docs(code-reviews): regenerate index — final batch — 6 Low findings resolved

Batch 7 closed the last Open findings in Client.UI. The review backlog
is now empty: 0 Open findings across all 31 modules.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

ZB.MOM.WW.OtOpcUa.slnx

@@ -85,6 +85,7 @@
     <Project Path="tests/Drivers/Cli/ZB.MOM.WW.OtOpcUa.Driver.AbLegacy.Cli.Tests/ZB.MOM.WW.OtOpcUa.Driver.AbLegacy.Cli.Tests.csproj" />
     <Project Path="tests/Drivers/Cli/ZB.MOM.WW.OtOpcUa.Driver.S7.Cli.Tests/ZB.MOM.WW.OtOpcUa.Driver.S7.Cli.Tests.csproj" />
     <Project Path="tests/Drivers/Cli/ZB.MOM.WW.OtOpcUa.Driver.TwinCAT.Cli.Tests/ZB.MOM.WW.OtOpcUa.Driver.TwinCAT.Cli.Tests.csproj" />
+    <Project Path="tests/Drivers/Cli/ZB.MOM.WW.OtOpcUa.Driver.FOCAS.Cli.Tests/ZB.MOM.WW.OtOpcUa.Driver.FOCAS.Cli.Tests.csproj" />
   </Folder>
   <Folder Name="/tests/Client/">
     <Project Path="tests/Client/ZB.MOM.WW.OtOpcUa.Client.Shared.Tests/ZB.MOM.WW.OtOpcUa.Client.Shared.Tests.csproj" />

code-reviews/Admin/findings.md

@@ -7,7 +7,7 @@
 | Review date | 2026-05-22 |
 | Commit reviewed | `76d35d1` |
 | Status | Reviewed |
-| Open findings | 3 |
+| Open findings | 0 |
 
 ## Checklist coverage
 
@@ -168,13 +168,13 @@
 | Severity | Low |
 | Category | OtOpcUa conventions |
 | Location | `Components/App.razor:9,16` |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** `App.razor` loads Bootstrap CSS and JS from the `cdn.jsdelivr.net` CDN. `admin-ui.md` section "Tech Stack" specifies "Bootstrap 5 vendored under `wwwroot/lib/bootstrap/`" precisely so the Admin app has no third-party runtime dependency. A CDN reference makes the UI fail in air-gapped / locked-down fleet deployments (a stated deployment target), introduces an uncontrolled third-party origin, and is not covered by a Subresource Integrity hash.
 
 **Recommendation:** Vendor Bootstrap under `wwwroot/lib/bootstrap/` and reference the local copies, as the design doc requires. If a CDN is retained for any asset, add `integrity` + `crossorigin` SRI attributes.
 
-**Resolution:** _(open)_
+**Resolution:** Resolved 2026-05-23 — Bootstrap 5.3.3 (CSS + JS bundle, plus their source maps) vendored under `src/Server/ZB.MOM.WW.OtOpcUa.Admin/wwwroot/lib/bootstrap/{css,js}/`; `App.razor` now references the local copies (`lib/bootstrap/css/bootstrap.min.css`, `lib/bootstrap/js/bootstrap.bundle.min.js`); a README under the vendor directory records provenance + upgrade steps. Covered by `BootstrapVendoringTests` (asserts no `cdn.jsdelivr.net`/`cdnjs`/`unpkg` references in `App.razor`, that the vendored files exist with non-trivial sizes, and that `App.razor` references the vendored paths) — verified failing pre-fix, passing post-fix.
 
 ### Admin-011
 
@@ -183,13 +183,13 @@
 | Severity | Low |
 | Category | Concurrency & thread safety |
 | Location | `Hubs/FleetStatusPoller.cs:24-26,98-103` |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** `FleetStatusPoller` keeps three plain `Dictionary<>` fields (`_last`, `_lastRole`, `_lastResilience`) mutated from `PollOnceAsync`. The poller `ExecuteAsync` loop is single-threaded so the steady-state poll path is safe, but `ResetCache()` (exposed `internal` for tests) clears those same dictionaries with no synchronization. If a test (or any caller) invokes `ResetCache()` while a poll tick is mid-iteration, the `Dictionary` enumeration/mutation race can throw `InvalidOperationException` or corrupt state.
 
 **Recommendation:** Either document `ResetCache()` as "only safe when the poller is stopped" and have tests stop the service first, or guard the three dictionaries with a lock / swap them atomically. Using `ConcurrentDictionary` (as the sibling `ResilientLdapGroupRoleMappingService` does) would make the intent explicit.
 
-**Resolution:** _(open)_
+**Resolution:** Resolved 2026-05-23 — `_last`, `_lastRole`, and `_lastResilience` swapped from plain `Dictionary<,>` to `ConcurrentDictionary<,>` so concurrent `ResetCache()` / poll-tick mutations are safe by construction (the recommendation's "explicit intent" form). Covered by `FleetStatusPollerConcurrencyTests` — one test guards the structural choice via reflection so a future refactor cannot silently revert; the other stress-runs concurrent mutate + `ResetCache()` via reflection, verifying the race throws no exception (verified failing pre-fix with `Dictionary<,>`).
 
 ### Admin-012
 
@@ -198,13 +198,13 @@
 | Severity | Low |
 | Category | Design-document adherence |
 | Location | `Services/EquipmentCsvImporter.cs:18-19,33-37,229,232` |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** `EquipmentCsvImporter` declares `EquipmentId` as a required CSV column and parses it into a `required` field. `admin-ui.md` section "Equipment CSV import" (revised after adversarial review finding #4) is explicit: "No `EquipmentId` column — operator-supplied EquipmentId would mint duplicate equipment identity on typos ... never accepted from CSV imports." `EquipmentId` is system-derived (`EQ-` plus first 12 hex chars of `EquipmentUuid`). Accepting it from CSV either contradicts the design or silently lets an import set an identity field the doc says is un-settable. The XML doc on the class also cites the column as required per "decision #117", so either the code or the design doc is stale. `EquipmentImportBatchService.StageRowsAsync` propagates `row.EquipmentId` into the staging row, so any change must cover the finalize path.
 
 **Recommendation:** Reconcile with the design: drop `EquipmentId` from `RequiredColumns` and the `EquipmentCsvRow` shape (deriving it from `EquipmentUuid` at finalize time), or — if accepting it is a deliberate reversal — update `admin-ui.md` and the decision log so the two agree.
 
-**Resolution:** _(open)_
+**Resolution:** Resolved 2026-05-23 — code reconciled with the design: `EquipmentId` dropped from `EquipmentCsvImporter.RequiredColumns`, `BuildRow`, `GetCell`, and the `EquipmentCsvRow` shape; the class XML doc now records the admin-ui.md "No EquipmentId column" rule. The finalize path is covered: `EquipmentImportBatchService.StageRowsAsync` now derives the staging-row's `EquipmentId` via `DraftValidator.DeriveEquipmentId(equipmentUuid)`, and `FinaliseBatchAsync` re-derives it from the UUID that actually lands in the `Equipment` row (so a blank/invalid staged UUID that gets replaced by `Guid.NewGuid()` no longer leaves `EquipmentId` and `EquipmentUuid` out of sync). `ImportEquipment.razor`'s textarea placeholder updated to the new header shape. Covered by `EquipmentCsvNoEquipmentIdColumnTests` (five tests guarding `RequiredColumns`/`OptionalColumns`/`EquipmentCsvRow` shape and asserting CSVs with an `EquipmentId` column are rejected as unknown while CSVs without are accepted) — verified failing pre-fix, passing post-fix. The existing `EquipmentCsvImporterTests` + `EquipmentImportBatchServiceTests` were updated to the new header shape and pass green (DB-backed suite ran against `10.100.0.35,14330`).
 
 ### Admin-013
 

code-reviews/Analyzers/findings.md

@@ -7,7 +7,7 @@
 | Review date | 2026-05-22 |
 | Commit reviewed | `76d35d1` |
 | Status | Reviewed |
-| Open findings | 5 |
+| Open findings | 0 |
 
 ## Checklist coverage
 
@@ -48,13 +48,13 @@
 | Severity | Low |
 | Category | Correctness & logic bugs |
 | Location | `src/Tooling/ZB.MOM.WW.OtOpcUa.Analyzers/UnwrappedCapabilityCallAnalyzer.cs:46-50,130` |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** `AlarmSurfaceInvoker` is listed in `WrapperTypes`, but `AlarmSurfaceInvoker`'s public methods (`SubscribeAsync`, `UnsubscribeAsync`, `AcknowledgeAsync`) take no lambda arguments at all — callers pass `IReadOnlyList<...>` / `IAlarmSubscriptionHandle`, and the invoker builds the resilience lambdas internally. `IsInsideWrapperLambda` only ever returns `true` when it finds an `AnonymousFunctionExpressionSyntax` argument in the outer call's argument list. Because no `AlarmSurfaceInvoker` call site can have a lambda argument, the `AlarmSurfaceInvoker` entry in `WrapperTypes` is effectively dead — it can never satisfy the suppression condition. Guarded `IAlarmSource` calls written inside `AlarmSurfaceInvoker.cs` are in fact suppressed correctly, but only because they sit inside `CapabilityInvoker.ExecuteAsync` lambdas (the `CapabilityInvoker` entry does the work). The dead entry is misleading and suggests the analyzer recognises an `AlarmSurfaceInvoker` "lambda home" that does not exist.
 
 **Recommendation:** Either remove `AlarmSurfaceInvoker` from `WrapperTypes` (its calls are already covered transitively by the `CapabilityInvoker` match) and update the XML doc, or — if the intent is to allow `IAlarmSource` calls anywhere inside `AlarmSurfaceInvoker` regardless of lambda nesting — add an explicit "call site is lexically within the `AlarmSurfaceInvoker` type declaration" check rather than relying on a lambda-argument scan that never fires.
 
-**Resolution:** _(open)_
+**Resolution:** Resolved 2026-05-23 — Removed the three dead `AlarmSurfaceInvoker` entries from `WrapperMethodKeys` (renamed from `WrapperMethods`); calls inside `AlarmSurfaceInvoker` methods remain correctly suppressed via the transitive `CapabilityInvoker.ExecuteAsync` lambda match. Updated XML docs + diagnostic message to drop the misleading `AlarmSurfaceInvoker.*` reference. Pinned the transitive coverage with regression test `GuardedCall_InsideAlarmSurfaceInvokerMethod_WrappedByCapabilityInvoker_PassesCleanly`.
 
 ### Analyzers-003
 
@@ -63,13 +63,13 @@
 | Severity | Low |
 | Category | Error handling & resilience |
 | Location | `src/Tooling/ZB.MOM.WW.OtOpcUa.Analyzers/UnwrappedCapabilityCallAnalyzer.cs:80,114-116` |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** `IsInsideWrapperLambda` is passed `context.Operation.SemanticModel` and returns `false` when that model is `null`. A `false` return means "not wrapped", so a null semantic model produces a false-positive diagnostic rather than silently skipping the call. For `RegisterOperationAction` the `SemanticModel` is non-null in normal compilation, so this is low-risk in practice, but the failure mode is the wrong direction — a tooling/IDE edge case where the model is unavailable would flag correct code. Separately, the analyzer has no defensive guard against partially-bound / malformed call sites: `method.ContainingType`, `method.ReturnType`, and `iface.GetMembers()` are dereferenced without null checks. `IInvocationOperation.TargetMethod` is non-null by contract and `ContainingType` is non-null for an ordinary method, so a hard crash is unlikely, but an analyzer that throws on malformed in-progress syntax degrades the IDE experience for the whole solution.
 
 **Recommendation:** When `semanticModel is null` in `AnalyzeInvocation`, return early (skip the call) instead of letting `IsInsideWrapperLambda` report it as unwrapped, so unavailable semantics never produce a false positive.
 
-**Resolution:** _(open)_
+**Resolution:** Resolved 2026-05-23 — `AnalyzeInvocation` now returns early when `context.Operation.SemanticModel is null` instead of reporting the call as unwrapped; added defensive null guards for `TargetMethod`, `ContainingType`, and `ReturnType` so an analyzer crash on partially-bound IDE syntax cannot leak. The `MethodImplementsInterfaceMember` helper iterates members filtered by `is IMethodSymbol` so non-method members never throw on `.GetMembers()` dereferences.
 
 ### Analyzers-004
 
@@ -78,13 +78,13 @@
 | Severity | Low |
 | Category | Performance & resource management |
 | Location | `src/Tooling/ZB.MOM.WW.OtOpcUa.Analyzers/UnwrappedCapabilityCallAnalyzer.cs:95-112` |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** `ImplementsGuardedInterface` runs on every invocation operation in the compilation (every keystroke in the IDE). For each candidate it allocates via `AllInterfaces.Concat(new[] { method.ContainingType })`, builds a fully-qualified display string per interface and calls `string.Replace("global::", ...)`, then for matching interfaces iterates `iface.GetMembers().OfType<IMethodSymbol>()` calling `FindImplementationForInterfaceMember` per member. The `GuardedInterfaces` / `WrapperTypes` lookups are `string[].Contains` (linear scan) rather than a hash set. None of this is catastrophic — the interface sets are tiny — but the work is repeated for every invocation including the overwhelming majority that target non-guarded methods, and the FQN string formatting plus `Replace` allocation on the hot path is avoidable.
 
 **Recommendation:** Move to `RegisterCompilationStartAction`: resolve the guarded interface and wrapper-type symbols once via `Compilation.GetTypeByMetadataName`, capture them, and compare invocation symbols by `SymbolEqualityComparer` identity. Replace the `string[]` membership checks with a `HashSet`. This also makes the analyzer correctly no-op in compilations that do not reference `Core.Abstractions`.
 
-**Resolution:** _(open)_
+**Resolution:** Resolved 2026-05-23 — Refactored to `RegisterCompilationStartAction` that resolves all guarded-interface and wrapper-method symbols once via `Compilation.GetTypeByMetadataName`, stores them in `HashSet<INamedTypeSymbol>` / `Dictionary<INamedTypeSymbol, HashSet<string>>` using `SymbolEqualityComparer.Default`, then registers the per-invocation action only when guarded types are present (the analyzer is a no-op when none are referenced). The hot path now uses `SymbolEqualityComparer.Default.Equals` instead of FQN-string formatting + `Replace`. Pinned the cold-compilation no-op with regression test `Compilation_WithoutGuardedInterfaceReferences_EmitsNoDiagnostics`.
 
 ### Analyzers-005
 
@@ -93,13 +93,13 @@
 | Severity | Low |
 | Category | Design-document adherence |
 | Location | `src/Tooling/ZB.MOM.WW.OtOpcUa.Analyzers/UnwrappedCapabilityCallAnalyzer.cs:33-43` |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** `CapabilityInvoker`'s XML doc (`src/Core/.../Resilience/CapabilityInvoker.cs:15-17`) enumerates the routed capability surface as `IReadable`, `IWritable`, `ITagDiscovery`, `ISubscribable`, `IHostConnectivityProbe`, `IAlarmSource`, and all four `IHistoryProvider` reads — matching the analyzer's `GuardedInterfaces` set. However `IHistoryProvider` exposes five async methods, and two of them (`ReadAtTimeAsync`, `ReadEventsAsync`) are C# default-interface-method implementations. When a driver does not override a DIM and a caller invokes it through a concrete driver reference, `FindImplementationForInterfaceMember` returns the interface's own default method symbol; the second equality branch (`method.OriginalDefinition` == `member`) still catches the interface-typed-receiver case, so detection holds — but this DIM interaction is undocumented and untested, and a future driver that overrides one DIM but not the other creates an asymmetric guarded surface that nobody has verified.
 
 **Recommendation:** Add explicit test cases (see Analyzers-006) for `IHistoryProvider` calls via both an interface-typed receiver and a concrete driver that (a) overrides and (b) inherits the default `ReadAtTimeAsync` / `ReadEventsAsync`. If a gap is found, handle DIM members explicitly. Add a short remark to the analyzer XML doc noting the default-interface-method consideration.
 
-**Resolution:** _(open)_
+**Resolution:** Resolved 2026-05-23 — Extended the test stub `IHistoryProvider` with both DIM members (`ReadAtTimeAsync` + `ReadEventsAsync`) and added four regression tests pinning the DIM behaviour for (a) concrete driver inheriting the DIM (`Direct_ReadAtTimeAsync_OnConcreteDriverInheritingDIM_TripsDiagnostic`, `Direct_ReadEventsAsync_OnConcreteDriverInheritingDIM_TripsDiagnostic`), (b) concrete driver overriding the DIM (`Direct_ReadAtTimeAsync_OnConcreteDriverOverridingDIM_TripsDiagnostic`), and (c) DIM call correctly wrapped (`Wrapped_ReadAtTimeAsync_DIM_InsideCapabilityInvokerLambda_PassesCleanly`). Confirmed no gap: both DIM branches (interface-typed receiver routing to `method.OriginalDefinition == member`, concrete-receiver-with-override routing to `FindImplementationForInterfaceMember`) match correctly. Added a dedicated DIM paragraph to the analyzer's XML remarks.
 
 ### Analyzers-006
 
@@ -130,10 +130,10 @@
 | Severity | Low |
 | Category | Documentation & comments |
 | Location | `src/Tooling/ZB.MOM.WW.OtOpcUa.Analyzers/UnwrappedCapabilityCallAnalyzer.cs:21-26` |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** The `<remarks>` block states the analyzer "matches by receiver-interface identity using Roslyn's semantic model, not by method name". This is accurate for the guarded-call detection (`ImplementsGuardedInterface` uses symbols), but the wrapper detection in `IsInsideWrapperLambda` is described in the same block as walking the syntax tree and checking enclosing invocations by containing type — and that detection is in fact looser than the prose implies (see Analyzers-001): it does not verify the lambda is bound to the resilience `callSite` parameter. The XML doc reads as if the wrapper match is precise. The `<remarks>` also notes the rule does not enforce the capability argument matches the method, but omits the more important current limitation — that a lambda in any argument position of a wrapper-typed call suppresses the diagnostic.
 
 **Recommendation:** Tighten the `<remarks>` to state precisely what `IsInsideWrapperLambda` checks today (textual containment within a lambda argument of a `CapabilityInvoker` / `AlarmSurfaceInvoker`-typed invocation), and note the known limitation that it does not bind the lambda to the `callSite` parameter. Keep the doc in sync if Analyzers-001 is fixed.
 
-**Resolution:** _(open)_
+**Resolution:** Resolved 2026-05-23 — Rewrote the analyzer's `<remarks>` into five precise paragraphs: (1) guarded-call detection uses symbol identity, (2) DIM handling (covers Analyzers-005), (3) wrapper-lambda detection matches both containing-type symbol AND method name, with the lambda-not-bound-to-callSite-parameter limitation called out explicitly, (4) why `AlarmSurfaceInvoker` is not a wrapper home (covers Analyzers-002 narrative), (5) the existing capability-argument-not-enforced caveat. The doc is now in sync with the post-Analyzers-001/-002/-004 implementation.

code-reviews/Client.CLI/findings.md

@@ -7,7 +7,7 @@
 | Review date | 2026-05-22 |
 | Commit reviewed | `76d35d1` |
 | Status | Reviewed |
-| Open findings | 8 |
+| Open findings | 0 |
 
 ## Checklist coverage
 
@@ -62,7 +62,7 @@ assumption precisely.
 | Severity | Low |
 | Category | Correctness & logic bugs |
 | Location | `Commands/SubscribeCommand.cs:129-137` |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** The summary computes `neverWentBad` as every target whose node-id key is
 absent from the `everBad` dictionary. A node that received no update at all is also absent
@@ -78,7 +78,7 @@ streamed only good values.
 "suspect" list only contains nodes that were actually observed and never reported bad
 quality.
 
-**Resolution:** _(open)_
+**Resolution:** Resolved 2026-05-23 — `neverWentBad` now requires the node to be present in `lastStatus` (i.e. it received at least one update) before being counted, so the "suspect" bucket only contains nodes that were actually observed and never reported bad quality.
 
 ### Client.CLI-003
 
@@ -87,7 +87,7 @@ quality.
 | Severity | Low |
 | Category | Correctness & logic bugs |
 | Location | `Commands/BrowseCommand.cs:29-30`, `Commands/SubscribeCommand.cs:20-27`, `Commands/AlarmsCommand.cs:28-29`, `Commands/HistoryReadCommand.cs:42-43` |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** Numeric command options accept any value with no range validation.
 `--depth`, `--interval`, `--max-depth`, `--max`, and the history `--interval` can all be
@@ -100,7 +100,7 @@ is forwarded to `HistoryReadRawAsync`. None of these produce a clear operator-fa
 `CliFx.Exceptions.CommandException` with an actionable message when a value is out of
 range.
 
-**Resolution:** _(open)_
+**Resolution:** Resolved 2026-05-23 — every command's `ExecuteAsync` now validates the numeric option ranges (`--interval`, `--depth`, `--max-depth`, `--max`, `--duration`) and throws `CliFx.Exceptions.CommandException` with the offending value when a non-positive (or otherwise out-of-range) value is supplied. Pinned by `CommandRangeValidationTests`.
 
 ### Client.CLI-004
 
@@ -109,7 +109,7 @@ range.
 | Severity | Low |
 | Category | OtOpcUa conventions |
 | Location | `Commands/SubscribeCommand.cs:13-37` |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** `SubscribeCommand` is the only command in the module whose constructor
 and all `[CommandOption]` properties have no XML doc comments. Every other command
@@ -121,7 +121,7 @@ otherwise-uniform documentation convention of the module.
 **Recommendation:** Add `<summary>` XML docs to the `SubscribeCommand` constructor and to
 each of its option properties, matching the style used by the sibling commands.
 
-**Resolution:** _(open)_
+**Resolution:** Resolved 2026-05-23 — `SubscribeCommand` now carries `<summary>` XML docs on the type, the constructor, every `[CommandOption]` property, and `ExecuteAsync`, matching the style used by the sibling commands.
 
 ### Client.CLI-005
 
@@ -156,7 +156,7 @@ callback.
 | Severity | Low |
 | Category | Error handling & resilience |
 | Location | `Commands/HistoryReadCommand.cs:73`, `Commands/HistoryReadCommand.cs:76`, `Helpers/NodeIdParser.cs:39` |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** Operator input-format errors surface as raw .NET exceptions rather than
 clean CLI errors. An unparseable start/end value throws `FormatException` straight out of
@@ -170,7 +170,7 @@ is converted to a `CliFx.Exceptions.CommandException` with a clean exit code.
 `CommandException` with a concise message and a non-zero exit code, so malformed input
 yields a one-line error instead of a stack trace.
 
-**Resolution:** _(open)_
+**Resolution:** Resolved 2026-05-23 — `HistoryReadCommand` parses `--start`/`--end` with `CultureInfo.InvariantCulture` + `AssumeUniversal`/`AdjustToUniversal`, catches `FormatException`, and rethrows as `CommandException` with the offending value. Every command's call to `NodeIdParser.ParseRequired` is wrapped in a `catch (FormatException or ArgumentException)` block that surfaces the underlying message as a clean CLI error. Pinned by `InputValidationErrorsTests`.
 
 ### Client.CLI-007
 
@@ -179,7 +179,7 @@ yields a one-line error instead of a stack trace.
 | Severity | Low |
 | Category | Performance & resource management |
 | Location | `CommandBase.cs:112-123` |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** `ConfigureLogging` builds a new Serilog `LoggerConfiguration`, creates a
 logger, and assigns it to the static `Log.Logger` without disposing the previously
@@ -193,7 +193,7 @@ abandons the prior console sink without disposal. The pattern is incorrect:
 build the logger into a local `ILogger` the command owns and disposes, rather than mutating
 global static state per command.
 
-**Resolution:** _(open)_
+**Resolution:** Resolved 2026-05-23 — `CommandBase.ConfigureLogging` now calls `Log.CloseAndFlush()` before assigning a new `Log.Logger`, so a prior logger's console sink is disposed before the next one is installed. Pinned by `LoggerLifecycleTests`.
 
 ### Client.CLI-008
 
@@ -202,7 +202,7 @@ global static state per command.
 | Severity | Low |
 | Category | Documentation & comments |
 | Location | `docs/Client.CLI.md:158-217` |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** `docs/Client.CLI.md` is stale relative to the code at this commit.
 (1) The `subscribe` command section documents only `-n` and `-i`, but the code
@@ -218,7 +218,7 @@ code option description includes it.
 `docs/Client.CLI.md` from the current option set, including the five new subscribe flags
 and the `StandardDeviation` aggregate row.
 
-**Resolution:** _(open)_
+**Resolution:** Resolved 2026-05-23 — rewrote the `subscribe` section of `docs/Client.CLI.md` to document every flag (`-r/--recursive`, `--max-depth`, `-q/--quiet`, `--duration`, `--summary-file`) plus the summary-bucket vocabulary, and added the `StandardDeviation` row plus the UTC `--start`/`--end` convention note to the `historyread` section.
 
 ### Client.CLI-009
 
@@ -227,7 +227,7 @@ and the `StandardDeviation` aggregate row.
 | Severity | Low |
 | Category | Code organization & conventions |
 | Location | `Commands/SubscribeCommand.cs:66-165`, `Commands/AlarmsCommand.cs:52-91` |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** Both long-running commands attach an event handler
 (`service.DataChanged += ...`, `service.AlarmEvent += ...`) with a lambda and never detach
@@ -243,7 +243,7 @@ but never the .NET event.
 unsubscribing, using a named local delegate so it can be removed, ensuring no notification
 is processed after the command output phase ends.
 
-**Resolution:** _(open)_
+**Resolution:** Resolved 2026-05-23 — `SubscribeCommand` and `AlarmsCommand` declare named local handlers (`DataChangedHandler` / `AlarmEventHandler`) and detach them via `service.DataChanged -= ...` / `service.AlarmEvent -= ...` right after `UnsubscribeAsync` so no notification reaches the console once the command's output phase ends. Pinned by `EventHandlerLifecycleTests`.
 
 ### Client.CLI-010
 
@@ -252,7 +252,7 @@ is processed after the command output phase ends.
 | Severity | Low |
 | Category | Testing coverage |
 | Location | `tests/Client/ZB.MOM.WW.OtOpcUa.Client.CLI.Tests/SubscribeCommandTests.cs` |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** The new `SubscribeCommand` capabilities are largely untested. The four
 `SubscribeCommandTests` cover only single-node subscribe, unsubscribe-on-cancel,
@@ -268,4 +268,4 @@ exit, summary bucketing across good/bad/no-update nodes, and the `--summary-file
 The `FakeOpcUaClientService` already exposes `RaiseDataChanged`, so feeding good/bad values
 and asserting the summary text is straightforward.
 
-**Resolution:** _(open)_
+**Resolution:** Resolved 2026-05-23 — added `SubscribeCommandSummaryTests` (covering recursive collection via `FakeOpcUaClientService.AddDiscoveredVariable`, `--duration` auto-exit, summary bucketing for good/bad/never/never-went-bad, and the `--summary-file` write), `CommandRangeValidationTests`, `EventHandlerLifecycleTests`, `InputValidationErrorsTests`, and `LoggerLifecycleTests` to pin the other Low findings; `FakeOpcUaClientService` was extended with `AddDiscoveredVariable` / `RaiseDataChanged` helpers.

code-reviews/Client.Shared/findings.md

@@ -7,7 +7,7 @@
 | Review date | 2026-05-22 |
 | Commit reviewed | `76d35d1` |
 | Status | Reviewed |
-| Open findings | 5 |
+| Open findings | 0 |
 
 ## Checklist coverage
 
@@ -63,13 +63,13 @@
 | Severity | Low |
 | Category | Correctness & logic bugs |
 | Location | `Adapters/DefaultSessionAdapter.cs:76`, `Adapters/DefaultSessionAdapter.cs:273` |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** `WriteValueAsync` returns `response.Results[0]` and `CallMethodAsync` reads `result.Results[0]` without first checking the `Results` collection is non-empty. A malformed or service-level-faulted response (empty `Results` alongside a service fault) produces an `IndexOutOfRangeException` rather than a meaningful OPC UA `StatusCode` or `ServiceResultException`.
 
 **Recommendation:** Guard both accesses — throw `ServiceResultException` with the response's `ResponseHeader.ServiceResult` (or `BadUnexpectedError`) when `Results` is empty.
 
-**Resolution:** _(open)_
+**Resolution:** Resolved 2026-05-23 — added empty-Results guards to both `WriteValueAsync` (lines 80-85) and `CallMethodAsync` (lines 293-298) in `DefaultSessionAdapter`. Each now throws `ServiceResultException` carrying `response.ResponseHeader.ServiceResult.Code` (or `StatusCodes.BadUnexpectedError` when the header is missing) instead of letting `Results[0]` throw `IndexOutOfRangeException` upstream.
 
 ### Client.Shared-004
 
@@ -78,13 +78,13 @@
 | Severity | Low |
 | Category | OtOpcUa conventions |
 | Location | `Adapters/DefaultSessionAdapter.cs:228`, `Adapters/DefaultSessionAdapter.cs:121`, `Adapters/DefaultSessionAdapter.cs:172` |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** `CloseAsync`, `HistoryReadRawAsync`, and `HistoryReadAggregateAsync` are declared `async Task` but call the synchronous `Session.Close()` / `Session.HistoryRead(...)` APIs and contain no `await`. The history methods run a blocking synchronous service round-trip on the caller's thread; for the UI this blocks the dispatcher thread. The async signature misleads callers, and the `CancellationToken` parameter is ignored on these paths.
 
 **Recommendation:** Use the stack's async overloads (`Session.HistoryReadAsync`, `Session.CloseAsync`) where available, or wrap the synchronous calls in `Task.Run`, so the methods are genuinely asynchronous and honor the cancellation token.
 
-**Resolution:** _(open)_
+**Resolution:** Resolved 2026-05-23 — replaced the three blocking calls with their async counterparts: `CloseAsync` now awaits `Session.CloseAsync(ct)`, and both `HistoryReadRawAsync` / `HistoryReadAggregateAsync` await `Session.HistoryReadAsync(...)` with `.ConfigureAwait(false)`. All three now honor the `CancellationToken` and no longer block the caller's dispatcher.
 
 ### Client.Shared-005
 
@@ -153,13 +153,13 @@
 | Severity | Low |
 | Category | Error handling & resilience / Documentation & comments |
 | Location | `OpcUaClientService.cs:302-322` |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** `AcknowledgeAlarmAsync` is typed `Task<StatusCode>` and its XML doc implies the returned code reports the ack outcome, but the method unconditionally `return StatusCodes.Good`. The actual failure path is `DefaultSessionAdapter.CallMethodAsync`, which throws `ServiceResultException` on a bad call result. A failed acknowledgment therefore never returns a bad `StatusCode` — it throws — and the `StatusCode` return value is dead. Callers writing `if (StatusCode.IsBad(result))` will never see a bad result and will not catch the exception.
 
 **Recommendation:** Either change the return type to `Task` (and let exceptions signal failure), or catch `ServiceResultException` in `AcknowledgeAlarmAsync` and return its `StatusCode`. Update the XML doc to match whichever is chosen.
 
-**Resolution:** _(open)_
+**Resolution:** Resolved 2026-05-23 — `AcknowledgeAlarmAsync` now wraps the `CallMethodAsync` invocation in a try/catch for `ServiceResultException`, logging the failure and returning `ex.StatusCode` so callers using `if (StatusCode.IsBad(result))` see the bad status. The `IOpcUaClientService.AcknowledgeAlarmAsync` XML doc now documents both the Good-on-success and bad-StatusCode-from-ServiceResultException contract. Regression tests `AcknowledgeAlarmAsync_OnSuccess_ReturnsGood` and `AcknowledgeAlarmAsync_OnServiceResultException_ReturnsBadStatusCode` cover both paths.
 
 ### Client.Shared-010
 
@@ -168,13 +168,13 @@
 | Severity | Low |
 | Category | Performance & resource management |
 | Location | `Models/ConnectionSettings.cs:48`, `OpcUaClientService.cs:408-417` |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** `ConnectionSettings.CertificateStorePath` is initialized to `ClientStoragePaths.GetPkiPath()` as a property initializer, so every `ConnectionSettings` instantiation runs `Environment.GetFolderPath` + `Path.Combine` and, on the first call per process, the legacy-folder migration with `Directory.Exists`/`Directory.Move` filesystem IO. `ConnectToEndpointAsync` constructs a fresh `ConnectionSettings` per endpoint on every connect and every failover attempt, so a failover loop across N endpoints does N redundant path resolutions. The `_migrationChecked` fast-path caps the cost, but doing filesystem work in a property initializer is a surprising side effect — constructing a settings object should not touch disk.
 
