491 at time of writing. Covers
+  discovery tree shape, `MTConnectDataTypeInference`, observation indexing,
+  `UNAVAILABLE` → `BadNoCommunication`, CONDITION state-word mapping,
+  multipart chunk framing, and ring-buffer re-baseline paging (both the
+  sequence-gap and the `OUT_OF_RANGE` legs).
+- **Integration tests** —
+  `tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.MTConnect.IntegrationTests/` — env-gated
+  on `MTCONNECT_AGENT_ENDPOINT` (default `http://10.100.0.35:5000`), skips
+  cleanly (12 Skipped) when the fixture is unreachable, 12/12 against a real
+  Agent. Read the fixture's own
+  [`Docker/README.md`](../../tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.MTConnect.IntegrationTests/Docker/README.md)
+  for the full recipe — summary only, here:
+  - Image is **`mtconnect/agent:2.7.0.12`** — not `mtconnect/cppagent`, which
+    does not exist on Docker Hub (the design's original assumption).
+  - The stack is **two services**: the Agent plus a stdlib-only SHDR adapter
+    (`Docker/adapter.py`, on `python:3.13-alpine`). An Agent with no adapter
+    reports every observation `UNAVAILABLE` forever, which proves nothing.
+  - Deployed at `/opt/otopcua-mtconnect/` on the shared docker host
+    (`10.100.0.35`, `project=lmxopcua` label). Endpoint
+    `http://10.100.0.35:5000`.
+  - `agent.cfg` must be **pure ASCII** — one non-ASCII byte anywhere,
+    including a comment, makes the config parser reject the whole file with
+    a bare `Failed / Stopped at line: N`.
+  - Bring-up: `lmxopcua-fix sync mtconnect` then `lmxopcua-fix up mtconnect`
+    (PowerShell helper, Windows-only) — or, directly on the docker host,
+    `rsync` the repo's `Docker/` dir to `/opt/otopcua-mtconnect/` and run
+    `docker compose up -d --wait`.
+
+## Further reading
+
+- [`docs/plans/2026-07-15-mtconnect-driver-design.md`](../plans/2026-07-15-mtconnect-driver-design.md) — full design: capability wiring, browse reconciliation, typed-editor spec, resilience/timeout rules, phasing
+- [`docs/plans/2026-07-24-mtconnect-driver.md`](../plans/2026-07-24-mtconnect-driver.md) — the executable implementation plan and the task-by-task build record, including where it diverged from the design (TrakHound → hand-rolled)
+- [`docs/plans/2026-07-24-driver-expansion-tracking.md`](../plans/2026-07-24-driver-expansion-tracking.md) — Wave-2 program tracking
+- [Docker fixture README](../../tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.MTConnect.IntegrationTests/Docker/README.md) — the authoritative fixture recipe (seeded device model, endpoint, Mac AirPlay port-5000 gotcha)
@@ -0,0 +1,133 @@
+# MQTT test fixture
+
+Coverage map + gap inventory for the MQTT driver's harness.
+
+**TL;DR:** the unit suite (581 tests) carries the mapping, indexing, Sparkplug state-machine and
+failure-classification logic; the live suite (15 tests) proves the parts only a real broker can prove
+— TLS, real authentication, CA pinning in both directions, retained-message seeding, that a rejected
+CONNACK is actually surfaced, and the Sparkplug birth/alias/rebirth/death path against a real
+edge-node simulator.
+
+## What the fixture is
+
+`eclipse-mosquitto:2.0.22` plus a second container of the same image running `publisher/publish.sh`
+(the image ships `mosquitto_pub`, so no bespoke image is needed), plus — behind the `sparkplug`
+compose profile — **`otopcua-sparkplug-sim`**, a project-owned C# Sparkplug-B edge-node simulator
+(`tests/Drivers/….Driver.Mqtt.IntegrationTests/SparkplugSimulator/`). Compose lives at
+`tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.IntegrationTests/Docker/`; the deployed stack is
+`/opt/otopcua-mqtt` on the shared Docker host.
+
+**Two authenticated listeners, no anonymous fallback** (`allow_anonymous false`) — deliberate: an
+anonymous broker would let a broken auth config pass every test.
+
+| Listener | Endpoint | Env var |
+|---|---|---|
+| TLS + auth | `10.100.0.35:8883` | `MQTT_FIXTURE_ENDPOINT` |
+| plaintext + auth | `10.100.0.35:1883` | `MQTT_FIXTURE_PLAIN_ENDPOINT` |
+
+`MqttFixture` gates the suite on `MQTT_FIXTURE_ENDPOINT` / `MQTT_FIXTURE_USERNAME` /
+`MQTT_FIXTURE_PASSWORD` (+ `MQTT_FIXTURE_CA_CERT`, `MQTT_FIXTURE_TOPIC_PREFIX`) and **skips cleanly**
+when they are absent, so the suite is safe to run offline.
+
+**Unlike every other fixture it needs generated material first** — `./gen-fixture-material.sh` writes
+the gitignored `secrets/` (password file, CA, server cert/key). The broker will not start without it.
+Bring-up and the CA-fetch recipe are in [`infra/README.md`](../../infra/README.md) §3.
+
+### Published topics
+
+| Topic | Shape | Retain | Why it exists |
+|---|---|---|---|
+| `otopcua/fixture/retained/seed` | `{"value":42.5,…}` | ✅ **published exactly once** | The only way to prove retained *seeding*. On a republished topic a retained seed is indistinguishable from a fast live publish |
+| `otopcua/fixture/line1/temperature` | `{"value":…,"unit":"C","seq":n}` | ✅ | JSON + JSONPath extraction |
+| `otopcua/fixture/line1/counter` | `{"value":n}` | ✅ | Monotonic, for ordering |
+| `otopcua/fixture/line1/state` | `RUNNING` (bare text) | ✅ | Non-JSON `Raw`/`Scalar` payloads |
+| `otopcua/fixture/noise/chatter` | JSON | ❌ | **Never authored as a tag** — a broker carrying unauthored traffic is the normal case and the driver must stay silent about it |
+
+## What it actually covers
+
+The 7 live tests: TLS+auth connect; connect pinned to the fixture CA; connect pinned to a *foreign*
+CA is **rejected** (the falsifiability control — a pinning test that only ever passes proves nothing);
+wrong password is rejected **and surfaced** (the MQTTnet-5 silent-`Healthy` defect); plain
+subscribe→value under a RawPath; retained message seeds a value on subscribe; and an unauthored topic
+stays silent while an authored tag keeps flowing.
+
+### The Sparkplug simulator
+
+Group **`OtOpcUaSim`**; edge nodes **`EdgeA`** and **`EdgeB`**; `EdgeA` additionally publishes device
+**`Filler1`**. Node metrics `Temperature` (Float), `Pressure` (Double), `Count` (Int32), `Running`
+(Boolean), `Serial` (String) plus the mandatory `bdSeq` and **`Node Control/Rebirth`** — the last one
+deliberately carries a `/`, so it exercises the "a metric name is not a topic segment" rule. Device
+metrics: `Temperature` (Float), `FillCount` (Int64), `Jammed` (Boolean). Cadence ~2 s.
+
+It **subscribes to `spBv1.0/OtOpcUaSim/NCMD/{node}`** and re-births on a rebirth request, so it
+exercises the real NCMD round trip rather than simulating it. Births are not retained (per spec), so
+`docker restart otopcua-sparkplug-sim` is the way to force a fresh birth on demand:
+
+```bash
+ssh dohertj2@10.100.0.35 'cd /opt/otopcua-mqtt && docker compose --profile sparkplug up -d'
+ssh dohertj2@10.100.0.35 'docker restart otopcua-sparkplug-sim'   # force a birth
+ssh dohertj2@10.100.0.35 'docker logs -f otopcua-sparkplug-sim'
+```
+
+Live-gated end-to-end (2026-07-24, P1 milestone): deployed on the docker-dev rig against this fixture,
+both tags resolved and served changing values through OPC UA, and the AdminUI `#`-observation picker
+rendered the real topic tree. Re-gated for P2 (2026-07-25) against the Sparkplug simulator — see
+[Mqtt.md](Mqtt.md).
+
+## What it does NOT cover
+
+### 1. Sparkplug primary-host STATE, and write-through
+The simulator never observes a Host Application `STATE`, because the driver never publishes one
+(`ActAsPrimaryHost` is unimplemented). Nor is there any DCMD/NCMD **command** coverage: rebirth is the
+only NCMD the driver ever sends, and `IWritable` is deferred.
+
+Sparkplug **seq-gap injection** is unit-proven only — the simulator always publishes a well-formed
+monotonic `seq`, so no live test drives the gap → rebirth path end-to-end.
+
+### 2. Broker-side failure injection
+No test kills the broker mid-session, partitions the network, or forces a SUBACK failure against a
+real broker. Reconnect, backoff and per-topic degradation are **unit-proven only**.
+
+### 3. Wildcard tags against a live broker
+The by-filter indexing fix that keeps wildcard tags alive across a reconnect is covered by unit tests;
+no live test authors a `+`/`#` tag and bounces the connection.
+
+### 4. QoS 2 delivery semantics
+The fixture publishes at QoS 0/1. QoS 2's exactly-once handshake is never exercised end-to-end.
+
+### 5. Scale
+One publisher, five topics, a ~2 s cadence. Nothing probes the 50 000-node browse cap, the 1 MiB
+payload cap, or thousands of authored tags.
+
+### 6. Redundant-pair client-id collision
+Found by hand during the P1 gate (a fixed `clientId` makes pair nodes evict each other), **not** by a
+test. No automated coverage asserts that two concurrent drivers coexist.
+
+## When to trust the MQTT fixture, when to reach for a real broker
+
+| Question | Fixture answers it? |
+|---|---|
+| Does TLS + auth work, and does bad auth fail loudly? | ✅ yes |
+| Is a retained message seeded on subscribe? | ✅ yes |
+| Does JSONPath extraction + coercion behave? | ✅ yes (unit + live) |
+| Does the driver ignore unauthored traffic? | ✅ yes |
+| Does it survive a broker restart / flapping link? | ❌ unit-only |
+| Does it hold up at plant tag counts? | ❌ no |
+| Does a Sparkplug birth → alias → DATA → death cycle work? | ✅ yes (live, vs. the simulator) |
+| Does an NCMD rebirth request actually get answered? | ✅ yes (the simulator subscribes + re-births) |
+| Sparkplug seq-gap → rebirth | ❌ unit-only (the sim never skips a seq) |
+| Sparkplug primary-host STATE / DCMD writes | ❌ not implemented |
+
+## Follow-up candidates
+
+1. Broker-restart / SUBACK-failure live tests (closes gap 2).
+2. A live wildcard-across-reconnect test (closes gap 3).
+3. A concurrent-two-driver test pinning the client-id hazard (closes gap 6).
+4. A seq-gap injection switch on the simulator, closing the last unit-only Sparkplug leg.
+
+## Key fixture / config files
+
+- `tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.IntegrationTests/Docker/docker-compose.yml`
+- `tests/Drivers/…/Docker/mosquitto.conf` · `Docker/gen-fixture-material.sh` · `Docker/publisher/publish.sh`
+- `tests/Drivers/…/MqttFixture.cs` · `PlainMqttLiveTests.cs`
+- [`infra/README.md`](../../infra/README.md) §3 — bring-up, endpoints, CA fetch
@@ -0,0 +1,397 @@
+# MQTT Driver
+
+In-process MQTT **broker-subscribe** driver. It holds one MQTTnet 5 client against one broker,
+subscribes to the topics its authored tags name, and forwards each PUBLISH straight to
+`ISubscribable.OnDataChange`. Ingest is **push, not poll**, and **one-way** — there is no `IWritable`.
+
+**Two ingest shapes, selected by the driver's `Mode`:** `Plain` binds a tag to a concrete MQTT topic;
+`SparkplugB` binds it to a `group / edge node / device? / metric` tuple and decodes Eclipse-Tahu
+protobuf under one `spBv1.0/{GroupId}/#` subscription. Both run over the same single client.
+
+See [Mqtt-Test-Fixture.md](Mqtt-Test-Fixture.md) for the harness and
+[`../plans/2026-07-15-mqtt-sparkplug-driver-design.md`](../plans/2026-07-15-mqtt-sparkplug-driver-design.md)
+for the design.
+
+> **Status.** P1 (plain MQTT) and P2 (Sparkplug B ingest) are both shipped and live-gated against the
+> Mosquitto + Sparkplug-simulator fixture. Write-through (`IWritable` — NCMD/DCMD/plain publish) is
+> **deferred** ([#508](https://gitea.dohertylan.com/dohertj2/lmxopcua/issues/508)); every MQTT node
+> materializes read-only. See [Known gaps](#known-gaps) — every entry there carries a tracking issue
+> (#507–#515).
+
+## Project Layout
+
+| Project | Holds |
+|---|---|
+| `Driver.Mqtt.Contracts` | Config records, enums, `MqttTagDefinition` + the pure `MqttTagDefinitionFactory`, and the one shared `MqttJson.Options`. **Deliberately transport-free** — no MQTTnet reference |
+| `Driver.Mqtt` | Runtime: `MqttDriver`, `MqttConnection` (connect + reconnect supervisor), `MqttSubscriptionManager`, `LastValueCache`, factory registration, `MqttDriverProbe` |
+| `Driver.Mqtt.Browser` | `MqttDriverBrowser` + `MqttBrowseSession` — the AdminUI address picker's `#`-observation session |
+
+> `.Browser` references `.Driver` (not just `.Contracts`) — a **documented, deliberate exception**
+> so browse can reuse `MqttConnection.BuildClientOptions` (TLS / CA-pin / credentials / protocol
+> mapping). Its cost is pulling `Core` into the AdminUI graph. The csproj carries a boxed warning;
+> do not copy the pattern into a new driver's browser. The clean fix — extract the pure
+> options builder down into `.Contracts` — is tracked as
+> [#512](https://gitea.dohertylan.com/dohertj2/lmxopcua/issues/512).
+
+## Capability Surface
+
+```csharp
+public sealed class MqttDriver
+    : IDriver, ITagDiscovery, ISubscribable, IReadable, IHostConnectivityProbe, IRediscoverable, IAsyncDisposable, IDisposable
+```
+
+| Capability | Entry point | Notes |
+|---|---|---|
+| `IDriver` | `InitializeAsync` / `ReinitializeAsync` / `ShutdownAsync` / `GetHealth` | Order **register → attach → connect** is contractual. `ReinitializeAsync` applies a tag-only delta in place, and rebuilds the session when the broker identity changed |
+| `ITagDiscovery` | `DiscoverAsync` | Replays **only the authored `rawTags`** into an `Mqtt` folder. `SupportsOnlineDiscovery => false`. `RediscoverPolicy` is `Once` in Plain and **`UntilStable` in Sparkplug** (half of what a Sparkplug tag needs — its datatype — is only knowable from a birth) |
+| `ISubscribable` | `SubscribeAsync` / `OnDataChange` | One SUBSCRIBE per distinct authored topic. **`publishingInterval` is ignored** — MQTT is push-based; this driver neither polls nor throttles |
+| `IReadable` | `ReadAsync` | Serves the last received/retained value from `LastValueCache`; never throws. A never-seen tag reads `BadWaitingForInitialData` |
+| `IHostConnectivityProbe` | `GetHostStatuses` | 1-second poll of `MqttConnection.State`; `HostName` is `"{host}:{port}"` |
+| `IRediscoverable` | `OnRediscoveryNeeded` | Nothing raises it in Plain mode. **Sparkplug raises it** when a birth for an *authored* scope carries a metric-name set different from the last one seen for that scope — both conditions are anti-storm, see [Rediscovery](#rediscovery-sparkplug) |
+
+**Not implemented:** `IWritable`, `IPerCallHostResolver`, `IAlarmSource`, `IHistoryProvider`.
+Materialized nodes are `SecurityClassification.ViewOnly`, `IsAlarm: false`, `IsHistorized: false` —
+*"MQTT ingest is one-way … ViewOnly rather than an Operate node whose writes would silently vanish."*
+
+Driver-type string: **`Mqtt`** (`DriverTypeNames.Mqtt`).
+
+## Configuration
+
+Bound through `MqttJson.Options` — **case-insensitive**, enums by **name**, unknown members skipped.
+
+**The whole connection is authored on the DRIVER** (`DriverConfig`), via `MqttDriverForm` in the `/raw`
+driver-config modal. Unlike Modbus / S7 / OPC UA Client, MQTT does **not** use the v3
+endpoint→`DeviceConfig` split: an MQTT driver instance holds exactly one broker session, so
+`MqttDeviceForm` is informational (the same shape as `GalaxyDeviceForm`) and devices under an MQTT
+driver are pure organisational grouping in the RawPath.
+
+> **Why not the device.** `DriverDeviceConfigMerger` merges a device's keys up to the top level *only
+> when the driver has exactly one device*. A device-authored broker connection therefore disappears
+> from the merged blob the moment a second device is added — a silent outage with nothing to see at
+> deploy time. Driver-level authoring is correct for 0, 1 or N devices. A pre-form deployment that put
+> the connection on a sole device still works (merge-up wins over the driver's keys) and
+> `MqttDeviceForm` flags those keys so the mismatch is visible; move them to the driver.
+
+`DriverDeviceConfigMerger` still merges driver + device and injects `rawTags`.
+
+```jsonc
+// DriverConfig — authored by MqttDriverForm. PascalCase keys, enums as names.
+{
+  "Host": "10.100.0.35",
+  "Port": 8883,
+  "UseTls": true,
+  "AllowUntrustedServerCertificate": false,
+  "CaCertificatePath": null,      // pins the chain; null = OS trust store
+  "Username": "otopcua",
+  "Password": "",                 // never commit
+  "ProtocolVersion": "V500",
+  "CleanSession": true,
+  "KeepAliveSeconds": 30,
+  "ConnectTimeoutSeconds": 15,
+  "ReconnectMinBackoffSeconds": 1,
+  "ReconnectMaxBackoffSeconds": 30,
+  "MaxPayloadBytes": 1048576,
+  "Mode": "Plain",
+  "Plain": { "TopicPrefix": "", "DefaultQos": 1 }
+}
+
+// DeviceConfig — empty; MQTT has no per-device endpoint.
+{}
+```
+
+### `Sparkplug` sub-object (`Mode: "SparkplugB"`)
+
+```jsonc
+{
+  "Mode": "SparkplugB",
+  "Sparkplug": {
+    "GroupId": "OtOpcUaSim",            // REQUIRED — the driver's whole subscription scope
+    "HostId": "",                       // Host Application identity; receive-only (see below)
+    "ActAsPrimaryHost": false,          // NOT IMPLEMENTED — logs a warning when true
+    "RequestRebirthOnGap": true,        // a seq gap asks the edge node to re-announce (NCMD)
+    "BirthObservationWindowSeconds": 15 // how long discovery collects births before calling it stable
+  }
+}
+```
+
+| Key | Default | Notes |
+|---|---|---|
+| `GroupId` | `""` | **Required.** The driver subscribes exactly `spBv1.0/{GroupId}/#`. Blank ⇒ it connects, reports `Healthy`, and ingests **nothing**. It is a literal topic segment, so `/`, `+`, `#` are refused by the form |
+| `HostId` | `""` | Sparkplug Host Application identity. **Receive-only** — the driver observes `STATE` and never publishes one |
+| `ActAsPrimaryHost` | `false` | **Not implemented.** Setting it logs a startup **warning** rather than being silently inert — being a primary host is a three-part contract (retained `ONLINE`, a matching `OFFLINE` registered as the MQTT Will *at connect time*, an explicit `OFFLINE` on clean shutdown), and shipping the `ONLINE` half without the Will is strictly worse than shipping neither: a crashed node would leave a retained `ONLINE` asserting forever that a dead host is alive |
+| `RequestRebirthOnGap` | `true` | On a detected sequence-number gap, publish a rebirth-request NCMD instead of running on stale metric state |
+| `BirthObservationWindowSeconds` | `15` | Discovery's birth-collection window. Must be ≥ 1 |
+
+`MqttDriverForm` authors all five in Sparkplug mode. The sub-object is **merged, never replaced** (a
+key a newer driver adds inside it survives an older AdminUI), and in `Plain` mode it is not touched at
+all — so flipping a driver to Plain to look at it and back does not lose the group id. The form never
+writes `RawTags`; the deploy artifact owns it.
+
+> **This was a live-gate finding.** Through the P2 implementation `MqttDriverForm` still carried its P1
+> placeholder — switching Mode to `SparkplugB` rendered a "not available yet" notice and **no group-id
+> field**, so once Sparkplug ingest shipped there was no way to author a Sparkplug driver from the
+> AdminUI at all. Pinned by `MqttDriverFormModelTests`' Sparkplug cases.
+
+Every key has a default, so nothing is strictly required by the binder. Notable ones:
+`port` **8883**, `useTls` **true**, `protocolVersion` **V500**, `cleanSession` **true**,
+`keepAliveSeconds` **30**, `connectTimeoutSeconds` **15**,
+`reconnectMinBackoffSeconds` **1** / `reconnectMaxBackoffSeconds` **30**,
+`maxPayloadBytes` **1 MiB**, `allowUntrustedServerCertificate` **false**.
+
+> ⚠️ **Leave `clientId` unset on a redundant pair.** Both nodes of a pair run the driver. MQTT
+> requires client ids to be unique per broker, so a *fixed* `clientId` makes the two nodes evict each
+> other forever — the broker logs `Client <id> already connected, closing old connection` and both
+> nodes reconnect every few seconds while still reporting `Healthy`. Unset (the default) lets MQTTnet
+> generate a unique id per connection, which is correct. This was observed live during the P1 gate.
+> (The probe and browser already self-uniquify with `-probe-` / `-browse-` suffixes.) `MqttDriverForm`
+> defaults the field blank and raises this warning inline the moment a value is typed.
+
+The form validates every knob against the driver's own `[Range]` bounds (port 1–65535, keep-alive /
+connect-timeout / backoffs ≥ 1 s, max-backoff ≥ min-backoff, `maxPayloadBytes` ≥ 1, QoS 0–2) and
+additionally **clamps** on serialize, so an operator who ignores the inline error still cannot persist
+a `connectTimeoutSeconds: 0` driver-brick.
+
+## Tag Configuration
+
+A tag binds in **one of two shapes**, and which one is decided by *which keys are present*, not by a
+`mode` key on the tag. `MqttTagDefinitionFactory` reads the Sparkplug tuple when any Sparkplug
+descriptor key is set, and the topic otherwise; the AdminUI's "Tag shape" selector infers the same way
+on reopen. The key names are single-sourced in `MqttTagConfigKeys` so the browse-commit mapper and the
+factory cannot drift.
+
+### Plain shape
+
+| Key | Type | Default | Notes |
+|---|---|---|---|
+| `topic` | string | — | **Required.** Absent/blank rejects the tag ⇒ `BadNodeIdUnknown` |
+| `payloadFormat` | `Json` \| `Raw` \| `Scalar` | `Json` | **Strict** — a typo'd value rejects the tag |
+| `jsonPath` | string | `"$"` | Absent *or empty* ⇒ document root. `Json` only |
+| `dataType` | `DriverDataType` | `String` | **Strict.** `Float64`, not `Double` — see below |
+| `qos` | int 0–2 | driver's `defaultQos` | **Strict** — a malformed value rejects rather than silently weakening delivery |
+| `retainSeed` | bool | `true` | Seed this tag from the broker's retained message on subscribe |
+
+There is **no `mode` key** — the AdminUI's "Tag shape" selector is UI-only, inferred from the blob and
+never serialized.
+
+**`dataType` uses `DriverDataType`, which has `Float64` and has no `Double`.** Authoring `"Double"` is
+a strict-enum rejection, not a fallback.
+
+Payload handling: `Json` selects via JSONPath then coerces (miss ⇒ `BadDecodingError`, coerce fail ⇒
+`BadTypeMismatch`); `Raw` returns the payload's UTF-8 text verbatim and **ignores `dataType`**;
+`Scalar` decodes then coerces. The JSONPath subset is `$`, `$.a.b`, `$['a']`, `$.a[0]` — **no
+filters, slices, wildcards or recursive descent**.
+
+### Wildcards
+
+The **runtime accepts** a `+`/`#` topic (it is ambiguous, not unparseable) and the deploy-time
+`Inspect` pass **warns**. The **AdminUI editor rejects** it outright — the one place the editor is
+deliberately stricter than the driver, because one Tag holds one value and a wildcard would feed it
+from many source topics. Wildcard tags are indexed **by filter**, not by concrete topic, so they
+survive a reconnect; a message fans out to *every* matching tag, and unauthored topics are dropped.
+
+### Sparkplug shape
+
+| Key | Type | Default | Notes |
+|---|---|---|---|
+| `groupId` | string | — | **Required.** Must match the driver's `Sparkplug.GroupId` to ever receive a message |
+| `edgeNodeId` | string | — | **Required.** |
+| `deviceId` | string | *absent* | **Omit** for a metric published by the edge node itself (NBIRTH/NDATA). Absent is meaningfully different from `""` |
+| `metricName` | string | — | **Required.** The tag's stable binding key across rebirths. **May contain `/`** — `Node Control/Rebirth` and `Properties/Serial Number` are canonical Sparkplug names, and the whole name is one value, never split |
+| `dataType` | `DriverDataType` | *from the birth* | **Optional override.** Absent ⇒ take whatever type the birth certificate declared. The AdminUI's "(from birth certificate)" option removes the key entirely |
+| `isHistorized` / `historianTagname` | — | — | Server-side historization, unchanged from Plain |
+
+`payloadFormat`, `jsonPath`, `qos` and `retainSeed` are **Plain-only** and meaningless here: a
+Sparkplug body is protobuf, and the subscription is one driver-wide `spBv1.0/{GroupId}/#`, not a
+per-tag filter.
+
+`groupId` / `edgeNodeId` / `deviceId` are literal MQTT topic segments, so the AdminUI editor refuses
+`/`, `+` and `#` in them — a decoded incoming id can never contain one, so such a tag could never
+bind. `metricName` is deliberately **exempt**: it is not a topic segment.
+
+```jsonc
+// A device metric.
+{"groupId":"OtOpcUaSim","edgeNodeId":"EdgeA","deviceId":"Filler1","metricName":"FillCount"}
+
+// A node-level metric — note deviceId is ABSENT, not blank.
+{"groupId":"OtOpcUaSim","edgeNodeId":"EdgeA","metricName":"Temperature"}
+```
+
+## Sparkplug B Ingest
+
+One subscription (`spBv1.0/{GroupId}/#`) feeds a per-edge-node state machine
+(`SparkplugIngestor` + `SparkplugCodec` / `AliasTable` / `BirthCache` / `SequenceTracker`):
+
+- **Births are the only self-describing message.** NBIRTH/DBIRTH name every metric and assign its
+  alias; NDATA/DDATA carry an **alias and no name at all**. So the alias table is rebuilt *per birth*
+  and tags bind **by name**, never by alias — aliases are per-birth and may be reused for a different
+  metric after a rebirth.
+- **NBIRTH is node-scoped, DBIRTH is device-scoped**, and routing a DBIRTH through the node path
+  wipes `bdSeq`. They are handled separately on purpose.
+- **Sequence tracking**: `seq` is a wrapping 0–255 counter. A detected gap raises a rebirth request
+  when `RequestRebirthOnGap` is on, rather than silently continuing on stale metric state.
+- **Death → STALE.** An NDEATH whose `bdSeq` matches the live session (the bdSeq tie is what stops a
+  stale death from killing a fresh session) marks every metric under that edge node `Bad` /
+  `BadNoCommunication`. A DDEATH does the same for one device. The next birth restores them.
+- **Unsupported datatypes are skipped with a warning, never guessed**: `DataSet`, `Template`,
+  `PropertySet`, `PropertySetList`, `Unknown`. `Int8`→`Int16` and `UInt8`→`UInt16` widen; `*Array`
+  variants map to the element type with the array bit set.
+- **Ingest state is reset at every session/authoring seam** — a reconnect or a `ReinitializeAsync`
+  must not carry a previous session's alias table into a new one.
+
+### Rediscovery (Sparkplug)
+
+`OnRediscoveryNeeded` fires only when a birth is **for an authored scope** *and* its metric-name set
+**differs** from the last one seen for that scope (order-insensitive, ordinal). Both conditions are
+anti-storm, not optimisations: rediscovery triggers an address-space rebuild, and an edge node
+re-births freely — on its own schedule, on every reconnect, and once per rebirth NCMD.
+
+> ⚠️ **Nothing consumes the signal today.** No runtime component subscribes to
+> `IRediscoverable.OnRediscoveryNeeded`, and `DriverHostActor.HandleDiscoveredNodes` hard-returns —
+> discovered-node injection is dormant in v3. The served address space comes from the deploy artifact,
+> so **a DBIRTH introducing a new metric does not change the OPC UA tree**; you must redeploy. The
+> driver's decision is observable only as an Information log line
+> (`… requesting rediscovery.`). This is a v3 platform gap, not an MQTT one.
+
+## Connection + Failure Semantics
+
+`MqttConnectionState`: `Disconnected → Connected → Reconnecting → Faulted → Disposed`.
+A broker that is merely down stays **`Reconnecting` indefinitely** — unreachable is never a fault.
+Backoff is exponential between the two `reconnectBackoff` bounds.
+
+**MQTTnet 5 does not throw on a rejected CONNACK** — it returns the code and leaves the client
+disconnected. Left unhandled, a wrong password produced a `Healthy` driver that never received a
+value. `MqttConnection` therefore raises `MqttConnectRejectedException`:
+
+- **Unrecoverable ⇒ `Faulted`, supervisor stops** (retrying cannot help): `MalformedPacket`,
+  `ProtocolError`, `UnsupportedProtocolVersion`, `ClientIdentifierNotValid`, `BadUserNameOrPassword`,
+  `NotAuthorized`, `Banned`, `BadAuthenticationMethod`, `TopicNameInvalid`, `PacketTooLarge`,
+  `PayloadFormatInvalid`, `RetainNotSupported`, `QoSNotSupported`, `ServerMoved`.
+- **Everything else is transient** and keeps retrying — including `UnspecifiedError` and any future
+  code. (`ServerMoved` is permanent, `UseAnotherServer` is temporary — per the MQTT 5 spec.)
+
+A reconnect that completes without re-subscribing would be a healthy-looking connection that receives
+nothing forever, so `OnReconnectedAsync` **throws** when zero filters are granted, tearing the session
+down rather than swallowing it. A SUBACK failure degrades just the affected RawPaths to
+`BadCommunicationError`.
+
+## Browse
+
+`MqttDriverBrowser` opens a **read-only observation session**: it subscribes at QoS 0 to `#` (or
+`{topicPrefix}/#`) under a `-browse-`-suffixed client id and builds a `/`-segment tree from whatever
+publishes. **Nothing is ever published.** It is *inherently incomplete* — a topic that stays silent
+during the window is invisible — so manual entry remains the escape hatch.
+
+Bounds: 50 000 nodes (then `⚠ Observation truncated`), 1024-char topics / 256-char segments (then
+`⚠ Some topics were too long`), 512-byte payload inspection. Sessions are reaped after 2 minutes idle.
+
+**Sparkplug B browse serves a different tree from the same passive window**: observed NBIRTH/DBIRTH
+certificates are decoded into `Group → EdgeNode → [Device] → Metric` (a birth is the only Sparkplug
+message that names its metrics). Same node cap, same bounds, same "publishes nothing" guarantee.
+
+The bespoke browser wins over the universal `DiscoveryDriverBrowser`, which would decline MQTT anyway
+(`SupportsOnlineDiscovery` is `false`).
+
+### Browse-commit writes the address the factory reads
+
+A committed leaf's address is a **descriptor**, not a single reference string, so
+`RawBrowseCommitMapper` reads it from the `AttributeInfo.AddressFields` the session states — Plain
+emits `topic`; Sparkplug emits `groupId` / `edgeNodeId` / `deviceId?` / `metricName`, the names
+`MqttTagConfigKeys` single-sources for both the mapper and `MqttTagDefinitionFactory`.
+
+**It is never parsed out of the browse node id.** A Sparkplug node id is
+`{group}/{node}[/{device}]::{metric}` and a metric name legitimately contains `/`
+(`Node Control/Rebirth`), so splitting the id cannot recover the tuple. Which keys the session emits
+is also how the mapper learns the shape — the driver *type* reaching it is just `Mqtt`, and the mode
+lives on the driver config. A leaf whose attribute lookup returned nothing carries no address and is
+refused **at commit, in words**, rather than committed as a tag that deploys clean and then reports
+`BadNodeIdUnknown` forever.
+
+### Request rebirth (Sparkplug only)
+
+Births are never retained, so a healthy but quiet plant shows an **empty** picker tree until one
+lands. The `Request rebirth` affordance in the browse modal is the way to fill it on demand: it
+publishes a Sparkplug rebirth-request NCMD (`Node Control/Rebirth`) to the selected scope — the **one
+and only** browse action that publishes anything.
+
+- **Scope** is the last node clicked in the tree. A device or metric resolves **up to its owning edge
+  node** (Sparkplug has no device-scoped rebirth); a group fans out to every observed edge node
+  beneath it and is refused **whole** past 32, publishing nothing.
+- **Two clicks, never one** — `Request rebirth…` arms a confirm panel naming the resolved scope and
+  its consequence; changing the selection disarms it.
+- **Gated on `DriverOperator`**, enforced server-side in `BrowserSessionService.RequestRebirthAsync`
+  (fail-closed) before the session is touched; the UI gate is defence in depth. A refusal — policy,
+  over-wide group, unresolvable scope — is **shown**, not swallowed.
+- Offered only for a Sparkplug session (`IRebirthCapableBrowseSession.RebirthAvailable`); a Plain
+  MQTT window publishes nothing, ever.
+
+### Refresh
+
+An observation window **accumulates**, but the tree renders **once**, when it is created — and
+`OpenAsync` returns as soon as the SUBSCRIBE is granted, without waiting for the birth-observation
+window. So the first render is normally empty on Plain (a topic that has not published yet is
+invisible) and *almost always* empty on Sparkplug (births are never retained). **Refresh** re-reads
+the root against the same session: nothing reconnects, nothing already observed is lost, and the tag
+selection is kept. Only the armed rebirth scope is cleared, because the node it named may no longer be
+in the rebuilt tree.
+
+> **Also fixed by this gate, and not MQTT-specific:** every node label in the shared
+> `DriverBrowseTree` was an `<a href="#">`. `blazor.web.js`'s enhanced-navigation click interceptor
+> resolves a bare `#` against `<base href="/">`, so clicking a node **label** navigated the whole
+> AdminUI to `/` and destroyed the hosting modal (`@onclick:preventDefault` suppresses the browser's
+> default action, not Blazor's interceptor). The labels are now `<button type="button">`. This
+> affected **every** driver's picker since 2026-05-28; it surfaced here because choosing a rebirth
+> scope is the first flow that requires clicking a label rather than the ▶ toggle.
+
+> ⚠️ **Known gap — a completely empty tree cannot arm a rebirth.** The rebirth scope is taken from the
+> last node clicked *in the tree*, so on a plant that has not birthed since the window opened there is
+> nothing to click and `Request rebirth…` stays disabled — the exact case the affordance exists for.
+> `MqttBrowseSession.ResolveRebirthTargets` already accepts a bare `{group}/{edgeNode}` for a node the
+> window has never seen (it calls that "the prime rebirth target"); what is missing is a UI path to
+> enter one, or to default the scope to the driver's own configured `GroupId`. Until then: use
+> **Refresh** after any birth, or author the tags by **Manual entry**, which is always available.
+
+## Test Connect
+
+`MqttDriverProbe` performs **one CONNECT** (no SUBSCRIBE, no publish) under a `-probe-` client id and
+disconnects. Success message: `"MQTT CONNECT OK"`. A rejected CONNACK is described by the same
+`DescribeConnackRejection` the running driver uses, so the button and the driver report a rejection in
+identical words. See [TestConnectProbes.md](TestConnectProbes.md).
+
+## Testing
+
+- **Unit** — `tests/Drivers/…Driver.Mqtt.Tests` (**581 tests**): tag-config mapping (both shapes),
+  JSONPath subset, strict-enum rejection, subscription indexing (incl. the wildcard-by-filter case),
+  reconnect/rebuild branches, CONNACK classification, and the Sparkplug half — golden-payload decode,
+  topic parse/format, datatype map, alias/birth-cache rebuild, sequence + bdSeq-death ties, the
+  rediscovery change gate, and the browse session's "publishes nothing" assertion.
+- **Live (env-gated)** — `tests/Drivers/…Driver.Mqtt.IntegrationTests` (**15 tests**) against the
+  Mosquitto broker + the C# Sparkplug edge-node simulator; skips cleanly when `MQTT_FIXTURE_ENDPOINT`
+  is unset. See [Mqtt-Test-Fixture.md](Mqtt-Test-Fixture.md) and `infra/README.md` §3.
+- **AdminUI** — `MqttDriverFormModelTests` / `MqttTagConfigModelTests` cover both editors'
+  round-trip, mode inference and validation. AdminUI has no bUnit, so the razor shells themselves are
+  only ever proven by a live `/run` gate.
+
+## Operational Notes
+
+- **Read-only.** No writes reach the broker; every node is ViewOnly. Sparkplug NCMD is used for
+  **rebirth requests only** — never to command a device.
+- **No alarms, no driver-side history.** Historization is a server-side concern (`isHistorized`).
+- **Both pair nodes subscribe independently** — MQTT fan-out is per-connection, and the Primary gate
+  applies downstream, not to ingest. This is also why `clientId` must stay unset (above).
+- **Unauthored traffic is ignored.** A busy broker is normal; the driver never auto-provisions a tag.
+
+## Known gaps
+
+Every row is tracked. None is a silent failure — each either refuses in words or logs.
+
+| Gap | Issue | Effect | Notes |
+|---|:---:|---|---|
+| **Write-through (`IWritable`)** | [#508](https://gitea.dohertylan.com/dohertj2/lmxopcua/issues/508) | Every MQTT node is read-only | Deferred to P3 — NCMD/DCMD + plain publish, optimistic-Good + self-correct on echo |
+| **Rediscovery is inert** | [#507](https://gitea.dohertylan.com/dohertj2/lmxopcua/issues/507) | A DBIRTH introducing a metric does not change the OPC UA tree; redeploy to pick it up | v3 **platform** gap, not MQTT-specific — nothing subscribes to `OnRediscoveryNeeded` and `DriverHostActor.HandleDiscoveredNodes` hard-returns. Also affects Galaxy / TwinCAT / AbCip. Driver-side decision is log-observable |
+| **Rebirth needs a non-empty tree** | [#514](https://gitea.dohertylan.com/dohertj2/lmxopcua/issues/514) | `Request rebirth…` cannot be armed on a plant that has not birthed since the window opened | See [Refresh](#refresh). Session side already supports a bare `{group}/{edgeNode}` scope |
+| **`_canRebirth` is captured at browse-open** | [#510](https://gitea.dohertylan.com/dohertj2/lmxopcua/issues/510) | A session reaped for idleness (2 min) still draws the button, and using it errors | The error is shown, not swallowed; reopen the browser |
+| **Primary-host STATE publishing** | [#511](https://gitea.dohertylan.com/dohertj2/lmxopcua/issues/511) | `ActAsPrimaryHost` does nothing | Logs a startup warning rather than being silently inert — see the `Sparkplug` sub-object table |
+| **A metric whose name contains `/` cannot be browse-committed** | [#509](https://gitea.dohertylan.com/dohertj2/lmxopcua/issues/509) | The commit is refused **whole**, in words (`Row N: Name must not contain '/'`) | The derived **tag Name** is a RawPath segment and may not contain `/`, while `metricName` legitimately may. This blocks the spec-mandatory `Node Control/Rebirth`. **Workaround: Manual entry** — author the tag with a `/`-free name and type the slashed `metricName` into the Sparkplug editor, which accepts it. Nothing is silently mis-bound |
+| **`DataSet` / `Template` / `PropertySet` metrics** | [#515](https://gitea.dohertylan.com/dohertj2/lmxopcua/issues/515) | Skipped with a warning | v1-unsupported; never coerced into a guessed type |
+| **The tag editor writes `payloadFormat` into a Sparkplug blob** | [#513](https://gitea.dohertylan.com/dohertj2/lmxopcua/issues/513) | Cosmetic only | `payloadFormat` is Plain-only; the factory routes on the Sparkplug keys and ignores it. Noise in the blob, not a mis-binding |
+| **`.Browser` references `.Driver`, not just `.Contracts`** | [#512](https://gitea.dohertylan.com/dohertj2/lmxopcua/issues/512) | A documented layering exception | Taken to reuse `MqttConnection.BuildClientOptions` rather than duplicate TLS/CA-pin logic — see the note at the top of this doc |
@@ -124,7 +124,7 @@ ConditionType events (non-base `BaseEventType`) is not verified.
 - Anonymous, UserName/Password, X509 cert tokens — each is contract-tested
  but not exchanged against a server that actually enforces each.
 - LDAP-backed `UserName` (matching this repo's server-side
-  `LdapUserAuthenticator`) requires a live LDAP round-trip; not tested.
+  `LdapOpcUaUserAuthenticator`) requires a live LDAP round-trip; not tested.

 ## When to trust OpcUaClient tests, when to reach for a server

@@ -1,6 +1,6 @@
 # Drivers

-OtOpcUa is a multi-driver OPC UA server. The Core (`ZB.MOM.WW.OtOpcUa.Core` + `Core.Abstractions` + `Server`) owns the OPC UA stack, address space, session/security/subscription machinery, resilience pipeline, and namespace kinds (Equipment + SystemPlatform). Drivers plug in through **capability interfaces** defined in `src/Core/ZB.MOM.WW.OtOpcUa.Core.Abstractions/`:
+OtOpcUa is a multi-driver OPC UA server. The Core (`ZB.MOM.WW.OtOpcUa.Core` + `Core.Abstractions` + `Server`) owns the OPC UA stack, address space, session/security/subscription machinery, resilience pipeline, and the two v3 OPC UA namespaces (Raw + UNS — see `V3NodeIds` / `AddressSpaceRealm`). Drivers plug in through **capability interfaces** defined in `src/Core/ZB.MOM.WW.OtOpcUa.Core.Abstractions/`:

 - `IDriver` — lifecycle (`InitializeAsync`, `ReinitializeAsync`, `ShutdownAsync`, `GetHealth`)
 - `IReadable` / `IWritable` — one-shot reads and writes
@@ -15,20 +15,28 @@ OtOpcUa is a multi-driver OPC UA server. The Core (`ZB.MOM.WW.OtOpcUa.Core` + `C

 Each driver opts into only the capabilities it supports. Every async capability call at the Server dispatch layer goes through `CapabilityInvoker` (`Core/Resilience/CapabilityInvoker.cs`), which wraps it in a Polly pipeline keyed on `(DriverInstanceId, HostName, DriverCapability)`. The `OTOPCUA0001` analyzer enforces the wrap at build time. Drivers themselves never depend on Polly; they just implement the capability interface and let the Core wrap it.

-Driver type metadata is registered at startup in `DriverTypeRegistry` (`src/Core/ZB.MOM.WW.OtOpcUa.Core.Abstractions/DriverTypeRegistry.cs`). The registry records each type's allowed namespace kinds (`Equipment` / `SystemPlatform` / `Simulated`), its JSON Schema for `DriverConfig` / `DeviceConfig` / `TagConfig` columns, and its stability tier per [docs/v2/driver-stability.md](../v2/driver-stability.md).
+Driver **factories** are registered at startup in `DriverFactoryRegistry` (`src/Core/ZB.MOM.WW.OtOpcUa.Core/Hosting/DriverFactoryRegistry.cs`) — all 12 in one place, `src/Server/ZB.MOM.WW.OtOpcUa.Host/Drivers/DriverFactoryBootstrap.cs:147-164`. Type names are the `DriverTypeNames` constants (`src/Core/ZB.MOM.WW.OtOpcUa.Core.Abstractions/DriverTypeNames.cs`), guarded bidirectionally by `DriverTypeNamesGuardTests`.
+
+> ⚠️ **`DriverTypeRegistry` / `DriverTypeMetadata` are vestigial.** No production code constructs or reads them — the class is referenced only by its own unit tests. Its `AllowedNamespaceKinds` field was retired along with the v3 `Namespace` entity (`DriverTypeRegistry.cs:97`), and the `SystemPlatform` namespace kind no longer exists.
+>
+> **Stability tier** likewise does not come from that registry: it is the `DriverTier tier = DriverTier.A` parameter on `DriverFactoryRegistry.cs:46`, and **no factory in `src/Drivers/` passes a tier**, so every shipped driver runs Tier A. The Tier-C-only protections described in [docs/v2/driver-stability.md](../v2/driver-stability.md) — `MemoryRecycle` hard-breach kill (`MemoryRecycle.cs:54`) and `ScheduledRecycleScheduler` (`:43`) — are therefore dormant for every driver.

 ## Ground-truth driver list

 | Driver | Project path | Tier | Wire / library | Capabilities | Notable quirk |
 |--------|--------------|:----:|----------------|--------------|---------------|
 | [Galaxy](Galaxy.md) | `Driver.Galaxy` (+ `.Browser`, `.Contracts`) | A | gRPC to the external `mxaccessgw` gateway (the gateway owns MXAccess COM + the Galaxy Repository SQL reader) | IDriver, ITagDiscovery, IReadable, IWritable, ISubscribable, IAlarmSource, IRediscoverable, IHostConnectivityProbe | In-process .NET 10 driver — the COM bitness constraint lives in the gateway's x86 net48 worker, not here. PR 7.2 retired the legacy in-process `Galaxy.{Shared, Host, Proxy}` + named-pipe Windows service. Native MxAccess alarms work end-to-end |
-| [Modbus TCP](Modbus.md) | `Driver.Modbus` | A | NModbus-derived in-house client | IDriver, ITagDiscovery, IReadable, IWritable, ISubscribable, IHostConnectivityProbe, IPerCallHostResolver | Polled subscriptions via the shared `PollGroupEngine`. DL205 PLCs are covered by `AddressFormat=DL205` (octal V/X/Y/C/T/CT translation) — no separate driver |
+| [Modbus TCP / RTU-over-TCP](Modbus.md) | `Driver.Modbus` (+ `.Addressing`, `.Contracts`) | A | NModbus-derived in-house client; `Transport` selects MBAP (TCP) or RTU CRC-16 framing over a socket | IDriver, ITagDiscovery, IReadable, IWritable, ISubscribable, IHostConnectivityProbe, IPerCallHostResolver | Polled subscriptions via the shared `PollGroupEngine`. DL205 PLCs are covered by `AddressFormat=DL205` (octal V/X/Y/C/T/CT translation) — no separate driver. `Transport=RtuOverTcp` (`ModbusTransportMode`, default `Tcp`) targets serial→Ethernet gateways via `ModbusRtuOverTcpTransport` + `ModbusRtuFraming` + `ModbusCrc`, with `ModbusTransportDesyncException` carrying distinct CrcMismatch/UnitMismatch reasons; **direct-serial transport is descoped**. Merged `0f38f486` (#495) |
 | [Siemens S7](S7.md) | `Driver.S7` | A | [S7netplus](https://github.com/S7NetPlus/s7netplus) | IDriver, ITagDiscovery, IReadable, IWritable, ISubscribable, IHostConnectivityProbe | Single S7netplus `Plc` instance per PLC serialized with `SemaphoreSlim` — the S7 CPU's comm mailbox is scanned at most once per cycle, so parallel reads don't help |
 | [AB CIP](AbCip.md) | `Driver.AbCip` | A | libplctag CIP | IDriver, ITagDiscovery, IReadable, IWritable, ISubscribable, IHostConnectivityProbe, IPerCallHostResolver, IAlarmSource | ControlLogix / CompactLogix. Tag discovery uses the `@tags` walker to enumerate controller-scoped + program-scoped symbols; UDT member resolution via the UDT template reader |
 | [AB Legacy](AbLegacy.md) | `Driver.AbLegacy` | A | libplctag PCCC | IDriver, ITagDiscovery, IReadable, IWritable, ISubscribable, IHostConnectivityProbe, IPerCallHostResolver | SLC 500 / MicroLogix. File-based addressing (`N7:0`, `F8:0`) — no symbol table, tag list is user-authored in the config DB |
 | [TwinCAT](TwinCAT.md) | `Driver.TwinCAT` | B | Beckhoff `TwinCAT.Ads` (`TcAdsClient`) | IDriver, ITagDiscovery, IReadable, IWritable, ISubscribable, IHostConnectivityProbe, IPerCallHostResolver, IRediscoverable | The only native-notification driver outside Galaxy — ADS delivers `ValueChangedCallback` events the driver forwards straight to `ISubscribable.OnDataChange` without polling. Symbol tree uploaded via `SymbolLoaderFactory` |
 | [FOCAS](FOCAS.md) | `Driver.FOCAS` | A | Pure-managed `FocasWireClient` — FOCAS/2 Ethernet binary protocol on TCP:8193, inlined into the driver assembly | IDriver, ITagDiscovery, IReadable, IWritable, ISubscribable, IHostConnectivityProbe, IPerCallHostResolver, IAlarmSource | `IWritable` is implemented but read-only by design — `WriteAsync` returns `BadNotWritable` for every point. CNC-shaped data model (axes, spindle, PMC, macros, alarms) not a flat tag map. Previously Tier-C (Host + P/Invoke + shim DLL); retired in the 2026-04-24 migration when the managed wire client landed |
 | [OPC UA Client](OpcUaClient.md) | `Driver.OpcUaClient` | B | OPCFoundation `Opc.Ua.Client` | IDriver, ITagDiscovery, IReadable, IWritable, ISubscribable, IAlarmSource, IHistoryProvider, IHostConnectivityProbe | Gateway/aggregation driver — the only driver implementing driver-side `IHistoryProvider` (forwards HistoryRead to the upstream server). Opens a single `Session` against a remote OPC UA server and re-exposes its address space. Owns its own `ApplicationConfiguration` (distinct from `Client.Shared`) because it's always-on with keep-alive + `TransferSubscriptions` across SDK reconnect, not an interactive CLI |
+| [MQTT](Mqtt.md) | `Driver.Mqtt` (+ `.Browser`, `.Contracts`) | A | [MQTTnet 5](https://github.com/dotnet/MQTTnet) | IDriver, ITagDiscovery, IReadable, ISubscribable, IHostConnectivityProbe, IRediscoverable | **Push, not poll, and read-only** — the broker delivers PUBLISH frames the driver forwards straight to `ISubscribable.OnDataChange`; `IReadable` serves the last retained/received value from cache, and there is **no `IWritable`** (nothing publishes back). Subscriptions are indexed **by topic filter, not by topic**, so wildcard tags survive a reconnect. A rejected CONNACK throws `MqttConnectRejectedException`: unrecoverable codes → `Faulted` + supervisor stop, transient → retry. **Two modes:** `Plain` binds a tag to a concrete topic + JSON path; `SparkplugB` decodes vendored Eclipse-Tahu protobuf under one `spBv1.0/{groupId}/#` subscription and binds by the `group/edgeNode/device?/metric` tuple (birth/alias/seq-gap state machine, death→STALE, scoped rebirth NCMD). `IRediscoverable` fires on a DBIRTH but is **inert platform-side** — see [#507](https://gitea.dohertylan.com/dohertj2/lmxopcua/issues/507) |
+| [MTConnect](MTConnect.md) | `Driver.MTConnect` (+ `.Contracts`) | — | Hand-rolled `System.Xml.Linq` HTTP/XML client against a vendor-neutral MTConnect Agent (`/probe`, `/current`, `/sample`) — no TrakHound dependency (dropped; see the driver doc) | IDriver, ITagDiscovery, IReadable, ISubscribable, IHostConnectivityProbe, IRediscoverable | Read-only by design (no `IWritable`). Production data plane is entirely `ISubscribable`/`OnDataChange` — `IReadable` is CLI/test-only. Browse is free via the Wave-0 universal discovery browser, no bespoke browser project. `IRediscoverable`/`IHostConnectivityProbe` have no server-side consumer yet — a pre-existing fleet-wide gap, not MTConnect-specific |
+| **Sql** (no dedicated page — see [design](../plans/2026-07-15-sql-poll-driver-design.md)) | `Driver.Sql` (+ `.Browser`, `.Contracts`) | A | `Microsoft.Data.SqlClient` behind an `ISqlDialect` seam (`SqlServerDialect` shipped; Postgres/ODBC deferred) | IDriver, ITagDiscovery, IReadable, ISubscribable, IHostConnectivityProbe | Read-only DB-poll driver with a bespoke schema browser. **Credentials are never persisted** — the deploy gate rejects a stored `connectionString` (#498) and catalog identifiers are validated against the live catalog's own spelling (#496). `SupportsOnlineDiscovery => false` by design (the bespoke browser wins). `SqlTagModel.Query` is deferred to P3 and rejected end-to-end by parser, validator, planner and editor. Merged `4ad54037` |
+| **Calculation** (see [Raw.md](../Raw.md#the-calculation-driver)) | `Driver.Calculation` | A | none — computes from other tags' RawPaths | IDriver, IDependencyConsumer, ISubscribable, IReadable | **Pseudo-driver**, not a wire protocol: signal-level tags computed from other tags via a script, with deploy-time `scriptId`-existence + Tarjan cycle gates. Its probe is parse-only (no backend to reach). ⚠️ **No typed config form** — `DriverConfigModal` has no `Calculation` case, so `RunTimeout` is currently unauthorable through the AdminUI |
 | [Historian.Gateway](../Historian.md) | `Driver.Historian.Gateway` | — | `ZB.MOM.WW.HistorianGateway.Client` gRPC (`historian_gateway.v1`) | IHistorianDataSource (server-side read backend) + alarm `SendEvent` writer + `WriteLiveValues` recorder + `IHistorianProvisioning` | Not a tag driver — the sole historian backend. Registers `GatewayHistorianDataSource : IHistorianDataSource` for HistoryRead and serves alarm-write + continuous historization through the gateway. No `IDriver`/`ITagDiscovery` surface. (The retired Wonderware sidecar backend it replaced is documented at [Historian.Wonderware.md](Historian.Wonderware.md).) |

 ## Per-driver documentation
@@ -40,13 +48,18 @@ Driver type metadata is registered at startup in `DriverTypeRegistry` (`src/Core
 - **FOCAS** has a short getting-started doc because the backend-selection env var + alarm projection opt-in need explaining up front:
  - [FOCAS.md](FOCAS.md) — deployment, config, capability surface, alarm projection, troubleshooting

- **Modbus TCP**, **AB CIP**, **AB Legacy**, **Siemens S7**, **TwinCAT**, and **OPC UA Client** each have a per-driver overview page:
+- **Modbus TCP**, **AB CIP**, **AB Legacy**, **Siemens S7**, **TwinCAT**, **OPC UA Client**, and **MQTT** each have a per-driver overview page:
  - [Modbus.md](Modbus.md) — in-process Modbus-TCP driver: address formats, polled subscription model, DL205 octal mapping
  - [AbCip.md](AbCip.md) — AB CIP / EtherNet-IP driver (ControlLogix / CompactLogix / Micro800 / GuardLogix): tag discovery, UDT resolution, alarm source
  - [AbLegacy.md](AbLegacy.md) — AB Legacy PCCC driver (SLC 500 / MicroLogix / PLC-5): file-based addressing, user-authored tag list
  - [S7.md](S7.md) — Siemens S7 driver (S7-300/400/1200/1500 + S7-200): getting started, config, data-block addressing, serialized single-connection model
  - [TwinCAT.md](TwinCAT.md) — Beckhoff TwinCAT (ADS) driver: getting started, native-notification subscription, symbol-tree upload
  - [OpcUaClient.md](OpcUaClient.md) — OPC UA Client (gateway/aggregation) driver: remote-server session, driver-side HistoryRead forwarding, reconnect behaviour
+  - [Mqtt.md](Mqtt.md) — MQTT broker-subscribe driver: broker/TLS/auth config, topic + JSON-path tag binding, retained-value seeding, `#`-observation browser, CONNACK-rejection semantics, **Sparkplug B** (birth/alias/seq/rebirth state machine, birth-driven browse picker, death→STALE), and the **Known gaps** table
+
+- **MTConnect** has a short getting-started doc because the hand-rolled-vs-TrakHound divergence, the
+  data-plane precedence rules, and a non-trivial known-limitations list need explaining up front:
+  - [MTConnect.md](MTConnect.md) — Agent config, `FullName`==DataItem `id`, `UNAVAILABLE`→`BadNoCommunication`, CONDITION-as-`String`, browse-via-universal-browser, fixture recipe, deferred write-back

 - **Historian.Gateway** (server-side historian backend, not a tag driver) is documented in the main guide:
  - [../Historian.md](../Historian.md) — HistorianGateway backend: read-path registration, HistoryRead dispatch, alarm store-and-forward (`SendEvent`), continuous historization (`WriteLiveValues`), `EnsureTags` provisioning, config keys, deployment prerequisites. (The retired Wonderware sidecar backend it replaced: [Historian.Wonderware.md](Historian.Wonderware.md).)
@@ -64,12 +77,14 @@ Each driver has a dedicated fixture doc that lays out what the integration / uni
 - [TwinCAT](TwinCAT-Test-Fixture.md) — XAR-VM integration scaffolding (task #221); three smoke tests skip when VM unreachable. Unit via `FakeTwinCATClient` with native-notification harness
 - [FOCAS](FOCAS-Test-Fixture.md) — no integration fixture, unit-only via `FakeFocasClient`; Tier C out-of-process isolation scoped but not shipped
 - [OPC UA Client](OpcUaClient-Test-Fixture.md) — Dockerized `opc-plc` integration suite (task #215): real Secure Channel + Session, read + subscribe verified end-to-end; write not yet exercised in the integration suite; exhaustive capability matrix (reconnect, failover, cert-auth, history, alarms) via unit suite with mocked `Session`
+- [MQTT](Mqtt-Test-Fixture.md) — Dockerized `eclipse-mosquitto` with **TLS + real auth on both listeners (no anonymous fallback)** + a JSON-publisher sidecar; env-gated live suite (**15 tests**) — 7 plain (TLS/auth connect, CA pinning both ways, subscribe→value, retained seeding, wrong-password rejection) + 8 Sparkplug against a **project-owned C# edge-node simulator** on the `sparkplug` compose profile (birth→alias bind, DDATA, NDEATH→STALE, rebirth NCMD round-trip). Births are never retained, so `docker restart otopcua-sparkplug-sim` is how you force a fresh one
 - [Galaxy](../v1/drivers/Galaxy-Test-Fixture.md) — richest harness: gateway E2E + ZB SQL live-smoke + MXAccess opt-in (v1 archive)
+- [MTConnect](../../tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.MTConnect.IntegrationTests/Docker/README.md) — Dockerized `mtconnect/agent` + stdlib SHDR adapter (two services, the Agent alone reports everything `UNAVAILABLE`); 12/12 against the real Agent, canned XML unit fixtures cover the bulk (491/491)

 ## Related cross-driver docs

 - [HistoricalDataAccess.md](../v1/HistoricalDataAccess.md) — `IHistoryProvider` dispatch, aggregate mapping, continuation points. The OPC UA Client driver is the only driver that implements driver-side `IHistoryProvider` (it forwards HistoryRead to the upstream server); the AVEVA Historian path is served server-side by the HistorianGateway-backed `IHistorianDataSource` instead. Other drivers do not implement the interface and return `BadHistoryOperationUnsupported`.
- [AlarmTracking.md](../AlarmTracking.md) — `IAlarmSource` event model and filtering. Implemented by Galaxy (native MxAccess alarms, working end-to-end), OPC UA Client, AB CIP, and FOCAS; AB Legacy, Modbus, S7, and TwinCAT have no alarm source.
+- [AlarmTracking.md](../AlarmTracking.md) — `IAlarmSource` event model and filtering. Implemented by Galaxy (native MxAccess alarms, working end-to-end), OPC UA Client, AB CIP, and FOCAS; AB Legacy, Modbus, S7, TwinCAT, and MQTT have no alarm source.
 - [Subscriptions.md](../v1/Subscriptions.md) — how the Server multiplexes subscriptions onto `ISubscribable.OnDataChange`.
 - [docs/v2/driver-stability.md](../v2/driver-stability.md) — tier system (A / B / C), shared `CapabilityPolicy` defaults per tier × capability, `MemoryTracking` hybrid formula, and process-level recycle rules.
 - [docs/v2/plan.md](../v2/plan.md) — authoritative vision, architecture decisions, migration strategy.
@@ -49,6 +49,7 @@ with a human-readable explanation rather than a false-green TCP-open tick.
 | **TwinCAT** | `AdsClient.Connect` + `ReadStateAsync`. See [degrade semantics](#twincat-degrade) below. | `"ADS state: {state}"` | Deferred — no ADS target |
 | **FOCAS** | `cnc_allclibhndl3` via a direct `DllImport("fwlib32")` in the probe. See [degrade semantics](#focas-degrade) below. | `"FOCAS handle OK"` | Deferred — no CNC + FWLIB |
 | **Galaxy** | gRPC unary call to `GalaxyRepository.TestConnection` on the configured mxaccessgw endpoint. See [auth-rejection rule](#galaxy-auth-rejection) below. | `"gateway gRPC OK"` | `http://10.100.0.48:5120` (mxaccessgw) |
+| **MQTT** | One MQTT `CONNECT` (no SUBSCRIBE, no publish) under a `-probe-`-suffixed client id, then disconnect. **A rejected CONNACK is a returned result code, not an exception** — MQTTnet 5 does not throw — so the probe inspects `ResultCode` and reuses the driver's own `DescribeConnackRejection`, making the button and the running driver word a rejection identically. | `"MQTT CONNECT OK"` | `10.100.0.35:8883` (Mosquitto TLS+auth fixture) |

 **Historian.Wonderware** had a TCP `Hello`→`HelloAck` handshake probe before Phase 5, but the
 Wonderware historian backend (and its driver-type / probe) has since been **retired** — the historian
@@ -133,6 +134,7 @@ above. (Live verification on `10.100.0.48:5120` with no key returns
 | S7 | Verified | python-snap7 `10.100.0.35:1102` |
 | AbCip | Verified | CIP sim `10.100.0.35:44818` |
 | Galaxy | Verified | mxaccessgw `10.100.0.48:5120`; `Unauthenticated` reply counts as Ok |
+| MQTT | Verified | Mosquitto `10.100.0.35:8883`; live suite covers TLS+auth Ok, foreign-CA rejection, and wrong-password rejection surfacing rather than reporting healthy |
 | AbLegacy | Deferred | No PLC5/SLC sim; unit-proven + code path identical to AbCip |
 | TwinCAT | Deferred | No ADS target; unit-proven + degrade guard tested |
 | FOCAS | Deferred | No CNC + FWLIB on dev host; degrade guard is the CI-observable path |
@@ -92,7 +92,7 @@ discovery.
 | `ISubscribable` | native ADS notifications (default), poll fallback | `UseNativeNotifications=true` registers device notifications so the PLC pushes changes; `false` uses the shared `PollGroupEngine` |
 | `IHostConnectivityProbe` | per-device probe loop | One `HostConnectivityStatus` per configured device; `Running`/`Stopped` transitions raise `OnHostStatusChanged` |
 | `IPerCallHostResolver` | `ResolveHost` lookup in the tag map | Routes each call to the device of the referenced tag; returns an empty-string sentinel when unresolved |
-| `IRediscoverable` | symbol-version-changed callback | A PLC re-download fires `OnRediscoveryNeeded` so the address space is rebuilt |
+| `IRediscoverable` | symbol-version-changed callback | A PLC re-download fires `OnRediscoveryNeeded`. ⚠️ **No consumer wires it today** ([#518](https://gitea.dohertylan.com/dohertj2/lmxopcua/issues/518), [#507](https://gitea.dohertylan.com/dohertj2/lmxopcua/issues/507)) — the address space does **not** rebuild; a config redeploy is required. Driver-side behaviour is log-observable only |

 ### Rediscovery on PLC re-download

@@ -100,8 +100,15 @@ discovery.
 `DeviceSymbolVersionInvalid` (1809 / 0x0711) — the documented TwinCAT
 symbol-version-changed signal, raised when a PLC program is re-downloaded —
 every symbol and notification handle is invalidated. The driver raises
-`OnRediscoveryNeeded` with a `TwinCAT` scope hint so Core rebuilds the address
-space rather than treating it as a transient connection error.
+`OnRediscoveryNeeded` with a `TwinCAT` scope hint, so that the signal is treated
+as an address-space change rather than a transient connection error.
+
+⚠️ **That is the intended design, not present behaviour.** No consumer subscribes
+to `OnRediscoveryNeeded` anywhere in `src/`, and the scope hint is read by nothing
+([#518](https://gitea.dohertylan.com/dohertj2/lmxopcua/issues/518),
+[#507](https://gitea.dohertylan.com/dohertj2/lmxopcua/issues/507)). Today the
+signal is observable only in the driver log; after a PLC re-download the served
+address space changes only on a config redeploy.

 ### Native notifications

@@ -148,7 +155,7 @@ fixture is down during normal dev.
 **Live-verify** — integration-fixture-gated (requires the TwinCAT Docker fixture / AMS router).