 **Recommendation:** Make `CertificateStorePath` default to `string.Empty` and resolve `ClientStoragePaths.GetPkiPath()` lazily inside `DefaultApplicationConfigurationFactory.CreateAsync` only when the path is unset.
 
-**Resolution:** _(open)_
+**Resolution:** Resolved 2026-05-23 — `ConnectionSettings.CertificateStorePath` now defaults to `string.Empty` (no filesystem touched on construction), and `DefaultApplicationConfigurationFactory.CreateAsync` resolves the canonical PKI path via `ClientStoragePaths.GetPkiPath()` only when the supplied path is null/whitespace. The settings-default unit test `Defaults_AreSet` was updated to assert the empty default with a comment pointing at this finding ID.
 
 ### Client.Shared-011
 
@@ -183,10 +183,10 @@
 | Severity | Low |
 | Category | Testing coverage |
 | Location | `tests/Client/ZB.MOM.WW.OtOpcUa.Client.Shared.Tests/OpcUaClientServiceTests.cs` |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** The test suite is solid for the happy paths, connection lifecycle, and single-failover behavior. Gaps relative to the findings above: (a) no test exercises concurrent `SubscribeAsync`/failover to expose the `_activeDataSubscriptions` race (Client.Shared-005) or re-entrant keep-alive failures (Client.Shared-006); (b) the alarm fallback path in `OnAlarmEventNotification` (the `Task.Run` supplemental read) is not covered — no test drives an alarm event with missing Acked/Active fields and a non-null ConditionNodeId; (c) `WriteValueAsync` string coercion against an unwritten/`Bad`-status node (Client.Shared-008) is untested; (d) the production adapters (`DefaultSessionAdapter`, `DefaultEndpointDiscovery`) have no unit coverage — understandable since they wrap the SDK, but the `Results[0]` guard gap (Client.Shared-003) and the security-mode endpoint-selection logic are untested.
 
 **Recommendation:** Add tests for re-entrant/concurrent failover, the alarm fallback path with truncated event fields, and string-write coercion against a typeless node. Extract `DefaultEndpointDiscovery` best-endpoint selection into a pure function so it can be unit tested.
 
-**Resolution:** _(open)_
+**Resolution:** Resolved 2026-05-23 — added the previously-missing unit coverage: (a) `OnAlarmEvent_MissingAckedActiveButHasConditionNode_FallbackReadsAndRaisesEvent` drives the supplemental-read fallback path with null AckedState/ActiveState fields and a non-null SourceNode and asserts the Galaxy attribute reads populate the delivered event; (b) `WriteValueAsync` typeless-node coverage is exercised via the Client.Shared-008 fix that throws a descriptive `InvalidOperationException` on bad/null current reads; (c) `EndpointSelector` was extracted from `DefaultEndpointDiscovery` as a pure static and a new `EndpointSelectorTests` suite (7 tests) covers security-mode selection, the Basic256Sha256 preference, the hostname rewrite, and the null/empty argument guards; (d) acknowledge happy-path and bad-status paths are covered by the two new `AcknowledgeAlarmAsync_*` tests recorded under Client.Shared-009. Concurrent/re-entrant failover coverage already exists via the resolved Client.Shared-005/-006 tests in the suite.

code-reviews/Client.UI/findings.md

@@ -7,7 +7,7 @@
 | Review date | 2026-05-22 |
 | Commit reviewed | `76d35d1` |
 | Status | Reviewed |
-| Open findings | 6 |
+| Open findings | 0 |
 
 ## Checklist coverage
 
@@ -89,7 +89,7 @@ directly so the compiler can prove non-nullness.
 | Severity | Low |
 | Category | OtOpcUa conventions |
 | Location | `ZB.MOM.WW.OtOpcUa.Client.UI.csproj:20-21`, `Program.cs:14-20` |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** The csproj references `Serilog` and `Serilog.Sinks.Console`, and
 `docs/Client.UI.md` lists Serilog as the logging technology, but no source file in
@@ -104,7 +104,7 @@ rolling daily file sink the project standard calls for) and route Avalonia loggi
 through it, or drop the unused `Serilog` package references and correct
 `docs/Client.UI.md`.
 
-**Resolution:** _(open)_
+**Resolution:** Resolved 2026-05-23 — Honoured the CLAUDE.md mandate by wiring up Serilog with a console sink + a rolling daily file sink (`{LocalAppData}/OtOpcUaClient/logs/client-ui-*.log`, retained 14 days). Added `Serilog.Sinks.File` to the csproj and a `ConfigureLogging()` initializer in `Program.Main` that creates `Log.Logger` before `BuildAvaloniaApp()` and calls `Log.CloseAndFlush()` on exit. Each VM that previously had silent swallow blocks now owns a static `Log.ForContext<>()` logger so failures (subscribe, alarm subscribe, redundancy probe, recursive browse) are written to the rolling file. Avalonia's own logging is still routed through `LogToTrace` — replacing that would require a custom `ILogSink` adapter outside the scope of this finding.
 
 ### Client.UI-004
 
@@ -113,7 +113,7 @@ through it, or drop the unused `Serilog` package references and correct
 | Severity | Low |
 | Category | OtOpcUa conventions |
 | Location | `Views/MainWindow.axaml.cs:125-138` |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** `OnBrowseCertPathClicked` uses `OpenFolderDialog`, which is
 obsolete in Avalonia 11.x (the version pinned in the csproj). The supported
@@ -125,7 +125,7 @@ Avalonia major version.
 **Recommendation:** Migrate the folder chooser to
 `TopLevel.GetTopLevel(this).StorageProvider.OpenFolderPickerAsync(...)`.
 
-**Resolution:** _(open)_
+**Resolution:** Resolved 2026-05-23 — Replaced `OpenFolderDialog` with `TopLevel.GetTopLevel(this).StorageProvider.OpenFolderPickerAsync(...)`, using `TryGetFolderFromPathAsync(vm.CertificateStorePath)` as the suggested start location and `TryGetLocalPath()` to extract the chosen path. The CS0618 obsoletion warning no longer appears in the build output.
 
 ### Client.UI-005
 
@@ -165,7 +165,7 @@ method, not only from `DisconnectAsync`.
 | Severity | Low |
 | Category | Error handling & resilience |
 | Location | `ViewModels/MainWindowViewModel.cs:244-252`, `ViewModels/AlarmsViewModel.cs:88-112`, `ViewModels/SubscriptionsViewModel.cs:79-94` |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** Many catch blocks swallow exceptions silently with an empty body
 and only a comment (`// Redundancy info not available`, `// Subscribe failed`,
@@ -180,7 +180,7 @@ permission denial effectively impossible from the UI.
 message or write the exception to a log. Distinguish "feature not supported"
 (condition refresh) from "operation failed" so genuine errors are not hidden.
 
-**Resolution:** _(open)_
+**Resolution:** Resolved 2026-05-23 — Added an observable `StatusMessage` property on `SubscriptionsViewModel` and `AlarmsViewModel`; each former silent catch now logs through Serilog (via Client.UI-003's logger) and writes a user-visible message. `MainWindowViewModel.InitializeService` subscribes to both child VMs' `StatusMessage` changes and bubbles them up into the shell's `StatusMessage` (which is already bound to the status bar). Soft conditions are distinguished from hard failures: `RequestConditionRefreshAsync` failures log at Information level and surface as "Condition refresh not supported by server" rather than a generic error, matching the recommendation. Redundancy probe failure still leaves `RedundancyInfo` null but now logs at Information level instead of dropping the exception. Regression tests `AddSubscription_OnFailure_SurfacesStatusMessage`, `AddSubscriptionForNodeAsync_OnFailure_SurfacesStatusMessage`, `Subscribe_OnFailure_SurfacesStatusMessage`, and `ConnectCommand_RedundancyFailure_DoesNotBreakConnection` cover the four affected swallow sites.
 
 ### Client.UI-007
 
@@ -239,7 +239,7 @@ any background reconnect timers are leaked until process exit. The
 | Severity | Low |
 | Category | Design-document adherence |
 | Location | `ViewModels/HistoryViewModel.cs:44-54` |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** `HistoryViewModel.AggregateTypes` exposes eight entries: `null`
 (Raw) plus Average, Minimum, Maximum, Count, Start, End, and `StandardDeviation`.
@@ -250,7 +250,7 @@ stale relative to the code.
 **Recommendation:** Update the "Aggregate" row in `docs/Client.UI.md` to include
 Standard Deviation.
 
-**Resolution:** _(open)_
+**Resolution:** Resolved 2026-05-23 — Added "Standard Deviation" to the Aggregate row of the Query Options table in `docs/Client.UI.md` so it matches the eighth entry already exposed by `HistoryViewModel.AggregateTypes`.
 
 ### Client.UI-010
 
@@ -259,7 +259,7 @@ Standard Deviation.
 | Severity | Low |
 | Category | Code organization & conventions |
 | Location | `Controls/DateTimeRangePicker.axaml.cs:33-37`, `Controls/DateTimeRangePicker.axaml.cs:70-80` |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** `DateTimeRangePicker` declares `MinDateTimeProperty` /
 `MaxDateTimeProperty` styled properties with public CLR accessors, but neither is
@@ -272,7 +272,7 @@ constraint the control does not enforce.
 path (turn out-of-range input red, as invalid input already is) or remove the two
 unused styled properties.
 
-**Resolution:** _(open)_
+**Resolution:** Resolved 2026-05-23 — Removed `MinDateTimeProperty` / `MaxDateTimeProperty` and their CLR accessors from `DateTimeRangePicker.axaml.cs`. No XAML or external caller binds the properties (grep across the repo confirmed only the control file referenced them), so removing the dead API surface is the correct fix; adding min/max clamping would have been speculative behaviour without a calling site.
 
 ### Client.UI-011
 
@@ -281,7 +281,7 @@ unused styled properties.
 | Severity | Low |
 | Category | Documentation & comments |
 | Location | `Views/MainWindow.axaml:81`, `Services/JsonSettingsService.cs:11-15` |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** The certificate-store-path `TextBox` watermark reads
 `(default: AppData/LmxOpcUaClient/pki)`, referencing the legacy pre-task-#208
@@ -293,4 +293,4 @@ that no longer matches where settings and the PKI store actually live.
 **Recommendation:** Update the watermark to reference `OtOpcUaClient/pki`, or bind
 it to `ClientStoragePaths.GetPkiPath()` so it cannot drift again.
 
-**Resolution:** _(open)_
+**Resolution:** Resolved 2026-05-23 — Updated the watermark text in `Views/MainWindow.axaml` from `(default: AppData/LmxOpcUaClient/pki)` to `(default: AppData/OtOpcUaClient/pki)` so it matches the canonical folder name resolved by `ClientStoragePaths` (the binding-to-helper alternative was considered but a static string keeps the watermark cheap; the path is also already documented in `docs/Client.UI.md`).

code-reviews/Configuration/findings.md

@@ -7,7 +7,7 @@
 | Review date | 2026-05-22 |
 | Commit reviewed | `76d35d1` |
 | Status | Reviewed |
-| Open findings | 5 |
+| Open findings | 0 |
 
 ## Checklist coverage
 
@@ -78,13 +78,13 @@
 | Severity | Low |
 | Category | OtOpcUa conventions |
 | Location | `src/Core/ZB.MOM.WW.OtOpcUa.Configuration/Enums/NodePermissions.cs:8`, `src/Core/ZB.MOM.WW.OtOpcUa.Configuration/OtOpcUaConfigDbContext.cs:417` |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** `NodePermissions` is declared `[Flags] enum ... : uint`, while its XML doc and `NodeAcl.PermissionFlags`' doc both say "stored as int", and `ConfigureNodeAcl` uses `HasConversion<int>()` — a `uint`→`int` conversion. Only bits 0–11 are used today, but the underlying-type/storage-type mismatch is a latent trap: a future bit-31 flag yields a `uint` value that overflows `int` and the conversion round-trip would corrupt it.
 
 **Recommendation:** Change the enum underlying type to `int` (consistent with the docs and the conversion). No high bit is in use, so this is the smaller change.
 
-**Resolution:** _(open)_
+**Resolution:** Resolved 2026-05-23 — changed `NodePermissions` underlying type from `uint` to `int` so it matches the documented "stored as int" semantics and the `HasConversion<int>()` mapping in `OtOpcUaConfigDbContext.ConfigureNodeAcl`. Added regression test `NodePermissionsTests` pinning the underlying type and round-trip safety through `int` storage.
 
 ### Configuration-005
 
@@ -93,13 +93,13 @@
 | Severity | Low |
 | Category | Concurrency & thread safety |
 | Location | `src/Core/ZB.MOM.WW.OtOpcUa.Configuration/LocalCache/LiteDbConfigCache.cs:50` |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** `PutAsync` performs a non-atomic find-then-insert/update. Two concurrent `PutAsync` calls for the same `(ClusterId, GenerationId)` can both observe `existing is null` and both `Insert`, producing two rows for one generation. The constructor's `EnsureIndex` calls are non-unique, so the storage layer does not prevent the duplicate, and `PruneOldGenerationsAsync`'s `keepLatest` accounting is then off.
 
 **Recommendation:** Declare a unique index on `(ClusterId, GenerationId)` and treat the duplicate-key exception as an idempotent no-op, or guard `PutAsync` with an instance `SemaphoreSlim`/lock. Document the concurrency contract on `ILocalConfigCache`.
 
-**Resolution:** _(open)_
+**Resolution:** Resolved 2026-05-23 — guarded `PutAsync` with an instance-level `SemaphoreSlim` so the find-then-insert/update window runs atomically for a given cache instance; documented the concurrency contract on `ILocalConfigCache`. Added regression test `PutAsync_concurrent_for_same_cluster_and_generation_does_not_duplicate` that runs 64 concurrent puts and inspects the LiteDB file directly to confirm exactly one row per `(ClusterId, GenerationId)` survives.
 
 ### Configuration-006
 
@@ -123,13 +123,13 @@
 | Severity | Low |
 | Category | Error handling & resilience |
 | Location | `src/Core/ZB.MOM.WW.OtOpcUa.Configuration/Apply/GenerationApplier.cs:44` |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** `ApplyPass` wraps each callback in `catch (Exception ex)`. This swallows `OperationCanceledException` — a cancellation during a callback is recorded as just another entity error string and the applier keeps walking the remaining passes instead of stopping. It also masks fatal exceptions. The applier continues applying Added/Modified passes even after a Removed callback failed, leaving a partially-applied runtime state.
 
 **Recommendation:** Rethrow `OperationCanceledException` rather than recording it as an entity error; call `ct.ThrowIfCancellationRequested()` between passes. Document or enforce whether a failed Removed pass should abort before the Added/Modified passes run.
 
-**Resolution:** _(open)_
+**Resolution:** Resolved 2026-05-23 — added `catch (OperationCanceledException) when (ct.IsCancellationRequested) { throw; }` ahead of the generic catch in `ApplyPass` so genuine caller cancellation propagates rather than being recorded as an entity error, and added a `ct.ThrowIfCancellationRequested()` at the top of each Added/Modified pass iteration. The "failed Removed pass keeps walking Added/Modified" behaviour was confirmed as the intended contract (cascades must settle) and pinned by `Apply_continues_to_Added_pass_when_a_Removed_callback_throws`. New regression tests: `Apply_propagates_OperationCanceledException_from_callback_when_token_cancelled`, `Apply_stops_between_passes_when_cancellation_requested`.
 
 ### Configuration-008
 
@@ -168,13 +168,13 @@
 | Severity | Low |
 | Category | Security |
 | Location | `src/Core/ZB.MOM.WW.OtOpcUa.Configuration/LocalCache/ResilientConfigReader.cs:81` |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** On central-DB read failure the warning log records the full exception object. Callers pass arbitrary `centralFetch` delegates; if any delegate closes over a connection string, an exception thrown from it (or a `SqlException` carrying server/credential context) is logged verbatim. There is no scrubbing of connection-string fragments before logging, against the project's no-secret-logging rule.
 
 **Recommendation:** Log `ex.GetType().Name` and `ex.Message` for SQL failures rather than the full exception, or run exception messages through a connection-string scrubber before they reach the log sink.
 
-**Resolution:** _(open)_
+**Resolution:** Resolved 2026-05-23 — stopped passing the raw exception object to `LogWarning`; the fallback log now records only `ex.GetType().Name` and a `ScrubSecrets`-redacted `ex.Message` so connection-string fragments (Password, User Id, Pwd, Uid, AccessToken, Authorization, ApiKey/Api-Key) are stripped before reaching any sink. Added regression test `FallbackWarning_does_not_log_full_exception_object_or_password_fragment` that captures emitted log records and asserts no raw exception attached and no credential keyword present in the rendered message.
 
 ### Configuration-011
 
@@ -183,10 +183,10 @@
 | Severity | Low |
 | Category | Testing coverage |
 | Location | `src/Core/ZB.MOM.WW.OtOpcUa.Configuration/Apply/GenerationApplier.cs:7`, `src/Core/ZB.MOM.WW.OtOpcUa.Configuration/Validation/DraftValidator.cs:60` |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** The companion test project covers the cache, schema compliance, stored procedures, and `DraftValidator` well, but two flagged behaviours are not pinned: (a) `GenerationApplier` ordering/cancellation when a Removed callback fails — no test asserts the Added/Modified passes still run or that cancellation aborts; (b) `ValidatePathLength`'s constant 32+32 approximation — no test exercises a long Enterprise/Site. The publish-bypasses-validation bug (Configuration-001) is also untested against the live SQL fixture.
 
 **Recommendation:** Add `GenerationApplierTests` cases for a throwing callback (assert error recorded, assert cancellation propagates) and a `DraftValidatorTests` path-length boundary case. Add a `StoredProceduresTests` case that publishes an invalid draft and asserts it stays `Draft`.
 
-**Resolution:** _(open)_
+**Resolution:** Resolved 2026-05-23 — all three gaps now covered. (a) `GenerationApplierTests.Apply_continues_to_Added_pass_when_a_Removed_callback_throws` pins ordering; `Apply_propagates_OperationCanceledException_from_callback_when_token_cancelled` and `Apply_stops_between_passes_when_cancellation_requested` (added under Configuration-007) pin cancellation. (b) `DraftValidatorTests.PathLength_uses_actual_Enterprise_Site_when_provided` and `PathLength_conservative_fallback_when_Enterprise_Site_absent` (added under Configuration-003) pin the path-length boundary. (c) `StoredProceduresTests.Publish_aborts_when_ValidateDraft_rejects_the_draft` (added under Configuration-001) pins the publish-bypasses-validation regression against the live SQL fixture.

code-reviews/Core.Abstractions/findings.md

@@ -7,7 +7,7 @@
 | Review date | 2026-05-22 |
 | Commit reviewed | `76d35d1` |
 | Status | Reviewed |
-| Open findings | 5 |
+| Open findings | 0 |
 
 ## Checklist coverage
 
@@ -84,13 +84,13 @@ a category produced nothing rather than leaving it blank.
 | Severity | Low |
 | Category | Concurrency & thread safety |
 | Location | `src/Core/ZB.MOM.WW.OtOpcUa.Core.Abstractions/DriverTypeRegistry.cs:23-40` |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** `Register` performs a check-then-act sequence (`snapshot.ContainsKey` then build `next` then `Interlocked.Exchange`) that is not atomic. Two threads registering concurrently can both pass the duplicate check and both build a `next` dictionary; the second `Interlocked.Exchange` then wins and silently discards the first registration, defeating the documented "registered only once" guarantee. The class XML doc states registration happens single-threaded at startup, so this is not a live defect — but the use of `Interlocked.Exchange` for the swap implies the type is fully thread-safe for writers, which it is not. The mismatch between the implementation's apparent intent and its actual guarantee is a maintenance hazard.
 
 **Recommendation:** Either guard `Register` with a `lock` so the check-build-swap is atomic, or strengthen the XML `Thread-safety` remark to state explicitly that concurrent `Register` calls are unsupported and only reader/writer concurrency is safe.
 
-**Resolution:** _(open)_
+**Resolution:** Resolved 2026-05-23 — guarded the duplicate check + copy-on-write rebuild + swap with a private `Lock`, making the check-build-swap atomic. Added `Register_ConcurrentDistinctTypes_AllSucceed` and `Register_ConcurrentDuplicateType_ExactlyOneWins` tests that exercise 16/32 racing threads and assert the "registered only once" guarantee holds.
 
 ### Core.Abstractions-005
 
@@ -99,13 +99,13 @@ a category produced nothing rather than leaving it blank.
 | Severity | Low |
 | Category | Error handling & resilience |
 | Location | `src/Core/ZB.MOM.WW.OtOpcUa.Core.Abstractions/PollGroupEngine.cs:90,99` |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** Both the initial-poll and steady-state catch blocks use a bare `catch { }` that swallows every exception type, including non-transient programmer errors such as `NullReferenceException` and `ArgumentOutOfRangeException` (see Core.Abstractions-002). The XML remark says "transient poll error — loop continues, driver health surface logs it", but the engine never actually notifies the driver — there is no callback or event for a caught exception, so the driver's health surface has nothing to log. A persistently failing reader produces a silently spinning loop with zero observability from inside this module.
 
 **Recommendation:** Narrow the catch to the exception types a reader is expected to throw (or at least exclude obviously-fatal ones), and add an optional `Action<Exception>` error callback (or raise an event) so the owning driver can record poll failures on its health surface as the doc claims happens.
 
-**Resolution:** _(open)_
+**Resolution:** Resolved 2026-05-23 — narrowed the catch blocks with an `IsFatal` guard so `OutOfMemoryException` / `StackOverflowException` / `AccessViolationException` / `ThreadAbortException` propagate instead of being swallowed; added an optional `Action<Exception>? onError` constructor parameter (backward-compatible — every existing driver call site uses named args and is unaffected) and routed every caught reader / contract-violation exception through a `ReportError` helper that defends against a buggy error sink. Also tolerates `ObjectDisposedException` from `Task.Delay` against an already-disposed CTS (defensive race-safety). Added `Reader_exception_is_reported_to_onError_callback`, `Reader_contract_violation_routes_to_onError_callback`, and `OnError_handler_that_throws_does_not_crash_loop` regression tests.
 
 ### Core.Abstractions-006
 
@@ -114,13 +114,13 @@ a category produced nothing rather than leaving it blank.
 | Severity | Low |
 | Category | Code organization & conventions |
 | Location | `src/Core/ZB.MOM.WW.OtOpcUa.Core.Abstractions/IHistoryProvider.cs:63,84-86`, `src/Core/ZB.MOM.WW.OtOpcUa.Core.Abstractions/Historian/IHistorianDataSource.cs:30,63` |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** The two history-read surfaces use inconsistent integer types for the same "maximum rows" concept. `IHistoryProvider.ReadRawAsync` and `IHistorianDataSource.ReadRawAsync` take `uint maxValuesPerNode`, but `ReadEventsAsync` (on both interfaces) takes `int maxEvents`. The OPC UA `HistoryRead` service request fields are unsigned, and a negative `maxEvents` has no defined meaning. Mixing `int` and `uint` for the same parameter role across sibling methods forces every caller and implementer to reason about the inconsistency and risks accidental sign issues at the boundary.
 
 **Recommendation:** Standardize on `uint` for all max-rows parameters across both `IHistoryProvider` and `IHistorianDataSource` (or document explicitly why `maxEvents` differs).
 
-**Resolution:** _(open)_
+**Resolution:** Resolved 2026-05-23 — took the documented-difference path (signature change would cross ten files outside Core.Abstractions). `int maxEvents` is intentionally signed: callers and downstream historian adapters (`WonderwareHistorianClient`, `HistorianDataSource`) treat `maxEvents <= 0` as a "use the backend's default cap" sentinel that has no `uint` equivalent. Updated XML docs on both `IHistoryProvider.ReadEventsAsync` and `IHistorianDataSource.ReadEventsAsync` to spell out the asymmetry and rationale. Added `HistoryRead_MaxParameter_TypePinned` / `HistoryProvider_MaxParameter_TypePinned` contract tests so an accidental future flip is caught.
 
 ### Core.Abstractions-007
 
@@ -129,13 +129,13 @@ a category produced nothing rather than leaving it blank.
 | Severity | Low |
 | Category | Testing coverage |
 | Location | `tests/Core/ZB.MOM.WW.OtOpcUa.Core.Abstractions.Tests/PollGroupEngineTests.cs` |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** `PollGroupEngine` is the only behavioural (non-DTO) type in the module and its tests, while solid for the happy paths, miss two paths that this review identifies as defect-prone: (a) no test exercises an array-valued tag whose contents are unchanged across polls (would catch Core.Abstractions-001), and (b) no test exercises a reader that returns a snapshot list shorter than the input references (would catch Core.Abstractions-002). The `Reader_exception_does_not_crash_loop` test only covers a reader that throws before producing any result. `DataValueSnapshot` change-detection semantics for reference-typed values are therefore unverified.
 
 **Recommendation:** Add tests for the unchanged-array case and the short-result-list case once Core.Abstractions-001/002 are addressed, so the intended contract is locked down.
 
-**Resolution:** _(open)_
+**Resolution:** Resolved 2026-05-23 — the gap is filled by the regression tests added when Core.Abstractions-001 and -002 were closed: `Array_valued_tag_unchanged_contents_raises_only_once`, `Array_valued_tag_changed_contents_raises_event`, and `Reader_short_result_list_raises_descriptive_exception_and_loop_continues` lock the two previously-untested paths down. The fixes for -004 / -005 / -008 added a further nine regression tests (`Register_ConcurrentDistinctTypes_AllSucceed`, `Register_ConcurrentDuplicateType_ExactlyOneWins`, `Reader_exception_is_reported_to_onError_callback`, `Reader_contract_violation_routes_to_onError_callback`, `OnError_handler_that_throws_does_not_crash_loop`, `LastError_IsIndependent_OfState`, `DriverState_EnumContainsExpectedMembers`, `HistoryRead_MaxParameter_TypePinned`, `HistoryProvider_MaxParameter_TypePinned`, `HistoryProvider_OptionalMethods_HaveDefaultImplementation`). Total test count rose from 57 to 75.
 
 ### Core.Abstractions-008
 
@@ -144,7 +144,7 @@ a category produced nothing rather than leaving it blank.
 | Severity | Low |
 | Category | Documentation & comments |
 | Location | `src/Core/ZB.MOM.WW.OtOpcUa.Core.Abstractions/DriverHealth.cs:9`, `src/Core/ZB.MOM.WW.OtOpcUa.Core.Abstractions/IHistoryProvider.cs:39-43,65-69` |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** Two XML-doc inaccuracies:
 
@@ -153,4 +153,4 @@ a category produced nothing rather than leaving it blank.
 
 **Recommendation:** Reword `DriverHealth.LastError` to "Most recent error message; may be null when no error has been recorded" without tying nullness to a specific state. Add a one-line note on `IHistoryProvider`/`IHistorianDataSource` explaining why one surface uses default methods and the other does not.
 
-**Resolution:** _(open)_
+**Resolution:** Resolved 2026-05-23 — reworded `DriverHealth.LastError` to "null when no error has been recorded" and called out that the field is independent of `State`. Added an asymmetry `<remarks>` to `IHistoryProvider` (default-impl-throws so legacy drivers compile) and to `IHistorianDataSource.ReadEventsAsync` (required because server-side historians own the full surface) cross-referencing the finding. Added `LastError_IsIndependent_OfState` + `DriverState_EnumContainsExpectedMembers` and `HistoryProvider_OptionalMethods_HaveDefaultImplementation` contract tests so the asymmetry pins.

code-reviews/Core.AlarmHistorian/findings.md

@@ -7,7 +7,7 @@
 | Review date | 2026-05-22 |
 | Commit reviewed | `76d35d1` |
 | Status | Reviewed |
-| Open findings | 2 |
+| Open findings | 0 |
 
 ## Checklist coverage
 
@@ -138,13 +138,13 @@
 | Severity | Low |
 | Category | Performance & resource management |
 | Location | `src/Core/ZB.MOM.WW.OtOpcUa.Core.AlarmHistorian/SqliteStoreAndForwardSink.cs:107-127,255-278` |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** Each `EnqueueAsync` (one per alarm transition — a hot path on a busy plant) opens a connection, runs `EnforceCapacity` (a `COUNT(*)` over the queue table on every single enqueue), serializes JSON, inserts, and closes the connection. The unconditional `COUNT(*)` on every enqueue is an avoidable scan; the open/close churn defeats connection pooling benefits and adds lock-acquisition overhead per event. `DrainOnceAsync` similarly opens three separate connections per tick (`PurgeAgedDeadLetters`, `ReadBatch`, the transaction block).
 
 **Recommendation:** Reuse a single pooled write connection. Replace the per-enqueue `COUNT(*)` with a periodic capacity check (every Nth enqueue, or piggy-backed on the drain tick), or maintain an in-memory approximate counter. Combine the drain-tick connections into one.
 
-**Resolution:** _(open)_
+**Resolution:** Resolved 2026-05-23 — added an `Interlocked`-guarded in-memory `_queuedRowCount` seeded from storage at construction and kept current by every mutation (enqueue increment, drain Ack/PermanentFail/corrupt-dead-letter decrements, capacity-eviction adjustment, RetryDeadLettered re-add). `EnqueueAsync` now short-circuits capacity enforcement against the cached counter via `EnforceCapacityFastPathAsync`, only paying for a real `COUNT(*)` when the cached value reaches the capacity wall or the periodic resync interval (every 10,000 enqueues) elapses; the obsolete sync `EnforceCapacity` was removed. `GetStatus()` reads `QueueDepth` from the same counter so a busy Admin UI no longer hits the DB for it. `DrainOnceAsync` is consolidated onto one shared `SqliteConnection` per tick — purge, read, corrupt-dead-letter, and the outcome-applying transaction now reuse it instead of opening three. Regression tests `EnqueueAsync_does_not_count_all_rows_on_every_call_below_capacity`, `Enqueue_and_drain_keep_queue_depth_consistent_with_storage`, and `Counter_remains_consistent_under_concurrent_enqueue_and_drain` added.
 
 ### Core.AlarmHistorian-009
 
@@ -183,10 +183,10 @@
 | Severity | Low |
 | Category | Documentation & comments |
 | Location | `src/Core/ZB.MOM.WW.OtOpcUa.Core.AlarmHistorian/IAlarmHistorianSink.cs:5-9,76`, `AlarmHistorianEvent.cs:20` |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** Several doc-comments reference the retired v1 architecture. The `IAlarmHistorianSink` summary says ingestion "routes through Galaxy.Host's pipe" and `IAlarmHistorianWriter` says "Stream G wires this to the Galaxy.Host IPC client", but `docs/AlarmTracking.md` and `CLAUDE.md` state the legacy `Galaxy.Host` project was retired in PR 7.2 and the write path is now the Wonderware historian sidecar (`WonderwareHistorianClient`). `AlarmHistorianEvent.cs:20` likewise says "the Galaxy.Host handler maps to the historian's enum on the wire." These stale references will mislead a reader about where the writer is actually hosted.
 
 **Recommendation:** Update the doc-comments to refer to the Wonderware historian sidecar / `WonderwareHistorianClient` (`IAlarmHistorianWriter` implementation) instead of `Galaxy.Host`, consistent with `docs/AlarmTracking.md`'s "Historian write-back" section.
 
-**Resolution:** _(open)_
+**Resolution:** Resolved 2026-05-23 — the three stale `Galaxy.Host` references were already replaced ahead of this resolution by earlier commits (`bdca772` rewrote the `IAlarmHistorianSink` summary + `IAlarmHistorianWriter` summary to name the Wonderware historian sidecar / `WonderwareHistorianClient`; `f6d487b` rewrote the `AlarmHistorianEvent.EventKind` doc-comment). A fresh grep across the project confirms no remaining `Galaxy.Host` / "Stream G wires this" strings — only the legitimate `Galaxy-native` alarm-source label survives. Status flipped to Resolved during the -008 pass; no new source change was needed.

code-reviews/Core.ScriptedAlarms/findings.md

@@ -7,7 +7,7 @@
 | Review date | 2026-05-22 |
 | Commit reviewed | `76d35d1` |
 | Status | Reviewed |
-| Open findings | 6 |
+| Open findings | 0 |
 
 ## Checklist coverage
 
@@ -66,13 +66,13 @@ a category produced nothing rather than leaving it blank.
 | Severity | Low |
 | Category | Documentation & comments |
 | Location | `ScriptedAlarmEngine.cs:343`, `docs/ScriptedAlarms.md:107` |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** `docs/ScriptedAlarms.md` (Composition step 3) and the `OnUpstreamChange` comment ("Fire-and-forget so driver-side dispatch isn't blocked", line 225-226) describe the `OnEvent` emission path as non-blocking / fire-and-forget. In the code, `EmitEvent` invokes `OnEvent?.Invoke(this, evt)` **synchronously while `_evalGate` is held** (called from `EvaluatePredicateToStateAsync` line 305 and `ApplyAsync` line 217, both inside the gate). A slow subscriber blocks the single evaluation gate for all alarms; a subscriber that re-enters the engine (e.g. calls `AcknowledgeAsync`) deadlocks because `_evalGate` is a non-reentrant `SemaphoreSlim(1,1)`. The behaviour is defensible (the historian sink is non-blocking, per the doc), but the comments/doc are misleading about where the work happens and the re-entrancy hazard is undocumented.
 
 **Recommendation:** Either move `EmitEvent` outside the `_evalGate` critical section (collect emissions during the locked section and raise them after `Release()`), or document explicitly on `OnEvent` that handlers run under the engine lock, must be fast, and must never call back into the engine.
 
-**Resolution:** _(open)_
+**Resolution:** Resolved 2026-05-23 — split `EmitEvent` into `BuildEmission` (called under the gate to capture a coherent value-cache snapshot for message-template resolution) and `FireEvent` (called after `_evalGate.Release()` so subscribers can re-enter the engine without deadlocking and a slow subscriber no longer blocks concurrent engine operations). Updated `ApplyAsync`, `ReevaluateAsync`, `ShelvingCheckAsync`, and `LoadAsync` (startup-recovery path) to collect emissions in a pending list and flush after the gate is released; added regression tests for both the re-entry path and a white-box gate-acquirable-from-subscriber check.
 
 ### Core.ScriptedAlarms-004
 
@@ -111,13 +111,13 @@ a category produced nothing rather than leaving it blank.
 | Severity | Low |
 | Category | Concurrency & thread safety |
 | Location | `ScriptedAlarmEngine.cs:232`, `ScriptedAlarmEngine.cs:369` |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** `OnUpstreamChange` and `RunShelvingCheck` both launch fire-and-forget tasks (`_ = ReevaluateAsync(...)`, `_ = ShelvingCheckAsync(...)`) with `CancellationToken.None`. There is no tracking of these in-flight tasks, so `Dispose` cannot await them and a server shutdown can race a still-running re-evaluation that writes to the (possibly disposed) store. Combined with finding 005, an upstream push arriving during shutdown produces an unobserved background task touching torn state.
 
 **Recommendation:** Track outstanding background tasks (or use a single serialised worker / `Channel`), and link them to a `CancellationTokenSource` that `Dispose` cancels and drains. At minimum, await the in-flight work in `Dispose`.
 
-**Resolution:** _(open)_
+**Resolution:** Resolved 2026-05-23 — added `_inFlight` HashSet + `TrackBackgroundTask(...)` helper to register every fire-and-forget `ReevaluateAsync`/`ShelvingCheckAsync` task, with a sync `ContinueWith` continuation that auto-removes on completion. `Dispose` snapshots the set under its own lock and `Task.WhenAll(...).GetAwaiter().GetResult()` drains them before returning; `OnUpstreamChange` also short-circuits when `_disposed` is set so no new work is queued during shutdown. Regression test exercises the slow-store path: Dispose blocks until the in-flight `SaveAsync` completes.
 
 ### Core.ScriptedAlarms-007
 
@@ -141,13 +141,13 @@ a category produced nothing rather than leaving it blank.
 | Severity | Low |
 | Category | Performance & resource management |
 | Location | `Part9StateMachine.cs:261-268` |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** `AppendComment` copies the entire existing comment list into a new `List` on every audit-producing transition (ack, confirm, shelve, unshelve, enable, disable, add-comment, auto-unshelve). The `Comments` list is append-only and unbounded — for a long-lived alarm that is acknowledged/commented hundreds of times, every transition is an O(n) copy and the full history is also re-serialised to the store on every `SaveAsync`. Over a multi-month uptime this is a slowly growing per-transition cost.
 
 **Recommendation:** Acceptable for now given audit requirements, but consider an immutable persistent list / `ImmutableList<AlarmComment>` to make append O(log n), or have the store persist comments incrementally (append-only audit table) rather than rewriting the whole collection each save. At minimum, note the unbounded-growth characteristic in the design doc.
 
-**Resolution:** _(open)_
+**Resolution:** Resolved 2026-05-23 — switched `AlarmConditionState.Comments` from `IReadOnlyList<AlarmComment>` to `ImmutableList<AlarmComment>` and rewrote `AppendComment` as `existing.Add(...)` so each append is O(log n) instead of the prior O(n) copy. `ImmutableList<T>` still implements `IReadOnlyList<T>` so existing consumers compile unchanged; the persistence layer continues to store comments as JSON so wire-format is unaffected. Regression test asserts the runtime type is `ImmutableList<AlarmComment>`.
 
 ### Core.ScriptedAlarms-009
 
@@ -156,13 +156,13 @@ a category produced nothing rather than leaving it blank.
 | Severity | Low |
 | Category | Performance & resource management |
 | Location | `ScriptedAlarmEngine.cs:309-315`, `ScriptedAlarmEngine.cs:271` |
-| Status | Open |
+| Status | Won't Fix |
 
 **Description:** `BuildReadCache` allocates a fresh `Dictionary<string, DataValueSnapshot>` on every predicate evaluation, i.e. on every upstream tag change for every referencing alarm. On a busy line where many tags feeding many alarms change frequently, this is a steady stream of short-lived dictionary allocations on the hot path. `AlarmPredicateContext` is also newly constructed each evaluation (line 281).
 
 **Recommendation:** Minor. If the evaluation path shows up in allocation profiling, the read cache could be a reused per-alarm buffer cleared between evaluations (evaluations are already serialised under `_evalGate`, so a single shared scratch dictionary is safe). Not worth doing speculatively — flag for the perf surface in `docs/v2/Galaxy.Performance.md` if alarm evaluation is ever soak-tested.
 
-**Resolution:** _(open)_
+**Resolution:** Won't Fix 2026-05-23 — per the recommendation, no code change. Documented the known allocation characteristic in `docs/v2/Galaxy.Performance.md` (new "Scripted-alarm engine — known hot-path allocations" section) so a future soak that surfaces pressure has a noted mitigation (reused per-alarm scratch buffer) and we don't re-find this in a later review.
 
 ### Core.ScriptedAlarms-010
 
@@ -171,13 +171,13 @@ a category produced nothing rather than leaving it blank.
 | Severity | Low |
 | Category | Design-document adherence |
 | Location | `ScriptedAlarmEngine.cs:325-336`, `AlarmPredicateContext.cs:33-40`, `MessageTemplate.cs:47` |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** Quality handling is inconsistent across the three places that inspect a `DataValueSnapshot.StatusCode`. `AreInputsReady` (engine, line 333) treats only outright Bad (bit 31) as not-ready, so an Uncertain-quality input is fed to the predicate. `MessageTemplate.Resolve` (line 47) rejects *any* non-zero status code — including Uncertain — and renders `{?}`. `AlarmPredicateContext.GetTag` returns `BadNodeIdUnknown` (`0x80340000`) for a missing path. The net effect: an Uncertain-quality tag is considered good enough to drive an alarm *activation* decision but not good enough to print in the alarm *message*. `docs/ScriptedAlarms.md` ("Fallback rules") only documents the message-template behaviour and does not mention that predicate evaluation accepts Uncertain. The two policies should be reconciled and documented.
 
 **Recommendation:** Decide one quality policy for "is this input usable" and apply it in both `AreInputsReady` and the message resolver, or explicitly document why predicate evaluation and message rendering treat Uncertain differently. Add the predicate-side Uncertain rule to `docs/ScriptedAlarms.md`.
 
-**Resolution:** _(open)_
+**Resolution:** Resolved 2026-05-23 — documented the deliberate asymmetry. Added an "Input-quality policy" section to `docs/ScriptedAlarms.md` (table contrasting `AreInputsReady`'s Bad-only rejection with `MessageTemplate.Resolve`'s Good-only acceptance, plus the rationale) and a cross-referencing remarks block on `MessageTemplate.Resolve`. The two policies are kept distinct on purpose: predicate evaluation accepts Uncertain because the value is still inspectable, while the operator-facing message must render `{?}` to make the qualifier visible. Regression test locks in both behaviours with a single Uncertain-quality input that activates the alarm and surfaces `{?}` in the emission message.
 
 ### Core.ScriptedAlarms-011
 
@@ -186,13 +186,13 @@ a category produced nothing rather than leaving it blank.
 | Severity | Low |
 | Category | Code organization & conventions |
 | Location | `Part9StateMachine.cs:275` |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** `TransitionResult.NoOp(state, reason)` takes a `reason` string parameter that is documented in the calling code as a diagnostic ("disabled — predicate result ignored", "already acknowledged", etc.) but the factory method silently discards it — it just returns `new(state, EmissionKind.None)`, identical to `None(state)`. Every call site that passes a carefully-worded reason string is doing dead work, and the comments in `Part9StateMachine` and the class-level remarks claim disabled/no-op transitions "produce ... a diagnostic log line", which they do not.
 
 **Recommendation:** Either propagate the reason (add it to `TransitionResult` and have the engine log it at debug level when emission is `None` for a no-op), or remove the unused `reason` parameter and collapse `NoOp` into `None`. Update the `Part9StateMachine` remarks that promise a diagnostic log line.
 
-**Resolution:** _(open)_
+**Resolution:** Resolved 2026-05-23 — added a nullable `NoOpReason` property to `TransitionResult` (defaulted on the primary constructor so existing positional `new TransitionResult(state, kind)` call sites remain valid) and propagated it from `TransitionResult.NoOp(state, reason)`. `ScriptedAlarmEngine.ApplyAsync` now logs the reason at debug level via the alarm's script logger when the transition is a no-op, fulfilling the class-level remarks. Two regression tests assert that `NoOp` carries the reason and `None` does not.
 
 ### Core.ScriptedAlarms-012
 

code-reviews/Core.Scripting/findings.md

@@ -7,7 +7,7 @@
 | Review date | 2026-05-22 |
 | Commit reviewed | `76d35d1` |
 | Status | Reviewed |
-| Open findings | 5 |
+| Open findings | 0 |
 
 ## Checklist coverage
 
@@ -169,7 +169,7 @@ member-access call to a non-ctx `GetTag` is untested and would be misattributed.
 | Severity | Low |
 | Category | Correctness & logic bugs |
 | Location | `DependencyExtractor.cs:97` |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** A raw string literal token passed as the tag path (a raw triple-quote
 literal) tokenizes as `SingleLineRawStringLiteralToken` /
@@ -183,7 +183,7 @@ paths) but the error text would confuse anyone who does.
 `literal.IsKind(SyntaxKind.StringLiteralExpression)` on the expression node, or include
 the raw-string token kinds, so a static raw string is harvested rather than rejected.
 
-**Resolution:** _(open)_
+**Resolution:** Resolved 2026-05-23 — `HandleTagCall` now checks `literal.IsKind(SyntaxKind.StringLiteralExpression)` on the expression node, which covers regular string literals, single-line raw strings, and multi-line raw strings uniformly. Regression tests `Accepts_single_line_raw_string_literal_path` and `Accepts_multi_line_raw_string_literal_path` added to `DependencyExtractorTests`.
 
 ### Core.Scripting-006
 
@@ -192,7 +192,7 @@ the raw-string token kinds, so a static raw string is harvested rather than reje
 | Severity | Low |
 | Category | Concurrency & thread safety |
 | Location | `CompiledScriptCache.cs:55` |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** On a failed compile the `catch` block calls
 `_cache.TryRemove(key, out _)` without a value comparison. If two threads race a miss for
@@ -206,7 +206,7 @@ but the removal should be key+value scoped for correctness.
 remove only the specific faulted `Lazy` instance, so a concurrently re-added entry is not
 evicted.
 
-**Resolution:** _(open)_
+**Resolution:** Resolved 2026-05-23 — `GetOrCompile`'s catch block now evicts via `_cache.TryRemove(new KeyValuePair<string, Lazy<…>>(key, lazy))`, comparing the value reference so only the faulted Lazy is removed; a concurrent retry that re-inserted a fresh Lazy under the same key is preserved. Regression test `Failed_compile_eviction_does_not_remove_a_concurrent_retry_entry` added to `CompiledScriptCacheTests` (reflection-driven deterministic race: the faulted Lazy's factory swaps the dictionary entry to a fresh Lazy as a side effect of its throw, modelling the precise race window).
 
 ### Core.Scripting-007
 
@@ -240,7 +240,7 @@ race ordering.
 | Severity | Low |
 | Category | Performance & resource management |
 | Location | `CompiledScriptCache.cs:34`, `ScriptEvaluator.cs:34` |
-| Status | Open |
+| Status | Won't Fix |
 
 **Description:** `CompiledScriptCache` has no capacity bound (acknowledged in the class
 remarks) and no eviction. Each cached `ScriptEvaluator` holds a Roslyn `ScriptRunner<T>`
@@ -257,7 +257,7 @@ compile scripts into a collectible `AssemblyLoadContext` so `Clear()` can unload
 generations. At minimum add a note to `docs/ScriptedAlarms.md` so operators with
 high-publish-frequency deployments are aware.
 
-**Resolution:** _(open)_
+**Resolution:** Resolved 2026-05-23 — accepted as a documented known limitation rather than fixing in code (collectible `AssemblyLoadContext` for Roslyn-emitted assemblies is a v3 concern). The "Compile cache" section of `docs/VirtualTags.md` now carries a "Per-publish assembly accretion (accepted limitation, Core.Scripting-008)" note that operators with high-publish-frequency deployments can scan, and `docs/ScriptedAlarms.md` cross-references it. The accretion is benign at the expected "low thousands" of scripts scale; recommended mitigation is a scheduled server restart for deployments that publish very frequently.
 
 ### Core.Scripting-009
 
@@ -266,7 +266,7 @@ high-publish-frequency deployments are aware.
 | Severity | Low |
 | Category | Design-document adherence |
 | Location | `ForbiddenTypeAnalyzer.cs:45` |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** The Phase 7 plan decision #6
 (`docs/v2/implementation/phase-7-scripting-and-alarming.md`) enumerates the forbidden
@@ -283,7 +283,7 @@ authoritative deny-list exactly as `ForbiddenTypeAnalyzer.ForbiddenNamespacePref
 defines it, including the `System.Environment` allowed-compromise, so the docs match the
 code.
 
-**Resolution:** _(open)_
+**Resolution:** Resolved 2026-05-23 — `docs/v2/implementation/phase-7-scripting-and-alarming.md` decision #6 row + the "Sandbox escape" compliance-check row now enumerate the authoritative deny-list exactly as `ForbiddenTypeAnalyzer` defines it (namespace-prefix denies for `System.IO` / `System.Net` / `System.Diagnostics` / `System.Reflection` / `System.Threading.Tasks` / `System.Runtime.InteropServices` / `Microsoft.Win32`; type-granular denies for `System.Environment` / `System.AppDomain` / `System.GC` / `System.Activator` / `System.Threading.Thread`), and the compliance-check row lists the syntactic vectors (`typeof` / generic arg / cast / `is`/`as` / `default(T)` / array element / declared local) the broadened analyzer covers. `docs/VirtualTags.md` already documents the same list and is unchanged.
 
 ### Core.Scripting-010
 
@@ -318,7 +318,7 @@ assert a `ScriptSandboxViolationException` (or `CompilationErrorException`) at c
 | Severity | Low |
 | Category | Testing coverage |
 | Location | `tests/Core/ZB.MOM.WW.OtOpcUa.Core.Scripting.Tests/` |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** Two source files have no direct test coverage: `ScriptContext`
 (`Deadband` static helper is exercised only indirectly through `ScriptSandboxTests`, and
@@ -335,4 +335,4 @@ unverified.
 a script logging at Error level produces both a `scripts-*.log` event and a companion
 Warning event.
 
-**Resolution:** _(open)_
+**Resolution:** Resolved 2026-05-23 — added three new test files: `ScriptSandboxBuildTests` covers the `Build` null / non-`ScriptContext` / base-class / concrete-subclass paths; `ScriptContextTests` locks `Deadband` boundary semantics (equal-to-tolerance returns false; just-over returns true; symmetric in direction; zero-tolerance returns true only on non-equal; negative tolerance trips on any non-equal); the new `Factory_plus_companion_sink_integration_surfaces_script_error_in_both_logs` test in `ScriptLogCompanionSinkTests` wires `ScriptLoggerFactory` + the companion sink together end-to-end and asserts an Error emission lands in both the scripts sink (at Error) and the main sink (at Warning), each tagged with `ScriptName`. Suite now 101 green (was 85 before).

code-reviews/Core.VirtualTags/findings.md

@@ -7,7 +7,7 @@
 | Review date | 2026-05-22 |
 | Commit reviewed | `76d35d1` |
 | Status | Reviewed |
-| Open findings | 7 |
+| Open findings | 0 |
 
 ## Checklist coverage
 
@@ -124,7 +124,7 @@ collection is keyed off the registered set, not the raw input list.
 | Severity | Low |
 | Category | Correctness & logic bugs |
 | Location | `src/Core/ZB.MOM.WW.OtOpcUa.Core.VirtualTags/VirtualTagEngine.cs:349` |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** `CoerceResult`'s switch has a default arm (`_ => raw`) that returns the
 script's raw return value uncoerced for any `DriverDataType` not in the explicit list
@@ -139,7 +139,7 @@ the outer pipeline maps to BadInternalError) for an unsupported `DriverDataType`
 document precisely which `DriverDataType` values `CoerceResult` supports and validate at
 `Load` time that no definition declares an unsupported type.
 
-**Resolution:** _(open)_
+**Resolution:** Resolved 2026-05-23 — extended `CoerceResult` to cover every scalar `DriverDataType` (`Int16`, `UInt16`, `UInt32`, `UInt64` added); the default arm now throws (mapped to `BadInternalError`) instead of returning the uncoerced raw value, and a new `IsSupportedDataType` validation in `Load` rejects definitions declaring an unsupported type (currently `Reference`) so the typo is caught at publish time. Added regression tests for both Int16/UInt16/UInt32/UInt64 round-trip and the publish-time rejection.
 
 ### Core.VirtualTags-005
 
@@ -172,7 +172,7 @@ delivered before any subsequent change for that path.
 | Severity | Low |
 | Category | Concurrency & thread safety |
 | Location | `src/Core/ZB.MOM.WW.OtOpcUa.Core.VirtualTags/VirtualTagEngine.cs:177-182`, `:395-401` |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** `Subscribe` does `_observers.GetOrAdd(path, _ => [])` then
 `lock (list) { list.Add(observer); }`. When `Unsub.Dispose` removes the last observer,
@@ -188,7 +188,7 @@ but it makes any future "prune empty entries" logic racy.
 lock, re-checking emptiness inside the lock to avoid dropping a concurrently-added
 observer.
 
-**Resolution:** _(open)_
+**Resolution:** Resolved 2026-05-23 — `Unsub.Dispose` now removes the dictionary entry under the same lock when the observer list becomes empty, using the `ICollection<KeyValuePair>.Remove(key,value)` overload so a racing Subscribe's brand-new list is not collateral damage. `Subscribe` retries via the GetOrAdd / lock-and-reconfirm pattern so it cannot deposit an observer into a list that has already been pruned. Added a regression test that subscribes twice + disposes both and asserts the dictionary entry is gone.
 
 ### Core.VirtualTags-007
 
@@ -197,7 +197,7 @@ observer.
 | Severity | Low |
 | Category | Error handling & resilience |
 | Location | `src/Core/ZB.MOM.WW.OtOpcUa.Core.VirtualTags/TimerTriggerScheduler.cs:58` |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** `Tick` calls
 `_engine.EvaluateOneAsync(p, _cts.Token).GetAwaiter().GetResult()`, blocking the
@@ -214,7 +214,7 @@ if the previous one for that group is still running (a per-group "in flight" fla
 rather than blocking synchronously. At minimum, document the blocking behaviour and the
 expected upper bound on group evaluation time relative to the interval.
 
-**Resolution:** _(open)_
+**Resolution:** Resolved 2026-05-23 — rewrote `TimerTriggerScheduler` to use a per-`TickGroup` `InFlight` flag (`Interlocked.CompareExchange`-guarded). The timer callback no longer blocks on `GetAwaiter().GetResult()`; instead it kicks off an async `RunTickAsync` and skips the tick (incrementing the new `SkippedTickCount` diagnostic counter) when the prior tick for that group is still running. Added a regression test that runs a 250ms evaluation against a 50ms cadence and asserts `SkippedTickCount > 2`.
 
 ### Core.VirtualTags-008
 
@@ -246,7 +246,7 @@ O(V+E) cost into an O(closure) cost.
 | Severity | Low |
 | Category | Performance & resource management |
 | Location | `src/Core/ZB.MOM.WW.OtOpcUa.Core.VirtualTags/DependencyGraph.cs:64-65`, `:72-73` |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** `DirectDependencies` and `DirectDependents` allocate a fresh empty
 `HashSet<string>` on every call for an unregistered node. `DirectDependents` is called
@@ -257,7 +257,7 @@ on the change-cascade path.
 **Recommendation:** Return a shared static empty set for the miss case instead of
 allocating each time.
 
-**Resolution:** _(open)_
+**Resolution:** Resolved 2026-05-23 — `DependencyGraph` now exposes a shared static `EmptySet` instance and `DirectDependencies` / `DirectDependents` return it on a miss instead of allocating a fresh `HashSet<string>` every call. Added regression tests asserting `ReferenceEquals` across two miss calls.
 
 ### Core.VirtualTags-010
 
@@ -266,7 +266,7 @@ allocating each time.
 | Severity | Low |
 | Category | Documentation & comments |
 | Location | `src/Core/ZB.MOM.WW.OtOpcUa.Core.VirtualTags/ITagUpstreamSource.cs:18`, `VirtualTagContext.cs:30`, `VirtualTagDefinition.cs:28` |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** Several XML docs reference component names that do not exist in the
 codebase. `ITagUpstreamSource` XML doc says the subscription path "feeds the engine's
@@ -280,7 +280,7 @@ XML docs mislead maintainers searching for the named component.
 `CascadeAsync`, `EvaluateInternalAsync`) or drop the specific name in favour of a
 behavioural description.
 
-**Resolution:** _(open)_
+**Resolution:** Resolved 2026-05-23 — replaced the stale type names: `ITagUpstreamSource` now references `VirtualTagEngine.OnUpstreamChange` + `CascadeAsync`; `VirtualTagContext` references `VirtualTagEngine.OnScriptSetVirtualTag` + `CascadeAsync`; `VirtualTagDefinition.TimerInterval` references `VirtualTagEngine.EvaluateInternalAsync`.
 
 ### Core.VirtualTags-011
 
@@ -289,7 +289,7 @@ behavioural description.
 | Severity | Low |
 | Category | Code organization & conventions |
 | Location | `src/Core/ZB.MOM.WW.OtOpcUa.Core.VirtualTags/VirtualTagEngine.cs:404-409` |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** `VirtualTagState` records a Writes set (the `ctx.SetVirtualTag` targets
 extracted by `DependencyExtractor`), but nothing in the engine reads it -- it is captured
@@ -305,7 +305,7 @@ miss), so an operator typo is caught at publish rather than silently dropped at
 If validation is deliberately deferred, remove the unused field or comment why it is
 retained.
 
-**Resolution:** _(open)_
+**Resolution:** Resolved 2026-05-23 — `Load` now iterates every registered tag's `Writes` set and adds a `compileFailures` entry for any write target that does not resolve to a registered virtual tag. Updated the pre-existing Core.VirtualTags-012 "warning on non-registered path" test to assert publish-time rejection (the runtime warning branch remains as a defensive guard but the static `DependencyExtractor` enforces literal-string paths, so it is unreachable for any operator-authored script). Added a positive companion test confirming a write to a registered path still loads cleanly.
 
 ### Core.VirtualTags-012
 
@@ -342,7 +342,7 @@ correspond to open correctness findings and would have caught them.
 | Severity | Low |
 | Category | Documentation & comments |
 | Location | `src/Core/ZB.MOM.WW.OtOpcUa.Core.VirtualTags/DependencyGraph.cs:266-270` |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** `DependencyCycleException.BuildMessage` renders each cycle as
 `string.Join(" -> ", c) + " -> " + c[0]`, presenting the SCC member list as a traversable
@@ -356,4 +356,4 @@ into looking for an edge that is not in their config.
 path) rather than rendering arrows, or reconstruct an actual cycle path within the SCC
 (a single DFS back-edge walk) before formatting.
 
-**Resolution:** _(open)_
+**Resolution:** Resolved 2026-05-23 — `DependencyCycleException.BuildMessage` now formats each cycle as `cycle members: A, B, C` (comma-separated set) rather than the misleading `A -> B -> C -> A` arrow form. Added a regression test asserting the message contains the word "member" and does not fabricate an edge sequence.

code-reviews/Core/findings.md

@@ -7,7 +7,7 @@
 | Review date | 2026-05-22 |
 | Commit reviewed | `76d35d1` |
 | Status | Reviewed |
-| Open findings | 6 |
+| Open findings | 0 |
 
 ## Checklist coverage
 
@@ -78,13 +78,13 @@
 | Severity | Low |
 | Category | OtOpcUa conventions |
 | Location | `src/Core/ZB.MOM.WW.OtOpcUa.Core/Hosting/DriverHost.cs:55,72,87` |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** `DriverHost` is a library type whose async calls (`driver.InitializeAsync`, `driver.ShutdownAsync`) do not use `ConfigureAwait(false)`, whereas the sibling `CapabilityInvoker` and `AlarmSurfaceInvoker` in the same module consistently do. The server host has no synchronization context so behaviour is currently correct, but the inconsistency is a maintenance hazard and a deviation from the established convention in `Core.Resilience`.
 
 **Recommendation:** Add `.ConfigureAwait(false)` to the three awaited calls in `DriverHost.RegisterAsync`, `UnregisterAsync`, and `DisposeAsync`.
 
-**Resolution:** _(open)_
+**Resolution:** Resolved 2026-05-23 — added `.ConfigureAwait(false)` to the three awaited driver calls in `RegisterAsync`, `UnregisterAsync`, and `DisposeAsync`; added three `RegisterAsync/UnregisterAsync/DisposeAsync_Does_Not_Capture_SynchronizationContext` regression tests that install a tracking `SynchronizationContext` on a dedicated thread and assert zero captured posts.
 
 ### Core-005
 
@@ -138,13 +138,13 @@
 | Severity | Low |
 | Category | Error handling & resilience |
 | Location | `src/Core/ZB.MOM.WW.OtOpcUa.Core/OpcUa/GenericDriverNodeManager.cs:42-64` |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** The XML summary of `BuildAddressSpaceAsync` states "Driver exceptions are isolated per decision #12 — the driver's subtree is marked Faulted, but other drivers remain available." The method body contains no such isolation: an exception from `discovery.DiscoverAsync` propagates straight out unhandled, and nothing here marks a subtree Faulted. The isolation is presumably done by the server-layer caller, but the comment asserts behaviour this class does not implement.
 
 **Recommendation:** Either implement the documented isolation in `GenericDriverNodeManager`, or correct the XML doc to state that exception isolation is the caller's responsibility and name the type that performs it.
 
-**Resolution:** _(open)_
+**Resolution:** Resolved 2026-05-23 — corrected the `BuildAddressSpaceAsync` XML doc to (a) explicitly state exception isolation is the caller's responsibility, and (b) name the type that performs it (`Server.OpcUa.OpcUaApplicationHost.PopulateAddressSpaces`); added `BuildAddressSpaceAsync_Propagates_Discovery_Exceptions_To_Caller` regression test verifying the documented propagation behaviour.
 
 ### Core-009
 
@@ -153,13 +153,13 @@
 | Severity | Low |
 | Category | Performance & resource management |
 | Location | `src/Core/ZB.MOM.WW.OtOpcUa.Core/Resilience/CapabilityInvoker.cs:121-128` |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** `ExecuteWriteAsync` calls `_optionsAccessor()` three times for a single non-idempotent write (once for the `with` expression, once inside the dictionary initializer for `.Resolve(...)`, plus the discarded base). On the per-write hot path it rebuilds a fresh `DriverResilienceOptions` and a one-entry dictionary on every non-idempotent write, and the redundant accessor calls could observe two different snapshots if an Admin edit lands between them. Phase 6.1 budgets a 1% pipeline overhead; this is unnecessary allocation plus a minor consistency hazard.
 
 **Recommendation:** Capture `var options = _optionsAccessor();` once at the top of the non-idempotent branch and derive both the `with` and the `Resolve` call from that snapshot. Consider caching the no-retry pipeline keyed on `(hostName, non-idempotent)`.
 
-**Resolution:** _(open)_
+**Resolution:** Resolved 2026-05-23 — `ExecuteWriteAsync` now captures `_optionsAccessor()` into a single `snapshot` local at the top of the non-idempotent branch; the `with` expression and the `Resolve(Write)` call both derive from that snapshot so the two values are guaranteed coherent and only one accessor invocation occurs per call. Added `ExecuteWriteAsync_NonIdempotent_Snapshots_Options_Once_Per_Call` (counts invocations) and `ExecuteWriteAsync_NonIdempotent_Uses_Consistent_Options_Snapshot` (alternating-accessor) regression tests.
 
 ### Core-010
 
@@ -168,13 +168,13 @@
 | Severity | Low |
 | Category | Code organization & conventions |
 | Location | `src/Core/ZB.MOM.WW.OtOpcUa.Core/Resilience/DriverResilienceOptions.cs:45-52` |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** `DriverResilienceOptions.Resolve` indexes the tier-default dictionary directly (`defaults[capability]`) with no fallback. Any future addition to `DriverCapability` that is not also added to all three tier tables in `GetTierDefaults` will make `Resolve` throw `KeyNotFoundException` at runtime on the capability hot path rather than failing at build time. The two are coupled by convention only.
 
 **Recommendation:** Either add a `default` arm to `Resolve` returning a conservative policy (and logging), or add a unit-test invariant asserting every `DriverCapability` value is present in each tier's default table.
 
-**Resolution:** _(open)_
+**Resolution:** Resolved 2026-05-23 — `Resolve` now uses `TryGetValue` and throws a diagnostic `KeyNotFoundException` whose message names the missing capability + tier and points to `GetTierDefaults` when a capability is missing from both the override map and the tier table; the existing `TierDefaults_Cover_EveryCapability` test invariant prevents this in shipped code, and added `Resolve_Returns_NonNull_Policy_For_Every_Capability` (per-tier exhaustive) + `Resolve_Throws_Diagnostic_When_Capability_Missing_From_Tier_Defaults` regression tests.
 
 ### Core-011
 
@@ -183,13 +183,13 @@
 | Severity | Low |
 | Category | Testing coverage |
 | Location | `src/Core/ZB.MOM.WW.OtOpcUa.Core/Authorization/PermissionTrieBuilder.cs:58-75` |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** `PermissionTrieBuilder.Descend` has a two-branch behaviour: with a `scopePaths` lookup it descends the real hierarchy; without one it falls back to placing every non-cluster row directly under the root keyed by `ScopeId` ("works for deterministic tests, not for production"). The fallback silently produces a structurally incorrect trie when `scopePaths` is null or a row's `ScopeId` is missing — a UnsLine-scoped grant ends up as a direct child of the root, so `WalkEquipment` / `WalkSystemPlatform` never reach it and the grant is effectively dropped, with no diagnostic. There is no test asserting the production multi-level descent versus the fallback.
 
 **Recommendation:** Add unit tests covering `Build` with `scopePaths` producing the correct multi-level trie and the missing-`ScopeId` fallback. Have `Descend` surface a diagnostic (or throw outside test configuration) when a sub-cluster row cannot be located in `scopePaths`.
 