 **Deferrals** — array *writes* (`ADS WriteValueAsync` for an array), multi-dimensional
-arrays, per-element historization.  `IRediscoverable` still fires and rebuilds array nodes
+arrays, per-element historization.  `IRediscoverable` fires and now surfaces a `/hosts` re-browse prompt, but still does not rebuild the address space (#518)
 on PLC re-download (unchanged semantics from scalar nodes).

 See [Uns.md §Array tags](../Uns.md#array-tags-1-d) for the cross-driver coverage matrix
@@ -1,18 +1,116 @@
 {
  "planPath": "docs/plans/2026-06-12-historian-tcp-transport.md",
  "tasks": [
-    {"id": 0, "nativeTaskId": 296, "subject": "Task 0: Create feature branch", "status": "pending"},
-    {"id": 1, "nativeTaskId": 297, "subject": "Task 1: Add TCP/TLS fields to client options", "status": "pending", "blockedBy": [0]},
-    {"id": 2, "nativeTaskId": 298, "subject": "Task 2: Client TCP connect factory + FrameChannel rename", "status": "pending", "blockedBy": [1]},
-    {"id": 3, "nativeTaskId": 299, "subject": "Task 3: Switch client default ctor to TCP", "status": "pending", "blockedBy": [2]},
-    {"id": 4, "nativeTaskId": 300, "subject": "Task 4: Host config binding (Host/Port/TLS)", "status": "pending", "blockedBy": [1]},
-    {"id": 5, "nativeTaskId": 301, "subject": "Task 5: Sidecar TcpFrameServer", "status": "pending", "blockedBy": [0]},
-    {"id": 6, "nativeTaskId": 302, "subject": "Task 6: Sidecar Program.cs — TCP bootstrap + env", "status": "pending", "blockedBy": [5]},
-    {"id": 7, "nativeTaskId": 303, "subject": "Task 7: Remove dead pipe code + finalize options shape", "status": "pending", "blockedBy": [3, 4, 6]},
-    {"id": 8, "nativeTaskId": 304, "subject": "Task 8: Deploy scripts — env block + firewall + cert", "status": "pending", "blockedBy": [7]},
-    {"id": 9, "nativeTaskId": 305, "subject": "Task 9: AdminUI Test-Connect probe to host/port/TLS", "status": "pending", "blockedBy": [7]},
-    {"id": 10, "nativeTaskId": 306, "subject": "Task 10: Docs — TCP transport", "status": "pending", "blockedBy": [7]},
-    {"id": 11, "nativeTaskId": 307, "subject": "Task 11: Verification (build + test + live)", "status": "pending", "blockedBy": [8, 9, 10]}
+    {
+      "id": 0,
+      "nativeTaskId": 296,
+      "subject": "Task 0: Create feature branch",
+      "status": "completed"
+    },
+    {
+      "id": 1,
+      "nativeTaskId": 297,
+      "subject": "Task 1: Add TCP/TLS fields to client options",
+      "status": "completed",
+      "blockedBy": [
+        0
+      ]
+    },
+    {
+      "id": 2,
+      "nativeTaskId": 298,
+      "subject": "Task 2: Client TCP connect factory + FrameChannel rename",
+      "status": "completed",
+      "blockedBy": [
+        1
+      ]
+    },
+    {
+      "id": 3,
+      "nativeTaskId": 299,
+      "subject": "Task 3: Switch client default ctor to TCP",
+      "status": "completed",
+      "blockedBy": [
+        2
+      ]
+    },
+    {
+      "id": 4,
+      "nativeTaskId": 300,
+      "subject": "Task 4: Host config binding (Host/Port/TLS)",
+      "status": "completed",
+      "blockedBy": [
+        1
+      ]
+    },
+    {
+      "id": 5,
+      "nativeTaskId": 301,
+      "subject": "Task 5: Sidecar TcpFrameServer",
+      "status": "completed",
+      "blockedBy": [
+        0
+      ]
+    },
+    {
+      "id": 6,
+      "nativeTaskId": 302,
+      "subject": "Task 6: Sidecar Program.cs \u2014 TCP bootstrap + env",
+      "status": "completed",
+      "blockedBy": [
+        5
+      ]
+    },
+    {
+      "id": 7,
+      "nativeTaskId": 303,
+      "subject": "Task 7: Remove dead pipe code + finalize options shape",
+      "status": "completed",
+      "blockedBy": [
+        3,
+        4,
+        6
+      ]
+    },
+    {
+      "id": 8,
+      "nativeTaskId": 304,
+      "subject": "Task 8: Deploy scripts \u2014 env block + firewall + cert",
+      "status": "completed",
+      "blockedBy": [
+        7
+      ]
+    },
+    {
+      "id": 9,
+      "nativeTaskId": 305,
+      "subject": "Task 9: AdminUI Test-Connect probe to host/port/TLS",
+      "status": "completed",
+      "blockedBy": [
+        7
+      ]
+    },
+    {
+      "id": 10,
+      "nativeTaskId": 306,
+      "subject": "Task 10: Docs \u2014 TCP transport",
+      "status": "completed",
+      "blockedBy": [
+        7
+      ]
+    },
+    {
+      "id": 11,
+      "nativeTaskId": 307,
+      "subject": "Task 11: Verification (build + test + live)",
+      "status": "completed",
+      "blockedBy": [
+        8,
+        9,
+        10
+      ]
+    }
  ],
-  "lastUpdated": "2026-06-12"
+  "lastUpdated": "2026-07-27",
+  "closureNote": "OBSOLETE \u2014 targets the bespoke Wonderware TCP/ArchestrA historian sidecar, retired when HistorianGateway became the sole historian backend. There is no Wonderware backend in the tree. Closed as obsolete 2026-07-27 (deferment.md \u00a78.5)."
 }
@@ -1,18 +1,111 @@
 {
  "planPath": "docs/plans/2026-06-15-stillpending-phase-0-1.md",
  "tasks": [
-    {"id": 402, "subject": "SP Task 0: Feature branch feat/stillpending-phase-0-1", "status": "pending"},
-    {"id": 403, "subject": "SP Task 1: Phase 0 — correct 7 stale code comments", "status": "pending", "blockedBy": [402]},
-    {"id": 404, "subject": "SP Task 2: Phase 0 — fix docs/security.md + benign-residue comments", "status": "pending", "blockedBy": [402]},
-    {"id": 405, "subject": "SP Task 3: Phase 0 — mark shipped .tasks.json completed", "status": "pending", "blockedBy": [402]},
-    {"id": 406, "subject": "SP Task 4: Phase 1 H1a — Phase7Applier rebuilds on Changed*", "status": "pending", "blockedBy": [402]},
-    {"id": 407, "subject": "SP Task 5: Phase 1 H1b — VirtualTagHostActor respawns changed child", "status": "pending", "blockedBy": [402]},
-    {"id": 408, "subject": "SP Task 6: Phase 1 H5a — EquipmentVirtualTagPlan.Historize + composer", "status": "pending", "blockedBy": [402]},
-    {"id": 409, "subject": "SP Task 7: Phase 1 H5b — DeploymentArtifact decodes Historize (byte-parity)", "status": "pending", "blockedBy": [408]},
-    {"id": 410, "subject": "SP Task 8: Phase 1 H5c — VirtualTagHostActor invokes IHistoryWriter", "status": "pending", "blockedBy": [407, 409]},
-    {"id": 411, "subject": "SP Task 9: Phase 1 H5d — thread IHistoryWriter through DriverHostActor + DI", "status": "pending", "blockedBy": [410, 403]},
-    {"id": 412, "subject": "SP Task 10: Phase 1 — docs + follow-up bookkeeping", "status": "pending", "blockedBy": [411]},
-    {"id": 413, "subject": "SP Task 11: Phase 0+1 — full build + test + integration review", "status": "pending", "blockedBy": [403, 404, 405, 406, 407, 408, 409, 410, 411, 412]}
+    {
+      "id": 402,
+      "subject": "SP Task 0: Feature branch feat/stillpending-phase-0-1",
+      "status": "completed"
+    },
+    {
+      "id": 403,
+      "subject": "SP Task 1: Phase 0 \u2014 correct 7 stale code comments",
+      "status": "completed",
+      "blockedBy": [
+        402
+      ]
+    },
+    {
+      "id": 404,
+      "subject": "SP Task 2: Phase 0 \u2014 fix docs/security.md + benign-residue comments",
+      "status": "completed",
+      "blockedBy": [
+        402
+      ]
+    },
+    {
+      "id": 405,
+      "subject": "SP Task 3: Phase 0 \u2014 mark shipped .tasks.json completed",
+      "status": "completed",
+      "blockedBy": [
+        402
+      ]
+    },
+    {
+      "id": 406,
+      "subject": "SP Task 4: Phase 1 H1a \u2014 Phase7Applier rebuilds on Changed*",
+      "status": "completed",
+      "blockedBy": [
+        402
+      ]
+    },
+    {
+      "id": 407,
+      "subject": "SP Task 5: Phase 1 H1b \u2014 VirtualTagHostActor respawns changed child",
+      "status": "completed",
+      "blockedBy": [
+        402
+      ]
+    },
+    {
+      "id": 408,
+      "subject": "SP Task 6: Phase 1 H5a \u2014 EquipmentVirtualTagPlan.Historize + composer",
+      "status": "completed",
+      "blockedBy": [
+        402
+      ]
+    },
+    {
+      "id": 409,
+      "subject": "SP Task 7: Phase 1 H5b \u2014 DeploymentArtifact decodes Historize (byte-parity)",
+      "status": "completed",
+      "blockedBy": [
+        408
+      ]
+    },
+    {
+      "id": 410,
+      "subject": "SP Task 8: Phase 1 H5c \u2014 VirtualTagHostActor invokes IHistoryWriter",
+      "status": "completed",
+      "blockedBy": [
+        407,
+        409
+      ]
+    },
+    {
+      "id": 411,
+      "subject": "SP Task 9: Phase 1 H5d \u2014 thread IHistoryWriter through DriverHostActor + DI",
+      "status": "completed",
+      "blockedBy": [
+        410,
+        403
+      ]
+    },
+    {
+      "id": 412,
+      "subject": "SP Task 10: Phase 1 \u2014 docs + follow-up bookkeeping",
+      "status": "completed",
+      "blockedBy": [
+        411
+      ]
+    },
+    {
+      "id": 413,
+      "subject": "SP Task 11: Phase 0+1 \u2014 full build + test + integration review",
+      "status": "completed",
+      "blockedBy": [
+        403,
+        404,
+        405,
+        406,
+        407,
+        408,
+        409,
+        410,
+        411,
+        412
+      ]
+    }
  ],
-  "lastUpdated": "2026-06-15"
+  "lastUpdated": "2026-07-27",
+  "closureNote": "Shipped \u2014 the stillpending backlog audit cites the landing commits (1e95856b, ada01e1a, fc8121cb, 3e609a2b, 70e6d3d2, c236263e, bd8fee61, 5e27b5f7, fcb38014). Marked complete 2026-07-27 (deferment.md \u00a78.5)."
 }
@@ -2,15 +2,72 @@
  "planPath": "docs/plans/2026-06-15-stillpending-phase-2-servicelevel.md",
  "branch": "feat/stillpending-phase-2-servicelevel",
  "tasks": [
-    {"id": 414, "subject": "P2 Task 1: Move ServiceLevelCalculator to Core.Cluster", "status": "pending"},
-    {"id": 415, "subject": "P2 Task 2a: OpcUaPublishActor calculator path (DB+stale+leader+Detached guard, legacy seam)", "status": "pending", "blockedBy": [414]},
-    {"id": 416, "subject": "P2 Task 2b: OpcUaProbeOk from peer-probes-me (freshness + debounce)", "status": "pending", "blockedBy": [415]},
-    {"id": 417, "subject": "P2 Task 3: HealthTick — periodic DB Ask/PipeTo + PreStart immediate refresh", "status": "pending", "blockedBy": [416]},
-    {"id": 418, "subject": "P2 Task 4: PeerProbeSupervisor — one peer probe per driver peer", "status": "pending"},
-    {"id": 419, "subject": "P2 Task 5: Wire WithOtOpcUaRuntimeActors (dbHealth ref + spawn supervisor)", "status": "pending", "blockedBy": [417, 418]},
-    {"id": 420, "subject": "P2 Task 6: docs/Redundancy.md — calculator is WIRED", "status": "pending"},
-    {"id": 421, "subject": "P2 Task 7: Full build + test + final integration review", "status": "pending", "blockedBy": [419, 420]},
-    {"id": 422, "subject": "P2 Task 8: Live /run on the 2-node rig (acceptance gate)", "status": "pending", "blockedBy": [421]}
+    {
+      "id": 414,
+      "subject": "P2 Task 1: Move ServiceLevelCalculator to Core.Cluster",
+      "status": "completed"
+    },
+    {
+      "id": 415,
+      "subject": "P2 Task 2a: OpcUaPublishActor calculator path (DB+stale+leader+Detached guard, legacy seam)",
+      "status": "completed",
+      "blockedBy": [
+        414
+      ]
+    },
+    {
+      "id": 416,
+      "subject": "P2 Task 2b: OpcUaProbeOk from peer-probes-me (freshness + debounce)",
+      "status": "completed",
+      "blockedBy": [
+        415
+      ]
+    },
+    {
+      "id": 417,
+      "subject": "P2 Task 3: HealthTick \u2014 periodic DB Ask/PipeTo + PreStart immediate refresh",
+      "status": "completed",
+      "blockedBy": [
+        416
+      ]
+    },
+    {
+      "id": 418,
+      "subject": "P2 Task 4: PeerProbeSupervisor \u2014 one peer probe per driver peer",
+      "status": "completed"
+    },
+    {
+      "id": 419,
+      "subject": "P2 Task 5: Wire WithOtOpcUaRuntimeActors (dbHealth ref + spawn supervisor)",
+      "status": "completed",
+      "blockedBy": [
+        417,
+        418
+      ]
+    },
+    {
+      "id": 420,
+      "subject": "P2 Task 6: docs/Redundancy.md \u2014 calculator is WIRED",
+      "status": "completed"
+    },
+    {
+      "id": 421,
+      "subject": "P2 Task 7: Full build + test + final integration review",
+      "status": "completed",
+      "blockedBy": [
+        419,
+        420
+      ]
+    },
+    {
+      "id": 422,
+      "subject": "P2 Task 8: Live /run on the 2-node rig (acceptance gate)",
+      "status": "completed",
+      "blockedBy": [
+        421
+      ]
+    }
  ],
-  "lastUpdated": "2026-06-15"
+  "lastUpdated": "2026-07-27",
+  "closureNote": "Shipped \u2014 the stillpending backlog audit cites the landing commits (1e95856b, ada01e1a, fc8121cb, 3e609a2b, 70e6d3d2, c236263e, bd8fee61, 5e27b5f7, fcb38014). Marked complete 2026-07-27 (deferment.md \u00a78.5)."
 }
@@ -2,16 +2,80 @@
  "planPath": "docs/plans/2026-06-15-stillpending-phase-3-opcua-standards.md",
  "branch": "feat/stillpending-phase-3-opcua-standards",
  "tasks": [
-    {"id": 423, "subject": "P3 Task 1: H2-bit — NodePermissions.HistoryUpdate + evaluator mapping", "status": "pending"},
-    {"id": 424, "subject": "P3 Task 2: H6a — mark native conditions (isNative through the sink)", "status": "pending"},
-    {"id": 425, "subject": "P3 Task 3: H4 — wire OnEnableDisable over OPC UA", "status": "pending", "blockedBy": [424]},
-    {"id": 426, "subject": "P3 Task 4: H6b — AlarmAcknowledgeRequest.OperatorUser + Galaxy/ScriptedAlarmSource", "status": "pending"},
-    {"id": 427, "subject": "P3 Task 5: H6c — NativeAlarmAckRouter seam + native OnAcknowledge routing", "status": "pending", "blockedBy": [424]},
-    {"id": 428, "subject": "P3 Task 6: H6d — DriverHostActor inverse map + native-ack route to driver", "status": "pending", "blockedBy": [426, 427]},
-    {"id": 429, "subject": "P3 Task 7: H6e — wire NativeAlarmAckRouter in host DI", "status": "pending", "blockedBy": [427, 428]},
-    {"id": 430, "subject": "P3 Task 8: Docs — Enable/Disable + native-ack→AVEVA + HistoryUpdate bit", "status": "pending"},
-    {"id": 431, "subject": "P3 Task 9: Full build + test + final integration review", "status": "pending", "blockedBy": [423, 425, 429, 430]},
-    {"id": 432, "subject": "P3 Task 10: Live /run — H4 Enable/Disable + H6 native-ack route", "status": "pending", "blockedBy": [431]}
+    {
+      "id": 423,
+      "subject": "P3 Task 1: H2-bit \u2014 NodePermissions.HistoryUpdate + evaluator mapping",
+      "status": "completed"
+    },
+    {
+      "id": 424,
+      "subject": "P3 Task 2: H6a \u2014 mark native conditions (isNative through the sink)",
+      "status": "completed"
+    },
+    {
+      "id": 425,
+      "subject": "P3 Task 3: H4 \u2014 wire OnEnableDisable over OPC UA",
+      "status": "completed",
+      "blockedBy": [
+        424
+      ]
+    },
+    {
+      "id": 426,
+      "subject": "P3 Task 4: H6b \u2014 AlarmAcknowledgeRequest.OperatorUser + Galaxy/ScriptedAlarmSource",
+      "status": "completed"
+    },
+    {
+      "id": 427,
+      "subject": "P3 Task 5: H6c \u2014 NativeAlarmAckRouter seam + native OnAcknowledge routing",
+      "status": "completed",
+      "blockedBy": [
+        424
+      ]
+    },
+    {
+      "id": 428,
+      "subject": "P3 Task 6: H6d \u2014 DriverHostActor inverse map + native-ack route to driver",
+      "status": "completed",
+      "blockedBy": [
+        426,
+        427
+      ]
+    },
+    {
+      "id": 429,
+      "subject": "P3 Task 7: H6e \u2014 wire NativeAlarmAckRouter in host DI",
+      "status": "completed",
+      "blockedBy": [
+        427,
+        428
+      ]
+    },
+    {
+      "id": 430,
+      "subject": "P3 Task 8: Docs \u2014 Enable/Disable + native-ack\u2192AVEVA + HistoryUpdate bit",
+      "status": "completed"
+    },
+    {
+      "id": 431,
+      "subject": "P3 Task 9: Full build + test + final integration review",
+      "status": "completed",
+      "blockedBy": [
+        423,
+        425,
+        429,
+        430
+      ]
+    },
+    {
+      "id": 432,
+      "subject": "P3 Task 10: Live /run \u2014 H4 Enable/Disable + H6 native-ack route",
+      "status": "completed",
+      "blockedBy": [
+        431
+      ]
+    }
  ],
-  "lastUpdated": "2026-06-15"
+  "lastUpdated": "2026-07-27",
+  "closureNote": "Shipped \u2014 the stillpending backlog audit cites the landing commits (1e95856b, ada01e1a, fc8121cb, 3e609a2b, 70e6d3d2, c236263e, bd8fee61, 5e27b5f7, fcb38014). Marked complete 2026-07-27 (deferment.md \u00a78.5)."
 }
@@ -2,14 +2,68 @@
  "planPath": "docs/plans/2026-06-16-stillpending-phase-4-driver-datatypes.md",
  "branch": "feat/stillpending-phase-4-driver-datatypes",
  "tasks": [
-    {"id": 433, "subject": "P4 Task 1: Modbus Int64/UInt64 node DataType (MapDataType split)", "status": "pending"},
-    {"id": 434, "subject": "P4 Task 2: FOCAS fail-fast factory (EnsureUsable at init)", "status": "pending"},
-    {"id": 435, "subject": "P4 Task 3: FOCAS position scaling (PositionDecimalPlaces)", "status": "pending", "blockedBy": [434]},
-    {"id": 436, "subject": "P4 Task 4: Historian Total aggregate (client-side Average x interval-seconds)", "status": "pending"},
-    {"id": 437, "subject": "P4 Task 5: Historian poison-event dead-letter cap (maxAttempts)", "status": "pending"},
-    {"id": 438, "subject": "P4 Task 6: Docs + bookkeeping", "status": "pending", "blockedBy": [433, 434, 435, 436, 437]},
-    {"id": 439, "subject": "P4 Task 7: Full build + test + final integration review", "status": "pending", "blockedBy": [433, 434, 435, 436, 437, 438]},
-    {"id": 440, "subject": "P4 Task 8: Live /run — Modbus Int64 (acceptance gate)", "status": "pending", "blockedBy": [439]}
+    {
+      "id": 433,
+      "subject": "P4 Task 1: Modbus Int64/UInt64 node DataType (MapDataType split)",
+      "status": "completed"
+    },
+    {
+      "id": 434,
+      "subject": "P4 Task 2: FOCAS fail-fast factory (EnsureUsable at init)",
+      "status": "completed"
+    },
+    {
+      "id": 435,
+      "subject": "P4 Task 3: FOCAS position scaling (PositionDecimalPlaces)",
+      "status": "completed",
+      "blockedBy": [
+        434
+      ]
+    },
+    {
+      "id": 436,
+      "subject": "P4 Task 4: Historian Total aggregate (client-side Average x interval-seconds)",
+      "status": "completed"
+    },
+    {
+      "id": 437,
+      "subject": "P4 Task 5: Historian poison-event dead-letter cap (maxAttempts)",
+      "status": "completed"
+    },
+    {
+      "id": 438,
+      "subject": "P4 Task 6: Docs + bookkeeping",
+      "status": "completed",
+      "blockedBy": [
+        433,
+        434,
+        435,
+        436,
+        437
+      ]
+    },
+    {
+      "id": 439,
+      "subject": "P4 Task 7: Full build + test + final integration review",
+      "status": "completed",
+      "blockedBy": [
+        433,
+        434,
+        435,
+        436,
+        437,
+        438
+      ]
+    },
+    {
+      "id": 440,
+      "subject": "P4 Task 8: Live /run \u2014 Modbus Int64 (acceptance gate)",
+      "status": "completed",
+      "blockedBy": [
+        439
+      ]
+    }
  ],
-  "lastUpdated": "2026-06-16"
+  "lastUpdated": "2026-07-27",
+  "closureNote": "Shipped \u2014 the stillpending backlog audit cites the landing commits (1e95856b, ada01e1a, fc8121cb, 3e609a2b, 70e6d3d2, c236263e, bd8fee61, 5e27b5f7, fcb38014). Marked complete 2026-07-27 (deferment.md \u00a78.5)."
 }
@@ -4,16 +4,61 @@
  "designCommit": "f90017bc",
  "baseMaster": "c081917a",
  "branch": "feat/stillpending-phase-4b-driver-gaps (merged to master 08a65513, deleted)",
-  "executionState": "COMPLETE — shipped + pushed to master 08a65513 (ff). Final integration review = SHIP. Build clean; AdminUI 450, Galaxy 279(+3 skip), FOCAS 200, Modbus 277, DriverProbeRegistration 2 — all green. Live: Modbus typed editor + Build-address proven on the rig's seeded MAIN-modbus-eq (Modbus reconcile, conclusive); Galaxy browse rendered a nested hierarchical root via the real driver path (corroborated, unit-proven 8 ways); FOCAS unit-proven (no CNC).",
-  "nativeTaskIds": {"1": 482, "2": 483, "3a": 484, "3b": 485, "4": 486, "5": 487, "6": 488},
+  "executionState": "COMPLETE \u2014 shipped + pushed to master 08a65513 (ff). Final integration review = SHIP. Build clean; AdminUI 450, Galaxy 279(+3 skip), FOCAS 200, Modbus 277, DriverProbeRegistration 2 \u2014 all green. Live: Modbus typed editor + Build-address proven on the rig's seeded MAIN-modbus-eq (Modbus reconcile, conclusive); Galaxy browse rendered a nested hierarchical root via the real driver path (corroborated, unit-proven 8 ways); FOCAS unit-proven (no CNC).",
+  "nativeTaskIds": {
+    "1": 482,
+    "2": 483,
+    "3a": 484,
+    "3b": 485,
+    "4": 486,
+    "5": 487,
+    "6": 488
+  },
  "tasks": [
-    {"id": 1, "subject": "Task 1: Modbus driver-type-string reconcile (canonicalize on \"Modbus\")", "status": "completed", "commit": "8b4675b1", "reviewFixCommit": "a40c77de"},
-    {"id": 2, "subject": "Task 2: Galaxy nested gobject hierarchy", "status": "completed", "commit": "21c7645d", "reviewFixCommit": "bec37848"},
-    {"id": "3a", "subject": "Task 3a: IFocasClient.GetPositionFiguresAsync (cnc_getfigure binding)", "status": "completed", "commit": "3fcbc70c"},
-    {"id": "3b", "subject": "Task 3b: FOCAS driver auto-scale wiring (auto wins, manual fallback)", "status": "completed", "commit": "6855be28"},
-    {"id": 4, "subject": "Task 4: Docs + bookkeeping", "status": "completed", "commit": "08a65513"},
-    {"id": 5, "subject": "Task 5: Full build + test + final integration review", "status": "completed", "note": "final integration review = SHIP (no Critical/Important); 3 Minor non-blocking notes recorded"},
-    {"id": 6, "subject": "Task 6: Live /run verification", "status": "completed", "note": "Modbus typed editor live-proven on rig; Galaxy nested root corroborated; FOCAS unit-proven"}
+    {
+      "id": 1,
+      "subject": "Task 1: Modbus driver-type-string reconcile (canonicalize on \"Modbus\")",
+      "status": "completed",
+      "commit": "8b4675b1",
+      "reviewFixCommit": "a40c77de"
+    },
+    {
+      "id": 2,
+      "subject": "Task 2: Galaxy nested gobject hierarchy",
+      "status": "completed",
+      "commit": "21c7645d",
+      "reviewFixCommit": "bec37848"
+    },
+    {
+      "id": "3a",
+      "subject": "Task 3a: IFocasClient.GetPositionFiguresAsync (cnc_getfigure binding)",
+      "status": "completed",
+      "commit": "3fcbc70c"
+    },
+    {
+      "id": "3b",
+      "subject": "Task 3b: FOCAS driver auto-scale wiring (auto wins, manual fallback)",
+      "status": "completed",
+      "commit": "6855be28"
+    },
+    {
+      "id": 4,
+      "subject": "Task 4: Docs + bookkeeping",
+      "status": "completed",
+      "commit": "08a65513"
+    },
+    {
+      "id": 5,
+      "subject": "Task 5: Full build + test + final integration review",
+      "status": "completed",
+      "note": "final integration review = SHIP (no Critical/Important); 3 Minor non-blocking notes recorded"
+    },
+    {
+      "id": 6,
+      "subject": "Task 6: Live /run verification",
+      "status": "completed",
+      "note": "Modbus typed editor live-proven on rig; Galaxy nested root corroborated; FOCAS unit-proven"
+    }
  ],
  "reviewFollowUps": [
    "FOCAS minor: no upper-bound clamp on a misbehaving cnc_getfigure value (Math.Pow overflow; same latent risk the manual path had)",
@@ -21,5 +66,6 @@
    "FOCAS: live auto-fetch on the real backend needs a cnc_getfigure command added to the managed FocasWireClient wire protocol (WireFocasClient returns empty today)",
    "Galaxy minor: 3-node chain cycle provably-correct but not directly tested (2-node mutual cycle is tested)"
  ],
-  "lastUpdated": "2026-06-16"
+  "lastUpdated": "2026-07-27",
+  "closureNote": "Shipped \u2014 the stillpending backlog audit cites the landing commits (1e95856b, ada01e1a, fc8121cb, 3e609a2b, 70e6d3d2, c236263e, bd8fee61, 5e27b5f7, fcb38014). Marked complete 2026-07-27 (deferment.md \u00a78.5)."
 }
@@ -4,28 +4,121 @@
  "designCommit": "efccd8d1",
  "baseMaster": "050164b2",
  "branch": "feat/stillpending-phase-4c-array-support (merged to master 0f92e9e2, deleted)",
-  "executionState": "COMPLETE — shipped + pushed to master 0f92e9e2 (ff, 23 commits). Big-bang all 5 drivers + full AbLegacy. Build clean; OpcUaServer 230, Runtime 272, AdminUI 472, Modbus 289, AbCip 292, TwinCAT 153, S7 143, AbLegacy 188 — all green. Bundle integration review caught the cross-driver isArray-gating divergence (C-1/C-2 Modbus+AbLegacy ignored isArray; I-1/I-2/I-3 the arrayLength=1 edge); final integration review = SHIP WITH MINOR FOLLOW-UPS (I-1 S7 clarity, I-2 AbCip degenerate-scalar, I-3 AbLegacy >256 author-validation, M-1 array nodes read-only) — all closed. LIVE /run PASS: a Modbus array equipment tag (HR[0..3], UInt16[4]) materialises as ValueRank=OneDimension/ArrayDimensions=[4] and a Good array value flows end-to-end from the live sim (read over the wire, Status 0x00000000, Value System.UInt16[]); the address-100 first attempt correctly surfaced the sim's Illegal-Data-Address as Bad (faithful device status). S7/AbCip/TwinCAT/AbLegacy unit-proven (fixtures down).",
+  "executionState": "COMPLETE \u2014 shipped + pushed to master 0f92e9e2 (ff, 23 commits). Big-bang all 5 drivers + full AbLegacy. Build clean; OpcUaServer 230, Runtime 272, AdminUI 472, Modbus 289, AbCip 292, TwinCAT 153, S7 143, AbLegacy 188 \u2014 all green. Bundle integration review caught the cross-driver isArray-gating divergence (C-1/C-2 Modbus+AbLegacy ignored isArray; I-1/I-2/I-3 the arrayLength=1 edge); final integration review = SHIP WITH MINOR FOLLOW-UPS (I-1 S7 clarity, I-2 AbCip degenerate-scalar, I-3 AbLegacy >256 author-validation, M-1 array nodes read-only) \u2014 all closed. LIVE /run PASS: a Modbus array equipment tag (HR[0..3], UInt16[4]) materialises as ValueRank=OneDimension/ArrayDimensions=[4] and a Good array value flows end-to-end from the live sim (read over the wire, Status 0x00000000, Value System.UInt16[]); the address-100 first attempt correctly surfaced the sim's Illegal-Data-Address as Bad (faithful device status). S7/AbCip/TwinCAT/AbLegacy unit-proven (fixtures down).",
  "scope": "Big-bang all 5 drivers (AskUserQuestion) + full AbLegacy array read (AskUserQuestion). 1-D read-surface only; array writes / multi-dim / array historization out of scope (array nodes forced read-only at the applier per review M-1).",
-  "nativeTaskIds": {"1": 495, "2": 496, "3": 497, "4": 498, "5": 499, "6": 500, "7": 501, "8": 502, "9": 503, "10": 504, "11": 505, "12": 506},
+  "nativeTaskIds": {
+    "1": 495,
+    "2": 496,
+    "3": 497,
+    "4": 498,
+    "5": 499,
+    "6": 500,
+    "7": 501,
+    "8": 502,
+    "9": 503,
+    "10": 504,
+    "11": 505,
+    "12": 506
+  },
  "tasks": [
-    {"id": 1, "subject": "Sink contract — EnsureVariable array params", "classification": "high-risk", "status": "completed", "commit": "a7928202", "reviewFixCommit": "3172b7bd"},
-    {"id": 2, "subject": "EquipmentTagPlan IsArray/ArrayLength + composer + applier", "classification": "high-risk", "status": "completed", "commit": "71cc4171", "reviewFixCommit": "584e9f2a"},
-    {"id": 3, "subject": "DeploymentArtifact decode byte-parity", "classification": "high-risk", "status": "completed", "commit": "0a747c34", "reviewFixCommit": "eb8a8dc1"},
-    {"id": 4, "subject": "AdminUI driver-agnostic isArray/arrayLength control", "classification": "standard", "status": "completed", "commit": "c2006dfb"},
-    {"id": 5, "subject": "Modbus String/BitInRegister array decode + resolver", "classification": "small", "status": "completed", "commit": "8d3dc321", "reviewFixCommit": "49ac1392"},
-    {"id": 6, "subject": "AbCip libplctag array read + IsArray", "classification": "standard", "status": "completed", "commit": "f4d5a5ee", "reviewFixCommit": "94e8c55b+5f7a2acd"},
-    {"id": 7, "subject": "TwinCAT ADS array read + IsArray (reference impl, no fix needed)", "classification": "standard", "status": "completed", "commit": "3e742395"},
-    {"id": 8, "subject": "S7 block-read array + decode loop + IsArray", "classification": "high-risk", "status": "completed", "commit": "a82c22c6", "reviewFixCommit": "3bbe39c1+d30fb77e"},
-    {"id": 9, "subject": "AbLegacy PCCC multi-element array read + IsArray", "classification": "high-risk", "status": "completed", "commit": "95006939", "reviewFixCommit": "ce5d46be+0f92e9e2"},
-    {"id": 10, "subject": "Docs + bookkeeping", "classification": "small", "status": "completed", "commit": "05c7e86f"},
-    {"id": 11, "subject": "Full build + test + final integration review", "classification": "standard", "status": "completed", "note": "final integration review = SHIP WITH MINOR FOLLOW-UPS; 4 review fixes applied (d30fb77e/5f7a2acd/0f92e9e2/3bb2031d)"},
-    {"id": 12, "subject": "Live /run acceptance + finish branch", "classification": "standard", "status": "completed", "note": "Modbus array tag live-proven (Good UInt16[4] from sim HR[0..3], over the wire); others unit-proven; root-caused the address-100 Bad as a sim Illegal-Data-Address (not a code bug)"}
+    {
+      "id": 1,
+      "subject": "Sink contract \u2014 EnsureVariable array params",
+      "classification": "high-risk",
+      "status": "completed",
+      "commit": "a7928202",
+      "reviewFixCommit": "3172b7bd"
+    },
+    {
+      "id": 2,
+      "subject": "EquipmentTagPlan IsArray/ArrayLength + composer + applier",
+      "classification": "high-risk",
+      "status": "completed",
+      "commit": "71cc4171",
+      "reviewFixCommit": "584e9f2a"
+    },
+    {
+      "id": 3,
+      "subject": "DeploymentArtifact decode byte-parity",
+      "classification": "high-risk",
+      "status": "completed",
+      "commit": "0a747c34",
+      "reviewFixCommit": "eb8a8dc1"
+    },
+    {
+      "id": 4,
+      "subject": "AdminUI driver-agnostic isArray/arrayLength control",
+      "classification": "standard",
+      "status": "completed",
+      "commit": "c2006dfb"
+    },
+    {
+      "id": 5,
+      "subject": "Modbus String/BitInRegister array decode + resolver",
+      "classification": "small",
+      "status": "completed",
+      "commit": "8d3dc321",
+      "reviewFixCommit": "49ac1392"
+    },
+    {
+      "id": 6,
+      "subject": "AbCip libplctag array read + IsArray",
+      "classification": "standard",
+      "status": "completed",
+      "commit": "f4d5a5ee",
+      "reviewFixCommit": "94e8c55b+5f7a2acd"
+    },
+    {
+      "id": 7,
+      "subject": "TwinCAT ADS array read + IsArray (reference impl, no fix needed)",
+      "classification": "standard",
+      "status": "completed",
+      "commit": "3e742395"
+    },
+    {
+      "id": 8,
+      "subject": "S7 block-read array + decode loop + IsArray",
+      "classification": "high-risk",
+      "status": "completed",
+      "commit": "a82c22c6",
+      "reviewFixCommit": "3bbe39c1+d30fb77e"
+    },
+    {
+      "id": 9,
+      "subject": "AbLegacy PCCC multi-element array read + IsArray",
+      "classification": "high-risk",
+      "status": "completed",
+      "commit": "95006939",
+      "reviewFixCommit": "ce5d46be+0f92e9e2"
+    },
+    {
+      "id": 10,
+      "subject": "Docs + bookkeeping",
+      "classification": "small",
+      "status": "completed",
+      "commit": "05c7e86f"
+    },
+    {
+      "id": 11,
+      "subject": "Full build + test + final integration review",
+      "classification": "standard",
+      "status": "completed",
+      "note": "final integration review = SHIP WITH MINOR FOLLOW-UPS; 4 review fixes applied (d30fb77e/5f7a2acd/0f92e9e2/3bb2031d)"
+    },
+    {
+      "id": 12,
+      "subject": "Live /run acceptance + finish branch",
+      "classification": "standard",
+      "status": "completed",
+      "note": "Modbus array tag live-proven (Good UInt16[4] from sim HR[0..3], over the wire); others unit-proven; root-caused the address-100 Bad as a sim Illegal-Data-Address (not a code bug)"
+    }
  ],
  "reviewFollowUps": [
-    "Foundation array test asserts in-process variable.Value only — add a wire-level Session.ReadValueAsync assertion over an array node (the live /run proved it works, but it's not unit-covered)",
-    "Client.CLI read/subscribe prints an array value's type name (System.UInt16[]) not its elements — add array element formatting",
+    "Foundation array test asserts in-process variable.Value only \u2014 add a wire-level Session.ReadValueAsync assertion over an array node (the live /run proved it works, but it's not unit-covered)",
+    "Client.CLI read/subscribe prints an array value's type name (System.UInt16[]) not its elements \u2014 add array element formatting",
    "Array WRITES (inbound client->device), multi-dimensional arrays, array historization remain out of scope (named deferrals)",
    "Live array read for S7/AbCip/TwinCAT/AbLegacy is fixture-gated/operator-gated (unit-proven only); the 5 AbLegacy libplctag PCCC array-read assumptions need a real SLC/MicroLogix to confirm"
  ],
-  "lastUpdated": "2026-06-16"
+  "lastUpdated": "2026-07-27",
+  "closureNote": "Shipped \u2014 the stillpending backlog audit cites the landing commits (1e95856b, ada01e1a, fc8121cb, 3e609a2b, 70e6d3d2, c236263e, bd8fee61, 5e27b5f7, fcb38014). Marked complete 2026-07-27 (deferment.md \u00a78.5)."
 }
@@ -271,7 +271,7 @@ public sealed class GatewayQualityMapperTests
 {
    [Theory]
    [InlineData(192, 0x00000000u)] // Good
-    [InlineData(216, 0x00D80000u)] // Good_LocalOverride
+    [InlineData(216, 0x00960000u)] // Good_LocalOverride
    [InlineData(64,  0x40000000u)] // Uncertain
    [InlineData(0,   0x80000000u)] // Bad
    [InlineData(8,   0x808A0000u)] // Bad_NotConnected
@@ -307,7 +307,7 @@ public sealed class SampleMapperTests
    {
        var a = new HistorianAggregateSample { Tag = "T", /* Value unset */ EndTime = Ts(2026,1,1,0,0,0) };
        var snap = SampleMapper.ToAggregateSnapshot(a);
-        Assert.Equal(0x800E0000u, snap.StatusCode); // BadNoData
+        Assert.Equal(0x809B0000u, snap.StatusCode); // BadNoData
        Assert.Null(snap.Value);
    }
    // Ts(...) builds a Google.Protobuf.WellKnownTypes.Timestamp from UTC parts.
@@ -323,7 +323,7 @@ public sealed class SampleMapperTests
  - `StatusCode`: `GatewayQualityMapper.Map((byte)s.OpcQuality)` (prefer `opc_quality`; if zero/unset and `quality` carries the OPC-DA byte, fall back to `quality` — match whatever the gateway populates; document the choice).
  - `SourceTimestampUtc`: `s.Timestamp.ToDateTime()` (UTC kind).
  - `ServerTimestampUtc`: `DateTime.UtcNow`.
- `SampleMapper.ToAggregateSnapshot(HistorianAggregateSample)` → null aggregate value ⇒ `StatusCode 0x800E0000` (BadNoData), non-null ⇒ Good (`0x00000000`) with the value; `SourceTimestampUtc` ← the bucket end/start timestamp (match the Wonderware `ToAggregateSnapshots` convention — it stamps the bucket timestamp). Provide `IReadOnlyList<>` batch helpers too.
+- `SampleMapper.ToAggregateSnapshot(HistorianAggregateSample)` → null aggregate value ⇒ `StatusCode 0x809B0000` (BadNoData), non-null ⇒ Good (`0x00000000`) with the value; `SourceTimestampUtc` ← the bucket end/start timestamp (match the Wonderware `ToAggregateSnapshots` convention — it stamps the bucket timestamp). Provide `IReadOnlyList<>` batch helpers too.

 **Step 4: run, expect PASS.**

@@ -1,27 +1,185 @@
 {
  "planPath": "docs/plans/2026-06-26-otopcua-historian-gateway-integration.md",
  "tasks": [
-    { "id": 0,  "subject": "Task 1: Consume gateway packages + scaffold Gateway driver project", "status": "pending", "blockedBy": [] },
-    { "id": 1,  "subject": "Task 2: HistoryAggregateType->RetrievalMode mapper (matrix-guarded)", "status": "pending", "blockedBy": [0] },
-    { "id": 2,  "subject": "Task 3: DriverDataType->HistorianDataType mapper + write-gap fallbacks (matrix-guarded)", "status": "pending", "blockedBy": [0] },
-    { "id": 3,  "subject": "Task 4: HistorianSample/Aggregate->DataValueSnapshot + quality mapper", "status": "pending", "blockedBy": [0] },
-    { "id": 4,  "subject": "Task 5: HistorianEvent->HistoricalEvent mapper (+ severity)", "status": "pending", "blockedBy": [0] },
-    { "id": 5,  "subject": "Task 6: AlarmHistorianEvent->HistorianEvent mapper (SendEvent)", "status": "pending", "blockedBy": [0] },
-    { "id": 6,  "subject": "Task 7: GatewayHistorianDataSource read paths (raw/processed/at-time)", "status": "pending", "blockedBy": [1, 3] },
-    { "id": 7,  "subject": "Task 8: GetHealthSnapshot via Probe/GetConnectionStatus", "status": "pending", "blockedBy": [6] },
-    { "id": 8,  "subject": "Task 9: Reshape ServerHistorianOptions to gateway form", "status": "pending", "blockedBy": [0] },
-    { "id": 9,  "subject": "Task 10: Swap AddServerHistorian factory in Program.cs (READ CUTOVER)", "status": "pending", "blockedBy": [6, 8] },
-    { "id": 10, "subject": "Task 11: ReadEventsAsync alarm-history on the data source", "status": "pending", "blockedBy": [6, 4] },
-    { "id": 11, "subject": "Task 12: GatewayAlarmHistorianWriter (SendEvent + outcome mapping)", "status": "pending", "blockedBy": [9, 5] },
-    { "id": 12, "subject": "Task 13: Swap AddAlarmHistorian factory in Program.cs", "status": "pending", "blockedBy": [11] },
-    { "id": 13, "subject": "Task 14: IHistorianProvisioning + GatewayTagProvisioner (EnsureTags)", "status": "pending", "blockedBy": [9, 2] },
-    { "id": 14, "subject": "Task 15: Hook provisioning into AddressSpaceApplier.Apply()", "status": "pending", "blockedBy": [13] },
-    { "id": 15, "subject": "Task 16: FasterLog historization outbox store", "status": "pending", "blockedBy": [9] },
-    { "id": 16, "subject": "Task 17: ContinuousHistorizationRecorder actor", "status": "pending", "blockedBy": [15, 9] },
-    { "id": 17, "subject": "Task 18: Wire recorder into DI + hosted lifecycle", "status": "pending", "blockedBy": [16] },
-    { "id": 18, "subject": "Task 19: Retire Wonderware historian projects", "status": "pending", "blockedBy": [9, 12, 17, 19] },
-    { "id": 19, "subject": "Task 20: Env-gated live validation vs wonder-sql-vd03", "status": "pending", "blockedBy": [9, 10, 12, 17] },
-    { "id": 20, "subject": "Task 21: Documentation (CLAUDE.md, appsettings, README)", "status": "pending", "blockedBy": [18] }
+    {
+      "id": 0,
+      "subject": "Task 1: Consume gateway packages + scaffold Gateway driver project",
+      "status": "completed",
+      "blockedBy": []
+    },
+    {
+      "id": 1,
+      "subject": "Task 2: HistoryAggregateType->RetrievalMode mapper (matrix-guarded)",
+      "status": "completed",
+      "blockedBy": [
+        0
+      ]
+    },
+    {
+      "id": 2,
+      "subject": "Task 3: DriverDataType->HistorianDataType mapper + write-gap fallbacks (matrix-guarded)",
+      "status": "completed",
+      "blockedBy": [
+        0
+      ]
+    },
+    {
+      "id": 3,
+      "subject": "Task 4: HistorianSample/Aggregate->DataValueSnapshot + quality mapper",
+      "status": "completed",
+      "blockedBy": [
+        0
+      ]
+    },
+    {
+      "id": 4,
+      "subject": "Task 5: HistorianEvent->HistoricalEvent mapper (+ severity)",
+      "status": "completed",
+      "blockedBy": [
+        0
+      ]
+    },
+    {
+      "id": 5,
+      "subject": "Task 6: AlarmHistorianEvent->HistorianEvent mapper (SendEvent)",
+      "status": "completed",
+      "blockedBy": [
+        0
+      ]
+    },
+    {
+      "id": 6,
+      "subject": "Task 7: GatewayHistorianDataSource read paths (raw/processed/at-time)",
+      "status": "completed",
+      "blockedBy": [
+        1,
+        3
+      ]
+    },
+    {
+      "id": 7,
+      "subject": "Task 8: GetHealthSnapshot via Probe/GetConnectionStatus",
+      "status": "completed",
+      "blockedBy": [
+        6
+      ]
+    },
+    {
+      "id": 8,
+      "subject": "Task 9: Reshape ServerHistorianOptions to gateway form",
+      "status": "completed",
+      "blockedBy": [
+        0
+      ]
+    },
+    {
+      "id": 9,
+      "subject": "Task 10: Swap AddServerHistorian factory in Program.cs (READ CUTOVER)",
+      "status": "completed",
+      "blockedBy": [
+        6,
+        8
+      ]
+    },
+    {
+      "id": 10,
+      "subject": "Task 11: ReadEventsAsync alarm-history on the data source",
+      "status": "completed",
+      "blockedBy": [
+        6,
+        4
+      ]
+    },
+    {
+      "id": 11,
+      "subject": "Task 12: GatewayAlarmHistorianWriter (SendEvent + outcome mapping)",
+      "status": "completed",
+      "blockedBy": [
+        9,
+        5
+      ]
+    },
+    {
+      "id": 12,
+      "subject": "Task 13: Swap AddAlarmHistorian factory in Program.cs",
+      "status": "completed",
+      "blockedBy": [
+        11
+      ]
+    },
+    {
+      "id": 13,
+      "subject": "Task 14: IHistorianProvisioning + GatewayTagProvisioner (EnsureTags)",
+      "status": "completed",
+      "blockedBy": [
+        9,
+        2
+      ]
+    },
+    {
+      "id": 14,
+      "subject": "Task 15: Hook provisioning into AddressSpaceApplier.Apply()",
+      "status": "completed",
+      "blockedBy": [
+        13
+      ]
+    },
+    {
+      "id": 15,
+      "subject": "Task 16: FasterLog historization outbox store",
+      "status": "completed",
+      "blockedBy": [
+        9
+      ]
+    },
+    {
+      "id": 16,
+      "subject": "Task 17: ContinuousHistorizationRecorder actor",
+      "status": "completed",
+      "blockedBy": [
+        15,
+        9
+      ]
+    },
+    {
+      "id": 17,
+      "subject": "Task 18: Wire recorder into DI + hosted lifecycle",
+      "status": "completed",
+      "blockedBy": [
+        16
+      ]
+    },
+    {
+      "id": 18,
+      "subject": "Task 19: Retire Wonderware historian projects",
+      "status": "completed",
+      "blockedBy": [
+        9,
+        12,
+        17,
+        19
+      ]
+    },
+    {
+      "id": 19,
+      "subject": "Task 20: Env-gated live validation vs wonder-sql-vd03",
+      "status": "completed",
+      "blockedBy": [
+        9,
+        10,
+        12,
+        17
+      ]
+    },
+    {
+      "id": 20,
+      "subject": "Task 21: Documentation (CLAUDE.md, appsettings, README)",
+      "status": "completed",
+      "blockedBy": [
+        18
+      ]
+    }
  ],
-  "lastUpdated": "2026-06-26"
+  "lastUpdated": "2026-07-27",
+  "closureNote": "Shipped as PR #423 and live-validated against the gateway on wonder-sql-vd03. Marked complete 2026-07-27 (deferment.md \u00a78.5)."
 }
@@ -26,7 +26,9 @@ OpcUaClient, Historian.Gateway (`src/Drivers/`).

 ## 2. Document map

-**Program:** this file.
+**Program:** this file (architecture / shared contract / build order).
+**Progress tracker (Waves 0–2):** [`2026-07-24-driver-expansion-tracking.md`](2026-07-24-driver-expansion-tracking.md)
+— per-deliverable status + links to each design doc and implementation plan.

 **Research reports** (`docs/research/drivers/`, index: [`README.md`](../research/drivers/README.md)):
 - [`mtconnect-agent.md`](../research/drivers/mtconnect-agent.md) ·
@@ -98,7 +98,7 @@ Pure function in `.Contracts` (shared by driver, browser-commit, and the typed e
 | `EVENT` free text (`Program`, `Block`, `Message`) | `String` |
 | `CONDITION` | `String` (state word; §3.6) |

-**Quality mapping (`DataValueSnapshot.StatusCode`):** an observation value of `UNAVAILABLE` (MTConnect's explicit no-data sentinel) → **`BadNoCommunication` (`0x80310000u`)** with a null value, not the literal string — this is *the* UNAVAILABLE code, used everywhere in this design (read, subscribe, and the §8 fixtures). Rationale + fleet fit: semantically, `UNAVAILABLE` means the Agent is reachable but has no device-backed value (the adapter↔device link is down or the item has never reported) — exactly OPC UA's `BadNoCommunication` ("communication to the data source has failed"). The fleet grep shows no competing convention for this case: every existing driver's `BadCommunicationError` (`0x80050000u`, Modbus/FOCAS/TwinCAT/OpcUaClient/S7/AbCip/AbLegacy/Galaxy) marks the **driver's own transport failure** to its peer — a different failure (and the code this driver also uses when the *Agent* HTTP call fails, per §7) — while `BadNoData` (`0x800E0000u`) is historian-domain only (`Historian.Gateway/Mapping/SampleMapper.cs`). `BadNoCommunication` is already in the CLI's `SnapshotFormatter` name table (`src/Drivers/Cli/ZB.MOM.WW.OtOpcUa.Driver.Cli.Common/SnapshotFormatter.cs`), so it renders by name, not hex. Declare it as a `private const uint` in `MTConnectDriver` (the Modbus `StatusBadCommunicationError` pattern). Missing dataItem / empty condition → `Bad`. `observation.timestamp` → `SourceTimestamp` (not a separate node).
+**Quality mapping (`DataValueSnapshot.StatusCode`):** an observation value of `UNAVAILABLE` (MTConnect's explicit no-data sentinel) → **`BadNoCommunication` (`0x80310000u`)** with a null value, not the literal string — this is *the* UNAVAILABLE code, used everywhere in this design (read, subscribe, and the §8 fixtures). Rationale + fleet fit: semantically, `UNAVAILABLE` means the Agent is reachable but has no device-backed value (the adapter↔device link is down or the item has never reported) — exactly OPC UA's `BadNoCommunication` ("communication to the data source has failed"). The fleet grep shows no competing convention for this case: every existing driver's `BadCommunicationError` (`0x80050000u`, Modbus/FOCAS/TwinCAT/OpcUaClient/S7/AbCip/AbLegacy/Galaxy) marks the **driver's own transport failure** to its peer — a different failure (and the code this driver also uses when the *Agent* HTTP call fails, per §7) — while `BadNoData` (`0x809B0000u`) is historian-domain only (`Historian.Gateway/Mapping/SampleMapper.cs`). `BadNoCommunication` is already in the CLI's `SnapshotFormatter` name table (`src/Drivers/Cli/ZB.MOM.WW.OtOpcUa.Driver.Cli.Common/SnapshotFormatter.cs`), so it renders by name, not hex. Declare it as a `private const uint` in `MTConnectDriver` (the Modbus `StatusBadCommunicationError` pattern). Missing dataItem / empty condition → `Bad`. `observation.timestamp` → `SourceTimestamp` (not a separate node).

 ### 3.4 `IReadable` — `/current`

@@ -588,6 +588,40 @@ SQL Server client works cross-platform, so `Sql` runs on macOS dev too (unlike G
  `dialect.QuoteIdentifier` (which escapes/rejects embedded quote characters). A table/column string
  in a `TagConfig` is validated against the live catalog (or an allow-list) before it's ever quoted
  into text; an unknown identifier rejects the tag (→ `BadNodeIdUnknown`) rather than executing.
+
+  **Implemented (Gitea #496).** `SqlCatalogGate` + `SqlCatalogLoader`, run from
+  `SqlDriver.InitializeAsync` after the liveness check and before the driver reports Healthy. Shape,
+  and the decisions worth knowing before touching it:
+
+  - **The catalog's spelling is substituted, not merely checked.** An accepted identifier is rewritten
+    to the string the catalog returned, so the text quoted into a poll query is one this driver read
+    back out of `ListSchemas`/`ListTables`/`ListColumns` — not operator input. Matching is
+    exact-ordinal first, then a *unique* case-insensitive hit (SQL Server's default collation is CI, so
+    case variants have always worked and rejecting them would break valid configs); an ambiguous CI
+    match under a case-sensitive collation is refused rather than guessed, because picking one would
+    publish another column's data under the operator's node.
+  - **Charset check first, catalog lookup second.** Each identifier goes through `QuoteIdentifier` for
+    its rejection rules *before* being looked up, so a name carrying a control or Unicode format
+    character is rejected **without its value being echoed** into a log line (Trojan-Source). A name
+    that passes is safe to render, which is why catalog-miss messages *do* name it — an operator
+    hunting a typo has to see what they wrote.
+  - **Rejection is per-tag and keeps the node.** The rejected tag is dropped from the *polled* table
+    but stays in the *authored* table, so it still materializes as a node and reads
+    `BadNodeIdUnknown` (§8.1's specified outcome) instead of vanishing from the address space. Every
+    drop is logged at Warning with the tag, the field and the reason.
+  - **A catalog that cannot be read faults Initialize; it does not reject every tag.** An unreadable
+    catalog is the *absence* of evidence about the tags, not evidence against them — rejecting all of
+    them would serve a confidently-empty address space and send the operator hunting typos that do not
+    exist. Zero visible schemas is treated the same way, because that is what a missing GRANT looks
+    like. Faulting lands `DriverInstanceActor` in Reconnecting with its retry timer running.
+  - **Bounded load:** one schema-list query, one default-schema scalar (`ISqlDialect.DefaultSchemaSql`,
+    added for this — an unqualified `TagValues` must resolve in whatever schema the *server* says, not
+    a guessed `dbo`), then one `ListTables` per distinct authored schema and one `ListColumns` per
+    distinct authored relation. It never enumerates the whole catalog, and the load runs under the same
+    wall-clock bound as the liveness check (R2-01 / STAB-14).
+  - **Accepted v1 limitation:** a 3-part `db.schema.table` (or a linked-server name) addresses a
+    catalog this connection cannot enumerate, so it cannot be allow-listed and is rejected with a
+    message pointing at the fix — expose the data through a view in the connected database.
 - **Treat any code path that builds SQL by string-concatenating a tag field as a defect** — enforce
  with a review checklist item + a unit test that feeds a malicious `keyValue`/`table`
  (`'; DROP TABLE …`) and asserts it either binds harmlessly (value) or is rejected (identifier),
@@ -607,8 +641,15 @@ comment) and the env-overridable ConfigDb connection string:
  file. Direct env read (not `IConfiguration`) is deliberate: the factory registry materializes
  drivers via a static `(id, json)` closure (Modbus pattern) with no `IConfiguration` in reach, so
  this keeps the factory shape unchanged.
- If an inline `connectionString` is ever permitted (dev convenience only), the AdminUI **redacts** it
-  in display/logging and flags it dev-only.
+- **An inline `connectionString` is not permitted at all** — the earlier "dev convenience, redacted in
+  the UI" carve-out is withdrawn (Gitea #498). Redaction only hides a credential that has *already been
+  written* to the config DB and replicated to every node's artifact cache. `SqlDriverConfigDto` has no
+  such property and `UnmappedMemberHandling.Skip` drops the key on read, but that protects only the read
+  path; config blobs are schemaless JSON columns, so nothing stopped the key being **written**.
+  `DraftValidator.ValidateSqlConnectionStringNotPersisted` now fails the deploy
+  (`SqlConnectionStringPersisted`) for a `connectionString` key at the top level of a Sql driver's
+  `DriverConfig` **or** of the `DeviceConfig` of any device beneath it (the two are merged before the DTO
+  sees them). The key is matched case-insensitively, and the error text never echoes the value.
 - **Never log the resolved connection string.** Log only provider + server host + database name.
 - Prefer integrated/managed auth where the estate supports it (`Integrated Security=true` / Azure AD /
  Kerberos) so no password transits config at all.
@@ -94,7 +94,14 @@ dual-namespace + event-delivery), Runtime 377 (+ VT reassert regression), AdminU

 ## Documented follow-ups (non-blocking)

- **Scripted-alarm redeploy recovery (CONFIRMED pre-existing bug, deferred — deserves its own careful fix). Filed as issue #487.**
+- **Scripted-alarm redeploy recovery — FIXED (issue #487), see `docs/ScriptedAlarms.md` §"Post-(re)load
+  condition-node re-assert".** Landed as the proposed shape below: `ScriptedAlarmHostActor.ReassertConditionNodes`
+  in `OnAlarmsLoaded`, node-only, never the `alerts` topic. Two deviations from the sketch, both deliberate:
+  it reads a new `ScriptedAlarmEngine.GetProjections()` rather than `GetState(alarmId)` + `LoadedAlarmIds`
+  (a projection also carries the definition's severity, the resolved message template, and the last-observed
+  worst-input quality — `GetState` alone would have clobbered severity/message on the node); and it skips
+  alarms sitting in the Part 9 no-event position, so a deploy where nothing is in alarm writes no condition
+  nodes at all. The original deferral text follows for context.
  The scripted-alarm Part 9 condition node has the same redeploy-reset race the VT `ReassertValue` fix closed:
  `RebuildAddressSpace` clears `_alarmConditions` and `MaterialiseScriptedAlarms` recreates each condition
  fresh/normal, but `ScriptedAlarmEngine.LoadAsync` reloads from the persisted state and yields
@@ -312,7 +312,7 @@ Deliberately not a task plan — per-phase plans follow, one at a time.
 | 3 | Config fetch-and-cache: artifact served by central, driver nodes read LocalDb (§6.1) | No |
 | 4 | Cut the driver-side ConfigDb connection: re-home `EfAlarmConditionStateStore`, resolve the `DbHealthProbeActor` ServiceLevel input, audit `OpcUaPublishActor` | No |
 | 5 | gRPC stream contract; migrate the seven observability topics | No |
-| 6 | Mesh partition: per-cluster seed nodes, cluster-scoped roles + singletons; rig models the real topology | No |
+| 6 | Mesh partition: per-cluster seed nodes, cluster-scoped roles + singletons; rig models the real topology | No — **DONE 2026-07-24**, see `2026-07-22-per-cluster-mesh-program.md` §Phase 6 and `2026-07-24-mesh-phase6-partition-and-colocation.md` |
 | 7 | Failover drill (both directions, per §6.2); live gate | No |

 Phases 3 and 4 are the ones that change a running system's data path rather than its wiring, and each
@@ -263,25 +263,45 @@ kill-and-reconnect of a site node's dialer recovers every stream (driver-health/
 from the node hub's snapshot replay). Treat Phase 5 as **code-complete, not verified**, until this
 lands — see `docs/plans/2026-07-23-mesh-phase5-grpc-telemetry-stream.md` Task 12.

-### Phase 6 — Mesh partition + co-location topology
+### Phase 6 — Mesh partition + co-location topology — **DONE 2026-07-24**
 **Scope:** per-cluster seed nodes — ~~adopt ScadaBridge's self-first ordering and RETIRE the
 `SelfFormAfter` watchdog + TCP reachability guard~~ **DONE EARLY 2026-07-22** (docker-dev
 `central-2` swapped to self-first, `ClusterBootstrapFallback`/`SelfFormAfter` deleted,
 `AkkaClusterOptionsValidator` ports ScadaBridge's startup rule in its conditional form, and
 `SelfFirstSeedBootstrapTests` replaces `SelfFormBootstrapTests`; see `docs/Redundancy.md`
-§"Bootstrap: self-first seed ordering"). What remains for this phase is the per-pair
-`Cluster__SeedNodes__*` matrix once the meshes actually split — every node in a pair is then a seed
-of its own mesh, so the site-node exemption disappears; cluster-scoped roles `cluster-{ClusterId}` + singleton re-scoping,
-central pair keeps the admin singletons; **docker-dev rig rewritten** to model the real topology —
-including the co-location port table above (both products' compose files on shared per-site
-networks, real LocalDb sync ports); remove the ClusterRedundancy page's mesh-scope caveat (the
-election is pair-local now) and the fallback's site-node island-guard docs note (moot — every
-node is a seed of its own mesh); `Cluster__SeedNodes__*` env matrix per pair.
-**Exit gate:** rig up in the new shape; every existing live-gated behavior re-verified per pair
-(deploy, redundancy 250/240 per pair — **two Primaries fleet-wide, one per pair, by design**);
-secrets Akka replication re-verified or re-scoped (it rides DPS on the current single mesh — its
-topology must be re-decided here, likely SQL-hub mode like ScadaBridge, since pub/sub cannot
-cross separate meshes).
+§"Bootstrap: self-first seed ordering"). The rest of the phase — actually splitting the single
+fleet-wide mesh into three independent 2-node meshes (central `cluster-MAIN`, site-a
+`cluster-SITE-A`, site-b `cluster-SITE-B`) — **shipped 2026-07-24**. See
+`docs/plans/2026-07-24-mesh-phase6-partition-and-colocation.md` for the full plan and task list.
+Delivered:
+- Per-pair `Cluster:SeedNodes` (each node lists itself first, its pair partner second — no
+  cross-pair seeds) + `cluster-{ClusterId}` roles on every driver node + singleton re-scoping:
+  `RedundancyStateActor` is now a `cluster-{ClusterId}`-scoped singleton spawned on every driver
+  node (falls back to plain `driver` for legacy nodes), so **each pair elects its own Primary —
+  two or more Primaries fleet-wide, by design**; `ClusterNodeAddressReconciler` is own-cluster-scoped.
+- `CentralCommunicationActor` now creates one `ClusterClient` per application `Cluster` and fans
+  commands across them (closes the `TODO(Phase 6)` left by Phase 2).
+- New `SplitTopologyTransportValidator` fails host start on a `cluster-{ClusterId}`-role node left
+  on a DPS transport (`MeshTransport:Mode` must be `ClusterClient`; `Telemetry:Mode`/`TelemetryDial:Mode`
+  must be `Grpc`) — see `docs/Configuration.md` §"Per-cluster mesh split (Phase 6)".
+- **Three decisions worth recording:**
+  1. **Secrets replication went pair-local, not SQL-hub.** The design flagged "likely SQL-hub mode
+     like ScadaBridge" as the fallback if DPS couldn't cross the split meshes — in the event, each
+     pair simply keeps replicating its own secrets within itself (no cross-cluster sync needed, and
+     no SQL-hub was built, consistent with Phase 4: site nodes have no SQL to hub through).
+  2. **The compiled transport-mode defaults (`MeshTransport:Mode`, `Telemetry:Mode`,
+     `TelemetryDial:Mode`) were deliberately left at `Dps`**, not flipped to the split-safe modes —
+     a blast-radius assessment found flipping the default breaks every integration test and every
+     appsettings profile that leaves the key unset. The guardrail is
+     `SplitTopologyTransportValidator` plus explicit per-deployment config, not a default flip.
+  3. **The docker-dev rig models three OtOpcUa-only meshes** (central/site-a/site-b), not the
+     ScadaBridge co-location topology sketched in the design's port table — co-location with
+     ScadaBridge's own site nodes stayed out of scope for this phase.
+**Exit gate:** rig up in the new three-mesh shape; every existing live-gated behavior re-verified
+per pair (deploy, redundancy 250/240 per pair, two-Primaries-fleet-wide confirmed); the
+ClusterRedundancy page's mesh-scope caveat and `IManualFailoverService`'s doc-comment caveat
+removed (the election is pair-local now); `docs/Redundancy.md`'s per-Akka-cluster KNOWN LIMITATION
+marked resolved.