-**Resolution:** _(open)_
+**Resolution:** Resolved 2026-05-23 — added optional `Action<PermissionTrieBuildDiagnostic>? diagnostic` parameter to `PermissionTrieBuilder.Build`; `Descend` now invokes the callback with a `MissingScopePath` diagnostic when a sub-cluster row's `ScopeId` is absent from a supplied (non-null) `scopePaths` lookup so production callers can log + surface orphan grants instead of silently dropping them. New `PermissionTrieBuilderTests` covers (a) production multi-level descent with sibling-line non-leakage, (b) the deterministic-test fallback, (c) the diagnostic firing on a missing scope-path entry, (d) no diagnostic when all rows resolve, and (e) no diagnostic when `scopePaths` is null (explicit test mode).
 
 ### Core-012
 
@@ -198,10 +198,10 @@
 | Severity | Low |
 | Category | Documentation & comments |
 | Location | `src/Core/ZB.MOM.WW.OtOpcUa.Core/Stability/WedgeDetector.cs:26`, `src/Core/ZB.MOM.WW.OtOpcUa.Core/Observability/DriverHealthReport.cs:11-22` |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** Two stale doc comments. (1) `WedgeDetector` — the `<summary>` above the constructor reads "Whether the driver reported itself `DriverState.Healthy` at construction." The constructor takes only a `TimeSpan threshold` and the detector is documented as stateless; the comment describes nothing the constructor does. (2) `DriverHealthReport` — the `<remarks>` state matrix lists Unknown, Initializing, Healthy, Degraded, Faulted but `Aggregate` (lines 42-44) also folds `DriverState.Reconnecting` into the Degraded verdict. `Reconnecting` is a real `DriverState` member absent from the documented matrix.
 
 **Recommendation:** Replace the `WedgeDetector` constructor `<summary>` with an accurate description (e.g. "Construct with the wedge-detection threshold; values below 60 s clamp to 60 s"). Add `Reconnecting` to the `DriverHealthReport` `<remarks>` state matrix and state it maps to Degraded.
 
-**Resolution:** _(open)_
+**Resolution:** Resolved 2026-05-23 — replaced the `WedgeDetector(.ctor)` `<summary>` with an accurate "Construct with the wedge-detection threshold; values below 60 s clamp to 60 s" description plus a `<param>` block; added the `Reconnecting` row to the `DriverHealthReport` `<remarks>` state matrix and updated the verdict-rule prose. Added `WedgeDetectorTests.Doc_Constructor_Summary_Describes_Threshold_Clamp` and `DriverHealthReportTests.Doc_State_Matrix_Includes_Reconnecting` regression tests that parse the generated `.xml` doc to assert the strings, plus `Any_Reconnecting_WithoutFaultedOrNotReady_IsDegraded` confirming the documented Reconnecting → Degraded behaviour.

code-reviews/Driver.AbCip.Cli/findings.md

@@ -7,7 +7,7 @@
 | Review date | 2026-05-22 |
 | Commit reviewed | `76d35d1` |
 | Status | Reviewed |
-| Open findings | 6 |
+| Open findings | 0 |
 
 ## Checklist coverage
 
@@ -96,7 +96,7 @@ into `AbCipCommandBase`.
 | Severity | Low |
 | Category | Concurrency & thread safety |
 | Location | `src/Drivers/Cli/ZB.MOM.WW.OtOpcUa.Driver.AbCip.Cli/Commands/SubscribeCommand.cs:50-56,60-61` |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** The `OnDataChange` handler writes change lines to `console.Output`
 (a `TextWriter`) from the driver's poll-engine callback thread, while the command's
@@ -112,7 +112,12 @@ during the watch loop widens it.
 writes during the subscription with a shared lock so poll-thread and main-thread
 output cannot interleave.
 
-**Resolution:** _(open)_
+**Resolution:** Resolved 2026-05-23 — moved the "Subscribed to ... Ctrl+C to stop."
+banner write to BEFORE `driver.OnDataChange +=` (and therefore before
+`SubscribeAsync`). With the handler not yet attached when the banner runs, the
+poll thread cannot fire change events into `console.Output` concurrently with the
+main-thread banner write. After `+=` the only writer to `console.Output` is the
+poll-thread handler, so no interleaving is possible.
 
 ### Driver.AbCip.Cli-004
 
@@ -121,7 +126,7 @@ output cannot interleave.
 | Severity | Low |
 | Category | Error handling & resilience |
 | Location | `src/Drivers/Cli/ZB.MOM.WW.OtOpcUa.Driver.AbCip.Cli/Commands/SubscribeCommand.cs:28,58`; `AbCipCommandBase.cs:26-34` |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** `--interval-ms` (`IntervalMs`) is taken verbatim and passed as
 `TimeSpan.FromMilliseconds(IntervalMs)` to `SubscribeAsync` with no validation. A
@@ -135,7 +140,16 @@ downstream component to sanitise operator input is fragile. `--timeout-ms` on
 `ExecuteAsync` / in `AbCipCommandBase`, throwing a `CommandException` with the
 accepted range when out of bounds.
 
-**Resolution:** _(open)_
+**Resolution:** Resolved 2026-05-23 — added `SubscribeCommand.ValidateInterval(int)`
+(throws `CommandException` for `IntervalMs <= 0`) called at the top of
+`SubscribeCommand.ExecuteAsync`; moved `TimeoutMs > 0` validation into the
+`AbCipCommandBase.Timeout` getter (throws `CommandException` for non-positive
+`TimeoutMs`) and added a `_ = Timeout` touch in `SubscribeCommand.ExecuteAsync` to
+fire that guard before the driver opens. Other commands trip the same guard
+naturally via `BuildOptions(...).Timeout`. Regression tests
+`AbCipCommandBaseTests.Timeout_get_throws_CommandException_when_TimeoutMs_is_non_positive`
+and `SubscribeCommandIntervalTests.ValidateInterval_rejects_non_positive` cover
+both paths.
 
 ### Driver.AbCip.Cli-005
 
@@ -144,7 +158,7 @@ accepted range when out of bounds.
 | Severity | Low |
 | Category | Performance & resource management |
 | Location | `src/Drivers/Cli/ZB.MOM.WW.OtOpcUa.Driver.Cli.Common/DriverCommandBase.cs:51-59` |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** `ConfigureLogging` assigns a freshly created Serilog logger to the
 process-global `Log.Logger` but never calls `Log.CloseAndFlush()`. For a short-lived
@@ -159,7 +173,12 @@ module's review.)
 `AppDomain.ProcessExit` or a `finally` in the command), or have the CLI use a
 disposable logger scoped to `ExecuteAsync`.
 
-**Resolution:** _(open)_
+**Resolution:** Resolved 2026-05-23 — `Driver.Cli.Common` already exposes
+`DriverCommandBase.FlushLogging()` (a `Log.CloseAndFlush()` wrapper); the AB CIP
+CLI was not calling it. Added `FlushLogging()` in the `finally` block of all four
+commands (`ProbeCommand`, `ReadCommand`, `WriteCommand`, `SubscribeCommand`) so
+buffered Serilog output is flushed before the process exits, including the
+Ctrl+C-driven `subscribe` path. No edits to `Driver.Cli.Common` were needed.
 
 ### Driver.AbCip.Cli-006
 
@@ -168,7 +187,7 @@ disposable logger scoped to `ExecuteAsync`.
 | Severity | Low |
 | Category | Design-document adherence |
 | Location | `src/Drivers/Cli/ZB.MOM.WW.OtOpcUa.Driver.AbCip.Cli/AbCipCommandBase.cs:29-34` |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** `AbCipCommandBase` overrides the abstract `DriverCommandBase.Timeout`
 property with a getter derived from `TimeoutMs` and an empty `init` body
@@ -183,9 +202,13 @@ bug.
 **Recommendation:** Either drop the `init` accessor entirely (make the override a
 get-only expression-bodied property) or have the empty `init` throw
 `NotSupportedException` to make the "driven by TimeoutMs" contract explicit and
-fail-fast.
+fail-fast. (Drop is not viable because the abstract base declares `{ get; init; }`
+and an override must provide both accessors.)
 
-**Resolution:** _(open)_
+**Resolution:** Resolved 2026-05-23 — the `init` accessor now throws
+`NotSupportedException` with a message pointing the caller at `TimeoutMs`. A new
+test `AbCipCommandBaseTests.Timeout_setter_is_inert_and_does_not_silently_swallow_assignments`
+asserts that an object-initializer assignment to `Timeout` fails fast.
 
 ### Driver.AbCip.Cli-007
 
@@ -194,7 +217,7 @@ fail-fast.
 | Severity | Low |
 | Category | Testing coverage |
 | Location | `tests/Drivers/Cli/ZB.MOM.WW.OtOpcUa.Driver.AbCip.Cli.Tests/WriteCommandParseValueTests.cs` |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** The only test file covers `WriteCommand.ParseValue` and
 `ReadCommand.SynthesiseTagName` — both pure static helpers. There is no coverage for
@@ -213,7 +236,12 @@ driver CLIs.
 (`HostAddress`, `PlcFamily`, `DeviceName`), the supplied tag list, and the `Timeout`
 derived from `TimeoutMs`.
 
-**Resolution:** _(open)_
+**Resolution:** Resolved 2026-05-23 — added
+`tests/.../AbCipCommandBaseTests.cs` covering `BuildOptions` (probe disabled,
+controller-browse disabled, alarm-projection disabled, single device with
+`HostAddress` / `PlcFamily` / `cli-{Family}` device name, tag list passed verbatim,
+`Timeout` derived from `TimeoutMs`) and `DriverInstanceId` (`abcip-cli-{Gateway}`),
+plus the `RejectStructure` guard (throws for `Structure`, no-op for atomic types).
 
 ### Driver.AbCip.Cli-008
 
@@ -222,7 +250,7 @@ derived from `TimeoutMs`.
 | Severity | Low |
 | Category | Documentation & comments |
 | Location | `docs/Driver.AbCip.Cli.md:8-9` |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** `docs/Driver.AbCip.Cli.md` opens with "Second of four driver
 test-client CLIs (Modbus -> AB CIP -> AB Legacy -> S7 -> TwinCAT)." The count "four"
@@ -235,4 +263,6 @@ doc's "four" and the truncated chain are both stale.
 and complete the chain (Modbus -> AB CIP -> AB Legacy -> S7 -> TwinCAT -> FOCAS), or
 drop the explicit count and link `docs/DriverClis.md` as the authoritative roster.
 
-**Resolution:** _(open)_
+**Resolution:** Resolved 2026-05-23 — rewrote the lead paragraph to "Second of six
+driver test-client CLIs (Modbus -> AB CIP -> AB Legacy -> S7 -> TwinCAT -> FOCAS)"
+and added a link to `docs/DriverClis.md` as the authoritative roster.

code-reviews/Driver.AbCip/findings.md

@@ -7,7 +7,7 @@
 | Review date | 2026-05-22 |
 | Commit reviewed | `76d35d1` |
 | Status | Reviewed |
-| Open findings | 5 |
+| Open findings | 0 |
 
 ## Checklist coverage
 
@@ -123,13 +123,13 @@
 | Severity | Low |
 | Category | OtOpcUa conventions |
 | Location | `AbCipDriver.cs` (whole file), `AbCipAlarmProjection.cs`, `LibplctagTagRuntime.cs` |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** `CLAUDE.md` Library Preferences mandate Serilog with a rolling daily file sink. The driver has no logging at all: no `ILogger`/Serilog dependency is injected or used. Failure paths instead swallow exceptions into the `_health` string (`ReadSingleAsync`, `WriteAsync`, `FetchUdtShapeAsync` catch-all, `ProbeLoopAsync` empty catch, `AbCipAlarmProjection.RunPollLoopAsync` empty catch). An operator looking at server logs sees nothing for a probe loop failing every tick for hours, a template decode that silently returned null, or an alarm poll loop throwing every interval. The health surface carries only the last error message, so a transient error immediately overwrites a more important earlier one.
 
 **Recommendation:** Inject an `ILogger` (Serilog) and log at least device init failures, per-call read/write transport errors (debounced), probe-loop failures, template-read failures, and alarm-poll-loop exceptions. The health surface is for state, not for the audit trail.
 
-**Resolution:** _(open)_
+**Resolution:** Resolved 2026-05-23 — `AbCipDriver` and `AbCipAlarmProjection` now accept an optional `ILogger<AbCipDriver>` / `ILogger` (defaulting to `NullLogger` so the existing constructor surface stays compatible). Failure paths log through it: `InitializeAsync` (`LogError` on fault), `ReadSingleAsync` / `ReadGroupAsync` / `WriteAsync` (`LogWarning` on non-zero libplctag status + transport / type-conversion exceptions, with the affected tag + device on each entry), `ProbeLoopAsync` (`LogDebug` per swallowed tick), `FetchUdtShapeAsync` (`LogWarning` on template-read failure), and `AbCipAlarmProjection.RunPollLoopAsync` (`LogDebug` on swallowed tick). Six regression tests in `AbCipLoggingTests` exercise the new logger seam.
 
 ### Driver.AbCip-008
 
@@ -183,13 +183,13 @@
 | Severity | Low |
 | Category | Error handling & resilience |
 | Location | `AbCipDriver.cs:144-152`, `AbCipDriverOptions.cs:131-143` |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** `InitializeAsync` only starts probe loops when `_options.Probe.Enabled` is true AND `Probe.ProbeTagPath` is non-blank. When `Probe.Enabled` is true (the default) but `ProbeTagPath` is null (also the default; the doc comment says "PR 8 wires this up"), no probe runs at all and the device `HostState` stays `HostState.Unknown` forever. `GetHostStatuses()` then reports every device as Unknown indefinitely with no warning. An operator who enables the probe but does not set a probe tag gets a silently inert health surface rather than an error or a log line.
 
 **Recommendation:** When `Probe.Enabled` is true but no `ProbeTagPath` is configured, either fail initialization with a clear message, fall back to a family-default probe tag (the doc comment stated intent), or at minimum log a warning that the probe is enabled-but-inert.
 
-**Resolution:** _(open)_
+**Resolution:** Resolved 2026-05-23 — `InitializeAsync` now emits a `LogWarning` when `Probe.Enabled` is `true`, devices are configured, but `Probe.ProbeTagPath` is null/blank. The warning names the driver instance and explicitly states that no probe loops were started and `GetHostStatuses()` will report every device as `Unknown` until either a `ProbeTagPath` is set or `Probe.Enabled` is set to `false`. Initialization still succeeds (the probe is optional telemetry, not a hard requirement). Two `AbCipLoggingTests` cases cover the warn-on-enabled-but-blank and no-warn-on-disabled paths. The `AbCipProbeOptions.ProbeTagPath` doc-comment was also updated so the misconfiguration is documented in-place.
 
 ### Driver.AbCip-012
 
@@ -198,13 +198,13 @@
 | Severity | Low |
 | Category | Performance & resource management |
 | Location | `LibplctagTemplateReader.cs:15-35`, `AbCipDriver.cs:88-92` |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** `LibplctagTemplateReader` is created per `FetchUdtShapeAsync` call, and each call constructs a fresh libplctag `Tag` for the @udt pseudo-tag, initializes it (a CIP connection handshake), reads, and disposes it. There is no reuse of the `Tag` across template reads for the same device: every UDT shape fetch pays a full connect/init cost. `AbCipTemplateCache` caches the decoded shape so this only bites on the first fetch of each type, but discovery of a UDT-heavy controller still does one connect per type. The same per-call `Tag` construction applies to `LibplctagTagEnumerator`.
 
 **Recommendation:** Acceptable for a low-frequency discovery path, but consider pooling/reusing a single @udt-capable `Tag` per device for the duration of a discovery run, or document that the per-type connect cost is accepted.
 
-**Resolution:** _(open)_
+**Resolution:** Resolved 2026-05-23 — accepted per the recommendation's "document the per-type connect cost is accepted" branch; `AbCipTemplateCache` caches the decoded shape so only the first fetch per `(device, templateInstanceId)` pays the connect cost, and libplctag itself pools the underlying CIP connections per gateway+path so the TCP/EIP session is reused even when individual `Tag` instances are torn down. The class-level remarks on `LibplctagTemplateReader` now spell that out and call out when to revisit (telemetry showing discovery latency dominated by template-read connects).
 
 ### Driver.AbCip-013
 
@@ -213,13 +213,13 @@
 | Severity | Low |
 | Category | Design-document adherence |
 | Location | `AbCipDriverOptions.cs:70-73`, `PlcFamilies/AbCipPlcFamilyProfile.cs:13-19`, `LibplctagTagRuntime.cs:16-27` |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** `driver-specs.md` specifies the AB CIP per-device connection settings as discrete fields: Host, Path, PlcType, TimeoutMs, AllowPacking, ConnectionSize. The implementation instead collapses host + path into a single opaque ab:// URL string and exposes `PlcFamily` (which adds GuardLogix, not in the spec table). AllowPacking and ConnectionSize from the spec are not configurable per device: `AbCipPlcFamilyProfile` hard-codes `SupportsRequestPacking` and `DefaultConnectionSize` per family, and `LibplctagTagRuntime` never passes a connection-size or packing attribute to the `Tag` (it is constructed with only Gateway/Path/PlcType/Protocol/Name/Timeout). The family profile `DefaultConnectionSize`/`SupportsRequestPacking`/`MaxFragmentBytes` fields are computed but never applied to the wire layer: dead configuration.
 
 **Recommendation:** Either update `driver-specs.md` to describe the actual ab:// host-address model and the family-profile approach, and wire the profile ConnectionSize/packing values through to the libplctag `Tag` attributes; or expose AllowPacking/ConnectionSize as per-device options per the spec.
 
-**Resolution:** _(open)_
+**Resolution:** Resolved 2026-05-23 — took the "expose per-device options per the spec" branch. `AbCipDeviceOptions` now carries optional `AllowPacking` and `ConnectionSize` overrides (both default to `null` to inherit the family profile); `AbCipTagCreateParams` carries the resolved values; `DeviceState.BuildCreateParams` collapses every old per-call-site clone (read, write, probe, template, enumerator) into one helper that combines the per-device override with the family profile's `SupportsRequestPacking` / `DefaultConnectionSize` defaults. `LibplctagTagRuntime` now honours `AllowPacking` via the `Tag.AllowPacking` property — fixing the previously-dead family-profile setting. `ConnectionSize` is plumbed through `AbCipTagCreateParams` for forward-compat; libplctag.NET 1.5.2 has no direct `ConnectionSize` property, so an XML comment on `LibplctagTagRuntime` documents that current builds rely on the family-profile default at the wire layer until the wrapper exposes a direct property or we ship a custom tag-attribute path. `AbCipDriverFactoryExtensions` ParseOptions now reads `AllowPacking` + `ConnectionSize` from the driver-config JSON. Six regression tests in `AbCipPerDeviceConnectionOptionsTests` cover the new options.
 
 ### Driver.AbCip-014
 
@@ -243,10 +243,10 @@
 | Severity | Low |
 | Category | Documentation & comments |
 | Location | `AbCipDriver.cs:9-11`, `PlcTagHandle.cs:23-27,53-58`, `AbCipTemplateCache.cs:12-15`, `IAbCipTagEnumerator.cs:6-11`, `AbCipDriverOptions.cs:21` |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** Numerous comments are stale relative to the commit under review. `AbCipDriver.cs:9-11` says the driver "Implements IDriver only for now" with capabilities shipping "in subsequent PRs (3-8)" while the class already implements all of them. `PlcTagHandle.cs` says the plc_tag_destroy P/Invoke "is deferred to PR 3 ... PR 2 ships the lifetime scaffold + tests only" and `ReleaseHandle` "is a no-op", which now reads as a permanent unfinished-work marker (see Driver.AbCip-006). `AbCipTemplateCache.cs:12-15` says "Template shape read ... lands with PR 6 ... no reader writes to it yet" while `CipTemplateObjectDecoder` and `LibplctagTemplateReader` both exist and `FetchUdtShapeAsync` writes to the cache. `IAbCipTagEnumerator.cs:6-11` says the enumerator "Defaults to EmptyAbCipTagEnumeratorFactory" while the production default is `LibplctagTagEnumeratorFactory`. `AbCipDriverOptions.cs:21` says "AB discovery lands in PR 5", already shipped. `StyleGuide.md` explicitly says not to leave stale coming-soon notes.
 
 **Recommendation:** Sweep the module for PR-N forward references and "lands in PR X" notes that have been delivered; update them to describe present behavior. Where a comment marks genuinely unfinished work (e.g. `PlcTagHandle.ReleaseHandle`), convert it to a tracked TODO with an issue reference rather than a PR-number milestone.
 
-**Resolution:** _(open)_
+**Resolution:** Resolved 2026-05-23 — swept the module for stale PR-N forward references and replaced each with a description of present behaviour: `AbCipDriver.TemplateCache` summary, `AbCipDataType.cs` (PR 5 / PR 6 → references `CipTemplateObjectDecoder` + `AbCipTemplateCache`), `AbCipTagPath.cs` (PR 6 → references `AbCipTemplateCache`), `AbCipTemplateCache.cs` (the "lands with PR 6" remarks and the `AbCipUdtShape` summary), `IAbCipTagEnumerator.cs` (the `EmptyAbCipTagEnumeratorFactory`-defaults claim and the PR-5 stub line; `EmptyAbCipTagEnumerator` summary), `LibplctagTagEnumerator.cs` ("Task #178 closed the stub gap from PR 5"), `LibplctagTagRuntime.cs` (`Whole-UDT writes land in PR 6`), `AbCipDriverOptions.cs` (`Tags` summary, `ProbeTagPath` summary), and `AbCipPlcFamilyProfile.cs` ("Family-specific wire tests ship in PRs 9–12"). `PlcTagHandle.cs` was already deleted as part of Driver.AbCip-006's resolution. The only remaining "lands in" reference is the `AbCipDataType.Dt` ⇒ `Date/Time` mapping, which is product-domain wording, not a PR reference.

code-reviews/Driver.AbLegacy.Cli/findings.md

@@ -7,7 +7,7 @@
 | Review date | 2026-05-22 |
 | Commit reviewed | `76d35d1` |
 | Status | Reviewed |
-| Open findings | 6 |
+| Open findings | 0 |
 
 ## Checklist coverage
 
@@ -68,7 +68,7 @@ type (mirroring the existing `Bit` and unsupported-type branches). Either catch
 | Severity | Low |
 | Category | Correctness & logic bugs |
 | Location | `Commands/WriteCommand.cs:27-29`, `Program.cs:6-9` |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** The `--value` option help text states "booleans accept
 true/false/1/0", but `ParseBool` (`WriteCommand.cs:74-80`) and the error message
@@ -82,7 +82,10 @@ with both the code and the design doc.
 matching the wording used elsewhere (e.g. "booleans accept
 true/false, 1/0, on/off, yes/no").
 
-**Resolution:** _(open)_
+**Resolution:** Resolved 2026-05-23 — updated `WriteCommand.Value` description to
+list the full alias set: "booleans accept true/false, 1/0, on/off, yes/no".
+Regression test `CommandMetadataTests.WriteCommand_value_help_lists_full_boolean_alias_set`
+asserts the description contains every alias group.
 
 ### Driver.AbLegacy.Cli-003
 
@@ -91,7 +94,7 @@ true/false, 1/0, on/off, yes/no").
 | Severity | Low |
 | Category | Concurrency & thread safety |
 | Location | `Commands/SubscribeCommand.cs:47-53` |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** The `OnDataChange` handler calls `console.Output.WriteLine(line)`
 (the synchronous overload) directly from the `PollGroupEngine` poll thread. The
@@ -109,7 +112,10 @@ change events through a `Channel<string>` drained by a single consumer task, or
 guard the `WriteLine` with a lock. At minimum, document that the interleaving is
 accepted because output is human-facing and line-buffered.
 
-**Resolution:** _(open)_
+**Resolution:** Resolved 2026-05-23 — `SubscribeCommand` now serialises every
+console write through a shared `consoleGate` lock: the poll-thread
+`OnDataChange` callback and the command-thread "Subscribed to ..." line both take
+the lock before calling `WriteLine`. Comment in the source documents the intent.
 
 ### Driver.AbLegacy.Cli-004
 
@@ -118,7 +124,7 @@ accepted because output is human-facing and line-buffered.
 | Severity | Low |
 | Category | Error handling & resilience |
 | Location | `Commands/ProbeCommand.cs:37-56`, `Commands/ReadCommand.cs:39-50`, `Commands/WriteCommand.cs:48-59`, `Commands/SubscribeCommand.cs:41-76` |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** Every command does `await using var driver = new AbLegacyDriver(...)`
 *and* an explicit `await driver.ShutdownAsync(...)` in the `finally`. `AbLegacyDriver`
@@ -135,7 +141,12 @@ cleanup on every exit path including exceptions.
 since the commands deliberately pass `CancellationToken.None` to shutdown so teardown
 is not cut short by a cancelled `ct`.
 
-**Resolution:** _(open)_
+**Resolution:** Resolved 2026-05-23 — replaced `await using var driver` with a
+plain `var driver` in all four commands (`ProbeCommand`, `ReadCommand`,
+`WriteCommand`, `SubscribeCommand`), keeping the explicit
+`finally { await driver.ShutdownAsync(CancellationToken.None) }` as the single
+teardown path. Comment in each command documents the intent so readers do not
+have to verify idempotency.
 
 ### Driver.AbLegacy.Cli-005
 
@@ -144,7 +155,7 @@ is not cut short by a cancelled `ct`.
 | Severity | Low |
 | Category | Design-document adherence |
 | Location | `Commands/SubscribeCommand.cs:23-25`, `docs/Driver.AbLegacy.Cli.md:94-96` |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** The subscribe command interval option is `--interval-ms`
 (default 1000). `docs/Driver.AbLegacy.Cli.md` shows the subscribe example as
@@ -160,7 +171,13 @@ but the documented contract drifts between the two CLIs.
 `--interval-ms` description for parity with the AbCip CLI, and mention the
 `--interval-ms` long form + 1000 ms default in `docs/Driver.AbLegacy.Cli.md`.
 
-**Resolution:** _(open)_
+**Resolution:** Resolved 2026-05-23 — extended the `SubscribeCommand.IntervalMs`
+help text to match AbCip ("Publishing interval in milliseconds (default 1000).
+PollGroupEngine floors sub-250ms values.") and added a paragraph under the
+`subscribe` section in `docs/Driver.AbLegacy.Cli.md` naming the `-i` /
+`--interval-ms` long form, the 1000 ms default, and the 250 ms floor. Regression
+test `CommandMetadataTests.SubscribeCommand_interval_ms_help_notes_PollGroupEngine_floor`
+asserts the description mentions "250".
 
 ### Driver.AbLegacy.Cli-006
 
@@ -169,7 +186,7 @@ but the documented contract drifts between the two CLIs.
 | Severity | Low |
 | Category | Code organization & conventions |
 | Location | `Commands/ProbeCommand.cs:20-22` |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** `ProbeCommand` declares its `--type` option with no short alias,
 while `ReadCommand`, `WriteCommand`, and `SubscribeCommand` all declare `--type`
@@ -182,7 +199,13 @@ it silently rejected on `probe`.
 for consistency with the other three commands. (The AbCip CLI `ProbeCommand` has
 the same omission, so a cross-CLI sweep is worthwhile.)
 
-**Resolution:** _(open)_
+**Resolution:** Resolved 2026-05-23 — added the `'t'` short alias to
+`ProbeCommand.DataType`. Regression test
+`CommandMetadataTests.ProbeCommand_type_has_short_alias_t` (plus the parity test
+`Other_commands_keep_type_short_alias_t` for read/write/subscribe) asserts the
+short alias is present on every command. The same omission still exists in the
+AbCip CLI's `ProbeCommand` — flagged as a sibling sweep but out of scope for
+this module.
 
 ### Driver.AbLegacy.Cli-007
 
@@ -191,7 +214,7 @@ the same omission, so a cross-CLI sweep is worthwhile.)
 | Severity | Low |
 | Category | Testing coverage |
 | Location | `tests/Drivers/Cli/ZB.MOM.WW.OtOpcUa.Driver.AbLegacy.Cli.Tests/WriteCommandParseValueTests.cs` |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** The only test file in the CLI test project covers
 `WriteCommand.ParseValue` and `ReadCommand.SynthesiseTagName`. Two behaviours that
@@ -210,4 +233,11 @@ Driver.AbLegacy.Cli-001. `BuildOptions` is reachable via `InternalsVisibleTo`
 tag passthrough) and an overflow-input test for `ParseValue` so the fix for
 Driver.AbLegacy.Cli-001 is locked in by a regression test.
 
-**Resolution:** _(open)_
+**Resolution:** Resolved 2026-05-23 — added `BuildOptionsTests` (five tests:
+probe disabled, device shape from Gateway+PlcType, tag passthrough, timeout
+propagation, empty tag list) covering `AbLegacyCommandBase.BuildOptions` via a
+nested `TestCommand` subclass annotated with `[Command]` to satisfy the CliFx
+analyzer. The overflow path for `ParseValue` is already covered by
+`WriteCommandParseValueTests.ParseValue_out_of_range_throws_CommandException`
+(theory with `short.Parse` + `AnalogInt` overflow inputs), added when finding
+Driver.AbLegacy.Cli-001 was resolved.

code-reviews/Driver.AbLegacy/findings.md

@@ -7,7 +7,7 @@
 | Review date | 2026-05-22 |
 | Commit reviewed | `76d35d1` |
 | Status | Reviewed |
-| Open findings | 3 |
+| Open findings | 0 |
 
 ## Checklist coverage
 
@@ -141,7 +141,7 @@ decode the full 16-bit word and test bit 0.
 | Severity | Low |
 | Category | OtOpcUa conventions |
 | Location | `AbLegacyDriver.cs` (whole file) |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** The driver uses no `ILogger`/Serilog at all. Probe-loop failures,
 runtime initialisation failures, libplctag non-zero statuses, and read/write
@@ -155,7 +155,16 @@ string that the next read or write immediately clobbers.
 log probe transitions, runtime-init failures, and the first occurrence of a non-zero
 libplctag status per device.
 
-**Resolution:** _(open)_
+**Resolution:** Resolved 2026-05-23 — `AbLegacyDriver` now accepts an optional
+`ILogger<AbLegacyDriver>` (falls back to `NullLogger`), mirroring the Modbus / S7 /
+Galaxy driver pattern. `InitializeAsync` catch-path logs the init failure at Error
+level; `TransitionDeviceState` logs every probe transition (Warning on downgrade to
+Stopped, Information on recovery); `ReadAsync` logs the first non-zero libplctag
+status per device at Warning level via a re-armable `DeviceState.FirstNonZeroStatusLogged`
+latch so a permanently-bad PLC doesn't flood the rolling file. `AbLegacyDriverFactoryExtensions.Register`
+gains an optional `ILoggerFactory` parameter so the Server bootstrap can wire DI
+logging when it chooses; the legacy single-arg `CreateInstance` overload stays for
+back-compat. Regression coverage in `AbLegacyLoggerInjectionTests`.
 
 ### Driver.AbLegacy-006
 
@@ -293,7 +302,7 @@ into a real PCCC-STS path or delete it as dead code. The same defect exists in
 | Severity | Low |
 | Category | Performance & resource management |
 | Location | `AbLegacyDriver.cs:440` |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** `Dispose()` is implemented as
 `DisposeAsync().AsTask().GetAwaiter().GetResult()` - sync-over-async. `ShutdownAsync`
@@ -306,7 +315,16 @@ single-threaded synchronization context.
 must exist, perform the synchronous teardown directly (cancel CTSs, dispose runtimes)
 rather than blocking on the async path.
 
-**Resolution:** _(open)_
+**Resolution:** Resolved 2026-05-23 — `Dispose()` now performs the synchronous
+teardown directly (cancel probe CTSs, dispose runtimes, clear maps) rather than
+wrapping `DisposeAsync().AsTask().GetAwaiter().GetResult()`. The poll engine's
+`DisposeAsync` is drained with `.ConfigureAwait(false).GetAwaiter().GetResult()` so a
+captured single-threaded `SynchronizationContext` can never be the resumption target —
+the classic sync-over-async deadlock is structurally ruled out. Regression test
+`Dispose_under_single_threaded_sync_context_does_not_deadlock` drives the path
+through a cooperative single-threaded `SynchronizationContext` with a 2s pump timeout;
+`Dispose_runs_teardown_without_blocking_on_async_wait` and `Dispose_is_idempotent`
+cover the cleanup invariants.
 
 ### Driver.AbLegacy-012
 
@@ -345,7 +363,7 @@ unused fields and the doc comments that imply they are load-bearing.
 | Severity | Low |
 | Category | Code organization & conventions |
 | Location | `AbLegacyDriver.cs:340-345`, `AbLegacyDriver.cs:238-264` |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** Two minor organisational issues:
 1. `ResolveHost` returns `_options.Devices.FirstOrDefault()?.HostAddress ??
@@ -362,4 +380,17 @@ unused fields and the doc comments that imply they are load-bearing.
 document why falling back to the instance id is acceptable. For (2), record the
 array-addressing gap as a tracked follow-up.
 
-**Resolution:** _(open)_
+**Resolution:** Resolved 2026-05-23 —
+(1) `ResolveHost` carries a new XML-doc block that documents the three-step fallback
+chain (known tag → first device → `DriverInstanceId`) and explicitly cites the
+`IPerCallHostResolver` contract which requires implementations to return the driver's
+default-host string rather than throw on an unknown reference. The instance-id
+fallback is therefore the documented single-host behaviour, not a leaky fake. Three
+regression tests in `AbLegacyDisposeAndResolveHostTests` pin each branch of the chain
+(`ResolveHost_known_reference_returns_tag_device`,
+`ResolveHost_unknown_reference_with_devices_returns_first_device`,
+`ResolveHost_unknown_reference_no_devices_returns_driver_instance_id`).
+(2) `DiscoverAsync` now carries an inline tracked-follow-up comment that calls out
+the PCCC-file-as-array gap, notes the consistency with the PR-staged scope in
+`docs/v2/driver-specs.md`, and points to the Modbus `ArrayCount` flow as the pattern
+to mirror when multi-element addressing lands.

code-reviews/Driver.Cli.Common/findings.md

@@ -7,7 +7,7 @@
 | Review date | 2026-05-22 |
 | Commit reviewed | `76d35d1` |
 | Status | Reviewed |
-| Open findings | 2 |
+| Open findings | 0 |
 
 ## Checklist coverage
 
@@ -130,7 +130,7 @@ dispose the previous logger if reconfiguration is genuinely intended.
 | Severity | Low |
 | Category | Error handling & resilience |
 | Location | `src/Drivers/Cli/ZB.MOM.WW.OtOpcUa.Driver.Cli.Common/SnapshotFormatter.cs:68-70` |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** `FormatTable` calls `rows.Max(r => r.Tag.Length)` (and the same for the
 value and status columns) without guarding against empty input. When `tagNames` and
@@ -143,7 +143,13 @@ instead of producing an empty (header-only) table.
 separator, or an explicit "no rows" line), or use `DefaultIfEmpty(0).Max(...)` for the
 width computations.
 
-**Resolution:** _(open)_
+**Resolution:** Resolved 2026-05-23 — `FormatTable` guards each `rows.Max(...)` width
+computation with a `rows.Length == 0 ? "<HEADER>".Length : Math.Max(...)` ternary, so
+an empty batch read returns the header + separator rows (no data rows) instead of
+throwing `InvalidOperationException`. The fix was landed in commit `1433a1c` alongside
+the -002 work, and the regression test
+`SnapshotFormatterTests.FormatTable_with_empty_input_returns_header_only` (added under
+-005) exercises it.
 
 ### Driver.Cli.Common-005
 
@@ -178,7 +184,7 @@ empty-input and `DriverCommandBase` level-selection tests.
 | Severity | Low |
 | Category | Documentation & comments |
 | Location | `src/Drivers/Cli/ZB.MOM.WW.OtOpcUa.Driver.Cli.Common/SnapshotFormatter.cs:71`, `src/Drivers/Cli/ZB.MOM.WW.OtOpcUa.Driver.Cli.Common/DriverCommandBase.cs:9` |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** Two minor doc inaccuracies. (1) The comment at `SnapshotFormatter.cs:71`
 states the "source-time column is fixed-width (ISO-8601 to ms) so no max-measurement
@@ -194,4 +200,8 @@ library. The XML doc is stale relative to the shipped driver-CLI set.
 right-most and intentionally unpadded rather than claiming fixed width. Add FOCAS to the
 `DriverCommandBase` class-summary driver list.
 
-**Resolution:** _(open)_
+**Resolution:** Resolved 2026-05-23 — (1) `SnapshotFormatter.cs:71` comment reworded
+to state the source-time column is the right-most one and intentionally not
+measured/padded, calling out the null-timestamp `"-"` case explicitly. (2) FOCAS was
+added to the `DriverCommandBase` class-summary driver enumeration in commit `7ff356b`
+(landed alongside the -003 work).

code-reviews/Driver.FOCAS.Cli/findings.md

@@ -7,7 +7,7 @@
 | Review date | 2026-05-22 |
 | Commit reviewed | `76d35d1` |
 | Status | Reviewed |
-| Open findings | 5 |
+| Open findings | 0 |
 
 ## Checklist coverage
 
@@ -45,7 +45,7 @@ a category produced nothing rather than leaving it blank.
 | Severity | Low |
 | Category | Error handling & resilience |
 | Location | `Commands/WriteCommand.cs:58-68` |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** `WriteCommand.ParseValue` parses the numeric `--value` types
 (`Byte`/`Int16`/`Int32`/`Float32`/`Float64`) with `sbyte.Parse` / `short.Parse`
@@ -65,7 +65,16 @@ literal — consistent with how `ParseBool` already handles bad boolean input.
 The same pattern exists in the sibling S7 CLI; a shared helper in
 `Driver.Cli.Common` would fix both.
 
-**Resolution:** _(open)_
+**Resolution:** Resolved 2026-05-23 — wrapped the `ParseValue` numeric switch in
+`try/catch (FormatException)` and `try/catch (OverflowException)` that rethrow as
+`CliFx.Exceptions.CommandException` with a message naming the `--type` and the
+offending value, mirroring the friendly text the `Bit` path already produced.
+Added `WriteCommandParseValueTests` with [Theory] cases covering non-numeric
+input across `Byte`/`Int16`/`Int32`/`Float32`/`Float64`, overflow edges
+(sbyte ±1, short max+1, > int.MaxValue), and an assertion that the exception
+message names both the type and the offending value. A shared `Driver.Cli.Common`
+helper is the cleaner long-term fix (cross-CLI duplication remains) but is left
+to the Driver.Cli.Common review per this module's edit scope.
 
 ### Driver.FOCAS.Cli-002
 
@@ -74,7 +83,7 @@ The same pattern exists in the sibling S7 CLI; a shared helper in
 | Severity | Low |
 | Category | Concurrency & thread safety |
 | Location | `Commands/SubscribeCommand.cs:45-51` |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** The `subscribe` command attaches an `OnDataChange` handler that
 calls the synchronous `console.Output.WriteLine`. `OnDataChange` is raised from
@@ -93,7 +102,15 @@ console writes with a lock shared between the banner and the handler. Optionally
 detach the handler in the `finally` block before `ShutdownAsync` for symmetry
 with the `handle` teardown already present there.
 
-**Resolution:** _(open)_
+**Resolution:** Resolved 2026-05-23 — introduced a `writeLock` shared between the
+`OnDataChange` handler and the banner write so the poll-engine background thread
+and the CliFx invocation thread can't interleave partial lines. Added an
+explanatory comment above the handler explaining the CliFx-`IConsole` rationale
+and the synchronous-on-background-thread design — mirroring the Modbus / S7
+copies of this command. Also added a try/catch around the handler body so a
+transient stdout error cannot tear down the poll loop, and Serilog-warn-logs the
+swallowed exception. Added `SubscribeCommandConsoleHandlerTests` to guard the
+`writeLock` + CliFx-`IConsole` rationale against future copy-paste regressions.
 
 ### Driver.FOCAS.Cli-003
 
@@ -102,7 +119,7 @@ with the `handle` teardown already present there.
 | Severity | Low |
 | Category | Error handling & resilience |
 | Location | `FocasCommandBase.cs:19` (`CncPort`), `FocasCommandBase.cs:27` (`TimeoutMs`), `Commands/SubscribeCommand.cs:23` (`IntervalMs`) |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** The numeric command options `--cnc-port`, `--timeout-ms`, and
 `--interval-ms` are accepted without range validation. A zero or negative
@@ -120,7 +137,17 @@ timeout and interval strictly positive. The same gap exists across the sibling
 driver CLIs, so a shared validation helper in `Driver.Cli.Common` is the
 cleaner fix.
 
-**Resolution:** _(open)_
+**Resolution:** Resolved 2026-05-23 — added a protected `ValidateOptions(int?
+intervalMs = null)` helper on `FocasCommandBase` that rejects `--cnc-port`
+outside `1..65535`, non-positive `--timeout-ms`, and non-positive
+`--interval-ms` (when the caller passes one) with a `CliFx.Exceptions.CommandException`
+naming the option and the rejected value. `ProbeCommand` / `ReadCommand` /
+`WriteCommand` call `ValidateOptions()` without an interval, `SubscribeCommand`
+calls `ValidateOptions(IntervalMs)`. Added `FocasCommandBaseValidationTests`
+covering accept-defaults, reject out-of-range port (0, -1, 65536), reject
+non-positive timeout / interval, and skip-interval-when-omitted. A shared
+helper in `Driver.Cli.Common` is the cleaner cross-CLI fix and is recorded
+against that module's review.
 
 ### Driver.FOCAS.Cli-004
 
@@ -129,7 +156,7 @@ cleaner fix.
 | Severity | Low |
 | Category | Performance & resource management |
 | Location | `Commands/ProbeCommand.cs:37,54`; `Commands/ReadCommand.cs:37,46`; `Commands/WriteCommand.cs:45,54`; `Commands/SubscribeCommand.cs:39,73` |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** Every command declares `await using var driver = new FocasDriver(...)`
 **and** explicitly calls `await driver.ShutdownAsync(CancellationToken.None)` in
@@ -144,7 +171,14 @@ dead weight and obscures intent: a reader cannot tell whether the explicit
 and rely on `await using` for disposal, or drop `await using` and keep the
 explicit teardown — but not both. The same redundancy exists in the sibling CLIs.
 
-**Resolution:** _(open)_
+**Resolution:** Resolved 2026-05-23 — dropped the explicit
+`await driver.ShutdownAsync(CancellationToken.None)` calls from the `finally`
+blocks of `ProbeCommand`, `ReadCommand`, `WriteCommand`, and `SubscribeCommand`;
+`await using` is now the sole driver-disposal mechanism per command
+(`FocasDriver.DisposeAsync` itself runs `ShutdownAsync`). The subscribe command
+keeps `UnsubscribeAsync` in its finally because that is a subscription-lifecycle
+concern, not driver disposal. Added `CommandDisposalConventionsTests` to guard
+the source-level convention against regression.
 
 ### Driver.FOCAS.Cli-005
 
@@ -153,7 +187,7 @@ explicit teardown — but not both. The same redundancy exists in the sibling CL
 | Severity | Low |
 | Category | Design-document adherence |
 | Location | `Commands/WriteCommand.cs:50`, `Commands/ProbeCommand.cs:50` (via `SnapshotFormatter.FormatStatus`) |
-| Status | Open |
+| Status | Deferred |
 
 **Description:** `docs/Driver.FOCAS.Cli.md` documents `BadDeviceFailure` and
 `BadCommunicationError` as the key diagnostic signals an operator reads off
@@ -180,4 +214,14 @@ actually emit — at minimum `BadNotWritable`, `BadOutOfRange`, `BadNotSupported
 because the gap defeats this module documented `probe`/`write` diagnostic
 workflow; cross-reference the `Driver.Cli.Common` review.
 
-**Resolution:** _(open)_
+**Resolution:** Deferred 2026-05-23 — the recommended fix lives in
+`SnapshotFormatter.FormatStatus` inside the `Driver.Cli.Common` shared module,
+which is outside this module's edit scope. Driver.Cli.Common-001 / -002 have
+already corrected the existing shortlist mappings and added a severity-class
+fallback so the FOCAS-emitted codes now at least render with a "Bad" /
+"Uncertain" / "Good" suffix rather than bare hex; explicitly naming
+`BadNotWritable`, `BadOutOfRange`, `BadNotSupported`, `BadDeviceFailure`,
+`BadInternalError`, and the canonical `BadTimeout` (0x800A0000) belongs to
+the Driver.Cli.Common review's follow-up (and benefits every driver CLI, not
+just FOCAS). Re-open here only if Driver.Cli.Common declines to extend the
+shortlist.

code-reviews/Driver.FOCAS/findings.md

@@ -7,7 +7,7 @@
 | Review date | 2026-05-22 |
 | Commit reviewed | `76d35d1` |
 | Status | Reviewed |
-| Open findings | 5 |
+| Open findings | 0 |
 
 ## Checklist coverage
 
@@ -200,7 +200,7 @@ stale object.
 | Severity | Low |
 | Category | Error handling & resilience |
 | Location | `FocasDriver.cs:140-148`, `FocasDriver.cs:478-484`, `FocasDriver.cs:529-533`, `FocasAlarmProjection.cs:61-63` |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** Numerous `try { ... } catch {}` blocks swallow every exception with no
 logging - `ShutdownAsync` (CTS cancel/dispose), `RecycleLoopAsync` (`DisposeClient`),
@@ -215,7 +215,7 @@ solely on `GetHealth()`.
 poll/probe/recycle loops at `Debug`/`Warning`. Pass a logger into `FocasWireClient` so
 the per-response `Debug` entries it already emits are actually captured.
 
-**Resolution:** _(open)_
+**Resolution:** Resolved 2026-05-23 — `FocasDriver` now takes an optional `ILogger<FocasDriver>` (defaulting to `NullLogger`) and every previously-empty `catch { }` in `ShutdownAsync` / `ProbeLoopAsync` / `FixedTreeLoopAsync` / `RecycleLoopAsync` / `ReadActiveAlarmsAcrossDevicesAsync` now logs at `Debug` with the host address + context. `FocasAlarmProjection` also accepts an optional `ILogger` (forwarded by the driver) so its unsubscribe / dispose / per-tick poll swallows log. `WireFocasClientFactory` gained a logger-accepting overload that threads through to `FocasWireClient`, so its per-response `Debug` entries actually reach the host pipeline.
 
 ### Driver.FOCAS-008
 
@@ -224,7 +224,7 @@ the per-response `Debug` entries it already emits are actually captured.
 | Severity | Low |
 | Category | Performance & resource management |
 | Location | `FocasDriver.cs:201`, `FocasDriver.cs:253` |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** `ReadAsync` and `WriteAsync` call `FocasAddress.TryParse(def.Address)`
 on every operation, even though `InitializeAsync` already parsed and validated every
@@ -235,7 +235,7 @@ re-parses and allocates a `FocasAddress` record per tag per tick unnecessarily.
 parsed `FocasAddress` on `FocasTagDefinition` (or in a side dictionary), so the runtime
 read/write paths use the cached value.
 
-**Resolution:** _(open)_
+**Resolution:** Resolved 2026-05-23 — `FocasDriver` now holds a `_parsedAddressesByTagName` side dictionary populated at `InitializeAsync`. `ReadAsync` and `WriteAsync` look up the cached `FocasAddress` instance; the defensive fallback `TryParse` only fires if a tag was somehow not seeded. The cache is cleared on `ShutdownAsync`. Regression test `ReadAsync_uses_cached_FocasAddress_when_tag_definition_has_a_malformed_address_after_init` (and the matching `WriteAsync` variant) asserts the same `FocasAddress` instance is reused across calls.
 
 ### Driver.FOCAS-009
 
@@ -244,7 +244,7 @@ read/write paths use the cached value.
 | Severity | Low |
 | Category | Design-document adherence |
 | Location | `FocasDriverOptions.cs:110-115`, `FocasDriver.cs:468-486`, `FocasDriverFactoryExtensions.cs:75-80` |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** `FocasProbeOptions.Timeout` is parsed by the factory
 (`FocasProbeDto.TimeoutMs` to `FocasProbeOptions.Timeout`) but never consumed.
@@ -257,7 +257,7 @@ until the OS TCP timeout rather than the configured `Probe.Timeout`.
 around the `ProbeAsync` call, or remove the dead `Timeout` field from
 `FocasProbeOptions` / `FocasProbeDto` if it is genuinely not intended.
 
-**Resolution:** _(open)_
+**Resolution:** Resolved 2026-05-23 — `FocasDriver.ProbeLoopAsync` now wraps `client.ProbeAsync` in a linked `CancellationTokenSource` that fires after `Probe.Timeout` (skipped when the timeout is `<= TimeSpan.Zero`). On timeout the loop logs the cancellation at Debug and surfaces it as a failed probe, so a hung CNC socket transitions the host to `Stopped` at the configured budget instead of blocking on the OS TCP timeout. Regression test `ProbeLoop_cancels_a_slow_ProbeAsync_at_Probe_Timeout` asserts the cancellation reaches the fake `ProbeAsync` within the configured 100 ms.
 
 ### Driver.FOCAS-010
 
@@ -266,7 +266,7 @@ around the `ProbeAsync` call, or remove the dead `Timeout` field from
 | Severity | Low |
 | Category | Code organization & conventions |
 | Location | `IFocasClient.cs:210-227` (`FocasOpMode`), `FocasConstants.cs:42-78` (`FocasOperationMode`) |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** There are two parallel operation-mode-to-text mappings with divergent
 labels. `FocasOpMode.ToText` (used by the driver fixed-tree `OperationMode/ModeText`
@@ -278,7 +278,7 @@ inconsistent results depending on which path renders it.
 **Recommendation:** Consolidate to a single op-mode enum + `ToText` helper shared by
 both the wire layer and the driver projection, with one canonical label set.
 
-**Resolution:** _(open)_
+**Resolution:** Resolved 2026-05-23 — `FocasOperationModeExtensions.ToText` now delegates to `FocasOpMode.ToText((short)mode)`, so the wire layer and the driver fixed-tree projection render identical labels. `FocasOpMode` keeps its existing labels (`TJOG`, `TEACH_IN_HANDLE`, `Mode{n}` fallback), which are now the single canonical surface. Regression theory `OpMode_ToText_yields_the_same_label_in_both_namespaces` cross-checks every defined code; `OpMode_ToText_fallback_label_is_consistent` covers the unknown-code path.
 
 ### Driver.FOCAS-011
 
@@ -287,7 +287,7 @@ both the wire layer and the driver projection, with one canonical label set.
 | Severity | Low |
 | Category | Code organization & conventions |
 | Location | `IFocasClient.cs:275-287` (`FocasAlarmType`), `FocasAlarmProjection.cs:149-175` |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** `FocasAlarmType` declares its constants as `public const int`, but the
 only consumers - `FocasAlarmProjection.MapAlarmType(short type)` and
@@ -301,7 +301,7 @@ expected by `ReadAlarmsAsync`.
 **Recommendation:** Declare the `FocasAlarmType` constants as `short` (or make it an
 `enum : short`) so the type matches the wire field width and the projection signatures.
 
-**Resolution:** _(open)_
+**Resolution:** Resolved 2026-05-23 — every `FocasAlarmType` constant (`All`, `Parameter`, `PulseCode`, `Overtravel`, `Overheat`, `Servo`, `DataIo`, `MemoryCheck`, `MacroAlarm`) is now typed `short`, matching the wire field width on `cnc_rdalmmsg2` and the `switch (short type)` arms in `FocasAlarmProjection.MapAlarmType` / `MapSeverity`. Regression test `FocasAlarmType_constants_are_typed_short` uses reflection to guarantee the type is preserved against future drift.
 
 ### Driver.FOCAS-012
 

code-reviews/Driver.Galaxy/findings.md

@@ -7,7 +7,7 @@
 | Review date | 2026-05-22 |
 | Commit reviewed | `76d35d1` |
 | Status | Reviewed |
-| Open findings | 4 |
+| Open findings | 0 |
 
 ## Checklist coverage
 
@@ -93,13 +93,13 @@
 | Severity | Low |
 | Category | OtOpcUa conventions |
 | Location | `Runtime/EventPump.cs:81-88` |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** The `BoundedChannelOptions` comment states "Newest-dropped policy: when full, the producer's TryWrite returns false ... We do this manually rather than relying on `BoundedChannelFullMode.DropWrite`" — but the option is then set to `FullMode = BoundedChannelFullMode.Wait`. With `Wait`, `TryWrite` returning `false` on a full channel is correct behaviour, so the code works, but the comment naming the mode and the actual mode disagree, which is confusing for a maintainer deciding whether the policy is `Wait`, `DropWrite`, or `DropNewest`.
 
 **Recommendation:** Either reword the comment to say "we use `Wait` mode but never call the awaitable `WriteAsync` — `TryWrite` gives us synchronous newest-dropped semantics", or switch to `BoundedChannelFullMode.DropWrite` and keep the manual drop count. Make the comment and the mode consistent.
 
-**Resolution:** _(open)_
+**Resolution:** Resolved 2026-05-23 — reworded the `BoundedChannelOptions` comment to say "we use FullMode.Wait but never call the awaitable WriteAsync — only synchronous TryWrite, which returns false immediately on a full channel and lets us account for drops on the EventsDropped counter". Also explains why we deliberately do NOT use `BoundedChannelFullMode.DropWrite` (it would silently discard without surfacing on the counter). Comment and `FullMode` value now agree.
 
 ### Driver.Galaxy-006
 
@@ -168,13 +168,13 @@
 | Severity | Low |
 | Category | Security |
 | Location | `GalaxyDriver.cs:311-341` |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** `ResolveApiKey` supports an `env:`/`file:` indirection and otherwise treats the config string as the literal API key ("Anything else — used as the literal API key. Convenient for dev"). `GalaxyGatewayOptions`' own XML doc claims "the API key never appears in cleartext config". The literal-key fallback silently permits a plaintext API key in the `DriverConfig` JSON column of the central config DB, contradicting the documented contract. There is no warning logged when the literal path is taken.
 
 **Recommendation:** Log a startup warning when `ResolveApiKey` falls through to the literal arm so an operator who accidentally committed a cleartext key sees it, and update the `GalaxyGatewayOptions` doc comment so it no longer over-promises. Consider gating the literal arm behind an explicit `dev:`-style prefix so a cleartext key cannot be used by accident.
 
-**Resolution:** _(open)_
+**Resolution:** Resolved 2026-05-23 — (a) added a logger-aware `ResolveApiKey(string, ILogger?)` overload that emits a `Warning` when the back-compat literal arm is taken, and wired the `BuildClientOptions` call site to pass `_logger`; (b) added an explicit `dev:KEY` prefix that returns the literal value without warning, so dev rigs / parity tests can opt-in deliberately; (c) rewrote the `GalaxyGatewayOptions.ApiKeySecretRef` XML doc so it no longer claims "the API key never appears in cleartext config" — it now documents all four supported forms (`env:`, `file:`, `dev:`, and the warning-on-literal back-compat path). Regression coverage in `GalaxyDriverApiKeyResolverTests` (`Literal_string_emits_warning_when_logger_supplied`, `Dev_prefix_returns_literal_without_warning`, `Env_prefix_does_not_emit_literal_warning`).
 
 ### Driver.Galaxy-011
 
@@ -198,13 +198,13 @@
 | Severity | Low |
 | Category | Performance & resource management |
 | Location | `Runtime/SubscriptionRegistry.cs:65-67`, `GalaxyDriver.cs:538`, `GalaxyDriver.cs:675` |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** Several hot paths are O(n^2) per call. `SubscriptionRegistry.ResolveSubscribers` does `entry.Bindings.FirstOrDefault(b => b.ItemHandle == itemHandle)` — a linear scan of the whole binding list for every event dispatch; at 50k tags this is 50k-element scans on the 1Hz fan-out path. `GalaxyDriver.SubscribeAsync` and `ReadViaSubscribeOnceAsync` correlate results to references with `results.FirstOrDefault(r => string.Equals(...))` inside a `for` loop over all references — O(n^2) over the subscribe batch. `SubscriptionRegistry.Remove` rebuilds a `ConcurrentBag` from a LINQ filter on every unsubscribe.
 
 **Recommendation:** Index `SubscriptionEntry` bindings by item handle (a `Dictionary<int, string>` per entry) so `ResolveSubscribers` is O(1) per subscriber. Project the `SubscribeResult` list into a `Dictionary<string, SubscribeResult>` (OrdinalIgnoreCase) once before the correlation loop. These matter on the documented 50k-tag soak path.
 
-**Resolution:** _(open)_
+**Resolution:** Resolved 2026-05-23 — three changes: (a) `SubscriptionEntry` now carries a `FullRefByItemHandle` `Dictionary<int, string>` built once at construction; `ResolveSubscribers` does O(1) lookups per subscriber instead of a `FirstOrDefault` linear scan of the binding list. (b) Reverse map `_subscribersByItemHandle` swapped from `ConcurrentBag<long>` to `ImmutableHashSet<long>` — `Remove`/`Rebind` use `set.Remove(id)` (O(log n)) instead of "rebuild a new bag from a LINQ filter on every unsubscribe", and reads remain lock-free via atomic publication through `ConcurrentDictionary.AddOrUpdate`. (c) `GalaxyDriver.SubscribeAsync` + `ReadViaSubscribeOnceAsync` now index the `SubscribeResult` list once via the existing `BuildResultIndex` helper (already used by `ReplayAsync`) so per-reference correlation is O(1). Regression coverage in `SubscriptionRegistryTests.ResolveSubscribers_LargeBindingSet_DispatchesCorrectly`.
 
 ### Driver.Galaxy-013
 
@@ -213,13 +213,13 @@
 | Severity | Low |
 | Category | Design-document adherence |
 | Location | `GalaxyDriver.cs:14-27`, `GalaxyDriver.cs:374-382`, `Config/GalaxyDriverOptions.cs:84-86` |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** Multiple doc comments are stale relative to the shipped code. `GalaxyDriver`'s class summary still describes the file as "the project skeleton with `IDriver` bodies that wire to a future `IGalaxyGatewayClient` abstraction. Capability interfaces ... land in PRs 4.1-4.7" and references the legacy `GalaxyProxyDriver` coexisting "until PR 7.2" — but PR 7.2 already deleted the legacy Galaxy projects and the capability interfaces are all implemented. `ReinitializeAsync` is still a stub ("for the skeleton we just refresh health") that ignores `driverConfigJson` entirely — a config reapply silently does nothing. `GalaxyReconnectOptions.ReplayOnSessionLost` is defined and documented but never read anywhere in the driver (`ReplayAsync` always replays).
 
 **Recommendation:** Refresh the `GalaxyDriver` class and `ReinitializeAsync` doc comments to describe the shipped state, implement or explicitly reject `ReinitializeAsync` config reapply, and either honour `ReplayOnSessionLost` or remove it from `GalaxyReconnectOptions`.
 
-**Resolution:** _(open)_
+**Resolution:** Resolved 2026-05-23 — three fixes: (a) rewrote the `GalaxyDriver` class summary to describe the shipped capability surface (`ITagDiscovery`, `IReadable`, `IWritable`, `ISubscribable`, `IRediscoverable`, `IHostConnectivityProbe`, `IAlarmSource`) and removed the stale "PR 4.0 skeleton" / "legacy `GalaxyProxyDriver` coexists until PR 7.2" wording — PR 7.2 already retired the legacy projects. (b) `ReinitializeAsync` now parses the incoming `driverConfigJson` through the factory pipeline and compares the result to `_options`; an equivalent reapply refreshes health, a non-equivalent change throws `NotSupportedException` so a config swap never silently no-ops. (c) `ReplayAsync` now honours `_options.Reconnect.ReplayOnSessionLost` — when false it restarts the EventPump but skips the per-tag SubscribeBulk fan-out, delegating to gateway session-level replay. Regression coverage in `GalaxyDriverInfrastructureTests` (`ReinitializeAsync_RejectsNonEquivalentConfigChange`, `ReinitializeAsync_AcceptsEquivalentConfig`, `ReplayOnSessionLost_False_SkipsResubscribeBulk`, `ReplayOnSessionLost_True_RunsResubscribeBulk`). Updated `GalaxyDriverFactoryTests.ReinitializeAsync_RefreshesHealth_WhenConfigIsEquivalent` to use an equivalent config JSON.
 
 ### Driver.Galaxy-014
 

code-reviews/Driver.Historian.Wonderware.Client/findings.md

@@ -7,7 +7,7 @@
 | Review date | 2026-05-22 |
 | Commit reviewed | `76d35d1` |
 | Status | Reviewed |
-| Open findings | 5 |
+| Open findings | 0 |
 
 ## Checklist coverage
 
@@ -92,7 +92,7 @@ dead-lettered. Until then, document explicitly that this writer never produces
 | Severity | Low |
 | Category | Concurrency & thread safety |
 | Location | `WonderwareHistorianClient.cs:207`, `WonderwareHistorianClient.cs:132-150` |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** `_totalQueries` is mutated with `Interlocked.Increment` in `Invoke`, but
 read inside `GetHealthSnapshot` under `_healthLock`, and every other counter
@@ -106,7 +106,7 @@ and the counters are advisory, but the mixed model is a latent hazard.
 `_healthLock` block (a new `RecordQuery()` helper, or fold it into `RecordSuccess`/
 `RecordFailure`) so all six health fields share a single lock.
 
-**Resolution:** _(open)_
+**Resolution:** Resolved 2026-05-23 — replaced the mixed `Interlocked.Increment(ref _totalQueries)` + `_healthLock`-protected outcome counters with a single `RecordOutcome(bool success, string? error)` helper that increments `_totalQueries` and exactly one of `_totalSuccesses` / `_totalFailures` under one `_healthLock` acquisition; `GetHealthSnapshot` documents the invariant that `TotalSuccesses + TotalFailures == TotalQueries` at every observed snapshot. Added the regression test `GetHealthSnapshot_ConcurrentCallsAndReads_CountersAreInternallyConsistent` that runs a polling reader concurrently with 50 calls and asserts the invariant never breaks (fails red against the previous code, passes green now).
 
 ### Driver.Historian.Wonderware.Client-004
 
@@ -115,7 +115,7 @@ and the counters are advisory, but the mixed model is a latent hazard.
 | Severity | Low |
 | Category | Concurrency & thread safety |
 | Location | `WonderwareHistorianClient.cs:203-267` |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** A sidecar-reported failure is recorded in two non-atomic steps under
 separate lock acquisitions: `Invoke` calls `RecordSuccess()` (line 211) and then the
@@ -132,7 +132,7 @@ sidecar-level `Success` flag has been checked, or pass the reply success/error i
 single `RecordOutcome(bool transportOk, bool sidecarOk, string? error)` that updates all
 counters under one lock acquisition.
 
-**Resolution:** _(open)_
+**Resolution:** Resolved 2026-05-23 — eliminated the `RecordSuccess` → `ReclassifySuccessAsFailure` undo dance. `InvokeAsync` now takes a `Func<TReply, (bool ok, string? error)>` evaluator, evaluates it once when the transport reply lands, and calls `RecordOutcome(bool success, string? error)` exactly once per call under a single `_healthLock` acquisition. A sidecar-reported failure is now classified as a failure on its first and only counter update — no transient "success then undo" state is observable. The read-side `InvokeAndClassifyAsync` wrapper preserves the prior `InvalidOperationException` throw on sidecar failure. Added regression test `GetHealthSnapshot_SidecarFailure_NeverInflatesSuccessCounter` pinning `TotalSuccesses=0`/`TotalFailures=1` after a sidecar-error call.
 
 ### Driver.Historian.Wonderware.Client-005
 
@@ -167,7 +167,7 @@ the reader.
 | Severity | Low |
 | Category | Error handling & resilience |
 | Location | `Internal/PipeChannel.cs:96-107`, `WonderwareHistorianClientOptions.cs:11-12` |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** `PipeChannel.InvokeAsync` retries exactly once on transport failure and
 otherwise propagates. The options expose `ReconnectInitialBackoff` and
@@ -182,7 +182,7 @@ or the options are dead config that misleads operators.
 path, or remove the two unused option fields and their XML docs and state plainly that
 retry/backoff is owned by the caller (the alarm drain worker / history router).
 
-**Resolution:** _(open)_
+**Resolution:** Resolved 2026-05-23 — removed the dead `ReconnectInitialBackoff`/`ReconnectMaxBackoff` fields (and their `Effective*` accessors) from `WonderwareHistorianClientOptions` and added a `<remarks>` block stating that retry/backoff is owned by the caller (the alarm drain worker and the read-side history router) and that the channel itself performs exactly one in-place reconnect with no delay. Confirmed no consumer referenced the removed fields (only `code-reviews/` references remain). Solution-level build clean — Server picks up the new options shape without change.
 