 ### Phase 7 — Failover drill + live gates
 **Scope:** the drill ScadaBridge already has (`failover-drill.sh` analogue) run per pair, both
@@ -318,5 +338,5 @@ resource sizing on the site VMs should be checked once both products run the ful
 | 3 fetch-and-cache | **DONE 2026-07-23**, merged `d01b0695`, live gate PASSED, pushed to origin (scadaproj umbrella index updated + pushed `b5e7bc8`). gRPC fetch RPC + shared node key; dark switch `ConfigSource:Mode` (Direct default). Rig flip: `OTOPCUA_CONFIG_MODE=FetchAndCache` on the site nodes. See `2026-07-22-mesh-phase3-config-fetch-and-cache.md`. |
 | 4 cut driver ConfigDb | **DONE 2026-07-23 — live gate PASSED** on `feat/mesh-phase4` (Tasks 0–8 + 1b + 10–11; Task 9 table-drop deferred). ConfigDb admin-only; driver-only ⇒ FetchAndCache (validator); `DbHealthProbeActor` not spawned driver-only (client-visible ServiceLevel 240/250 with central SQL down — proven live); alarm condition state in replicated LocalDb `alarm_condition_state`; central persists acks; `OpcUaPublish` guard split fixes the driver-only address-space wipe; driver-only LDAP maps from appsettings only (6th consumer found mid-phase). Gate: deploy sealed green w/ 4 DB-less site nodes acking, ServiceLevel held 240 w/ SQL down, restart booted last-known-good from the LocalDb pointer. See `2026-07-23-mesh-phase4-cut-driver-configdb.md` + `2026-07-23-mesh-phase4-live-gate.md`. |
 | 5 gRPC telemetry | **DONE 2026-07-23 — live gate PASSED** on `feat/mesh-phase5`. 4-channel scope (`alerts`/`script-logs`/`driver-health`/`driver-resilience-status`), 3 deferred with rationale (`redundancy-state`, `fleet-status`, `deployment-acks`); dark switch `Telemetry:Mode`/`TelemetryDial:Mode` (Dps default); node hosts server / central dials; auth-from-day-one fail-closed bearer key, superseding design §6.3. Gate: full 12-stream mesh formed in Grpc mode (2 inbound per driver node, 6 outbound per central), AdminUI pill live (data path proven), kill-and-reconnect of a node recovered its stream in ~5s; Dps baseline dials nothing. Surfaced an upgrade gotcha — `ClusterNode.GrpcPort` must be populated on existing deployments (fresh installs seed it; nullable column doesn't backfill) — which live-validated the graceful null-`GrpcPort` skip. See `docs/Telemetry.md`, `2026-07-23-mesh-phase5-grpc-telemetry-stream.md` + `2026-07-23-mesh-phase5-live-gate.md`. |
-| 6 mesh partition + co-location | not started |
-| 7 drill + live gates | not started |
+| 6 mesh partition + co-location | **DONE 2026-07-24** — three independent 2-node meshes (central/site-a/site-b), `cluster-{ClusterId}` roles, per-pair self-first seeds, cluster-scoped `RedundancyStateActor` singleton (two+ Primaries fleet-wide, by design), one `ClusterClient` per `Cluster`, `SplitTopologyTransportValidator`, pair-local secrets replication, compiled transport defaults intentionally kept `Dps`. See `2026-07-24-mesh-phase6-partition-and-colocation.md`. |
+| 7 drill + live gates | **DONE 2026-07-24 — all 6 drills PASSED** on the docker-dev three-mesh rig. D1 MAIN graceful manual-failover via the AdminUI button (Primary leaves, peer→250, restarts+rejoins no split); D2 SITE-A auto-down failover both directions; D3 SITE-B crash-the-oldest; D4 **auto-down 1-vs-1 survival (closes the gate deferred since Phase 0a)** — every survivor stayed Up; D5 **self-first cold-start-alone (gate b)** — a node boots alone and forms its mesh; D6 recovery/rejoin. Manual-failover button confirmed MAIN-only by construction (site pairs are driver-only, fail over via auto-down). One-page co-located operator runbook shipped. Carried Phase-6 finding: simultaneous cold-start of both pair VMs can split — operational mitigation (staggered start) in the runbook; product-level guard is a candidate follow-up, not shipped. See `2026-07-24-mesh-phase7-failover-drills.md`. **Per-cluster mesh program COMPLETE.** |
@@ -2,14 +2,69 @@
  "planPath": "docs/plans/2026-07-22-per-cluster-mesh-program.md",
  "note": "PROGRAM plan: each task = write that phase's detailed plan (writing-plans), execute it (executing-plans), run its exit gate, update the tracking tables. Prereq task 0 is the separate selfform-fallback plan in this repo.",
  "tasks": [
-    {"id": 0, "subject": "Prereq: execute 2026-07-22-selfform-fallback-and-manual-failover.md (7 tasks)", "status": "completed", "note": "Shipped as self-first seed ordering + AkkaClusterOptionsValidator, NOT the planned SelfFormAfter watchdog (live gate caught it islanding a failed-over node). Merged a78425ea."},
-    {"id": 1, "subject": "Phase 1: ClusterNode Akka+gRPC address columns; ConfigPublishCoordinator ack set from DB", "status": "completed", "note": "Merged 7654f24d. Escape hatch is ClusterNode.MaintenanceMode, not Enabled=0."},
-    {"id": 2, "subject": "Phase 2: comm actors + receptionist + ClusterClient transport (deploy notify/acks, driver-control)", "status": "in_progress", "blockedBy": [1]},
-    {"id": 3, "subject": "Phase 3: config fetch-and-cache from central; LocalDb steady-state config store (live gate)", "status": "pending", "blockedBy": [2]},
-    {"id": 4, "subject": "Phase 4: cut driver-side ConfigDb — EfAlarmConditionStateStore to LocalDb, DbHealthProbeActor ServiceLevel input, OpcUaPublishActor audit (live gate)", "status": "pending", "blockedBy": [3]},
-    {"id": 5, "subject": "Phase 5: gRPC oneof stream contract; migrate 7 observability topics; AdminUI reconnect story", "status": "pending", "blockedBy": [2]},
-    {"id": 6, "subject": "Phase 6: mesh partition — per-pair seeds, cluster-scoped roles/singletons, co-location rig rewrite, secrets replication re-scope", "status": "pending", "blockedBy": [0, 4, 5]},
-    {"id": 7, "subject": "Phase 7: failover drill per pair (incl. shared-VM failure) + close auto-down 1v1 and self-first cold-start-alone live gates + operator runbook", "status": "pending", "blockedBy": [6]}
+    {
+      "id": 0,
+      "subject": "Prereq: execute 2026-07-22-selfform-fallback-and-manual-failover.md (7 tasks)",
+      "status": "completed",
+      "note": "Shipped as self-first seed ordering + AkkaClusterOptionsValidator, NOT the planned SelfFormAfter watchdog (live gate caught it islanding a failed-over node). Merged a78425ea."
+    },
+    {
+      "id": 1,
+      "subject": "Phase 1: ClusterNode Akka+gRPC address columns; ConfigPublishCoordinator ack set from DB",
+      "status": "completed",
+      "note": "Merged 7654f24d. Escape hatch is ClusterNode.MaintenanceMode, not Enabled=0."
+    },
+    {
+      "id": 2,
+      "subject": "Phase 2: comm actors + receptionist + ClusterClient transport (deploy notify/acks, driver-control)",
+      "status": "completed",
+      "blockedBy": [
+        1
+      ]
+    },
+    {
+      "id": 3,
+      "subject": "Phase 3: config fetch-and-cache from central; LocalDb steady-state config store (live gate)",
+      "status": "completed",
+      "blockedBy": [
+        2
+      ]
+    },
+    {
+      "id": 4,
+      "subject": "Phase 4: cut driver-side ConfigDb \u2014 EfAlarmConditionStateStore to LocalDb, DbHealthProbeActor ServiceLevel input, OpcUaPublishActor audit (live gate)",
+      "status": "completed",
+      "blockedBy": [
+        3
+      ]
+    },
+    {
+      "id": 5,
+      "subject": "Phase 5: gRPC oneof stream contract; migrate 7 observability topics; AdminUI reconnect story",
+      "status": "completed",
+      "blockedBy": [
+        2
+      ]
+    },
+    {
+      "id": 6,
+      "subject": "Phase 6: mesh partition \u2014 per-pair seeds, cluster-scoped roles/singletons, co-location rig rewrite, secrets replication re-scope",
+      "status": "completed",
+      "blockedBy": [
+        0,
+        4,
+        5
+      ]
+    },
+    {
+      "id": 7,
+      "subject": "Phase 7: failover drill per pair (incl. shared-VM failure) + close auto-down 1v1 and self-first cold-start-alone live gates + operator runbook",
+      "status": "completed",
+      "blockedBy": [
+        6
+      ]
+    }
  ],
-  "lastUpdated": "2026-07-22T00:00:00Z"
+  "lastUpdated": "2026-07-27",
+  "closureNote": "Program COMPLETE (Phases 0a-7 + bootstrap guard), origin/master d1dac87f. Marked complete 2026-07-27 (deferment.md \u00a78.5)."
 }
@@ -100,7 +100,7 @@
    {
      "id": 9,
      "subject": "Task 9: Drop dead ConfigDb ScriptedAlarmState table + retire EfAlarmConditionStateStore",
-      "status": "deferred",
+      "status": "completed",
      "blockedBy": [
        6
      ],
@@ -128,5 +128,6 @@
      "result": "LIVE GATE PASSED \u2014 deploy sealed green w/ 4 DB-less site nodes acking; ServiceLevel 240 w/ central SQL down; restart booted last-known-good from LocalDb pointer; grep proof; alarm_condition_state table live+replicated. Doc: 2026-07-23-mesh-phase4-live-gate.md"
    }
  ],
-  "lastUpdated": "2026-07-23"
+  "lastUpdated": "2026-07-27",
+  "closureNote": "Task 9 landed 3a590a0c; live gate PASSED 1281aebf. Marked complete 2026-07-27 (deferment.md \u00a78.5)."
 }
@@ -0,0 +1,261 @@
+# Driver-expansion — Waves 0–2 tracking
+
+> **Living status tracker** for the driver-expansion program (Waves 0, 1, 2). One row per
+> deliverable, each pointing at its **design doc**, its **implementation plan** (once written),
+> and its current **status**. The authoritative *architecture* index is the program design doc;
+> this file is the authoritative *progress* index.
+>
+> **Program design (architecture / shared contract / build order):**
+> [`2026-07-15-driver-expansion-program-design.md`](2026-07-15-driver-expansion-program-design.md)
+>
+> Last updated: 2026-07-27.
+
+## Legend
+
+| Status | Meaning |
+|---|---|
+| ✅ **Done** | Merged to master, tests green. |
+| 🟡 **Live gate open** | Code merged; a live `/run` or hardware-gated verification still outstanding. |
+| 📝 **Plan ready** | Executable implementation plan (`*-implementation.md` + `.tasks.json`) written; not yet built. |
+| 📐 **Design only** | Design doc exists; **no** implementation plan yet — writing-plans is the next step. |
+| ⛔ **Not started** | No design, no plan. |
+
+**Doc types** (per the writing-plans skill): a *design* states architecture, decisions, and risks;
+an *implementation plan* is the bite-sized, TDD, file-path-level task list the subagent-driven
+executor runs off, with a co-located `.tasks.json` for resume. A deliverable is only buildable once
+it reaches 📝.
+
+## Summary
+
+| Wave | Deliverable | Design | Impl. plan | Status | Effort | Fixture / hardware |
+|---|---|---|---|---|---|---|
+| **0** | Universal Discover-backed browser | [design](2026-07-15-universal-discovery-browser-design.md) | [plan](2026-07-15-universal-discovery-browser-implementation.md) · [tasks](2026-07-15-universal-discovery-browser-implementation.md.tasks.json) | 🟡 **Live gate open** | S–M | none (retrofits shipped drivers) |
+| **1** | Modbus RTU (extend Modbus) | [design](2026-07-15-modbus-rtu-driver-design.md) | [plan](2026-07-24-modbus-rtu-driver.md) · [tasks](2026-07-24-modbus-rtu-driver.md.tasks.json) | ✅ **Done** — merged to master `0f38f486` (#495), 11 tasks, live gate PASSED | **S (lowest)** | `pymodbus` `rtu_over_tcp` — CI-simulatable, no new infra |
+| **1** | SQL poll | [design](2026-07-15-sql-poll-driver-design.md) | [plan](2026-07-24-sql-poll-driver.md) · [tasks](2026-07-24-sql-poll-driver.md.tasks.json) | ✅ **Done** — merged to master `4ad54037`, 22 tasks, live gate PASSED; follow-ups #496/#497/#498 closed in `28c28667` | S–M | **existing central SQL Server** `10.100.0.35,14330` + SQLite unit |
+| **2** | MTConnect Agent | [design](2026-07-15-mtconnect-driver-design.md) | [plan](2026-07-24-mtconnect-driver.md) · [tasks](2026-07-24-mtconnect-driver.md.tasks.json) | ✅ **COMPLETE** — P1 Agent MVP, all 23 tasks + the 5-leg live gate PASSED (branch `feat/mtconnect-driver`, PR #506) | S–M | Dockerized `mtconnect/agent:2.7.0.12` (not `cppagent`) — CI-simulatable, live at `10.100.0.35:5000` |
+| **2** | MQTT / Sparkplug B | [design](2026-07-15-mqtt-sparkplug-driver-design.md) | [plan](2026-07-24-mqtt-sparkplug-driver.md) · [tasks](2026-07-24-mqtt-sparkplug-driver.md.tasks.json) | ✅ **COMPLETE** — P1 + P2 shipped, both live-gated (Tasks 0–26) | M–L | Mosquitto TLS+auth **+ C# Sparkplug edge-node simulator**, live at `10.100.0.35:8883` |
+
+> Waves 3+ (BACnet/IP, Omron) and the deferred MELSEC are tracked in the program design doc §6/§8,
+> not here. Omron CIP is the program's sole real-hardware wire gate; BACnet's broadcast/BBMD leg is
+> env-gated live. Both are out of this file's scope until they're pulled forward.
+
+---
+
+## Executing a plan (git worktree + subagent-per-task)
+
+Each 📝 plan is executed with the **subagent-driven-development** skill: it sets up an isolated
+**git worktree** first (via `using-git-worktrees`), then dispatches a **fresh subagent per task**,
+running the classification-driven review chain (`trivial` = implement only … `high-risk` =
+spec-review → code-review → integration review) between tasks. The `.tasks.json` next to each plan
+tracks progress and lets a later session resume.
+
+> ⚠️ **All four plans below have been executed and merged.** This table is retained as the *pattern*
+> for executing a future driver plan — do **not** run these four commands, they would rebuild shipped
+> drivers in a fresh worktree. (Their `.tasks.json` files still read `pending`; that is stale
+> bookkeeping, not backlog — see `deferment.md` §6.1.)
+
+| Deliverable | Status | Command (pattern only — do not re-run) |
+|---|---|---|
+| Modbus RTU (Wave 1) | ✅ merged `0f38f486` | ~~`… execute docs/plans/2026-07-24-modbus-rtu-driver.md …`~~ |
+| SQL poll (Wave 1) | ✅ merged `4ad54037` | ~~`… execute docs/plans/2026-07-24-sql-poll-driver.md …`~~ |
+| MTConnect (Wave 2) | ✅ merged `90bdaa44` (#506) | ~~`… execute docs/plans/2026-07-24-mtconnect-driver.md …`~~ |
+| MQTT/Sparkplug (Wave 2) | ✅ merged `c3a2b0f7` | ~~`… execute docs/plans/2026-07-24-mqtt-sparkplug-driver.md …`~~ |
+
+For a **new** driver the invocation shape is:
+`Use superpowers-extended-cc:subagent-driven-development to execute <plan-path> in a new git worktree`
+
+- **Slash-command form** (equivalent): `/superpowers-extended-cc:subagent-driven-development <plan-path>`.
+- **Parallel-session / resume form** (batch execution with checkpoints, no fresh-subagent-per-task):
+  `/superpowers-extended-cc:executing-plans <plan-path>` — reads the same `.tasks.json` and continues
+  from the first pending task.
+- **Order (historical):** the four were built lowest-effort-first — Modbus RTU → SQL poll → MTConnect
+  → MQTT/Sparkplug. All are merged; nothing in this list remains to schedule. Run one plan per
+  worktree; independent plans may run concurrently in separate worktrees.
+
+---
+
+## Wave 0 — Universal Discover-backed browser 🟡
+
+**What it is.** One generic `DiscoveryDriverBrowser` (+ `CapturingAddressSpaceBuilder`,
+`CapturedTreeBrowseSession`, `BrowserSessionService` fallback, and the
+`ITagDiscovery.SupportsOnlineDiscovery` gate) that turns any driver's `ITagDiscovery.DiscoverAsync`
+into an AdminUI browse tree. It is the **Wave-0 gate**: every browsable new driver depends on this
+seam, and it retrofits browse to the already-shipped AbCip / TwinCAT / FOCAS drivers for near-zero
+marginal cost.
+
+- **Design:** [`2026-07-15-universal-discovery-browser-design.md`](2026-07-15-universal-discovery-browser-design.md)
+- **Implementation plan:** [`2026-07-15-universal-discovery-browser-implementation.md`](2026-07-15-universal-discovery-browser-implementation.md) · [`.tasks.json`](2026-07-15-universal-discovery-browser-implementation.md.tasks.json)
+- **Status: 🟡 code-complete + merged, live gate open.**
+  - Merged to master — `056887d6` (*Merge feat/universal-discovery-browser — Wave-0 universal Discover-backed browser*), 2026-07-15.
+  - Implementation plan: **19 / 19 tasks completed.**
+  - Lit up AbCip / TwinCAT / FOCAS pickers with zero per-driver browse code.
+- **Outstanding:** the full tree-render live `/run` gate is **fixture-blocked** — tracked as **Gitea #468**. Complete this before leaning on browse in Wave 2/3.
+
+---
+
+## Wave 1 — low-effort / high-leverage pair ✅
+
+Both are **fully CI-simulatable with zero new hardware**; Modbus RTU needs no new infra at all, and
+SQL poll reuses the always-on central SQL Server. **Both shipped.**
+
+### Modbus RTU — ✅ Done (merged `0f38f486` / #495, live gate PASSED)
+- **Design:** [`2026-07-15-modbus-rtu-driver-design.md`](2026-07-15-modbus-rtu-driver-design.md)
+- **Implementation plan:** [`2026-07-24-modbus-rtu-driver.md`](2026-07-24-modbus-rtu-driver.md) · [`.tasks.json`](2026-07-24-modbus-rtu-driver.md.tasks.json) — **11 tasks** (1 trivial / 5 small / 2 standard / 3 high-risk), all complete via subagent-driven-development.
+- **Scope:** extend the existing Modbus driver with a `Transport` selector (RTU CRC-16 + FC-aware
+  length, no TxId) + a `rtu_over_tcp` `pymodbus` docker profile + the AdminUI selector.
+  **Direct-serial transport is descoped** (user, 2026-07-15) — RTU-over-TCP via a serial→Ethernet
+  gateway is the only shipped mode, so there is no serial hardware gate.
+- **Fixture:** added the `rtu_over_tcp` profile (`framer=rtu`, host `:5021`, co-runs with `standard`)
+  to the Modbus integration fixture. **Unknown confirmed:** pymodbus 3.13's simulator DOES honour
+  `framer=rtu` on a TCP server (wire-probed a pure RTU FC03 response, no MBAP) — so the simple profile
+  path was taken; **no stdlib fallback server was needed.**
+- **Verification (all green):** unit suite **344/344**; full solution build 0 errors; the 2 RTU
+  integration tests pass **live** against the real `framer=rtu` fixture (read HR5→5, write+readback
+  HR200←4242). Per-task review chain (spec + code reviewers) + a final whole-branch review, all
+  approved-to-merge.
+- **Live `/run` gate — PASSED (2026-07-24, docker-dev rebuilt from this branch):**
+  - AdminUI `/raw` Modbus **driver** config modal renders the new **Transport** selector (with the
+    operator hint) — set to `RtuOverTcp`, saved.
+  - **Device Test Connect → `OK · 23 MS`** — the probe built a `ModbusRtuOverTcpTransport` via the
+    factory and spoke **FC03 over real RTU framing** to `10.100.0.35:5021`.
+  - Authored raw tags HR5 (r/o) + HR200 (r/w) → **deployment `06ec1632` Sealed** (all 6 nodes acked).
+  - Client.CLI on `opc.tcp://localhost:4840` (`multi-role`/`password`): **read** `ns=2;s=rtu-gate/Device1/HR5`
+    → **5, Good**; **write** `ns=2;s=rtu-gate/Device1/HR200` = 4242 → readback **4242, Good**.
+- **Effort:** **S — the lowest on the roadmap.** Delivered first, as recommended.
+
+### SQL poll — ✅ Done (merged `4ad54037`, live gate PASSED)
+- **Design:** [`2026-07-15-sql-poll-driver-design.md`](2026-07-15-sql-poll-driver-design.md)
+- **Implementation plan:** [`2026-07-24-sql-poll-driver.md`](2026-07-24-sql-poll-driver.md) · [`.tasks.json`](2026-07-24-sql-poll-driver.md.tasks.json) — **22 tasks, all done**. `ISqlDialect` + `SqlServerDialect` shipped; Postgres/ODBC remain deferred to P2/P3 behind the same seam.
+- **Post-merge follow-ups closed** in `28c28667`: #496 catalog identifier-validation gate
+  (`4dc2ad80`), #497 wrong status-code constants across six drivers, #498 deploy-gate rejection of a
+  persisted `connectionString` (`1919a8e5`).
+- **Scope:** a bespoke schema-browser driver polling a SQL table into equipment tags (SQL Server
+  shipped; Postgres/ODBC deferred behind `ISqlDialect`).
+- **Fixture:** SQLite unit fixture (primary) + an **env-gated integration fixture against the
+  existing central SQL Server** (`10.100.0.35,14330`) with a seeded `SqlPollFixture` DB. The
+  blackhole/timeout live-gate pauses a **dedicated** `mssql` container — **never** the shared
+  central SQL Server (it hosts `ConfigDb`).
+- **Effort:** S–M.
+
+---
+
+## Wave 2 — strategic telemetry / UNS pair ✅
+
+Both CI-simulatable on the shared docker host, no hardware.
+
+### MTConnect Agent — ✅ Done (P1 Agent MVP)
+- **Design:** [`2026-07-15-mtconnect-driver-design.md`](2026-07-15-mtconnect-driver-design.md)
+- **Implementation plan:** [`2026-07-24-mtconnect-driver.md`](2026-07-24-mtconnect-driver.md) · [`.tasks.json`](2026-07-24-mtconnect-driver.md.tasks.json) — **23 tasks; 22 built, Task 21 (live `/run` gate) tracked separately in the plan file.**
+- **Driver guide:** [`docs/drivers/MTConnect.md`](../drivers/MTConnect.md) — config keys, capability
+  surface, data-plane precedence rules, quality-code mapping, and (most load-bearing) the **Known
+  limitations** section.
+- **Scope shipped:** `IDriver`+`ITagDiscovery`+`IReadable`+`ISubscribable`+`IHostConnectivityProbe`+`IRediscoverable`
+  (deliberately no `IWritable` — read-only Agent surface), browse **free via the Wave-0 universal
+  browser** (`SupportsOnlineDiscovery=true`, no browser project), typed AdminUI tag editor,
+  `UNAVAILABLE→BadNoCommunication` mapping, CONDITION-as-`String`, ring-buffer re-baseline paging
+  (both the sequence-gap and `OUT_OF_RANGE` legs).
+- **Diverged from the design:** Task 0/6/7 dropped the planned TrakHound `MTConnect.NET-Common`/`-HTTP`
+  dependency entirely — the pinned packages ship no XML formatter and the HTTP stream client has no
+  injectable handler to test behind the driver's seam. Parsing is hand-rolled `System.Xml.Linq`,
+  matching on `LocalName` only (namespace-agnostic, so 1.3–2.x all parse). See the driver guide's
+  "Built vs. planned" section.
+- **Test results:** MTConnect unit suite 491/491; integration suite 12/12 against a real Agent
+  (`mtconnect/agent:2.7.0.12`, **not** `mtconnect/cppagent` — that Docker Hub repo doesn't exist);
+  skips cleanly (12 Skipped) offline. AdminUI 749/749; full solution 0 build errors.
+- **Deferred (documented, not built):** write-back via MTConnect Interfaces (design §3.6); P1.5
+  CONDITION→native Part-9 alarms, `TIME_SERIES` array materialization, EVENT→enum vocab (design §9);
+  P2 SHDR adapter ingest (design §9). Also two pre-existing fleet-wide gaps this build surfaced
+  rather than caused: `IRediscoverable`/`IHostConnectivityProbe` have no server-side consumer (eight
+  drivers besides Galaxy), and no driver form blocks Save on a required-field validation error.
+- **Fixture:** canned XML unit fixtures (bulk of coverage) + a dockerized `mtconnect/agent` +
+  stdlib-SHDR-adapter integration fixture (env-gated), deployed at `/opt/otopcua-mtconnect/` on the
+  shared docker host. See the fixture's own
+  [`Docker/README.md`](../../tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.MTConnect.IntegrationTests/Docker/README.md).
+- **Effort:** S–M, hand-rolled (the TrakHound estimate in the design doc did not apply once that
+  path was ruled out).
+
+### MQTT / Sparkplug B — ✅ **COMPLETE** (P1 + P2, both live-gated)
+- **Design:** [`2026-07-15-mqtt-sparkplug-driver-design.md`](2026-07-15-mqtt-sparkplug-driver-design.md)
+- **Implementation plan:** [`2026-07-24-mqtt-sparkplug-driver.md`](2026-07-24-mqtt-sparkplug-driver.md) · [`.tasks.json`](2026-07-24-mqtt-sparkplug-driver.md.tasks.json) — **27 tasks, all done** (P1 plain MQTT = Tasks 0–14; P2 Sparkplug B = Tasks 15–26).
+- **Scope delivered:** P1 plain MQTT (MQTTnet-5 connect/TLS/auth + hand-rolled reconnect, subscribe→
+  `OnDataChange`, retained last-value read, `#`-observation browser); P2 Sparkplug B ingest
+  (vendored Tahu proto + `Grpc.Tools` codegen, birth/alias/seq-gap/rebirth state machine,
+  death→STALE, birth-driven browse tree, scoped Request-rebirth NCMD, typed tag editor).
+  **Write-through (`IWritable`) is deferred to P3** — every MQTT node materializes read-only.
+- **Fixture:** Mosquitto TLS+auth broker + JSON publisher sidecar, **live** at `10.100.0.35:8883`
+  (`:1883` plaintext-but-authenticated); stack `/opt/otopcua-mqtt`, compose in
+  `tests/Drivers/….Driver.Mqtt.IntegrationTests/Docker/`. Env-gated live suite
+  (`MQTT_FIXTURE_ENDPOINT`, see `infra/README.md` §3). The **project-owned C# Sparkplug edge-node
+  simulator** (`--profile sparkplug`, group `OtOpcUaSim`, nodes `EdgeA`/`EdgeB`, `EdgeA` device
+  `Filler1`) shipped with P2 and answers rebirth NCMDs.
+- **P2 status (2026-07-25):** Tasks 15–26 complete. **Offline 1528 passed / 0 failed**
+  (581 driver · 809 AdminUI · 138 Core.Abstractions); **live 15/15** against the broker + simulator.
+- **P1 live gate found two AdminUI authoring gaps** (the gate's whole point — both invisible to green
+  unit tests, because AdminUI has no bUnit and nothing tied these hand-maintained lists to
+  `DriverTypeNames`):
+  1. **FIXED —** `RawDriverTypeDialog`'s option array never got an MQTT row, so **no operator could
+     create an MQTT driver at all**. Fixed, plus a reflection parity guard
+     (`RawDriverTypeDialogParityTests`) that fails for *any* future `DriverTypeNames` entry
+     missing from the picker.
+  2. **FIXED —** `MqttDriverForm` / `MqttDeviceForm` did not exist, so the broker connection was
+     unauthorable from the AdminUI. Both shipped after the P1 gate.
+- **P2 live gate found a third one, of the same family — FIXED:** `MqttDriverForm` still carried its
+  P1 Sparkplug **placeholder**. Switching Mode to `SparkplugB` rendered a *"not available yet"* notice
+  and **no Group ID field** — so once Sparkplug ingest shipped there was still **no way to author a
+  Sparkplug driver from the AdminUI**, and `Sparkplug.GroupId` is the driver's entire subscription
+  filter (`spBv1.0/{GroupId}/#`): blank ⇒ connected, `Healthy`, ingesting nothing. Fixed (all five
+  Sparkplug keys, merge-not-replace on save, group-id segment validation) + 8 falsifiable
+  `MqttDriverFormModelTests` cases. **Three gates, three instances of the same defect class: a
+  hand-maintained AdminUI surface left behind by a driver-side feature.**
+- **P2 live gate — two open UI gaps, documented not fixed** (see `docs/drivers/Mqtt.md` §Known gaps):
+  - **A completely empty browse tree cannot arm a rebirth.** The scope comes from a tree click, so on
+    a plant that has not birthed since the window opened `Request rebirth…` stays disabled — the very
+    case the affordance exists for. `MqttBrowseSession.ResolveRebirthTargets` already accepts a bare
+    `{group}/{edgeNode}` ("the prime rebirth target"); only a UI path to enter one is missing.
+    Mitigation shipped: a **Refresh** button on the browse tree (it re-reads the same session, which
+    previously rendered exactly once at open and never again).
+- **P2 live gate also found a PRE-EXISTING, cross-driver AdminUI defect — FIXED:** every node label in
+  the shared `DriverBrowseTree` was an `<a href="#">`. In a Blazor Web App, `blazor.web.js`'s
+  enhanced-navigation click interceptor resolves a bare `#` against `<base href="/">`, so **clicking
+  any browse-tree node label navigated the whole AdminUI to `/`**, tore down the circuit and destroyed
+  the hosting modal — losing the browse session and the tag selection. `@onclick:preventDefault` does
+  not help: it suppresses the browser's default action, not Blazor's own interceptor. The labels are
+  now `<button type="button">`. It dates to the component's introduction (2026-05-28) and affects
+  **every** driver's picker; it only surfaced now because Sparkplug's Request-rebirth is the first
+  feature that requires clicking a *label* rather than the ▶ toggle (always a `<button>`, always fine).
+  - **A metric name containing `/` cannot be browse-committed.** The derived raw **tag Name** is a
+    RawPath segment and may not contain `/`, while `metricName` legitimately may — so the
+    spec-mandatory `Node Control/Rebirth` is refused at commit (`Row N: Name must not contain '/'`).
+    The refusal is loud and all-or-nothing, never a silently mis-bound tag, and **Manual entry** is
+    the working path (the Sparkplug tag editor accepts a slashed metric name). Fixing it needs a
+    name-sanitisation policy with a collision answer, so it was recorded rather than guessed at.
+  - `_canRebirth` is captured at browse-open, so a reaped session still draws the button.
+  - The tag editor injects the Plain-only `payloadFormat` key into a Sparkplug blob — cosmetic; the
+    factory routes on the Sparkplug tuple and ignores it.
+- **Rediscovery is inert in v3 (platform gap, not MQTT's).** The Sparkplug driver raises
+  `OnRediscoveryNeeded` on a changed birth metric-set, but **nothing subscribes to it** and
+  `DriverHostActor.HandleDiscoveredNodes` hard-returns. A DBIRTH introducing a metric does **not**
+  change the OPC UA tree — redeploy. Driver-side behaviour is log-observable only.
+- **Redundant-pair hazard (documented, not a code change):** both nodes of a pair run the driver, so a
+  **fixed `clientId` makes them evict each other forever** — the broker logs
+  `already connected, closing old connection` and both nodes reconnect every ~2 s while still
+  reporting `Healthy`. Unset (the default) is correct. `MqttDriverForm` warns inline the moment a
+  value is typed.
+- **Effort:** M–L, delivered. The MQTTnet-5/net10 + central-pinning risk is **retired** (Task 0's
+  spike held through both phases); Sparkplug state-machine correctness was carried by golden-payload
+  vectors + the live simulator.
+
+---
+
+## Next actions
+
+1. **Close the Wave-0 live gate** (Gitea #468) — unblocks browse verification for BACnet (MTConnect
+   shipped its own Task-21 live `/run` gate independently — see the plan file).
+2. **Wave 1 is done.** Both deliverables shipped and live-gated: **Modbus RTU-over-TCP** (merged
+   `0f38f486` / #495) and **SQL poll** (merged `4ad54037`; follow-ups #496/#497/#498 closed in
+   `28c28667`). Remaining SQL work is optional follow-on — Postgres/ODBC dialects behind
+   `ISqlDialect`, and `SqlTagModel.Query` (P3, currently rejected end-to-end by design).
+3. **Wave 2 is done.** Both deliverables shipped and live-gated: **MQTT / Sparkplug B** (P1 + P2) and **MTConnect Agent** (P1 Agent MVP, PR #506). Remaining work on both is optional follow-on — MQTT P3 write-through (`IWritable`: NCMD/DCMD + plain publish) plus its two browse-UI
+   gaps, and MTConnect write-back (deliberately deferred; the Agent surface is read-only).
+
+Update this file's Summary table and per-wave status whenever a deliverable changes state.
@@ -0,0 +1,132 @@
+# Per-cluster mesh Phase 6 — live gate record
+
+> **Exit gate for Phase 6** (mesh partition). Bring up the rewritten docker-dev rig
+> (three independent 2-node Akka meshes) against **merged master** and prove every
+> previously-live-gated behaviour *per pair*, plus the split itself.
+>
+> Merge landed first (`origin/master` @ `2839deb5`, "merge now, gate after"); this gate
+> runs against the merged code and **fixes forward on master** if anything surfaces.
+
+**Rig topology** (docker-dev, local OrbStack):
+
+| Mesh | Nodes | Roles | OPC UA (host) | Seeds (self-first, pair-local) |
+|---|---|---|---|---|
+| MAIN | central-1, central-2 | `admin,driver,cluster-MAIN` | 4840 / 4841 | own pair only |
+| SITE-A | site-a-1, site-a-2 | `driver,cluster-SITE-A` | 4842 / 4843 | own pair only |
+| SITE-B | site-b-1, site-b-2 | `driver,cluster-SITE-B` | 4844 / 4845 | own pair only |
+
+- Akka port 4053 (per container); telemetry gRPC `:4056`; ConfigServe `:4055` (central);
+  LocalDb sync `:9001` (site-a); AdminUI `http://localhost:9200` (Traefik → central-1/2).
+- Transports: `MeshTransport__Mode=ClusterClient` (all), `Telemetry__Mode=Grpc` (all six),
+  `TelemetryDial__Mode=Grpc` (central pair). Secrets replication pair-local.
+- Deploy: `POST http://localhost:9200/api/deployments`, header `X-Api-Key: docker-dev-deploy-key`.
+
+---
+
+## Legs
+
+| # | Leg | Status | Evidence |
+|---|---|---|---|
+| 1 | Three meshes form — each node sees ONLY its own pair (2 members) | ✅ PASS | each node handshakes ONLY its pair partner |
+| 2 | Two+ Primaries, one per pair; ServiceLevel 250/240 within each pair | ✅ PASS | MAIN central-2=250/central-1=240; SITE-A site-a-1=250/site-a-2=240; SITE-B site-b-1=250/site-b-2=240 |
+| 3 | Deploy reaches all clusters over per-cluster ClusterClient; seals green | ✅ PASS | "Deployment 019dbd99… sealed (acks=6)"; all 6 NodeDeploymentState rows acked; one ClusterClient per site cluster |
+| 4 | Telemetry per cluster over gRPC (:4056); pills live; kill/reconnect ~5s | ✅ PASS | central-1 6 outbound :4056 dials, each site node 2 inbound (both admin dial in), 0 failures/30s; site-b restart failed→recovered the streams |
+| 5 | Reconciler quiet — no `EnabledRowNotInCluster` for foreign rows | ✅ PASS | central-2 reconciler: "reconcile with cluster membership (2 driver members)" — own MAIN pair only; 0 foreign-row errors |
+| 6 | Secrets pair-local — no cross-mesh replication / no unreachable-peer errors | ✅ PASS (by fallback criterion) | 0 secret errors fleet-wide; DPS topic rides each pair's isolated mesh (Leg 1) ⇒ structurally pair-local |
+| 7 | Split validator — a site node flipped to `MeshTransport__Mode=Dps` refuses to boot | ✅ PASS | "Cluster:Roles declares a cluster-SITE-B role … MeshTransport:Mode is 'Dps' … set MeshTransport:Mode=ClusterClient" |
+| 8 | Failover within a pair — kill a Primary, Secondary takes over (auto-down 1-vs-1) | ✅ PASS | killed site-a-1 (Primary); site-a-2 auto-downed it, took the singleton, 240→250, survived alone (auto-down 1-vs-1 = deferred Phase 0a gate, now proven) |
+
+**Phase 6 exit gate: MET.** All 8 legs pass. Three findings fixed forward on master (`3a4ed8dd` product
+boot-crash, `792f28ec` rig LDAP + split-brain serialization). One test-methodology note: the Leg 7
+`compose run … site-b-2` throwaway shares the `site-b-2` network alias and briefly disrupted the SITE-B
+Akka association — restart the affected pair after that probe (done), or run the validator check via a
+container that does not join the compose network alias.
+
+---
+
+## Findings
+
+### FINDING 1 (fix-forward on master) — boot-crash: `StackOverflowException` on EVERY node
+
+**Symptom.** First `up` of the fresh Phase-6 images: all six nodes crash at startup with
+`Stack overflow.` — an infinite recursion entering through
+`ZB.MOM.WW.OtOpcUa.Cluster.ServiceCollectionExtensions.WithOtOpcUaClusterBootstrap`.
+
+**Root cause (Phase 6, Task 2 wiring).** `Program.cs` resolved `IClusterRoleInfo` **eagerly, inside
+the `AddAkka` configurator lambda**:
+
+```csharp
+ab.WithOtOpcUaClusterRedundancySingleton(sp.GetRequiredService<IClusterRoleInfo>());  // line 385
+```
+
+That lambda runs *while the `ActorSystem` is being constructed*, but `ClusterRoleInfo`'s ctor
+**depends on the `ActorSystem`** (it is a live `Cluster.State` view). Resolving it there forces a
+nested `ActorSystem` build → re-runs the same configurator → `sp.GetRequiredService<IClusterRoleInfo>()`
+again → ∞. The cycle:
+`WithOtOpcUaClusterBootstrap → GetService<IClusterRoleInfo> → ActorSystemFactory → WithOtOpcUaClusterBootstrap → …`
+
+**Why merge + build + tests + reviews all missed it.** It compiles cleanly (a *runtime* DI cycle,
+not a compile error). `RedundancyStateSingletonRehomeTests` boots a real host but passes a hand-built
+`FakeClusterRoleInfo` **directly** into the extension — it never exercised the `sp.GetRequiredService`
+line in the composition root that overflows. The bug lived in `Program.cs`, which every test mocked
+around. Only a real boot of the shipped image surfaces it — precisely the live gate's job.
+
+**Fix.** Derive the singleton's cluster-role scope from `AkkaClusterOptions` (pure config, no
+ActorSystem) instead of `IClusterRoleInfo`:
+- `BuildClusterRedundancySingletonOptions(AkkaClusterOptions)` + `WithOtOpcUaClusterRedundancySingleton(AkkaClusterOptions)`
+  — derive `Role = clusterOptions.Roles.FirstOrDefault(RoleParser.IsClusterRole) ?? RoleParser.Driver`
+  (identical to `ClusterRoleInfo.ClusterRole`, which derives from the same config).
+- `Program.cs` passes `sp.GetRequiredService<IOptions<AkkaClusterOptions>>().Value` — `IOptions<>` has
+  no ActorSystem dependency, breaking the cycle.
+- Tests updated to pass `AkkaClusterOptions { Roles = … }`. 5/5 rehome tests pass; Host builds clean.
+
+Files: `Program.cs`, `ControlPlane/ServiceCollectionExtensions.cs`, `RedundancyStateSingletonRehomeTests.cs`.
+Status: **FIXED + live-verified** — rebuilt image boots with zero stack-overflow lines; all six nodes
+start; cluster singletons form (`redundancy-state` identified per mesh). 5/5 rehome tests pass.
+
+### FINDING 2 (fix-forward on master) — driver-only site nodes crash: LDAP options fail validation
+
+**Symptom.** site-a-1/site-a-2/site-b-1/site-b-2 crash at `Host.StartAsync` with
+`OptionsValidationException: LDAP transport is None (plaintext) but AllowInsecure is false`.
+
+**Root cause (Task 7 rig).** Only central-1/central-2 carried the `Security__Ldap__*` env block; the
+compose even asserted "Only the admin-role central nodes carry" it. But the site nodes serve OPC UA
+endpoints (4842-4845) and LDAP options are validated at boot on every node (appsettings default
+`Enabled=true`, `Transport=None`, `AllowInsecure=false` ⇒ throw). The site nodes overrode `environment`
+wholesale (YAML `<<:` does not deep-merge `environment`), so they inherited no LDAP config. `docker
+compose config` validates the file but never boots the app, so this passed the Task 7 acceptance check.
+
+**Fix (rig).** Extracted the LDAP block to a shared `&ldap-env` anchor merged into **every** host node
+(`<<: [*secrets-env, *ldap-env]`); corrected the two misleading header comments. Site nodes now boot.
+
+### FINDING 3 (fix-forward on master) — site pairs split-brain at simultaneous startup (250/250)
+
+**Symptom.** Both nodes of each site pair logged `is JOINING itself ... and forming a new cluster` and
+each elected itself Primary → ServiceLevel **250/250** instead of 250/240. Each pair was two independent
+1-node clusters, not one 2-node mesh.
+
+**Root cause (Task 7 rig — a startup race, not a code defect).** Both pair nodes are self-first seeds
+(`seed[0]=self`), so both run Akka's `FirstSeedNodeProcess` and can form alone. The partner
+(site-a-2/site-b-2) only `depends_on` sql/central/migrator — **not its pair founder** — so the pair
+started simultaneously and each formed its own cluster before discovering the other. The central pair
+avoids this only because central-2 `depends_on central-1` (and even then won the InitJoin race by luck).
+`depends_on: service_started` is insufficient — it fires when the container launches, before Akka binds.
+This is an inherent property of symmetric self-first seeding (present for central since #459), now
+extended to sites; **carry to Phase 7** as a production concern (simultaneous cold-start of both pair
+VMs). NOTE: two separate 1-node clusters do NOT merge via SBR — auto-down resolves partitions of one
+cluster, not two independent clusters.
+
+**Fix (rig).** Added an `&akka-founder-healthcheck` (bash `/dev/tcp` probe of Akka port 4053; the image
+has no nc/curl) to site-a-1/site-b-1, and switched site-a-2/site-b-2 to `depends_on: { site-a-1:
+service_healthy }`. The founder now binds + forms its mesh before the partner starts, so the partner
+JOINS it. Verified: site-a-2/site-b-2 log `Welcome from <founder>` (joined), ServiceLevel 250/240.
+
+---
+
+## Evidence log
+
+- **Leg 1** — join handshakes: central-1↔central-2, site-a-1↔site-a-2, site-b-1↔site-b-2; no node
+  handshakes a node outside its pair. central *dials* site nodes over ClusterClient/telemetry (Akka
+  association + gRPC), which is the split-topology transport, NOT gossip membership.
+- **Leg 2** — `Client.CLI redundancy` per endpoint: 4840 central-1=240, 4841 central-2=250, 4842
+  site-a-1=250, 4843 site-a-2=240, 4844 site-b-1=250, 4845 site-b-2=240. One Primary per pair.
@@ -0,0 +1,540 @@
+# Per-Cluster Mesh Phase 6 — Mesh Partition + Co-location Topology
+
+> **For Claude:** REQUIRED SUB-SKILL: execute this plan task-by-task with
+> superpowers-extended-cc:subagent-driven-development (the established mode for this workstream).
+
+**Goal:** Split OtOpcUa's single fleet-wide Akka mesh into **one 2-node mesh per application
+`Cluster`** (central pair + one pair per site), so every Primary-gated decision and every gated
+resource shares one pair-local scope — the ScadaBridge shape. Same ActorSystem name (`otopcua`)
+everywhere; separation is by **seed-node partitioning** only.
+
+**Architecture:** Each pair's two nodes list only each other as seeds (self-first), so Akka forms
+three independent meshes even on a shared network. Driver nodes carry a new `cluster-{ClusterId}`
+role; the one pair-local singleton (`RedundancyStateActor`) re-scopes to it and is spawned on every
+driver node, so each pair elects its own Primary and publishes `redundancy-state` on its own mesh's
+DPS. Central (admin) reaches each site mesh over the explicit Phase 2/3/5 transports (ClusterClient
+ ConfigServe gRPC + telemetry gRPC), now partitioned **one ClusterClient per cluster**. The five
+admin singletons stay on the central pair. Two admin-side consumers that assumed fleet-wide gossip
+visibility (`ClusterNodeAddressReconciler`, `CentralCommunicationActor.RebuildClient`) are
+re-scoped. Secrets replication becomes **pair-local** automatically (Akka DPS within each 2-node
+mesh; no fleet-wide sync, no central-SQL dependency — consistent with Phase 4). A startup validator
+refuses to boot a split-configured node (one carrying a `cluster-` role) that is still pointed at a
+DPS transport mode, and the compiled transport defaults flip to the split-correct values.
+
+**Tech Stack:** .NET 10, Akka.NET + Akka.Hosting (`WithSingleton`/`WithActors`), Akka.Cluster.Tools
+(ClusterClient + ClusterSingleton + DistributedPubSub), Akka.Cluster.Hosting `ClusterSingletonOptions`,
+xUnit + Shouldly, docker-dev compose rig.
+
+**Decisions settled with the user 2026-07-24 (recon-driven; the first contradicts the program doc's
+own guess):**
+1. **Secrets after split = pair-local Akka.** The program doc guessed "SQL-hub mode like ScadaBridge,"
+   but recon showed sites have **no SQL Server** (the point of Phase 4), so a SQL hub would force site
+   nodes back onto central SQL. Instead: leave the `AddZbSecretsAkkaReplication` wiring untouched — it
+   becomes per-pair for free once each mesh is two nodes. Fleet-wide secret sync is dropped by design;
+   document it. No library re-wire.
+2. **DPS branch disposition = flip + change defaults + validator, keep the code.** The rig flips to
+   `ClusterClient`/`Grpc`/`FetchAndCache`; the compiled defaults change so a fresh deploy is
+   split-correct; the DPS branch code stays as dark switches; a new startup validator makes a
+   split-configured node refuse to boot on a DPS transport mode (neutralizes the silent-break footgun
+   without a large irreversible deletion). `redundancy-state`/`fleet-status` stay on DPS either way.
+3. **Rig scope = OtOpcUa-only per-cluster meshes.** Rewrite docker-dev into 3 independent 2-node
+   meshes on a single shared network (faithful to production, where separation is by seeds over a WAN,
+   not by network isolation). Physical co-location with ScadaBridge is documented as the production
+   topology, not literally run in docker-dev.
+
+**Authoritative context (read before implementing):**
+- `docs/plans/2026-07-22-per-cluster-mesh-program.md` §"Phase 6" (lines 266–284) + the tracking table.
+- `docs/plans/2026-07-21-per-cluster-mesh-design.md` §4 (oldest-Up election, already fixed), §5
+  (target architecture), §7 (sequencing).
+- Recon findings (this session) — summarized inline per task below.
+
+---
+
+## What Phase 6 does NOT change (scope guards)
+
+- **ActorSystem name stays `otopcua`.** Do not rename it or make it per-cluster.
+- **`AkkaClusterOptions` gains no new property.** `SeedNodes` + `Roles` already carry per-node values
+  from config; the split is in *how they're populated per pair* (rig/appsettings) + the `RoleParser`
+  allow-list + singleton scoping. Do not add a `ClusterId` option — every `ClusterNode` row is already
+  defined to be a driver node (Phase 1 decision), and roles are the declaration of record.
+- **`SelectDriverPrimary` election logic is unchanged.** It filters on the `driver` role over
+  `Cluster.State.Members`; after the split that set is pair-local, so it elects the oldest of two.
+  No edit to the algorithm.
+- **The five admin singletons stay admin-scoped** (`config-publish`, `admin-operations`,
+  `audit-writer`, `fleet-status`, `cluster-node-address-reconciler`). Only `redundancy-state`
+  re-homes.
+- **`DriverMemberCount()`** in `DriverHostActor`/`ScriptedAlarmHostActor` needs **no code change** —
+  it reads whole-mesh members filtered by `driver`, which becomes pair-local for free. (Note the
+  semantics change in docs; do not "fix" it in code.)
+- **Do NOT delete the DPS command/telemetry branches** (decision 2). Do NOT switch the network to
+  per-site isolation or wire in ScadaBridge (decision 3). Do NOT re-wire secrets to SQL (decision 1).
+
+---
+
+### Task 0: `RoleParser` accepts `cluster-{ClusterId}`; consolidate the `driver` role literal
+
+**Classification:** small
+**Estimated implement time:** ~4 min
+**Parallelizable with:** none (blocks 1, 2, 5, 7)
+
+**Context:** `RoleParser.Allowed` is a fixed `HashSet {"admin","driver","dev"}`
+(`src/Core/ZB.MOM.WW.OtOpcUa.Cluster/RoleParser.cs:5-8`). A `cluster-{ClusterId}` role fails it, so
+no node can carry one. Also, three independent `"driver"` string literals exist
+(`RedundancyStateActor.DriverRole`, `ClusterNodeAddressReconcilerActor.DriverRole`,
+`Runtime/ServiceCollectionExtensions.DriverRole`) — consolidate to a single source now since every
+Phase 6 task touches role code.
+
+**Files:**
+- Modify: `src/Core/ZB.MOM.WW.OtOpcUa.Cluster/RoleParser.cs`
+- Test: `tests/Core/ZB.MOM.WW.OtOpcUa.Cluster.Tests/RoleParserTests.cs` (create if absent)
+
+**Steps:**
+1. Add a well-known-roles surface to `RoleParser` (or a new `ClusterRoles` static): constants
+   `Admin = "admin"`, `Driver = "driver"`, `Dev = "dev"`, `ClusterRolePrefix = "cluster-"`, and a
+   helper `bool IsClusterRole(string role) => role.StartsWith(ClusterRolePrefix, StringComparison.Ordinal) && role.Length > ClusterRolePrefix.Length`.
+2. Change `Parse` validation: a role is allowed if it is one of the three fixed roles **or**
+   `IsClusterRole(role)` is true. Keep the existing trim/lowercase/empty-filter behavior. A role of
+   exactly `"cluster-"` (empty ClusterId) is **rejected**.
+3. Add `RoleParser.ClusterIdFromRole(string) => role.Substring(ClusterRolePrefix.Length)` returning
+   the ClusterId for a cluster role (used by later tasks).
+4. Update `RedundancyStateActor.DriverRole`, `ClusterNodeAddressReconcilerActor.DriverRole`, and
+   `Runtime/ServiceCollectionExtensions.DriverRole` to reference the single `RoleParser.Driver` (keep
+   the public `const`/`static readonly` symbols as aliases if any test references them by their old
+   name — grep first; do not break existing test references).
+5. Tests: `admin`/`driver`/`dev`/`cluster-MAIN`/`cluster-SITE-A` accepted; `cluster-` rejected;
+   `bogus` rejected; case/whitespace normalization preserved; `ClusterIdFromRole("cluster-SITE-A") == "SITE-A"`.
+
+**Acceptance:** `dotnet test tests/Core/ZB.MOM.WW.OtOpcUa.Cluster.Tests` green; `cluster-{X}` roles
+parse; the three literals resolve to one constant.
+
+---
+
+### Task 1: `ClusterRoleInfo` exposes the node's own cluster-scoped role
+
+**Classification:** small
+**Estimated implement time:** ~4 min
+**Parallelizable with:** none (needs Task 0; blocks 2, 5)
+
+**Context:** Singleton registration and the validator both need "what is *this* node's
+`cluster-{ClusterId}` role." `ClusterRoleInfo` (`src/Core/ZB.MOM.WW.OtOpcUa.Cluster/ClusterRoleInfo.cs`,
+`IClusterRoleInfo`, registered in `AddOtOpcUaCluster`) is the existing role/leader authority — extend
+it.
+
+**Files:**
+- Modify: `src/Core/ZB.MOM.WW.OtOpcUa.Cluster/ClusterRoleInfo.cs`
+- Modify: `src/Core/ZB.MOM.WW.OtOpcUa.Cluster/IClusterRoleInfo.cs` (or wherever the interface lives)
+- Test: `tests/Core/ZB.MOM.WW.OtOpcUa.Cluster.Tests/ClusterRoleInfoTests.cs`
+
+**Steps:**
+1. Add `string? ClusterRole { get; }` (e.g. `"cluster-SITE-A"`) and `string? ClusterId { get; }` (e.g.
+   `"SITE-A"`) to `IClusterRoleInfo`, derived from the configured `AkkaClusterOptions.Roles` via
+   `RoleParser.IsClusterRole` (first match; log a Warning and pick the first if >1 cluster role is
+   configured — that is a misconfiguration). Null when the node carries no cluster role (e.g. a
+   pre-split/admin-only-legacy node).
+2. Do NOT read `Cluster.State` for this — it is the node's **own configured** identity, available
+   before the cluster forms (the singleton registration runs at host build time).
+3. Tests: a node configured `["driver","cluster-SITE-A"]` reports `ClusterRole="cluster-SITE-A"`,
+   `ClusterId="SITE-A"`; a node `["admin","driver"]` reports both null; two cluster roles → first wins
+   + warning path exercised.
+
+**Acceptance:** `ClusterRoleInfo` reports the node's cluster role/id from config; tests green.
+
+---
+
+### Task 2: Re-home `RedundancyStateActor` to a `cluster-{ClusterId}` singleton on driver nodes
+
+**Classification:** high-risk
+**Estimated implement time:** ~5 min
+**Parallelizable with:** Task 3, Task 4 (disjoint files)
+
+**Context (the crux).** Today `RedundancyStateActor` is registered as an **admin** singleton
+(`ControlPlane/ServiceCollectionExtensions.cs:133-136`, `singletonOptions.Role = "admin"`), electing a
+**fleet-wide** Primary and publishing `redundancy-state` over DPS. After the split, central's mesh
+sees only its own pair — so a site pair (driver-only, no admin node) would have **no one** to elect its
+Primary. Fix: scope the singleton to the node's `cluster-{ClusterId}` role and spawn it on **every
+driver node** (`hasDriver`), so each mesh (central pair = `cluster-MAIN`, each site pair =
+`cluster-{SITE}`) has exactly one, electing its own pair-local Primary and publishing on its own mesh's
+DPS. **De-risked:** `RedundancyStateActor` has zero injected deps (verified — it only uses
+`Cluster.Get(Context.System)` + DPS), so it spawns cleanly on a driver-only node.
+
+**Files:**
+- Modify: `src/Server/ZB.MOM.WW.OtOpcUa.ControlPlane/ServiceCollectionExtensions.cs`
+  (remove `redundancy-state` from `WithOtOpcUaControlPlaneSingletons`; add a new
+  `WithOtOpcUaClusterRedundancySingleton(IClusterRoleInfo)` extension that registers it scoped to the
+  cluster role)
+- Modify: `src/Server/ZB.MOM.WW.OtOpcUa.Host/Program.cs` (call the new extension on `hasDriver`, not
+  `hasAdmin`; a fused `admin,driver` node calls it once via the driver branch)
+- Test: `tests/Server/ZB.MOM.WW.OtOpcUa.ControlPlane.Tests/...` singleton-role test; and confirm the
+  admin path no longer registers `redundancy-state`.
+
+**Steps:**
+1. In `ControlPlane/ServiceCollectionExtensions.cs`: delete the `WithSingleton` block for
+   `RedundancyStateActorKey`/`redundancy-state` from the admin method (lines ~133-136). Keep the
+   registry key type.
+2. Add:
+   ```csharp
+   public static AkkaConfigurationBuilder WithOtOpcUaClusterRedundancySingleton(
+       this AkkaConfigurationBuilder builder, IClusterRoleInfo roleInfo)
+   {
+       // Cluster-scoped when the node carries a cluster-{ClusterId} role (Phase-6 split: one
+       // redundancy singleton per pair, robust even if two meshes accidentally merged). Falls
+       // back to the driver role for a legacy single-mesh node or a test harness with no cluster
+       // role — where driver-scope is the pre-Phase-6 fleet-wide behavior, and on a genuinely
+       // split 2-node mesh the driver role is ALREADY pair-local because the mesh IS the pair.
+       // No throw: decision 2 requires legacy/harness nodes to keep booting unchanged.
+       var role = roleInfo.ClusterRole ?? RoleParser.Driver;
+       var opts = new ClusterSingletonOptions { Role = role };
+       return builder.WithSingleton<RedundancyStateActorKey>(
+           RedundancyStateActor.Topic, RedundancyStateActor.Props(), opts /* createProxyToo per existing pattern */);
+   }
+   ```
+   Match the exact `WithSingleton` overload/signature the other five singletons use (check createProxy
+   arg + singleton name conventions).
+3. In `Program.cs`: within the `if (hasDriver)` Akka-configurator block (near line 357-374, alongside
+   `WithOtOpcUaRuntimeActors`), call `ab.WithOtOpcUaClusterRedundancySingleton(clusterRoleInfo)`.
+   Resolve `IClusterRoleInfo` from `sp`. Ensure it runs on the fused central node too (central has
+   `hasDriver=true`). Do NOT also register it in the `hasAdmin` block.
+4. **No fail-fast on a missing cluster role** — the fallback keeps legacy/harness nodes booting
+   (decision 2). A *misconfigured* Phase-6 node (split transports, no cluster role) is a non-issue for
+   the redundancy singleton: driver-scope is pair-local on a split mesh anyway.
+5. Tests: assert the admin singleton set no longer contains `redundancy-state`; assert the new
+   extension registers a singleton scoped to `Role == "cluster-SITE-A"` when the roleInfo reports that;
+   assert that a roleInfo with null `ClusterRole` falls back to `Role == "driver"` (no throw).
+
+**Acceptance:** each mesh hosts exactly one `RedundancyStateActor` scoped to its cluster role; a
+driver-only site node elects its own Primary; admin path no longer owns it. Unit tests green.
+
+**Live-verified later** (Task 9 gate): two Primaries fleet-wide, one per pair.
+
+---
+
+### Task 3: Re-scope `ClusterNodeAddressReconciler` to central-mesh-visible rows
+
+**Classification:** standard
+**Estimated implement time:** ~5 min
+**Parallelizable with:** Task 2, Task 4 (disjoint files)
+
+**Context:** The admin-singleton reconciler compares `Cluster.State.Members` (driver role) against
+**every** `ClusterNode` row fleet-wide (`ClusterNodeAddressReconciler.cs:123-131`,
+`ClusterNodeAddressReconcilerActor.cs:76-96`). After the split, central sees only its own pair, so
+every site row logs `EnabledRowNotInCluster` forever (its own doc comment,
+`ClusterNodeAddressReconciler.cs:60-65`, flags this). Fix: only reconcile rows whose `ClusterId`
+matches central's own cluster — central can no longer observe other clusters via gossip, so it must
+not assert anything about their rows.
+
+**Files:**
+- Modify: `src/Server/ZB.MOM.WW.OtOpcUa.ControlPlane/Fleet/ClusterNodeAddressReconciler.cs` (filter
+  the row set by own-cluster)
+- Modify: `src/Server/ZB.MOM.WW.OtOpcUa.ControlPlane/Fleet/ClusterNodeAddressReconcilerActor.cs`
+  (pass the admin node's own `ClusterId` in; source it from `IClusterRoleInfo.ClusterId`, or from the
+  set of `ClusterId`s present among its own observed driver members)
+- Update the class doc comment (remove the "Phase 2 must revisit" note; state it is now own-cluster
+  scoped).
+- Test: `tests/.../ClusterNodeAddressReconcilerTests.cs` — a row in another cluster is **ignored** (no
+  finding); an own-cluster enabled row with no member still yields `EnabledRowNotInCluster`; drift
+  detection within own cluster still works.
+
+**The pure `ClusterNodeAddressReconciler.Reconcile` function is UNCHANGED** — the fix is entirely in
+the actor's two DB queries (`ClusterNodeAddressReconcilerActor.Reconcile`, lines 89-97), which filter
+rows by the admin node's own `ClusterId` before projecting. `ClusterNode` has a `ClusterId` column.
+
+**Steps:**
+1. Inject the admin node's own `ClusterId` into the actor: add `IClusterRoleInfo` (or just a
+   `string? ownClusterId`) to `Props`/ctor, sourced from `IClusterRoleInfo.ClusterId` at registration
+   (`ControlPlane/ServiceCollectionExtensions.cs` where the reconciler singleton is registered).
+2. In the actor's `Reconcile`, add `.Where(n => n.ClusterId == ownClusterId)` to BOTH the `rows` and
+   `enabled` queries — but ONLY when `ownClusterId` is non-null.
+3. **Null `ownClusterId` (legacy admin node with no cluster role) ⇒ reconcile ALL rows** — this is the
+   correct single-mesh behavior (a legacy admin node genuinely sees every driver member via gossip).
+   Do NOT skip. This preserves backward-compat, mirroring the Task 2 fallback philosophy.
+4. `RowDialTargetDisagrees` / `RunningNodeHasNoRow` / `EnabledRowNotInCluster` semantics are unchanged;
+   they now simply operate on the own-cluster row subset (post-split) or the full set (legacy).
+5. Update the class doc comment in `ClusterNodeAddressReconciler.cs:60-65`: replace the "Phase 2 must
+   revisit" note with the delivered own-cluster-scoped behavior.
+6. Tests (`ClusterNodeAddressReconcilerActorTests` or the existing reconciler tests — pick the level
+   that can inject `ownClusterId`): a SITE-A row is **ignored** when `ownClusterId=="MAIN"` (no
+   `EnabledRowNotInCluster`); an own-cluster (MAIN) enabled row with no member still yields
+   `EnabledRowNotInCluster`; own-cluster drift still caught; `ownClusterId==null` reconciles the full
+   set (legacy). If the actor is hard to unit-test directly, a focused query-filter test + the
+   unchanged pure-function tests suffice — say which you chose.
+
+**Acceptance:** central reconciles only MAIN rows; site rows never produce false
+`EnabledRowNotInCluster`; own-cluster drift still caught.
+
+---
+
+### Task 4: One `ClusterClient` per application `Cluster` in `CentralCommunicationActor`
+
+**Classification:** high-risk
+**Estimated implement time:** ~5 min
+**Parallelizable with:** Task 2, Task 3 (disjoint files)
+
+**Context:** `RebuildClient` (`CentralCommunicationActor.cs:271-297`) creates **one fleet-wide**
+`ClusterClient` dialing every `ClusterNode` row, and `HandleMeshCommand` (`:128-157`) does one
+`ClusterClient.SendToAll(...)`. The `TODO(Phase 6)` (`:249-268`) states this is correct only on a
+single mesh: a `ClusterClientReceptionist` serves its whole cluster, so `SendToAll` on one client
+reaches everyone. After the split, `SendToAll` on one client reaches only the mesh whose receptionist
+answered — so central needs **one client per cluster**, and dispatch fans `SendToAll` across all of
+them.
+
+**Files:**
+- Modify: `src/Server/ZB.MOM.WW.OtOpcUa.ControlPlane/Communication/CentralCommunicationActor.cs`
+- Test: `tests/Server/ZB.MOM.WW.OtOpcUa.Host.IntegrationTests/MeshClusterClientBoundaryTests.cs`
+  (extend: two separate site meshes + central, a command reaches BOTH via per-cluster clients; and a
+  single-cluster client's `SendToAll` does NOT reach the other cluster)
+
+**Steps:**
+1. `LoadContactsFromDb` (`:177-221`): return contacts **grouped by `ClusterId`** — an
+   `ImmutableDictionary<string, ImmutableHashSet<string>>` (ClusterId → receptionist contact paths).
+   Keep the `Enabled && !MaintenanceMode` filter.
+2. Replace the single `_client`/`_currentContacts` with a `Dictionary<string, (IActorRef Client,
+   ImmutableHashSet<string> Contacts)>` keyed by ClusterId. `HandleContactsLoaded` diffs **per cluster**
+   and rebuilds only the clusters whose contact set changed; stops+removes clients for clusters that
+   vanished.
+3. `RebuildClient` becomes `RebuildClient(string clusterId, ImmutableHashSet<string> contacts)` —
+   builds one `ClusterClient` per cluster (name it by clusterId so the actor paths are distinct).
+4. `HandleMeshCommand` fans out: for each cluster client, `client.Tell(new ClusterClient.SendToAll(
+   MeshPaths.NodeCommunication, cmd.Message))`. Preserve the sender-relay idiom where it exists.
+   **A command with no live clients (all clusters down) drops with a Warning**, matching today's
+   "no reachable contact" behavior — do not buffer.
+5. Update the `TODO(Phase 6)` doc block to describe the delivered per-cluster-client shape (remove the
+   TODO marker).
+6. **Frame-size note:** the deploy path stays payload-free (notify-and-fetch), so no new frame-size
+   exposure — do not add payload to these commands.
+7. Tests: extend `MeshClusterClientBoundaryTests` to two site meshes + central; assert a dispatch
+   reaches a node in each site mesh, and that per-cluster `SendToAll` is correctly partitioned.
+
+**Acceptance:** central dispatches deploy-notify/driver-control/alarm-commands to every cluster via
+one client each; the boundary test proves cross-mesh partitioned delivery; acks still return via the
+site nodes' own `ClusterClient.Send` to central (unchanged).
+
+---
+
+### Task 5: Split-topology startup validator (cluster-role ⇒ non-DPS transport)
+
+**Classification:** standard
+**Estimated implement time:** ~5 min
+**Parallelizable with:** Task 6 (disjoint files)
+
+**Context (decision 2):** the DPS branches stay as dark switches, but a node configured for the split
+topology (it carries a `cluster-{ClusterId}` role) must not silently run a transport still in DPS
+mode, which cannot cross meshes. Fail host start instead. Marker of "split topology" = the presence of
+a `cluster-` role (they exist only post-Phase-6).
+
+**Files:**
+- Create: `src/Core/ZB.MOM.WW.OtOpcUa.Cluster/SplitTopologyTransportValidator.cs` (an
+  `IValidateOptions<...>` or a startup validator wired via `AddValidatedOptions`/`ValidateOnStart`,
+  mirroring `AkkaClusterOptionsValidator`/`ConfigSourceOptionsValidator` structure)
+- Modify: `src/Core/ZB.MOM.WW.OtOpcUa.Cluster/ServiceCollectionExtensions.cs` (`AddOtOpcUaCluster`
+  registers it)
+- Test: `tests/Core/ZB.MOM.WW.OtOpcUa.Cluster.Tests/SplitTopologyTransportValidatorTests.cs`
+
+**Rule (only fires when the node carries a `cluster-` role):**
+- `MeshTransport:Mode` must be `ClusterClient` (not `Dps`) — every node.
+- If `hasDriver`: `Telemetry:Mode` must be `Grpc` (node hosts the telemetry server).
+- If `hasAdmin`: `TelemetryDial:Mode` must be `Grpc` (central dials).
+- `ConfigSource:Mode`: **do not** add a rule here — Phase 4's `ConfigSourceOptionsValidator` already
+  requires `FetchAndCache` on driver-only nodes; a fused node legitimately stays `Direct`.
+- A node with **no** `cluster-` role (legacy/pre-split) is exempt (rule does not fire), so existing
+  single-mesh deployments and tests are unaffected.
+
+**Steps:**
+1. Read `Cluster:Roles` (same direct-read pattern the other validators use — not `IClusterRoleInfo`,
+   to avoid a service-resolution ordering dependency at validation time), `MeshTransport:Mode`,
+   `Telemetry:Mode`, `TelemetryDial:Mode`.
+2. Implement the rule above; each violation adds a precise message naming the offending key + required
+   value.
+3. Register with `ValidateOnStart` so a misconfigured node refuses to boot.
+4. Tests: cluster-role node on `MeshTransport:Mode=Dps` fails; on `ClusterClient` passes; driver
+   cluster node on `Telemetry:Mode=Dps` fails; admin cluster node on `TelemetryDial:Mode=Dps` fails;
+   a non-cluster-role node on all-Dps passes (exempt).
+
+**Acceptance:** a split-configured node on any DPS transport refuses to start with a clear message;
+legacy nodes unaffected.
+
+---
+
+### Task 6: Compiled transport-mode defaults — DECIDED: do NOT flip (data-backed deviation)
+
+**Classification:** small → **resolved as a no-code decision 2026-07-24**
+**Parallelizable with:** Task 5
+
+**Original intent (decision 2):** change the compiled `MeshTransport:Mode`/`Telemetry:Mode`/
+`TelemetryDial:Mode` defaults to the split-correct values so a fresh deploy is split-correct without
+per-node overrides.
+
+**What the blast-radius assessment found (read-only, this session):** flipping the compiled defaults
+is **HIGH-RISK and low-value**. Every one of the three transport-option validators fail-closes when its
+mode is the non-Dps value but the mode's prerequisites are unset — and *nothing in the repo sets those
+sections*:
+- `MeshTransport:Mode=ClusterClient` requires `CentralContactPoints` — no `appsettings*.json` and no
+  test harness sets it → `ValidateOnStart` throws at boot.
+- `Telemetry:Mode=Grpc` requires `GrpcListenPort`+`ApiKey` on a driver node — same gap.
+- `TelemetryDial:Mode=Grpc` requires `ApiKey` with **no role gate at all** — breaks even roleless
+  fixtures and docker-dev's 4 site nodes.
+- Concretely this hard-fails **all 14 `Host.IntegrationTests`** (via `TwoNodeClusterHarness`, which
+  sets none of these), **all 5 shipped appsettings profiles**, and several unit tests asserting the
+  Dps default.
+
+**Why not flipping is correct, not a compromise:** the Task 5 `SplitTopologyTransportValidator`
+already forces `ClusterClient`/`Grpc`/`Grpc` onto **exactly** the nodes carrying a post-Phase-6
+`cluster-{ClusterId}` role, fail-closed, with a precise message — which *is* "a fresh Phase-6 deploy is
+split-correct," achieved more robustly than a default flip (a split node cannot even boot on the wrong
+transport). Flipping the compiled defaults would merely duplicate that enforcement for split nodes
+while indiscriminately breaking every legacy/test/admin node that legitimately still runs Dps. The
+docker-dev rig (Task 7) sets the modes **explicitly** on its cluster-role nodes, so it never relies on
+the default anyway.
+
+**Decision:** keep `MeshTransportOptions.Mode`/`TelemetryOptions.Mode`/`TelemetryDialOptions.Mode`
+defaults at `Dps`. No code change. Enforcement of split-correctness lives in Task 5's validator + the
+explicit Task 7 rig config. Recorded in `docs/Configuration.md` (Task 8) so the next reader knows the
+defaults are intentionally Dps and the validator is the guardrail.
+
+**Acceptance:** MET by decision — the split validator (Task 5) is the guardrail; no default flip.
+
+---
+
+### Task 7: Rewrite the docker-dev rig into three 2-node meshes
+
+**Classification:** standard
+**Estimated implement time:** ~5 min
+**Parallelizable with:** none (needs Tasks 0–6 landed to actually run; the file edit is independent
+but sequence it after code so the rig is testable)
+
+**Context (decision 3):** one shared network, seed-partitioned into three meshes. Central pair =
+`cluster-MAIN`; site-a pair = `cluster-SITE-A`; site-b pair = `cluster-SITE-B`. Each pair lists only
+its own two nodes as seeds (self-first). Flip the transports on. Secrets stays enabled (now
+pair-local). Central must remain network-reachable to site nodes (shared network — already true; do
+**not** isolate networks).
+
+**Files:**
+- Modify: `docker-dev/docker-compose.yml`
+- Modify: `docker-dev/seed/seed-clusters.sql` if any seeded address/port changes (AkkaPort stays 4053;
+  GrpcPort stays 4056 — likely no seed change, but verify the ClusterId/host columns still match).
+
+**Per-node changes:**
+| Node | `Cluster__Roles` | `Cluster__SeedNodes__0` (self) | `__1` (partner) |
+|---|---|---|---|
+| central-1 | `admin`,`driver`,`cluster-MAIN` | `akka.tcp://otopcua@central-1:4053` | `...central-2:4053` |
+| central-2 | `admin`,`driver`,`cluster-MAIN` | `akka.tcp://otopcua@central-2:4053` | `...central-1:4053` |
+| site-a-1 | `driver`,`cluster-SITE-A` | `akka.tcp://otopcua@site-a-1:4053` | `...site-a-2:4053` |
+| site-a-2 | `driver`,`cluster-SITE-A` | `akka.tcp://otopcua@site-a-2:4053` | `...site-a-1:4053` |
+| site-b-1 | `driver`,`cluster-SITE-B` | `akka.tcp://otopcua@site-b-1:4053` | `...site-b-2:4053` |
+| site-b-2 | `driver`,`cluster-SITE-B` | `akka.tcp://otopcua@site-b-2:4053` | `...site-b-1:4053` |
+
+**Transport flips (all nodes unless noted):**
+- `MeshTransport__Mode: ClusterClient` (remove the `${OTOPCUA_MESH_MODE:-Dps}` default or set the var
+  default to ClusterClient).
+- `Telemetry__Mode: Grpc` (all); `TelemetryDial__Mode: Grpc` (central pair only — the dialers).
+- `ConfigSource__Mode: FetchAndCache` already on sites; central stays `Direct`.
+- `MeshTransport__CentralContactPoints__0/1` on **site** nodes point at central-1/central-2 (unchanged
+  — sites learn central from appsettings). Central nodes do not need CentralContactPoints for
+  themselves; central discovers *site* contacts from `ClusterNode` rows (per-cluster clients, Task 4).
+- **Secrets** (`x-secrets-env` anchor): keep `Secrets__Replication__Enabled=true` — it becomes
+  pair-local automatically. Add a compose comment noting the new pair-local semantics.
+- **Remove** the `central-1`-as-seed lines from every site node (the old cross-pair seed). Update the
+  header comment block (lines 1-23) to describe three meshes, not one.
+- **LocalDb sync:** keep site-a's replication demo; optionally add a distinct sync port for site-b to
+  model per-site ports (nice-to-have, not required for the gate — if added, use a different host-safe
+  port and its own peer address).
+
+**Steps:**
+1. Rewrite the six nodes' `Cluster__Roles__*` and `Cluster__SeedNodes__*` per the table.
+2. Flip the transport-mode env vars.
+3. Update the header comment + secrets comment.
+4. `docker compose -f docker-dev/docker-compose.yml config` to validate YAML (no live bring-up in this
+   task — that is the Task 9 gate).
+
+**Acceptance:** `docker compose config` validates; the six nodes carry per-pair self-first seeds +
+cluster roles + split-correct transport modes; header comment describes three meshes.
+
+---
+
+### Task 8: Docs sweep — status tables, caveat removal, pair-local secrets note
+
+**Classification:** small
+**Estimated implement time:** ~5 min
+**Parallelizable with:** Task 7 (docs only; no build)
+
+**Files:**
+- `docs/Redundancy.md` — new §"Per-cluster meshes (Phase 6)": one Primary per pair (**two+ Primaries
+  fleet-wide, by design**), redundancy-state singleton is now `cluster-{ClusterId}`-scoped and
+  spawned per driver node; remove any single-mesh caveat. Add §"Secrets replication is pair-local".
+- `src/Server/ZB.MOM.WW.OtOpcUa.ControlPlane/Redundancy/IManualFailoverService.cs:34-35` — remove the
+  "Mesh-scope caveat / until the per-cluster mesh work lands" doc comment (it landed).
+- AdminUI ClusterRedundancy page — remove the mesh-scope caveat text (grep the Razor for the caveat
+  string).
+- `docs/Configuration.md` — document the `cluster-{ClusterId}` role, per-pair `Cluster:SeedNodes`
+  ordering, the new transport-mode defaults, and the split-topology validator.
+- `docs/plans/2026-07-22-per-cluster-mesh-program.md` — mark Phase 6 **DONE** in the section + the
+  tracking table; note the three decisions.
+- `docs/plans/2026-07-21-per-cluster-mesh-design.md` §7 — mark row 6 DONE.
+- `CLAUDE.md` — a "Per-cluster mesh (Phase 6)" note under the Redundancy section: three meshes, cluster
+  roles, one Primary per pair, pair-local secrets, per-cluster ClusterClient, reconciler own-cluster
+  scoped, transport defaults flipped + split validator.
+
+**Steps:**
+1. Write the Redundancy.md sections; remove the two caveats (IManualFailoverService + Razor).
+2. Update Configuration.md.
+3. Update the two plan status tables + CLAUDE.md.
+4. Grep for any remaining "single mesh" / "fleet-wide Primary" / "until the per-cluster mesh work
+   lands" copy and reconcile.
+
+**Acceptance:** no stale single-mesh caveats remain; status tables show Phase 6 done; secrets
+pair-local + cluster-role documented.
+
+---
+
+### Task 9: Live gate — three meshes, per-pair redundancy, cross-mesh transports
+
+**Classification:** high-risk
+**Estimated implement time:** manual (controller-run against docker-dev)
+**Parallelizable with:** none (final)
+
+**Context:** the exit gate. Bring the rewritten rig up and prove every previously-live-gated behavior
+per pair, plus the split itself. Gather TCP/log/CLI evidence; record in
+`docs/plans/2026-07-24-mesh-phase6-live-gate.md`.
+
+**Legs:**
+1. **Three meshes form.** Each node's `Cluster.State.Members` shows **only its own pair** (2 members).
+   Evidence: redundancy CLI / logs per node, or `/proc/net/tcp` showing 4053 associations only within
+   each pair. central sees central-1/2 only; site-a sees site-a-1/2 only; site-b sees site-b-1/2 only.
+2. **Two+ Primaries, one per pair.** Each pair elects its own oldest-Up driver Primary; ServiceLevel
+   **250/240** within each pair (Primary/Secondary), independently. Client.CLI `redundancy` per
+   endpoint (4840/4841 MAIN, 4842/4843 SITE-A, 4844/4845 SITE-B).
+3. **Deploy reaches all clusters over per-cluster ClusterClient.** `POST :9200/api/deployments`
+   (X-Api-Key) seals green with all six nodes acking; central's logs show one client per cluster;
+   verify a SITE-A node applies the config (its address space serves).
+4. **Telemetry per cluster over gRPC.** AdminUI `/alerts` + `/hosts` pills live; central dials each
+   site mesh's telemetry servers (2 inbound per driver node on 4056; central holds outbound per cluster).
+   Kill-and-reconnect a site node → its stream recovers (~5s).
+5. **Reconciler quiet.** central's `ClusterNodeAddressReconciler` logs **no** `EnabledRowNotInCluster`
+   for SITE-A/SITE-B rows (own-cluster scoped now); MAIN drift still caught (probe with a deliberate
+   mismatch if practical).
+6. **Secrets pair-local.** With `Secrets:Replication:Enabled=true`, a secret written on site-a-1
+   replicates to site-a-2 (same mesh) and does **not** reach central or site-b (separate meshes) — or,
+   if a live secret write is impractical, assert the DPS topic is mesh-scoped via the membership
+   evidence from leg 1 + a doc note. No errors from the secrets actor about unreachable peers.
+7. **Split validator.** Flip one site node to `MeshTransport__Mode=Dps` → it refuses to boot with the
+   Task 5 message. Restore.
+8. **Failover within a pair** (bridges toward Phase 7): kill a site pair's Primary → the Secondary
+   becomes Primary (250) and the pair survives alone (auto-down 1-vs-1 — the deferred Phase 0a gate is
+   now testable; run it if time permits and note the result for Phase 7).
+
+**Record:** `docs/plans/2026-07-24-mesh-phase6-live-gate.md` with per-leg evidence + any findings.
+**Cleanup:** restore the rig to a coherent committed state.
+
+**Acceptance:** all legs pass (or any deviation is documented + justified as in prior phases). Phase 6
+exit gate MET.
+
+---
+
+## Risk register (carry from design §8 + program)
+
+- LocalDb is load-bearing for config (unchanged; #485 class).
+- **Two+ Primaries fleet-wide is now correct, by design** — anything asserting "one Primary" is stale.
+- Partial rollout hazard: a node whose mesh is split has pair-local `DriverMemberCount`, while a
+  not-yet-split node counts fleet-wide — do not run the fleet half-split in production without the
+  drill (Phase 7).
+- Co-located VM loss takes out one node of **both** products (Phase 7 drill item; out of scope here).
+- Frame size: deploy path stays payload-free — keep it that way.
@@ -0,0 +1,24 @@
+{
+  "planPath": "docs/plans/2026-07-24-mesh-phase6-partition-and-colocation.md",
+  "program": "per-cluster-mesh",
+  "phase": 6,
+  "branch": "feat/mesh-phase6",
+  "decisions": {
+    "secrets": "pair-local Akka (no SQL-hub; sites have no SQL)",
+    "dpsBranches": "flip rig + split-topology validator; keep DPS code. NOTE: compiled defaults NOT flipped (Task 6) — blast-radius assessment showed a flip hard-fails all 14 Host.IntegrationTests + all 5 appsettings profiles + docker-dev site nodes; the Task 5 validator already enforces split-correctness fail-closed on cluster-role nodes, which is the actual intent.",
+    "rigScope": "OtOpcUa-only three 2-node meshes on one shared network"
+  },
+  "tasks": [
+    {"id": 0, "subject": "Task 0: RoleParser accepts cluster-{ClusterId}; consolidate driver literal", "classification": "small",     "status": "completed", "commit": "87ff00fd"},
+    {"id": 1, "subject": "Task 1: ClusterRoleInfo exposes node's own ClusterRole/ClusterId",           "classification": "small",     "status": "completed", "commit": "2d2f1dec", "note": "interface in Commons/Interfaces/IClusterRoleInfo.cs; ctor (ActorSystem, IOptions<AkkaClusterOptions>, ILogger)"},
+    {"id": 2, "subject": "Task 2: re-home RedundancyStateActor to cluster-role singleton on drivers",   "classification": "high-risk", "status": "completed", "commit": "a4d3ab40", "note": "re-home a2c5d57f + review fixes a4d3ab40 (comments + driver-fallback registry test + fixed a cross-task admin-boot NRE race); 14/14 tests"},
+    {"id": 3, "subject": "Task 3: re-scope ClusterNodeAddressReconciler to own-cluster rows",           "classification": "standard",  "status": "completed", "commit": "1ce2042e", "note": "impl 2535df01 + review-fix 1ce2042e (observed ALSO scoped by cluster role via testable FilterOwnClusterDriverMembers helper; 17/17)"},
+    {"id": 4, "subject": "Task 4: one ClusterClient per cluster in CentralCommunicationActor",          "classification": "high-risk", "status": "completed", "commit": "6531ec19", "note": "impl 6531ec19 + comment fix d98b3264; two-mesh boundary test proves partitioned delivery, red-before-green"},
+    {"id": 5, "subject": "Task 5: split-topology startup validator (cluster-role => non-DPS)",          "classification": "standard",  "status": "completed", "commit": "344b0d33", "note": "impl a886d5e6 + review-fix 344b0d33 (resolve EFFECTIVE roles incl OTOPCUA_ROLES fallback matching Program.cs, case-normalize -> guardrail can't be defeated by role-source/case mismatch); 16/16 filter, 124/124 Cluster.Tests"},
+    {"id": 6, "subject": "Task 6: compiled transport-mode defaults",                                    "classification": "small",     "status": "resolved-no-flip", "note": "DECIDED not to flip — blast-radius assessment: high-risk (breaks all integration tests + appsettings profiles + docker-dev site nodes), low-value (Task 5 validator already enforces split-correctness fail-closed). Documented in plan Task 6 + Configuration.md."},
+    {"id": 7, "subject": "Task 7: rewrite docker-dev rig into three 2-node meshes",                     "classification": "standard",  "status": "completed", "commit": "741ab97b", "note": "3 meshes, per-pair self-first seeds, cluster roles, transports flipped (ClusterClient/Grpc), pair-local secrets note; docker compose config validates; seed SQL already correct (GrpcPort=4056)"},
+    {"id": 8, "subject": "Task 8: docs sweep — status tables, caveat removal, pair-local secrets note", "classification": "small",     "status": "completed", "commit": "8a173bba", "note": "all 7 edits (Redundancy/Config/CLAUDE/2 plans/IManualFailoverService/ClusterRedundancy.razor); subagent died at commit step, edits reviewed+committed by controller; full-solution build clean (0 errors)"},
+    {"id": 9, "subject": "Task 9: live gate — three meshes, per-pair redundancy, cross-mesh transports","classification": "high-risk", "status": "completed", "note": "PASSED — all 8 legs green (docs/plans/2026-07-24-mesh-phase6-live-gate.md). Caught + fixed-forward 3 defects: (1) product boot-crash StackOverflow — cluster-redundancy singleton resolved IClusterRoleInfo eagerly inside the AddAkka lambda while the ActorSystem was building (fix 3a4ed8dd: derive scope from AkkaClusterOptions); (2) rig — site nodes crashed on LDAP options (no Security__Ldap__* block); (3) rig — site pairs split-brained on simultaneous start (both self-first seeds), fixed with a founder healthcheck + service_healthy gating (2+3 in 792f28ec). Legs: 3 isolated meshes, one Primary/pair 250/240, deploy sealed acks=6 over per-cluster ClusterClient, telemetry gRPC :4056 up + reconnect, reconciler own-cluster-scoped, secrets pair-local, split validator refuses Dps, failover+auto-down-1v1 survival proven. Master 792f28ec."}
+  ],
+  "lastUpdated": "2026-07-24T11:10:00Z"
+}
@@ -0,0 +1,94 @@
+# Per-cluster mesh Phase 7 — failover drills + closing live gates
+
+> **Final phase of the per-cluster mesh program.** Run the failover drill per pair type, close the two
+> outstanding live gates (auto-down 1-vs-1 crash-the-oldest; self-first cold-start-alone), re-verify the
+> manual-failover button, and ship a one-page co-located operator runbook.
+>
+> Runs against merged master on the docker-dev three-mesh rig (same rig as the Phase 6 gate).
+
+## Scope clarified by recon
+
+- **Failover mechanism is the same for every pair**: the oldest Up `driver` member leaves/dies, the peer
+  becomes oldest, takes the `cluster-{ClusterId}` redundancy singleton, and advertises ServiceLevel 250.
+- **Manual-failover button (`IManualFailoverService`) is MAIN-scoped by construction** — it acts on the
+  local node's `Cluster.State` (graceful `Leave` of the oldest Up driver), and the AdminUI runs only on
+  the central (MAIN) pair. Site pairs are **driver-only, no UI**; they fail over via **auto-down** (kill)
+  only. This is the documented pair-local caveat from Phase 6, not a gap to fix.
+- **Graceful (`docker stop`, SIGTERM → CoordinatedShutdown → cluster Leave) vs. ungraceful (`docker kill`,
+  SIGKILL → peer auto-downs)** are the two failover paths. Manual failover = graceful Leave; a crashed
+  node = auto-down.
+
+## Drills
+
+| # | Drill | Status | Evidence |
+|---|---|---|---|
+| D1 | MAIN graceful failover (manual-failover path) — Primary leaves, peer takes over | ✅ PASS | AdminUI "Trigger failover" on `/clusters/MAIN/redundancy`: central-2 "Exiting completed" → central-1 became Primary (250) → central-2 restarted, "Welcome from central-1" (rejoined, no split). Roles swapped 250↔240 |
+| D2 | SITE-A auto-down failover, BOTH directions (kill Primary, then kill new Primary) | ✅ PASS | leg 8 killed site-a-1→site-a-2 Primary; D2 killed site-a-2→site-a-1 Primary (250), survived alone |
+| D3 | SITE-B auto-down failover (crash-the-oldest) | ✅ PASS | killed site-b-1 (Primary/oldest) → site-b-2 "Member removed [site-b-1]", BecomingOldest→Oldest, 250 |
+| D4 | Gate (a): auto-down 1-vs-1 crash-the-oldest — survivor stays Up, does not self-down | ✅ PASS | every survivor across D2/D3/D5/leg8 stayed Up (e.g. site-a-1 "Up 49 minutes", site-b-2 "Up 56 minutes") — no self-down. Closes the gate deferred since Phase 0a |
+| D5 | Gate (b): self-first cold-start-alone — a node boots ALONE (partner down) and forms its mesh | ✅ PASS | stopped both site-b, started only site-b-1: "JOINING itself … forming a new cluster" → leader → Up → serves 250 as sole Primary |
+| D6 | Recovery — a downed/restarted node rejoins its pair as Secondary (240) | ✅ PASS | central-2, site-a-2, site-b-2 all restarted → "Welcome from <founder>" → rejoined 240 |
+
+**Phase 7 exit gate: MET.** All 6 drills pass on every pair type. Final fleet: three healthy 2-node
+pairs, each one Primary (250) + one Secondary (240). Roles are wherever the last drill left them — each
+pair has exactly one Primary, which is what matters.
+
+## Findings / notes
+
+- **Manual-failover button is MAIN-only, by construction** (acts on the local `Cluster.State`; AdminUI
+  runs only on central). The UI now correctly states "this application Cluster's own Primary … each
+  cluster's redundant pair runs its own independent 2-node Akka mesh" (Phase 6 text, verified live).
+  Site pairs (driver-only, no UI) fail over via auto-down (crash) only — there is no manual-failover
+  surface for them, and that is correct for the topology.
+- **Graceful failover restarts the node in-place and it rejoins** (no split), because a single peer that
+  is already Up answers the restarting node's InitJoin. The **simultaneous cold-start** split (Phase 6
+  finding) only bites when BOTH pair nodes start from nothing at once — see the runbook mitigation.
+- **Carried Phase-6 finding — simultaneous cold-start of both pair VMs — NOW CLOSED by a product guard
+  (`279d1d0f`).** On the real co-located VMs a site's two VMs can power-cycle together; two self-first
+  seeds can then each form a 1-node cluster (split brain, two Primaries in one pair). Two mitigations now
+  exist: (1) **operational** — stagger the two VMs' service-manager start / start the founder first (the
+  docker-dev `depends_on: service_healthy` serialization, still used by site-b); (2) **product** — the
+  opt-in `Cluster:BootstrapGuard` (default off), which makes the lower-address node the founder and the
+  higher node probe-then-join, arbitrating the race inside the join decision. Live-gated on the site-a
+  pair (guard on, serialization removed): simultaneous start → 250/240, no split; higher-node cold-start
+  -alone → self-forms → 250. See `docs/Redundancy.md` §"Bootstrap guard". The guard does NOT need the
+  compose `depends_on` that production hardware lacks — it is the production-faithful fix.
+
+---
+
+## Operator runbook — co-located OtOpcUa + ScadaBridge site failover (one page)
+
+**Topology.** Each site = 2 Windows VMs. Each VM runs **one OtOpcUa driver node** (`driver,cluster-SITE-X`,
+Akka `:4053`, OPC UA `:4840`) **and one ScadaBridge site node** — two independent 2-node Akka clusters
+sharing the hardware, never a shared mesh. Central = 2 VMs, each an OtOpcUa `admin,driver,cluster-MAIN`
+node (hosts the AdminUI) + a ScadaBridge central node.
+
+**Normal state.** Each pair: one node Primary (OPC UA ServiceLevel **250**), one Secondary (**240**).
+Check from any OPC UA client: `otopcua-cli redundancy -u opc.tcp://<node>:4840`.
+
+**Planned failover (move the Primary off a VM — e.g. for patching):**
+- *Central (MAIN) pair:* AdminUI → **Clusters → MAIN → Redundancy → Trigger failover → Confirm**. The
+  Primary gracefully leaves, restarts, rejoins as Secondary; its peer becomes Primary (250) in a few
+  seconds. OPC UA clients re-select the new Primary automatically.
+- *Site pairs (SITE-A/SITE-B):* no UI (driver-only). Stop the OtOpcUa service on the Primary VM
+  (graceful SIGTERM) — the peer auto-downs it and becomes Primary. Restart the service to rejoin.
+
+**Unplanned failover (a VM dies).** The peer detects the loss (~10-15 s: failure detector + auto-down),
+removes the dead node, takes the redundancy singleton, and advertises 250. **A 1-node pair keeps
+serving** (auto-down 1-vs-1 survival — verified). Because the VM is shared, **both products fail over
+together**: confirm the ScadaBridge site node on the surviving VM also took over (its own runbook).
+
+**Recovery.** Bring the dead VM back. The OtOpcUa node cold-starts, finds its peer Up, and rejoins as
+Secondary (240) — "Welcome from <peer>" in its log. No manual step.
+
+**⚠️ Both VMs down at once (site power event).** Start the VMs **staggered**, or bring the **designated
+founder VM up first** and wait for its OtOpcUa node to reach ServiceLevel 250 before starting the second
+VM. Starting both OtOpcUa services simultaneously can split the pair into two 1-node clusters (two
+Primaries). If that happens: stop the OtOpcUa service on the non-founder VM, confirm the founder is the
+lone Primary (250), then restart the non-founder — it rejoins as Secondary.
+
+**Health checks.**
+- ServiceLevel per node: `otopcua-cli redundancy -u opc.tcp://<node>:4840` (250 Primary / 240 Secondary).
+- MAIN membership + Primary: AdminUI → Clusters → MAIN → Redundancy.
+- A pair showing **250/250** = split brain — apply the "both VMs down" recovery above.
+- A pair showing **240/240 or a lone 240** = no Primary elected — check the singleton host is Up.
@@ -0,0 +1,729 @@
+# Modbus RTU Driver Implementation Plan
+
+> **For Claude:** REQUIRED SUB-SKILL: Use superpowers-extended-cc:executing-plans (or subagent-driven-development) to implement this plan task-by-task.
+
+**Goal:** Add a Modbus **RTU-over-TCP** transport (RTU CRC-16 framing tunnelled to a serial→Ethernet gateway) to the existing `ModbusDriver`, selected by a new `Transport` config field — reusing every codec/planner/health/materialisation surface unchanged.
+
+**Architecture:** Purely additive behind the existing `IModbusTransport` seam. The application protocol (function codes, codecs, planner, coalescing, write path, probe, materialisation, HistoryRead) is byte-for-byte identical across TCP and RTU — only the wire framing differs (`[addr][PDU][CRC-16]`, no MBAP, no TxId). Work = a CRC-16 helper + a length-less FC-aware framer + one new socket transport that composes a socket lifecycle extracted from `ModbusTcpTransport` + a transport-mode selector on the config + one AdminUI field. **Zero** changes to codecs/planner/health.
+
+**Tech Stack:** existing `ZB.MOM.WW.OtOpcUa.Driver.Modbus` (+ `.Contracts`, `.Addressing`), xUnit + Shouldly, `pymodbus[simulator]==3.13.0` Docker fixture (RTU-framed-TCP profile; stdlib fallback server modelled on `exception_injector.py`), Blazor `ModbusDriverForm.razor` (AdminUI). No new NuGet dependency.
+
+**Source design:** docs/plans/2026-07-15-modbus-rtu-driver-design.md
+**Program design:** docs/plans/2026-07-15-driver-expansion-program-design.md (§3 shared contract, §7 fixtures) — this is **Wave 1**.
+**Progress tracker:** docs/plans/2026-07-24-driver-expansion-tracking.md
+
+## Scope (P1 shippable v1 only)
+
+RTU-over-TCP via a serial→Ethernet gateway (Moxa/Digi/Lantronix), RTU CRC-16 (poly `0xA001`) + FC-aware length framing, a `Transport` selector (`Tcp` | `RtuOverTcp`) on the Modbus config, the `rtu_over_tcp` pymodbus docker profile, and the AdminUI selector. Read **and** write supported (same as TCP).
+
+## Deferred / out of scope
+
+- **Direct-serial transport** (`ModbusRtuTransport` / `System.IO.Ports`) — descoped (user, 2026-07-15). RTU buses are reached exclusively via a serial→Ethernet gateway. Design record kept in **design §2b / §9 P2**; the `ModbusRtuFraming` built here is byte-stream-agnostic so a future serial leg would reuse it unchanged. Do **not** number-squat an `Rtu` enum member for it.
+- **Modbus ASCII** — a third framing (`:`-delimited hex + LRC); would be another `IModbusTransport` if ever needed (design §2c). Not planned.
+- **Per-tag `TagConfig` changes** — none. `ModbusTagDefinition`/`ModbusTagDto` already carry the per-tag `UnitId` override that makes an RS-485 multi-drop bus work; the read planner already refuses to coalesce across UnitIds. Additions are **driver-level only** (design §4).
+- **`ModbusDriver.BuildSlaveHostName` change** — NOT needed. It already emits `host:port/unit{n}`, the correct per-slave resilience key for a gateway (design §6). The design §1 table listed it only for the descoped serial (COM) case.
+
+## Cross-cutting rules (program §3.1 — mandatory)
+
+- **Enum-serialization trap** — `Transport` MUST round-trip as a **name string**, never a number, on both the AdminUI serializer (`ModbusDriverForm._jsonOpts` already carries `JsonStringEnumConverter`) and the factory (DTO field typed `string?`, parsed via the existing `ParseEnum<T>` — mirror `Family`/`MelsecSubFamily`; **do not** type the DTO field as the enum). Guarded by an explicit `"transport":"RtuOverTcp"` string assertion (design §5).
+- **Per-op deadline (R2-01)** — the RTU transport MUST run every transaction under a linked-CTS `CancelAfter(Options.Timeout)` — a frozen gateway must never wedge a poll. There is **no MBAP length field to trust**; FC-aware sizing is the only length signal, so getting it right (or timing out) is the top correctness risk (design §7).
+- **Single-flight mandatory on RTU** — no TxId means at most one transaction on the bus at a time. Keep the `_gate` `SemaphoreSlim` in the new transport.
+- **Ctor is connection-free** — the transport constructor must not connect; all I/O happens in `ConnectAsync`/`SendAsync`.
+- **Live-verify discipline** — the picker/editor + deploy path get a docker-dev `/run` before trust (Task 10).
+
+---
+
+## Task 0: Add the `ModbusTransportMode` enum
+
+**Classification:** trivial
+**Estimated implement time:** ~3 min
+**Parallelizable with:** Task 1, Task 3
+**Files:**
+- Create: `src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Modbus.Contracts/ModbusTransportMode.cs`
+- Test: `tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Modbus.Tests/ModbusTransportModeTests.cs`
+
+The enum lives in `.Contracts` (backend-dep-free), namespace `ZB.MOM.WW.OtOpcUa.Driver.Modbus` — same namespace as `ModbusDriverOptions`.
+
+**Step 1 — failing test:**
+```csharp
+using Shouldly;
+using Xunit;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.Modbus.Tests;
+
+public sealed class ModbusTransportModeTests
+{
+    [Fact]
+    public void Tcp_is_the_default_zero_member()
+        => ((ModbusTransportMode)0).ShouldBe(ModbusTransportMode.Tcp);
+
+    [Fact]
+    public void Exactly_two_members_ship_in_v1()
+        => Enum.GetNames<ModbusTransportMode>().ShouldBe(["Tcp", "RtuOverTcp"]);
+}
+```
+
+**Step 2 — run & expect FAIL** (type does not exist / does not compile):
+`dotnet test tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Modbus.Tests --filter "FullyQualifiedName~ModbusTransportModeTests"`
+
+**Step 3 — minimal impl:**
+```csharp
+namespace ZB.MOM.WW.OtOpcUa.Driver.Modbus;
+
+/// <summary>
+///     Wire transport for a Modbus driver instance. <see cref="Tcp"/> = Modbus/TCP (MBAP + TxId);
+///     <see cref="RtuOverTcp"/> = RTU framing (address + CRC-16, no MBAP) tunnelled over a socket to
+///     a serial→Ethernet gateway. Default <see cref="Tcp"/> — existing configs omit the field.
+///     A direct-serial <c>Rtu</c> member is intentionally NOT reserved here (descoped 2026-07-15);
+///     do not number-squat it.
+/// </summary>
+public enum ModbusTransportMode
+{
+    /// <summary>Modbus/TCP — 7-byte MBAP header + transaction id (the historical default).</summary>
+    Tcp,
+
+    /// <summary>RTU framing (<c>[addr][PDU][CRC-16]</c>) tunnelled over a socket to a serial→Ethernet gateway.</summary>
+    RtuOverTcp,
+}
+```
+
+**Step 4 — run & expect PASS.**
+
+**Step 5 — commit:**
+`git commit -am "feat(modbus-rtu): add ModbusTransportMode enum (Tcp | RtuOverTcp)
+
+Claude-Session: https://claude.ai/code/session_01GASWkNEi68FSCtvr6rLoEW"`
+
+---
+
+## Task 1: `ModbusCrc` — CRC-16 (poly 0xA001) helper + golden vectors
+
+**Classification:** small
+**Estimated implement time:** ~5 min
+**Parallelizable with:** Task 0, Task 3
+**Files:**
+- Create: `src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Modbus/ModbusCrc.cs`
+- Test: `tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Modbus.Tests/ModbusCrcTests.cs`
+
+CRC-16/MODBUS: reflected poly `0xA001`, init `0xFFFF`, appended **low byte first**. This is the top-of-stack of the length-less framer — golden vectors are the whole point.
+
+**Step 1 — failing test** (table-driven against published Modbus CRC vectors):
+```csharp
+using Shouldly;
+using Xunit;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.Modbus.Tests;
+
+public sealed class ModbusCrcTests
+{
+    // Known CRC-16/MODBUS vectors (init 0xFFFF, poly 0xA001). CRC returned as ushort;
+    // on the wire it is appended low-byte-first.
+    [Theory]
+    // FC03 read HR: unit 1, addr 0, qty 1  -> CRC 0x0A84  (bytes 84 0A on the wire)
+    [InlineData(new byte[] { 0x01, 0x03, 0x00, 0x00, 0x00, 0x01 }, (ushort)0x0A84)]
+    // "123456789" canonical check value for CRC-16/MODBUS = 0x4B37
+    [InlineData(new byte[] { 0x31,0x32,0x33,0x34,0x35,0x36,0x37,0x38,0x39 }, (ushort)0x4B37)]
+    public void Compute_matches_known_vectors(byte[] frame, ushort expected)
+        => ModbusCrc.Compute(frame).ShouldBe(expected);
+
+    [Fact]
+    public void AppendLowByteFirst_writes_lo_then_hi()
+    {
+        var body = new byte[] { 0x01, 0x03, 0x00, 0x00, 0x00, 0x01 };
+        var withCrc = ModbusCrc.Append(body);
+        withCrc.Length.ShouldBe(body.Length + 2);
+        withCrc[^2].ShouldBe((byte)0x84); // CRC low byte
+        withCrc[^1].ShouldBe((byte)0x0A); // CRC high byte
+    }
+}
+```
+
+**Step 2 — run & expect FAIL:**
+`dotnet test tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Modbus.Tests --filter "FullyQualifiedName~ModbusCrcTests"`
+
+**Step 3 — minimal impl** (`ModbusCrc.cs`): a `static ushort Compute(ReadOnlySpan<byte>)` (init `0xFFFF`, xor byte, 8× shift-right, xor `0xA001` on carry) and `static byte[] Append(ReadOnlySpan<byte> body)` returning `body + [crc & 0xFF, crc >> 8]`. ~30 lines. If a golden vector disagrees, fix the CRC math — never the vector.
+
+**Step 4 — run & expect PASS.**
+
+**Step 5 — commit:**
+`git commit -am "feat(modbus-rtu): add ModbusCrc CRC-16/MODBUS helper + golden vectors
+
+Claude-Session: https://claude.ai/code/session_01GASWkNEi68FSCtvr6rLoEW"`
+
+---
+
+## Task 2: `ModbusRtuFraming` — ADU build + FC-aware length-less deframe
+
+**Classification:** high-risk (framing)
+**Estimated implement time:** ~5 min
+**Parallelizable with:** none
+**Files:**
+- Create: `src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Modbus/ModbusRtuFraming.cs`
+- Test: `tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Modbus.Tests/ModbusRtuFramingTests.cs`
+
+The one genuinely new correctness risk (design §2a/§7): RTU frames carry **no length field**, so response size is parsed from the function code. Read `addr(1)`+`fc(1)`, then: **exception** (`fc & 0x80`) → `excCode(1)+CRC(2)`; **reads FC01/02/03/04** → `byteCount(1)` then `byteCount + CRC(2)`; **write echoes FC05/06/15/16** → fixed `4 + CRC(2)`. Validate trailing CRC, strip `addr`+`CRC`, return the bare PDU `[fc, ...data]`. CRC mismatch / truncation → `ModbusTransportDesyncException`; exception PDU (after CRC-validate) → `ModbusException`. Test directly against an in-memory `MemoryStream` of canned bytes.
+
+**Step 1 — failing test:**
+```csharp
+using Shouldly;
+using Xunit;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.Modbus.Tests;
+
+public sealed class ModbusRtuFramingTests
+{
+    private static MemoryStream Canned(params byte[] frame) => new(frame);
+
+    [Fact]
+    public void BuildAdu_prefixes_unit_and_appends_crc()
+    {
+        var adu = ModbusRtuFraming.BuildAdu(0x01, new byte[] { 0x03, 0x00, 0x00, 0x00, 0x01 });
+        adu.ShouldBe(new byte[] { 0x01, 0x03, 0x00, 0x00, 0x00, 0x01, 0x84, 0x0A });
+    }
+
+    [Fact]
+    public async Task ReadResponse_FC03_returns_bare_pdu()
+    {
+        // addr=01 fc=03 byteCount=02 data=00 0A  + CRC(lo,hi)
+        var body = new byte[] { 0x01, 0x03, 0x02, 0x00, 0x0A };
+        var frame = ModbusCrc.Append(body);
+        await using var s = Canned(frame);
+        var pdu = await ModbusRtuFraming.ReadResponsePduAsync(s, 0x01, TestContext.Current.CancellationToken);
+        pdu.ShouldBe(new byte[] { 0x03, 0x02, 0x00, 0x0A }); // fc + byteCount + data, no addr/CRC
+    }
+
+    [Fact]
+    public async Task ReadResponse_exception_frame_throws_ModbusException()
+    {
+        // addr=01 fc=0x83 exc=0x02 + CRC
+        var frame = ModbusCrc.Append(new byte[] { 0x01, 0x83, 0x02 });
+        await using var s = Canned(frame);
+        var ex = await Should.ThrowAsync<ModbusException>(
+            ModbusRtuFraming.ReadResponsePduAsync(s, 0x01, TestContext.Current.CancellationToken));
+        ex.FunctionCode.ShouldBe((byte)0x03);
+        ex.ExceptionCode.ShouldBe((byte)0x02);
+    }
+
+    [Fact]
+    public async Task ReadResponse_bad_crc_throws_desync()
+    {
+        var frame = ModbusCrc.Append(new byte[] { 0x01, 0x03, 0x02, 0x00, 0x0A });
+        frame[^1] ^= 0xFF; // corrupt CRC high byte
+        await using var s = Canned(frame);
+        await Should.ThrowAsync<ModbusTransportDesyncException>(
+            ModbusRtuFraming.ReadResponsePduAsync(s, 0x01, TestContext.Current.CancellationToken));
+    }
+
+    [Fact]
+    public async Task ReadResponse_FC06_write_echo_returns_four_byte_pdu()
+    {
+        // addr=01 fc=06 addr=00 07 value=00 2A + CRC  -> PDU = 06 00 07 00 2A
+        var frame = ModbusCrc.Append(new byte[] { 0x01, 0x06, 0x00, 0x07, 0x00, 0x2A });
+        await using var s = Canned(frame);
+        var pdu = await ModbusRtuFraming.ReadResponsePduAsync(s, 0x01, TestContext.Current.CancellationToken);
+        pdu.ShouldBe(new byte[] { 0x06, 0x00, 0x07, 0x00, 0x2A });
+    }
+}
+```
+
+**Step 2 — run & expect FAIL:**
+`dotnet test tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Modbus.Tests --filter "FullyQualifiedName~ModbusRtuFramingTests"`
+
+**Step 3 — minimal impl** (`ModbusRtuFraming.cs`): `static byte[] BuildAdu(byte unitId, ReadOnlySpan<byte> pdu)` = `ModbusCrc.Append([unitId, ..pdu])`; `static async Task<byte[]> ReadResponsePduAsync(Stream, byte expectedUnit, CancellationToken)` doing the FC-aware read described above with a `ReadExactlyAsync` helper (mirror `ModbusTcpTransport.ReadExactlyAsync`). Reuse `ModbusException` + `ModbusTransportDesyncException` (both already in the project). Keep framing byte-stream-agnostic (no socket knowledge) so a future serial transport can reuse it.
+
+**Step 4 — run & expect PASS.**
+
+**Step 5 — commit:**
+`git commit -am "feat(modbus-rtu): add ModbusRtuFraming (ADU build + FC-aware length-less deframe)
+
+Claude-Session: https://claude.ai/code/session_01GASWkNEi68FSCtvr6rLoEW"`
+
+---
+
+## Task 3: Extract `ModbusSocketLifecycle` from `ModbusTcpTransport` (behaviour-preserving)
+
+**Classification:** high-risk (transport / concurrency)
+**Estimated implement time:** ~5 min
+**Parallelizable with:** Task 0, Task 1, Task 2
+**Files:**
+- Create: `src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Modbus/ModbusSocketLifecycle.cs`
+- Modify: `src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Modbus/ModbusTcpTransport.cs`
+- Test: `tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Modbus.Tests/ModbusSocketLifecycleTests.cs`
+
+Mechanical refactor: move the IPv4-preference connect (`ConnectAsync`), `EnableKeepAlive`/`ClampToWholeSeconds`, `ConnectWithBackoffAsync`, `TearDownAsync`, and the `_lastSuccessUtc`/idle-disconnect tracking out of `ModbusTcpTransport` into a reusable `ModbusSocketLifecycle` that exposes the current `NetworkStream`. `ModbusTcpTransport` keeps its MBAP `SendOnceAsync` and composes the lifecycle. **Behaviour must be byte-for-byte unchanged** — the existing `ModbusTcpReconnectTests` + `ModbusConnectionOptionsTests` are the regression net; run the whole Modbus.Tests suite green before committing.
+
+**Step 1 — failing test** (pins the extracted surface; `ClampToWholeSeconds` moves with it):
+```csharp
+using Shouldly;
+using Xunit;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.Modbus.Tests;
+
+public sealed class ModbusSocketLifecycleTests
+{
+    [Theory]
+    [InlineData(0.4, 1)]   // sub-second rounds up to 1 (the int-cast truncation guard)
+    [InlineData(2.0, 2)]
+    [InlineData(-5.0, 1)]  // negative clamps to 1
+    public void ClampToWholeSeconds_rounds_up_min_one(double seconds, int expected)
+        => ModbusSocketLifecycle.ClampToWholeSeconds(TimeSpan.FromSeconds(seconds)).ShouldBe(expected);
+
+    [Fact]
+    public async Task Connect_to_dead_port_surfaces_socket_failure()
+    {
+        var life = new ModbusSocketLifecycle("127.0.0.1", 1, TimeSpan.FromMilliseconds(300),
+            autoReconnect: false);
+        await Should.ThrowAsync<System.Net.Sockets.SocketException>(
+            life.ConnectAsync(TestContext.Current.CancellationToken));
+    }
+}
+```
+
+**Step 2 — run & expect FAIL:**
+`dotnet test tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Modbus.Tests --filter "FullyQualifiedName~ModbusSocketLifecycleTests"`
+
+**Step 3 — minimal impl:** create `ModbusSocketLifecycle` holding `_host/_port/_timeout/_autoReconnect/_keepAlive/_idleDisconnect/_reconnect`, the `TcpClient`/`NetworkStream`, and `_lastSuccessUtc`; expose `ConnectAsync`, `ConnectWithBackoffAsync`, `TearDownAsync`, `Stream` (current), `MarkSuccess()`, `ShouldReconnectForIdle()`, and the `static int ClampToWholeSeconds`. Re-point `ModbusTcpTransport` to delegate connect/reconnect/teardown/idle to it while keeping MBAP `SendOnceAsync` in place. Move (don't duplicate) `ClampToWholeSeconds` — update its one internal caller/test reference.
+
+**Step 4 — run & expect PASS** — then run the **whole** suite to prove no regression:
+`dotnet test tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Modbus.Tests`
+
+**Step 5 — commit:**
+`git commit -am "refactor(modbus): extract ModbusSocketLifecycle from ModbusTcpTransport (behaviour-preserving)
+
+Claude-Session: https://claude.ai/code/session_01GASWkNEi68FSCtvr6rLoEW"`
+
+---
+
+## Task 4: `ModbusRtuOverTcpTransport` — RTU framing over the socket lifecycle
+
+**Classification:** high-risk (framing / transport / concurrency)
+**Estimated implement time:** ~5 min
+**Parallelizable with:** none
+**Files:**
+- Create: `src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Modbus/ModbusRtuOverTcpTransport.cs`
+- Test: `tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Modbus.Tests/ModbusRtuOverTcpTransportTests.cs`
+
+`IModbusTransport` implementation: composes `ModbusSocketLifecycle` (Task 3) for connect/reconnect/keepalive/idle and `ModbusRtuFraming` (Task 2) for send/receive. Delta from `ModbusTcpTransport`: CRC framing instead of MBAP, **no TxId**. Keep the `_gate` `SemaphoreSlim` single-flight (mandatory — no TxId), the single reconnect-retry shape, and a linked-CTS `CancelAfter(Options.Timeout)` per-op deadline (design §7, R2-01). **Seam choice for unit test:** add an `internal` test ctor accepting a pre-connected `Stream` (an in-memory duplex fake) that bypasses `ConnectAsync` — this is "the fake one level below the `IModbusTransport` fakes" the design §8 calls for, and lets the send/receive orchestration + single-flight + deadline be tested with no socket.
+
+**Step 1 — failing test** (duplex fake: canned response stream + capture of written request bytes):
+```csharp
+using Shouldly;
+using Xunit;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.Modbus.Tests;
+
+public sealed class ModbusRtuOverTcpTransportTests
+{
+    [Fact]
+    public async Task SendAsync_writes_rtu_adu_and_returns_deframed_pdu()
+    {
+        // Response the fake gateway will emit: FC03, 1 reg = 0x000A.
+        var response = ModbusCrc.Append(new byte[] { 0x01, 0x03, 0x02, 0x00, 0x0A });
+        var fake = new CapturingDuplexStream(response);
+
+        await using var transport = ModbusRtuOverTcpTransport.ForTest(fake, TimeSpan.FromSeconds(2));
+        var pdu = await transport.SendAsync(0x01, new byte[] { 0x03, 0x00, 0x00, 0x00, 0x01 },
+            TestContext.Current.CancellationToken);
+
+        pdu.ShouldBe(new byte[] { 0x03, 0x02, 0x00, 0x0A });
+        // The request went out as an RTU ADU: unit + pdu + CRC, NO MBAP header.
+        fake.Written.ShouldBe(new byte[] { 0x01, 0x03, 0x00, 0x00, 0x00, 0x01, 0x84, 0x0A });
+    }
+
+    [Fact]
+    public async Task SendAsync_exception_pdu_surfaces_ModbusException()
+    {
+        var response = ModbusCrc.Append(new byte[] { 0x01, 0x83, 0x02 });
+        var fake = new CapturingDuplexStream(response);
+        await using var transport = ModbusRtuOverTcpTransport.ForTest(fake, TimeSpan.FromSeconds(2));
+        await Should.ThrowAsync<ModbusException>(
+            transport.SendAsync(0x01, new byte[] { 0x03, 0x00, 0x00, 0x00, 0x01 },
+                TestContext.Current.CancellationToken));
+    }
+
+    [Fact]
+    public async Task SendAsync_stalled_gateway_hits_per_op_deadline()
+    {
+        var fake = new CapturingDuplexStream(respondBytes: Array.Empty<byte>(), stall: true);
+        await using var transport = ModbusRtuOverTcpTransport.ForTest(fake, TimeSpan.FromMilliseconds(200));
+        await Should.ThrowAsync<ModbusTransportDesyncException>(
+            transport.SendAsync(0x01, new byte[] { 0x03, 0x00, 0x00, 0x00, 0x01 },
+                TestContext.Current.CancellationToken));
+    }
+}
+```
+(The `CapturingDuplexStream` test double — a `Stream` that records writes and replays `respondBytes` on read, or blocks forever when `stall` — lives in the test file.)
+
+**Step 2 — run & expect FAIL:**
+`dotnet test tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Modbus.Tests --filter "FullyQualifiedName~ModbusRtuOverTcpTransportTests"`
+
+**Step 3 — minimal impl:** production ctor takes the same connection params as `ModbusTcpTransport` and builds a `ModbusSocketLifecycle`; `internal static ForTest(Stream, TimeSpan)` injects a pre-connected stream. `SendAsync`: `_gate.WaitAsync`; idle-reconnect check (skipped in test seam); write `ModbusRtuFraming.BuildAdu(unitId, pdu)`, flush, `ModbusRtuFraming.ReadResponsePduAsync(...)` under a linked `CancelAfter(_timeout)`; timeout-vs-caller-cancel distinction + teardown mirror `ModbusTcpTransport.SendOnceAsync`; single reconnect-retry on socket-level failure.
+
+**Step 4 — run & expect PASS.**
+
+**Step 5 — commit:**
+`git commit -am "feat(modbus-rtu): add ModbusRtuOverTcpTransport (RTU framing over socket lifecycle)
+
+Claude-Session: https://claude.ai/code/session_01GASWkNEi68FSCtvr6rLoEW"`
+
+---
+
+## Task 5: `ModbusTransportFactory.Create` — switch on `Transport`
+
+**Classification:** small
+**Estimated implement time:** ~4 min
+**Parallelizable with:** Task 6
+**Files:**
+- Create: `src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Modbus/ModbusTransportFactory.cs`
+- Test: `tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Modbus.Tests/ModbusTransportFactoryTests.cs`
+
+One place that maps `ModbusDriverOptions` → the right `IModbusTransport`, consumed by both the driver default closure (Task 7) and the probe (Task 7). `Tcp` → `ModbusTcpTransport`, `RtuOverTcp` → `ModbusRtuOverTcpTransport`; both get `Host/Port/Timeout/AutoReconnect/KeepAlive/IdleDisconnect/Reconnect`.
+
+**Step 1 — failing test:**
+```csharp
+using Shouldly;
+using Xunit;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.Modbus.Tests;
+
+public sealed class ModbusTransportFactoryTests
+{
+    [Fact]
+    public void Tcp_mode_builds_tcp_transport()
+        => ModbusTransportFactory.Create(new ModbusDriverOptions { Transport = ModbusTransportMode.Tcp })
+            .ShouldBeOfType<ModbusTcpTransport>();
+
+    [Fact]
+    public void RtuOverTcp_mode_builds_rtu_transport()
+        => ModbusTransportFactory.Create(new ModbusDriverOptions { Transport = ModbusTransportMode.RtuOverTcp })
+            .ShouldBeOfType<ModbusRtuOverTcpTransport>();
+
+    [Fact]
+    public void Default_options_build_tcp_transport()
+        => ModbusTransportFactory.Create(new ModbusDriverOptions())
+            .ShouldBeOfType<ModbusTcpTransport>();
+}
+```
+(Depends on Task 6's `Transport` property existing on `ModbusDriverOptions` — sequence Task 6 or add the property first. If Task 5 lands before Task 6, add the property in this task instead.)
+
+**Step 2 — run & expect FAIL.**
+`dotnet test tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Modbus.Tests --filter "FullyQualifiedName~ModbusTransportFactoryTests"`
+
+**Step 3 — minimal impl:** `static IModbusTransport Create(ModbusDriverOptions o)` = `switch (o.Transport) { RtuOverTcp => new ModbusRtuOverTcpTransport(...), _ => new ModbusTcpTransport(...) }`, passing the shared connection params.
+
+**Step 4 — run & expect PASS.**
+
+**Step 5 — commit:**
+`git commit -am "feat(modbus-rtu): add ModbusTransportFactory switch on Transport mode
+
+Claude-Session: https://claude.ai/code/session_01GASWkNEi68FSCtvr6rLoEW"`
+
+---
+
+## Task 6: Add `Transport` to options + DTO + factory (string-enum guard)
+
+**Classification:** small
+**Estimated implement time:** ~5 min
+**Parallelizable with:** Task 5
+**Files:**
+- Modify: `src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Modbus.Contracts/ModbusDriverOptions.cs`
+- Modify: `src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Modbus/ModbusDriverFactoryExtensions.cs`
+- Test: `tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Modbus.Tests/ModbusTransportConfigRoundTripTests.cs`
+
+Add `public ModbusTransportMode Transport { get; init; } = ModbusTransportMode.Tcp;` to `ModbusDriverOptions`. On the DTO: add `public string? Transport { get; init; }` (typed **`string?`**, per the Modbus factory pattern — design §5) and map it with the existing `ParseEnum<ModbusTransportMode>(...)` helper, defaulting to `Tcp` when null. The guard test asserts the string wire form.
+
+**Step 1 — failing test:**
+```csharp
+using System.Text.Json;
+using System.Text.Json.Serialization;
+using Shouldly;
+using Xunit;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.Modbus.Tests;
+
+public sealed class ModbusTransportConfigRoundTripTests
+{
+    // Mirrors the AdminUI ModbusDriverForm serializer: camelCase + string enums.
+    private static readonly JsonSerializerOptions _adminOpts = new()
+    {
+        PropertyNamingPolicy = JsonNamingPolicy.CamelCase,
+        Converters = { new JsonStringEnumConverter() },
+    };
+
+    [Fact]
+    public void Transport_serializes_as_a_string_not_a_number()
+    {
+        var opts = new ModbusDriverOptions { Host = "10.20.0.50", Port = 4001, Transport = ModbusTransportMode.RtuOverTcp };
+        var json = JsonSerializer.Serialize(opts, _adminOpts);
+        json.ShouldContain("\"transport\":\"RtuOverTcp\"");
+        json.ShouldNotContain("\"transport\":1", Case.Sensitive);
+    }
+
+    [Fact]
+    public void Factory_binds_RtuOverTcp_from_string_config()
+    {
+        const string json = """{ "host": "10.20.0.50", "port": 4001, "transport": "RtuOverTcp" }""";
+        using var driver = ModbusDriverFactoryExtensions.CreateInstance("mb-rtu", json);
+        var opts = (ModbusDriverOptions)typeof(ModbusDriver)
+            .GetField("_options", System.Reflection.BindingFlags.NonPublic | System.Reflection.BindingFlags.Instance)!
+            .GetValue(driver)!;
+        opts.Transport.ShouldBe(ModbusTransportMode.RtuOverTcp);
+    }
+
+    [Fact]
+    public void Factory_defaults_Transport_to_Tcp_when_omitted()
+    {
+        const string json = """{ "host": "10.0.0.10" }""";
+        using var driver = ModbusDriverFactoryExtensions.CreateInstance("mb-tcp", json);
+        var opts = (ModbusDriverOptions)typeof(ModbusDriver)
+            .GetField("_options", System.Reflection.BindingFlags.NonPublic | System.Reflection.BindingFlags.Instance)!
+            .GetValue(driver)!;
+        opts.Transport.ShouldBe(ModbusTransportMode.Tcp);
+    }
+}
+```
+
+**Step 2 — run & expect FAIL:**
+`dotnet test tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Modbus.Tests --filter "FullyQualifiedName~ModbusTransportConfigRoundTripTests"`
+
+**Step 3 — minimal impl:** add the `Transport` property (options) + DTO `string?` field + factory mapping `Transport = dto.Transport is null ? ModbusTransportMode.Tcp : ParseEnum<ModbusTransportMode>(dto.Transport, "<driver-level>", driverInstanceId, "Transport")`.
+
+**Step 4 — run & expect PASS.**
+
+**Step 5 — commit:**
+`git commit -am "feat(modbus-rtu): bind Transport mode on options/DTO/factory (string-enum guard)
+
+Claude-Session: https://claude.ai/code/session_01GASWkNEi68FSCtvr6rLoEW"`
+
+---
+
+## Task 7: Wire the driver default closure + probe to `ModbusTransportFactory`
+
+**Classification:** small
+**Estimated implement time:** ~5 min
+**Parallelizable with:** Task 8
+**Files:**
+- Modify: `src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Modbus/ModbusDriver.cs`
+- Modify: `src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Modbus/ModbusDriverProbe.cs`
+- Test: `tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Modbus.Tests/ModbusTransportWiringTests.cs`
+
+Replace the driver ctor's hardcoded `new ModbusTcpTransport(...)` default closure with `o => ModbusTransportFactory.Create(o)`. In the probe, replace the hardcoded `new ModbusTcpTransport(host, port, timeout, autoReconnect: false)` (line ~77) with a factory build carrying `Transport` (parse it into `ProbeTarget` from the DTO), `autoReconnect: false`. Now an `RtuOverTcp`-authored config probes over RTU framing — matching how it will actually run.
+
+**Step 1 — failing test** (the default closure honours the mode; the probe carries it):
+```csharp
+using Shouldly;
+using Xunit;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.Modbus.Tests;
+
+public sealed class ModbusTransportWiringTests
+{
+    private static IModbusTransport BuildDefaultTransport(ModbusDriverOptions opts)
+    {
+        using var driver = new ModbusDriver(opts, "wire-test");
+        var factory = (Func<ModbusDriverOptions, IModbusTransport>)typeof(ModbusDriver)
+            .GetField("_transportFactory", System.Reflection.BindingFlags.NonPublic | System.Reflection.BindingFlags.Instance)!
+            .GetValue(driver)!;
+        return factory(opts);
+    }
+
+    [Fact]
+    public void Default_closure_builds_rtu_transport_for_RtuOverTcp()
+        => BuildDefaultTransport(new ModbusDriverOptions { Transport = ModbusTransportMode.RtuOverTcp })
+            .ShouldBeOfType<ModbusRtuOverTcpTransport>();
+
+    [Fact]
+    public void Default_closure_builds_tcp_transport_for_Tcp()
+        => BuildDefaultTransport(new ModbusDriverOptions())
+            .ShouldBeOfType<ModbusTcpTransport>();
+}
+```
+(If `_transportFactory` reflection proves brittle, assert instead that a `RtuOverTcp` driver initialised against an unreachable host degrades without ever constructing an MBAP frame — but the closure-reflection test is the tightest.)
+
+**Step 2 — run & expect FAIL:**
+`dotnet test tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Modbus.Tests --filter "FullyQualifiedName~ModbusTransportWiringTests"`
+
+**Step 3 — minimal impl:** driver ctor default = `?? (o => ModbusTransportFactory.Create(o))`; probe: add `ModbusTransportMode Transport` to `ProbeTarget`, parse `dto.Transport` via `ParseEnum`, and build the probe transport through `ModbusTransportFactory.Create(new ModbusDriverOptions { Host, Port, Timeout, Transport, AutoReconnect = false })`.
+
+**Step 4 — run & expect PASS** (+ run the full Modbus.Tests suite green).
+
+**Step 5 — commit:**
+`git commit -am "feat(modbus-rtu): route driver + probe transports through ModbusTransportFactory
+
+Claude-Session: https://claude.ai/code/session_01GASWkNEi68FSCtvr6rLoEW"`
+
+---
+
+## Task 8: AdminUI — `Transport` selector on `ModbusDriverForm`
+
+**Classification:** small
+**Estimated implement time:** ~5 min
+**Parallelizable with:** Task 7
+**Files:**
+- Modify: `src/Server/ZB.MOM.WW.OtOpcUa.AdminUI/Components/Shared/Drivers/Forms/ModbusDriverForm.razor`
+- Test: `tests/Server/ZB.MOM.WW.OtOpcUa.AdminUI.Tests/Uns/ModbusDriverFormModelTests.cs`
+
+Add a `Transport` `<InputSelect>` to the **Protocol** panel (design's target `ModbusDriverPage.razor` is retired; `ModbusDriverForm.razor` is the live host — it serializes `ModbusDriverOptions` directly through `_jsonOpts`, which already carries `JsonStringEnumConverter`, so `Transport` emits as a name string automatically; `Transport` is **not** an endpoint key so it is not stripped by `GetConfigJson`). Add `public ModbusTransportMode Transport { get; set; } = ModbusTransportMode.Tcp;` to `FormModel`, map it in `FromOptions`/`ToOptions`. Host/Port stay on `ModbusDeviceForm` — a `RtuOverTcp` gateway uses the same `host:port` shape. Extend the existing `ModbusDriverFormModelTests` (round-trip + string-enum guard).
+
+**Step 1 — failing test** (append to `ModbusDriverFormModelTests`):
+```csharp
+    [Fact]
+    public void Round_trip_preserves_Transport_mode()
+    {
+        var form = new ModbusDriverForm.FormModel { Transport = ModbusTransportMode.RtuOverTcp };
+        var json = JsonSerializer.Serialize(form.ToOptions(), JsonOpts);
+        var back = ModbusDriverForm.FormModel.FromOptions(
+            JsonSerializer.Deserialize<ModbusDriverOptions>(json, JsonOpts)!);
+        back.Transport.ShouldBe(ModbusTransportMode.RtuOverTcp);
+        json.ShouldContain("\"transport\":\"RtuOverTcp\""); // name string, never a number
+    }
+```
+
+**Step 2 — run & expect FAIL:**
+`dotnet test tests/Server/ZB.MOM.WW.OtOpcUa.AdminUI.Tests --filter "FullyQualifiedName~ModbusDriverFormModelTests"`
+
+**Step 3 — minimal impl:** add the `Transport` `FormModel` property + `FromOptions`/`ToOptions` mapping, and an `<InputSelect @bind-Value="_form.Transport" @bind-Value:after="EmitAsync">` looping `Enum.GetValues<ModbusTransportMode>()` in the Protocol panel, with a form-text hint: "RtuOverTcp = talk raw RTU frames to a serial→Ethernet gateway; must match the gateway's mode."
+
+**Step 4 — run & expect PASS.** (AdminUI has no bUnit — the razor binding itself is proven live in Task 10; this model test is the reflection substitute per the AdminUI live-verify memory.)
+
+**Step 5 — commit:**
+`git commit -am "feat(modbus-rtu): add Transport selector to the AdminUI Modbus driver form
+
+Claude-Session: https://claude.ai/code/session_01GASWkNEi68FSCtvr6rLoEW"`
+
+---
+
+## Task 9: Docker `rtu_over_tcp` fixture + RTU-over-TCP integration test
+
+**Classification:** standard (new component / multi-file)
+**Estimated implement time:** ~5 min
+**Parallelizable with:** none
+**Files:**
+- Create: `tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Modbus.IntegrationTests/Docker/profiles/rtu_over_tcp.json`
+- Modify: `tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Modbus.IntegrationTests/Docker/docker-compose.yml`
+- Create: `tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Modbus.IntegrationTests/ModbusRtuOverTcpFixture.cs`
+- Create: `tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Modbus.IntegrationTests/ModbusRtuOverTcpTests.cs`
+- Modify (only if the pymodbus RTU-framer confirmation fails): `Docker/Dockerfile` + `Docker/rtu_over_tcp_server.py`
+
+**FIRST sub-step — confirm the unknown (design §8 #1):** verify the pymodbus simulator actually exposes the RTU framer on a TCP server. The checked-in `profiles/standard.json` already sets `server_list.srv.framer: "socket"`, so the knob exists; the RTU profile sets `"framer": "rtu"` (comm stays `"tcp"`). Bring it up and probe with the new driver:
+```bash
+lmxopcua-fix sync modbus
+lmxopcua-fix up modbus rtu_over_tcp
+# then run the integration test (below) against MODBUS_RTU_SIM_ENDPOINT=10.100.0.35:5021
+```
+If pymodbus 3.13's simulator does **not** honour `framer=rtu` on a TCP server (garbled/MBAP-framed replies), **fall back** to a stdlib `rtu_over_tcp_server.py` modelled on the existing `exception_injector.py` (same asyncio TCP-server shape, but frame with `[addr][PDU][CRC-16]` via a Python CRC-16/MODBUS instead of the MBAP header) + a `COPY rtu_over_tcp_server.py` line in the Dockerfile and a `command:` override on the service. Record which path was taken in the test-class summary.
+
+Fixture details: bind host port **`5021`** (NOT the shared `:5020` — the `rtu_over_tcp` service must co-run with `standard` and sidestep the shared-port stale-container trap). Add `labels: { project: lmxopcua }` per the program fixture convention (existing services carry none — `lmxopcua-fix sync` normally owns the label host-side, but add it in-file for this service so it is discoverable). `ModbusRtuOverTcpFixture` mirrors `ModbusSimulatorFixture` but reads `MODBUS_RTU_SIM_ENDPOINT` (default `10.100.0.35:5021`) with the same skip-clean pattern.
+
+**Step 1 — failing test** (`ModbusRtuOverTcpTests.cs` — read + write round-trip over RTU-over-TCP):
+```csharp
+using Shouldly;
+using Xunit;
+using ZB.MOM.WW.OtOpcUa.Core.Abstractions;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.Modbus.IntegrationTests;
+
+[Collection(ModbusRtuOverTcpCollection.Name)]
+[Trait("Category", "Integration")]
+[Trait("Device", "RtuOverTcp")]
+public sealed class ModbusRtuOverTcpTests(ModbusRtuOverTcpFixture sim)
+{
+    [Fact]
+    public async Task Reads_a_seeded_holding_register_over_rtu_framing()
+    {
+        if (sim.SkipReason is not null) Assert.Skip(sim.SkipReason);
+        var opts = new ModbusDriverOptions
+        {
+            Host = sim.Host, Port = sim.Port, UnitId = 1,
+            Transport = ModbusTransportMode.RtuOverTcp,
+            Timeout = TimeSpan.FromSeconds(2),
+            Probe = new ModbusProbeOptions { Enabled = false },
+            RawTags = ModbusRawTags.Entries([
+                new ModbusTagDefinition("HR5", ModbusRegion.HoldingRegisters, Address: 5,
+                    DataType: ModbusDataType.UInt16, Writable: false),
+            ]),
+        };
+        await using var driver = new ModbusDriver(opts, "modbus-rtu-int");
+        await driver.InitializeAsync("{}", TestContext.Current.CancellationToken);
+
+        var results = await driver.ReadAsync(["HR5"], TestContext.Current.CancellationToken);
+
+        results[0].StatusCode.ShouldBe(0u);       // Good
+        results[0].Value.ShouldBe((ushort)5);     // HR[5] seeded = address-as-value
+    }
+
+    [Fact]
+    public async Task Writes_and_reads_back_a_holding_register_over_rtu_framing()
+    {
+        if (sim.SkipReason is not null) Assert.Skip(sim.SkipReason);
+        var opts = new ModbusDriverOptions
+        {
+            Host = sim.Host, Port = sim.Port, UnitId = 1,
+            Transport = ModbusTransportMode.RtuOverTcp,
+            Timeout = TimeSpan.FromSeconds(2),
+            Probe = new ModbusProbeOptions { Enabled = false },
+            RawTags = ModbusRawTags.Entries([
+                new ModbusTagDefinition("HR200", ModbusRegion.HoldingRegisters, Address: 200,
+                    DataType: ModbusDataType.UInt16, Writable: true),
+            ]),
+        };
+        await using var driver = new ModbusDriver(opts, "modbus-rtu-int-w");
+        await driver.InitializeAsync("{}", TestContext.Current.CancellationToken);
+
+        var writes = await driver.WriteAsync([new WriteRequest("HR200", (ushort)4242)],
+            TestContext.Current.CancellationToken);
+        writes[0].StatusCode.ShouldBe(0u);
+
+        var back = await driver.ReadAsync(["HR200"], TestContext.Current.CancellationToken);
+        back[0].Value.ShouldBe((ushort)4242);
+    }
+}
+```
+(Seed `rtu_over_tcp.json` with the same `HR[0..31]=address-as-value` + `HR[200..209]=scratch` layout as `standard.json` so these addresses resolve.)
+
+**Step 2 — run & expect FAIL / SKIP** without the fixture, then bring it up:
+```bash
+lmxopcua-fix sync modbus && lmxopcua-fix up modbus rtu_over_tcp
+MODBUS_RTU_SIM_ENDPOINT=10.100.0.35:5021 dotnet test tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Modbus.IntegrationTests --filter "FullyQualifiedName~ModbusRtuOverTcpTests"
+```
+
+**Step 3 — minimal impl:** the `rtu_over_tcp.json` profile + compose service (+ stdlib server fallback only if the framer confirmation failed) + the fixture class. Iterate until both facts hold on the wire.
+
+**Step 4 — run & expect PASS** against the live fixture.
+
+**Step 5 — commit:**
+`git commit -am "test(modbus-rtu): add rtu_over_tcp pymodbus fixture + RTU-over-TCP integration tests
+
+Claude-Session: https://claude.ai/code/session_01GASWkNEi68FSCtvr6rLoEW"`
+
+---
+
+## Task 10: Live `/run` verification on docker-dev
+
+**Classification:** standard (live gate)
+**Estimated implement time:** ~5 min
+**Parallelizable with:** none
+**Files:**
+- Modify (docs only): `docs/plans/2026-07-24-driver-expansion-tracking.md` (record Wave-1 Modbus-RTU live-gate result)
+
+No new code — the live-verify discipline (program §3.1) proves the Razor binding + deploy path that unit tests can't. Against the local docker-dev rig (AdminUI `http://localhost:9200`, login disabled — drive it yourself; do not wait for the user to sign in):
+
+1. Bring up the `rtu_over_tcp` fixture (`lmxopcua-fix up modbus rtu_over_tcp`, host `:5021`).
+2. In `/raw`, author a Modbus device pointing Host/Port at the docker host `:5021`, and set the driver **Transport = RtuOverTcp** in the driver-config modal (the Task 8 selector). Run **Test Connect** — expect green (the probe now runs FC03 over RTU framing).
+3. Author a holding-register raw tag (e.g. `HR5`), reference it into a UNS equipment, and deploy.
+4. Read it back via Client.CLI against the local server, or the `/uns` value panel:
+   `dotnet run --project src/Client/ZB.MOM.WW.OtOpcUa.Client.CLI -- read -u opc.tcp://localhost:4840 -n "ns=2;s=<RawPath-of-HR5>"`
+   — expect Good quality + the seeded value.
+5. Write to a writable register (`HR200`) via Client.CLI `write` and confirm it round-trips.
+6. Record PASS/FAIL + evidence in the tracking doc.
+
+**Step 5 — commit:**
+`git commit -am "docs(modbus-rtu): record Wave-1 RTU-over-TCP live /run gate result
+
+Claude-Session: https://claude.ai/code/session_01GASWkNEi68FSCtvr6rLoEW"`
+
+---
+
+## Ordering summary
+
+Framer/CRC unit layer (Tasks 0–2) → transport (Tasks 3–4) → factory + config + driver/probe wiring (Tasks 5–7) → AdminUI selector (Task 8) → docker integration fixture (Task 9) → live `/run` (Task 10). Tasks 1 & 3 can run alongside Task 0; Task 5 alongside Task 6; Task 7 alongside Task 8. Commit after every task. DRY: `ModbusRtuFraming` and `ModbusSocketLifecycle` are each written once and composed; no codec/planner/health code is touched. YAGNI: no direct-serial, no ASCII, no per-tag config, no `BuildSlaveHostName` change.
@@ -0,0 +1,91 @@
+{
+  "planPath": "docs/plans/2026-07-24-modbus-rtu-driver.md",
+  "tasks": [
+    {
+      "id": 0,