 ### Driver.Historian.Wonderware.Client-007
 
@@ -218,7 +218,7 @@ deserializing.
 | Severity | Low |
 | Category | Security |
 | Location | `ZB.MOM.WW.OtOpcUa.Driver.Historian.Wonderware.Client.csproj:29-32` |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** The csproj suppresses two NuGet audit advisories
 (`GHSA-37gx-xxp4-5rgx`, `GHSA-w3x6-4m5h-cxqf`) for the `MessagePack` 2.5.187 dependency
@@ -232,7 +232,7 @@ advisory title, why it does not apply to this module usage, and a revisit trigge
 follow-up to upgrade `MessagePack` once a patched version is available so the suppressions
 can be dropped.
 
-**Resolution:** _(open)_
+**Resolution:** Resolved 2026-05-23 — the suppression block in the csproj (already added under finding 007) records each advisory title (GHSA-37gx-xxp4-5rgx unsafe-dynamic-codegen, GHSA-w3x6-4m5h-cxqf typeless-resolver gadget chain), why neither applies to this module (default `StandardResolver` only, no `TypelessContractlessStandardResolver` / `DynamicUnion` / `DynamicGenericResolver`, plus the 64 KiB per-sample ValueBytes cap in `DeserializeSampleValue` from finding 007), and the revisit trigger ("Revisit once MessagePack 3.x is available and drop these suppressions at that time"). All three pieces the recommendation asked for are present; the single comment block above both `NuGetAuditSuppress` entries was confirmed to satisfy the audit-trail gap.
 
 ### Driver.Historian.Wonderware.Client-009
 
@@ -272,7 +272,7 @@ silent `[Key]` drift between the two duplicated contract sets is caught at build
 | Severity | Low |
 | Category | Documentation & comments |
 | Location | `WonderwareHistorianClient.cs:355-361`, `WonderwareHistorianClient.cs:132-150` |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** Two doc/behaviour mismatches.
 (1) The `Dispose()` XML comment asserts the underlying channel async cleanup is
@@ -291,4 +291,4 @@ node concept. The collapse is reasonable but undocumented.
 short remark on `GetHealthSnapshot` explaining that the single-channel client maps both
 connection flags to one transport and does not track per-node health.
 
-**Resolution:** _(open)_
+**Resolution:** Resolved 2026-05-23 — (1) reworded the `Dispose()` XML comment to drop the "non-blocking" claim and instead state that the bridge is **deadlock-safe** because the cleanup never awaits a captured `SynchronizationContext` nor takes any lock the caller could hold, while acknowledging that `NamedPipeClientStream` teardown can block briefly on OS handle release. (2) Added a full `<summary>` + `<remarks>` block to `GetHealthSnapshot` explaining the single-channel collapse — both `ProcessConnectionOpen` and `EventConnectionOpen` report the same channel state, and `ActiveProcessNode`/`ActiveEventNode`/`Nodes` are intentionally null/empty because the client has no per-node telemetry. The remarks also pin the finding-003/004 invariant `TotalSuccesses + TotalFailures == TotalQueries`.

code-reviews/Driver.Historian.Wonderware/findings.md

@@ -7,7 +7,7 @@
 | Review date | 2026-05-22 |
 | Commit reviewed | `76d35d1` |
 | Status | Reviewed |
-| Open findings | 7 |
+| Open findings | 0 |
 
 ## Checklist coverage
 
@@ -115,7 +115,7 @@ analog/integer tags.
 | Severity | Low |
 | Category | Correctness and logic bugs |
 | Location | `Backend/SdkAlarmHistorianWriteBackend.cs:198-201` |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** `ToHistorianEvent` only assigns `historianEvent.Id` when
 `Guid.TryParse(dto.EventId, ...)` succeeds. If `EventId` is not a parseable GUID
@@ -128,7 +128,7 @@ The non-parseable case is never logged.
 the event as `PermanentFail` (malformed input) or synthesize a fresh
 `Guid.NewGuid()` so each event still gets a unique id.
 
-**Resolution:** _(open)_
+**Resolution:** Resolved 2026-05-23 — `ToHistorianEvent` now synthesizes a fresh `Guid.NewGuid()` when the dto's `EventId` fails `Guid.TryParse`, and logs a warning carrying both the original (unparseable) id and the synthesized id so collisions stop happening silently. Regression tests `ToHistorianEvent_parseable_event_id_is_used_verbatim` and `ToHistorianEvent_unparseable_event_id_synthesizes_unique_non_empty_Guid` in `SdkAlarmHistorianWriteBackendTests`.
 
 ### Driver.Historian.Wonderware-005
 
@@ -137,7 +137,7 @@ the event as `PermanentFail` (malformed input) or synthesize a fresh
 | Severity | Low |
 | Category | Concurrency and thread safety |
 | Location | `Backend/HistorianDataSource.cs:124`, `:126-127` |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** `GetHealthSnapshot` reads `_activeProcessNode` and
 `_activeEventNode` inside `_healthLock`, but those two fields are written under
@@ -152,7 +152,7 @@ a momentarily inconsistent health snapshot.
 `_healthLock` on every connection state change, or read them under the connection
 lock), so the snapshot is internally consistent.
 
-**Resolution:** _(open)_
+**Resolution:** Resolved 2026-05-23 — `GetHealthSnapshot` now derives the `ProcessConnectionOpen` / `EventConnectionOpen` booleans from the active-node strings (`_activeProcessNode != null` / `_activeEventNode != null`) which all live under `_healthLock`, instead of reading `_connection`/`_eventConnection` via `Volatile.Read` outside the lock those fields are published under. The snapshot is now self-consistent by construction: open ↔ active node populated. Regression tests in `HistorianDataSourceHealthSnapshotTests` cover the three half-published states plus the steady-state cases.
 
 ### Driver.Historian.Wonderware-006
 
@@ -184,7 +184,7 @@ restart the sidecar cleanly.
 | Severity | Low |
 | Category | Error handling and resilience |
 | Location | `Ipc/PipeServer.cs:70-75` |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** When `VerifyCaller` rejects the peer SID, the server logs the
 reason and calls `_current.Disconnect()` with no `HelloAck` frame sent. The
@@ -198,7 +198,7 @@ harder to test from the client.
 `caller-sid-mismatch` reject reason before disconnecting, consistent with the
 other two rejection paths.
 
-**Resolution:** _(open)_
+**Resolution:** Resolved 2026-05-23 — the SID rejection path now writes a `HelloAck { Accepted=false, RejectReason="caller-sid-mismatch: ..." }` before disconnecting, symmetric with the shared-secret-mismatch and major-version-mismatch paths. The caller-verification function was also extracted into a `CallerVerifier` delegate so tests can override it (the pipe ACL would otherwise block the test client itself). End-to-end regression `PipeServerSidRejectTests.Caller_SID_mismatch_sends_HelloAck_with_reject_reason_before_disconnect` connects a real named-pipe client and asserts the rejecting ack frame arrives.
 
 ### Driver.Historian.Wonderware-008
 
@@ -207,7 +207,7 @@ other two rejection paths.
 | Severity | Low |
 | Category | Error handling and resilience |
 | Location | `Backend/HistorianDataSource.cs:301-307`, `:374-380` |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** When `query.StartQuery` returns `false`, `ReadRawAsync` and
 `ReadAggregateAsync` call `HandleConnectionError()` and return an empty result
@@ -226,7 +226,7 @@ connection intact, surface the error). Consider returning a failed reply
 (`Success = false`) for query-class `StartQuery` failures so the client does not
 treat an SDK error as an empty history.
 
-**Resolution:** _(open)_
+**Resolution:** Resolved 2026-05-23 — extracted a static `ConnectionErrorCodes` set + `IsConnectionClassError` classifier (mirroring the alarm-write side) and centralised the failure handling in a new `HandleStartQueryFailure` helper. Connection-class codes still drop the connection and mark the node failed; query-class codes throw a new `QueryClassStartQueryException` that the outer catch re-throws WITHOUT touching the connection. All four read paths (raw / aggregate / at-time / events) also re-throw caught exceptions so the IPC frame handler surfaces `Success=false` instead of returning an empty list with `Success=true`. Regression tests `HistorianDataSourceStartQueryClassificationTests` pin the connection-class vs query-class classification per error code; the connect-failover suite (`HistorianDataSourceConnectFailoverTests`) verifies the read paths now propagate the exception.
 
 ### Driver.Historian.Wonderware-009
 
@@ -261,7 +261,7 @@ cap with an explicit error reply rather than letting `WriteAsync` throw.
 | Severity | Low |
 | Category | Performance and resource management |
 | Location | `Backend/HistorianConfiguration.cs:32-36`, `Backend/HistorianDataSource.cs` (all read methods) |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** `HistorianConfiguration.RequestTimeoutSeconds` is documented as
 the "outer safety timeout applied to sync-over-async Historian operations" and is
@@ -278,7 +278,7 @@ timeout, but the query path does not). The documented safety net does not exist.
 worker with a bounded wait), or remove the property and its XML doc so the code
 does not advertise a guarantee it does not provide.
 
-**Resolution:** _(open)_
+**Resolution:** Resolved 2026-05-23 — added an internal `BuildRequestCts` helper that returns a `CancellationTokenSource` linked into the caller's `ct` with `CancelAfter(RequestTimeoutSeconds)` applied when positive. Each read method (`ReadRawAsync`, `ReadAggregateAsync`, `ReadAtTimeAsync`, `ReadEventsAsync`) now wraps its work with the linked CTS and feeds the linked token into the `ThrowIfCancellationRequested` checks between `MoveNext` iterations, so a hung SDK call cancels at the configured deadline instead of blocking the connection thread indefinitely. Regression tests `HistorianDataSourceRequestTimeoutTests` pin the helper: positive value enforces `CancelAfter`, zero/negative means no timeout, caller cancellation propagates, default is 60s.
 
 ### Driver.Historian.Wonderware-011
 
@@ -287,7 +287,7 @@ does not advertise a guarantee it does not provide.
 | Severity | Low |
 | Category | Design-document adherence |
 | Location | `Backend/HistorianDataSource.cs:9-12`, `Backend/IHistorianDataSource.cs:9-11`, `Backend/HistorianSample.cs:7-9`, `Backend/HistorianConfiguration.cs:7-9` |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** Several XML doc comments reference the retired v1 architecture as
 if it were current: "inside Galaxy.Host", "the Proxy maps returned samples", "the
@@ -303,7 +303,7 @@ review checklist.
 architecture (sidecar talking to `WonderwareHistorianClient` over the named pipe),
 dropping the `Galaxy.Host` / `Proxy` / `GalaxyDataValue` references.
 
-**Resolution:** _(open)_
+**Resolution:** Resolved 2026-05-23 — refreshed the XML doc comments on `HistorianDataSource`, `IHistorianDataSource`, `HistorianSample` / `HistorianAggregateSample`, and `HistorianConfiguration` to describe the current sidecar / named-pipe / .NET 10 `WonderwareHistorianClient` architecture. References to `Galaxy.Host` / `Galaxy.Proxy` / `GalaxyDataValue` are now framed as historical context tied to the PR 7.2 retirement rather than as current behaviour.
 
 ### Driver.Historian.Wonderware-012
 
@@ -312,7 +312,7 @@ dropping the `Galaxy.Host` / `Proxy` / `GalaxyDataValue` references.
 | Severity | Low |
 | Category | Testing coverage |
 | Location | `Backend/HistorianDataSource.cs`, `tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Historian.Wonderware.Tests/` |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** The unit-test suite covers `HistorianQualityMapper`,
 `HistorianClusterEndpointPicker`, `SdkAlarmHistorianWriteBackend`,
@@ -334,4 +334,4 @@ removed to avoid confusion.
 cancellation, and the value-type selection — and delete the stale empty
 `tests/ZB.MOM.WW.OtOpcUa.Driver.Historian.Wonderware.Tests/` directory.
 
-**Resolution:** _(open)_
+**Resolution:** Resolved 2026-05-23 — added four new `HistorianDataSource`-targeted test files: `HistorianDataSourceHealthSnapshotTests` (snapshot consistency under half-published state, see also -005), `HistorianDataSourceStartQueryClassificationTests` (connection-class vs query-class error-code table, see also -008), `HistorianDataSourceRequestTimeoutTests` (the request-timeout helper, see also -010), `HistorianDataSourceConnectFailoverTests` (cluster failover order + cooldown via the `IHistorianConnectionFactory` fake), and `HistorianDataSourceValueAndAggregateTests` (the string-vs-numeric heuristic via the new SDK-independent `SelectValueFromPair` overload + the `ExtractAggregateValue` column dispatch). Stale empty `tests/ZB.MOM.WW.OtOpcUa.Driver.Historian.Wonderware.Tests/` directory deleted. Unit count rose from 80 to 125 (+45 new tests).

code-reviews/Driver.Modbus.Addressing/findings.md

@@ -7,7 +7,7 @@
 | Review date | 2026-05-22 |
 | Commit reviewed | `76d35d1` |
 | Status | Reviewed |
-| Open findings | 3 |
+| Open findings | 0 |
 
 ## Checklist coverage
 
@@ -157,7 +157,7 @@ overwrite it.
 | Severity | Low |
 | Category | Error handling & resilience |
 | Location | `ModbusAddressParser.cs:297-301` |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** `TryParseFamilyNative` catches only `ArgumentException` and `OverflowException`.
 The current helpers throw only those (including `ArgumentOutOfRangeException`, which derives from
@@ -171,7 +171,13 @@ depend on.
 narrow catch, or broaden to a general catch-all that records the message — a try-parse method
 should never throw.
 
-**Resolution:** _(open)_
+**Resolution:** Resolved 2026-05-23 — broadened the `catch` filter in
+`ModbusAddressParser.TryParseFamilyNative` from `ArgumentException or OverflowException` to a
+general `catch (Exception ex)` so any future helper exception type is converted to a structured
+`(false, error)` rather than escaping the `TryParse` method. Added `DL205_TryParse_NeverThrows`
+and `MELSEC_TryParse_NeverThrows` parameterised regression tests in
+`ModbusAddressEdgeCaseTests` covering ~20 pathological inputs (empty prefixes, octal/hex digit
+violations, overflow inputs, unknown prefixes) to pin the defensive contract.
 
 ### Driver.Modbus.Addressing-007
 
@@ -180,7 +186,7 @@ should never throw.
 | Severity | Low |
 | Category | Design-document adherence |
 | Location | `ModbusDataType.cs:91-95`, `docs/v2/dl205.md` section Strings |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** `ModbusStringByteOrder` (HighByteFirst / LowByteFirst) is defined in this
 assembly and documented as the DL205 low-byte-first string-packing knob, but `ParsedModbusAddress`
@@ -193,7 +199,18 @@ unreachable from the parser, so the grammar cannot represent a known, documented
 token for it, or document explicitly that DL205 string byte order is only configurable via the
 structured tag form and is intentionally out of grammar scope.
 
-**Resolution:** _(open)_
+**Resolution:** Resolved 2026-05-23 — chose the "document the limitation" branch of the
+recommendation rather than adding a grammar token: the 3rd field slot is the multi-register
+word/byte order and the 4th is the array count, so a 5th `:<order>` suffix would conflict with
+the existing count-shape disambiguation; `ModbusStringByteOrder` is already plumbed through the
+structured tag form (`ModbusDriverFactoryExtensions.ModbusTagDto.StringByteOrder` →
+`ModbusTagDefinition.StringByteOrder`) which is the canonical config path. Added an explicit
+"Grammar scope" remarks block to `ModbusStringByteOrder` and to the `ModbusAddressParser`
+`<remarks>` block stating that string byte order is configurable only via the structured tag
+form. Added a corresponding bullet to `docs/v2/dl205.md` §Strings. Added two regression tests
+(`Parser_STR_grammar_does_not_carry_StringByteOrder` reflecting on `ParsedModbusAddress`, and
+`Parser_rejects_unknown_string_byte_order_token_in_grammar`) pinning the contract so a future
+grammar change can't quietly add a conflicting token.
 
 ### Driver.Modbus.Addressing-008
 
@@ -226,7 +243,7 @@ finding -001.
 | Severity | Low |
 | Category | Documentation & comments |
 | Location | `ModbusModiconAddress.cs:55-64`, `ModbusModiconAddress.cs:104-110` |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** The comments on `ModbusModiconAddress.TryParse` are slightly inaccurate. The
 remark that 5-digit Modicon is always exactly 5 chars (40001..49999) and 6-digit is exactly 6
@@ -238,4 +255,11 @@ says the 5-digit form caps at 9999 by construction while the adjacent code path
 **Recommendation:** Reword the range examples to cover all four region digits and drop the
 caps-at-9999 aside or restate it as a precise statement about trailing-digit count.
 
-**Resolution:** _(open)_
+**Resolution:** Resolved 2026-05-23 — reworded the up-front range-check comment to describe all
+four region digits (0/1/3/4) and give examples covering each region (coils 00001..09999 /
+000001..065536, holding registers 40001..49999 / 400001..465536). Reworded the lower
+`> 65536` comment to drop the misleading "5-digit form caps at 9999 by construction" framing and
+state precisely that the check is reached only by the 6-digit form in practice, but applied to
+both for safety rather than relying on the digit-count invariant. Pure documentation change —
+no behavioural change; the existing `ModbusModiconAddressTests` already pin the cross-region
+5-digit ranges (00001..09999 / 10001..19999 / 30001..39999 / 40001..49999).

code-reviews/Driver.Modbus.Cli/findings.md

@@ -7,7 +7,7 @@
 | Review date | 2026-05-22 |
 | Commit reviewed | `76d35d1` |
 | Status | Reviewed |
-| Open findings | 6 |
+| Open findings | 0 |
 
 ## Checklist coverage
 
@@ -87,7 +87,7 @@ message explaining coils carry a single bit.
 | Severity | Low |
 | Category | Correctness & logic bugs |
 | Location | `src/Drivers/Cli/ZB.MOM.WW.OtOpcUa.Driver.Modbus.Cli/ModbusCommandBase.cs:14-24` |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** `Port` (`int`) and `TimeoutMs` (`int`) accept any 32-bit value,
 including negatives and ports above 65535. `UnitId` is a `byte`, so it accepts
@@ -103,7 +103,13 @@ error. None of these are validated at parse time.
 message — consistent with how `WriteCommand` already rejects bad regions and
 boolean strings.
 
-**Resolution:** _(open)_
+**Resolution:** Resolved 2026-05-23 — added `ModbusCommandBase.ValidateEndpoint()`
+that throws `CliFx.Exceptions.CommandException` for `--port` outside 1..65535,
+non-positive `--timeout-ms`, and `--unit-id` outside 1..247 (Modbus spec unicast
+range — rejects the broadcast 0 and reserved 248-255). Each of `ProbeCommand`,
+`ReadCommand`, `WriteCommand`, and `SubscribeCommand` now calls it at the top of
+`ExecuteAsync` after `ConfigureLogging()`. Regression tests live in
+`ModbusCommandBaseTests` (range + boundary cases for all three knobs).
 
 
 ### Driver.Modbus.Cli-004
@@ -113,7 +119,7 @@ boolean strings.
 | Severity | Low |
 | Category | Concurrency & thread safety |
 | Location | `src/Drivers/Cli/ZB.MOM.WW.OtOpcUa.Driver.Modbus.Cli/Commands/SubscribeCommand.cs:61-67` |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** The `OnDataChange` handler is invoked from the driver's
 `PollGroupEngine` background thread and calls `console.Output.WriteLine`
@@ -127,7 +133,11 @@ any synchronization, so overlapping poll ticks could interleave partial lines.
 write failures so a transient console-write error cannot tear down the poll loop.
 A single `lock` around the write also removes the interleave risk.
 
-**Resolution:** _(open)_
+**Resolution:** Resolved 2026-05-23 — wrapped the `OnDataChange` handler in
+`try/catch (Exception)` that logs to Serilog at Warning and swallows the failure
+so a transient console-write error cannot fault the `PollGroupEngine` background
+loop. The console write is also serialized through a local `lock` object, removing
+the partial-line interleave risk when multiple poll ticks overlap.
 
 ### Driver.Modbus.Cli-005
 
@@ -136,7 +146,7 @@ A single `lock` around the write also removes the interleave risk.
 | Severity | Low |
 | Category | Error handling & resilience |
 | Location | `src/Drivers/Cli/ZB.MOM.WW.OtOpcUa.Driver.Modbus.Cli/Commands/ProbeCommand.cs:21-54`; `Commands/ReadCommand.cs:46-75`; `Commands/WriteCommand.cs:54-89` |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** All three commands call `ConfigureLogging()` then
 `console.RegisterCancellationHandler()`, but if the operator presses Ctrl+C
@@ -152,7 +162,14 @@ commands do not catch it around their driver calls.
 the noisy trace on Ctrl+C-during-connect is acceptable. Consistency with
 `SubscribeCommand`'s handling is the cleaner choice.
 
-**Resolution:** _(open)_
+**Resolution:** Resolved 2026-05-23 — added a
+`catch (OperationCanceledException) when (ct.IsCancellationRequested)` clause
+around the driver-call bodies in `ProbeCommand`, `ReadCommand`, and `WriteCommand`
+that prints `Cancelled.` and falls through to the existing `finally`-block
+shutdown. Matches `SubscribeCommand`'s existing handling so all four commands now
+exit quietly on Ctrl+C. Regression tests in `CommandCancellationTests` pre-cancel
+the CliFx `FakeInMemoryConsole` before calling `ExecuteAsync` and assert no
+exception escapes.
 
 ### Driver.Modbus.Cli-006
 
@@ -161,7 +178,7 @@ the noisy trace on Ctrl+C-during-connect is acceptable. Consistency with
 | Severity | Low |
 | Category | Error handling & resilience |
 | Location | `src/Drivers/Cli/ZB.MOM.WW.OtOpcUa.Driver.Modbus.Cli/Commands/ProbeCommand.cs:35-53` |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** `probe` reports `Health: {health.State}` from `GetHealth()`.
 After a successful `InitializeAsync` the driver sets state to `Healthy`
@@ -179,7 +196,14 @@ snapshot's `StatusCode` (Good vs Bad) rather than — or in addition to — the
 `State`, or print a single combined verdict line so the two cannot contradict each
 other.
 
-**Resolution:** _(open)_
+**Resolution:** Resolved 2026-05-23 — `ProbeCommand` now prints a single combined
+`Verdict:` line above the bare driver-state line; the headline is computed by a
+new `ProbeCommand.ComputeVerdict(DriverState, statusCode)` helper that combines
+the driver state with the probe snapshot's OPC UA quality class (top 2 bits of
+the StatusCode). Verdict is `FAIL` whenever the driver is not Healthy OR the
+snapshot is Bad, `DEGRADED` when the driver is Healthy but the snapshot is
+Uncertain, and `OK` only when both are Good. Regression tests in
+`ProbeCommandTests` pin the verdict-grid behaviour.
 
 ### Driver.Modbus.Cli-007
 
@@ -188,7 +212,7 @@ other.
 | Severity | Low |
 | Category | Design-document adherence |
 | Location | `docs/Driver.Modbus.Cli.md:124-156`; `src/Drivers/Cli/ZB.MOM.WW.OtOpcUa.Driver.Modbus.Cli/Commands/ReadCommand.cs` |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** `docs/Driver.Modbus.Cli.md` devotes a whole "v2 addressing
 grammar" section to the industry-standard tag-address strings (`40001:F:CDAB`,
@@ -205,7 +229,14 @@ driver's address-string parser (and `--family` for the DL205/MELSEC native
 syntax), or scope the "v2 addressing grammar" section of the doc to note it
 applies to `DriverConfig` JSON and is not a CLI flag.
 
-**Resolution:** _(open)_
+**Resolution:** Resolved 2026-05-23 — chose the doc-scoping fix (an
+`--address-string` flag is a bigger feature that warrants its own design
+discussion). Added a "CLI scope" callout to the top of the
+`docs/Driver.Modbus.Cli.md` "v2 addressing grammar" section stating the CLI
+accepts only the structured `--region` + `--address` + `--type` triple and that
+the address-string grammar is a `DriverConfig` JSON feature. The pre-existing
+closing paragraph already said the same thing; the new callout makes it visible
+before the grammar examples instead of after them. Code surface left unchanged.
 
 ### Driver.Modbus.Cli-008
 
@@ -214,7 +245,7 @@ applies to `DriverConfig` JSON and is not a CLI flag.
 | Severity | Low |
 | Category | Testing coverage |
 | Location | `tests/Drivers/Cli/ZB.MOM.WW.OtOpcUa.Driver.Modbus.Cli.Tests/` |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** The test project covers only the two pure-function seams:
 `ReadCommand.SynthesiseTagName` and `WriteCommand.ParseValue`. There is no coverage
@@ -231,4 +262,19 @@ likely to regress and is currently untested. The validation gaps in findings
 setters and assert the produced `ModbusDriverOptions`). Once findings 002/003 are
 fixed, add tests for the new validation paths.
 
-**Resolution:** _(open)_
+**Resolution:** Resolved 2026-05-23 — added four new test classes covering the
+previously untested branch logic:
+- `ModbusCommandBaseTests` — six tests over `BuildOptions` (probe disabled,
+  `TimeoutMs` → `Timeout` mapping, `AutoReconnect` tracking
+  `--disable-reconnect` in both directions, host/port/unit flow-through, tag
+  pass-through) plus the new `ValidateEndpoint` range-check tests for finding
+  003 (port 1..65535, timeout-ms > 0, unit-id 1..247).
+- `WriteCommandRegionValidationTests` — read-only region rejection
+  (DiscreteInputs / InputRegisters) and the Coils-non-Bool guard for finding
+  002.
+- `ProbeCommandTests` — the new `ComputeVerdict` helper for finding 006
+  (OK / DEGRADED / FAIL grid).
+- `CommandCancellationTests` — Ctrl+C-during-initialize for `ProbeCommand` /
+  `ReadCommand` / `WriteCommand` for finding 005.
+
+Total test count grew from 18 to 64; all pass.

code-reviews/Driver.Modbus/findings.md

@@ -7,7 +7,7 @@
 | Review date | 2026-05-22 |
 | Commit reviewed | `76d35d1` |
 | Status | Reviewed |
-| Open findings | 7 |
+| Open findings | 0 |
 
 ## Checklist coverage
 
@@ -63,13 +63,13 @@
 | Severity | Low |
 | Category | Concurrency & thread safety |
 | Location | `ModbusDriver.cs:59,188,241,259,266,726,745,759` |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** `_health` is a non-`volatile` reference field written from multiple threads (concurrent `ReadAsync` callers, the coalesced-read path, `WriteAsync` indirectly, and `ProbeLoopAsync`) and read by `GetHealth()`. Reference assignment is atomic on .NET so a torn read cannot occur, but there is no happens-before ordering: a stale `DriverHealth` can be observed on another core, and concurrent writers race so "last write wins" is non-deterministic (a `Degraded` write from a failed read can clobber a just-published `Healthy`, or vice versa).
 
 **Recommendation:** Mark `_health` `volatile`, or assign via `Volatile.Write` and read with `Volatile.Read`, to give `GetHealth()` a defined ordering guarantee.
 
-**Resolution:** _(open)_
+**Resolution:** Resolved 2026-05-23 — routed every `_health` access through new `ReadHealth()` (`Volatile.Read`) and `WriteHealth()` (`Volatile.Write`) helpers, giving `GetHealth()` a defined ordering guarantee on every core. Stress-test (`ModbusLifecycleHygieneTests.GetHealth_under_concurrent_pressure_always_returns_a_complete_snapshot`) confirms the read path never sees a torn / half-constructed snapshot under concurrent reader + writer pressure.
 
 ### Driver.Modbus-004
 
@@ -123,13 +123,13 @@
 | Severity | Low |
 | Category | Design-document adherence |
 | Location | `ModbusDriver.cs:1392`, `ModbusDriverOptions.cs:74-80` |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** Two design-vs-code drifts. (1) `MapDataType` maps `Int64`/`UInt64` to `DriverDataType.Int32` with the inline comment "widening to Int32 loses precision; PR 25 adds Int64 to DriverDataType". The address-space node for a 64-bit Modbus tag is declared `Int32`, misrepresenting the OPC UA variable's `DataType` even though `DecodeRegister` produces a correct `long`/`ulong` value — clients see a type/value mismatch. (2) `DisableFC23` is documented and bound from JSON but is a confirmed no-op ("The driver does not currently emit FC23"). Both are acknowledged-but-unfinished items worth tracking.
 
 **Recommendation:** Track the PR 25 `DriverDataType.Int64` follow-up; until then document the Int32 surfacing limitation in `docs/v2/modbus-addressing.md` so operators configuring `I_64`/`UI_64` tags understand the node type. Mark `DisableFC23` clearly as reserved/unimplemented or gate it once FC23 ships.
 
-**Resolution:** _(open)_
+**Resolution:** Resolved 2026-05-23 — promoted the inline Int64/UInt64 caveat into a full `<remarks>` block on `MapDataType` calling out the surfacing limitation and the tracked follow-up, and rewrote the `DisableFC23` XML doc to flag the option as "Reserved / no-op" with a Driver.Modbus-007 tracking reference. (The cross-module doc update in `docs/v2/modbus-addressing.md` is out of scope for this module's edits — code is now self-documenting.)
 
 ### Driver.Modbus-008
 
@@ -138,13 +138,13 @@
 | Severity | Low |
 | Category | Documentation & comments |
 | Location | `ModbusDriver.cs:411-417,700-703,737-744` |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** Stale/misleading comments. (1) The `<summary>` block at `ModbusDriver.cs:411-417` says auto-prohibited ranges are "Cleared by ReinitializeAsync ... or by an explicit re-probe API (not yet shipped)" — the re-probe loop has shipped (#151, `ReprobeLoopAsync`), so the parenthetical is wrong. (2) The comment at `ModbusDriver.cs:700-703` ("On block-level failure mark every member Bad — caller's per-tag fallback won't re-try since handled-set already includes them; auto-split-on-failure is a follow-up") contradicts the actual `catch (ModbusException)` arm below it, which deliberately does not add members to `handled` and does defer to per-tag fallback (and auto-split has shipped via bisection). The empty `foreach (var (idx, _) in block.Members) { }` loop at `ModbusDriver.cs:737-744`, with only a comment body, is dead code from that superseded design.
 
 **Recommendation:** Update the two comments to match the shipped #148/#150/#151 behaviour and delete the empty `foreach` loop in the `catch (ModbusException)` arm.
 
-**Resolution:** _(open)_
+**Resolution:** Resolved 2026-05-23 — deleted the duplicate `<summary>` orphaned at the top of the prohibition block, rewrote the surviving one to credit the shipped #151 re-probe loop, replaced the "auto-split-on-failure is a follow-up" comment above the block loop with the actual #148/#150 behaviour (per-tag fallback + bisection), and removed the empty `foreach (var (idx, _) in block.Members) { }` plus its unused `status` local from the `catch (ModbusException)` arm.
 
 ### Driver.Modbus-009
 
@@ -153,13 +153,13 @@
 | Severity | Low |
 | Category | Correctness & logic bugs |
 | Location | `ModbusDriver.cs:1160-1167`, `ModbusTcpTransport.cs:94-95` |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** Two edge cases. (1) `RegisterCount` for `ModbusDataType.String` computes `(tag.StringLength + 1) / 2`; a tag configured with `StringLength = 0` yields a register count of 0, flowing into `ReadOneAsync` as `totalRegs = 0` and producing an FC03/FC04 with quantity 0 — a spec-illegal request the PLC rejects with exception 03. The factory does not reject `StringLength = 0` for String tags. (2) `EnableKeepAlive` casts `opts.Time.TotalSeconds`/`opts.Interval.TotalSeconds` to `int`; a sub-second configured `TimeSpan` (e.g. 500 ms) truncates to 0, which most OSes reject or interpret as "use default", silently defeating the configured keep-alive timing.
 
 **Recommendation:** Validate `StringLength >= 1` for `String` tags in `ModbusDriverFactoryExtensions.BuildTag`. For keep-alive, round up to a minimum of 1 second or validate the configured `TimeSpan` is a whole number of seconds.
 