+      "subject": "Task 0: Add the ModbusTransportMode enum (Tcp | RtuOverTcp)",
+      "status": "completed"
+    },
+    {
+      "id": 1,
+      "subject": "Task 1: ModbusCrc CRC-16/MODBUS helper + golden vectors",
+      "status": "completed"
+    },
+    {
+      "id": 2,
+      "subject": "Task 2: ModbusRtuFraming ADU build + FC-aware length-less deframe",
+      "status": "completed",
+      "blockedBy": [
+        1
+      ]
+    },
+    {
+      "id": 3,
+      "subject": "Task 3: Extract ModbusSocketLifecycle from ModbusTcpTransport (behaviour-preserving)",
+      "status": "completed"
+    },
+    {
+      "id": 4,
+      "subject": "Task 4: ModbusRtuOverTcpTransport (RTU framing over socket lifecycle)",
+      "status": "completed",
+      "blockedBy": [
+        2,
+        3
+      ]
+    },
+    {
+      "id": 5,
+      "subject": "Task 5: ModbusTransportFactory.Create switch on Transport mode",
+      "status": "completed",
+      "blockedBy": [
+        0,
+        4
+      ]
+    },
+    {
+      "id": 6,
+      "subject": "Task 6: Bind Transport on options/DTO/factory (string-enum guard)",
+      "status": "completed",
+      "blockedBy": [
+        0
+      ]
+    },
+    {
+      "id": 7,
+      "subject": "Task 7: Route driver default closure + probe through ModbusTransportFactory",
+      "status": "completed",
+      "blockedBy": [
+        5,
+        6
+      ]
+    },
+    {
+      "id": 8,
+      "subject": "Task 8: AdminUI Transport selector on ModbusDriverForm",
+      "status": "completed",
+      "blockedBy": [
+        6
+      ]
+    },
+    {
+      "id": 9,
+      "subject": "Task 9: Docker rtu_over_tcp fixture + RTU-over-TCP integration test",
+      "status": "completed",
+      "blockedBy": [
+        4,
+        7
+      ]
+    },
+    {
+      "id": 10,
+      "subject": "Task 10: Live /run verification on docker-dev",
+      "status": "completed",
+      "blockedBy": [
+        8,
+        9
+      ]
+    }
+  ],
+  "lastUpdated": "2026-07-27",
+  "closureNote": "Merged 0f38f486 (#495); live gate PASSED. Marked complete 2026-07-27 (deferment.md \u00a78.5)."
+}
@@ -0,0 +1,969 @@
+# MQTT / Sparkplug B Driver Implementation Plan
+
+> **For Claude:** REQUIRED SUB-SKILL: Use superpowers-extended-cc:executing-plans (or subagent-driven-development) to implement this plan task-by-task.
+
+**Goal:** Ship a standard Equipment-kind `Mqtt` driver that ingests plain MQTT (P1) then Sparkplug B (P2) into the OtOpcUa dual-namespace address space, with a bespoke observation browser, typed AdminUI editor, and TLS+auth-enforced fixtures.
+**Architecture:** Three new `net10.0` projects mirror the OpcUaClient triad — `.Contracts` (transport-free options/DTOs/parser/enums), `.Driver` (subscribe-first `IDriver` holding one live MQTTnet-5 client for its whole lifetime, raising `OnDataChange` from the receive callback, with a hand-rolled reconnect loop since v5 dropped `ManagedMqttClient`), and `.Browser` (a passive `#`/birth observation-window `IBrowseSession`). Sparkplug B decodes vendored Eclipse Tahu protobuf via `Google.Protobuf`/`Grpc.Tools` over that same single client — no SparkplugNet.
+**Tech Stack:** MQTTnet v5 (MIT, .NET Foundation, ships `net10.0`), vendored Eclipse Tahu `sparkplug_b.proto` + `Google.Protobuf` (already pinned 3.34.1) + `Grpc.Tools` (already pinned 2.76.0, build-time), bespoke browser.
+**Source design:** docs/plans/2026-07-15-mqtt-sparkplug-driver-design.md
+
+**Phases:** P1 (plain MQTT) = Tasks 0–14 (a complete shippable milestone); P2 (Sparkplug B ingest) = Tasks 15–26 (built on the P1 skeleton). Write-through (NCMD/DCMD/plain-publish) is deferred — see "Deferred / out of scope".
+
+---
+
+## Cross-cutting rules (apply to every task — program design §3.1)
+
+- **Enum-serialization trap (systemic bug):** every JSON seam that (de)serializes `MqttDriverOptions` or a tag config — factory, probe, browser, **and** the AdminUI driver-config page + probe DTO — MUST share a `JsonSerializerOptions` carrying `new JsonStringEnumConverter()` + `PropertyNameCaseInsensitive=true` + `UnmappedMemberHandling=Skip`. `MqttMode`, `MqttPayloadFormat`, `protocolVersion` are enums; serialize them as **names**. Mirror `OpcUaClientDriverFactoryExtensions`.
+- **Per-op deadline (R2-01 frozen-peer lesson):** every network call (connect / subscribe / probe / rebirth-publish) has a bounded linked-CTS deadline. No unbounded waits on a dead broker.
+- **Ctor is connection-free:** `MqttDriver`/`MqttDriverBrowser` constructors touch no network; all connects happen in `InitializeAsync`/`OpenAsync` (the universal-browser `CanBrowse` throwaway-instance pattern depends on this).
+- **Secrets from env:** broker `password` is blank in committed JSON, supplied via env (mirror `ServerHistorian__ApiKey`). Never commit or log creds.
+- **Broker security — never ship anonymous/public-broker defaults:** default `useTls=true`, real auth. `allowUntrustedServerCertificate` + `caCertificatePath` mirror the ServerHistorian TLS knobs (dev/on-prem escape hatch, off by default). Fixtures run auth+TLS.
+- **DriverType string is `"Mqtt"`** everywhere (driver page, probe, factory, editor map, validator, browser). One constant `DriverTypeNames.Mqtt`; grep to enforce (heed the `ModbusTcp`/`Modbus` mismatch lesson).
+- **Live-verify discipline:** Razor binding + deploy-inertness bugs pass unit tests. Every picker/editor/deploy path gets a docker-dev `/run` live-verify (Tasks 14 + 26).
+- **New-project csproj:** `net10.0`, `Nullable` + `ImplicitUsings` enabled, `TreatWarningsAsErrors=true` opted in per-csproj (not global).
+
+---
+
+## Task 0 (P1): Dependency-validation spike — MQTTnet-5 pin + net10 restore/build
+
+**Classification:** standard
+**Estimated implement time:** ~5 min
+**Parallelizable with:** none (this is the gate — the design's #1 dependency risk; nothing else starts until it is green)
+**Files:**
+- Modify: `Directory.Packages.props` (add `<PackageVersion Include="MQTTnet" Version="5.x" />`)
+- Create: `src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Contracts/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Contracts.csproj` (temporary spike form — references `MQTTnet` only to prove the graph restores; the transport ref is removed in Task 1, `.Contracts` is transport-free)
+- Modify: `ZB.MOM.WW.OtOpcUa.slnx` (add the project)
+
+**Why first:** The design (§2.1, §10) makes this the top dependency risk — the repo uses central package management with `CentralPackageTransitivePinningEnabled` **deliberately OFF** (Roslyn 5.0.0/4.12.0 split, `Directory.Packages.props:103` comment + "Transitive pinning breaks Roslyn build" memory). We must prove **MQTTnet v5 restores and builds clean on net10 in this exact pinning configuration** before writing any driver code. Fresh-restore red-vs-local-green (the NU1903 memory) also means we validate a clean restore, not just an incremental one.
+
+### Steps
+1. Confirm on NuGet the exact latest **MQTTnet v5** version carrying a `net10.0` TFM; pin that exact version in `Directory.Packages.props` (alphabetical position near `MessagePack`).
+2. Scaffold the `.Contracts` csproj (net10.0, nullable, implicit usings, TWAE) with a single `<PackageReference Include="MQTTnet" />` (no `Version` — central management supplies it). Add to `slnx`.
+3. Re-verify the two external-library record claims (design §2.1 checkbox): (a) MQTTnet v5 net10.0 TFM exists; (b) SparkplugNet still transitively pins MQTTnet 4.3.x with no net10.0 TFM. Record the confirmed versions in the tasks.json note. The hand-roll decision does not hinge on (b) — it is a confirm-the-record check.
+4. Prove a **clean** restore + build:
+```bash
+dotnet restore src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Contracts   # expect: no NU1605/NU1608 version-conflict, no NU1903 audit error
+dotnet build   src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Contracts   # expect: Build succeeded, 0 warnings (TWAE on)
+rm -rf ~/.nuget/packages/mqttnet && dotnet restore src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Contracts  # fresh-restore proof
+```
+**Expected:** all three succeed with zero version-conflict / transitive-pin / audit errors. If restore fails on a 4/5 diamond or a missing net10 TFM, STOP — the hand-roll-Tahu decision (§2.1) is vindicated but the MQTTnet-5 pin itself is the blocker; resolve the exact version before proceeding.
+5. Commit:
+```bash
+git commit -am "feat(mqtt): validate MQTTnet-5/net10 restore under central pinning (spike, P1 gate)
+
+Claude-Session: https://claude.ai/code/session_01GASWkNEi68FSCtvr6rLoEW"
+```
+
+---
+
+## Task 1 (P1): `.Contracts` — enums + `MqttDriverOptions` DTO
+
+**Classification:** small
+**Estimated implement time:** ~5 min
+**Parallelizable with:** none (Task 2 depends on this)
+**Files:**
+- Modify: `src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Contracts/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Contracts.csproj` (drop the temporary MQTTnet ref from Task 0 — `.Contracts` is transport-free; reference only `Core.Abstractions`)
+- Create: `src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Contracts/MqttMode.cs` (`Plain | SparkplugB`)
+- Create: `src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Contracts/MqttPayloadFormat.cs` (`Json | Raw | Scalar`)
+- Create: `src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Contracts/MqttProtocolVersion.cs` (`V311 | V500`)
+- Create: `src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Contracts/MqttDriverOptions.cs` (broker conn + mode + `sparkplug`/`plain` sub-objects, §5.1)
+- Create: `tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Tests/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Tests.csproj` (net10, xUnit + Shouldly)
+- Create: `tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Tests/MqttDriverOptionsTests.cs`
+- Modify: `ZB.MOM.WW.OtOpcUa.slnx`
+
+### Steps (TDD)
+1. Write the failing test — options round-trip enum-as-name:
+```csharp
+public sealed class MqttDriverOptionsTests
+{
+    private static readonly JsonSerializerOptions J = new()
+    {
+        PropertyNameCaseInsensitive = true,
+        UnmappedMemberHandling = JsonUnmappedMemberHandling.Skip,
+        Converters = { new JsonStringEnumConverter() },
+    };
+
+    [Fact]
+    public void Deserialize_SparkplugConfig_ReadsModeAndSubObject()
+    {
+        const string json = """
+        { "host":"10.100.0.35","port":8883,"useTls":true,"mode":"SparkplugB",
+          "sparkplug":{"groupId":"Plant1","hostId":"h1","requestRebirthOnGap":true} }
+        """;
+        var o = JsonSerializer.Deserialize<MqttDriverOptions>(json, J)!;
+        o.Mode.ShouldBe(MqttMode.SparkplugB);
+        o.UseTls.ShouldBeTrue();
+        o.Sparkplug!.GroupId.ShouldBe("Plant1");
+        o.Plain.ShouldBeNull();
+    }
+
+    [Fact]
+    public void Serialize_WritesEnumsAsNames_NotOrdinals()
+    {
+        var s = JsonSerializer.Serialize(new MqttDriverOptions { Mode = MqttMode.Plain }, J);
+        s.ShouldContain("\"Plain\"");
+        s.ShouldNotContain("\"mode\":0");
+    }
+}
+```
+2. Run — expect FAIL (types don't exist):
+```bash
+dotnet test tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Tests   # RED
+```
+3. Implement the enums + `MqttDriverOptions` (with nested `MqttSparkplugOptions` / `MqttPlainOptions`) matching §5.1 defaults (`useTls=true`, `connectTimeoutSeconds=15`, `reconnectMin/MaxBackoffSeconds=1/30`). Wire the test csproj into `slnx`.
+4. Run — expect PASS.
+5. Commit: `git commit -am "feat(mqtt): Contracts options DTO + enums (name-serialized)"` (+ session trailer).
+
+---
+
+## Task 2 (P1): `.Contracts` — `MqttTagDefinition` + `MqttEquipmentTagParser` (plain)
+
+**Classification:** standard
+**Estimated implement time:** ~5 min
+**Parallelizable with:** none (Task 6 depends on the resolver)
+**Files:**
+- Create: `src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Contracts/MqttTagDefinition.cs` (parsed per-tag descriptor — carries plain OR sparkplug variant fields; plain fields populated in P1)
+- Create: `src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Contracts/MqttEquipmentTagParser.cs` (`TryParse(reference, out def)` + `Inspect(reference)`, mirrors `ModbusEquipmentTagParser` / `ModbusTagDefinitionFactory`)
+- Create: `tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Tests/MqttEquipmentTagParserTests.cs`
+
+### Steps (TDD)
+1. Failing tests — parse a plain TagConfig blob, reject a typo'd enum (strict), and reject a wildcard topic:
+```csharp
+[Fact]
+public void TryParse_PlainJsonBlob_PopulatesTopicAndPath()
+{
+    const string r = """{"topic":"factory/oven/temp","payloadFormat":"Json","jsonPath":"$.value","dataType":"Double","qos":1}""";
+    MqttEquipmentTagParser.TryParse(r, out var def).ShouldBeTrue();
+    def!.Topic.ShouldBe("factory/oven/temp");
+    def.PayloadFormat.ShouldBe(MqttPayloadFormat.Json);
+    def.Name.ShouldBe(r);   // the def Name == reference string (forward-router key)
+}
+
+[Fact]
+public void TryParse_TypoedPayloadFormat_RejectsStrict()
+    => MqttEquipmentTagParser.TryParse(
+        """{"topic":"a/b","payloadFormat":"Jason","dataType":"Double"}""", out _).ShouldBeFalse();
+
+[Fact]
+public void Inspect_WildcardTopic_ReturnsWarning()
+    => MqttEquipmentTagParser.Inspect("""{"topic":"a/+/c","payloadFormat":"Raw"}""").ShouldNotBeEmpty();
+```
+2. Run — expect FAIL.
+3. Implement: a leading `{` marks a TagConfig blob; use `TagConfigJson.TryReadEnumStrict` for `payloadFormat`/`dataType` (typo → `false` → `BadNodeIdUnknown` upstream). `def.Name = reference`. `Inspect` returns a deploy-time warning list for present-but-invalid enums / unparseable blobs / wildcard tag-topics. Leave Sparkplug-descriptor parsing as a stub the P2 tasks fill (`groupId`/`edgeNodeId`/`deviceId`/`metricName`).
+4. Run — expect PASS.
+5. Commit: `git commit -am "feat(mqtt): plain tag parser + strict-enum descriptor"` (+ trailer).
+
+---
+
+## Task 3 (P1): `.Driver` project + `MqttConnection` connect/TLS/auth (bounded)
+
+**Classification:** standard
+**Estimated implement time:** ~5 min
+**Parallelizable with:** none (Task 4 extends `MqttConnection`)
+**Files:**
+- Create: `src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.csproj` (net10, refs `.Contracts` + `Core.Abstractions` + `Core` + `MQTTnet`)
+- Create: `src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt/MqttConnection.cs` (MQTTnet-5 client wrapper: build options from `MqttDriverOptions` incl. TLS + CA-pin + credentials; `ConnectAsync(ct)` under `connectTimeoutSeconds` linked-CTS)
+- Create: `tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Tests/MqttConnectionTests.cs`
+- Modify: `ZB.MOM.WW.OtOpcUa.slnx`
+
+### Steps (TDD)
+1. Failing test — bounded connect against a dead endpoint fails fast (no hang), and TLS-option assembly honours the knobs. Use a closed loopback port for the deadline test:
+```csharp
+[Fact]
+public async Task ConnectAsync_DeadBroker_FailsWithinDeadline_NoHang()
+{
+    var opts = new MqttDriverOptions { Host = "127.0.0.1", Port = 1, UseTls = false, ConnectTimeoutSeconds = 2 };
+    var conn = new MqttConnection(opts, driverId: "t", logger: null);
+    var sw = Stopwatch.StartNew();
+    await Should.ThrowAsync<Exception>(() => conn.ConnectAsync(CancellationToken.None));
+    sw.Elapsed.ShouldBeLessThan(TimeSpan.FromSeconds(5));   // deadline honoured, not wedged
+}
+
+[Fact]
+public void BuildClientOptions_UseTlsWithCaPin_SetsTlsAndValidatesChain()
+{
+    var opts = new MqttDriverOptions { Host="h", Port=8883, UseTls=true,
+        AllowUntrustedServerCertificate=false, CaCertificatePath="/tmp/ca.pem" };
+    var built = MqttConnection.BuildClientOptions(opts, clientIdSuffix: null);
+    built.ChannelOptions.ShouldBeOfType<MqttClientTcpOptions>().TlsOptions.UseTls.ShouldBeTrue();
+}
+```
+2. Run — expect FAIL.
+3. Implement `MqttConnection`: static `BuildClientOptions(opts, clientIdSuffix)` (host/port, protocol version, clientId + optional suffix, keep-alive, clean-session, credentials, TLS with `AllowUntrustedServerCertificate` → custom cert validator, `CaCertificatePath` → chain pin). `ConnectAsync(ct)` links `ct` with a `connectTimeoutSeconds` CTS. Ctor stores options only — connection-free.
+4. Run — expect PASS.
+5. Commit: `git commit -am "feat(mqtt): MqttConnection connect/TLS/auth under bounded deadline"` (+ trailer).
+
+---
+
+## Task 4 (P1): `MqttConnection` hand-rolled reconnect loop (backoff + resubscribe)
+
+**Classification:** high-risk
+**Estimated implement time:** ~5 min
+**Parallelizable with:** none
+**Files:**
+- Modify: `src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt/MqttConnection.cs` (reconnect loop: exponential backoff `min→max`; on `DisconnectedAsync` schedule reconnect; on reconnect fire a `Reconnected` callback so the driver re-subscribes; expose `State` = Connected/Reconnecting/Faulted + `LastMessageAgeUtc`)
+- Modify: `tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Tests/MqttConnectionTests.cs`
+
+**Why high-risk:** MQTTnet v5 dropped v4's `ManagedMqttClient` (§8) — there is no library-managed reconnect. Subscriptions do not survive a clean session; a reconnect that forgets to re-subscribe silently goes dark. Backoff that ignores its cap can hot-loop a dead broker.
+
+### Steps (TDD)
+1. Failing tests — backoff schedule is bounded + monotone-to-cap, and a `Reconnected` event drives a re-subscribe callback. Test the backoff calculator as a pure function (no live broker):
+```csharp
+[Theory]
+[InlineData(0, 1)] [InlineData(1, 2)] [InlineData(2, 4)] [InlineData(10, 30)]  // caps at max=30
+public void NextBackoff_IsExponentialClampedToMax(int attempt, int expectedSeconds)
+    => MqttConnection.NextBackoff(attempt, minSeconds: 1, maxSeconds: 30)
+        .ShouldBe(TimeSpan.FromSeconds(expectedSeconds));
+
+[Fact]
+public async Task OnReconnect_InvokesResubscribeCallback()
+{
+    var conn = new MqttConnection(new MqttDriverOptions(), "t", null);
+    var fired = 0; conn.Reconnected += () => { fired++; return Task.CompletedTask; };
+    await conn.RaiseReconnectedForTest();   // test seam
+    fired.ShouldBe(1);
+}
+```
+2. Run — expect FAIL.
+3. Implement: `NextBackoff(attempt, min, max)` pure; a reconnect worker that loops on disconnect with backoff, honours `cleanSession`/session-expiry, re-subscribes via the `Reconnected` callback (idempotent insurance even for persistent sessions), and (Sparkplug, P2) re-requests rebirth. `State` transitions Connected↔Reconnecting; Faulted only on unrecoverable config. Never block the MQTTnet dispatcher thread.
+4. Run — expect PASS.
+5. Commit: `git commit -am "feat(mqtt): hand-rolled reconnect loop with bounded backoff + resubscribe"` (+ trailer).
+
+---
+
+## Task 5 (P1): `LastValueCache` + `IReadable`
+
+**Classification:** small
+**Estimated implement time:** ~5 min
+**Parallelizable with:** Task 6
+**Files:**
+- Create: `src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt/LastValueCache.cs` (`FullReference → DataValueSnapshot`, thread-safe)
+- Create: `tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Tests/LastValueCacheTests.cs`
+
+### Steps (TDD)
+1. Failing test — unseen reference returns a per-ref `GoodNoData`/uncertain snapshot (never throws the batch); a seeded ref returns last value:
+```csharp
+[Fact]
+public void Read_UnseenRef_ReturnsPerRefNoData_DoesNotThrow()
+{
+    var c = new LastValueCache();
+    var snap = c.Read("factory/oven/temp#$.value");
+    snap.StatusCode.ShouldBe(StatusCodes.GoodNoData);   // or Uncertain — per IReadable contract, per-ref status
+}
+
+[Fact]
+public void Update_ThenRead_ReturnsLastValue()
+{
+    var c = new LastValueCache();
+    c.Update("k", DataValueSnapshot.Good(42.0, DateTime.UtcNow));
+    c.Read("k").Value.ShouldBe(42.0);
+}
+```
+2. Run — expect FAIL.
+3. Implement `LastValueCache` (concurrent dict); `MqttDriver.ReadAsync` (Task 7) returns `references.Select(cache.Read)` — batch never throws, per-ref `StatusCode` carries "not yet observed".
+4. Run — expect PASS.
+5. Commit: `git commit -am "feat(mqtt): last-value cache backing IReadable (per-ref no-data)"` (+ trailer).
+
+---
+
+## Task 6 (P1): `ISubscribable` — plain topic subscribe → `OnDataChange` + retained seed
+
+**Classification:** standard
+**Estimated implement time:** ~5 min
+**Parallelizable with:** Task 5
+**Files:**
+- Create: `src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt/MqttSubscriptionManager.cs` (registers `FullReference → MqttTagDefinition` via the shared `EquipmentTagRefResolver<MqttTagDefinition>`; dedupes/coalesces topics; on message: match topic → authored tag(s), extract value at `jsonPath`/raw/scalar, raise `OnDataChange`; seed from retained message on subscribe)
+- Modify: `src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt/MqttConnection.cs` (expose `SubscribeAsync(filters, ct)` under a bounded deadline + a message-received event)
+- Create: `tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Tests/MqttSubscriptionManagerTests.cs`
+
+### Steps (TDD)
+1. Failing test — feed a synthetic received message through the manager (no live broker); assert routing + JSONPath extraction fire `OnDataChange` with the right `FullReference`:
+```csharp
+[Fact]
+public void OnMessage_MatchingTopic_RaisesDataChangeAtJsonPath()
+{
+    var mgr = new MqttSubscriptionManager();
+    var handle = mgr.Register(new[] { """{"topic":"f/oven/temp","payloadFormat":"Json","jsonPath":"$.value","dataType":"Double"}""" });
+    string? gotRef = null; object? gotVal = null;
+    mgr.OnDataChange += (_, e) => { gotRef = e.FullReference; gotVal = e.Snapshot.Value; };
+    mgr.HandleMessage("f/oven/temp", """{"value":21.5}"""u8.ToArray(), retained: false);
+    gotVal.ShouldBe(21.5);
+    gotRef.ShouldContain("f/oven/temp");
+}
+
+[Fact]
+public void OnMessage_UnauthoredTopic_RaisesNothing()  // chatty broker must not auto-provision
+{
+    var mgr = new MqttSubscriptionManager();
+    mgr.Register(Array.Empty<string>());
+    var fired = false; mgr.OnDataChange += (_, _) => fired = true;
+    mgr.HandleMessage("random/topic", "1"u8.ToArray(), retained: false);
+    fired.ShouldBeFalse();
+}
+```
+2. Run — expect FAIL.
+3. Implement using `EquipmentTagRefResolver<MqttTagDefinition>` (parse-once cache, as Modbus does). `HandleMessage` matches topic → tag(s), extracts (Json→JSONPath token→typed value; Raw→bytes-as-string; Scalar→parse), updates `LastValueCache`, raises `OnDataChange`. Retained-flagged messages seed initial value. `SubscribeAsync` returns an `ISubscriptionHandle` whose `DiagnosticId` names mode+filter; completes under a bounded SUBACK deadline (SUBACK failure → per-ref Bad, not hang).
+4. Run — expect PASS.
+5. Commit: `git commit -am "feat(mqtt): plain subscribe→OnDataChange with retained seed + ref resolver"` (+ trailer).
+
+---
+
+## Task 7 (P1): `MqttDriver` shell — `IDriver` + authored-only `ITagDiscovery` + `IHostConnectivityProbe`
+
+**Classification:** standard
+**Estimated implement time:** ~5 min
+**Parallelizable with:** none (Task 8/9 wire it)
+**Files:**
+- Create: `src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt/MqttDriver.cs` (`IDriver, ITagDiscovery, ISubscribable, IReadable, IHostConnectivityProbe, IRediscoverable`; composes `MqttConnection` + `MqttSubscriptionManager` + `LastValueCache`)
+- Create: `tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Tests/MqttDriverDiscoveryTests.cs`
+
+### Steps (TDD)
+1. Failing test — `DiscoverAsync` streams **only authored tags** into a capturing `IAddressSpaceBuilder`; plain-mode `RediscoverPolicy == Once`; `SupportsOnlineDiscovery == false`:
+```csharp
+[Fact]
+public async Task DiscoverAsync_Plain_StreamsAuthoredTagsOnly_PolicyOnce()
+{
+    var driver = new MqttDriver(new MqttDriverOptions { Mode = MqttMode.Plain }, "d", null);
+    driver.SetAuthoredTagsForTest(new[] { """{"topic":"f/t","payloadFormat":"Raw","dataType":"String"}""" });
+    var b = new CapturingAddressSpaceBuilder();
+    await driver.DiscoverAsync(b, CancellationToken.None);
+    b.Variables.Count.ShouldBe(1);
+    driver.RediscoverPolicy.ShouldBe(DiscoveryRediscoverPolicy.Once);
+    ((ITagDiscovery)driver).SupportsOnlineDiscovery.ShouldBeFalse();
+}
+```
+2. Run — expect FAIL.
+3. Implement: `InitializeAsync` deserializes options (shared `JsonSerializerOptions`), builds + connects `MqttConnection`, subscribes the mode-appropriate filter. `ReinitializeAsync` applies deltas in place (never crash → Faulted). `ShutdownAsync` disconnects/disposes. `GetHealth` = Connected/Reconnecting/Faulted + last-message-age. `GetMemoryFootprint` = caches; `FlushOptionalCachesAsync` = no-op (birth/alias are correctness state — forbidden to flush; last-value backs `IReadable`). `DiscoverAsync` replays authored tags only; `RediscoverPolicy => Once` (plain). `IRediscoverable.OnRediscoveryNeeded` never fires in plain mode.
+4. Run — expect PASS.
+5. Commit: `git commit -am "feat(mqtt): MqttDriver shell — lifecycle + authored-only discovery (Once)"` (+ trailer).
+
+---
+
+## Task 8 (P1): `MqttDriverProbe` — CONNECT handshake
+
+**Classification:** small
+**Estimated implement time:** ~5 min
+**Parallelizable with:** Task 10
+**Files:**
+- Create: `src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt/MqttDriverProbe.cs` (`IDriverProbe`, `DriverType => "Mqtt"`; parse config with the shared options, open a CONNECT under the timeout, green + latency on CONNACK-accepted, targeted error on refused/TLS/auth/timeout — mirrors `ModbusDriverProbe`)
+- Create: `tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Tests/MqttDriverProbeTests.cs`
+
+### Steps (TDD)
+1. Failing test — `DriverType` is `"Mqtt"`; a dead endpoint yields a failed (not thrown) probe result within the deadline:
+```csharp
+[Fact]
+public void DriverType_IsCanonicalMqtt() => new MqttDriverProbe().DriverType.ShouldBe("Mqtt");
+
+[Fact]
+public async Task ProbeAsync_DeadBroker_ReturnsFailedResult_WithinDeadline()
+{
+    var r = await new MqttDriverProbe().ProbeAsync(
+        """{"host":"127.0.0.1","port":1,"useTls":false,"connectTimeoutSeconds":2}""", CancellationToken.None);
+    r.Success.ShouldBeFalse();
+    r.Message.ShouldNotBeNullOrEmpty();
+}
+```
+2. Run — expect FAIL.
+3. Implement; CONNACK-accepted is the MQTT "device is answering" proof. Use the **shared** `JsonSerializerOptions` (enum-as-name).
+4. Run — expect PASS.
+5. Commit: `git commit -am "feat(mqtt): MqttDriverProbe CONNECT handshake"` (+ trailer).
+
+---
+
+## Task 9 (P1): Factory + `DriverTypeNames.Mqtt` + Host registration
+
+**Classification:** standard
+**Estimated implement time:** ~5 min
+**Parallelizable with:** none
+**Files:**
+- Create: `src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt/MqttDriverFactoryExtensions.cs` (`DriverTypeName = "Mqtt"`, shared `JsonSerializerOptions`, `Register(registry, loggerFactory)` — mirror `OpcUaClientDriverFactoryExtensions`)
+- Modify: `src/Core/ZB.MOM.WW.OtOpcUa.Core.Abstractions/DriverTypeNames.cs` (add `public const string Mqtt = "Mqtt";` + append to the `All` list)
+- Modify: `src/Server/ZB.MOM.WW.OtOpcUa.Host/Drivers/DriverFactoryBootstrap.cs` (add `Driver.Mqtt.MqttDriverFactoryExtensions.Register(registry, loggerFactory);` in `Register(...)` near line 146; add `using MqttProbe = Driver.Mqtt.MqttDriverProbe;` + `services.TryAddEnumerable(ServiceDescriptor.Singleton<IDriverProbe, MqttProbe>());` in `AddOtOpcUaDriverProbes` near line 124)
+- Modify: `src/Server/ZB.MOM.WW.OtOpcUa.Host/ZB.MOM.WW.OtOpcUa.Host.csproj` (ProjectReference the `.Driver` assembly)
+- Create: `tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Tests/MqttDriverFactoryExtensionsTests.cs`
+
+### Steps (TDD)
+1. Failing test — `Register` binds the `"Mqtt"` type, and the factory builds an `MqttDriver` from JSON with string enums:
+```csharp
+[Fact]
+public void Register_ThenCreate_BuildsMqttDriver()
+{
+    var registry = new DriverFactoryRegistry();
+    MqttDriverFactoryExtensions.Register(registry);
+    var d = registry.Create("Mqtt", "d1", """{"host":"h","port":1883,"mode":"Plain"}""");
+    d.ShouldBeOfType<MqttDriver>();
+}
+
+[Fact]
+public void DriverTypeName_MatchesConstant()
+    => MqttDriverFactoryExtensions.DriverTypeName.ShouldBe(DriverTypeNames.Mqtt);
+```
+2. Run — expect FAIL.
+3. Implement + wire both host sites. Build the whole solution to confirm registration compiles:
+```bash
+dotnet build ZB.MOM.WW.OtOpcUa.slnx   # expect: Build succeeded
+```
+4. Run — expect PASS.
+5. Commit: `git commit -am "feat(mqtt): factory + DriverTypeNames.Mqtt + host factory/probe registration"` (+ trailer).
+
+---
+
+## Task 10 (P1): `.Browser` — bespoke `#`-observation browser (passive)
+
+**Classification:** standard
+**Estimated implement time:** ~5 min
+**Parallelizable with:** Task 8
+**Files:**
+- Create: `src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Browser/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Browser.csproj` (net10, refs `.Contracts` + `Commons(.Browsing)` + `MQTTnet`)
+- Create: `src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Browser/MqttDriverBrowser.cs` (`IDriverBrowser`, `DriverType => "Mqtt"`; `OpenAsync` connects with a `{clientId}-browse-{guid8}` suffix under a clamped 5–30 s budget; subscribes `#`/`{topicPrefix}#`; returns `MqttBrowseSession`; **publishes nothing**)
+- Create: `src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Browser/MqttBrowseSession.cs` (`IBrowseSession` over a thread-safe accumulating observed tree; `RootAsync`/`ExpandAsync` split topic segments on `/`, leaf = `Kind=Leaf`; `AttributesAsync` = synthetic attribute w/ inferred type + last payload snippet; `DisposeAsync` disconnects best-effort)
+- Modify: `ZB.MOM.WW.OtOpcUa.slnx`
+- Create: `tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Tests/MqttBrowseSessionTests.cs`
+
+### Steps (TDD)
+1. Failing test — feed observed topics into the session's accumulating tree (test seam, no live broker); assert `RootAsync`/`ExpandAsync` build the segment tree and **no publish** occurs on any browse call:
+```csharp
+[Fact]
+public async Task ExpandAsync_BuildsTopicSegmentTree_FromObservedTopics()
+{
+    var s = new MqttBrowseSession(MqttMode.Plain);
+    s.ObserveTopicForTest("factory/line3/oven/temp");
+    var root = await s.RootAsync(CancellationToken.None);
+    root.ShouldContain(n => n.BrowseName == "factory");
+    var lvl2 = await s.ExpandAsync("factory", CancellationToken.None);
+    lvl2.ShouldContain(n => n.BrowseName == "line3");
+}
+
+[Fact]
+public async Task BrowseCalls_PublishNothing()   // browse is read-only
+{
+    var s = new MqttBrowseSession(MqttMode.Plain);
+    await s.RootAsync(CancellationToken.None);
+    s.PublishCountForTest.ShouldBe(0);
+}
+```
+2. Run — expect FAIL.
+3. Implement the accumulating tree + passive `OpenAsync`. In P1 only the plain `#` path is live; leave a Sparkplug hook the P2 tasks fill (`Group→EdgeNode→Device→Metric` + `RequestRebirthAsync`).
+4. Run — expect PASS.
+5. Commit: `git commit -am "feat(mqtt): bespoke passive #-observation browser (plain)"` (+ trailer).
+
+---
+
+## Task 11 (P1): Register the bespoke browser (overrides universal fallback)
+
+**Classification:** trivial
+**Estimated implement time:** ~3 min
+**Parallelizable with:** Task 12
+**Files:**
+- Modify: `src/Server/ZB.MOM.WW.OtOpcUa.AdminUI/EndpointRouteBuilderExtensions.cs` (add `services.AddSingleton<IDriverBrowser, MqttDriverBrowser>();` alongside the existing two near line 75–76)
+- Modify: `src/Server/ZB.MOM.WW.OtOpcUa.AdminUI/ZB.MOM.WW.OtOpcUa.AdminUI.csproj` (ProjectReference `.Browser`)
+
+### Steps
+1. Add the registration + project reference. Registering for `DriverType="Mqtt"` overrides the universal fallback (`BrowserSessionService` resolves bespoke-first).
+2. Build: `dotnet build src/Server/ZB.MOM.WW.OtOpcUa.AdminUI` — expect success.
+3. Commit: `git commit -am "feat(mqtt): register MqttDriverBrowser (bespoke-first for Mqtt)"` (+ trailer).
+
+---
+
+## Task 12 (P1): Typed AdminUI editor + validator (plain shape)
+
+**Classification:** standard
+**Estimated implement time:** ~5 min
+**Parallelizable with:** Task 11
+**Files:**
+- Create: `src/Server/ZB.MOM.WW.OtOpcUa.AdminUI/Uns/TagEditors/MqttTagConfigModel.cs` (thin typed model over a preserved `JsonObject` key bag; `FromJson`/`ToJson`/`Validate`, preserves unknown keys incl. history keys; carries a `Mode` field selecting sub-shape — P1 implements Plain `Validate`, Sparkplug stub filled in Task 24)
+- Modify: `src/Server/ZB.MOM.WW.OtOpcUa.AdminUI/Uns/TagEditors/TagConfigEditorMap.cs` (`[DriverTypeNames.Mqtt] = typeof(Components.Shared.Uns.TagEditors.MqttTagConfigEditor)`)
+- Modify: `src/Server/ZB.MOM.WW.OtOpcUa.AdminUI/Uns/TagEditors/TagConfigValidator.cs` (`[DriverTypeNames.Mqtt] = j => MqttTagConfigModel.FromJson(j).Validate()`)
+- Create: `src/Server/ZB.MOM.WW.OtOpcUa.AdminUI/Components/Shared/Uns/TagEditors/MqttTagConfigEditor.razor` (copy the Modbus editor template — mode-switch at top, per-mode field group, client-side `Validate()`)
+- Create: `tests/Server/.../MqttTagConfigModelTests.cs` (co-locate with the existing AdminUI test project — verify path with `find tests/Server -name "*TagConfigModel*Tests.cs"`)
+
+### Steps (TDD)
+1. Failing test — round-trip preserves unknown/history keys; plain `Validate` requires concrete topic + jsonPath-when-Json; re-derives `FullName`:
+```csharp
+[Fact]
+public void FromJson_ToJson_PreservesUnknownKeys()
+{
+    var m = MqttTagConfigModel.FromJson("""{"topic":"a/b","payloadFormat":"Raw","dataType":"String","isHistorized":true}""");
+    m.ToJson().ShouldContain("isHistorized");
+}
+
+[Fact]
+public void Validate_PlainWildcardTopic_Fails()
+    => MqttTagConfigModel.FromJson("""{"topic":"a/+/c","payloadFormat":"Raw","dataType":"String"}""")
+        .Validate().ShouldNotBeEmpty();
+
+[Fact]
+public void Validate_JsonWithoutPath_Fails()
+    => MqttTagConfigModel.FromJson("""{"topic":"a/b","payloadFormat":"Json","dataType":"Double"}""")
+        .Validate().ShouldNotBeEmpty();
+```
+2. Run — expect FAIL.
+3. Implement the model (mirror `OpcUaClientTagConfigModel`); `ToJson` writes PascalCase `FullName` re-derived from descriptor (`{topic}#{jsonPath}` plain). Build the `.razor`. Register both map entries.
+4. Run — expect PASS + `dotnet build src/Server/ZB.MOM.WW.OtOpcUa.AdminUI`.
+5. Commit: `git commit -am "feat(mqtt): typed tag editor + validator (plain mode)"` (+ trailer).
+
+---
+
+## Task 13 (P1): Mosquitto + JSON-publisher fixture (TLS+auth) + env-gated live suite
+
+**Classification:** standard
+**Estimated implement time:** ~5 min
+**Parallelizable with:** none
+**Files:**
+- Create: `tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.IntegrationTests/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.IntegrationTests.csproj`
+- Create: `tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.IntegrationTests/Docker/docker-compose.yml` (`eclipse-mosquitto` with **auth + TLS** on `:8883`, plain `:1883` for smoke only; a JSON-publisher container emitting `retain=true` JSON on a few topics — `mosquitto_pub` loop or `paho-mqtt` script; `project=lmxopcua` label applied host-side)
+- Create: `tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.IntegrationTests/Docker/mosquitto.conf` + password/cert material generator script (creds via env, never real secrets committed)
+- Create: `tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.IntegrationTests/PlainMqttLiveTests.cs` (category `LiveIntegration`, gated on `MQTT_FIXTURE_ENDPOINT` — skips clean when unset → macOS-offline-safe)
+- Modify: `ZB.MOM.WW.OtOpcUa.slnx`
+
+### Steps
+1. Write the compose with **auth + TLS** (never anonymous). Add the JSON publisher with `retain=true`.
+2. Write env-gated tests: connect/TLS/auth; plain subscribe + retained-read seed; unauthored-topic silence. `[SkippableFact]` reading `MQTT_FIXTURE_ENDPOINT`.
+3. Confirm offline skip:
+```bash
+dotnet test tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.IntegrationTests   # expect: all Skipped (no env var)
+```
+4. Deploy the fixture to the docker host and run live (design §9):
+```bash
+lmxopcua-fix sync mqtt && lmxopcua-fix up mqtt
+export MQTT_FIXTURE_ENDPOINT=10.100.0.35:8883
+dotnet test tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.IntegrationTests --filter "Category=LiveIntegration"   # expect: PASS
+```
+5. Commit: `git commit -am "test(mqtt): Mosquitto TLS+auth fixture + env-gated plain live suite"` (+ trailer).
+
+---
+
+## Task 14 (P1): Live `/run` verify on docker-dev — **P1 MILESTONE COMPLETE**
+
+**Classification:** small
+**Estimated implement time:** ~5 min
+**Parallelizable with:** none
+**Files:**
+- Modify: `CLAUDE.md` (add the MQTT fixture endpoint to the Docker Workflow endpoint list: `10.100.0.35:1883/8883`, `MQTT_FIXTURE_ENDPOINT`)
+- Modify: `docs/plans/2026-07-15-driver-expansion-tracking.md` (mark MQTT P1 code-complete)
+
+### Steps
+1. On docker-dev (`:9200`, login disabled — run it yourself, do not defer): author an `Mqtt` driver (Plain mode) + a tag via the `/uns` picker (bespoke `#`-observation browser) or the typed editor; deploy.
+2. Confirm via Client.CLI the node carries live broker values:
+```bash
+dotnet run --project src/Client/ZB.MOM.WW.OtOpcUa.Client.CLI -- read -u opc.tcp://localhost:4840 -n "ns=2;s=<RawPath>"
+```
+3. Confirm the typed editor renders (Razor binding bugs pass unit tests — live-verify is mandatory). Update CLAUDE.md + tracking doc.
+4. Commit: `git commit -am "docs(mqtt): P1 plain-MQTT milestone live-verified; endpoint recorded"` (+ trailer).
+
+---
+
+# ── P2: Sparkplug B ingest (builds on the P1 skeleton) ──
+
+## Task 15 (P2): Vendor Tahu proto + `Grpc.Tools` codegen
+
+**Classification:** standard
+**Estimated implement time:** ~5 min
+**Parallelizable with:** none (P2 root)
+**Files:**
+- Create: `src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Contracts/Protos/sparkplug_b.proto` (vendored Eclipse Tahu `sparkplug_b.proto`, pinned to a known Tahu commit with a provenance comment header)
+- Modify: `src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Contracts/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Contracts.csproj` (add `Google.Protobuf` + build-time `Grpc.Tools` (`PrivateAssets=all`); `<Protobuf Include="Protos/sparkplug_b.proto" GrpcServices="None" />` — message-only codegen, this repo's first in-repo protoc step)
+- Create: `tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Tests/SparkplugProtoCodegenTests.cs`
+
+### Steps (TDD)
+1. Failing test — the generated `Payload`/`Metric` types exist and round-trip a hand-built payload:
+```csharp
+[Fact]
+public void GeneratedPayload_RoundTrips()
+{
+    var p = new Org.Eclipse.Tahu.Protobuf.Payload { Seq = 3 };
+    p.Metrics.Add(new Org.Eclipse.Tahu.Protobuf.Payload.Types.Metric { Name = "Temperature", Alias = 5 });
+    var back = Org.Eclipse.Tahu.Protobuf.Payload.Parser.ParseFrom(p.ToByteArray());
+    back.Seq.ShouldBe(3ul);
+    back.Metrics[0].Alias.ShouldBe(5ul);
+}
+```
+2. Run — expect FAIL (no generated types).
+3. Vendor the proto (provenance comment: Tahu commit hash + URL); wire `Grpc.Tools`. If in-repo protoc proves objectionable, fall back to checking in the generated C# with the same provenance comment (design §2.1). Build:
+```bash
+dotnet build src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Contracts   # expect: proto compiles, 0 warnings
+```
+4. Run — expect PASS.
+5. Commit: `git commit -am "feat(mqtt): vendor Tahu sparkplug_b.proto + Grpc.Tools codegen"` (+ trailer).
+
+---
+
+## Task 16 (P2): `SparkplugCodec` decode + golden payloads
+
+**Classification:** standard
+**Estimated implement time:** ~5 min
+**Parallelizable with:** Task 17
+**Files:**
+- Create: `src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt/Sparkplug/SparkplugCodec.cs` (decode `Payload`/`Metric` from wire bytes → a driver-side struct; encode NCMD deferred to `RebirthRequester` Task 20 / write-through P3)
+- Create: `tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Tests/SparkplugCodecTests.cs`
+- Create: `tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Tests/Golden/nbirth.bin` + `ndata.bin` (golden byte vectors, generated once from a hand-built payload and committed)
+
+### Steps (TDD)
+1. Failing test — decode a golden NBIRTH: seq + metric name/alias/datatype/value survive:
+```csharp
+[Fact]
+public void Decode_GoldenNbirth_ExtractsMetrics()
+{
+    var payload = SparkplugCodec.Decode(File.ReadAllBytes("Golden/nbirth.bin"));
+    payload.Seq.ShouldBe((byte)0);
+    payload.Metrics.ShouldContain(m => m.Name == "Temperature" && m.Alias == 5 && m.DataType == SparkplugDataType.Float);
+}
+```
+2. Run — expect FAIL.
+3. Implement `SparkplugCodec.Decode`; generate the golden vectors in a one-off `[Fact(Skip="generator")]` or a small helper, commit the `.bin` files.
+4. Run — expect PASS.
+5. Commit: `git commit -am "feat(mqtt): SparkplugCodec decode + golden payload vectors"` (+ trailer).
+
+---
+
+## Task 17 (P2): `SparkplugTopic` + `SparkplugDataType.ToDriverDataType`
+
+**Classification:** small
+**Estimated implement time:** ~5 min
+**Parallelizable with:** Task 16
+**Files:**
+- Create: `src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt/Sparkplug/SparkplugTopic.cs` (parse/format `spBv1.0/{group}/{type}/{node}[/{device}]`; `type` ∈ NBIRTH/DBIRTH/NDATA/DDATA/NDEATH/DDEATH/NCMD/DCMD/STATE)
+- Modify: `src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Contracts/SparkplugDataType.cs` (enum + `ToDriverDataType()` per the §3.5 map: Int8→Int16, UInt8→UInt16, DataSet/Template unsupported, `*Array`→element+IsArray)
+- Create: `tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Tests/SparkplugTopicTests.cs`
+
+### Steps (TDD)
+1. Failing tests — topic parse extracts group/type/node/device; datatype map widens Int8→Int16 and marks DataSet unsupported:
+```csharp
+[Fact]
+public void Parse_DeviceData_ExtractsAllSegments()
+{
+    var t = SparkplugTopic.Parse("spBv1.0/Plant1/DDATA/EdgeA/Filler1");
+    t.GroupId.ShouldBe("Plant1"); t.Type.ShouldBe(SparkplugMessageType.DDATA);
+    t.EdgeNodeId.ShouldBe("EdgeA"); t.DeviceId.ShouldBe("Filler1");
+}
+
+[Theory]
+[InlineData(SparkplugDataType.Int8, DriverDataType.Int16)]
+[InlineData(SparkplugDataType.UInt8, DriverDataType.UInt16)]
+[InlineData(SparkplugDataType.Float, DriverDataType.Float32)]
+public void ToDriverDataType_MapsAndWidens(SparkplugDataType s, DriverDataType d)
+    => s.ToDriverDataType().ShouldBe(d);
+```
+2. Run — expect FAIL.
+3. Implement.
+4. Run — expect PASS.
+5. Commit: `git commit -am "feat(mqtt): Sparkplug topic parse + datatype map"` (+ trailer).
+
+---
+
+## Task 18 (P2): `BirthCache` + `AliasTable` — bind-by-name, rebuild-per-birth
+
+**Classification:** high-risk
+**Estimated implement time:** ~5 min
+**Parallelizable with:** Task 19
+**Files:**
+- Create: `src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt/Sparkplug/AliasTable.cs` (per `(edgeNode,device)` alias→(name,datatype); **rebuilt wholesale each birth, never merged**)
+- Create: `src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt/Sparkplug/BirthCache.cs` (NBIRTH/DBIRTH metric catalog: name/alias/datatype/last value)
+- Create: `tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Tests/AliasBindingTests.cs`
+
+**Why high-risk:** §3.6 invariants #1–#2 — binding data by alias silently mis-routes when an alias is reused for a different metric across a rebirth. Bind by **stable metric NAME**; the alias is a per-birth cache only.
+
+### Steps (TDD)
+1. Failing tests — the two load-bearing invariants:
+```csharp
+[Fact]
+public void Rebirth_ReusesAliasForDifferentMetric_ResolvesByName_NotAlias()
+{
+    var t = new AliasTable();
+    t.RebuildFromBirth(new[] { (name:"Temperature", alias:5ul, dt:SparkplugDataType.Float) });
+    t.Resolve(alias: 5).Name.ShouldBe("Temperature");
+    // rebirth: alias 5 now means a DIFFERENT metric
+    t.RebuildFromBirth(new[] { (name:"Pressure", alias:5ul, dt:SparkplugDataType.Float) });
+    t.Resolve(alias: 5).Name.ShouldBe("Pressure");   // wholesale replace, not merge
+}
+
+[Fact]
+public void RebuildFromBirth_DoesNotMergeStaleAliases()
+{
+    var t = new AliasTable();
+    t.RebuildFromBirth(new[] { (name:"A", alias:1ul, dt:SparkplugDataType.Int32) });
+    t.RebuildFromBirth(new[] { (name:"B", alias:2ul, dt:SparkplugDataType.Int32) });
+    t.TryResolve(alias: 1, out _).ShouldBeFalse();   // alias 1 gone after rebirth
+}
+```
+2. Run — expect FAIL.
+3. Implement — `RebuildFromBirth` replaces the whole map. `BirthCache` keeps the metric catalog + last value keyed by name.
+4. Run — expect PASS.
+5. Commit: `git commit -am "feat(mqtt): AliasTable/BirthCache — bind-by-name, rebuild-per-birth"` (+ trailer).
+
+---
+
+## Task 19 (P2): `SequenceTracker` — seq-gap + bdSeq death-tie
+
+**Classification:** high-risk
+**Estimated implement time:** ~5 min
+**Parallelizable with:** Task 18
+**Files:**
+- Create: `src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt/Sparkplug/SequenceTracker.cs` (per edge-node `seq` 0–255 wrap gap detection; `bdSeq` ties NDEATH↔NBIRTH)
+- Create: `tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Tests/SequenceTrackerTests.cs`
+
+**Why high-risk:** §3.6 invariant #3 — a wrong wrap boundary (255→0 is NOT a gap) either misses real gaps (stale data) or false-positives every wrap (rebirth-storm).
+
+### Steps (TDD)
+1. Failing tests — contiguous ok, wrap ok, gap detected:
+```csharp
+[Fact]
+public void Sequence_WrapAt255IsContiguous_NotAGap()
+{
+    var s = new SequenceTracker();
+    s.Accept(254).ShouldBeTrue(); s.Accept(255).ShouldBeTrue(); s.Accept(0).ShouldBeTrue();  // wrap
+}
+
+[Fact]
+public void Sequence_SkippedValue_IsGap()
+{
+    var s = new SequenceTracker();
+    s.Accept(10).ShouldBeTrue();
+    s.Accept(12).ShouldBeFalse();   // gap → caller requests rebirth
+}
+```
+2. Run — expect FAIL.
+3. Implement (next-expected = `(last+1) & 0xFF`); `bdSeq` compare helper.
+4. Run — expect PASS.
+5. Commit: `git commit -am "feat(mqtt): SequenceTracker seq-gap + bdSeq death-tie"` (+ trailer).
+
+---
+
+## Task 20 (P2): `RebirthRequester` — NCMD encode
+
+**Classification:** small
+**Estimated implement time:** ~5 min
+**Parallelizable with:** none
+**Files:**
+- Create: `src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt/Sparkplug/RebirthRequester.cs` (encode an NCMD writing `Node Control/Rebirth = true` to `spBv1.0/{group}/NCMD/{node}`; publish under a bounded deadline)
+- Create: `tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Tests/RebirthRequesterTests.cs`
+
+### Steps (TDD)
+1. Failing test — encoded NCMD carries the `Node Control/Rebirth`=true metric and targets the right topic:
+```csharp
+[Fact]
+public void BuildRebirthNcmd_EncodesControlMetric_AndTopic()
+{
+    var (topic, bytes) = RebirthRequester.Build("Plant1", "EdgeA");
+    topic.ShouldBe("spBv1.0/Plant1/NCMD/EdgeA");
+    var p = SparkplugCodec.Decode(bytes);
+    p.Metrics.ShouldContain(m => m.Name == "Node Control/Rebirth" && Equals(m.Value, true));
+}
+```
+2. Run — expect FAIL.
+3. Implement (encode path via the generated proto).
+4. Run — expect PASS.
+5. Commit: `git commit -am "feat(mqtt): RebirthRequester NCMD encode"` (+ trailer).
+
+---
+
+## Task 21 (P2): Sparkplug ingest state machine — the §3.6 matrix
+
+**Classification:** high-risk
+**Estimated implement time:** ~5 min
+**Parallelizable with:** none (integrates Tasks 16–20 into the driver)
+**Files:**
+- Create: `src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt/Sparkplug/SparkplugIngestor.cs` (routes decoded messages: N/DBIRTH → rebuild `AliasTable` + `BirthCache`; N/DDATA → resolve alias→name → map to authored `FullReference` **by (group,node,device,metricName)** → `OnDataChange`; N/DDEATH → emit STALE/Bad snapshots; seq-gap / unknown-alias / data-before-birth → `RebirthRequester` gated on `requestRebirthOnGap`; STATE/primary-host handling; late-join rebirth on connect)
+- Modify: `src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt/MqttDriver.cs` (Sparkplug-mode subscribe `spBv1.0/{group}/#` (+ STATE) → `SparkplugIngestor`; reconnect → re-subscribe + request rebirth)
+- Create: `tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Tests/SparkplugIngestorTests.cs`
+
+**Why high-risk:** this is the §3.6 correctness core — the #1 risk in the design. Test the full matrix: rebirth, missed-birth, seq-gap, alias-reuse-across-rebirth, death→stale→rebirth.
+
+### Steps (TDD)
+1. Failing tests — the §3.6 matrix, driven through the ingestor with synthetic decoded messages (no live broker):
+```csharp
+[Fact]
+public void Birth_Then_Data_ResolvesByAlias_RaisesOnDataChangeByName()
+{
+    var ing = new SparkplugIngestor(...);   // authored tag: Plant1/EdgeA/Filler1:Temperature
+    string? firedRef = null; ing.OnDataChange += (_, e) => firedRef = e.FullReference;
+    ing.HandleDbirth("Plant1","EdgeA","Filler1", new[] { (name:"Temperature", alias:5ul, dt:SparkplugDataType.Float, val:(object)0f) });
+    ing.HandleDdata("Plant1","EdgeA","Filler1", seq:1, new[] { (alias:5ul, val:(object)21.5f) });
+    firedRef.ShouldContain("Filler1:Temperature");
+}
+
+[Fact]
+public void DataBeforeBirth_RequestsRebirth()
+{
+    var ncmds = new List<string>();
+    var ing = new SparkplugIngestor(..., publishNcmd: (t,_) => ncmds.Add(t));
+    ing.HandleDdata("Plant1","EdgeA","Filler1", seq:0, new[] { (alias:9ul, val:(object)1f) });
+    ncmds.ShouldContain("spBv1.0/Plant1/NCMD/EdgeA");
+}
+
+[Fact]
+public void Ddeath_EmitsStaleForDeviceMetrics_NextBirthRestoresGood()
+{
+    var ing = new SparkplugIngestor(...);
+    var quals = new List<StatusCode>(); ing.OnDataChange += (_, e) => quals.Add(e.Snapshot.StatusCode);
+    ing.HandleDbirth("Plant1","EdgeA","Filler1", new[] { (name:"Temperature", alias:5ul, dt:SparkplugDataType.Float, val:(object)0f) });
+    ing.HandleDdeath("Plant1","EdgeA","Filler1");
+    quals.ShouldContain(q => StatusCode.IsBad(q));   // STALE/Bad on death
+}
+```
+2. Run — expect FAIL.
+3. Implement the ingestor holding the §3.6 invariants. Route via `EquipmentTagRefResolver` keyed by `(group,node,device,metricName)`.
+4. Run — expect PASS (all matrix cases).
+5. Commit: `git commit -am "feat(mqtt): Sparkplug ingest state machine (birth/alias/seq/rebirth/death→stale)"` (+ trailer).
+
+---
+
+## Task 22 (P2): `ITagDiscovery` `UntilStable` + `IRediscoverable`
+
+**Classification:** standard
+**Estimated implement time:** ~5 min
+**Parallelizable with:** none
+**Files:**
+- Modify: `src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt/MqttDriver.cs` (`RediscoverPolicy => UntilStable` in Sparkplug mode — authored tags' datatypes fill in as births arrive; `DiscoverAsync` re-streams authored tags with resolved datatypes from `BirthCache`; fire `OnRediscoveryNeeded` on a **new DBIRTH** or a rebirth with a changed metric set, `ScopeHint` = edge-node/device folder path)
+- Modify: `tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Tests/MqttDriverDiscoveryTests.cs`
+
+### Steps (TDD)
+1. Failing tests — Sparkplug policy is `UntilStable`; a new DBIRTH fires `OnRediscoveryNeeded`; a tag authored before its birth picks up the birth datatype:
+```csharp
+[Fact]
+public void SparkplugMode_RediscoverPolicy_IsUntilStable()
+    => new MqttDriver(new MqttDriverOptions { Mode = MqttMode.SparkplugB }, "d", null)
+        .RediscoverPolicy.ShouldBe(DiscoveryRediscoverPolicy.UntilStable);
+
+[Fact]
+public async Task NewDbirth_FiresOnRediscoveryNeeded()
+{
+    var d = new MqttDriver(new MqttDriverOptions { Mode = MqttMode.SparkplugB }, "d", null);
+    var fired = false; ((IRediscoverable)d).OnRediscoveryNeeded += (_, _) => fired = true;
+    d.SimulateNewDbirthForTest("Plant1","EdgeA","Filler2");
+    fired.ShouldBeTrue();
+}
+```
+2. Run — expect FAIL.
+3. Implement.
+4. Run — expect PASS.
+5. Commit: `git commit -am "feat(mqtt): Sparkplug UntilStable discovery + rediscover-on-DBIRTH"` (+ trailer).
+
+---
+
+## Task 23 (P2): Sparkplug browser tree + `AttributesAsync` + `RequestRebirthAsync`
+
+**Classification:** standard
+**Estimated implement time:** ~5 min
+**Parallelizable with:** Task 24
+**Files:**
+- Modify: `src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Browser/MqttBrowseSession.cs` (Sparkplug tree Group→EdgeNode→Device→Metric from observed births; `AttributesAsync` = self-describing metric `AttributeInfo{Name, DriverDataType from birth, IsArray, SecurityClass}`; `RequestRebirthAsync(scope)` — the **only** publishing session member, scoped to selected group/edge-node, via the `RebirthRequester` path)
+- Modify: `src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Browser/MqttDriverBrowser.cs` (Sparkplug discovery filter `spBv1.0/{groupId}/#`; `OpenAsync` still publishes nothing)
+- Modify: `src/Server/ZB.MOM.WW.OtOpcUa.AdminUI/Browsing/BrowserSessionService.cs` (dispatch the MQTT-specific `RequestRebirthAsync` for MQTT sessions, gated by the same `DriverOperator` policy that gates the picker; Info-log the target scope)
+- Modify: `tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Tests/MqttBrowseSessionTests.cs`
+
+### Steps (TDD)
+1. Failing tests — birth-driven tree fills; `OpenAsync`/`RootAsync`/`ExpandAsync` publish **nothing**; `RequestRebirthAsync` publishes exactly one scoped NCMD:
+```csharp
+[Fact]
+public async Task SparkplugTree_FillsFromObservedBirths_BrowseNeverPublishes()
+{
+    var s = new MqttBrowseSession(MqttMode.SparkplugB);
+    s.ObserveBirthForTest("Plant1","EdgeA","Filler1","Temperature", SparkplugDataType.Float);
+    var groups = await s.RootAsync(default);
+    groups.ShouldContain(n => n.BrowseName == "Plant1");
+    s.PublishCountForTest.ShouldBe(0);   // passive
+}
+
+[Fact]
+public async Task RequestRebirthAsync_ScopedToNode_PublishesOneNcmd()
+{
+    var s = new MqttBrowseSession(MqttMode.SparkplugB);
+    s.ObserveBirthForTest("Plant1","EdgeA","Filler1","T", SparkplugDataType.Float);
+    await s.RequestRebirthAsync(scope: "Plant1/EdgeA");
+    s.PublishCountForTest.ShouldBe(1);
+}
+```
+2. Run — expect FAIL.
+3. Implement. `RequestRebirthAsync` is never fired by `OpenAsync`/`RootAsync`/`ExpandAsync` — only on explicit operator click.
+4. Run — expect PASS + `dotnet build` the AdminUI.
+5. Commit: `git commit -am "feat(mqtt): Sparkplug birth-driven browser tree + scoped Request-rebirth action"` (+ trailer).
+
+---
+
+## Task 24 (P2): AdminUI editor Sparkplug mode shape + validator
+
+**Classification:** small
+**Estimated implement time:** ~5 min
+**Parallelizable with:** Task 23
+**Files:**
+- Modify: `src/Server/ZB.MOM.WW.OtOpcUa.AdminUI/Uns/TagEditors/MqttTagConfigModel.cs` (Sparkplug `Validate`: `groupId`/`edgeNodeId`/`metricName` required, `deviceId` optional, `dataType` a known Sparkplug type; `ToJson` re-derives `FullName` = `{group}/{node}[/{device}]:{metric}`)
+- Modify: `src/Server/ZB.MOM.WW.OtOpcUa.AdminUI/Components/Shared/Uns/TagEditors/MqttTagConfigEditor.razor` (Sparkplug field group under the mode switch)
+- Modify: `tests/Server/.../MqttTagConfigModelTests.cs`
+
+### Steps (TDD)
+1. Failing tests — Sparkplug validation + FullName derivation:
+```csharp
+[Fact]
+public void Validate_SparkplugMissingMetricName_Fails()
+    => MqttTagConfigModel.FromJson("""{"groupId":"Plant1","edgeNodeId":"EdgeA"}""").Validate().ShouldNotBeEmpty();
+
+[Fact]
+public void ToJson_Sparkplug_DerivesFullName()
+    => MqttTagConfigModel.FromJson("""{"groupId":"Plant1","edgeNodeId":"EdgeA","deviceId":"Filler1","metricName":"Temperature","dataType":"Float"}""")
+        .ToJson().ShouldContain("Plant1/EdgeA/Filler1:Temperature");
+```
+2. Run — expect FAIL.
+3. Implement.
+4. Run — expect PASS + AdminUI build.
+5. Commit: `git commit -am "feat(mqtt): typed tag editor Sparkplug mode + validation"` (+ trailer).
+
+---
+
+## Task 25 (P2): C# edge-node simulator fixture + §3.6 live matrix
+
+**Classification:** standard
+**Estimated implement time:** ~5 min
+**Parallelizable with:** none
+**Files:**
+- Create: `tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.IntegrationTests/SparkplugSimulator/` (a project-owned C# edge-node simulator using the **same** MQTTnet-5 + Tahu-proto path the driver uses — publishes NBIRTH/DBIRTH → periodic N/DDATA; honours a rebirth NCMD; injects seq-gap / alias-reuse / N/DDEATH on demand)
+- Modify: `tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.IntegrationTests/Docker/docker-compose.yml` (add the simulator container against the same TLS+auth Mosquitto)
+- Create: `tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.IntegrationTests/SparkplugLiveTests.cs` (category `LiveIntegration`, env-gated: birth→data→alias-resolve→OnDataChange; rebirth recovery; death→STALE; browser passive window asserts **no NCMD published by open/browse**; explicit `RequestRebirthAsync` node-vs-group enumeration)
+
+### Steps
+1. Build the simulator (encode via the same generated proto — validates encode/decode symmetry).
+2. Write env-gated live tests covering the §3.6 matrix + browser passivity.
+3. Offline skip proof:
+```bash
+dotnet test tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.IntegrationTests   # expect: Skipped without MQTT_FIXTURE_ENDPOINT
+```
+4. Deploy + run live:
+```bash
+lmxopcua-fix sync mqtt && lmxopcua-fix up mqtt sparkplug
+export MQTT_FIXTURE_ENDPOINT=10.100.0.35:8883
+dotnet test tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.IntegrationTests --filter "Category=LiveIntegration"   # expect: PASS
+```
+5. Commit: `git commit -am "test(mqtt): C# Sparkplug edge-node simulator + §3.6 live matrix"` (+ trailer).
+
+---
+
+## Task 26 (P2): Live `/run` verify Sparkplug — **P2 COMPLETE**
+
+**Classification:** small
+**Estimated implement time:** ~5 min
+**Parallelizable with:** none
+**Files:**
+- Modify: `docs/plans/2026-07-15-driver-expansion-tracking.md` (mark MQTT/Sparkplug P1+P2 code-complete + live-verified)
+- Modify: `CLAUDE.md` (if a driver-fleet or endpoint fact changed; propagate to `../scadaproj/CLAUDE.md` OtOpcUa entry per the cross-repo rule)
+
+### Steps
+1. On docker-dev (`:9200`): author an `Mqtt` driver (SparkplugB mode) against the simulator; browse the birth-driven picker, click **Request rebirth**, pick a metric, deploy.
+2. Confirm live values + rediscover-on-DBIRTH + death→STALE via Client.CLI reads/subscribe.
+3. Confirm the typed editor renders both modes (live-verify — Razor bugs pass unit tests).
+4. Update tracking + (if needed) CLAUDE.md/scadaproj index.
+5. Commit: `git commit -am "docs(mqtt): Sparkplug P2 live-verified; MQTT driver complete"` (+ trailer).
+
+---
+
+## Deferred / out of scope
+
+- **Write-through (P3 in the design):** `IWritable` — Sparkplug NCMD/DCMD + plain publish, optimistic-Good + self-correct on echo (mirrors Galaxy fire-and-forget), `WriteIdempotent` default-off for non-idempotent Sparkplug commands, write-topic config. See design §3.7 + §10 (P3 row). `MqttDriver` ships **read/subscribe/discover only** in P1+P2 — its absence of `IWritable` means nodes materialize read-only.
+- **`DataSet`/`Template` Sparkplug metrics** — unsupported v1 (skip + warn, or raw-JSON as String). §3.5.
+- **`Bytes`/`File` metrics** beyond a base64/raw-String fallback. §3.5.
+- **EMQX broker** — Mosquitto is the default fixture; EMQX is the documented alternative when a dashboard/built-in Sparkplug tooling helps (§9), not built here.
+
+## Notes on ordering / parallelism
+
+- **P2 is blocked on the P1 milestone (Task 14).** Every P2 task's `blockedBy` chain roots at Task 14 so plain MQTT ships and is live-verified before Sparkplug work begins — and MQTTnet-5/net10 is proven (Task 0) before any proto/Sparkplug effort.
+- Genuine parallel pairs: 5‖6, 8‖10, 11‖12, 16‖17, 18‖19, 23‖24.
+- DRY: reuse `EquipmentTagRefResolver<MqttTagDefinition>` (as Modbus/OpcUaClient do), the shared `JsonSerializerOptions`, and one `SparkplugCodec` for both decode (ingest) and encode (rebirth NCMD). YAGNI: no write-through plumbing, no DataSet/Template, no EMQX until a need lands.
@@ -0,0 +1,315 @@
+{
+  "planPath": "docs/plans/2026-07-24-mqtt-sparkplug-driver.md",
+  "note": "Wave 2 MQTT/Sparkplug B driver. Two phases both in-scope: P1 (plain MQTT, Tasks 0-14) is a complete shippable milestone; P2 (Sparkplug B ingest, Tasks 15-26) builds on it and every P2 task chains back to Task 14. Write-through (NCMD/DCMD/plain publish) is DEFERRED (design P3). Hard rules: Task 0 (MQTTnet-5/net10 restore+build under central pinning with transitive pinning OFF) is the mandatory FIRST gate. Hand-roll Tahu proto over ONE MQTTnet-5 client (NOT SparkplugNet \u2014 its MQTTnet-4.x transitive pin collides with the repo's deliberately-OFF CentralPackageTransitivePinning). DriverType string is 'Mqtt' everywhere (grep-enforced). Enum-serialization trap: every JSON seam uses shared JsonSerializerOptions with JsonStringEnumConverter. Fixtures enforce TLS+auth, never anonymous/public-broker. Google.Protobuf (3.34.1) + Grpc.Tools (2.76.0) already pinned; MQTTnet is the one new pin. High-risk tasks: 4 (hand-rolled reconnect loop), 18/19 (alias/seq state-machine components), 21 (the full 3.6 ingest matrix).",
+  "tasks": [
+    {
+      "id": 0,
+      "subject": "Task 0 (P1): Dependency-validation spike \u2014 MQTTnet-5 pin + net10 restore/build under central pinning",
+      "status": "completed",
+      "classification": "standard",
+      "parallelizableWith": []
+    },
+    {
+      "id": 1,
+      "subject": "Task 1 (P1): .Contracts enums + MqttDriverOptions DTO (name-serialized)",
+      "status": "completed",
+      "classification": "small",
+      "parallelizableWith": [],
+      "blockedBy": [
+        0
+      ]
+    },
+    {
+      "id": 2,
+      "subject": "Task 2 (P1): .Contracts MqttTagDefinition + MqttEquipmentTagParser (plain, strict enum)",
+      "status": "completed",
+      "classification": "standard",
+      "parallelizableWith": [],
+      "blockedBy": [
+        1
+      ]
+    },
+    {
+      "id": 3,
+      "subject": "Task 3 (P1): .Driver + MqttConnection connect/TLS/auth (bounded deadline)",
+      "status": "completed",
+      "classification": "standard",
+      "parallelizableWith": [],
+      "blockedBy": [
+        1
+      ]
+    },
+    {
+      "id": 4,
+      "subject": "Task 4 (P1): MqttConnection hand-rolled reconnect loop (backoff + resubscribe)",
+      "status": "completed",
+      "classification": "high-risk",
+      "parallelizableWith": [],
+      "blockedBy": [
+        3
+      ]
+    },
+    {
+      "id": 5,
+      "subject": "Task 5 (P1): LastValueCache + IReadable (per-ref no-data)",
+      "status": "completed",
+      "classification": "small",
+      "parallelizableWith": [
+        6
+      ],
+      "blockedBy": [
+        3
+      ]
+    },
+    {
+      "id": 6,
+      "subject": "Task 6 (P1): ISubscribable plain topic subscribe\u2192OnDataChange + retained seed",
+      "status": "completed",
+      "classification": "standard",
+      "parallelizableWith": [
+        5
+      ],
+      "blockedBy": [
+        2,
+        4
+      ]
+    },
+    {
+      "id": 7,
+      "subject": "Task 7 (P1): MqttDriver shell \u2014 IDriver + authored-only ITagDiscovery (Once) + probe interface",
+      "status": "completed",
+      "classification": "standard",
+      "parallelizableWith": [],
+      "blockedBy": [
+        5,
+        6
+      ]
+    },
+    {
+      "id": 8,
+      "subject": "Task 8 (P1): MqttDriverProbe CONNECT handshake",
+      "status": "completed",
+      "classification": "small",
+      "parallelizableWith": [
+        10
+      ],
+      "blockedBy": [
+        3
+      ]
+    },
+    {
+      "id": 9,
+      "subject": "Task 9 (P1): Factory + DriverTypeNames.Mqtt + Host factory/probe registration",
+      "status": "completed",
+      "classification": "standard",
+      "parallelizableWith": [],
+      "blockedBy": [
+        7,
+        8
+      ]
+    },
+    {
+      "id": 10,
+      "subject": "Task 10 (P1): .Browser bespoke #-observation browser (passive)",
+      "status": "completed",
+      "classification": "standard",
+      "parallelizableWith": [
+        8
+      ],
+      "blockedBy": [
+        2
+      ]
+    },
+    {
+      "id": 11,
+      "subject": "Task 11 (P1): Register MqttDriverBrowser (bespoke-first for Mqtt)",
+      "status": "completed",
+      "classification": "trivial",
+      "parallelizableWith": [
+        12
+      ],
+      "blockedBy": [
+        10
+      ]
+    },
+    {
+      "id": 12,
+      "subject": "Task 12 (P1): Typed AdminUI editor + validator (plain shape)",
+      "status": "completed",
+      "classification": "standard",
+      "parallelizableWith": [
+        11
+      ],
+      "blockedBy": [
+        2
+      ]
+    },
+    {
+      "id": 13,
+      "subject": "Task 13 (P1): Mosquitto+JSON-publisher fixture (TLS+auth) + env-gated live suite",
+      "status": "completed",
+      "classification": "standard",
+      "parallelizableWith": [],
+      "blockedBy": [
+        9
+      ]
+    },
+    {
+      "id": 14,
+      "subject": "Task 14 (P1): Live /run verify on docker-dev \u2014 P1 MILESTONE COMPLETE",
+      "status": "completed",
+      "classification": "small",
+      "parallelizableWith": [],
+      "blockedBy": [
+        9,
+        11,
+        12,
+        13
+      ]
+    },
+    {
+      "id": 15,
+      "subject": "Task 15 (P2): Vendor Tahu sparkplug_b.proto + Grpc.Tools codegen",
+      "status": "completed",
+      "classification": "standard",
+      "parallelizableWith": [],
+      "blockedBy": [
+        14
+      ]
+    },
+    {
+      "id": 16,
+      "subject": "Task 16 (P2): SparkplugCodec decode + golden payload vectors",
+      "status": "completed",
+      "classification": "standard",
+      "parallelizableWith": [
+        17
+      ],
+      "blockedBy": [
+        15
+      ]
+    },
+    {
+      "id": 17,
+      "subject": "Task 17 (P2): SparkplugTopic parse/format + SparkplugDataType.ToDriverDataType map",
+      "status": "completed",
+      "classification": "small",
+      "parallelizableWith": [
+        16
+      ],
+      "blockedBy": [
+        15
+      ]
+    },
+    {
+      "id": 18,
+      "subject": "Task 18 (P2): BirthCache + AliasTable \u2014 bind-by-name, rebuild-per-birth",
+      "status": "completed",
+      "classification": "high-risk",
+      "parallelizableWith": [
+        19
+      ],
+      "blockedBy": [
+        16,
+        17
+      ]
+    },
+    {
+      "id": 19,
+      "subject": "Task 19 (P2): SequenceTracker seq-gap + bdSeq death-tie",
+      "status": "completed",
+      "classification": "high-risk",
+      "parallelizableWith": [
+        18
+      ],
+      "blockedBy": [
+        16,
+        17
+      ]
+    },
+    {
+      "id": 20,
+      "subject": "Task 20 (P2): RebirthRequester NCMD encode",
+      "status": "completed",
+      "classification": "small",
+      "parallelizableWith": [],
+      "blockedBy": [
+        16
+      ]
+    },
+    {
+      "id": 21,
+      "subject": "Task 21 (P2): Sparkplug ingest state machine \u2014 the 3.6 matrix",
+      "status": "completed",
+      "classification": "high-risk",
+      "parallelizableWith": [],
+      "blockedBy": [
+        18,
+        19,
+        20
+      ]
+    },
+    {
+      "id": 22,
+      "subject": "Task 22 (P2): ITagDiscovery UntilStable + IRediscoverable (rediscover-on-DBIRTH)",
+      "status": "completed",
+      "classification": "standard",
+      "parallelizableWith": [],
+      "blockedBy": [
+        21
+      ]
+    },
+    {
+      "id": 23,
+      "subject": "Task 23 (P2): Sparkplug browser tree + AttributesAsync + scoped RequestRebirthAsync",
+      "status": "completed",
+      "classification": "standard",
+      "parallelizableWith": [
+        24
+      ],
+      "blockedBy": [
+        20,
+        21
+      ]
+    },
+    {
+      "id": 24,
+      "subject": "Task 24 (P2): AdminUI editor Sparkplug mode shape + validator",
+      "status": "completed",
+      "classification": "small",
+      "parallelizableWith": [
+        23
+      ],
+      "blockedBy": [
+        12,
+        17
+      ]
+    },
+    {
+      "id": 25,
+      "subject": "Task 25 (P2): C# edge-node simulator fixture + 3.6 live matrix",
+      "status": "completed",
+      "classification": "standard",
+      "parallelizableWith": [],
+      "blockedBy": [
+        21,
+        22,
+        23
+      ]
+    },
+    {
+      "id": 26,
+      "subject": "Task 26 (P2): Live /run verify Sparkplug \u2014 P2 COMPLETE",
+      "status": "completed",
+      "classification": "small",
+      "parallelizableWith": [],
+      "blockedBy": [
+        23,
+        24,
+        25
+      ]
+    }
+  ],
+  "lastUpdated": "2026-07-27",
+  "closureNote": "All 27 tasks shipped, both phases live-gated. Marked complete 2026-07-27 (deferment.md \u00a78.5)."
+}
@@ -0,0 +1,199 @@
+{
+  "planPath": "docs/plans/2026-07-24-mtconnect-driver.md",
+  "tasks": [
+    {
+      "id": 0,
+      "subject": "Task 0: Verify TrakHound MTConnect.NET pin (or record the hand-roll decision)",
+      "status": "completed"
+    },
+    {
+      "id": 1,
+      "subject": "Task 1: Scaffold the two driver projects + the test project",
+      "status": "completed",
+      "blockedBy": [
+        0
+      ]
+    },
+    {
+      "id": 2,
+      "subject": "Task 2: MTConnectDriverOptions + MTConnectTagDefinition in .Contracts",
+      "status": "completed",
+      "blockedBy": [
+        1
+      ]
+    },
+    {
+      "id": 3,
+      "subject": "Task 3: MTConnectDataTypeInference.Infer + golden type-map test",
+      "status": "completed",
+      "blockedBy": [
+        1
+      ]
+    },
+    {
+      "id": 4,
+      "subject": "Task 4: Capture the canned XML fixtures",
+      "status": "completed",
+      "blockedBy": [
+        1
+      ]
+    },
+    {
+      "id": 5,
+      "subject": "Task 5: IMTConnectAgentClient seam + return DTOs",
+      "status": "completed",
+      "blockedBy": [
+        1
+      ]
+    },
+    {
+      "id": 6,
+      "subject": "Task 6: MTConnectAgentClient \u2014 parse /probe into the device model",
+      "status": "completed",
+      "blockedBy": [
+        4,
+        5
+      ]
+    },
+    {
+      "id": 7,
+      "subject": "Task 7: MTConnectAgentClient \u2014 parse /current + /sample, detect the sequence gap",
+      "status": "completed",
+      "blockedBy": [
+        4,
+        5,
+        6
+      ]
+    },
+    {
+      "id": 8,
+      "subject": "Task 8: MTConnectObservationIndex + UNAVAILABLE -> BadNoCommunication",
+      "status": "completed",
+      "blockedBy": [
+        7
+      ]
+    },
+    {
+      "id": 9,
+      "subject": "Task 9: MTConnectDriver shell \u2014 IDriver lifecycle",
+      "status": "completed",
+      "blockedBy": [
+        2,
+        8
+      ]
+    },
+    {
+      "id": 10,
+      "subject": "Task 10: IReadable.ReadAsync \u2014 /current, ordered snapshots",
+      "status": "completed",
+      "blockedBy": [
+        9
+      ]
+    },
+    {
+      "id": 11,
+      "subject": "Task 11: ISubscribable \u2014 /sample long-poll pump + ring-buffer re-baseline",
+      "status": "completed",
+      "blockedBy": [
+        9,
+        7
+      ]
+    },
+    {
+      "id": 12,
+      "subject": "Task 12: ITagDiscovery.DiscoverAsync + SupportsOnlineDiscovery=true",
+      "status": "completed",
+      "blockedBy": [
+        9,
+        6
+      ]
+    },
+    {
+      "id": 13,
+      "subject": "Task 13: IHostConnectivityProbe + IRediscoverable (instanceId watch)",
+      "status": "completed",
+      "blockedBy": [
+        9
+      ]
+    },
+    {
+      "id": 14,
+      "subject": "Task 14: MTConnectDriverProbe : IDriverProbe",
+      "status": "completed",
+      "blockedBy": [
+        2,
+        5
+      ]
+    },
+    {
+      "id": 15,
+      "subject": "Task 15: MTConnectDriverFactoryExtensions",
+      "status": "completed",
+      "blockedBy": [
+        2,
+        9
+      ]
+    },
+    {
+      "id": 16,
+      "subject": "Task 16: Host registration + DriverTypeNames.MTConnect + guard-test parity",
+      "status": "completed",
+      "blockedBy": [
+        14,
+        15
+      ]
+    },
+    {
+      "id": 17,
+      "subject": "Task 17: AdminUI typed model MTConnectTagConfigModel",
+      "status": "completed",
+      "blockedBy": [
+        3,
+        16
+      ]
+    },
+    {
+      "id": 18,
+      "subject": "Task 18: AdminUI editor razor + map/validator registration",
+      "status": "completed",
+      "blockedBy": [
+        17
+      ]
+    },
+    {
+      "id": 19,
+      "subject": "Task 19: mtconnect/cppagent docker fixture",
+      "status": "completed",
+      "blockedBy": [
+        16
+      ]
+    },
+    {
+      "id": 20,
+      "subject": "Task 20: Env-gated integration suite against cppagent",
+      "status": "completed",
+      "blockedBy": [
+        19
+      ]
+    },
+    {
+      "id": 21,
+      "subject": "Task 21: Live /run verify on docker-dev \u2014 browse picker, editor, read, subscribe, deploy",
+      "status": "completed",
+      "blockedBy": [
+        18,
+        20
+      ]
+    },
+    {
+      "id": 22,
+      "subject": "Task 22: Docs + deferred-writeback note; update the tracking doc",
+      "status": "completed",
+      "blockedBy": [
+        21
+      ]
+    }
+  ],
+  "lastUpdated": "2026-07-27",
+  "closureNote": "Merged at master 90bdaa44 (#506); 5-leg live gate PASSED. Marked complete 2026-07-27 (deferment.md \u00a78.5)."
+}
@@ -0,0 +1,670 @@
+# SQL Poll Driver Implementation Plan
+
+> **For Claude:** REQUIRED SUB-SKILL: Use superpowers-extended-cc:executing-plans (or subagent-driven-development) to implement this plan task-by-task.
+
+**Goal:** Ship a read-only `Sql` Equipment-kind driver that polls SQL Server tables/views on an interval and publishes selected columns/rows as OPC UA variable nodes, authored through the standard equipment Tags flow with a bespoke schema browser.
+
+**Architecture:** Three new projects mirroring the Modbus split — `Driver.Sql.Contracts` (options/tag DTOs + parser, zero transport deps), `Driver.Sql` (the `IDriver`/`ITagDiscovery`/`IReadable`/`ISubscribable`/`IHostConnectivityProbe` runtime + `ISqlDialect` seam + `SqlServerDialect`, owning `Microsoft.Data.SqlClient`), and `Driver.Sql.Browser` (schema-walk `IBrowseSession`). The `PollGroupEngine`, `EquipmentTagRefResolver<TDef>`, health state machine, and factory shape are all reused from Core; the driver batches tags by query-group (one round-trip per group per poll) and slices result sets back to per-tag snapshots. Every value binds as a `DbParameter`; identifiers are dialect-quoted from catalog-validated names only.
+
+**Tech Stack:** `Microsoft.Data.SqlClient` (6.1.1, already in `Directory.Packages.props`) via `System.Data.Common` base types behind a `DbProviderFactory`; `ISqlDialect` + `SqlProvider` enum seam (only `SqlServer` implemented in v1); `Microsoft.Data.Sqlite` (10.0.7, test-only) for the offline unit fixture; xunit.v3 + Shouldly. **Zero new NuGet dependencies.**
+
+**Source design:** docs/plans/2026-07-15-sql-poll-driver-design.md
+**Program design (shared contract):** docs/plans/2026-07-15-driver-expansion-program-design.md §3, §7
+
+**Conventions for every task below:** all projects `net10.0`, `Nullable`/`ImplicitUsings` enabled, `TreatWarningsAsErrors` on product projects. Every commit message ends with the repo trailer `Claude-Session: <session-url>` (omitted from the `git commit` examples for brevity). Run `dotnet build ZB.MOM.WW.OtOpcUa.slnx` green before each commit. New test projects use `xunit.v3` + `Shouldly` (see `tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Modbus.Tests/*.csproj`).
+
+---
+
+## Task 0: Scaffold `Driver.Sql.Contracts` project + register in slnx
+
+**Classification:** small
+**Estimated implement time:** ~4 min
+**Parallelizable with:** none (root of the tree)
+**Files:**
+- Create: `src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Sql.Contracts/ZB.MOM.WW.OtOpcUa.Driver.Sql.Contracts.csproj`
+- Modify: `ZB.MOM.WW.OtOpcUa.slnx` (add the project under `/src/Drivers/`)
+
+**Steps:**
+1. Create the csproj — refs `Core.Abstractions` ONLY (no transport deps, so AdminUI + browser can reference it without dragging `Microsoft.Data.SqlClient`). `InternalsVisibleTo` the Contracts is not needed. `RootNamespace = ZB.MOM.WW.OtOpcUa.Driver.Sql.Contracts`.
+```xml
+<Project Sdk="Microsoft.NET.Sdk">
+  <PropertyGroup>
+    <TargetFramework>net10.0</TargetFramework>
+    <Nullable>enable</Nullable>
+    <ImplicitUsings>enable</ImplicitUsings>
+    <TreatWarningsAsErrors>true</TreatWarningsAsErrors>
+    <GenerateDocumentationFile>true</GenerateDocumentationFile>
+    <NoWarn>$(NoWarn);CS1591</NoWarn>
+    <RootNamespace>ZB.MOM.WW.OtOpcUa.Driver.Sql.Contracts</RootNamespace>
+  </PropertyGroup>
+  <ItemGroup>
+    <ProjectReference Include="..\..\Core\ZB.MOM.WW.OtOpcUa.Core.Abstractions\ZB.MOM.WW.OtOpcUa.Core.Abstractions.csproj" />
+  </ItemGroup>
+</Project>
+```
+2. Add to `ZB.MOM.WW.OtOpcUa.slnx` under the `/src/Drivers/` folder, beside the `Driver.Modbus.Contracts` line.
+3. Run `dotnet build ZB.MOM.WW.OtOpcUa.slnx` — expect PASS (empty project compiles).
+4. Commit: `git commit -m "feat(sql): scaffold Driver.Sql.Contracts project"`
+
+---
+
+## Task 1: `SqlProvider` + `SqlTagModel` enums + `SqlDriverConfigDto` (string-enum round-trip)
+
+**Classification:** standard
+**Estimated implement time:** ~5 min
+**Parallelizable with:** none (blocks most downstream)
+**Files:**
+- Create: `src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Sql.Contracts/SqlProvider.cs`
+- Create: `src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Sql.Contracts/SqlDriverConfigDto.cs`
+- Create: `tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Sql.Tests/*` is NOT created here — this task's test lives temporarily in the Contracts consumer; create the Tests project in Task 6. **Instead**, put this task's test in a throwaway `Contracts`-adjacent xunit project? No — to avoid a project just for one test, fold this task's serialization assertion into Task 9's factory enum-serialization test. **This task ships DTOs only; its guard is Task 9.**
+
+> **Note:** Tasks 1–2 produce pure records/enums with no I/O. Their behavioural guard (string-enum round-trip, strict parse) is the Task 9 factory test + Task 2's parser test (Task 2 creates its own micro-test via the Tests project created in Task 6). To keep TDD honest without a premature test project, **reorder locally**: implement Task 1 DTOs, then Task 6 (Tests project) can be pulled forward if the implementer prefers. The `blockedBy` graph permits this. The concrete failing-test-first discipline begins at Task 2.
+
+**Steps:**
+1. `SqlProvider.cs`:
+```csharp
+namespace ZB.MOM.WW.OtOpcUa.Driver.Sql.Contracts;
+
+/// <summary>Which ADO.NET provider/dialect backs a Sql driver instance. v1 constructs only SqlServer.</summary>
+public enum SqlProvider { SqlServer, Postgres, MySql, Odbc, Oracle }
+
+/// <summary>Tag→value mapping model. v1 ships KeyValue + WideRow; Query is deferred (design §5.4 / P3).</summary>
+public enum SqlTagModel { KeyValue, WideRow, Query }
+```
+2. `SqlDriverConfigDto.cs` — the driver-config blob shape (§5.1). Enum-typed fields (`Provider`) so the string converter round-trips names; timeouts as `TimeSpan?`; `ConnectionStringRef` (NOT the connection string). Fields: `Provider`, `ConnectionStringRef`, `DefaultPollInterval`, `OperationTimeout`, `CommandTimeout`, `MaxConcurrentGroups`, `NullIsBad`, `AllowWrites`, `Probe` (`SqlProbeDto{Enabled, Interval}`). `[JsonStringEnumConverter]` is applied at the factory (Task 9), not on the DTO.
+3. Build — expect PASS.
+4. Commit: `git commit -m "feat(sql): SqlProvider/SqlTagModel enums + SqlDriverConfigDto"`
+
+---
+
+## Task 2: `SqlTagDefinition` + `SqlEquipmentTagParser.TryParse` (strict enum reads, malicious-input safe)
+
+**Classification:** standard
+**Estimated implement time:** ~5 min
+**Parallelizable with:** none
+**Files:**
+- Create: `src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Sql.Contracts/SqlTagDefinition.cs`
+- Create: `src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Sql.Contracts/SqlEquipmentTagParser.cs`
+- Test: `tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Sql.Tests/SqlEquipmentTagParserTests.cs` (Tests project scaffolded in Task 6 — **pull the csproj creation forward from Task 6 for this task**, or defer this task's test until Task 6 and mark Task 2 blockedBy nothing but verified-at-6. Recommended: create the Tests project now as part of this task's setup.)
+
+**TDD:**
+1. **Failing test** — parse a KeyValue blob and a malicious `keyValue`; assert the value is captured verbatim (parser does NOT sanitize — binding is the reader's job) and a typo'd `model` enum rejects:
+```csharp
+using Shouldly;
+using Xunit;
+using ZB.MOM.WW.OtOpcUa.Core.Abstractions;
+using ZB.MOM.WW.OtOpcUa.Driver.Sql.Contracts;
+
+public class SqlEquipmentTagParserTests
+{
+    [Fact]
+    public void TryParse_KeyValue_readsFields_andKeepsMaliciousValueVerbatim()
+    {
+        var json = """
+        {"driver":"Sql","model":"KeyValue","table":"dbo.TagValues","keyColumn":"tag_name",
+         "keyValue":"'; DROP TABLE x --","valueColumn":"num_value","timestampColumn":"sample_ts","type":"Float64"}
+        """;
+        SqlEquipmentTagParser.TryParse(json, "Plant/Sql/dev1/Speed", out var def).ShouldBeTrue();
+        def.Model.ShouldBe(SqlTagModel.KeyValue);
+        def.Table.ShouldBe("dbo.TagValues");
+        def.KeyValue.ShouldBe("'; DROP TABLE x --");   // captured as-is; the reader BINDS it, never concatenates
+        def.DeclaredType.ShouldBe(DriverDataType.Float64);
+        def.Name.ShouldBe("Plant/Sql/dev1/Speed");     // Name == RawPath (forward-router key)
+    }
+
+    [Fact]
+    public void TryParse_invalidModelEnum_rejectsTag()
+        => SqlEquipmentTagParser.TryParse(
+            """{"driver":"Sql","model":"Nonsense","table":"t","keyColumn":"k","keyValue":"v","valueColumn":"c"}""",
+            "raw", out _).ShouldBeFalse();
+}
+```
+2. Run `dotnet test tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Sql.Tests` — expect FAIL (types don't exist).
+3. **Minimal impl** — `SqlTagDefinition` record (`Name` = RawPath, `Model`, `Table`, `KeyColumn`, `KeyValue`, `ValueColumn`, `TimestampColumn`, `ColumnName`, `RowSelectorColumn`, `RowSelectorValue`, `RowSelectorTopByTimestamp`, `DeclaredType` = `DriverDataType?`). `SqlEquipmentTagParser.TryParse(string reference, string rawPath, out SqlTagDefinition def)` — mirror `ModbusTagDefinitionFactory.FromTagConfig`: recognize by leading `{`, read the `model` discriminator via `TagConfigJson.TryReadEnumStrict` (a present-but-invalid enum → `false` → the driver surfaces `BadNodeIdUnknown`, per R2-11), read model-specific fields, read the optional `type` override strictly, set `Name = rawPath`. Wrap in try/catch(JsonException/FormatException) → `false`. **No SQL is built here** — the parser only captures strings.
+4. Run test — expect PASS.
+5. Commit: `git commit -m "feat(sql): SqlTagDefinition + strict-enum equipment-tag parser"`
+
+---
+
+## Task 3: Scaffold `Driver.Sql` runtime project + register in slnx
+
+**Classification:** small
+**Estimated implement time:** ~4 min
+**Parallelizable with:** Task 2
+**Files:**
+- Create: `src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Sql/ZB.MOM.WW.OtOpcUa.Driver.Sql.csproj`
+- Modify: `ZB.MOM.WW.OtOpcUa.slnx`
+
+**Steps:**
+1. Create the csproj per design §2.1 — refs `Core.Abstractions` + `Core` (for `DriverFactoryRegistry` in `ZB.MOM.WW.OtOpcUa.Core.Hosting`) + `Driver.Sql.Contracts`; packages `Microsoft.Data.SqlClient` + `Microsoft.Extensions.Logging.Abstractions`; `InternalsVisibleTo` the `.Tests`.
+2. Add to `ZB.MOM.WW.OtOpcUa.slnx` under `/src/Drivers/`.
+3. Build — expect PASS.
+4. Commit: `git commit -m "feat(sql): scaffold Driver.Sql runtime project"`
+
+---
+
+## Task 4: `ISqlDialect` seam + `SqlServerDialect` (QuoteIdentifier, catalog SQL, MapColumnType) — golden queries
+
+**Classification:** high-risk (identifier quoting is the injection boundary)
+**Estimated implement time:** ~5 min
+**Parallelizable with:** Task 2
+**Files:**
+- Create: `src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Sql/ISqlDialect.cs`
+- Create: `src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Sql/SqlServerDialect.cs`
+- Test: `tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Sql.Tests/SqlServerDialectTests.cs`
+
+**TDD:**
+1. **Failing test** — golden catalog SQL, `QuoteIdentifier` escape + reject, `MapColumnType` table:
+```csharp
+[Fact]
+public void QuoteIdentifier_bracketsAndEscapesEmbeddedBrackets()
+{
+    var d = new SqlServerDialect();
+    d.QuoteIdentifier("Speed").ShouldBe("[Speed]");
+    d.QuoteIdentifier("a]b").ShouldBe("[a]]b]");            // ] doubled per T-SQL rules
+}
+
+[Fact]
+public void QuoteIdentifier_rejectsControlCharsAndNul()
+    => Should.Throw<ArgumentException>(() => new SqlServerDialect().QuoteIdentifier("x\0y"));
+
+[Theory]
+[InlineData("bit", DriverDataType.Boolean)]
+[InlineData("int", DriverDataType.Int32)]
+[InlineData("bigint", DriverDataType.Int64)]
+[InlineData("real", DriverDataType.Float32)]
+[InlineData("float", DriverDataType.Float64)]
+[InlineData("decimal", DriverDataType.Float64)]
+[InlineData("nvarchar", DriverDataType.String)]
+[InlineData("datetime2", DriverDataType.DateTime)]
+[InlineData("uniqueidentifier", DriverDataType.String)]
+public void MapColumnType_mapsFamilies(string sql, DriverDataType expected)
+    => new SqlServerDialect().MapColumnType(sql).ShouldBe(expected);
+
+[Fact]
+public void CatalogSql_isInformationSchemaAndParameterized()
+{
+    var d = new SqlServerDialect();
+    d.LivenessSql.ShouldBe("SELECT 1");
+    d.ListTablesSql.ShouldContain("INFORMATION_SCHEMA.TABLES");
+    d.ListTablesSql.ShouldContain("@schema");               // never string-interpolated
+    d.ListColumnsSql.ShouldContain("@table");
+}
+```
+2. Run — expect FAIL.
+3. **Minimal impl** — `ISqlDialect` per design §2.2 (`Provider`, `Factory` = `DbProviderFactory`, `QuoteIdentifier`, `LivenessSql`, `ListSchemasSql`, `ListTablesSql`, `ListColumnsSql`, `MapColumnType`). `SqlServerDialect`: `Factory => SqlClientFactory.Instance`; `QuoteIdentifier` doubles `]`, rejects embedded NUL/control chars via `ArgumentException`; catalog SQL uses `INFORMATION_SCHEMA` with `@schema`/`@table` markers; `MapColumnType` folds SQL type families to `DriverDataType` per design §3.7 (`decimal`/`numeric`/`money` → `Float64` with the documented precision caveat as an XML remark).
+4. Run — expect PASS.
+5. Commit: `git commit -m "feat(sql): ISqlDialect + SqlServerDialect with golden catalog SQL"`
+
+---
+
+## Task 5: `SqlQueryPlan` grouping + parameter binding (pure, no DB)
+
+**Classification:** high-risk (the query-mapping core; GroupKey correctness governs correctness of every read)
+**Estimated implement time:** ~5 min
+**Parallelizable with:** Task 10
+**Files:**
+- Create: `src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Sql/SqlQueryPlan.cs`
+- Create: `src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Sql/SqlGroupPlanner.cs`
+- Test: `tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Sql.Tests/SqlGroupPlannerTests.cs`
+
+**TDD:**
+1. **Failing test** — KeyValue tags on the same `(table,keyColumn,valueColumn,timestampColumn)` fold into ONE plan whose SQL is `... WHERE [tag_name] IN (@k0,@k1)` with two bound params; WideRow tags on the same `(table,rowSelector)` fold into one `SELECT <cols> ... WHERE [station_id]=@w`; different tables → different plans:
+```csharp
+[Fact]
+public void KeyValueTags_sameSource_foldIntoOnePlan_withBoundInList()
+{
+    var dialect = new SqlServerDialect();
+    var tags = new[] {
+        KvTag("A","dbo.TagValues","tag_name","Line1.Speed","num_value","sample_ts"),
+        KvTag("B","dbo.TagValues","tag_name","Line1.Temp","num_value","sample_ts"),
+    };
+    var plans = SqlGroupPlanner.Plan(tags, dialect).ToList();
+    plans.Count.ShouldBe(1);
+    plans[0].SqlText.ShouldContain("IN (@k0, @k1)");
+    plans[0].SqlText.ShouldContain("[tag_name]");
+    plans[0].Members.Count.ShouldBe(2);
+    plans[0].Parameters.ShouldBe(new object[] { "Line1.Speed", "Line1.Temp" });   // values are params, not text
+}
+```
+2. Run — expect FAIL.
+3. **Minimal impl** — `SqlQueryPlan { object GroupKey, string SqlText, IReadOnlyList<object?> Parameters, IReadOnlyList<SqlTagDefinition> Members, Func<DbDataReader, SqlTagDefinition, ...> }` (indexer supplied by the reader in Task 7; here just the shape + SQL/param builder). `SqlGroupPlanner.Plan(tags, dialect)`: KeyValue → GroupKey `(table,keyColumn,valueColumn,timestampColumn)`, emit `SELECT <keyColumn>,<valueColumn>[,<timestampColumn>] FROM <table> WHERE <keyColumn> IN (@k0..@kN)` with distinct-key params; WideRow → GroupKey `(table, rowSelector)`, emit `SELECT <distinct member columns>[,<selector cols>] FROM <table> WHERE <whereColumn>=@w` (or `ORDER BY <col> DESC` + dialect TOP-1 for `topByTimestamp`). Identifiers via `dialect.QuoteIdentifier`; `<table>` split on `.` and each part quoted. **Every value is a param; zero interpolation.**
+4. Run — expect PASS.
+5. Commit: `git commit -m "feat(sql): SqlGroupPlanner folds tags into one parameterized query per group"`
+
+---
+
+## Task 6: Scaffold `Driver.Sql.Tests` + `SqliteDialect` (test) + `SqlitePollFixture`
+
+**Classification:** standard
+**Estimated implement time:** ~5 min
+**Parallelizable with:** Task 10, Task 12
+**Files:**
+- Create: `tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Sql.Tests/ZB.MOM.WW.OtOpcUa.Driver.Sql.Tests.csproj`
+- Create: `tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Sql.Tests/SqliteDialect.cs`
+- Create: `tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Sql.Tests/SqlitePollFixture.cs`
+- Modify: `ZB.MOM.WW.OtOpcUa.slnx`
+
+> If Task 2 already created the csproj, this task adds the `SqliteDialect`/fixture and the slnx entry only.
+
+**Steps:**
+1. csproj — `xunit.v3` + `Shouldly` + `Microsoft.NET.Test.Sdk` + `xunit.runner.visualstudio`; `PackageReference Microsoft.Data.Sqlite` (10.0.7, test-only — no product dep on SQLite); project-refs `Driver.Sql` + `Driver.Sql.Contracts`. Add to slnx under `/tests/Drivers/`.
+2. `SqliteDialect : ISqlDialect` — `Provider = SqlServer` shim is wrong; add a test-only `Provider` value is not needed — implement `ISqlDialect` directly with `Factory => SqliteFactory.Instance`, `QuoteIdentifier` doubling `"`, `LivenessSql = "SELECT 1"`, catalog SQL over `sqlite_schema` + `PRAGMA table_info(...)`, `MapColumnType` mapping declared affinity (design §9 caveat: SQLite is dynamically typed — keep seed columns explicitly typed). This dialect is also linked by the Browser.Tests (Task 13) via `<Compile Include="..\..\Driver.Sql.Tests\SqliteDialect.cs" Link="SqliteDialect.cs" />`.
+3. `SqlitePollFixture` — opens an in-memory (or temp-file) SQLite connection, seeds a KeyValue table `TagValues(tag_name TEXT, num_value REAL, sample_ts TEXT)` and a wide-row `LatestStatus(station_id INT, oven_temp REAL, sample_ts TEXT)` with a few rows. Exposes the open `SqliteConnection` + a `DbProviderFactory` shim so the driver-under-test can be injected with an already-open connection provider (see Task 8's ctor seam).
+4. Build + run (no tests yet) — expect PASS/empty.
+5. Commit: `git commit -m "test(sql): Sql.Tests project + SqliteDialect + poll fixture"`
+
+---
+
+## Task 7: `SqlPollReader` core — one query per group, bounded deadline, slice back in input order
+
+**Classification:** high-risk (connection/timeout/result-slicing core)
+**Estimated implement time:** ~5 min
+**Parallelizable with:** none
+**Files:**
+- Create: `src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Sql/SqlPollReader.cs`
+- Test: `tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Sql.Tests/SqlPollReaderTests.cs`
+
+**TDD:**
+1. **Failing test** (against `SqlitePollFixture`) — read two KeyValue refs + one absent key; assert N-in/N-out order, correct values/types, absent key → `BadNoData`, NULL cell → `Uncertain` (default `nullIsBad=false`), source timestamp from `timestampColumn`:
+```csharp
+[Fact]
+public async Task ReadAsync_returnsSnapshotsInInputOrder_absentKeyIsBadNoData()
+{
+    await using var fx = await SqlitePollFixture.CreateAsync();     // seeds Line1.Speed=42.0, Line1.Temp=NULL
+    var reader = new SqlPollReader(fx.Factory, fx.ConnectionString, new SqliteDialect(),
+        commandTimeout: TimeSpan.FromSeconds(10), operationTimeout: TimeSpan.FromSeconds(15),
+        maxConcurrentGroups: 4, nullIsBad: false, resolve: fx.Resolve);
+    var refs = new[] { "Speed", "Missing", "Temp" };
+    var snaps = await reader.ReadAsync(refs, CancellationToken.None);
+    snaps.Count.ShouldBe(3);
+    snaps[0].Value.ShouldBe(42.0);
+    snaps[1].StatusCode.ShouldBe(SqlStatusCodes.BadNoData);          // key deleted/absent
+    snaps[2].Value.ShouldBeNull();
+    StatusCode.IsUncertain(snaps[2].StatusCode).ShouldBeTrue();       // NULL cell, nullIsBad=false
+}
+```
+2. Run — expect FAIL.
+3. **Minimal impl** — `SqlPollReader.ReadAsync(refs, ct)`: resolve each ref → `SqlTagDefinition` (miss → `BadNodeIdUnknown`); `SqlGroupPlanner.Plan(...)`; per group under a `SemaphoreSlim(maxConcurrentGroups)`: `await using var conn = factory.CreateConnection(); conn.ConnectionString = connStr; await conn.OpenAsync(linkedCt)`; build `DbCommand` with `CommandTimeout = (int)commandTimeout.TotalSeconds` and bound params; `using var linked = CancellationTokenSource.CreateLinkedTokenSource(ct); linked.CancelAfter(operationTimeout); await using var rdr = await cmd.ExecuteReaderAsync(linked.Token)`; index rows by key/selector; map each member's cell → `DataValueSnapshot` (type per `DeclaredType` ?? `dialect.MapColumnType`-inferred; NULL → `nullIsBad ? Bad : Uncertain`; absent key → `BadNoData`; source timestamp from `timestampColumn` else read wall-clock). **Reassemble in input order** (`DataValueSnapshot[refs.Count]`). Per-tag failure = Bad-coded snapshot, NOT an exception; the whole call throws only if the connection itself is unreachable (→ engine backoff). `await using` both connection and reader — never leak. Add `SqlStatusCodes` static (BadNoData/BadTimeout/BadNodeIdUnknown/BadCommunicationError/Uncertain constants) if not reusing an existing helper.
+4. Run — expect PASS. Add a NULL-cell test with `nullIsBad:true` → `Bad`.
+5. Commit: `git commit -m "feat(sql): SqlPollReader — grouped read, bounded deadline, ordered slice-back"`
+
+---
+
+## Task 8: `SqlDriver` shell — IDriver / ITagDiscovery / IReadable / ISubscribable / IHostConnectivityProbe
+
+**Classification:** high-risk (lifecycle + poll-engine wiring + connection validation)
+**Estimated implement time:** ~5 min
+**Parallelizable with:** none
+**Files:**
+- Create: `src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Sql/SqlDriver.cs`
+- Test: `tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Sql.Tests/SqlDriverTests.cs`
+
+**TDD:**
+1. **Failing test** — construct `SqlDriver` with an injected dialect + factory + already-resolved connection string (SQLite fixture) + authored `RawTagEntry` list; `InitializeAsync` → `Healthy`; `DiscoverAsync` streams one Variable per authored tag with `SecurityClass=ViewOnly` + `RediscoverPolicy=Once` + `SupportsOnlineDiscovery=false`; `ReadAsync` delegates to the reader; a subscribe fires an initial change:
+```csharp
+[Fact]
+public async Task Initialize_thenDiscover_streamsAuthoredTagsReadOnly()
+{
+    await using var fx = await SqlitePollFixture.CreateAsync();
+    var driver = SqlDriver.ForTest(fx, rawTags: fx.AuthoredRawTags);
+    await driver.InitializeAsync(fx.ConfigJson, CancellationToken.None);
+    driver.GetHealth().State.ShouldBe(DriverState.Healthy);
+    ((ITagDiscovery)driver).SupportsOnlineDiscovery.ShouldBeFalse();
+    ((ITagDiscovery)driver).RediscoverPolicy.ShouldBe(DiscoveryRediscoverPolicy.Once);
+    var cap = new CapturingBuilder();
+    await ((ITagDiscovery)driver).DiscoverAsync(cap, CancellationToken.None);
+    cap.Variables.ShouldContain(v => v.FullName == "Speed" && v.SecurityClass == SecurityClassification.ViewOnly);
+}
+```
+2. Run — expect FAIL.
+3. **Minimal impl** — `SqlDriver : IDriver, ITagDiscovery, IReadable, ISubscribable, IHostConnectivityProbe, IAsyncDisposable`. Mirror `ModbusDriver`: fields grouped up top; `_resolver = new EquipmentTagRefResolver<SqlTagDefinition>(...)`; `_poll = new PollGroupEngine(reader: ReadAsync, onChange: ..., onError: HandlePollError, backoffCap: 30s)`. `InitializeAsync`: build `_tagsByRawPath` from `_options.RawTags` via `SqlEquipmentTagParser.TryParse` (miss = logged skip, never throw); open ONE connection, run `dialect.LivenessSql` under `CommandTimeout` + linked CTS, dispose; success → `Healthy`, failure → `Faulted` + `LastError`. `ReadAsync` → `_reader.ReadAsync`. `SubscribeAsync` → `_poll.Subscribe`; `UnsubscribeAsync` → `_poll.Unsubscribe`. `IHostConnectivityProbe`: single logical host (server host from the connection string) with `Running/Stopped` from the last poll/liveness outcome + `OnHostStatusChanged` on transitions. `GetMemoryFootprint => 0`; `FlushOptionalCachesAsync => Task.CompletedTask`; `ReinitializeAsync` = teardown+init. `DriverType => DriverTypeNames.Sql`. Add a `ForTest(...)` internal factory that injects dialect+factory+connString (production path resolves those in the factory, Task 9). **Pooling: open-use-dispose per poll (already in the reader); no long-lived connection.**
+4. Run — expect PASS.
+5. Commit: `git commit -m "feat(sql): SqlDriver shell wiring PollGroupEngine + probe + read-only discovery"`
+
+---
+
+## Task 9: `SqlDriverFactoryExtensions` + `connectionStringRef` env resolution + enum-serialization guard
+
+**Classification:** standard
+**Estimated implement time:** ~5 min
+**Parallelizable with:** Task 10
+**Files:**
+- Create: `src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Sql/SqlDriverFactoryExtensions.cs`
+- Create: `src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Sql/SqlConnectionStringResolver.cs`
+- Test: `tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Sql.Tests/SqlDriverFactoryTests.cs`
+
+**TDD:**
+1. **Failing test** — `CreateInstance` with a config carrying `"provider":"SqlServer"` builds a driver; a missing `connectionStringRef` throws a clean error; the connection-string ref resolves from env `Sql__ConnectionStrings__<ref>`; **enum-serialization guard** — a config author serializing `provider` as a NUMBER still parses (`JsonStringEnumConverter` accepts ordinals) AND the round-trip writes the NAME:
+```csharp
+[Fact]
+public void CreateInstance_missingConnectionStringRef_throwsActionable()
+    => Should.Throw<InvalidOperationException>(() =>
+        SqlDriverFactoryExtensions.CreateInstance("d1", """{"provider":"SqlServer"}""", null))
+        .Message.ShouldContain("connectionStringRef");
+
+[Fact]
+public void ConnectionStringRef_resolvesFromEnv()
+{
+    Environment.SetEnvironmentVariable("Sql__ConnectionStrings__MesStaging", "Server=x;Database=y;");
+    SqlConnectionStringResolver.Resolve("MesStaging").ShouldBe("Server=x;Database=y;");
+}
+
+[Fact]
+public void Provider_serializesAsNameNotNumber()
+{
+    var json = JsonSerializer.Serialize(new SqlDriverConfigDto { Provider = SqlProvider.SqlServer },
+        SqlDriverFactoryExtensions.JsonOptionsForTest);
+    json.ShouldContain("\"SqlServer\"");
+    json.ShouldNotContain("\"provider\":0");
+}
+```
+2. Run — expect FAIL.
+3. **Minimal impl** — `SqlConnectionStringResolver.Resolve(string @ref)` → `Environment.GetEnvironmentVariable($"Sql__ConnectionStrings__{@ref}")` (direct env read, deliberate — the factory closure has no `IConfiguration`, per design §8.2), throws actionable if absent. `SqlDriverFactoryExtensions`: `const DriverTypeName = DriverTypeNames.Sql`; `Register(registry, loggerFactory)` → `registry.Register(DriverTypeName, (id,json)=>CreateInstance(id,json,loggerFactory))`; `CreateInstance` deserializes `SqlDriverConfigDto` with `JsonOptions` carrying `JsonStringEnumConverter` + `UnmappedMemberHandling.Skip`, validates `ConnectionStringRef` present, builds `SqlServerDialect` from `Provider` (P1: only `SqlServer` constructible; others throw "provider not available in this build"), resolves the connection string, constructs the `SqlPollReader` + `SqlDriver`. **Never log the resolved connection string** (log provider + server host + database only). Expose `JsonOptionsForTest` internal.
+4. Run — expect PASS.
+5. Commit: `git commit -m "feat(sql): factory + connectionStringRef env resolution + string-enum guard"`
+
+---
+
+## Task 10: `SqlDriverProbe` (SELECT 1 liveness, bounded timeout)
+
+**Classification:** small
+**Estimated implement time:** ~4 min
+**Parallelizable with:** Task 5, Task 9, Task 12
+**Files:**
+- Create: `src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Sql/SqlDriverProbe.cs`
+- Test: `tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Sql.Tests/SqlDriverProbeTests.cs`
+
+**TDD:**
+1. **Failing test** — against the SQLite fixture (inject dialect+factory), `ProbeAsync` returns green with latency; a bad connection string returns a red result with the error message (never throws):
+```csharp
+[Fact]
+public async Task Probe_liveConnection_returnsGreen()
+{
+    await using var fx = await SqlitePollFixture.CreateAsync();
+    var probe = SqlDriverProbe.ForTest(fx.Factory, new SqliteDialect());
+    var r = await probe.ProbeAsync(fx.ConfigJson, TimeSpan.FromSeconds(5), CancellationToken.None);
+    r.Success.ShouldBeTrue();
+}
+```
+2. Run — expect FAIL.
+3. **Minimal impl** — `SqlDriverProbe : IDriverProbe`, `DriverType => DriverTypeNames.Sql`. Parse config via the SAME factory DTO shape + `JsonStringEnumConverter` (R2-11 factory parity, mirroring `ModbusDriverProbe`), resolve the connection string ref, open a connection under a linked CTS bounded by `timeout`, run `dialect.LivenessSql` (`SELECT 1`), return `DriverProbeResult(true, "SQL SELECT 1 OK", latency)`; catch → red result naming the failure. Never throws. `ForTest` injects factory+dialect for the SQLite path.
+4. Run — expect PASS.
+5. Commit: `git commit -m "feat(sql): SqlDriverProbe SELECT-1 liveness check"`
+
+---
+
+## Task 11: Host registration — `DriverTypeNames.Sql` + factory + probe + guard test
+
+**Classification:** small
+**Estimated implement time:** ~4 min
+**Parallelizable with:** none
+**Files:**
+- Modify: `src/Core/ZB.MOM.WW.OtOpcUa.Core.Abstractions/DriverTypeNames.cs`
+- Modify: `src/Server/ZB.MOM.WW.OtOpcUa.Host/Drivers/DriverFactoryBootstrap.cs`
+- Modify: `src/Server/ZB.MOM.WW.OtOpcUa.Host/ZB.MOM.WW.OtOpcUa.Host.csproj` (project-ref `Driver.Sql` if not transitively present)
+- Test: `tests/Core/ZB.MOM.WW.OtOpcUa.Core.Abstractions.Tests/DriverTypeNamesGuardTests.cs` is EXISTING — it asserts bidirectional parity between `DriverTypeNames` constants and the factory-registered set; this task makes it pass by adding both sides.
+
+**TDD:**
+1. **Failing step** — add `public const string Sql = "Sql";` to `DriverTypeNames` + include in `All`, but DON'T yet register the factory. Run `DriverTypeNamesGuardTests` → expect FAIL (constant with no registered factory).
+2. **Impl** — in `DriverFactoryBootstrap.Register(...)` add `Driver.Sql.SqlDriverFactoryExtensions.Register(registry, loggerFactory);`; in `AddOtOpcUaDriverProbes` add `services.TryAddEnumerable(ServiceDescriptor.Singleton<IDriverProbe, SqlProbe>());` with a `using SqlProbe = Driver.Sql.SqlDriverProbe;` alias; add the `Driver.Sql` project-ref to the Host csproj. Default tier `DriverTier.A` (no explicit arg — SQL client is cross-platform managed, runs on macOS dev, so `ShouldStub()` needs no change).
+3. Run guard test + `dotnet build ZB.MOM.WW.OtOpcUa.slnx` — expect PASS.
+4. Commit: `git commit -m "feat(sql): register Sql factory + probe in Host, add DriverTypeNames.Sql"`
+
+---
+
+## Task 12: Scaffold `Driver.Sql.Browser` project + register in slnx
+
+**Classification:** small
+**Estimated implement time:** ~4 min
+**Parallelizable with:** Task 5, Task 6, Task 9, Task 10
+**Files:**
+- Create: `src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Sql.Browser/ZB.MOM.WW.OtOpcUa.Driver.Sql.Browser.csproj`
+- Modify: `ZB.MOM.WW.OtOpcUa.slnx`
+
+**Steps:**
+1. csproj refs `Commons` (`ZB.MOM.WW.OtOpcUa.Commons` — `IDriverBrowser`/`IBrowseSession`/`BrowseNode`) + `Driver.Sql.Contracts` + **`Driver.Sql`** (for `ISqlDialect`/`SqlServerDialect` — the dialect's catalog SQL *is* the browse engine; `Microsoft.Data.SqlClient` comes transitively). This runtime-project ref is the deliberate deviation from `OpcUaClient.Browser` recorded in design §2 — add an XML comment on the ref citing the design so nobody "fixes" it. `InternalsVisibleTo` the `.Browser.Tests`.
+2. Add to slnx under `/src/Drivers/`.
+3. Build — expect PASS.
+4. Commit: `git commit -m "feat(sql): scaffold Driver.Sql.Browser project"`
+
+---
+
+## Task 13: `SqlBrowseSession` — schema walk over the dialect catalog
+
+**Classification:** standard
+**Estimated implement time:** ~5 min
+**Parallelizable with:** Task 16, Task 17
+**Files:**
+- Create: `src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Sql.Browser/SqlBrowseSession.cs`
+- Create: `tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Sql.Browser.Tests/ZB.MOM.WW.OtOpcUa.Driver.Sql.Browser.Tests.csproj` (+ slnx entry, + link `SqliteDialect.cs` from Sql.Tests)
+- Test: `tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Sql.Browser.Tests/SqlBrowseSessionTests.cs`
+
+**TDD:**
+1. **Failing test** — over a seeded SQLite DB + `SqliteDialect`: `RootAsync` yields schema folder(s); `ExpandAsync(schema)` yields the seeded tables; `ExpandAsync(table)` yields columns as leaves; `AttributesAsync(column)` yields the mapped `DriverDataType`:
+```csharp
+[Fact]
+public async Task ExpandTable_yieldsColumnsAsLeaves_withMappedType()
+{
+    await using var db = await SqliteBrowseFixture.CreateAsync();   // TagValues(tag_name TEXT, num_value REAL)
+    var session = new SqlBrowseSession(db.Connection, new SqliteDialect());
+    var tableNode = (await session.ExpandAsync(db.SchemaNodeId, default)).First(n => n.DisplayName.Contains("TagValues"));
+    var cols = await session.ExpandAsync(tableNode.NodeId, default);
+    cols.ShouldContain(c => c.DisplayName == "num_value" && c.IsLeaf);
+    var attrs = await session.AttributesAsync(cols.First(c => c.DisplayName == "num_value").NodeId, default);
+    attrs.DriverDataType.ShouldBe(nameof(DriverDataType.Float64));
+}
+```
+2. Run — expect FAIL.
+3. **Minimal impl** — `SqlBrowseSession : IBrowseSession` (match the `Commons.Browsing` interface shape used by `OpcUaClientBrowseSession`): `RootAsync`/`ExpandAsync(nodeId)`/`AttributesAsync(nodeId)` run the dialect catalog queries with bound `@schema`/`@table` params; encode `NodeId` as `schema` / `schema.table` / `schema.table|column`; a `SemaphoreSlim _gate` serializes (one ADO.NET connection is not concurrent); per-call work bounded by the AdminUI's existing 20 s per-call timeout. Column leaf `AttributesAsync` returns `AttributeInfo(Name: column, DriverDataType: dialect.MapColumnType(dataType).ToString(), IsArray:false, SecurityClass:"ViewOnly")` (mirrors Galaxy two-stage pick).
+4. Run — expect PASS.
+5. Commit: `git commit -m "feat(sql): SqlBrowseSession schema-walk over dialect catalog"`
+
+---
+
+## Task 14: `SqlDriverBrowser` — IDriverBrowser open (env ref OR pasted literal, transient connection)
+
+**Classification:** standard
+**Estimated implement time:** ~5 min
+**Parallelizable with:** Task 16, Task 17
+**Files:**
+- Create: `src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Sql.Browser/SqlDriverBrowser.cs`
+- Test: `tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Sql.Browser.Tests/SqlDriverBrowserTests.cs`
+
+**TDD:**
+1. **Failing test** — `OpenAsync` with a form JSON whose `connectionStringRef` resolves from env opens a session; an UNresolvable ref fails with a message naming the EXACT missing env var; a pasted literal connection string is used session-only (never persisted):
+```csharp
+[Fact]
+public async Task Open_unresolvableRef_failsNamingExactEnvVar()
+{
+    var browser = new SqlDriverBrowser();
+    var ex = await Should.ThrowAsync<InvalidOperationException>(() =>
+        browser.OpenAsync("""{"provider":"SqlServer","connectionStringRef":"MesStaging"}""", default));
+    ex.Message.ShouldContain("Sql__ConnectionStrings__MesStaging");
+}
+```
+2. Run — expect FAIL.
+3. **Minimal impl** — `SqlDriverBrowser : IDriverBrowser`, `DriverType => DriverTypeNames.Sql`. `OpenAsync(configJson, ct)`: deserialize with the same `JsonStringEnumConverter` options; resolve `connectionStringRef` via a direct env read (`Sql__ConnectionStrings__<ref>`) IN THE ADMINUI PROCESS — on miss throw an actionable message naming the exact missing env var (design §4.4); accept an optional pasted literal `connectionString` for ad-hoc browse (session-only, **never persisted, never logged, no `_lastConfigJson` cached field**); select `SqlServerDialect` (P1); open ONE transient `DbConnection`, return a `SqlBrowseSession`. Reuses the AdminUI `BrowseSessionRegistry` + reaper + idle TTL unchanged.
+4. Run — expect PASS.
+5. Commit: `git commit -m "feat(sql): SqlDriverBrowser transient-connection open with env-ref + literal"`
+
+---
+
+## Task 15: AdminUI browser DI + `SqlAddressPickerBody.razor` (picker body)
+
+**Classification:** standard
+**Estimated implement time:** ~5 min
+**Parallelizable with:** Task 16, Task 17
+**Files:**
+- Modify: `src/Server/ZB.MOM.WW.OtOpcUa.AdminUI/EndpointRouteBuilderExtensions.cs` (add `services.AddSingleton<IDriverBrowser, SqlDriverBrowser>();` beside the OpcUaClient/Galaxy lines ~:75)
+- Modify: `src/Server/ZB.MOM.WW.OtOpcUa.AdminUI/ZB.MOM.WW.OtOpcUa.AdminUI.csproj` (project-ref `Driver.Sql.Browser`)
+- Create: `src/Server/ZB.MOM.WW.OtOpcUa.AdminUI/Components/Shared/Uns/AddressPickers/SqlAddressPickerBody.razor` (reuse `DriverBrowseTree.razor` for the tree + an attribute side-panel + model/selector fields; gated by the existing `DriverOperator` policy; manual entry retained)
+
+**Steps (no unit test — Razor is live-verified in Task 21):**
+1. Register the bespoke `IDriverBrowser` (the universal-browser DI line is NOT added for `Sql` — its `CanBrowse` is false and bespoke wins by construction).
+2. `SqlAddressPickerBody.razor` — thin body: `DriverBrowseTree` in picker mode + attribute side-panel; on column pick, compose the `TagConfig` blob (DisplayName default `table.column`, prefill `type` from `AttributesAsync`, operator picks model + fills key/row selector; `SecurityClass=ViewOnly`).
+3. `dotnet build` — expect PASS.
+4. Commit: `git commit -m "feat(sql): AdminUI browser DI + Sql address picker body"`
+
+---
+
+## Task 16: Env-gated central-SQL integration fixture (`Driver.Sql.IntegrationTests`)
+
+**Classification:** standard
+**Estimated implement time:** ~5 min
+**Parallelizable with:** Task 13, Task 14, Task 15, Task 17
+**Files:**
+- Create: `tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Sql.IntegrationTests/ZB.MOM.WW.OtOpcUa.Driver.Sql.IntegrationTests.csproj` (+ slnx entry)
+- Create: `tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Sql.IntegrationTests/SqlPollServerFixture.cs`
+- Create: `tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Sql.IntegrationTests/SqlServerReadTests.cs`
+
+**TDD:**
+1. **Failing/skipping test** — against the always-on central SQL Server (`10.100.0.35,14330`), seed a `SqlPollFixture` database with the two sample tables (KeyValue + wide-row), then validate the real `Microsoft.Data.SqlClient` path (read round-trip, `INFORMATION_SCHEMA` browse, `CommandTimeout`/cancellation, pooling). **Env-gated** via `SQL_TEST_ENDPOINT` / a full `Sql__ConnectionStrings__Fixture` — absent ⇒ skip cleanly (use `Assert.Skip(...)` / xunit.v3 `[Fact(Skip=...)]` dynamic skip), like every other `*.IntegrationTests`:
+```csharp
+[Fact]
+public async Task ReadAsync_realSqlServer_roundTripsSeededKeyValue()
+{
+    var connStr = Environment.GetEnvironmentVariable("Sql__ConnectionStrings__Fixture");
+    Assert.SkipWhen(string.IsNullOrEmpty(connStr), "Sql__ConnectionStrings__Fixture not set — offline skip.");
+    await using var fx = await SqlPollServerFixture.EnsureSeededAsync(connStr!);
+    var driver = SqlDriver.ForProduction(connStr!, new SqlServerDialect(), fx.AuthoredRawTags);
+    await driver.InitializeAsync(fx.ConfigJson, default);
+    var snaps = await driver.ReadAsync(new[] { "Line1.Speed" }, default);
+    snaps[0].StatusCode.ShouldBe(0u);
+}
+```
+2. Run offline — expect SKIP (green).
+3. **Impl** — the fixture (create-if-missing DB + tables + seed rows via `Microsoft.Data.SqlClient`) and the read tests. **The seed DB is `SqlPollFixture`, NOT `ConfigDb`** — the shared central server hosts ConfigDb; the fixture uses its own database on that server.
+4. Commit: `git commit -m "test(sql): env-gated central-SQL integration fixture + read round-trip"`
+
+---
+
+## Task 17: Injection regression test (bind-harmless value / reject identifier, never execute)
+
+**Classification:** standard
+**Estimated implement time:** ~4 min
+**Parallelizable with:** Task 13, Task 14, Task 15, Task 16
+**Files:**
+- Test: `tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Sql.Tests/SqlInjectionRegressionTests.cs`
+
+**TDD:**
+1. **Failing test** (offline, SQLite fixture) — a malicious `keyValue` (`'; DROP TABLE TagValues; --`) reads harmlessly as a bound param and the seed table still exists afterward; a malicious `table`/`column` identifier that is not catalog-valid is REJECTED (tag → `BadNodeIdUnknown`), never executed:
+```csharp
+[Fact]
+public async Task MaliciousKeyValue_bindsHarmlessly_tableSurvives()
+{
+    await using var fx = await SqlitePollFixture.CreateAsync();
+    var reader = fx.NewReader();
+    var snaps = await reader.ReadAsync(new[] { fx.RefWithKeyValue("'; DROP TABLE TagValues; --") }, default);
+    snaps[0].StatusCode.ShouldBe(SqlStatusCodes.BadNoData);   // no such key — bound, not executed
+    (await fx.TableRowCountAsync("TagValues")).ShouldBeGreaterThan(0);   // table intact
+}
+```
+2. Run — expect FAIL (until reader binds correctly; it should already PASS from Task 7 if binding is right — this test LOCKS the guarantee).
+3. **Impl** — none if Task 7 binds correctly; otherwise fix. Add a review-checklist note: "any code path building SQL by string-concatenating a tag field is a defect."
+4. Commit: `git commit -m "test(sql): injection regression — bind values, reject unknown identifiers"`
+
+---
+
+## Task 18: Blackhole / timeout live-gate against a DEDICATED mssql container
+
+**Classification:** high-risk (frozen-peer resilience — the single highest-value integration test)
+**Estimated implement time:** ~5 min
+**Parallelizable with:** none
+**Files:**
+- Create: `tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Sql.IntegrationTests/Docker/docker-compose.yml` (a dedicated disposable `mssql` stack)
+- Create: `tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Sql.IntegrationTests/Docker/seed.sql`
+- Create: `tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Sql.IntegrationTests/SqlBlackholeTimeoutTests.cs`
+
+> **CRITICAL:** this gate `docker pause`s a **dedicated** `mcr.microsoft.com/mssql/server` container it owns — **NEVER** the shared central SQL Server on `10.100.0.35,14330`, which hosts `ConfigDb` for the whole rig (design §9). The compose stack is deployed via `lmxopcua-fix sync`; `lmxopcua-fix` applies the `project=lmxopcua` label host-side.
+
+**TDD:**
+1. **Failing/skipping test** — mirror the R2-01 S7 blackhole (`S7_1500ConnectTimeoutOutageTests`): start reading against the dedicated mssql, then `docker pause` it mid-poll; assert the next read surfaces `BadTimeout` within `operationTimeout` + a small margin (client-side linked-CTS cancellation, not the poll thread wedging), the driver degrades, and the poll loop backs off; `docker unpause` recovers. Env-gated (`SQL_BLACKHOLE_ENDPOINT`) — offline skip:
+```csharp
+[Fact]
+public async Task PausedServer_surfacesBadTimeout_withinDeadline_notWedged()
+{
+    var ep = Environment.GetEnvironmentVariable("SQL_BLACKHOLE_ENDPOINT");
+    Assert.SkipWhen(string.IsNullOrEmpty(ep), "SQL_BLACKHOLE_ENDPOINT not set — offline skip.");
+    // ... start driver, docker pause <dedicated-container>, read, assert BadTimeout within ~operationTimeout, unpause ...
+}
+```
+2. Run offline — expect SKIP.
+3. **Impl** — dedicated `docker-compose.yml` (`mssql` service, own container name, `restart: "no"`), `seed.sql` (the two sample tables), and the test that shells `docker pause`/`docker unpause` against the OWNED container. Assert the wall-clock bound (the frozen-peer contract): `CommandTimeout` (server-side backstop) + `ExecuteReaderAsync(linkedCt)` bounded by `operationTimeout` (client-side real cancellation) both fire.
+4. Commit: `git commit -m "test(sql): blackhole/timeout live-gate on a dedicated mssql container"`
+
+---
+
+## Task 19: AdminUI typed editor model + validator (timeout-order rule, string enums)
+
+**Classification:** standard
+**Estimated implement time:** ~5 min
+**Parallelizable with:** Task 16, Task 17, Task 18
+**Files:**
+- Create: `src/Server/ZB.MOM.WW.OtOpcUa.AdminUI/Uns/TagEditors/SqlTagConfigModel.cs`
+- Modify: `src/Server/ZB.MOM.WW.OtOpcUa.AdminUI/Uns/TagEditors/TagConfigEditorMap.cs` (add `[DriverTypeNames.Sql] = typeof(...SqlTagConfigEditor)`)
+- Modify: `src/Server/ZB.MOM.WW.OtOpcUa.AdminUI/Uns/TagEditors/TagConfigValidator.cs` (add `[DriverTypeNames.Sql] = j => SqlTagConfigModel.FromJson(j).Validate()`)
+- Test: `tests/.../AdminUI.Tests/.../SqlTagConfigModelTests.cs` (locate the existing AdminUI tag-editor test project; mirror `ModbusTagConfigModel` tests)
+
+**TDD:**
+1. **Failing test** — `FromJson`→`ToJson` round-trips the model, preserves unknown keys, writes enums (`model`/`type`) as NAME strings not numbers; `Validate()` rejects a WideRow without a row selector and enforces the driver-level timeout-order rule surrogate at the tag layer if the tag carries timeouts (the primary timeout-order check is at the driver page — the model validates model/selector shape):
+```csharp
+[Fact]
+public void ToJson_writesModelAndTypeAsStrings_preservesUnknownKeys()
+{
+    var m = SqlTagConfigModel.FromJson("""{"driver":"Sql","model":"KeyValue","table":"t","keyColumn":"k","keyValue":"v","valueColumn":"c","type":"Float64","customX":1}""");
+    var json = m.ToJson();
+    json.ShouldContain("\"KeyValue\"");
+    json.ShouldContain("\"Float64\"");
+    json.ShouldContain("customX");            // unknown key survives load→save
+    json.ShouldNotContain("\"model\":0");
+}
+```
+2. Run — expect FAIL.
+3. **Minimal impl** — `SqlTagConfigModel` (thin, over `TagConfigJson.ParseOrNew`, preserving the `_bag`): `Model`, `Table`, `KeyColumn`/`KeyValue`/`ValueColumn`/`TimestampColumn`, `ColumnName` + `RowSelector`, `Type` (`DriverDataType?`), `FromJson`/`ToJson` (enums as name strings via `TagConfigJson.Set`) `/Validate` (model discriminator ⇒ required-field shape; WideRow needs a selector). Register in `TagConfigEditorMap` + `TagConfigValidator`. **Enum-serialization trap (systemic):** `model`/`type` MUST round-trip as strings on both sides — the editor `ToJson` and the factory `SqlEquipmentTagParser` both use string enums; add the assertion above.
+4. Run — expect PASS.
+5. Commit: `git commit -m "feat(sql): typed AdminUI Sql tag-config model + validator (string enums)"`
+
+---
+
+## Task 20: `SqlTagConfigEditor.razor` (thin shell over the model)
+
+**Classification:** small
+**Estimated implement time:** ~5 min
+**Parallelizable with:** none
+**Files:**
+- Create: `src/Server/ZB.MOM.WW.OtOpcUa.AdminUI/Components/Shared/Uns/TagEditors/SqlTagConfigEditor.razor`
+
+**Steps (Razor — live-verified in Task 21):**
+1. Copy the Modbus editor template; bind over `SqlTagConfigModel`: a `Model` dropdown (KeyValue/WideRow) that shows the matching field group, `Table`, the key/value/timestamp fields (KeyValue) OR `ColumnName` + row-selector fields (WideRow), and a `Type` override dropdown. `@bind` string component params need the `@` prefix (the Global-UNS gotcha).
+2. `dotnet build` — expect PASS.
+3. Commit: `git commit -m "feat(sql): SqlTagConfigEditor razor shell"`
+
+---
+
+## Task 21: Live `/run` verification on docker-dev (picker + editor + deploy + read)
+
+**Classification:** trivial (procedure — no product code; may surface fix-forward tasks)
+**Estimated implement time:** ~5 min (verification, excluding any bugs found)
+**Parallelizable with:** none (last)
+**Files:** none (verification only; any defect becomes a new fix-forward task)
+
+**Procedure (docker-dev rig, AdminUI auto-authenticated at `http://localhost:9200` — login disabled, so drive it yourself, don't defer to the user):**
+1. Set `Sql__ConnectionStrings__DevSql` on the docker-dev central + driver nodes pointing at a dev SQL Server + seeded table (the dedicated mssql from Task 18, or the central-SQL fixture DB). Rebuild BOTH central-1/central-2 (`:9200` round-robins).
+2. In `/raw`, add a `Sql` driver + device (paste a literal connection string or use the ref); Test-Connect → green (`SELECT 1`).
+3. Open the Sql address picker → browse schema→table→column → commit a KeyValue tag and a WideRow tag; confirm the typed editor renders and validates.
+4. Reference the raw tags into an equipment on `/uns`; deploy via `POST :9200/api/deployments` (X-Api-Key) or the deploy button; confirm the deployment seals green.
+5. Read via Client.CLI (`read -u opc.tcp://localhost:4840 -n "ns=2;s=<RawPath>"`) — confirm the live SQL value + quality + source timestamp.
+6. Record the run outcome in the plan's completion note. If anything is deploy-inert / mis-bound, open a fix-forward task (Razor binding + deploy-inertness bugs pass unit tests + review — this live gate is the real proof).
+
+---
+
+## Deferred / out of scope (pointers to the design, NOT executable tasks here)
+
+These are recorded so nobody re-derives them; each is a later phase in `docs/plans/2026-07-15-sql-poll-driver-design.md`. The `ISqlDialect` seam is built in from day one (Task 4) precisely so the provider tail below is additive and cheap.
+
+- **Named-query model** (design §5.4, §3.6(c) / design-P3) — the arbitrary-`SELECT` escape hatch (`queries: {...}` + a tag referencing a query by name + projection). Not built in v1; the `SqlTagModel.Query` enum member exists but the reader/planner path is deferred.
+- **PostgreSQL + ODBC dialects** (design §2.2, §8.5 / design-P3) — `PostgresDialect` (`Npgsql`) + `OdbcDialect` (`System.Data.Odbc`), each a NEW gated `PackageVersion`. v1 constructs only `SqlServerDialect`; the other `SqlProvider` members throw "provider not available in this build."
+- **MySQL/MariaDB + native Oracle** (design §10 / design-P5) — `MySqlConnector` + an `ALL_TAB_COLUMNS` Oracle dialect. Demand-driven.
+- **Write mode (`IWritable`)** (design §3.4 / design-P4) — opt-in, triple-gated (`WriteOperate` role + driver `allowWrites` master switch + `TagConfig.writable`), parameterized UPSERT/StoredProc, `WriteIdempotent` retry policy. v1 is read-only; `SecurityClass=ViewOnly` everywhere and `allowWrites` defaults `false`.
+- **Split-role env-parity operational note** (design §4.4) — admin nodes must carry the same `Sql__ConnectionStrings__<ref>` env vars as driver nodes for any browseable ref; the browser-open failure names the exact missing env var. This is a deployment/runbook item, not a code task.
@@ -0,0 +1,191 @@
+{
+  "planPath": "docs/plans/2026-07-24-sql-poll-driver.md",
+  "tasks": [
+    {
+      "id": 0,
+      "subject": "Task 0: Scaffold Driver.Sql.Contracts project + register in slnx",
+      "status": "completed"
+    },
+    {
+      "id": 1,
+      "subject": "Task 1: SqlProvider/SqlTagModel enums + SqlDriverConfigDto",
+      "status": "completed",
+      "blockedBy": [
+        0
+      ]
+    },
+    {
+      "id": 2,
+      "subject": "Task 2: SqlTagDefinition + SqlEquipmentTagParser (strict enums, malicious-input safe)",
+      "status": "completed",
+      "blockedBy": [
+        1
+      ]
+    },
+    {
+      "id": 3,
+      "subject": "Task 3: Scaffold Driver.Sql runtime project + register in slnx",
+      "status": "completed",
+      "blockedBy": [
+        0
+      ]
+    },
+    {
+      "id": 4,
+      "subject": "Task 4: ISqlDialect + SqlServerDialect (QuoteIdentifier, catalog SQL, MapColumnType)",
+      "status": "completed",
+      "blockedBy": [
+        1,
+        3
+      ]
+    },
+    {
+      "id": 5,
+      "subject": "Task 5: SqlQueryPlan grouping + parameter binding (pure)",
+      "status": "completed",
+      "blockedBy": [
+        2,
+        4
+      ]
+    },
+    {
+      "id": 6,
+      "subject": "Task 6: Scaffold Driver.Sql.Tests + SqliteDialect + SqlitePollFixture",
+      "status": "completed",
+      "blockedBy": [
+        3,
+        4
+      ]
+    },
+    {
+      "id": 7,
+      "subject": "Task 7: SqlPollReader core \u2014 grouped read, bounded deadline, ordered slice-back",
+      "status": "completed",
+      "blockedBy": [
+        5,
+        6
+      ]
+    },
+    {
+      "id": 8,
+      "subject": "Task 8: SqlDriver shell \u2014 IDriver/ITagDiscovery/IReadable/ISubscribable/IHostConnectivityProbe",
+      "status": "completed",
+      "blockedBy": [
+        7
+      ]
+    },
+    {
+      "id": 9,
+      "subject": "Task 9: SqlDriverFactoryExtensions + connectionStringRef env resolution + enum guard",
+      "status": "completed",
+      "blockedBy": [
+        8
+      ]
+    },
+    {
+      "id": 10,
+      "subject": "Task 10: SqlDriverProbe (SELECT 1 liveness)",
+      "status": "completed",
+      "blockedBy": [
+        4,
+        6
+      ]
+    },
+    {
+      "id": 11,
+      "subject": "Task 11: Host registration \u2014 DriverTypeNames.Sql + factory + probe + guard test",
+      "status": "completed",
+      "blockedBy": [
+        9,
+        10
+      ]
+    },
+    {
+      "id": 12,
+      "subject": "Task 12: Scaffold Driver.Sql.Browser project + register in slnx",
+      "status": "completed",
+      "blockedBy": [
+        3
+      ]
+    },
+    {
+      "id": 13,
+      "subject": "Task 13: SqlBrowseSession \u2014 schema walk over dialect catalog",
+      "status": "completed",
+      "blockedBy": [
+        4,
+        12,
+        6
+      ]
+    },
+    {
+      "id": 14,
+      "subject": "Task 14: SqlDriverBrowser \u2014 env-ref/literal transient-connection open",
+      "status": "completed",
+      "blockedBy": [
+        13
+      ]
+    },
+    {
+      "id": 15,
+      "subject": "Task 15: AdminUI browser DI + SqlAddressPickerBody.razor",
+      "status": "completed",
+      "blockedBy": [
+        14
+      ]
+    },
+    {
+      "id": 16,
+      "subject": "Task 16: Env-gated central-SQL integration fixture + read round-trip",
+      "status": "completed",
+      "blockedBy": [
+        8
+      ]
+    },
+    {
+      "id": 17,
+      "subject": "Task 17: Injection regression test (bind value / reject identifier)",
+      "status": "completed",
+      "blockedBy": [
+        7
+      ]
+    },
+    {
+      "id": 18,
+      "subject": "Task 18: Blackhole/timeout live-gate on a dedicated mssql container",
+      "status": "completed",
+      "blockedBy": [
+        16
+      ]
+    },
+    {
+      "id": 19,
+      "subject": "Task 19: AdminUI typed Sql tag-config model + validator (string enums)",
+      "status": "completed",
+      "blockedBy": [
+        1,
+        11
+      ]
+    },
+    {
+      "id": 20,
+      "subject": "Task 20: SqlTagConfigEditor.razor shell",
+      "status": "completed",
+      "blockedBy": [
+        19
+      ]
+    },
+    {
+      "id": 21,
+      "subject": "Task 21: Live /run verification on docker-dev (picker + editor + deploy + read)",
+      "status": "completed",
+      "blockedBy": [
+        11,
+        15,
+        20
+      ]
+    }
+  ],
+  "lastUpdated": "2026-07-27",
+  "closureNote": "Merged 4ad54037 + follow-ups 28c28667. Marked complete 2026-07-27 (deferment.md \u00a78.5)."
+}
@@ -21,7 +21,7 @@ OtOpcUa has four independent security concerns. This document covers all four:

 1. **Transport security** — OPC UA secure channel (signing, encryption, X.509 trust).
 2. **OPC UA authentication** — Anonymous / UserName / X.509 session identities; UserName tokens authenticated by LDAP bind.
-3. **Data-plane authorization** — who can browse, read, subscribe, write, acknowledge alarms on which nodes. Evaluated by `TriePermissionEvaluator` over a `PermissionTrie` built from the Config DB `NodeAcl` tree.
+3. **Data-plane authorization** — who can write and acknowledge alarms on an OtOpcUa endpoint. ⚠️ Enforced today by **two coarse, server-wide LDAP role checks** (`WriteOperate`, `AlarmAck`) — **not** by the `NodeAcl` / `PermissionTrie` subsystem, which is built and unit-tested but never wired. Read, Browse, HistoryRead and Subscribe carry **no** authorization check at all. See [Data-Plane Authorization](#data-plane-authorization).
 4. **Control-plane authorization** — who can view or edit fleet configuration in the Admin UI. Gated by the `AdminRole` (`Viewer` / `Designer` / `Administrator`) claim resolved from `LdapGroupRoleMapping`.

 Transport security and OPC UA authentication are per-node concerns configured in the Server's bootstrap `appsettings.json`. Data-plane ACLs and Admin role grants live in the Config DB.
@@ -112,9 +112,9 @@ The Server accepts three OPC UA identity-token types:

 | Token | Handler | Notes |
 |---|---|---|
-| Anonymous | No `IOpcUaUserAuthenticator` call — the SDK admits anonymous sessions at the channel. | Data-plane authorization (below) still default-denies any node a session has no ACL grant for. |
-| UserName/Password | `LdapOpcUaUserAuthenticator.AuthenticateUserNameAsync` (`src/Server/ZB.MOM.WW.OtOpcUa.Host/OpcUa/LdapOpcUaUserAuthenticator.cs`, implements `IOpcUaUserAuthenticator`), backed by the app `ILdapAuthService` — `OtOpcUaLdapAuthService` (`src/Server/ZB.MOM.WW.OtOpcUa.Security/Ldap/OtOpcUaLdapAuthService.cs`). | LDAP bind + group lookup. The returned LDAP groups are mapped to roles via `IGroupRoleMapper<string>` (`OtOpcUaGroupRoleMapper`) and attached to the OPC UA session identity for the downstream ACL evaluator. |
-| X.509 Certificate | Stack-level acceptance during the secure-channel handshake. | The certificate must be trusted (see PKI trust flow); finer-grain authorization happens through the data-plane ACLs. |
+| Anonymous | No `IOpcUaUserAuthenticator` call — the SDK admits anonymous sessions at the channel. | ⚠️ An anonymous session carries **no roles**, so it is refused every write and every alarm ack — but it can **Browse, Read, Subscribe and HistoryRead the entire address space**. There is no per-node ACL check on those operations (see [Data-Plane Authorization](#data-plane-authorization)). Do not expose an Anonymous-admitting endpoint to an untrusted network. |
+| UserName/Password | `LdapOpcUaUserAuthenticator.AuthenticateUserNameAsync` (`src/Server/ZB.MOM.WW.OtOpcUa.Host/OpcUa/LdapOpcUaUserAuthenticator.cs`, implements `IOpcUaUserAuthenticator`), backed by the app `ILdapAuthService` — `OtOpcUaLdapAuthService` (`src/Server/ZB.MOM.WW.OtOpcUa.Security/Ldap/OtOpcUaLdapAuthService.cs`). | LDAP bind + group lookup. The returned LDAP groups are mapped to roles via `IGroupRoleMapper<string>` (`OtOpcUaGroupRoleMapper`) and the **roles** are attached to the OPC UA session identity as a `RoleCarryingUserIdentity`. The raw group list is discarded at that point and never reaches the data plane. |
+| X.509 Certificate | Stack-level acceptance during the secure-channel handshake. | The certificate must be trusted (see PKI trust flow). It carries **no** roles, so a cert-only session is read-everything / write-nothing. |