-**Resolution:** _(open)_
+**Resolution:** Resolved 2026-05-23 — added `ValidateStringLength` in `ModbusDriverFactoryExtensions.BuildTag` so String-typed tags with `StringLength < 1` throw at bind time with a clear diagnostic (both AddressString + structured DTO paths), and introduced `ModbusTcpTransport.ClampToWholeSeconds` which rounds the configured keep-alive `TimeSpan` up to a minimum of 1 second so sub-second values no longer truncate to 0. Regression coverage in `ModbusEdgeCaseValidationTests`.
 
 ### Driver.Modbus-010
 
@@ -168,13 +168,13 @@
 | Severity | Low |
 | Category | Error handling & resilience |
 | Location | `ModbusDriver.cs:864-868`, `ModbusDriverOptions.cs:116-125` |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** When `WriteOnChangeOnly` is enabled and `IsRedundantWrite` returns true, `WriteAsync` returns `WriteResult(0u)` (Good) without touching the wire. The suppression baseline (`_lastWrittenByRef`) is only invalidated by a *read* that returns a divergent value. If a driver instance has `WriteOnChangeOnly = true` but a tag is never subscribed/read (write-only setpoint), a value the operator believes was re-asserted is silently suppressed forever after the first write — no time- or count-based expiry exists. The option XML doc describes the read-invalidation path but does not warn about write-only tags.
 
 **Recommendation:** Document the write-only-tag caveat on the `WriteOnChangeOnly` option, or add an optional TTL to the suppression cache so a periodic re-write still reaches the PLC.
 
-**Resolution:** _(open)_
+**Resolution:** Resolved 2026-05-23 — added a `<remarks>` block on `ModbusDriverOptions.WriteOnChangeOnly` that calls out the write-only-tag caveat explicitly: the cache is only invalidated by reads, so a tag that is never subscribed/polled stays suppressed forever after the first write. Operators choosing this option are directed to either subscribe every affected tag or leave `WriteOnChangeOnly = false`. Adding a TTL was considered but the safer option for an OPC UA driver is to make the limitation discoverable in the documentation surface (no behaviour change for existing deployments).
 
 ### Driver.Modbus-011
 
@@ -183,13 +183,13 @@
 | Severity | Low |
 | Category | Code organization & conventions |
 | Location | `ModbusDriver.cs:23-43,89-97,408-432` |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** Field and member declarations are interleaved with methods throughout `ModbusDriver`. `ResolveHost` (a public method) is the first member of the class, followed by `BuildSlaveHostName`, then a block of fields; `_lastPublishedByRef`/`_lastWrittenByRef` are declared after the constructor; `ProhibitionState`, `_autoProhibited`, and `_reprobeCts` are declared mid-file between `DecodeRegisterArray` and `RangeIsAutoProhibited`. There are also two near-identical `<summary>` blocks stacked back-to-back at `ModbusDriver.cs:411-423`. This hurts readability of a 1400-line file and makes the field inventory hard to audit (relevant to the thread-safety findings above).
 
 **Recommendation:** Group all instance fields at the top of the class, move nested types together, and remove the orphaned first `<summary>` at lines 411-417 that no longer precedes a member.
 
-**Resolution:** _(open)_
+**Resolution:** Resolved 2026-05-23 — reorganized `ModbusDriver` so every instance field (including the `_autoProhibited` / `_autoProhibitedLock` / `_reprobeCts` / `_rmwLocks` / `_lastPublishedByRef` / `_lastWrittenByRef` fields that were declared mid-file) lives in a single contiguous block at the top of the class, followed by the `ProhibitionState` nested type, the constructor, and then methods. Removed the duplicate orphan `<summary>` and the now-redundant field declarations that had been scattered through the file. The full 263-test suite passes with no behavioural change.
 
 ### Driver.Modbus-012
 
@@ -198,10 +198,10 @@
 | Severity | Low |
 | Category | Testing coverage |
 | Location | `tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Modbus.Tests/` |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** The unit suite is broad (coalescing, bisection, auto-recovery, byte order, arrays, BCD, RMW, caps, multi-unit, probe, reconnect, subscription). Gaps relative to the findings above: (1) no test exercises concurrent multi-subscription publishing, so the `_lastPublishedByRef` race (Driver.Modbus-001) is uncaught; (2) no test covers `ReinitializeAsync` state hygiene for stale `_tagsByName`/caches (Driver.Modbus-002); (3) no test feeds a malformed/short response PDU through `ReadRegisterBlockAsync`/`DecodeBitArray` to confirm a clean `BadCommunicationError` rather than an index-range crash (Driver.Modbus-005); (4) no test asserts `DisposeAsync` (vs `ShutdownAsync`) tears down the probe/re-probe loops and `_poll` (Driver.Modbus-004).
 
 **Recommendation:** Add unit tests for concurrent deadband publishing across two subscriptions, `ReinitializeAsync` state hygiene, malformed-response handling in the register/bit block readers, and `DisposeAsync` loop teardown.
 
-**Resolution:** _(open)_
+**Resolution:** Resolved 2026-05-23 — gap (1) was already covered by `ModbusSubscriptionTests.Concurrent_deadband_subscriptions_do_not_corrupt_the_publish_cache` from the Driver.Modbus-001 fix. Added the remaining three in a new `ModbusLifecycleHygieneTests` file: `Reinitialize_clears_stale_tagsByName_entries` + `Reinitialize_clears_lastPublished_and_lastWritten_caches` (gap 2), `Short_response_PDU_surfaces_as_BadCommunicationError_not_an_IndexOutOfRangeException` + `Response_payload_truncated_below_declared_byteCount_surfaces_as_BadCommunicationError` + `DecodeBitArray_rejects_an_empty_bitmap_with_InvalidDataException` (gap 3), `DisposeAsync_without_explicit_Shutdown_tears_down_probe_loop_and_transport` + `DisposeAsync_disposes_the_pollEngine_so_subscriptions_stop` (gap 4). All 12 new tests pass (full suite: 263/263 green).

code-reviews/Driver.OpcUaClient/findings.md

@@ -7,7 +7,7 @@
 | Review date | 2026-05-22 |
 | Commit reviewed | `76d35d1` |
 | Status | Reviewed |
-| Open findings | 2 |
+| Open findings | 0 |
 
 ## Checklist coverage
 
@@ -182,14 +182,14 @@
 |---|---|
 | Severity | Low |
 | Category | Documentation & comments |
-| Location | `OpcUaClientDriver.cs:783-784` |
-| Status | Open |
+| Location | `OpcUaClientDriver.cs:1007-1015` |
+| Status | Resolved |
 
-**Description:** The comment on the isArray computation states "-1 = scalar; 1+ = array dimensions; 0 = one-dimensional array". This is inaccurate against OPC UA ValueRank semantics: -3 is ScalarOrOneDimension, -2 is Any, -1 is Scalar, and 0 is OneOrMoreDimensions (not specifically one-dimensional). The code `valueRank >= 0` treats -2 (Any) and -3 (ScalarOrOneDimension) as scalar, which is a defensible default, but the comment misdescribes the constants and would mislead a maintainer.
+**Description:** The comment on the isArray computation stated "-1 = scalar; 1+ = array dimensions; 0 = one-dimensional array". This is inaccurate against OPC UA ValueRank semantics: -3 is ScalarOrOneDimension, -2 is Any, -1 is Scalar, and 0 is OneOrMoreDimensions (not specifically one-dimensional). The code `valueRank >= 0` treats -2 (Any) and -3 (ScalarOrOneDimension) as scalar, which is a defensible default, but the comment misdescribed the constants and would mislead a maintainer.
 
 **Recommendation:** Correct the comment to the actual ValueRank constants (-3 ScalarOrOneDimension, -2 Any, -1 Scalar, 0 OneOrMoreDimensions, 1 OneDimension, >1 multi-dim) and state the deliberate choice that anything >= 0 is treated as an array.
 
-**Resolution:** _(open)_
+**Resolution:** Resolved 2026-05-23 — `EnrichAndRegisterVariablesAsync` now carries the correct OPC UA Part 3 ValueRank legend (`-3 ScalarOrOneDimension`, `-2 Any`, `-1 Scalar`, `0 OneOrMoreDimensions`, `1 OneDimension`, `>1` specific N-dimensions) and explicitly states the deliberate choice that anything `>= 0` is treated as an array, with `-3`/`-2` conservatively folded into the scalar bucket. Regression tests `ValueRank_constants_have_the_OPCUA_Part3_spec_values` (anchors the SDK constants) and `IsArray_decision_matches_valueRank_greater_or_equal_zero` (theory across -3..2) pin the logic in `OpcUaClientLowFindingsRegressionTests.cs`.
 
 ### Driver.OpcUaClient-012
 
@@ -227,14 +227,14 @@
 |---|---|
 | Severity | Low |
 | Category | Performance & resource management |
-| Location | `OpcUaClientDriver.cs:904`, `:1035` |
-| Status | Open |
+| Location | `OpcUaClientDriver.cs:1138`, `:1314` |
+| Status | Resolved |
 
-**Description:** `MonitoredItem.Notification += (mi, args) => ...` (and the alarm-event equivalent) attaches a closure-capturing lambda to each monitored item's event. The lambda is never detached. When UnsubscribeAsync removes a subscription it calls Subscription.DeleteAsync but does not clear the MonitoredItem.Notification handlers; if the SDK retains the MonitoredItem/Subscription graph anywhere (the session keeps a reference until its own disposal, or during transfer-on-reconnect), the driver instance is kept alive by the closure longer than necessary.
+**Description:** `MonitoredItem.Notification += (mi, args) => ...` (and the alarm-event equivalent) attached a closure-capturing lambda to each monitored item's event. The lambda was never detached. When UnsubscribeAsync removed a subscription it called Subscription.DeleteAsync but did not clear the MonitoredItem.Notification handlers; if the SDK retains the MonitoredItem/Subscription graph anywhere (the session keeps a reference until its own disposal, or during transfer-on-reconnect), the driver instance was kept alive by the closure longer than necessary.
 
 **Recommendation:** Detach the Notification handlers when deleting a subscription, or hold the handler delegate so it can be explicitly removed in UnsubscribeAsync/ShutdownAsync.
 
-**Resolution:** _(open)_
+**Resolution:** Resolved 2026-05-23 — `SubscribeAsync` now stores each `(MonitoredItem, MonitoredItemNotificationEventHandler)` pair in a new `MonitoredItemNotificationHandle` record carried inside `RemoteSubscription`. `SubscribeAlarmsAsync` similarly stores the event-MonitoredItem and its handler delegate on `RemoteAlarmSubscription`. `UnsubscribeAsync`, `UnsubscribeAlarmsAsync`, and the subscription-teardown loops in `ShutdownAsync` now invoke `DetachNotificationHandlers` (or the alarm-equivalent inline `Notification -= rs.Handler`) BEFORE calling `Subscription.DeleteAsync`, so the SDK's invocation list no longer pins the driver through the captured lambda. Reflection-based regression tests `RemoteSubscription_record_carries_handler_delegates_so_they_can_be_detached` and `RemoteAlarmSubscription_record_carries_handler_delegate_so_it_can_be_detached` pin the contract that the handler reference is reachable from the bookkeeping record (`OpcUaClientLowFindingsRegressionTests.cs`).
 
 ### Driver.OpcUaClient-015
 

code-reviews/Driver.S7.Cli/findings.md

@@ -7,7 +7,7 @@
 | Review date | 2026-05-22 |
 | Commit reviewed | `76d35d1` |
 | Status | Reviewed |
-| Open findings | 4 |
+| Open findings | 0 |
 
 ## Checklist coverage
 
@@ -120,7 +120,7 @@ unreachable device, not crash on it.
 | Severity | Low |
 | Category | Performance & resource management |
 | Location | `src/Drivers/Cli/ZB.MOM.WW.OtOpcUa.Driver.S7.Cli/Commands/ProbeCommand.cs:36,53`, `Commands/ReadCommand.cs:45,54`, `Commands/WriteCommand.cs:51,60`, `Commands/SubscribeCommand.cs:39,73` |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** Every command declares the driver with `await using var driver = new
 S7Driver(...)` and *also* calls `await driver.ShutdownAsync(...)` in a `finally` block.
@@ -136,7 +136,7 @@ not actually disposing.
 `subscribe` command `UnsubscribeAsync`. Alternatively drop `await using`
 and keep the explicit `finally`. Pick one disposal mechanism per command.
 
-**Resolution:** _(open)_
+**Resolution:** Resolved 2026-05-23 — dropped the explicit `await driver.ShutdownAsync(CancellationToken.None)` calls from the `finally` blocks of `ProbeCommand`, `ReadCommand`, `WriteCommand`, and `SubscribeCommand`; `await using` is now the sole driver-disposal mechanism per command (DisposeAsync itself runs ShutdownAsync), and the subscribe command keeps `UnsubscribeAsync` in its finally because that is a subscription-lifecycle concern, not driver disposal. Added `CommandDisposalConventionsTests` to guard the source-level convention against regression.
 
 ### Driver.S7.Cli-005
 
@@ -145,7 +145,7 @@ and keep the explicit `finally`. Pick one disposal mechanism per command.
 | Severity | Low |
 | Category | Code organization & conventions |
 | Location | `tests/ZB.MOM.WW.OtOpcUa.Driver.S7.Cli.Tests/` |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** A stale directory `tests/ZB.MOM.WW.OtOpcUa.Driver.S7.Cli.Tests/`
 exists containing only an `obj/` folder — no `.csproj`, no source. The real test
@@ -158,7 +158,7 @@ grepping the tree for the S7 CLI test project.
 directory (including its `obj/`). This is outside the module `src/` tree but is the
 S7 CLI own orphaned test folder, so it belongs to this module cleanup.
 
-**Resolution:** _(open)_
+**Resolution:** Resolved 2026-05-23 — deleted the stale `tests/ZB.MOM.WW.OtOpcUa.Driver.S7.Cli.Tests/` directory (only contained a leftover `obj/` from before the move into `tests/Drivers/Cli/`; no tracked files). The real test project at `tests/Drivers/Cli/ZB.MOM.WW.OtOpcUa.Driver.S7.Cli.Tests/` is untouched.
 
 ### Driver.S7.Cli-006
 
@@ -167,7 +167,7 @@ S7 CLI own orphaned test folder, so it belongs to this module cleanup.
 | Severity | Low |
 | Category | Testing coverage |
 | Location | `tests/Drivers/Cli/ZB.MOM.WW.OtOpcUa.Driver.S7.Cli.Tests/WriteCommandParseValueTests.cs` |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** The only test file covers `WriteCommand.ParseValue` and
 `ReadCommand.SynthesiseTagName`. `S7CommandBase.BuildOptions` — which maps the
@@ -184,7 +184,7 @@ not be caught. `ParseValue` is also missing an explicit overflow-edge test (e.g.
 overflow case to the `ParseValue` numeric tests once Driver.S7.Cli-001 is resolved so
 the test asserts the wrapped `CommandException`.
 
-**Resolution:** _(open)_
+**Resolution:** Resolved 2026-05-23 — added `S7CommandBaseBuildOptionsTests` covering Probe.Enabled=false (one-shot CLI guarantee), TimeoutMs→Timeout TimeSpan mapping, host/port/CPU/rack/slot flowing through, and tag-list passthrough. The overflow-edge `ParseValue` test was already added under Driver.S7.Cli-001 (`ParseValue_overflow_for_numeric_types_throws_CommandException`).
 
 ### Driver.S7.Cli-007
 
@@ -193,7 +193,7 @@ the test asserts the wrapped `CommandException`.
 | Severity | Low |
 | Category | Documentation & comments |
 | Location | `src/Drivers/Cli/ZB.MOM.WW.OtOpcUa.Driver.S7.Cli/Commands/SubscribeCommand.cs:45-51` |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** The Modbus CLI `SubscribeCommand` carries an explanatory comment on
 the `OnDataChange` handler ("Route every data-change event to the CliFx console (not
@@ -206,4 +206,4 @@ Minor, but the rationale is worth keeping consistent across the CLI family.
 **Recommendation:** Re-add the one-line comment from the Modbus `SubscribeCommand` so
 the S7 copy explains why the event handler writes via `console.Output` synchronously.
 
-**Resolution:** _(open)_
+**Resolution:** Resolved 2026-05-23 — re-added the explanatory comment above the `OnDataChange` handler in the S7 `SubscribeCommand`, mirroring the Modbus copy: it explains the use of the CliFx `IConsole.Output` abstraction (rather than `System.Console`) and notes that the handler runs synchronously because it's raised from a driver background thread. Added `SubscribeCommandConsoleHandlerCommentTests` to guard the rationale against future copy-paste regressions.

code-reviews/Driver.S7/findings.md

@@ -7,7 +7,7 @@
 | Review date | 2026-05-22 |
 | Commit reviewed | `76d35d1` |
 | Status | Reviewed |
-| Open findings | 5 |
+| Open findings | 0 |
 
 ## Checklist coverage
 
@@ -89,7 +89,7 @@ correct the comment so the lossiness of UInt32 is documented.
 | Severity | Low |
 | Category | Correctness & logic bugs |
 | Location | `S7Driver.cs:172`, `S7Driver.cs:255` |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** ReadAsync and WriteAsync dereference fullReferences.Count /
 writes.Count with no null guard. A null argument throws NullReferenceException
@@ -101,7 +101,13 @@ inconsistent with it.
 **Recommendation:** Add ArgumentNullException.ThrowIfNull for the list parameters
 at the top of ReadAsync and WriteAsync.
 
-**Resolution:** _(open)_
+**Resolution:** Resolved 2026-05-23 — added `ArgumentNullException.ThrowIfNull`
+at the top of both `ReadAsync` and `WriteAsync`, placed BEFORE `RequirePlc()` so
+a null argument produces a typed `ArgumentNullException` (consistent with
+`DiscoverAsync`) rather than either an NRE on `.Count` or the "not initialized"
+`InvalidOperationException` from `RequirePlc`. Regression tests
+`ReadAsync_with_null_fullReferences_throws_ArgumentNullException` and
+`WriteAsync_with_null_writes_throws_ArgumentNullException`.
 
 ### Driver.S7-004
 
@@ -133,7 +139,7 @@ and swallowed poll-loop / shutdown exceptions.
 | Severity | Low |
 | Category | OtOpcUa conventions |
 | Location | `S7Driver.cs:33`, `S7Driver.cs:433` |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** System.Collections.Concurrent.ConcurrentDictionary is written
 out with a fully-qualified namespace at the field declarations instead of a
@@ -145,7 +151,11 @@ S7Driver.cs despite the file-top using S7.Net.
 **Recommendation:** Add using System.Collections.Concurrent and drop the
 redundant global::S7.Net. qualifiers where using S7.Net already covers them.
 
-**Resolution:** _(open)_
+**Resolution:** Resolved 2026-05-23 — `using System.Collections.Concurrent` was
+already added by an earlier finding fix; this resolution removes the remaining
+`global::S7.Net.Plc` qualifiers from the `ReadOneAsync` and `WriteOneAsync`
+signatures, now using the unqualified `Plc` type (the file-top `using S7.Net`
+already covers it). House style restored.
 
 ### Driver.S7-006
 
@@ -250,7 +260,7 @@ status, and update _health to Degraded on transport failures.
 | Severity | Low |
 | Category | Error handling & resilience |
 | Location | `S7Driver.cs:392` |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** The subscription poll loop never reflects sustained polling
 failure anywhere an operator can see it. PollLoopAsync swallows every
@@ -266,7 +276,19 @@ Interval indefinitely on a hard failure.
 apply a capped backoff after consecutive errors; at minimum log the swallowed
 exception (see Driver.S7-004).
 
-**Resolution:** _(open)_
+**Resolution:** Resolved 2026-05-23 — `PollLoopAsync` now tracks
+`consecutiveFailures`, calls new `HandlePollFailure` which both logs (with the
+failure count) AND degrades `_health` to `Degraded` once
+`PollFailureHealthThreshold` (1) consecutive failures have accumulated, and
+applies a capped exponential backoff via new `ComputeBackoffDelay` (doubles the
+wait each consecutive failure up to a 30 s `PollBackoffCap`). A healthy tick
+resets the counter so the cadence snaps back to the configured Interval.
+`HandlePollFailure` refuses to downgrade a `Faulted` state (reserved for
+permanent config faults like PUT/GET-denied). Regression test
+`PollLoop_against_uninitialized_driver_degrades_health` proves the health
+surface now reflects sustained failure; `PollLoop_applies_capped_backoff_after_consecutive_failures`
+proves shutdown still completes inside the drain window even under a fault
+storm.
 
 ### Driver.S7-010
 
@@ -275,7 +297,7 @@ exception (see Driver.S7-004).
 | Severity | Low |
 | Category | Performance & resource management |
 | Location | `S7Driver.cs:504` |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** Dispose() is implemented as
 DisposeAsync().AsTask().GetAwaiter().GetResult() - sync-over-async. Inside the
@@ -288,7 +310,16 @@ blocking wrap is unnecessary risk.
 perform the teardown directly (cancel CTSs, close Plc, dispose _gate) without
 round-tripping through the async path.
 
-**Resolution:** _(open)_
+**Resolution:** Resolved 2026-05-23 — `Dispose()` now performs teardown
+directly via a new private `SynchronousTeardown` method that mirrors
+`ShutdownAsync` but uses `Task.WhenAll(...).Wait(DrainTimeout)` instead of
+`await Task.WhenAll(...).WaitAsync(...)`. Probe + poll Tasks are still drained
+with the bounded 5 s timeout (so a wedged loop cannot hang `Dispose` indefinitely),
+but the sync path no longer round-trips through `DisposeAsync().AsTask().GetAwaiter().GetResult()`.
+`DisposeAsync` keeps its existing implementation for callers that opt into the
+async dispose pattern. Regression tests
+`Dispose_completes_synchronously_without_sync_over_async_round_trip` and
+`Dispose_is_idempotent`.
 
 ### Driver.S7-011
 
@@ -358,7 +389,7 @@ ReadStatusAsync-based probe.
 | Severity | Low |
 | Category | Code organization & conventions |
 | Location | `S7DriverOptions.cs:90`, `S7Driver.cs:300` |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** S7TagDefinition.StringLength is a public configured/JSON-bound
 parameter (default 254) but is dead: S7DataType.String reads and writes both
@@ -376,7 +407,20 @@ StringLength) at InitializeAsync / factory validation with a clear "not yet
 supported" error, so a partially-implemented type cannot be configured into a
 live address space.
 
-**Resolution:** _(open)_
+**Resolution:** Resolved 2026-05-23 — `InitializeAsync` now runs new
+`RejectUnsupportedTagDataTypes`, which throws `NotSupportedException` for any
+tag whose `DataType` is in the `UnimplementedDataTypes` set (`Int64`, `UInt64`,
+`Float64`, `String`, `DateTime`). The half-implemented types can no longer leak
+into the live address space — a site that configures one fails fast at init
+rather than seeing a node that returns `BadNotSupported` on every access.
+Entries should be removed from `UnimplementedDataTypes` as each type is wired
+through; the comment on `RejectUnsupportedTagDataTypes` makes it a single grep
+target for that follow-up. `StringLength` remains in `S7TagDefinition` because
+removing it would be a breaking change to existing config JSON; once `String`
+is implemented it will be consumed without further config changes. Regression
+tests `Initialize_rejects_not_yet_implemented_data_type_with_NotSupportedException`
+(Theory, 5 types) and `Initialize_accepts_implemented_data_types` (Theory, 7
+types) prove the guard is targeted.
 
 ### Driver.S7-014
 

code-reviews/Driver.TwinCAT.Cli/findings.md

@@ -7,7 +7,7 @@
 | Review date | 2026-05-22 |
 | Commit reviewed | `76d35d1` |
 | Status | Reviewed |
-| Open findings | 7 |
+| Open findings | 0 |
 
 ## Checklist coverage
 
@@ -40,7 +40,7 @@ a category produced nothing rather than leaving it blank.
 | Severity | Low |
 | Category | Correctness & logic bugs |
 | Location | `TwinCATCommandBase.cs:23-24`, `Commands/SubscribeCommand.cs:23-24`, `Commands/BrowseCommand.cs:21-24` |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** Numeric command options are accepted without range validation. `--timeout-ms`
 feeds `Timeout => TimeSpan.FromMilliseconds(TimeoutMs)`; passing `--timeout-ms 0` or a negative
@@ -56,7 +56,16 @@ failure mode should be a readable up-front rejection.
 shared helper on `TwinCATCommandBase`) and throw `CliFx.Exceptions.CommandException` with a
 clear message when `TimeoutMs <= 0`, `IntervalMs <= 0`, or `AmsPort` falls outside `1..65535`.
 
-**Resolution:** _(open)_
+**Resolution:** Added a virtual `Validate()` helper on `TwinCATCommandBase` that rejects
+`TimeoutMs <= 0` and `AmsPort` outside `1..65535` with a clean
+`CliFx.Exceptions.CommandException` carrying the offending value. `SubscribeCommand` overrides
+`Validate()` to add the `IntervalMs > 0` check. Each `ExecuteAsync` calls `Validate()` first
+so the CLI surfaces "bad argument" up-front instead of letting the driver fail with an opaque
+transport error. Covered by `TwinCATCommandBaseTests.Validate_rejects_zero_timeout`,
+`Validate_rejects_negative_timeout`, `Validate_rejects_out_of_range_ams_port` (theory, 4
+cases), `Validate_accepts_in_range_ams_port` (theory, 4 cases),
+`SubscribeCommand_validate_rejects_zero_interval`,
+`SubscribeCommand_validate_rejects_negative_interval`.
 
 ### Driver.TwinCAT.Cli-002
 
@@ -65,7 +74,7 @@ clear message when `TimeoutMs <= 0`, `IntervalMs <= 0`, or `AmsPort` falls outsi
 | Severity | Low |
 | Category | Concurrency & thread safety |
 | Location | `Commands/SubscribeCommand.cs:46-58` |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** The `OnDataChange` handler calls `console.Output.WriteLine(line)` synchronously.
 In native ADS-notification mode the event is raised from the `Beckhoff.TwinCAT.Ads`
@@ -83,7 +92,12 @@ serialised on one poll loop; the TwinCAT native path has no such serialisation.
 `TextWriter.Synchronized`. At minimum, gate it so the banner is written before the
 subscription is registered (it already is) and lock the per-event writes against each other.
 
-**Resolution:** _(open)_
+**Resolution:** Introduced a per-execution `writeLock` object inside
+`SubscribeCommand.ExecuteAsync`. Both the `OnDataChange` handler's `WriteLine` and the
+post-subscription "Subscribed to ..." banner take the lock, so notification-callback writes
+cannot interleave with the main-thread banner or with each other. Lock is local to the
+command so parallel process instances do not contend with one another (each owns its own
+console).
 
 ### Driver.TwinCAT.Cli-003
 
@@ -92,7 +106,7 @@ subscription is registered (it already is) and lock the per-event writes against
 | Severity | Low |
 | Category | Error handling & resilience |
 | Location | `Commands/SubscribeCommand.cs:56-58` |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** The subscribe banner reports the mechanism purely from the `--poll-only` flag
 (`var mode = PollOnly ? "polling" : "ADS notification"`). The doc (`docs/Driver.TwinCAT.Cli.md`)
@@ -108,7 +122,15 @@ returned `ISubscriptionHandle.DiagnosticId`, which is `twincat-native-sub-*` for
 path vs the `PollGroupEngine` handle for poll mode) or soften the wording to "(requested:
 ADS notification)" so it does not over-claim.
 
-**Resolution:** _(open)_
+**Resolution:** Added internal static
+`SubscribeCommand.DescribeMechanism(ISubscriptionHandle)` that maps
+`DiagnosticId.StartsWith("twincat-native-sub-", Ordinal)` to `"ADS notification"` and
+anything else to `"polling"`. The banner now reads from the handle the driver actually
+returned, so the line cannot disagree with what the driver did even if a future fallback
+lands the subscription somewhere unexpected. Covered by
+`SubscribeCommandMechanismTests.DescribeMechanism_returns_ADS_notification_for_native_handle`
+(theory, 3 cases) and `DescribeMechanism_returns_polling_for_anything_else` (theory, 4 cases
+including an ordinal case-sensitivity guard).
 
 ### Driver.TwinCAT.Cli-004
 
@@ -117,7 +139,7 @@ ADS notification)" so it does not over-claim.
 | Severity | Low |
 | Category | Design-document adherence |
 | Location | `TwinCATCommandBase.cs:26-29`, `Commands/BrowseCommand.cs` |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** `--poll-only` is declared on `TwinCATCommandBase`, so it is inherited by
 `browse`. `BrowseCommand` only ever calls `DiscoverAsync` — it never subscribes — so
@@ -131,7 +153,15 @@ disagree.
 flag) onto an intermediate base shared by only `probe`/`read`/`subscribe`, or override/hide it
 for `browse`. Alternatively document explicitly that the flag is a no-op for `browse`.
 
-**Resolution:** _(open)_
+**Resolution:** Introduced an intermediate `TwinCATTagCommandBase : TwinCATCommandBase` that
+hosts the `--poll-only` flag and the `BuildOptions(...)` helper. `ProbeCommand`,
+`ReadCommand`, `WriteCommand`, and `SubscribeCommand` inherit from this intermediate (they all
+build a tag-list `TwinCATDriverOptions`). `BrowseCommand` keeps inheriting from
+`TwinCATCommandBase` directly, so `--poll-only` no longer surfaces in `browse --help`. Browse
+sets `UseNativeNotifications = true` on its inline options (irrelevant either way for the
+discover-only path, but matches production wiring). Covered by
+`TwinCATCommandBaseTests.BrowseCommand_does_not_expose_poll_only_flag` and
+`ProbeCommand_still_exposes_poll_only_flag` (both reflect over the public property surface).
 
 ### Driver.TwinCAT.Cli-005
 
@@ -140,7 +170,7 @@ for `browse`. Alternatively document explicitly that the flag is a no-op for `br
 | Severity | Low |
 | Category | Code organization & conventions |
 | Location | `Commands/ProbeCommand.cs:23`, `Commands/ReadCommand.cs:20`, `Commands/WriteCommand.cs:20`, `Commands/SubscribeCommand.cs:18` |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** The `--type` option is declared with the short alias `-t` on `read`, `write`,
 and `subscribe`, but `ProbeCommand` declares `[CommandOption("type", ...)]` with no short
@@ -151,7 +181,10 @@ take the same `TwinCATDataType` option.
 **Recommendation:** Add the `'t'` short alias to `ProbeCommand`'s `--type` option to match the
 other three commands.
 
-**Resolution:** _(open)_
+**Resolution:** Added the `'t'` short alias on `ProbeCommand.DataType`'s `[CommandOption]`,
+matching read/write/subscribe so muscle memory carries between the four verbs. Covered by
+`TwinCATCommandBaseTests.ProbeCommand_type_option_carries_short_alias_t` which asserts the
+`CommandOptionAttribute.ShortName` is `'t'`.
 
 ### Driver.TwinCAT.Cli-006
 
@@ -160,7 +193,7 @@ other three commands.
 | Severity | Low |
 | Category | Testing coverage |
 | Location | `tests/Drivers/Cli/ZB.MOM.WW.OtOpcUa.Driver.TwinCAT.Cli.Tests/WriteCommandParseValueTests.cs` |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** The only test file covers `WriteCommand.ParseValue` and
 `ReadCommand.SynthesiseTagName`. Other deterministic, router-independent logic is untested:
@@ -177,7 +210,20 @@ module's scope but worth flagging to whoever owns the test tree.
 `BuildOptions` field wiring, and for the `CollectingAddressSpaceBuilder` prefix/max filtering
 and access-classification logic.
 
-**Resolution:** _(open)_
+**Resolution:** Added two new test classes. `TwinCATCommandBaseTests` covers the Gateway
+canonical form, round-trip through `TwinCATAmsAddress.TryParse`, DriverInstanceId
+composition, Timeout projection, BuildOptions field wiring (devices, tags, timeout, probe
+disabled, controller-browse disabled, UseNativeNotifications default true), and the PollOnly
+toggle flipping UseNativeNotifications. `BrowseCommandFilterTests` covers
+`CollectingAddressSpaceBuilder` (records variables in call order, treats `Folder` as a
+same-builder pass-through), `BrowseCommand.FilterByPrefix` (empty/null prefix passes
+everything, case-sensitive ordinal match), `BrowseCommand.PrintLimit` (max <= 0 = unbounded,
+caps when matched > max, no padding when matched < max), and `BrowseCommand.AccessTag`
+(ViewOnly -> RO, every other classification -> RW, theory over all 6 non-ViewOnly values).
+`BrowseCommand.CollectingAddressSpaceBuilder` made `internal` (was `private`) so the test
+project can construct it directly via the existing `InternalsVisibleTo` hook. Total tests
+for this assembly went from 27 to 69. The stale empty sibling test directory mention is
+left out of scope as noted.
 