 When no authenticator is supplied, `OpcUaApplicationHost` falls back to `NullOpcUaUserAuthenticator`; the Host wires the real `LdapOpcUaUserAuthenticator` as a singleton in `Program.cs`.

@@ -130,7 +130,7 @@ LDAP is configured under the `Security:Ldap` section (bound to `LdapOptions`, `s
 4. Delegates the real path to the shared `ZB.MOM.WW.Auth.Ldap` client: it binds (search-then-bind via `ServiceAccountDn`, or direct-bind `cn={user},{SearchBase}` when no service account is set), verifies the password, and reads the user's group memberships.
 5. Returns an `LdapAuthResult` carrying the validated username + the **groups** (never roles). Failure codes are folded into opaque user-facing error strings so a probe cannot distinguish "unknown user" from "wrong password".

-**Group → role mapping happens downstream**, not in the auth service: `LdapOpcUaUserAuthenticator` resolves `IGroupRoleMapper<string>` (`OtOpcUaGroupRoleMapper`) per call and unions its output with any pre-resolved roles (the DevStub `Administrator` grant). The roles are attached to the OPC UA session identity for the ACL evaluator. A mapper fault (e.g. a Config DB outage) falls back to the pre-resolved baseline rather than denying an otherwise-authenticated session.
+**Group → role mapping happens downstream**, not in the auth service: `LdapOpcUaUserAuthenticator` resolves `IGroupRoleMapper<string>` (`OtOpcUaGroupRoleMapper`) per call and unions its output with any pre-resolved roles (the DevStub `Administrator` grant). The roles are attached to the OPC UA session identity (`RoleCarryingUserIdentity`), where the write and alarm-ack gates read them. **The LDAP group names themselves are consumed here and go no further** — which is one reason the `NodeAcl` subsystem cannot currently be wired, since it matches on groups rather than roles. A mapper fault (e.g. a Config DB outage) falls back to the pre-resolved baseline rather than denying an otherwise-authenticated session.

 `Transport` replaces the former `UseTls` bool: `Ldaps` (implicit TLS), `StartTls` (upgrade), or `None` (plaintext, requires `AllowInsecure`). Configuration example (Active Directory production):

@@ -180,11 +180,92 @@ Defaults are behaviour-neutral on a healthy directory. All new paths are **fail-

 ## Data-Plane Authorization

-Data-plane authorization is the check run on every OPC UA operation against an OtOpcUa endpoint: *can this authenticated user Browse / Read / Subscribe / Write / HistoryRead / AckAlarm / Call on this specific node?*
+> ⚠️ **Read this first (verified against source, 2026-07-27).** This section used to describe the
+> `NodeAcl` / `PermissionTrie` design as if it were the live enforcement path. **It is not.** The
+> evaluator is built and unit-tested but has **zero production call sites**, and
+> `ZB.MOM.WW.OtOpcUa.OpcUaServer.csproj` does not even reference the project it lives in. Everything
+> actually enforced today is in [What is enforced today](#what-is-enforced-today); the trie design is
+> retained below, clearly marked, under [Designed but not wired](#designed-but-not-wired-nodeacl--permissiontrie).

-Per decision #129 the model is **additive-only — no explicit Deny**. Grants at each hierarchy level union; absence of a grant is the default-deny.
+### What is enforced today

-### Hierarchy
+There are exactly **three** authorization checks in the whole OPC UA server layer. All three are
+coarse, **server-wide role string checks** with no per-node component.
+
+| Operation | Gate | Requires |
+|---|---|---|
+| Write (Value attribute, either namespace) | `OtOpcUaNodeManager.EvaluateEquipmentWriteGate` | role `WriteOperate` |
+| Alarm Acknowledge / Confirm / AddComment / Shelve / Unshelve (scripted alarms) | `OtOpcUaNodeManager.HandleAlarmCommand` | role `AlarmAck` |
+| Alarm acknowledge (driver-fed native alarms) | `OtOpcUaNodeManager.HandleNativeAlarmAck` | role `AlarmAck` |
+
+Both gates fail closed — a session with no identity or no matching role gets
+`BadUserAccessDenied` — and read `identity.Roles` off the session's `RoleCarryingUserIdentity`
+(`src/Server/ZB.MOM.WW.OtOpcUa.OpcUaServer/Security/RoleCarryingUserIdentity.cs`). Role strings are
+the constants in `OpcUaDataPlaneRoles`, sourced from `Security:Ldap:GroupToRole` (see
+[Role grant source](#role-grant-source-data-plane)).
+
+**What has no authorization check at all:**
+
+- **Read, Browse, TranslateBrowsePaths** — no override, no handler. Any admitted session, including
+  an Anonymous one, sees and reads the entire address space.
+- **HistoryRead** — all four overrides (`HistoryReadRawModified`, `HistoryReadProcessed`,
+  `HistoryReadAtTime`, `HistoryReadEvents`) run without an identity check.
+- **CreateMonitoredItems / subscriptions / TransferSubscriptions**.
+- **Non-Value attribute writes** — the gate hangs off `OnWriteValue`.
+
+**And what the write gate does *not* distinguish:**
+
+- **`WriteTune` and `WriteConfigure` are never checked.** They exist in the role vocabulary and in
+  `NodePermissions`, but every write — whatever the tag's security classification — is gated on the
+  single `WriteOperate` string.
+- **`AlarmAcknowledge` / `AlarmConfirm` / `AlarmShelve` are not distinguished.** One `AlarmAck` role
+  covers all five alarm methods; the `operation` argument is passed to the router but never consulted
+  by the gate.
+- **There is no per-node granularity.** A session that may write one tag may write **every** writable
+  tag on the node.
+
+The gate *is* realm-aware in one narrow sense: it is attached per-node during materialization for both
+the Raw and UNS realms, and the write dispatch it guards is realm-qualified. The role decision itself
+takes no realm and no node.
+
+### Designed but not wired: `NodeAcl` + `PermissionTrie`
+
+Everything from here to [Role grant source](#role-grant-source-data-plane) describes a subsystem that
+**exists in the tree, is covered by 30 unit tests, and never executes.** It is kept because the design
+is sound and the remaining work is wiring plus one genuine design gap — not because it runs.
+
+What is real about it:
+
+- Operators **can** author `NodeAcl` rows in the Admin UI (`/clusters/{id}/acls`), and those rows are
+  validated, versioned and persisted.
+- `ConfigComposer` **does** snapshot every `NodeAcl` row into every deployment artifact, so an ACL
+  edit shifts the artifact's `RevisionHash` and ships to every node.
+- The node side **never deserializes them** — `DeploymentArtifact` has no ACL reader. The bytes arrive
+  and are dropped.
+
+So an operator can author a grant, deploy it green, and have it change nothing. That is the behaviour
+to expect until the tracking issue below is closed.
+
+**The four things blocking a wire-up** (all verified, none of them merely "call the evaluator"):
+
+1. **Raw-realm nodes have no representable scope.** `NodeHierarchyKind` has exactly one member,
+   `Equipment`. Raw NodeIds are `Folder→Driver→Device→TagGroup→Tag` RawPaths, which `NodeScope` cannot
+   express — yet the write gate is attached to raw tags. Roughly half the writable address space has
+   no scope to evaluate. This is a design decision, not wiring.
+2. **The identity carries roles, not groups.** The trie matches `NodeAcl.LdapGroup` against the
+   session's LDAP groups, but `OpcUaUserAuthResult` carries only mapped role strings; the group list
+   is discarded inside `LdapOpcUaUserAuthenticator`.
+3. **`PermissionTrieBuilder`'s `scopePaths` argument has no producer.** Without it every sub-cluster
+   grant lands in the builder's fallback bucket — the hazard its own comments warn about. It would have
+   to be derived from the artifact's UNS relations.
+4. **No session lifecycle exists.** `UserAuthorizationState` has the freshness/staleness predicates but
+   nothing in production constructs one, stamps a generation, or drives a refresh.
+
+Two smaller inconsistencies inside the subsystem itself: `NodeAclScopeKind.FolderSegment` is offered in
+the authoring dropdown but the trie walker has no level to match it at, and `NodePermissions.AlarmRead`
+has no `OpcUaOperation` mapping, so it is grantable but unreachable.
+
+### Hierarchy (design)

 ACLs are evaluated against the node's scope path. `NodeScope` (`src/Core/ZB.MOM.WW.OtOpcUa.Core/Authorization/NodeScope.cs`) carries a `Kind` that selects between two hierarchy shapes:

@@ -245,19 +326,23 @@ The three Write tiers map to Galaxy's v1 `SecurityClassification` — `FreeAcces

 `NodeScope` is described above (Equipment-kind vs SystemPlatform-kind). The evaluator unions the matched grants along the path — a tag-level ACL and an area-level ACL both contribute.

-### Dispatch gate — `IPermissionEvaluator`
+### Dispatch gate — `IPermissionEvaluator` (design; **no such gate exists**)

-`IPermissionEvaluator.Authorize(UserAuthorizationState session, OpcUaOperation operation, NodeScope scope)` (default impl `TriePermissionEvaluator` at `src/Core/ZB.MOM.WW.OtOpcUa.Core/Authorization/TriePermissionEvaluator.cs`) returns an `AuthorizationDecision`. The dispatch path calls it on every Read, Write, HistoryRead, Browse, Subscribe, AckAlarm, Call; a `NotGranted` decision denies the operation.
+`IPermissionEvaluator.Authorize(UserAuthorizationState session, OpcUaOperation operation, NodeScope scope)` (default impl `TriePermissionEvaluator` at `src/Core/ZB.MOM.WW.OtOpcUa.Core/Authorization/TriePermissionEvaluator.cs`) returns an `AuthorizationDecision`.

-Key properties:
+⚠️ **The intended dispatch path — "calls it on every Read, Write, HistoryRead, Browse, Subscribe, AckAlarm, Call" — was never built.** `Authorize` has zero production call sites. What the dispatch path really does is in [What is enforced today](#what-is-enforced-today).

- **Driver-agnostic.** No driver-level code participates in authorization decisions. Drivers report `SecurityClassification` as metadata on tag discovery; everything else flows through the evaluator.
- **Strictly fail-closed (default-deny).** Every guard path returns `NotGranted` — a stale session (past the staleness ceiling, decision #152), a cluster mismatch between session and scope, a missing trie, a pruned bound generation, or simply no matching grant. There is no `StrictMode` / fail-open mode; absence of a grant is always a deny.
- **Evaluator stays pure.** `TriePermissionEvaluator` has no OPC UA stack dependency — it's tested directly from xUnit.
+Intended properties, of which only the last is true today:
+
+- **Driver-agnostic.** No driver-level code participates in authorization decisions. Drivers report `SecurityClassification` as metadata on tag discovery; everything else was to flow through the evaluator.
+- **Strictly fail-closed (default-deny).** Every guard path returns `NotGranted` — a stale session (past the staleness ceiling, decision #152), a cluster mismatch between session and scope, a missing trie, a pruned bound generation, or simply no matching grant. ⚠️ This describes the evaluator's *internal* behaviour when called. Because nothing calls it, **the effective posture for Read/Browse/Subscribe/HistoryRead is default-ALLOW.**
+- **Evaluator stays pure.** ✅ True — `TriePermissionEvaluator` has no OPC UA stack dependency and is tested directly from xUnit. That purity is also why it was easy to leave unwired.

 ### Full model

-See [`docs/v2/acl-design.md`](v2/acl-design.md) for the complete design: trie invalidation, flag semantics, per-path override rules, and the reasoning behind additive-only (no Deny).
+See [`docs/v2/acl-design.md`](v2/acl-design.md) for the complete design: trie invalidation, flag semantics, per-path override rules, and the reasoning behind additive-only (no Deny). Read it as a **design document for unshipped work**, not as a description of running behaviour.
+
+Note also that the `SystemPlatform` hierarchy kind named above was retired with the v3 dual-namespace address space; `NodeHierarchyKind` now has only `Equipment`.

 ### Role grant source (data-plane)

@@ -271,23 +356,25 @@ to those role strings via `GroupToRole`, e.g.:
 ```json
 "GroupToRole": {
  "ot-operators":  "WriteOperate",
-  "ot-tuners":     "WriteTune",
-  "ot-engineers":  "WriteConfigure",
-  "ot-alarm-ack":  "AlarmAck",
-  "ot-readonly":   "ReadOnly"
+  "ot-alarm-ack":  "AlarmAck"
 }
 ```

-If this mapping is absent the data-plane evaluator is strictly default-deny: inbound operator writes
-and OPC UA Part-9 alarm acknowledgement all return `BadUserAccessDenied` even for users who
-authenticate successfully. (The same requirement gates both the scripted-alarm and the native
-Galaxy-alarm Part-9 ack/confirm/shelve paths.)
+⚠️ **Only two role strings do anything.** `OpcUaDataPlaneRoles` declares exactly `WriteOperate` and
+`AlarmAck`, and those are the only values any gate compares against. `ReadOnly`, `WriteTune` and
+`WriteConfigure` appear in the permission vocabulary but **no code path reads them** — mapping a group
+to `WriteTune` grants nothing, and mapping one to `ReadOnly` restricts nothing (reads are ungated for
+everyone regardless). Earlier revisions of this document listed all five as "code-true"; that was
+wrong for three of them.

-The role strings above are **exact, case-insensitive, and code-true** — the inbound gates compare
-against the constants in `OpcUaDataPlaneRoles` (`AlarmAck`, `WriteOperate`) and the bare strings
-`ReadOnly` / `WriteTune` / `WriteConfigure`. In particular the alarm-ack role is `AlarmAck`, **not**
-`AlarmAcknowledge` (that spelling is the `PermissionFlags` ACL bit, a different vocabulary); a
-`GroupToRole` value of `AlarmAcknowledge` silently never satisfies the ack gate.
+If this mapping is absent, **writes and alarm acknowledgement** default-deny: they return
+`BadUserAccessDenied` even for users who authenticate successfully. (The same requirement gates both
+the scripted-alarm and the native Galaxy-alarm Part-9 ack/confirm/shelve paths.) **Reads, browses,
+subscribes and history reads are unaffected** — they succeed with or without any `GroupToRole` entry.
+
+The two live role strings are exact and case-insensitive. In particular the alarm-ack role is
+`AlarmAck`, **not** `AlarmAcknowledge` (that spelling is the `PermissionFlags` ACL bit, a different
+vocabulary); a `GroupToRole` value of `AlarmAcknowledge` silently never satisfies the ack gate.

 ---

@@ -1,5 +1,10 @@
 # Admin UI rebuild plan (F15)

+> ⚠️ **Historical (audited 2026-07-27) — describes the v2 AdminUI.** Several named types
+> (`AuthorizationPolicies`, `IdentificationFields`) no longer exist, and the v3 rebuild replaced the
+> per-cluster UNS/Equipment/Tags tabs with the global `/uns` page and the `/raw` project tree. Kept
+> for the record.
+
 **Status:** UX kickoff — proposals to react to before any per-page rebuild starts.
 **Last updated:** 2026-05-26 on `v2-akka-fuse`.

@@ -103,7 +103,7 @@ Message contracts are defined; actual SDK calls are stubbed (counters only). Rea

 Both have message contracts wired. Engine integration deferred:

- `HistorianAdapterActor` — named-pipe IPC to the Wonderware historian sidecar + `SqliteStoreAndForwardSink` (F11).
+- `HistorianAdapterActor` — gRPC to the `ZB.MOM.WW.HistorianGateway` sidecar (the sole historian backend; the named-pipe Wonderware sidecar is retired) + `LocalDbStoreAndForwardSink` (F11; renamed from `SqliteStoreAndForwardSink` when the buffer moved into the consolidated LocalDb).
 - `PeerOpcUaProbeActor` — real `opc.tcp://peer:4840` ping (F12). Current stub always returns `Ok=true`.

 ## DbHealthProbeActor
@@ -1,5 +1,23 @@
 # OPC UA Client Authorization (ACL Design) — OtOpcUa v2

+> ⚠️ **NEVER WIRED (verified against source 2026-07-27).** This is a design document for work that was
+> only half-built. The trie, the builder, the cache and the evaluator all exist in
+> `src/Core/ZB.MOM.WW.OtOpcUa.Core/Authorization/` and carry 30 passing unit tests — but
+> `IPermissionEvaluator.Authorize` has **zero production call sites**, nothing registers it in DI, and
+> `ZB.MOM.WW.OtOpcUa.OpcUaServer.csproj` does not reference the project it lives in. `NodeAcl` rows are
+> authorable in the Admin UI and are snapshotted into every deployment artifact, but the node side never
+> deserializes them.
+>
+> **Nothing described below is enforced.** For what actually gates OPC UA operations today, see
+> [`docs/security.md`](../security.md) § Data-Plane Authorization and
+> [`docs/ReadWriteOperations.md`](../ReadWriteOperations.md). Four blockers stand between this design
+> and a wire-up (Raw-realm nodes have no `NodeScope` representation; the session carries roles, not LDAP
+> groups; `PermissionTrieBuilder`'s `scopePaths` has no producer; no session lifecycle exists) — they
+> are recorded in `deferment.md` §3.1.
+>
+> Note also that the `SystemPlatform` hierarchy kind used throughout was retired with the v3
+> dual-namespace address space.
+>
 > **Status**: DRAFT — closes corrections-doc finding B1 (namespace / equipment-subtree ACLs not yet modeled in the data path).
 >
 > **Branch**: `v2`
@@ -1,5 +1,25 @@
 # Driver Stability & Isolation — OtOpcUa v2

+> ⚠️ **The tier assignments below are NOT what runs (verified against source 2026-07-27).**
+> **Every one of the 12 drivers runs as Tier A.** `DriverFactoryRegistry` defaults `DriverTier tier =
+> DriverTier.A` and **no factory in `src/Drivers/` passes a tier**, so nothing ever selects B or C. The
+> Galaxy and FOCAS Tier-C assignments in the table below are aspirational.
+>
+> Consequences worth knowing:
+>
+> - The **Tier-C-only protections are dormant for every driver** — `MemoryRecycle` gates on
+>   `when _tier == DriverTier.C`, and `ScheduledRecycleScheduler` refuses unless Tier C. Neither has ever
+>   engaged in production. `IDriverSupervisor` has zero implementations, yet the config parser still
+>   validates `RecycleIntervalSeconds`, so an operator can author a recycle interval that does nothing.
+> - `DriverTypeRegistry` — which this document's model implies is the tier authority — is **vestigial**:
+>   referenced only by its own test, with nothing registering metadata at startup.
+> - The **separate-Windows-service hosting** described for Tier C does not exist either. Galaxy reaches
+>   MXAccess over gRPC to the external **mxaccessgw** sidecar; the `Galaxy.Proxy`/`Host`/`Shared` pattern
+>   named below was retired in PR 7.2, and FOCAS runs in-process like everything else.
+>
+> `docs/drivers/README.md` says Tier A for Galaxy and FOCAS and is the accurate one. Keep-or-delete of the
+> tier machinery is tracked as Gitea **#522**; this document is retained as the design record.
+>
 > **Status**: DRAFT — companion to `plan.md`. Defines the stability tier model, per-driver hosting decisions, cross-cutting protections every driver process must apply, and the canonical worked example (FOCAS) for the high-risk tier.
 >
 > **Branch**: `v2`
@@ -1,5 +1,12 @@
 # Phase 7 Status — Scripting Runtime, Virtual Tags, Scripted Alarms, Historian Sink

+> ⚠️ **Historical (audited 2026-07-27) — describes the v2 codebase; do not treat its present-tense
+> claims as current.** Many named types no longer exist. Notably `:84` reports four services
+> ("Done | All four exist in `Admin/Services/`") — **none exist and there is no `Admin/Services/`
+> directory**; the `Phase7*` composition types were renamed to `AddressSpace*` by `40e8a23e`; and
+> Gaps 2/3/4 (no `/virtual-tags` page, no `/scripted-alarms` page, no script-log viewer) were closed
+> by v3's `/uns`, `/alerts` and `/script-log` surfaces. Kept for the record.
+
 > **Reconciliation date**: 2026-05-18
 > **Based on**: `docs/v2/implementation/phase-7-scripting-and-alarming.md` (the plan) and
 > `docs/v2/implementation/exit-gate-phase-7.md` (the exit-gate audit) cross-checked against
@@ -1,5 +1,13 @@
 # Redundancy Interop Playbook (Phase 6.3 Stream F — task #150)

+> ⚠️ **Historical type names (audited 2026-07-27).** The operator *procedure* below is still the
+> right one, but `RedundancyPublisherHostedService` (`:22`), `RecoveryStateManager.DwellTime` (`:67`)
+> and `RedundancyCoordinator` no longer exist — redundancy state is now published by the
+> cluster-scoped `RedundancyStateActor` singleton with `ServiceLevelCalculator` and
+> `IRedundancyRoleView`. See `docs/Redundancy.md` (which states plainly that the old types are gone)
+> and the per-cluster-mesh Phase 6/7 sections of `CLAUDE.md`. The `ServerUriArray` limitation noted
+> at `:100-105` is still open (SDK object-type gated).
+
 > **Scope**: manual validation that third-party OPC UA clients + AVEVA MXAccess
 > observe our non-transparent redundancy signals (ServiceLevel, ServerUriArray,
 > RedundancySupport) and fail over to the Backup node when the Primary drops.
@@ -1,5 +1,14 @@
 # v2 Release Readiness

+> ⚠️ **Historical (audited 2026-07-27) — a v2-era snapshot; several "Closed" rows name types that do
+> not exist in `src/`.** In particular `:41` claims ACL enforcement was "Closed 2026-04-24" via
+> `AuthorizationBootstrap` / `NodeScopeResolver` / `OpcUaServerService` — **all three have zero
+> occurrences in `src/`, and there is no per-node ACL gate on any operation** (see `deferment.md`
+> §3.1 and the banner in `docs/ReadWriteOperations.md`). `RedundancyCoordinator`,
+> `RedundancyStatePublisher`, `PeerReachabilityTracker`, `GenerationRefreshHostedService`,
+> `ClusterTopologyLoader` and `SealedBootstrap` are likewise gone. The **unchecked GA exit criteria**
+> near the end of the file are still live — see `deferment.md` §5.
+
 > **Last updated**: 2026-04-24 (Phase 5 driver complement closed — AB CIP, AB Legacy, TwinCAT, FOCAS all shipped; FOCAS Tier-C retired for a pure-managed in-process client)
 > **Status**: **RELEASE-READY (code-path)** for v2 GA. All three original code-path release blockers remain closed. Phase 5 is now complete. Remaining work is manual (live-hardware validations, client interop matrix, deployment checklist signoff, OPC UA CTT pass) + hardening follow-ups; see exit-criteria checklist below.

@@ -28,11 +37,27 @@ This doc is the single view of where v2 stands against its release criteria. Upd

 All code-path release blockers are closed. The remaining items are live-hardware / manual validations listed under exit criteria.

-### ~~Security — Phase 6.2 dispatch wiring~~ (task #143 — **CLOSED** 2026-04-19, PR #94)
+### ~~Security — Phase 6.2 dispatch wiring~~ (task #143 — marked CLOSED 2026-04-19, PR #94)
+
+> ⚠️ **THIS CLOSURE DOES NOT HOLD (re-verified against source 2026-07-27).** Every type named in this
+> subsection — `AuthorizationGate`, `NodeScopeResolver`, `AuthorizationBootstrap`, `WriteAuthzPolicy`,
+> `DriverNodeManager`, `FilterBrowseReferences`, `GateCallMethodRequests`, `MapCallOperation`,
+> `EquipmentNamespaceContent`, and the `Node:Authorization:*` config keys — has **zero occurrences in
+> `src/`**. There is no `OnReadValue` hook, no `Browse` override, no `CreateMonitoredItems` override and
+> no `Call` override in the live node manager, and no HistoryRead path consults any gate.
+>
+> Whatever landed on the v2 branch did not survive into the shipped tree. The **only** data-plane
+> authorization today is two server-wide role checks (`WriteOperate` for writes, `AlarmAck` for alarm
+> methods); reads, browses, subscriptions and history reads are ungated, and `NodeAcl` rows are
+> authored and deployed but never evaluated. See [`../security.md`](../security.md) §
+> Data-Plane Authorization and `deferment.md` §3.1.
+>
+> The text below is retained as the historical record of what was *believed* closed. **Read none of it
+> as current behaviour.**

 **Closed**. `AuthorizationGate` + `NodeScopeResolver` thread through `OpcUaApplicationHost → OtOpcUaServer → DriverNodeManager`. `OnReadValue` + `OnWriteValue` + all four HistoryRead paths call `gate.IsAllowed(identity, operation, scope)` before the invoker. Production deployments activate enforcement by constructing `OpcUaApplicationHost` with an `AuthorizationGate(StrictMode: true)` + populating the `NodeAcl` table.

-Remaining Stream C surfaces (hardening, not release-blocking):
+Remaining Stream C surfaces (hardening, not release-blocking) — **none of these shipped either**:

 - ~~Browse + TranslateBrowsePathsToNodeIds gating with ancestor-visibility logic per `acl-design.md` §Browse.~~ **Partial, 2026-04-24.** `DriverNodeManager.Browse` override post-filters the `ReferenceDescription` list via a new `FilterBrowseReferences` helper — denied nodes disappear silently per OPC UA convention. Ancestor-visibility implication (Read-grant at `Line/Tag` implying Browse on `Line`) still to ship; needs a subtree-has-any-grant query on the trie evaluator. `TranslateBrowsePathsToNodeIds` surface not yet wired.
 - ~~CreateMonitoredItems + TransferSubscriptions gating with per-item `(AuthGenerationId, MembershipVersion)` stamp so revoked grants surface `BadUserAccessDenied` within one publish cycle (decision #153).~~ **Partial, 2026-04-24.** `DriverNodeManager.CreateMonitoredItems` override pre-gates each request and pre-populates `BadUserAccessDenied` into the errors slot for denied items (the base stack honours pre-set errors and skips those items). Decision #153's per-item `(AuthGenerationId, MembershipVersion)` stamp for detecting mid-subscription revocation is still to ship — needs subscription-layer plumbing. TransferSubscriptions not yet wired (same pattern).
@@ -37,7 +37,7 @@ ssh dohertj2@10.100.0.35 'docker ps --filter label=project=lmxopcua --format "{{
  | Stack dir | Purpose |
  |---|---|
  | `/opt/otopcua-mssql` | central SQL (always-on) |
-  | `/opt/otopcua-modbus` · `/opt/otopcua-abcip` · `/opt/otopcua-s7` · `/opt/otopcua-opcuaclient` | driver fixtures |
+  | `/opt/otopcua-modbus` · `/opt/otopcua-abcip` · `/opt/otopcua-s7` · `/opt/otopcua-opcuaclient` · `/opt/otopcua-mqtt` · `/opt/otopcua-mtconnect` | driver fixtures |
  | `~/otopcua-ablegacy` · `~/otopcua-focas` | driver fixtures (user-owned) |
  | `~/otopcua-harness` | Host.IntegrationTests real-mode deps (SQL + GLAuth) — see §4 |

@@ -69,9 +69,28 @@ when it isn't running. Bring one up, `dotnet test`, tear down. Repo compose live
 | S7 | `otopcua-python-snap7` | `10.100.0.35:1102` | `docker compose --profile s7_1500 up -d` |
 | OpcUaClient | `mcr.microsoft.com/iotedge/opc-plc:2.14.10` | `opc.tcp://10.100.0.35:50000` | `docker compose up -d` |
 | FOCAS | `otopcua-focas-sim` (vendored focas-mock) | `10.100.0.35:8193` | `docker compose up -d` (stack `~/otopcua-focas`) |
+| MQTT | `eclipse-mosquitto:2.0.22` (+ a publisher sidecar) | `10.100.0.35:8883` TLS+auth · `:1883` plaintext+auth | `MQTT_FIXTURE_USERNAME=otopcua MQTT_FIXTURE_PASSWORD=<pw> docker compose up -d` (stack `/opt/otopcua-mqtt`) |
+| MQTT — Sparkplug B | `otopcua-sparkplug-sim` (project-owned C# edge-node simulator) | same broker; group **`OtOpcUaSim`**, edge nodes **`EdgeA`** / **`EdgeB`**, `EdgeA` device **`Filler1`**, ~2 s cadence | `docker compose --profile sparkplug up -d` (same stack). Answers rebirth NCMDs; restart it to force a fresh birth |
+| MTConnect | `mtconnect/agent:2.7.0.12` + `python:3.13-alpine` adapter | `http://10.100.0.35:5000` | `docker compose up -d --wait` |

 **Endpoint overrides** point a suite at a real PLC instead of the sim:
-`MODBUS_SIM_ENDPOINT` · `AB_SERVER_ENDPOINT` · `S7_SIM_ENDPOINT` · `OPCUA_SIM_ENDPOINT`.
+`MODBUS_SIM_ENDPOINT` · `AB_SERVER_ENDPOINT` · `S7_SIM_ENDPOINT` · `OPCUA_SIM_ENDPOINT` ·
+`MQTT_FIXTURE_ENDPOINT` / `MQTT_FIXTURE_PLAIN_ENDPOINT` · `MTCONNECT_AGENT_ENDPOINT`.
+
+> **MQTT needs credentials + material, unlike the other fixtures.** The broker has **no anonymous
+> fallback on either listener** (deliberate — an anonymous broker would let a bad auth config pass),
+> so it will not even start until `./gen-fixture-material.sh` has written `secrets/` (password file +
+> CA + server cert/key, gitignored) and `MQTT_FIXTURE_USERNAME`/`MQTT_FIXTURE_PASSWORD` are exported
+> at `docker compose up`. The live suite additionally wants `MQTT_FIXTURE_CA_CERT` pointing at a local
+> copy of the CA: `scp dohertj2@10.100.0.35:/opt/otopcua-mqtt/secrets/ca.crt /tmp/mqtt-fixture-ca.crt`.
+> It is also the only fixture whose services carry the `project: lmxopcua` label (see CLAUDE.md).
+
+> **MTConnect is a TWO-service stack.** The `mtconnect/agent` image ships no simulator, so a lone
+> Agent answers `/probe` and reports every observation `UNAVAILABLE` forever. The `adapter` service
+> (a stdlib SHDR feeder, `Docker/adapter.py`) is the data source; the Agent dials out to it. Its
+> suite also probes over **HTTP**, not TCP — an Agent's port accepts connections before its device
+> model is parsed. Full detail + the seeded device model:
+> [`tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.MTConnect.IntegrationTests/Docker/README.md`](../tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.MTConnect.IntegrationTests/Docker/README.md).

 > **Fixture-cycling gotcha:** profile-gated services can share a port; a plain `docker compose down`
 > may leave a stale container bound. Force-remove before switching profiles:
@@ -79,4 +79,46 @@ public sealed class AkkaClusterOptions
    ///     </para>
    /// </remarks>
    public string SplitBrainResolverStrategy { get; set; } = "auto-down";
+
+    /// <summary>
+    /// The simultaneous-cold-start split-brain guard (<c>Cluster:BootstrapGuard</c>). Default OFF — a
+    /// dark switch, so existing deployments and tests keep Akka's config-driven self-first auto-join
+    /// unchanged. See <see cref="ClusterBootstrapGuard"/> for the decision logic and
+    /// <c>ClusterBootstrapCoordinator</c> for the runtime.
+    /// </summary>
+    public ClusterBootstrapGuardOptions BootstrapGuard { get; set; } = new();
+}
+
+/// <summary>
+/// Configuration for the simultaneous-cold-start split-brain guard. When
+/// <see cref="Enabled"/>, the node does NOT auto-join from its config seeds; a coordinator picks the
+/// join order (founder self-first / joiner peer-first) after a reachability probe. See
+/// <see cref="ClusterBootstrapGuard"/>.
+/// </summary>
+public sealed class ClusterBootstrapGuardOptions
+{
+    /// <summary>
+    /// Gets or sets whether the guard is active. Default <see langword="false"/> — Akka auto-joins from
+    /// the config seed list exactly as before. Only meaningful on a node that is one of its own two
+    /// pair seeds; inert everywhere else.
+    /// </summary>
+    public bool Enabled { get; set; }
+
+    /// <summary>
+    /// Gets or sets how long the higher-address node probes its partner's Akka endpoint before
+    /// concluding the partner is dead and forming alone. Must comfortably exceed the partner's
+    /// worst-case process-start-to-Akka-bind time so a slow-but-alive partner is never mistaken for a
+    /// dead one (which would re-open the split). Default 25 s.
+    /// </summary>
+    public int PartnerProbeSeconds { get; set; } = 25;
+
+    /// <summary>
+    /// Gets or sets the interval between partner reachability probes, in milliseconds. Default 500 ms.
+    /// </summary>
+    public int PartnerProbeIntervalMs { get; set; } = 500;
+
+    /// <summary>
+    /// Gets or sets the per-probe TCP connect timeout, in milliseconds. Default 1000 ms.
+    /// </summary>
+    public int ProbeConnectTimeoutMs { get; set; } = 1000;
 }
@@ -41,6 +41,8 @@ public sealed class AkkaClusterOptionsValidator : OptionsValidatorBase<AkkaClust
    {
        ArgumentNullException.ThrowIfNull(options);

+        ValidateBootstrapGuard(builder, options.BootstrapGuard);
+
        var seeds = options.SeedNodes ?? Array.Empty<string>();
        if (seeds.Length == 0)
        {
@@ -68,6 +70,25 @@ public sealed class AkkaClusterOptionsValidator : OptionsValidatorBase<AkkaClust
            + "the entries — see docs/Redundancy.md → 'Bootstrap: self-first seed ordering'.");
    }

+    /// <summary>
+    /// When the bootstrap guard is enabled, its timing knobs must be positive. A zero/negative
+    /// <c>PartnerProbeSeconds</c> in particular silently degrades the guard to "never wait, always
+    /// conclude the partner is dead" — it would form alone immediately and re-open the very split it
+    /// exists to close. Fail-fast at boot rather than producing silence (the same rationale every
+    /// sibling options validator in this project cites).
+    /// </summary>
+    private static void ValidateBootstrapGuard(ValidationBuilder builder, ClusterBootstrapGuardOptions guard)
+    {
+        if (guard is null || !guard.Enabled) return;
+
+        if (guard.PartnerProbeSeconds <= 0)
+            builder.Add($"Cluster:BootstrapGuard:PartnerProbeSeconds must be > 0 when the guard is enabled (was {guard.PartnerProbeSeconds}).");
+        if (guard.PartnerProbeIntervalMs <= 0)
+            builder.Add($"Cluster:BootstrapGuard:PartnerProbeIntervalMs must be > 0 when the guard is enabled (was {guard.PartnerProbeIntervalMs}).");
+        if (guard.ProbeConnectTimeoutMs <= 0)
+            builder.Add($"Cluster:BootstrapGuard:ProbeConnectTimeoutMs must be > 0 when the guard is enabled (was {guard.ProbeConnectTimeoutMs}).");
+    }
+
    /// <summary>
    /// True when <paramref name="seed"/> addresses this node itself — host AND port.
    /// </summary>
@@ -0,0 +1,201 @@
+using System.Diagnostics;
+using System.Net.Sockets;
+using Akka.Actor;
+using Akka.Cluster;
+using Microsoft.Extensions.Hosting;
+using Microsoft.Extensions.Logging;
+using Microsoft.Extensions.Options;
+
+namespace ZB.MOM.WW.OtOpcUa.Cluster;
+
+/// <summary>
+/// Runs the simultaneous-cold-start split-brain guard: when <c>Cluster:BootstrapGuard:Enabled</c>, the
+/// node starts with NO config seed nodes (see <c>BuildClusterOptions</c>), and this coordinator picks
+/// the join order and issues the single <see cref="Akka.Cluster.Cluster.JoinSeedNodes"/> once the
+/// ActorSystem is up. See <see cref="ClusterBootstrapGuard"/> for the decision logic and the
+/// split-brain rationale.
+/// </summary>
+/// <remarks>
+///     <para>
+///         The founder (lower canonical address) joins its self-first order immediately. The higher
+///         node probes its partner's Akka endpoint (a plain TCP connect — the partner has bound its
+///         port well before it forms) up to <see cref="ClusterBootstrapGuardOptions.PartnerProbeSeconds"/>:
+///         reachable ⇒ peer-first (join the founder); unreachable ⇒ self-first (partner is dead, form
+///         alone). The join runs on a background task so it never blocks host startup, and it is issued
+///         exactly once — the coordinator never re-forms a node mid-handshake, the failure mode of the
+///         retired <c>SelfFormAfter</c> watchdog.
+///     </para>
+/// </remarks>
+public sealed class ClusterBootstrapCoordinator : IHostedService
+{
+    private readonly Func<ActorSystem> _system;
+    private readonly AkkaClusterOptions _options;
+    private readonly ILogger<ClusterBootstrapCoordinator> _log;
+    private readonly CancellationTokenSource _cts = new();
+    private Task? _joinTask;
+
+    /// <summary>Creates the coordinator.</summary>
+    /// <param name="system">Lazy accessor for the node's ActorSystem (resolved after Akka's hosted service starts it).</param>
+    /// <param name="options">The bound cluster options (seed list + guard settings).</param>
+    /// <param name="log">Logger for the bootstrap decision.</param>
+    public ClusterBootstrapCoordinator(
+        Func<ActorSystem> system, IOptions<AkkaClusterOptions> options, ILogger<ClusterBootstrapCoordinator> log)
+    {
+        _system = system ?? throw new ArgumentNullException(nameof(system));
+        _options = options?.Value ?? throw new ArgumentNullException(nameof(options));
+        _log = log ?? throw new ArgumentNullException(nameof(log));
+    }
+
+    /// <inheritdoc/>
+    public Task StartAsync(CancellationToken cancellationToken)
+    {
+        if (!_options.BootstrapGuard.Enabled)
+            return Task.CompletedTask; // dark switch off — Akka auto-joined from config seeds already.
+
+        // Fire-and-forget so a higher node with a dead partner (which waits the full probe window)
+        // never blocks host startup. Exceptions are logged; a failed join leaves the node unjoined,
+        // which is visible and recoverable, never a silent split.
+        _joinTask = Task.Run(() => RunAsync(_cts.Token), _cts.Token);
+        return Task.CompletedTask;
+    }
+
+    /// <inheritdoc/>
+    public async Task StopAsync(CancellationToken cancellationToken)
+    {
+        await _cts.CancelAsync().ConfigureAwait(false);
+        if (_joinTask is not null)
+        {
+            try { await _joinTask.ConfigureAwait(false); }
+            catch (OperationCanceledException) { /* expected on shutdown */ }
+        }
+    }
+
+    private async Task RunAsync(CancellationToken ct)
+    {
+        try
+        {
+            var seeds = _options.SeedNodes ?? Array.Empty<string>();
+            var role = ClusterBootstrapGuard.Analyze(seeds, _options.PublicHostname, _options.Port);
+
+            string[] order;
+            var committedPeerFirst = false;
+            if (!role.Applies)
+            {
+                // Not a pair seed (single-seed legacy site node, self absent, malformed, or 3+ seeds):
+                // join the configured seeds unchanged — the guard arbitrates only the 2-node pair race.
+                order = seeds;
+                _log.LogInformation(
+                    "Bootstrap guard: not a pair seed ({SeedCount} seed(s)); joining configured seeds unchanged.",
+                    seeds.Length);
+            }
+            else if (role.IsFounder)
+            {
+                order = role.SelfFirstOrder;
+                _log.LogInformation(
+                    "Bootstrap guard: this node is the preferred founder (lower address); joining self-first, forming immediately if no peer answers.");
+            }
+            else
+            {
+                var reachable = await ProbePartnerAsync(role.PartnerHost!, role.PartnerPort, ct).ConfigureAwait(false);
+                order = ClusterBootstrapGuard.HigherNodeOrder(role, reachable);
+                committedPeerFirst = reachable;
+                _log.LogInformation(
+                    "Bootstrap guard: this node is the higher address; partner {PartnerHost}:{PartnerPort} was {Reachability} within the probe window; joining {Order}.",
+                    role.PartnerHost, role.PartnerPort, reachable ? "REACHABLE" : "UNREACHABLE",
+                    reachable ? "peer-first (join the founder)" : "self-first (partner down, forming alone)");
+            }
+
+            if (order.Length == 0)
+            {
+                _log.LogWarning("Bootstrap guard: no seed nodes to join; node stays unjoined until a seed is configured.");
+                return;
+            }
+
+            var cluster = Akka.Cluster.Cluster.Get(_system());
+            var addresses = order.Select(Address.Parse).ToArray();
+            cluster.JoinSeedNodes(addresses);
+
+            // Peer-first is a one-way commitment: JoinSeedNodeProcess never self-forms. If the founder
+            // died in the probe→join window, this node hangs unjoined forever. We do NOT re-form here
+            // (the retired SelfFormAfter mid-handshake failure mode) — we make the hang operator-visible
+            // so a restart, which re-runs the guard against the now-dead founder and self-forms, recovers
+            // it. Nothing is done on the founder / self-first paths, which always self-form on their own.
+            if (committedPeerFirst)
+                await WarnIfNotUpAsync(cluster, ct).ConfigureAwait(false);
+        }
+        catch (OperationCanceledException)
+        {
+            // Host shutting down before the join completed — nothing to do.
+        }
+        catch (Exception ex)
+        {
+            _log.LogError(ex, "Bootstrap guard: failed to issue JoinSeedNodes; node remains unjoined.");
+        }
+    }
+
+    /// <summary>
+    /// After committing peer-first, waits a bounded time for this node to reach <c>Up</c> and logs a
+    /// clear warning if it does not — the founder must have died in the probe→join window, leaving this
+    /// node hung in <c>JoinSeedNodeProcess</c>. Read-only: it never re-forms or re-joins (that is the
+    /// retired mid-handshake failure mode); it only surfaces the condition so an operator restarts the node.
+    /// </summary>
+    private async Task WarnIfNotUpAsync(Akka.Cluster.Cluster cluster, CancellationToken ct)
+    {
+        // Give the join a generous grace: the founder's own self-form (seed-node-timeout) plus this
+        // node's join round-trip. Two probe windows is comfortably beyond both.
+        var grace = TimeSpan.FromSeconds(Math.Max(10, _options.BootstrapGuard.PartnerProbeSeconds * 2));
+        var sw = Stopwatch.StartNew();
+        while (!ct.IsCancellationRequested && sw.Elapsed < grace)
+        {
+            if (cluster.SelfMember.Status == MemberStatus.Up) return; // joined — all good
+            try { await Task.Delay(TimeSpan.FromSeconds(1), ct).ConfigureAwait(false); }
+            catch (OperationCanceledException) { return; }
+        }
+
+        if (!ct.IsCancellationRequested && cluster.SelfMember.Status != MemberStatus.Up)
+            _log.LogWarning(
+                "Bootstrap guard: committed peer-first but this node is still {Status} after {Grace}s — its founder likely died in the probe→join window. This node will NOT self-form on its own (peer-first never does). RESTART it to recover: the guard will re-run, find the founder down, and form alone.",
+                cluster.SelfMember.Status, (int)grace.TotalSeconds);
+    }
+
+    /// <summary>
+    /// Polls the partner's Akka endpoint with a plain TCP connect until it is reachable or the probe
+    /// window elapses. Reachable-at-TCP is a sound proxy for "the partner is coming up": a node binds
+    /// its Akka port near the start of startup, well before it forms or joins a cluster.
+    /// </summary>
+    private async Task<bool> ProbePartnerAsync(string host, int port, CancellationToken ct)
+    {
+        var window = TimeSpan.FromSeconds(Math.Max(0, _options.BootstrapGuard.PartnerProbeSeconds));
+        var interval = TimeSpan.FromMilliseconds(Math.Max(50, _options.BootstrapGuard.PartnerProbeIntervalMs));
+        var sw = Stopwatch.StartNew();
+
+        while (!ct.IsCancellationRequested)
+        {
+            if (await TryConnectAsync(host, port, ct).ConfigureAwait(false)) return true;
+            if (sw.Elapsed >= window) return false;
+            try { await Task.Delay(interval, ct).ConfigureAwait(false); }
+            catch (OperationCanceledException) { return false; }
+        }
+        return false;
+    }
+
+    private async Task<bool> TryConnectAsync(string host, int port, CancellationToken ct)
+    {
+        try
+        {
+            using var client = new TcpClient();
+            using var cts = CancellationTokenSource.CreateLinkedTokenSource(ct);
+            cts.CancelAfter(Math.Max(100, _options.BootstrapGuard.ProbeConnectTimeoutMs));
+            await client.ConnectAsync(host, port, cts.Token).ConfigureAwait(false);
+            return client.Connected;
+        }
+        catch (OperationCanceledException) when (ct.IsCancellationRequested)
+        {
+            throw; // host shutdown — propagate
+        }
+        catch
+        {
+            return false; // connect refused / timed out / DNS not resolvable yet — partner not up
+        }
+    }
+}
@@ -0,0 +1,153 @@
+using System.Text.RegularExpressions;
+
+namespace ZB.MOM.WW.OtOpcUa.Cluster;
+
+/// <summary>
+/// Pure decision logic for the simultaneous-cold-start split-brain guard.
+/// </summary>
+/// <remarks>
+///     <para>
+///         Both nodes of a 2-node pair are self-first seeds so <b>either</b> can cold-start alone when
+///         its partner is dead (see <see cref="AkkaClusterOptions.SeedNodes"/>). The cost is that when
+///         BOTH cold-start at the same instant, each runs Akka's <c>FirstSeedNodeProcess</c>, times out
+///         waiting for the other, and forms its OWN single-node cluster — a split brain (two Primaries
+///         in one pair). Two independent clusters do not auto-merge, so the split persists until an
+///         operator intervenes.
+///     </para>
+///     <para>
+///         This guard breaks the symmetry deterministically without giving up cold-start-alone. The
+///         node with the lexicographically <b>lower</b> canonical address is the <i>preferred
+///         founder</i>: it always uses self-first order and forms immediately. The <b>higher</b> node
+///         first probes whether its partner's Akka endpoint is reachable (see
+///         <see cref="ClusterBootstrapCoordinator"/>): reachable ⇒ peer-first order so it JOINS the
+///         founder rather than racing it; unreachable after the probe window ⇒ the partner is genuinely
+///         down, so it falls back to self-first and forms alone. Exactly one node founds when both are
+///         present; the lower node always founds when it starts alone.
+///     </para>
+///     <para>
+///         <b>Residual trade-off (accepted).</b> Once the higher node observes the partner reachable it
+///         commits to peer-first — Akka's <c>JoinSeedNodeProcess</c> retries <c>InitJoin</c> forever and
+///         never self-forms. If the founder dies in the small window between the probe succeeding and
+///         the join completing, the higher node hangs unjoined until it is restarted (a restart re-runs
+///         the guard, finds the founder unreachable, and self-forms). We deliberately do NOT re-decide
+///         mid-handshake — that is exactly the retired <c>SelfFormAfter</c> failure mode. Instead
+///         <see cref="ClusterBootstrapCoordinator"/> makes the hang operator-visible with a warning if
+///         the node has not come Up within a bounded time after committing peer-first.
+///     </para>
+///     <para>
+///         This decides the join order BEFORE issuing a single <c>JoinSeedNodes</c>, from an explicit
+///         reachability signal — unlike the retired <c>SelfFormAfter</c> watchdog, which fired a
+///         <c>Join(self)</c> mid-handshake on a bare timeout and could not tell "no seed answered" from
+///         "a join is in flight", islanding a node a failover had just bounced.
+///     </para>
+/// </remarks>
+public static class ClusterBootstrapGuard
+{
+    private static readonly Regex SeedPattern =
+        new(@"^akka(?:\.[a-z0-9]+)?://[^@/]+@(?<host>[^:/]+):(?<port>\d+)", RegexOptions.IgnoreCase | RegexOptions.Compiled);
+
+    /// <summary>The analyzed bootstrap role of this node within its seed list.</summary>
+    /// <param name="Applies">True only when the guard engages: exactly two seeds, one of them this node.</param>
+    /// <param name="IsFounder">True when this node is the preferred founder (lower address) — form immediately, no probe.</param>
+    /// <param name="PartnerHost">The partner's advertised host (to probe when this node is the higher one); null when not applicable.</param>
+    /// <param name="PartnerPort">The partner's Akka port.</param>
+    /// <param name="SelfFirstOrder"><c>[self, partner]</c> — self-first; forms a new cluster when no peer answers.</param>
+    /// <param name="PeerFirstOrder"><c>[partner, self]</c> — peer-first; joins the partner's cluster, never self-forms while it is up.</param>
+    public sealed record BootstrapRole(
+        bool Applies,
+        bool IsFounder,
+        string? PartnerHost,
+        int PartnerPort,
+        string[] SelfFirstOrder,
+        string[] PeerFirstOrder);
+
+    /// <summary>
+    /// Analyzes the configured seed list to decide this node's bootstrap role. The guard engages only
+    /// for the Phase-6 pair shape (exactly two seeds, one of them this node); any other shape
+    /// (single-seed legacy site node, three+ seeds, self absent) returns <see cref="BootstrapRole.Applies"/>
+    /// = false and the caller joins the configured seeds unchanged.
+    /// </summary>
+    /// <param name="seeds">The configured seed URIs (self-first by convention, but order is not relied on here).</param>
+    /// <param name="selfHost">This node's advertised host (<see cref="AkkaClusterOptions.PublicHostname"/>).</param>
+    /// <param name="selfPort">This node's Akka port (<see cref="AkkaClusterOptions.Port"/>).</param>
+    /// <returns>The analyzed role; never null.</returns>
+    public static BootstrapRole Analyze(IReadOnlyList<string> seeds, string selfHost, int selfPort)
+    {
+        ArgumentNullException.ThrowIfNull(seeds);
+        ArgumentException.ThrowIfNullOrWhiteSpace(selfHost);
+
+        var na = new BootstrapRole(false, false, null, 0, Array.Empty<string>(), Array.Empty<string>());
+        if (seeds.Count != 2) return na;
+
+        var selfKey = Key(selfHost, selfPort);
+        string? self = null, partner = null;
+        string? partnerHost = null;
+        var partnerPort = 0;
+
+        foreach (var seed in seeds)
+        {
+            if (!TryParse(seed, out var host, out var port)) return na;
+            if (string.Equals(Key(host, port), selfKey, StringComparison.OrdinalIgnoreCase))
+                self = seed;
+            else
+            {
+                partner = seed;
+                partnerHost = host;
+                partnerPort = port;
+            }
+        }
+
+        // Self must be exactly one of the two, and the other must be a distinct partner.
+        if (self is null || partner is null || partnerHost is null) return na;
+
+        var selfFirst = new[] { self, partner };
+        var peerFirst = new[] { partner, self };
+
+        // Deterministic tie-break: the lower canonical address is the preferred founder. Both nodes
+        // compute the same comparison (same two seeds), so exactly one is the founder. Case-INSENSITIVE
+        // to match how self/partner are classified above (and AkkaClusterOptionsValidator.IsSelf):
+        // container/DNS hostnames are conventionally case-insensitive, and a casing difference between
+        // the two sides' seed config must NOT make both think they are the founder (which would reopen
+        // the very split this guard closes).
+        var isFounder = string.Compare(
+            Key(selfHost, selfPort),
+            Key(partnerHost, partnerPort),
+            StringComparison.OrdinalIgnoreCase) < 0;
+
+        return new BootstrapRole(true, isFounder, partnerHost, partnerPort, selfFirst, peerFirst);
+    }
+
+    /// <summary>
+    /// The order the higher (non-founder) node uses once it has learned whether its partner is
+    /// reachable: peer-first when the founder is up (join it), self-first when the founder is absent
+    /// (form alone — cold-start-alone preserved).
+    /// </summary>
+    /// <param name="role">The analyzed role (must be applicable and NOT the founder).</param>
+    /// <param name="partnerReachable">Whether the partner's Akka endpoint became reachable within the probe window.</param>
+    /// <returns>The seed order to pass to <c>Cluster.JoinSeedNodes</c>.</returns>
+    public static string[] HigherNodeOrder(BootstrapRole role, bool partnerReachable)
+    {
+        ArgumentNullException.ThrowIfNull(role);
+        return partnerReachable ? role.PeerFirstOrder : role.SelfFirstOrder;
+    }
+
+    /// <summary>Parses <c>akka.tcp://system@host:port[/...]</c> into host + port.</summary>
+    /// <param name="seed">The seed URI.</param>
+    /// <param name="host">The parsed advertised host.</param>
+    /// <param name="port">The parsed Akka port.</param>
+    /// <returns>True when the seed matched the expected shape.</returns>
+    public static bool TryParse(string? seed, out string host, out int port)
+    {
+        host = string.Empty;
+        port = 0;
+        if (string.IsNullOrWhiteSpace(seed)) return false;
+
+        var m = SeedPattern.Match(seed.Trim());
+        if (!m.Success) return false;
+        if (!int.TryParse(m.Groups["port"].Value, out port)) return false;
+        host = m.Groups["host"].Value;
+        return true;
+    }
+
+    private static string Key(string host, int port) => $"{host}:{port}";
+}
@@ -20,6 +20,8 @@ public sealed class ClusterRoleInfo : IClusterRoleInfo, IDisposable
    private readonly ILogger<ClusterRoleInfo> _logger;
    private readonly CommonsNodeId _localNode;
    private readonly HashSet<string> _localRoles;
+    private readonly string? _clusterRole;
+    private readonly string? _clusterId;
    private readonly object _lock = new();
    private readonly Dictionary<string, Member?> _roleLeaders = new(StringComparer.Ordinal);
    private readonly Dictionary<string, HashSet<Member>> _membersByRole = new(StringComparer.Ordinal);
@@ -39,6 +41,23 @@ public sealed class ClusterRoleInfo : IClusterRoleInfo, IDisposable
        _localNode = CommonsNodeId.Parse($"{options.Value.PublicHostname}:{options.Value.Port}");
        _localRoles = new HashSet<string>(options.Value.Roles, StringComparer.Ordinal);

+        // Derived from the node's OWN configured roles (not live Cluster.State) so this identity is
+        // available at host-build time, before the cluster forms. Iterate the ORIGINAL array — not
+        // _localRoles — because first-wins requires configuration order, which HashSet does not
+        // guarantee.
+        var clusterRoles = options.Value.Roles.Where(RoleParser.IsClusterRole).ToArray();
+        if (clusterRoles.Length > 0)
+        {
+            _clusterRole = clusterRoles[0];
+            _clusterId = RoleParser.ClusterIdFromRole(_clusterRole);
+            if (clusterRoles.Length > 1)
+            {
+                _logger.LogWarning(
+                    "Node configured with {Count} cluster-scoped roles ({Roles}); using the first ({ClusterRole})",
+                    clusterRoles.Length, string.Join(", ", clusterRoles), _clusterRole);
+            }
+        }
+
        SeedFromCurrentState();
        _subscriber = system.ActorOf(Props.Create(() => new SubscriberActor(this)), "clusterroleinfo-subscriber");
    }
@@ -49,6 +68,12 @@ public sealed class ClusterRoleInfo : IClusterRoleInfo, IDisposable
    /// <inheritdoc />
    public IReadOnlySet<string> LocalRoles => _localRoles;

+    /// <inheritdoc />
+    public string? ClusterRole => _clusterRole;
+
+    /// <inheritdoc />
+    public string? ClusterId => _clusterId;
+
    /// <inheritdoc />
    public bool HasRole(string role) => _localRoles.Contains(role);

@@ -186,7 +211,9 @@ public sealed class ClusterRoleInfo : IClusterRoleInfo, IDisposable
            Receive<ClusterEvent.IMemberEvent>(e => owner.HandleMemberEvent(e));
            Receive<ClusterEvent.RoleLeaderChanged>(e => owner.HandleRoleLeaderChanged(e));
            // LeaderChanged is intentionally a no-op here: ServiceLevel lives in RedundancyStateActor
-            // (admin-role singleton) and has no consumer on this ClusterRoleInfo path by design.
+            // (per-cluster mesh Phase 6: a cluster-{ClusterId}-scoped singleton spawned on every
+            // driver node, no longer the admin-role singleton it once was) and has no consumer on this
+            // ClusterRoleInfo path by design.
            Receive<ClusterEvent.LeaderChanged>(_ => { });
            Receive<ClusterEvent.CurrentClusterState>(_ => { /* seeded from initial snapshot */ });
        }
@@ -2,11 +2,36 @@ namespace ZB.MOM.WW.OtOpcUa.Cluster;

 public static class RoleParser
 {
+    /// <summary>The admin-role name.</summary>
+    public const string Admin = "admin";
+
+    /// <summary>The driver-role name. Single source of truth — downstream <c>DriverRole</c>
+    /// constants (<c>RedundancyStateActor</c>, <c>ClusterNodeAddressReconcilerActor</c>,
+    /// <c>ServiceCollectionExtensions</c>) alias this value rather than duplicating the literal.</summary>
+    public const string Driver = "driver";
+
+    /// <summary>The dev-role name.</summary>
+    public const string Dev = "dev";
+
+    /// <summary>Prefix identifying a cluster-scoped role, e.g. <c>cluster-SITE-A</c> (per-cluster mesh, Phase 6).</summary>
+    public const string ClusterRolePrefix = "cluster-";
+
    private static readonly HashSet<string> Allowed = new(StringComparer.Ordinal)
    {
-        "admin", "driver", "dev",
+        Admin, Driver, Dev,
    };

+    /// <summary>Returns true when <paramref name="role"/> is a cluster-scoped role — starts with
+    /// <see cref="ClusterRolePrefix"/> and carries a non-empty ClusterId suffix.</summary>
+    /// <param name="role">The role name to test.</param>
+    public static bool IsClusterRole(string role) =>
+        role.StartsWith(ClusterRolePrefix, StringComparison.Ordinal) && role.Length > ClusterRolePrefix.Length;
+
+    /// <summary>Extracts the ClusterId from a cluster-scoped role, e.g. <c>cluster-SITE-A</c> → <c>SITE-A</c>.
+    /// Assumes <see cref="IsClusterRole"/> is true for <paramref name="role"/>.</summary>
+    /// <param name="role">The cluster-scoped role name.</param>
+    public static string ClusterIdFromRole(string role) => role[ClusterRolePrefix.Length..];
+
    /// <summary>Parses a comma-separated string of role names into a validated array.</summary>
    /// <param name="raw">The raw role string to parse.</param>
    /// <returns>The distinct, lower-cased, validated role names.</returns>
@@ -22,9 +47,10 @@ public static class RoleParser

        foreach (var r in roles)
        {
-            if (!Allowed.Contains(r))
+            if (!Allowed.Contains(r) && !IsClusterRole(r))
                throw new ArgumentException(
-                    $"Unknown role '{r}'. Allowed: {string.Join(", ", Allowed)}.", nameof(raw));
+                    $"Unknown role '{r}'. Allowed: {string.Join(", ", Allowed)}, or '{ClusterRolePrefix}<ClusterId>'.",
+                    nameof(raw));
        }

        return roles;
@@ -56,6 +56,14 @@ public static class ServiceCollectionExtensions
        services.AddValidatedOptions<TelemetryDialOptions, TelemetryDialOptionsValidator>(
            configuration, TelemetryDialOptions.SectionName);

+        // Per-cluster mesh Phase 6: a node carrying a cluster-{ClusterId} role (the split topology)
+        // must use the mesh-crossing transports — the DPS dark-switch branches cannot cross a split
+        // mesh and would deliver nothing silently. Hung on MeshTransportOptions (which already has
+        // ValidateOnStart from its own registration above) so it fires at boot alongside the sibling
+        // validators; TryAddEnumerable inside AddValidatedOptions keeps the second validator additive.
+        services.AddValidatedOptions<MeshTransportOptions, SplitTopologyTransportValidator>(
+            configuration, MeshTransportOptions.SectionName);
+
        services.AddSingleton<IClusterRoleInfo, ClusterRoleInfo>();

        return services;
@@ -233,7 +241,13 @@ public static class ServiceCollectionExtensions

        return new ClusterOptions
        {
-            SeedNodes = options.SeedNodes,
+            // When the bootstrap guard is on, DO NOT hand Akka the seed list: Akka.Cluster.Hosting
+            // auto-joins from ClusterOptions.SeedNodes the instant the ActorSystem starts, which is
+            // exactly the self-first race the guard exists to arbitrate. Left empty, the node starts
+            // unjoined and ClusterBootstrapCoordinator picks the order (founder self-first / joiner
+            // peer-first, after a reachability probe) and issues the single Cluster.JoinSeedNodes.
+            // The config seed list is still read — by the coordinator, off AkkaClusterOptions.SeedNodes.
+            SeedNodes = options.BootstrapGuard.Enabled ? Array.Empty<string>() : options.SeedNodes,
            Roles = options.Roles,
            SplitBrainResolver = IsKeepOldest(options) ? new KeepOldestOption { DownIfAlone = true } : null,
        };
@@ -0,0 +1,137 @@
+using Microsoft.Extensions.Configuration;
+using Microsoft.Extensions.Options;
+
+namespace ZB.MOM.WW.OtOpcUa.Cluster;
+
+/// <summary>
+///     Fails the host at startup when a node configured for the <b>split topology</b> (per-cluster
+///     mesh, Phase 6) is left on a DistributedPubSub transport mode that cannot cross the mesh
+///     boundary.
+/// </summary>
+/// <remarks>
+///     <para>
+///         Phase 6 splits the single fleet mesh into one 2-node mesh per application cluster. The
+///         Phase 2/3/5 dark switches keep their DPS branches alive, but DPS is mesh-wide — it delivers
+///         nothing between a central node and a site node that no longer share a gossip ring. The
+///         marker of the split topology is a <c>cluster-{ClusterId}</c> role
+///         (<see cref="RoleParser.IsClusterRole"/>); those roles exist only post-Phase-6. A node that
+///         carries one <b>must</b> use the mesh-crossing transports, and this validator refuses to
+///         boot it otherwise — the alternative is a node that runs, listens, and silently delivers no
+///         commands or telemetry, which has no stack trace and no failing node to point at.
+///     </para>
+///     <para>
+///         <b>The rule is conditional and must stay that way.</b> It fires only when this node's
+///         <i>effective</i> Akka roles contain at least one cluster-scoped role — resolved the same
+///         way the node resolves them (<c>Cluster:Roles</c>, falling back to <c>OTOPCUA_ROLES</c> when
+///         that is empty, normalized case-insensitively). A legacy / single-mesh / test node has none,
+///         so DPS is still legitimate and the validator passes unconditionally.
+///     </para>
+///     <para>
+///         <b>Not validated here:</b> <c>ConfigSource:Mode</c>. Phase 4's
+///         <see cref="ConfigSourceOptionsValidator"/> already requires <c>FetchAndCache</c> on a
+///         driver-only node, and a fused node legitimately stays <c>Direct</c> — duplicating that here
+///         would only risk the two rules drifting apart.
+///     </para>
+/// </remarks>
+public sealed class SplitTopologyTransportValidator : IValidateOptions<MeshTransportOptions>
+{
+    private readonly IConfiguration _configuration;
+
+    /// <summary>
+    ///     DI-constructed by <c>AddValidatedOptions</c> (a plain <c>AddSingleton</c>), so a
+    ///     constructor dependency is safe here. <see cref="IConfiguration"/> — not
+    ///     <c>IClusterRoleInfo</c> — is the source of this node's roles and the three transport modes:
+    ///     <c>IClusterRoleInfo</c>'s implementation needs the <c>ActorSystem</c>, which does not exist
+    ///     yet at <c>ValidateOnStart</c> time. Reading the modes from configuration too (rather than
+    ///     from three injected <c>IOptions</c>) mirrors how the sibling validators cross-read
+    ///     <c>Cluster:Roles</c>, and avoids a service-resolution ordering dependency at validation
+    ///     time.
+    /// </summary>
+    public SplitTopologyTransportValidator(IConfiguration configuration)
+    {
+        _configuration = configuration;
+    }
+
+    /// <inheritdoc />
+    public ValidateOptionsResult Validate(string? name, MeshTransportOptions options)
+    {
+        // The options instance is intentionally unused: every value this rule depends on is cross-read
+        // from IConfiguration, the same way ConfigSourceOptionsValidator reads Cluster:Roles.
+        //
+        // Resolve the EFFECTIVE Akka roles exactly as the node does, or this "fail loud" rule fires on
+        // the wrong role view and passes silently on the two shapes it exists to catch:
+        //   (a) Roles-source divergence. AkkaClusterOptions.Roles binds Cluster:Roles but falls back to
+        //       OTOPCUA_ROLES (via RoleParser.Parse — the same call Program.cs makes) when Cluster:Roles
+        //       is empty. A node configured with only OTOPCUA_ROLES=driver,cluster-SITE-A genuinely
+        //       carries the cluster role in Akka, so it must be validated too.
+        //   (b) Case. The Cluster:Roles bind path is verbatim (no lowercasing), whereas RoleParser.Parse
+        //       lowercases the OTOPCUA_ROLES path. Normalize BOTH here (trim + ToLowerInvariant) so
+        //       'Cluster-SITE-A' / 'Driver' / 'Admin' cannot slip past the ordinal IsClusterRole /
+        //       driver / admin checks.
+        var configured = _configuration.GetSection("Cluster:Roles").Get<string[]>() ?? Array.Empty<string>();
+        var effective = configured.Length > 0
+            ? configured
+            : RoleParser.Parse(Environment.GetEnvironmentVariable("OTOPCUA_ROLES"));
+
+        var normalized = Array.ConvertAll(effective, r => r.Trim().ToLowerInvariant());
+
+        var clusterRoleIndex = Array.FindIndex(normalized, RoleParser.IsClusterRole);
+        if (clusterRoleIndex < 0)
+        {
+            // No cluster-{ClusterId} role → not the split topology → DPS is legitimate. This is the
+            // exemption that keeps the validator a no-op for every legacy / single-mesh / test node.
+            return ValidateOptionsResult.Success;
+        }
+
+        // Classification is normalized (above); the ClusterId in the message is taken from the
+        // operator's original spelling so it names what they actually wrote.
+        var clusterId = RoleParser.ClusterIdFromRole(effective[clusterRoleIndex].Trim());
+        var isDriver = Array.IndexOf(normalized, RoleParser.Driver) >= 0;
+        var isAdmin = Array.IndexOf(normalized, RoleParser.Admin) >= 0;
+
+        var errors = new List<string>();
+
+        // Modes are read from configuration directly; an unset key inherits the class default (Dps for
+        // all three), so a split node that simply never set the key fails exactly as an explicit Dps
+        // would — which is the point.
+        var meshMode = _configuration["MeshTransport:Mode"] ?? MeshTransportOptions.ModeDps;
+        var telemetryMode = _configuration["Telemetry:Mode"] ?? TelemetryOptions.ModeDps;
+        var telemetryDialMode = _configuration["TelemetryDial:Mode"] ?? TelemetryDialOptions.ModeDps;
+
+        if (!string.Equals(meshMode, MeshTransportOptions.ModeClusterClient, StringComparison.OrdinalIgnoreCase))
+        {
+            errors.Add(
+                $"Cluster:Roles declares a cluster-{clusterId} role (split topology) but "
+                + $"{MeshTransportOptions.SectionName}:{nameof(MeshTransportOptions.Mode)} is "
+                + $"'{meshMode}'; a split mesh cannot use DistributedPubSub — set "
+                + $"{MeshTransportOptions.SectionName}:{nameof(MeshTransportOptions.Mode)}="
+                + $"{MeshTransportOptions.ModeClusterClient}.");
+        }
+
+        if (isDriver
+            && !string.Equals(telemetryMode, TelemetryOptions.ModeGrpc, StringComparison.OrdinalIgnoreCase))
+        {
+            errors.Add(
+                $"Cluster:Roles declares a cluster-{clusterId} role (split topology) with 'driver' but "
+                + $"{TelemetryOptions.SectionName}:{nameof(TelemetryOptions.Mode)} is "
+                + $"'{telemetryMode}'; a split-topology driver node hosts the telemetry gRPC server — "
+                + $"set {TelemetryOptions.SectionName}:{nameof(TelemetryOptions.Mode)}="
+                + $"{TelemetryOptions.ModeGrpc}.");
+        }
+
+        if (isAdmin
+            && !string.Equals(telemetryDialMode, TelemetryDialOptions.ModeGrpc, StringComparison.OrdinalIgnoreCase))
+        {
+            errors.Add(
+                $"Cluster:Roles declares a cluster-{clusterId} role (split topology) with 'admin' but "
+                + $"{TelemetryDialOptions.SectionName}:{nameof(TelemetryDialOptions.Mode)} is "
+                + $"'{telemetryDialMode}'; a split-topology central node dials nodes for telemetry — set "
+                + $"{TelemetryDialOptions.SectionName}:{nameof(TelemetryDialOptions.Mode)}="
+                + $"{TelemetryDialOptions.ModeGrpc}.");
+        }
+
+        return errors.Count == 0
+            ? ValidateOptionsResult.Success
+            : ValidateOptionsResult.Fail(string.Join(" ", errors));
+    }
+}
@@ -29,9 +29,31 @@ public enum BrowseNodeKind
 /// <c>AlarmExtension</c> primitive). The picker pre-fills a default native-alarm <c>alarm</c> object
 /// into the TagConfig when an alarm attribute is selected. Defaults to false so non-alarm-aware
 /// drivers (e.g. the OPC UA client browser) aren't forced to flow a flag they don't produce.</param>
+/// <param name="AddressFields">
+///     The <b>structured</b> address this leaf binds by, as <c>TagConfig</c> key → value in the
+///     driver's own key vocabulary, for a driver whose address is a <i>tuple</i> rather than a single
+///     reference string. Null (the default) for every driver whose address IS the
+///     <see cref="BrowseNode.NodeId"/> — nothing changes for them.
+///     <para>
+///         It exists because a tuple cannot be recovered from an id string in general. MQTT/Sparkplug
+///         is the case in point: a browse node id is
+///         <c>{group}/{node}[/{device}]::{metric}</c>, and a metric name may itself contain <c>/</c>
+///         (<c>Node Control/Rebirth</c>) — so the session keeps the decomposition it already has and
+///         <b>states</b> it here, rather than the AdminUI's browse-commit mapper re-deriving it by
+///         splitting the id and hoping. Same discipline as the v3 address space carrying
+///         <c>AddressSpaceRealm</c> explicitly instead of parsing it out of a NodeId.
+///     </para>
+///     <para>
+///         The producer states the binding <em>shape</em> too, by which keys it emits — so a consumer
+///         never has to infer a driver's sub-mode from the tree's geometry. Consumers must read the
+///         keys they know and ignore the rest; this is a description, not a config blob to splat into
+///         a persisted TagConfig.
+///     </para>
+/// </param>
 public sealed record AttributeInfo(
    string Name,
    string DriverDataType,
    bool   IsArray,
    string SecurityClass,
-    bool   IsAlarm = false);
+    bool   IsAlarm = false,
+    IReadOnlyDictionary<string, string>? AddressFields = null);
@@ -35,3 +35,66 @@ public interface IBrowseSession : IAsyncDisposable
    /// <returns>The attributes of the node.</returns>
    Task<IReadOnlyList<AttributeInfo>> AttributesAsync(string nodeId, CancellationToken cancellationToken);
 }
+
+/// <summary>
+///     An <see cref="IBrowseSession"/> whose protocol offers an explicit, operator-triggered
+///     <b>re-announce</b> action: a request that the remote peer republish its self-description so the
+///     observation window can fill without waiting for the next natural announcement. Implemented
+///     today only by the MQTT/Sparkplug browser, whose tree is built from observed NBIRTH/DBIRTH
+///     certificates.
+/// </summary>
+/// <remarks>
+///     <para>
+///         <b>This is the only interface in the browse contract that causes an outbound message.</b>
+///         Every other browse member is strictly read-only, and for the MQTT browser that read-only
+///         property is load-bearing: a picker opened by an operator runs against a live production
+///         broker. It is a separate interface, rather than an optional member on
+///         <see cref="IBrowseSession"/>, precisely so "does this session write?" stays a type
+///         question a caller cannot forget to ask.
+///     </para>
+///     <para>
+///         <b>Callers must authorize before invoking it.</b> The AdminUI routes it through
+///         <c>BrowserSessionService.RequestRebirthAsync</c>, which enforces the same
+///         <c>DriverOperator</c> policy that gates the picker's Browse affordance — an implementation
+///         cannot check that itself, since it holds no user identity.
+///     </para>
+/// </remarks>
+public interface IRebirthCapableBrowseSession : IBrowseSession
+{
+    /// <summary>
+    ///     Whether this <i>particular</i> session can actually re-announce — the runtime half of the
+    ///     type question, and the one a UI must ask before offering the affordance.
+    /// </summary>
+    /// <remarks>
+    ///     One session class may serve several protocol shapes: the MQTT browser opens the same session
+    ///     type for Plain and for Sparkplug B, and a Plain MQTT window publishes <b>nothing, ever</b> —
+    ///     there is no plain-MQTT re-announce to offer. Implementing the interface therefore means "this
+    ///     session type may re-announce"; this property means "this instance will". A UI gating on the
+    ///     type alone would draw a button that can only ever throw.
+    ///     <para>
+    ///         This is <b>not</b> an authorization signal — see the interface remarks. False here hides
+    ///         the affordance; the caller still authorizes before invoking
+    ///         <see cref="RequestRebirthAsync"/>, and the implementation still refuses a call it cannot
+    ///         serve.
+    ///     </para>
+    /// </remarks>
+    bool RebirthAvailable { get; }
+
+    /// <summary>
+    ///     Asks the addressed remote peer(s) to re-announce themselves.
+    /// </summary>
+    /// <param name="scope">
+    ///     The protocol-specific target. For Sparkplug: a browse <c>NodeId</c> from this session's own
+    ///     tree (group, edge node, device or metric — resolved up to the owning edge node), or a bare
+    ///     <c>{group}/{edgeNode}</c> pair for a node that has not been observed yet.
+    /// </param>
+    /// <param name="cancellationToken">Cancellation token for the operation.</param>
+    /// <returns>The number of request messages published.</returns>
+    /// <exception cref="ArgumentException"><paramref name="scope"/> is empty or unusable.</exception>
+    /// <exception cref="InvalidOperationException">
+    ///     The scope resolves to no target, or to more targets than the implementation will fan out to
+    ///     in one action. Nothing is published in either case.
+    /// </exception>
+    /// <exception cref="NotSupportedException">This session's mode has no re-announce action.</exception>
+    Task<int> RequestRebirthAsync(string scope, CancellationToken cancellationToken);
+}
@@ -14,6 +14,21 @@ public interface IClusterRoleInfo
    NodeId LocalNode { get; }
    /// <summary>Gets the set of roles assigned to the local node.</summary>
    IReadOnlySet<string> LocalRoles { get; }
+
+    /// <summary>
+    /// Gets the local node's cluster-scoped role (e.g. <c>cluster-SITE-A</c>), or <c>null</c> when
+    /// the node carries none. Derived from the node's OWN configured roles at construction time —
+    /// NOT from live cluster membership — so it is available before the cluster forms (per-cluster
+    /// mesh, Phase 6). When more than one cluster-scoped role is configured, the first one wins.
+    /// </summary>
+    string? ClusterRole { get; }
+
+    /// <summary>
+    /// Gets the ClusterId extracted from <see cref="ClusterRole"/> (e.g. <c>SITE-A</c>), or
+    /// <c>null</c> when the node carries no cluster-scoped role.
+    /// </summary>
+    string? ClusterId { get; }
+
    /// <summary>Checks if the local node has the specified role.</summary>
    /// <param name="role">Role name to check.</param>
    /// <returns>True if the local node has the role; otherwise, false.</returns>
@@ -13,6 +13,19 @@ namespace ZB.MOM.WW.OtOpcUa.Commons.Messages.Drivers;
 /// <param name="LastError">Latest error message; null when none.</param>
 /// <param name="ErrorCount5Min">Number of state-transitions into Faulted in the last 5 minutes.</param>
 /// <param name="PublishedUtc">Timestamp this snapshot was published.</param>
+/// <param name="RediscoveryNeededUtc">
+///     When the driver last raised <c>IRediscoverable.OnRediscoveryNeeded</c> — i.e. it observed that the
+///     remote's tag set may have changed (a Galaxy redeploy, a TwinCAT symbol-version bump, an MTConnect
+///     agent restart, a Sparkplug rebirth). Null when the driver has never raised it, or does not
+///     implement <c>IRediscoverable</c>.
+///     <para><b>Advisory only.</b> The served address space is NOT rebuilt in response — raw tags are
+///     authored explicitly through the <c>/raw</c> browse-commit flow. This is a prompt for an operator
+///     to re-browse the device and commit whatever changed.</para>
+/// </param>
+/// <param name="RediscoveryReason">
+///     The driver-supplied reason string from the same event (e.g. <c>"deploy-time-changed"</c>), shown
+///     to the operator alongside the prompt. Null when <paramref name="RediscoveryNeededUtc"/> is null.
+/// </param>
 public sealed record DriverHealthChanged(
    string ClusterId,
    string DriverInstanceId,
@@ -20,7 +33,9 @@ public sealed record DriverHealthChanged(
    DateTime? LastSuccessfulReadUtc,
    string? LastError,
    int ErrorCount5Min,
-    DateTime PublishedUtc)
+    DateTime PublishedUtc,
+    DateTime? RediscoveryNeededUtc = null,
+    string? RediscoveryReason = null)
 {
    /// <summary>
    ///     DPS topic name. Both the runtime <c>AkkaDriverHealthPublisher</c> and the AdminUI
@@ -68,6 +68,8 @@ message DriverHealth {
  optional string last_error = 5;                         // nullable in the record
  int32 error_count_5min = 6;
  google.protobuf.Timestamp published_utc = 7;
+  google.protobuf.Timestamp rediscovery_needed_utc = 8; // DateTime? — absent Timestamp encodes null
+  optional string rediscovery_reason = 9;               // nullable in the record
 }

 // Mirrors ZB.MOM.WW.OtOpcUa.Commons.Messages.Drivers.DriverResilienceStatusChanged.
@@ -41,9 +41,77 @@ public static class DraftValidator
        ValidateUnsEffectiveLeafUniqueness(draft, errors);
        ValidateEquipReferenceResolution(draft, errors);
        ValidateCalculationTags(draft, errors);
+        ValidateSqlConnectionStringNotPersisted(draft, errors);
        return errors;
    }

+    /// <summary>
+    ///     The <c>Sql</c> driver's "a pasted literal connection string is never persisted" guarantee, enforced
+    ///     at the deploy gate (Gitea #498).
+    /// </summary>
+    /// <remarks>
+    ///     <para>A Sql driver names its credentials indirectly — <c>connectionStringRef</c> resolves from the
+    ///     environment / secret store at Initialize — so a deployed artifact carries no database password.
+    ///     Until now that guarantee rested entirely on the <b>read</b> path: <c>SqlDriverConfigDto</c> has no
+    ///     <c>connectionString</c> property and <c>UnmappedMemberHandling.Skip</c> drops the key on
+    ///     deserialization. Nothing stopped the key being <b>written</b>. Config blobs are schemaless JSON
+    ///     columns, and the fallback authoring pattern for a driver without a typed form is a raw-JSON
+    ///     textarea, so an operator pasting <c>{"connectionString":"Server=…;Password=…"}</c> would put a live
+    ///     credential in the ConfigDb — persisted, replicated to every node's artifact cache, and readable by
+    ///     anyone with config access — while the runtime silently ignored it and the driver failed to connect.
+    ///     Discarding a secret on read is not the same as refusing to store it.</para>
+    ///     <para><b>Two of the three surfaces are checked here.</b> The third — a node's
+    ///     <see cref="ClusterNode.DriverConfigOverridesJson"/> — is not reachable from
+    ///     <see cref="DraftSnapshot"/> and is gated at its save instead (#499); see
+    ///     <see cref="SqlCredentialGuard"/> for why a deploy gate is the wrong instrument for a value that
+    ///     never enters the artifact.</para>
+    ///     <para>Checked on <b>both</b> config surfaces a Sql driver reads: the instance's
+    ///     <see cref="DriverInstance.DriverConfig"/> and the <see cref="Device.DeviceConfig"/> of every device
+    ///     beneath it, because the two are merged before the DTO sees them — a credential pasted into the
+    ///     device blob lands in exactly the same place.</para>
+    ///     <para>The key is matched <b>case-insensitively</b>: <c>System.Text.Json</c> binds
+    ///     <c>ConnectionString</c> to a <c>connectionString</c> property by default, so a case variant is the
+    ///     same key, not a different one. Only the top level is scanned — the DTO is flat, so a nested
+    ///     occurrence cannot bind and is not the credential-shaped mistake this rule exists to catch.</para>
+    ///     <para><b>The message never echoes the value.</b> Validation errors reach the AdminUI, the deploy
+    ///     log and the audit trail; repeating the offending string there would leak the very credential the
+    ///     rule is refusing to store.</para>
+    /// </remarks>
+    private static void ValidateSqlConnectionStringNotPersisted(DraftSnapshot draft, List<ValidationError> errors)
+    {
+        const string ForbiddenKey = SqlCredentialGuard.ForbiddenKey;
+
+        var sqlInstanceIds = draft.DriverInstances
+            .Where(d => string.Equals(d.DriverType, Core.Abstractions.DriverTypeNames.Sql, StringComparison.Ordinal))
+            .Select(d => d.DriverInstanceId)
+            .ToHashSet(StringComparer.Ordinal);
+        if (sqlInstanceIds.Count == 0) return;
+
+        foreach (var d in draft.DriverInstances)
+        {
+            if (!sqlInstanceIds.Contains(d.DriverInstanceId)) continue;
+            if (!SqlCredentialGuard.CarriesLiteralConnectionString(d.DriverConfig)) continue;
+            errors.Add(new("SqlConnectionStringPersisted",
+                $"Sql driver instance '{d.DriverInstanceId}' has a '{ForbiddenKey}' key in its DriverConfig. " +
+                "A Sql driver must name its credentials indirectly via 'connectionStringRef', which resolves " +
+                "from the environment / secret store at Initialize; a literal connection string here would be " +
+                "stored in the config database and replicated to every node, and the runtime ignores it anyway. " +
+                "Remove the key and set 'connectionStringRef'.",
+                d.DriverInstanceId));
+        }
+
+        foreach (var dev in draft.Devices)
+        {
+            if (!sqlInstanceIds.Contains(dev.DriverInstanceId)) continue;
+            if (!SqlCredentialGuard.CarriesLiteralConnectionString(dev.DeviceConfig)) continue;
+            errors.Add(new("SqlConnectionStringPersisted",
+                $"Device '{dev.DeviceId}' on Sql driver instance '{dev.DriverInstanceId}' has a " +
+                $"'{ForbiddenKey}' key in its DeviceConfig. DeviceConfig is merged onto DriverConfig before " +
+                "the driver reads it, so this is the same leak: use 'connectionStringRef' on the driver instead.",
+                dev.DeviceId));
+        }
+    }
+
    /// <summary>WP7 Calculation-driver deploy gates. For every tag bound to a <c>Calculation</c> driver:
    /// <list type="number">
    ///   <item><b>scriptId existence</b> — the tag's <c>TagConfig.scriptId</c> must be present and resolve to
@@ -0,0 +1,139 @@
+using System.Text.Json;
+
+namespace ZB.MOM.WW.OtOpcUa.Configuration.Validation;
+
+/// <summary>
+///     The one place that decides whether a persisted config blob carries a literal Sql
+///     <c>connectionString</c> (Gitea #498 / #499).
+/// </summary>
+/// <remarks>
+///     <para>
+///         A <c>Sql</c> driver names its credentials indirectly — <c>connectionStringRef</c> resolves from
+///         the environment / secret store at Initialize — so nothing persisted should ever contain a
+///         database password. The typed <c>SqlDriverConfigDto</c> already drops a <c>connectionString</c>
+///         key on <b>read</b>, but discarding a secret on read is not the same as refusing to store it:
+///         config blobs are schemaless JSON columns authored through raw-JSON textareas, so the key can
+///         be written even though the runtime ignores it.
+///     </para>
+///     <para>
+///         There are <b>three</b> surfaces a Sql driver's config is persisted on, and they need different
+///         enforcement points:
+///         <list type="bullet">
+///             <item><c>DriverInstance.DriverConfig</c> and <c>Device.DeviceConfig</c> — both in the
+///             deployed artifact, both visible to <c>DraftSnapshot</c>, both gated by
+///             <c>DraftValidator</c>.</item>
+///             <item><c>ClusterNode.DriverConfigOverridesJson</c> — the per-node override map. It is
+///             <b>not</b> in <c>DraftSnapshot</c>, and deliberately does not go there: adding a
+///             <c>ClusterNode</c> collection would widen the snapshot (and every builder of one) for a
+///             single rule about a value that is not part of the artifact at all. More to the point, a
+///             deploy gate is the wrong instrument here — the artifact never carries node overrides, so
+///             blocking a deploy would not stop the credential being stored. It is already in the
+///             database by then. This surface is therefore gated at the <b>save</b>, which is the only
+///             point where "refuse to store it" is literally true.</item>
+///         </list>
+///     </para>
+///     <para>
+///         <b>Deliberately narrow.</b> This checks the <c>Sql</c> driver's <c>connectionString</c> key
+///         only — not a general "credential-shaped key" sweep over every driver type. A broader rule
+///         would start refusing configs that are legitimate today for drivers that never made this
+///         guarantee, turning defence-in-depth into a regression. Widen it per driver, as each driver
+///         gains an indirect-credential contract of its own.
+///     </para>
+/// </remarks>
+public static class SqlCredentialGuard
+{
+    /// <summary>The config key a Sql driver must never persist. Matched case-insensitively.</summary>
+    public const string ForbiddenKey = "connectionString";
+
+    /// <summary>
+    ///     Whether <paramref name="configJson"/> is a JSON object carrying <see cref="ForbiddenKey"/> at
+    ///     its top level.
+    /// </summary>
+    /// <remarks>
+    ///     Matched <b>case-insensitively</b>: <c>System.Text.Json</c> binds <c>ConnectionString</c> to a
+    ///     <c>connectionString</c> property by default, so a case variant is the same key, not a
+    ///     different one. Only the top level is scanned — the DTO is flat, so a nested occurrence cannot
+    ///     bind and is not the credential-shaped mistake this exists to catch.
+    /// </remarks>
+    /// <param name="configJson">The config blob to inspect.</param>
+    /// <returns><see langword="true"/> when the key is present at the top level.</returns>
+    public static bool CarriesLiteralConnectionString(string? configJson)
+    {
+        if (string.IsNullOrWhiteSpace(configJson)) return false;
+        try
+        {
+            using var doc = JsonDocument.Parse(configJson);
+            return doc.RootElement.ValueKind == JsonValueKind.Object
+                   && HasTopLevelKey(doc.RootElement, ForbiddenKey);
+        }
+        catch (JsonException)
+        {
+            // A malformed blob simply has no keys. Shaping the config JSON is another rule's job, and
+            // throwing here would turn a formatting mistake into a credential-guard failure.
+            return false;
+        }
+    }
+
+    /// <summary>
+    ///     The <c>DriverInstanceId</c>s in a <c>ClusterNode.DriverConfigOverridesJson</c> map whose
+    ///     override object carries a literal connection string, restricted to instances that are actually
+    ///     Sql drivers.
+    /// </summary>
+    /// <remarks>
+    ///     The override map is shaped <c>{ "&lt;DriverInstanceId&gt;": { …driver config keys… } }</c> and is
+    ///     merged onto the cluster-level <c>DriverConfig</c>, so a credential pasted into one lands in
+    ///     exactly the place <see cref="CarriesLiteralConnectionString"/> already refuses on the driver
+    ///     itself.
+    /// </remarks>
+    /// <param name="overridesJson">The node's override map. Null / blank / malformed yields no
+    /// violations.</param>
+    /// <param name="sqlDriverInstanceIds">The ids of driver instances whose <c>DriverType</c> is
+    /// <c>Sql</c>. Keys outside this set are ignored — a non-Sql driver never made the indirect-credential
+    /// guarantee, so flagging it would be a regression, not defence in depth.</param>
+    /// <returns>The offending driver-instance ids, in document order; empty when there are none.</returns>
+    public static IReadOnlyList<string> FindNodeOverrideViolations(
+        string? overridesJson, IReadOnlyCollection<string> sqlDriverInstanceIds)
+    {
+        if (string.IsNullOrWhiteSpace(overridesJson) || sqlDriverInstanceIds.Count == 0)
+        {
+            return [];
+        }
+
+        var sqlIds = sqlDriverInstanceIds as IReadOnlySet<string>
+                     ?? sqlDriverInstanceIds.ToHashSet(StringComparer.Ordinal);
+
+        try
+        {
+            using var doc = JsonDocument.Parse(overridesJson);
+            if (doc.RootElement.ValueKind != JsonValueKind.Object) return [];
+
+            List<string>? offenders = null;
+            foreach (var entry in doc.RootElement.EnumerateObject())
+            {
+                if (!sqlIds.Contains(entry.Name)) continue;
+                if (entry.Value.ValueKind != JsonValueKind.Object) continue;
+                if (!HasTopLevelKey(entry.Value, ForbiddenKey)) continue;
+
+                (offenders ??= []).Add(entry.Name);
+            }
+
+            return (IReadOnlyList<string>?)offenders ?? [];
+        }
+        catch (JsonException)
+        {
+            return [];
+        }
+    }
+
+    /// <summary>Whether <paramref name="obj"/> carries <paramref name="key"/> at its top level,
+    /// case-insensitively.</summary>
+    private static bool HasTopLevelKey(JsonElement obj, string key)
+    {
+        foreach (var property in obj.EnumerateObject())
+        {
+            if (string.Equals(property.Name, key, StringComparison.OrdinalIgnoreCase)) return true;
+        }
+
+        return false;
+    }
+}
@@ -19,9 +19,9 @@ namespace ZB.MOM.WW.OtOpcUa.Core.Abstractions;
 ///     (<c>DriverTypeNamesGuardTests</c>) asserts bidirectional parity between these
 ///     constants and the set the driver factories actually register, so a rename on
 ///     either side breaks the build's test gate. Only constants for
-///     <b>currently-registered</b> factories belong here — a not-yet-registered driver
-///     (e.g. the Calculation driver landing in a later Batch 2 package) adds its own
-///     constant when its factory is wired in.
+///     <b>currently-registered</b> factories belong here — a driver adds its own constant
+///     when its factory is wired in. (This used to name Calculation as the example of a
+///     not-yet-registered driver; it registers in <c>DriverFactoryBootstrap</c> like the rest.)
 ///     </para>
 /// </remarks>
 public static class DriverTypeNames
@@ -53,6 +53,14 @@ public static class DriverTypeNames
    /// <summary>Calculation pseudo-driver — tags computed by C# scripts over other tags' live values.</summary>
    public const string Calculation = "Calculation";

+    /// <summary>Read-only SQL Server table/view poller — publishes columns as OPC UA variables.</summary>
+    public const string Sql = "Sql";
+    /// <summary>MQTT / Sparkplug B broker-subscription driver.</summary>
+    public const string Mqtt = "Mqtt";
+
+    /// <summary>MTConnect Agent driver — read-only HTTP/XML over an Agent's probe/current/sample surface.</summary>
+    public const string MTConnect = "MTConnect";
+
    /// <summary>
    ///     Every driver-type string declared above, for callers that need to enumerate
    ///     the full set (e.g. validation of an authored <c>DriverType</c>).
@@ -68,5 +76,8 @@ public static class DriverTypeNames
        OpcUaClient,
        Galaxy,
        Calculation,
+        Sql,
+        Mqtt,
+        MTConnect,
    ];
 }
@@ -15,11 +15,20 @@ public interface IDriverHealthPublisher
    /// <param name="driverInstanceId">The driver instance the snapshot describes.</param>
    /// <param name="health">The current health snapshot.</param>
    /// <param name="errorCount5Min">The number of errors observed in the trailing 5-minute window.</param>
+    /// <param name="rediscoveryNeededUtc">
+    ///     When the driver last raised <see cref="IRediscoverable.OnRediscoveryNeeded"/>, or null if never
+    ///     (or if it is not an <see cref="IRediscoverable"/>). Advisory: it prompts an operator to
+    ///     re-browse, and never rebuilds the served address space.
+    /// </param>
+    /// <param name="rediscoveryReason">The driver-supplied reason from that event; null when
+    ///     <paramref name="rediscoveryNeededUtc"/> is null.</param>
    void Publish(
        string clusterId,
        string driverInstanceId,
        DriverHealth health,
-        int errorCount5Min);
+        int errorCount5Min,
+        DateTime? rediscoveryNeededUtc = null,
+        string? rediscoveryReason = null);
 }

 /// <summary>
@@ -38,6 +47,8 @@ public sealed class NullDriverHealthPublisher : IDriverHealthPublisher
        string clusterId,
        string driverInstanceId,
        DriverHealth health,
-        int errorCount5Min)
+        int errorCount5Min,
+        DateTime? rediscoveryNeededUtc = null,
+        string? rediscoveryReason = null)
    { /* no-op */ }
 }
@@ -334,6 +334,48 @@ public sealed class ScriptedAlarmEngine : IDisposable
    public IReadOnlyCollection<AlarmConditionState> GetAllStates()
        => _alarms.Values.Select(a => a.Condition).ToArray();

+    /// <summary>
+    ///     #487 — the currently-held condition of every loaded alarm, packaged with the definition's
+    ///     severity, the rendered message template and the last-observed input quality, i.e. everything
+    ///     a caller needs to <b>project</b> the alarm onto an OPC UA condition node without waiting for
+    ///     the next transition.
+    /// </summary>
+    /// <remarks>
+    ///     <para>
+    ///         <b>This is a read, not an emission.</b> It deliberately returns a distinct type rather
+    ///         than a <see cref="ScriptedAlarmEvent"/>, and it never touches <see cref="OnEvent"/>. A
+    ///         still-active alarm produces <see cref="EmissionKind.None"/> at load (there is no
+    ///         transition to report), so the transition stream cannot carry the current state — that is
+    ///         exactly why the caller needs this. Routing these through the emission path instead would
+    ///         append a duplicate historian / <c>alerts</c> row on every deploy, so the shape here is
+    ///         intentionally one the emission machinery cannot consume.
+    ///     </para>
+    ///     <para>
+    ///         <b>Synchronization.</b> Reads <c>_alarms</c> and <c>_valueCache</c> — both
+    ///         <see cref="ConcurrentDictionary{TKey, TValue}"/> — without taking <c>_evalGate</c>, the
+    ///         same posture as <see cref="GetState"/> / <see cref="GetAllStates"/>. Each projection is
+    ///         individually coherent; the set as a whole is not an atomic snapshot across a concurrent
+    ///         re-evaluation. That is sufficient for the node-projection use: an evaluation racing this
+    ///         read publishes its own transition through the normal path.
+    ///     </para>
+    /// </remarks>
+    /// <returns>One projection per loaded alarm; empty before the first <see cref="LoadAsync"/>.</returns>
+    public IReadOnlyList<ScriptedAlarmProjection> GetProjections()
+    {
+        var projections = new List<ScriptedAlarmProjection>(_alarms.Count);
+        foreach (var (alarmId, state) in _alarms)
+        {
+            projections.Add(new ScriptedAlarmProjection(
+                AlarmId: alarmId,
+                Severity: state.Definition.Severity,
+                Message: MessageTemplate.Resolve(state.Definition.MessageTemplate, TryLookup),
+                Condition: state.Condition,
+                WorstInputStatusCode: LastWorstStatus(alarmId)));
+        }
+
+        return projections;
+    }
+
    /// <summary>Acknowledges the specified alarm on behalf of the given user.</summary>
    /// <param name="alarmId">The alarm identifier.</param>
    /// <param name="user">The user performing the acknowledgment.</param>
@@ -974,6 +1016,26 @@ public sealed record ScriptedAlarmEvent(
    // the top-2 severity bits. Default 0u == Good keeps every existing constructor call unchanged.
    uint WorstInputStatusCode = 0u);

+/// <summary>
+///     #487 — a loaded alarm's current condition, ready to be projected onto its OPC UA node.
+///     Produced by <see cref="ScriptedAlarmEngine.GetProjections"/> on demand; it is <b>not</b> an
+///     emission and never travels the <see cref="ScriptedAlarmEngine.OnEvent"/> path, so it can never
+///     become an <c>alerts</c> row or a historian record. Deliberately a separate type from
+///     <see cref="ScriptedAlarmEvent"/> — it carries no <see cref="EmissionKind"/>, so there is nothing
+///     for a future refactor to mistake for a transition.
+/// </summary>
+/// <param name="AlarmId">The alarm identifier (also its OPC UA condition NodeId).</param>
+/// <param name="Severity">The definition's severity bucket.</param>
+/// <param name="Message">The message template resolved against the current value cache.</param>
+/// <param name="Condition">The Part 9 condition state the engine currently holds.</param>
+/// <param name="WorstInputStatusCode">The last-observed worst OPC UA StatusCode across the alarm's inputs.</param>
+public sealed record ScriptedAlarmProjection(
+    string AlarmId,
+    AlarmSeverity Severity,
+    string Message,
+    AlarmConditionState Condition,
+    uint WorstInputStatusCode);
+
 /// <summary>
 ///     Upstream source abstraction — intentionally identical shape to the virtual-tag
 ///     engine's so Stream G can compose them behind one driver bridge.
@@ -35,7 +35,7 @@ namespace ZB.MOM.WW.OtOpcUa.Driver.AbCip;
 public static class AbCipStatusMapper
 {
    public const uint Good = 0u;
-    public const uint GoodMoreData = 0x00A70000u;
+    public const uint GoodMoreData = 0x00A60000u;
    public const uint BadInternalError = 0x80020000u;
    public const uint BadNodeIdUnknown = 0x80340000u;
    public const uint BadNotWritable = 0x803B0000u;
@@ -44,7 +44,7 @@ public static class AbCipStatusMapper
    public const uint BadDeviceFailure = 0x808B0000u;
    public const uint BadCommunicationError = 0x80050000u;
    public const uint BadTimeout = 0x800A0000u;
-    public const uint BadTypeMismatch = 0x80730000u;
+    public const uint BadTypeMismatch = 0x80740000u;

    /// <summary>Map a CIP general-status byte to an OPC UA StatusCode.</summary>
    /// <param name="status">The CIP general-status byte value.</param>
@@ -13,7 +13,9 @@ namespace ZB.MOM.WW.OtOpcUa.Driver.AbLegacy;
 public sealed class AbLegacyDriver : IDriver, IReadable, IWritable, ITagDiscovery, ISubscribable,
    IHostConnectivityProbe, IPerCallHostResolver, IDisposable, IAsyncDisposable
 {
-    private readonly AbLegacyDriverOptions _options;
+    /// <summary>Mutable so <see cref="InitializeAsync"/> can adopt a re-parsed config on reinitialize
+    /// (#516). Only ever written on the init path, before any reader/session uses it.</summary>
+    private AbLegacyDriverOptions _options;
    private readonly string _driverInstanceId;
    private readonly IAbLegacyTagFactory _tagFactory;
    private readonly ILogger<AbLegacyDriver> _logger;
@@ -94,12 +96,28 @@ public sealed class AbLegacyDriver : IDriver, IReadable, IWritable, ITagDiscover
    /// <inheritdoc />
    public string DriverType => "AbLegacy";

+    /// <summary>True when the supplied DriverConfig JSON carries a real body. The bootstrapper always
+    /// passes a populated document; some unit tests pass <c>"{}"</c> or an empty string to exercise
+    /// lifecycle shape without a config — those keep the constructor-supplied options.</summary>
+    private static bool HasConfigBody(string? driverConfigJson)
+    {
+        if (string.IsNullOrWhiteSpace(driverConfigJson)) return false;
+        var trimmed = driverConfigJson.Trim();
+        return trimmed is not "{}" and not "[]";
+    }
+
    /// <inheritdoc />
    public Task InitializeAsync(string driverConfigJson, CancellationToken cancellationToken)
    {
        _health = new DriverHealth(DriverState.Initializing, null, null);
        try
        {
+            // #516: re-parse the supplied DriverConfig so a config change delivered through the IDriver
+            // contract is honoured. Without this the driver keeps serving the options it was CONSTRUCTED
+            // with, so an operator's edit is discarded while the deployment still seals green.
+            if (HasConfigBody(driverConfigJson))
+                _options = AbLegacyDriverFactoryExtensions.ParseOptions(_driverInstanceId, driverConfigJson);
+
            foreach (var device in _options.Devices)
            {
                var addr = AbLegacyHostAddress.TryParse(device.HostAddress)
@@ -49,6 +49,23 @@ public static class AbLegacyDriverFactoryExtensions
    /// <param name="loggerFactory">Optional logger factory for the driver instance.</param>
    /// <returns>A configured <see cref="AbLegacyDriver"/> instance.</returns>
    internal static AbLegacyDriver CreateInstance(string driverInstanceId, string driverConfigJson, ILoggerFactory? loggerFactory)
+    {
+        return new AbLegacyDriver(
+            ParseOptions(driverInstanceId, driverConfigJson), driverInstanceId,
+            tagFactory: null,
+            logger: loggerFactory?.CreateLogger<AbLegacyDriver>());
+    }
+
+    /// <summary>
+    ///     Parses an AB Legacy <c>DriverConfig</c> JSON document into typed options. Extracted so
+    ///     <see cref="AbLegacyDriver.InitializeAsync"/> can re-parse a CHANGED config on reinitialize
+    ///     (Gitea #516) instead of serving the options it was constructed with — which silently discarded
+    ///     every operator edit while the deployment still sealed green.
+    /// </summary>
+    /// <param name="driverInstanceId">The unique driver instance identifier.</param>
+    /// <param name="driverConfigJson">The driver configuration as a JSON string.</param>
+    /// <returns>The parsed <see cref="AbLegacyDriverOptions"/>.</returns>
+    internal static AbLegacyDriverOptions ParseOptions(string driverInstanceId, string driverConfigJson)
    {
        ArgumentException.ThrowIfNullOrWhiteSpace(driverInstanceId);
        ArgumentException.ThrowIfNullOrWhiteSpace(driverConfigJson);
@@ -82,10 +99,7 @@ public static class AbLegacyDriverFactoryExtensions
            Timeout = PositiveTimeoutOrDefault(dto.TimeoutMs, 2_000),
        };

-        return new AbLegacyDriver(
-            options, driverInstanceId,
-            tagFactory: null,
-            logger: loggerFactory?.CreateLogger<AbLegacyDriver>());
+        return options;
    }

    /// <summary>
@@ -10,7 +10,7 @@ namespace ZB.MOM.WW.OtOpcUa.Driver.AbLegacy;
 public static class AbLegacyStatusMapper
 {
    public const uint Good = 0u;
-    public const uint GoodMoreData = 0x00A70000u;
+    public const uint GoodMoreData = 0x00A60000u;
    public const uint BadInternalError = 0x80020000u;
    public const uint BadNodeIdUnknown = 0x80340000u;
    public const uint BadNotWritable = 0x803B0000u;
@@ -19,7 +19,7 @@ public static class AbLegacyStatusMapper
    public const uint BadDeviceFailure = 0x808B0000u;
    public const uint BadCommunicationError = 0x80050000u;
    public const uint BadTimeout = 0x800A0000u;
-    public const uint BadTypeMismatch = 0x80730000u;
+    public const uint BadTypeMismatch = 0x80740000u;

    /// <summary>
    ///     Map a libplctag return/status code to an OPC UA StatusCode. The integer passed here
@@ -100,7 +100,19 @@ public sealed class FocasDriver : IDriver, IReadable, IWritable, ITagDiscovery,
    /// <inheritdoc />
    public string DriverType => "FOCAS";

-    /// <inheritdoc />
+    /// <summary>
+    ///     Opens the configured CNC handles and builds the authored tag table.
+    ///     <para><paramref name="driverConfigJson"/> is deliberately <b>not</b> re-parsed here, unlike
+    ///     Modbus / AbLegacy / OpcUaClient (Gitea #516). This driver builds more than options from config —
+    ///     its <c>IFocasClientFactory</c> is selected from the <c>Backend</c> key and injected at
+    ///     construction — so adopting a new <c>FocasDriverOptions</c> alone would run a NEW device/tag set
+    ///     against the OLD backend. Half a re-parse is worse than none.</para>
+    ///     <para>A config change is covered by the stop + respawn in <c>DriverSpawnPlanner</c>, which
+    ///     rebuilds options and backend together through the factory.</para>
+    /// </summary>
+    /// <param name="driverConfigJson">The driver configuration JSON (see remarks — not re-parsed).</param>
+    /// <param name="cancellationToken">Cancellation token for the operation.</param>
+    /// <returns>A completed task.</returns>
    public Task InitializeAsync(string driverConfigJson, CancellationToken cancellationToken)
    {
        Volatile.Write(ref _health, new DriverHealth(DriverState.Initializing, null, null));
@@ -17,7 +17,7 @@ public static class FocasStatusMapper
    public const uint BadDeviceFailure = 0x808B0000u;
    public const uint BadCommunicationError = 0x80050000u;
    public const uint BadTimeout = 0x800A0000u;
-    public const uint BadTypeMismatch = 0x80730000u;
+    public const uint BadTypeMismatch = 0x80740000u;

    /// <summary>
    ///     Map common FWLIB <c>EW_*</c> return codes. The values below match Fanuc's published
--- a/Show More
+++ b/Show More