 ### Driver.TwinCAT.Cli-007
 
@@ -186,7 +232,7 @@ and access-classification logic.
 | Severity | Low |
 | Category | Documentation & comments |
 | Location | `TwinCATCommandBase.cs:31-36` |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** The `Timeout` override has an empty `init` accessor with the comment
 `/* driven by TimeoutMs */`. Because the base `DriverCommandBase.Timeout` is declared
@@ -199,4 +245,9 @@ gives no hint of the deliberate no-op. This is a maintainability/clarity nit, no
 computed projection of `--timeout-ms` and the `init` accessor is intentionally a no-op, so the
 design intent survives refactoring.
 
-**Resolution:** _(open)_
+**Resolution:** Replaced the `<inheritdoc/>` on `TwinCATCommandBase.Timeout` with an explicit
+`<summary>` documenting that `Timeout` is projected from `TimeoutMs`, that the `init`
+accessor required by the abstract base property is intentionally a no-op, and that adding a
+backing field would cause the two to drift on every refactor. The inner-block comment was
+tightened to point at the XML summary so the design intent survives whichever doc surface a
+future maintainer reads first.

code-reviews/Driver.TwinCAT/findings.md

@@ -7,7 +7,7 @@
 | Review date | 2026-05-22 |
 | Commit reviewed | `76d35d1` |
 | Status | Reviewed |
-| Open findings | 5 |
+| Open findings | 0 |
 
 ## Checklist coverage
 
@@ -112,7 +112,7 @@ does not support UDT tags, and `BrowseSymbolsAsync` already correctly yields
 | Severity | Low |
 | Category | Correctness & logic bugs |
 | Location | `TwinCATDataType.cs:24-27` |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** The inline comments for the IEC time types are inaccurate. TwinCAT `TIME` is
 a duration (32-bit, milliseconds) — not "ms since epoch of day". `DATE` is stored as seconds
@@ -125,7 +125,7 @@ implementer who tries to add proper conversion.
 date/time semantics are intended to be exposed properly, track a follow-up to decode them to
 `DriverDataType.DateTime`; otherwise document that they surface as raw counters.
 
-**Resolution:** _(open)_
+**Resolution:** Resolved 2026-05-23 — rewrote the inline comments to match the actual IEC 61131-3 / TwinCAT encoding (TIME = duration in ms, DATE = seconds since 1970-01-01 truncated to a day boundary, DT = seconds since 1970-01-01, TOD = ms since midnight) and added a block comment documenting that the driver surfaces them as raw UDINT counters via `DriverDataType.UInt32`. Test `Iec_time_types_map_to_uint32_raw_counter` pins the mapping.
 
 ### Driver.TwinCAT-005
 
@@ -156,7 +156,7 @@ catch), native-notification registration failures, and host state transitions
 | Severity | Low |
 | Category | OtOpcUa conventions |
 | Location | `TwinCATDriver.cs:406-411` |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** `ResolveHost` falls back to `DriverInstanceId` when there are no configured
 devices and the reference is unknown. `DriverInstanceId` is a logical config-DB identifier,
@@ -169,7 +169,7 @@ connectivity-status row.
 empty string or a documented unresolved marker), or document why the instance ID is the chosen
 fallback. Prefer the first device HostAddress only when one exists (already done).
 
-**Resolution:** _(open)_
+**Resolution:** Resolved 2026-05-23 — `ResolveHost` now returns `TwinCATDriver.UnresolvedHostSentinel` (empty string) when no devices are configured, replacing the `DriverInstanceId` collision with `GetHostStatuses()` rows. The sentinel is publicly documented on the driver type. Updated `ResolveHost_falls_back_to_unresolved_sentinel_when_no_devices` (was `_to_DriverInstanceId_`) and added `ResolveHost_returns_unresolved_sentinel_when_no_devices` + `ResolveHost_unresolved_sentinel_matches_no_GetHostStatuses_entry` regressions.
 
 ### Driver.TwinCAT-007
 
@@ -361,7 +361,7 @@ part of the documented driver contract, not optional.
 | Severity | Low |
 | Category | Design-document adherence |
 | Location | `TwinCATDriverOptions.cs:41-43`, `TwinCATDriverOptions.cs:57-62`, `AdsTwinCATClient.cs:145` |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** Several drifts between the implemented config surface and
 `docs/v2/driver-specs.md` section 6. The spec connection-settings list has separate `Host`
@@ -376,7 +376,7 @@ the probe path connects via `_options.Timeout` — a dead config field. The spec
 shape (the doc is DRAFT, so updating it is acceptable). Remove or wire up
 `TwinCATProbeOptions.Timeout`. Expose `NotificationMaxDelayMs` if batching control is wanted.
 
-**Resolution:** _(open)_
+**Resolution:** Resolved 2026-05-23 — `TwinCATProbeOptions.Timeout` is now wired into `EnsureConnectedAsync` via an optional `timeoutOverride` parameter that the probe loop passes (reads / writes keep the driver-level `_options.Timeout`). Added a `TwinCATDriverOptions.NotificationMaxDelayMs` config knob (parsed from `driverConfigJson` via `TwinCATDriverConfigDto.NotificationMaxDelayMs`) and threaded it through `ITwinCATClient.AddNotificationAsync` so `NotificationSettings` carries the configured max-delay instead of the hard-coded 0. The `Host` / `AmsNetId` / `AmsPort` triple in the spec was already implemented as the single `HostAddress` (parsed `ads://{netId}:{port}` URI) — kept as-is to match the v2 driver convention; covered by `TwinCATAmsAddress`. Regression tests: `ProbeOptions_Timeout_is_applied_to_probe_calls`, `NotificationMaxDelayMs_is_exposed_on_driver_options`, `NotificationMaxDelayMs_parses_from_driver_config_json`.
 
 ### Driver.TwinCAT-015
 
@@ -385,7 +385,7 @@ shape (the doc is DRAFT, so updating it is acceptable). Remove or wire up
 | Severity | Low |
 | Category | Code organization & conventions |
 | Location | `TwinCATDriver.cs:431-432` |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** `Dispose()` runs `DisposeAsync().AsTask().GetAwaiter().GetResult()` —
 sync-over-async. `docs/v2/driver-stability.md` section Galaxy explicitly lists "sync-over-async
@@ -399,7 +399,7 @@ here — cancelling token sources, disposing clients, clearing dictionaries —
 synchronous, and `PollGroupEngine.DisposeAsync` completes synchronously, so factor the
 synchronous teardown out so `Dispose()` does not block on a `Task`.
 
-**Resolution:** _(open)_
+**Resolution:** Resolved 2026-05-23 — `Dispose()` now does an inline synchronous teardown with no `await` and no captured sync context: dispose native subscriptions, drive `PollGroupEngine.DisposeAsync` via `.AsTask().Wait(5s)` (no context capture), per-device `ProbeCts.Cancel()` + `ProbeTask.Wait(2s)`, `DisposeClient()` / `DisposeGate()`, then clear the dictionaries. `DisposeAsync` still routes through `ShutdownAsync` for genuinely async callers. Regression test `Dispose_does_not_block_on_async_in_default_synchronization_context` runs `Dispose()` inside a single-threaded `SynchronizationContext` that would deadlock a sync-over-async teardown and asserts it completes within 5s.
 
 ### Driver.TwinCAT-016
 
@@ -408,7 +408,7 @@ synchronous teardown out so `Dispose()` does not block on a `Task`.
 | Severity | Low |
 | Category | Testing coverage |
 | Location | `tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.TwinCAT.Tests/` |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** Unit coverage exists for AMS-address parsing, symbol-path parsing, read/write,
 native notifications, symbol browse, and the capability surface. Gaps tied to the findings
@@ -423,4 +423,4 @@ without truncation (Driver.TwinCAT-002).
 addressed, especially a concurrency stress test for `EnsureConnectedAsync` and a
 `ReinitializeAsync`-applies-new-config test.
 
-**Resolution:** _(open)_
+**Resolution:** Resolved 2026-05-23 — the previously-closed High findings each grew their regression coverage as they were resolved (see `TwinCATHighFindingsRegressionTests`: `ReinitializeAsync_applies_changed_device_config` for -001, `LInt_read_round_trips_value_above_int_MaxValue` + `DataType_mapping_preserves_width_and_signedness` for -002, `Concurrent_reads_on_one_device_create_a_single_client` + `Concurrent_reads_and_writes_share_one_client` for -007, `Symbol_version_changed_raises_OnRediscoveryNeeded` + `TwinCATDriver_implements_IRediscoverable` for -013). This pass added the two remaining gaps: `Structure_typed_pre_declared_tag_is_rejected_at_config_parse` (-003) and `Probe_loop_and_read_share_one_client_per_device` (-009 disposal-race coverage races 64 readers against the probe loop for 500ms and asserts a single client / single connect). All coverage lives in the test files `TwinCATHighFindingsRegressionTests.cs` and the new `TwinCATLowFindingsRegressionTests.cs`.

code-reviews/README.md

@@ -10,200 +10,43 @@ Each module's `findings.md` is the source of truth; this file is generated from
 
 | Module | Reviewer | Date | Commit | Status | Open | Total |
 |---|---|---|---|---|---|---|
-| [Admin](Admin/findings.md) | Claude Code | 2026-05-22 | `76d35d1` | Reviewed | 3 | 13 |
-| [Analyzers](Analyzers/findings.md) | Claude Code | 2026-05-22 | `76d35d1` | Reviewed | 5 | 7 |
-| [Client.CLI](Client.CLI/findings.md) | Claude Code | 2026-05-22 | `76d35d1` | Reviewed | 8 | 10 |
-| [Client.Shared](Client.Shared/findings.md) | Claude Code | 2026-05-22 | `76d35d1` | Reviewed | 5 | 11 |
-| [Client.UI](Client.UI/findings.md) | Claude Code | 2026-05-22 | `76d35d1` | Reviewed | 6 | 11 |
-| [Configuration](Configuration/findings.md) | Claude Code | 2026-05-22 | `76d35d1` | Reviewed | 5 | 11 |
-| [Core](Core/findings.md) | Claude Code | 2026-05-22 | `76d35d1` | Reviewed | 6 | 12 |
-| [Core.Abstractions](Core.Abstractions/findings.md) | Claude Code | 2026-05-22 | `76d35d1` | Reviewed | 5 | 8 |
-| [Core.AlarmHistorian](Core.AlarmHistorian/findings.md) | Claude Code | 2026-05-22 | `76d35d1` | Reviewed | 2 | 11 |
-| [Core.ScriptedAlarms](Core.ScriptedAlarms/findings.md) | Claude Code | 2026-05-22 | `76d35d1` | Reviewed | 6 | 12 |
-| [Core.Scripting](Core.Scripting/findings.md) | Claude Code | 2026-05-22 | `76d35d1` | Reviewed | 5 | 11 |
-| [Core.VirtualTags](Core.VirtualTags/findings.md) | Claude Code | 2026-05-22 | `76d35d1` | Reviewed | 7 | 13 |
-| [Driver.AbCip](Driver.AbCip/findings.md) | Claude Code | 2026-05-22 | `76d35d1` | Reviewed | 5 | 15 |
-| [Driver.AbCip.Cli](Driver.AbCip.Cli/findings.md) | Claude Code | 2026-05-22 | `76d35d1` | Reviewed | 6 | 8 |
-| [Driver.AbLegacy](Driver.AbLegacy/findings.md) | Claude Code | 2026-05-22 | `76d35d1` | Reviewed | 3 | 13 |
-| [Driver.AbLegacy.Cli](Driver.AbLegacy.Cli/findings.md) | Claude Code | 2026-05-22 | `76d35d1` | Reviewed | 6 | 7 |
-| [Driver.Cli.Common](Driver.Cli.Common/findings.md) | Claude Code | 2026-05-22 | `76d35d1` | Reviewed | 2 | 6 |
-| [Driver.FOCAS](Driver.FOCAS/findings.md) | Claude Code | 2026-05-22 | `76d35d1` | Reviewed | 5 | 12 |
-| [Driver.FOCAS.Cli](Driver.FOCAS.Cli/findings.md) | Claude Code | 2026-05-22 | `76d35d1` | Reviewed | 5 | 5 |
-| [Driver.Galaxy](Driver.Galaxy/findings.md) | Claude Code | 2026-05-22 | `76d35d1` | Reviewed | 4 | 14 |
-| [Driver.Historian.Wonderware](Driver.Historian.Wonderware/findings.md) | Claude Code | 2026-05-22 | `76d35d1` | Reviewed | 7 | 12 |
-| [Driver.Historian.Wonderware.Client](Driver.Historian.Wonderware.Client/findings.md) | Claude Code | 2026-05-22 | `76d35d1` | Reviewed | 5 | 10 |
-| [Driver.Modbus](Driver.Modbus/findings.md) | Claude Code | 2026-05-22 | `76d35d1` | Reviewed | 7 | 12 |
-| [Driver.Modbus.Addressing](Driver.Modbus.Addressing/findings.md) | Claude Code | 2026-05-22 | `76d35d1` | Reviewed | 3 | 9 |
-| [Driver.Modbus.Cli](Driver.Modbus.Cli/findings.md) | Claude Code | 2026-05-22 | `76d35d1` | Reviewed | 6 | 8 |
-| [Driver.OpcUaClient](Driver.OpcUaClient/findings.md) | Claude Code | 2026-05-22 | `76d35d1` | Reviewed | 2 | 15 |
-| [Driver.S7](Driver.S7/findings.md) | Claude Code | 2026-05-22 | `76d35d1` | Reviewed | 5 | 14 |
-| [Driver.S7.Cli](Driver.S7.Cli/findings.md) | Claude Code | 2026-05-22 | `76d35d1` | Reviewed | 4 | 7 |
-| [Driver.TwinCAT](Driver.TwinCAT/findings.md) | Claude Code | 2026-05-22 | `76d35d1` | Reviewed | 5 | 16 |
-| [Driver.TwinCAT.Cli](Driver.TwinCAT.Cli/findings.md) | Claude Code | 2026-05-22 | `76d35d1` | Reviewed | 7 | 7 |
-| [Server](Server/findings.md) | Claude Code | 2026-05-22 | `76d35d1` | Reviewed | 6 | 15 |
+| [Admin](Admin/findings.md) | Claude Code | 2026-05-22 | `76d35d1` | Reviewed | 0 | 13 |
+| [Analyzers](Analyzers/findings.md) | Claude Code | 2026-05-22 | `76d35d1` | Reviewed | 0 | 7 |
+| [Client.CLI](Client.CLI/findings.md) | Claude Code | 2026-05-22 | `76d35d1` | Reviewed | 0 | 10 |
+| [Client.Shared](Client.Shared/findings.md) | Claude Code | 2026-05-22 | `76d35d1` | Reviewed | 0 | 11 |
+| [Client.UI](Client.UI/findings.md) | Claude Code | 2026-05-22 | `76d35d1` | Reviewed | 0 | 11 |
+| [Configuration](Configuration/findings.md) | Claude Code | 2026-05-22 | `76d35d1` | Reviewed | 0 | 11 |
+| [Core](Core/findings.md) | Claude Code | 2026-05-22 | `76d35d1` | Reviewed | 0 | 12 |
+| [Core.Abstractions](Core.Abstractions/findings.md) | Claude Code | 2026-05-22 | `76d35d1` | Reviewed | 0 | 8 |
+| [Core.AlarmHistorian](Core.AlarmHistorian/findings.md) | Claude Code | 2026-05-22 | `76d35d1` | Reviewed | 0 | 11 |
+| [Core.ScriptedAlarms](Core.ScriptedAlarms/findings.md) | Claude Code | 2026-05-22 | `76d35d1` | Reviewed | 0 | 12 |
+| [Core.Scripting](Core.Scripting/findings.md) | Claude Code | 2026-05-22 | `76d35d1` | Reviewed | 0 | 11 |
+| [Core.VirtualTags](Core.VirtualTags/findings.md) | Claude Code | 2026-05-22 | `76d35d1` | Reviewed | 0 | 13 |
+| [Driver.AbCip](Driver.AbCip/findings.md) | Claude Code | 2026-05-22 | `76d35d1` | Reviewed | 0 | 15 |
+| [Driver.AbCip.Cli](Driver.AbCip.Cli/findings.md) | Claude Code | 2026-05-22 | `76d35d1` | Reviewed | 0 | 8 |
+| [Driver.AbLegacy](Driver.AbLegacy/findings.md) | Claude Code | 2026-05-22 | `76d35d1` | Reviewed | 0 | 13 |
+| [Driver.AbLegacy.Cli](Driver.AbLegacy.Cli/findings.md) | Claude Code | 2026-05-22 | `76d35d1` | Reviewed | 0 | 7 |
+| [Driver.Cli.Common](Driver.Cli.Common/findings.md) | Claude Code | 2026-05-22 | `76d35d1` | Reviewed | 0 | 6 |
+| [Driver.FOCAS](Driver.FOCAS/findings.md) | Claude Code | 2026-05-22 | `76d35d1` | Reviewed | 0 | 12 |
+| [Driver.FOCAS.Cli](Driver.FOCAS.Cli/findings.md) | Claude Code | 2026-05-22 | `76d35d1` | Reviewed | 0 | 5 |
+| [Driver.Galaxy](Driver.Galaxy/findings.md) | Claude Code | 2026-05-22 | `76d35d1` | Reviewed | 0 | 14 |
+| [Driver.Historian.Wonderware](Driver.Historian.Wonderware/findings.md) | Claude Code | 2026-05-22 | `76d35d1` | Reviewed | 0 | 12 |
+| [Driver.Historian.Wonderware.Client](Driver.Historian.Wonderware.Client/findings.md) | Claude Code | 2026-05-22 | `76d35d1` | Reviewed | 0 | 10 |
+| [Driver.Modbus](Driver.Modbus/findings.md) | Claude Code | 2026-05-22 | `76d35d1` | Reviewed | 0 | 12 |
+| [Driver.Modbus.Addressing](Driver.Modbus.Addressing/findings.md) | Claude Code | 2026-05-22 | `76d35d1` | Reviewed | 0 | 9 |
+| [Driver.Modbus.Cli](Driver.Modbus.Cli/findings.md) | Claude Code | 2026-05-22 | `76d35d1` | Reviewed | 0 | 8 |
+| [Driver.OpcUaClient](Driver.OpcUaClient/findings.md) | Claude Code | 2026-05-22 | `76d35d1` | Reviewed | 0 | 15 |
+| [Driver.S7](Driver.S7/findings.md) | Claude Code | 2026-05-22 | `76d35d1` | Reviewed | 0 | 14 |
+| [Driver.S7.Cli](Driver.S7.Cli/findings.md) | Claude Code | 2026-05-22 | `76d35d1` | Reviewed | 0 | 7 |
+| [Driver.TwinCAT](Driver.TwinCAT/findings.md) | Claude Code | 2026-05-22 | `76d35d1` | Reviewed | 0 | 16 |
+| [Driver.TwinCAT.Cli](Driver.TwinCAT.Cli/findings.md) | Claude Code | 2026-05-22 | `76d35d1` | Reviewed | 0 | 7 |
+| [Server](Server/findings.md) | Claude Code | 2026-05-22 | `76d35d1` | Reviewed | 0 | 15 |
 
 ## Pending findings
 
 Findings with status `Open` or `In Progress`, ordered by severity.
 
-| ID | Severity | Category | Location | Description |
-|---|---|---|---|---|
-| Admin-010 | Low | OtOpcUa conventions | `Components/App.razor:9,16` | `App.razor` loads Bootstrap CSS and JS from the `cdn.jsdelivr.net` CDN. `admin-ui.md` section "Tech Stack" specifies "Bootstrap 5 vendored under `wwwroot/lib/bootstrap/`" precisely so the Admin app has no third-party runtime dependency. A… |
-| Admin-011 | Low | Concurrency & thread safety | `Hubs/FleetStatusPoller.cs:24-26,98-103` | `FleetStatusPoller` keeps three plain `Dictionary<>` fields (`_last`, `_lastRole`, `_lastResilience`) mutated from `PollOnceAsync`. The poller `ExecuteAsync` loop is single-threaded so the steady-state poll path is safe, but `ResetCache()`… |
-| Admin-012 | Low | Design-document adherence | `Services/EquipmentCsvImporter.cs:18-19,33-37,229,232` | `EquipmentCsvImporter` declares `EquipmentId` as a required CSV column and parses it into a `required` field. `admin-ui.md` section "Equipment CSV import" (revised after adversarial review finding #4) is explicit: "No `EquipmentId` column… |
-| Analyzers-002 | Low | Correctness & logic bugs | `src/Tooling/ZB.MOM.WW.OtOpcUa.Analyzers/UnwrappedCapabilityCallAnalyzer.cs:46-50,130` | `AlarmSurfaceInvoker` is listed in `WrapperTypes`, but `AlarmSurfaceInvoker`'s public methods (`SubscribeAsync`, `UnsubscribeAsync`, `AcknowledgeAsync`) take no lambda arguments at all — callers pass `IReadOnlyList<...>` / `IAlarmSubscript… |
-| Analyzers-003 | Low | Error handling & resilience | `src/Tooling/ZB.MOM.WW.OtOpcUa.Analyzers/UnwrappedCapabilityCallAnalyzer.cs:80,114-116` | `IsInsideWrapperLambda` is passed `context.Operation.SemanticModel` and returns `false` when that model is `null`. A `false` return means "not wrapped", so a null semantic model produces a false-positive diagnostic rather than silently ski… |
-| Analyzers-004 | Low | Performance & resource management | `src/Tooling/ZB.MOM.WW.OtOpcUa.Analyzers/UnwrappedCapabilityCallAnalyzer.cs:95-112` | `ImplementsGuardedInterface` runs on every invocation operation in the compilation (every keystroke in the IDE). For each candidate it allocates via `AllInterfaces.Concat(new[] { method.ContainingType })`, builds a fully-qualified display… |
-| Analyzers-005 | Low | Design-document adherence | `src/Tooling/ZB.MOM.WW.OtOpcUa.Analyzers/UnwrappedCapabilityCallAnalyzer.cs:33-43` | `CapabilityInvoker`'s XML doc (`src/Core/.../Resilience/CapabilityInvoker.cs:15-17`) enumerates the routed capability surface as `IReadable`, `IWritable`, `ITagDiscovery`, `ISubscribable`, `IHostConnectivityProbe`, `IAlarmSource`, and all… |
-| Analyzers-007 | Low | Documentation & comments | `src/Tooling/ZB.MOM.WW.OtOpcUa.Analyzers/UnwrappedCapabilityCallAnalyzer.cs:21-26` | The `<remarks>` block states the analyzer "matches by receiver-interface identity using Roslyn's semantic model, not by method name". This is accurate for the guarded-call detection (`ImplementsGuardedInterface` uses symbols), but the wrap… |
-| Client.CLI-002 | Low | Correctness & logic bugs | `Commands/SubscribeCommand.cs:129-137` | The summary computes `neverWentBad` as every target whose node-id key is absent from the `everBad` dictionary. A node that received no update at all is also absent from `everBad`, so it is counted in `neverWentBad` and printed under the he… |
-| Client.CLI-003 | Low | Correctness & logic bugs | `Commands/BrowseCommand.cs:29-30`, `Commands/SubscribeCommand.cs:20-27`, `Commands/AlarmsCommand.cs:28-29`, `Commands/HistoryReadCommand.cs:42-43` | Numeric command options accept any value with no range validation. `--depth`, `--interval`, `--max-depth`, `--max`, and the history `--interval` can all be supplied as `0` or a negative number. A negative `--depth`/`--max-depth` silently d… |
-| Client.CLI-004 | Low | OtOpcUa conventions | `Commands/SubscribeCommand.cs:13-37` | `SubscribeCommand` is the only command in the module whose constructor and all `[CommandOption]` properties have no XML doc comments. Every other command (`ConnectCommand`, `ReadCommand`, `WriteCommand`, `BrowseCommand`, `AlarmsCommand`, `… |
-| Client.CLI-006 | Low | Error handling & resilience | `Commands/HistoryReadCommand.cs:73`, `Commands/HistoryReadCommand.cs:76`, `Helpers/NodeIdParser.cs:39` | Operator input-format errors surface as raw .NET exceptions rather than clean CLI errors. An unparseable start/end value throws `FormatException` straight out of `DateTime.Parse`; an invalid node id throws `FormatException`/`ArgumentExcept… |
-| Client.CLI-007 | Low | Performance & resource management | `CommandBase.cs:112-123` | `ConfigureLogging` builds a new Serilog `LoggerConfiguration`, creates a logger, and assigns it to the static `Log.Logger` without disposing the previously assigned logger. For a single CLI invocation this leaks at most one logger and the… |
-| Client.CLI-008 | Low | Documentation & comments | `docs/Client.CLI.md:158-217` | `docs/Client.CLI.md` is stale relative to the code at this commit. (1) The `subscribe` command section documents only `-n` and `-i`, but the code (`SubscribeCommand`) also exposes `-r/--recursive`, `--max-depth`, `-q/--quiet`, `--duration`… |
-| Client.CLI-009 | Low | Code organization & conventions | `Commands/SubscribeCommand.cs:66-165`, `Commands/AlarmsCommand.cs:52-91` | Both long-running commands attach an event handler (`service.DataChanged += ...`, `service.AlarmEvent += ...`) with a lambda and never detach it. Because the handler closes over `console`, the captured console and the closure remain refere… |
-| Client.CLI-010 | Low | Testing coverage | `tests/Client/ZB.MOM.WW.OtOpcUa.Client.CLI.Tests/SubscribeCommandTests.cs` | The new `SubscribeCommand` capabilities are largely untested. The four `SubscribeCommandTests` cover only single-node subscribe, unsubscribe-on-cancel, disconnect-in-finally, and the subscription message. There is no test for the `--recurs… |
-| Client.Shared-003 | Low | Correctness & logic bugs | `Adapters/DefaultSessionAdapter.cs:76`, `Adapters/DefaultSessionAdapter.cs:273` | `WriteValueAsync` returns `response.Results[0]` and `CallMethodAsync` reads `result.Results[0]` without first checking the `Results` collection is non-empty. A malformed or service-level-faulted response (empty `Results` alongside a servic… |
-| Client.Shared-004 | Low | OtOpcUa conventions | `Adapters/DefaultSessionAdapter.cs:228`, `Adapters/DefaultSessionAdapter.cs:121`, `Adapters/DefaultSessionAdapter.cs:172` | `CloseAsync`, `HistoryReadRawAsync`, and `HistoryReadAggregateAsync` are declared `async Task` but call the synchronous `Session.Close()` / `Session.HistoryRead(...)` APIs and contain no `await`. The history methods run a blocking synchron… |
-| Client.Shared-009 | Low | Error handling & resilience / Documentation & comments | `OpcUaClientService.cs:302-322` | `AcknowledgeAlarmAsync` is typed `Task<StatusCode>` and its XML doc implies the returned code reports the ack outcome, but the method unconditionally `return StatusCodes.Good`. The actual failure path is `DefaultSessionAdapter.CallMethodAs… |
-| Client.Shared-010 | Low | Performance & resource management | `Models/ConnectionSettings.cs:48`, `OpcUaClientService.cs:408-417` | `ConnectionSettings.CertificateStorePath` is initialized to `ClientStoragePaths.GetPkiPath()` as a property initializer, so every `ConnectionSettings` instantiation runs `Environment.GetFolderPath` + `Path.Combine` and, on the first call p… |
-| Client.Shared-011 | Low | Testing coverage | `tests/Client/ZB.MOM.WW.OtOpcUa.Client.Shared.Tests/OpcUaClientServiceTests.cs` | The test suite is solid for the happy paths, connection lifecycle, and single-failover behavior. Gaps relative to the findings above: (a) no test exercises concurrent `SubscribeAsync`/failover to expose the `_activeDataSubscriptions` race… |
-| Client.UI-003 | Low | OtOpcUa conventions | `ZB.MOM.WW.OtOpcUa.Client.UI.csproj:20-21`, `Program.cs:14-20` | The csproj references `Serilog` and `Serilog.Sinks.Console`, and `docs/Client.UI.md` lists Serilog as the logging technology, but no source file in the module uses Serilog. `Program.BuildAvaloniaApp()` uses Avalonia's `LogToTrace()` and th… |
-| Client.UI-004 | Low | OtOpcUa conventions | `Views/MainWindow.axaml.cs:125-138` | `OnBrowseCertPathClicked` uses `OpenFolderDialog`, which is obsolete in Avalonia 11.x (the version pinned in the csproj). The supported replacement is the `StorageProvider` API (`StorageProvider.OpenFolderPickerAsync`). Using the obsolete… |
-| Client.UI-006 | Low | Error handling & resilience | `ViewModels/MainWindowViewModel.cs:244-252`, `ViewModels/AlarmsViewModel.cs:88-112`, `ViewModels/SubscriptionsViewModel.cs:79-94` | Many catch blocks swallow exceptions silently with an empty body and only a comment (`// Redundancy info not available`, `// Subscribe failed`, `// Subscription failed; no item added`, and others). When a subscribe, alarm-subscribe, or red… |
-| Client.UI-009 | Low | Design-document adherence | `ViewModels/HistoryViewModel.cs:44-54` | `HistoryViewModel.AggregateTypes` exposes eight entries: `null` (Raw) plus Average, Minimum, Maximum, Count, Start, End, and `StandardDeviation`. `docs/Client.UI.md` ("Query Options" table) lists only "Raw (default), Average, Minimum, Maxi… |
-| Client.UI-010 | Low | Code organization & conventions | `Controls/DateTimeRangePicker.axaml.cs:33-37`, `Controls/DateTimeRangePicker.axaml.cs:70-80` | `DateTimeRangePicker` declares `MinDateTimeProperty` / `MaxDateTimeProperty` styled properties with public CLR accessors, but neither is read anywhere in the control. `TryParseDateTime`, `OnStartLostFocus`, and `OnEndLostFocus` never clamp… |
-| Client.UI-011 | Low | Documentation & comments | `Views/MainWindow.axaml:81`, `Services/JsonSettingsService.cs:11-15` | The certificate-store-path `TextBox` watermark reads `(default: AppData/LmxOpcUaClient/pki)`, referencing the legacy pre-task-#208 folder name. Per `CLAUDE.md` / `docs/Client.UI.md` the canonical path is now `{LocalAppData}/OtOpcUaClient/`… |
-| Configuration-004 | Low | OtOpcUa conventions | `src/Core/ZB.MOM.WW.OtOpcUa.Configuration/Enums/NodePermissions.cs:8`, `src/Core/ZB.MOM.WW.OtOpcUa.Configuration/OtOpcUaConfigDbContext.cs:417` | `NodePermissions` is declared `[Flags] enum ... : uint`, while its XML doc and `NodeAcl.PermissionFlags`' doc both say "stored as int", and `ConfigureNodeAcl` uses `HasConversion<int>()` — a `uint`→`int` conversion. Only bits 0–11 are used… |
-| Configuration-005 | Low | Concurrency & thread safety | `src/Core/ZB.MOM.WW.OtOpcUa.Configuration/LocalCache/LiteDbConfigCache.cs:50` | `PutAsync` performs a non-atomic find-then-insert/update. Two concurrent `PutAsync` calls for the same `(ClusterId, GenerationId)` can both observe `existing is null` and both `Insert`, producing two rows for one generation. The constructo… |
-| Configuration-007 | Low | Error handling & resilience | `src/Core/ZB.MOM.WW.OtOpcUa.Configuration/Apply/GenerationApplier.cs:44` | `ApplyPass` wraps each callback in `catch (Exception ex)`. This swallows `OperationCanceledException` — a cancellation during a callback is recorded as just another entity error string and the applier keeps walking the remaining passes ins… |
-| Configuration-010 | Low | Security | `src/Core/ZB.MOM.WW.OtOpcUa.Configuration/LocalCache/ResilientConfigReader.cs:81` | On central-DB read failure the warning log records the full exception object. Callers pass arbitrary `centralFetch` delegates; if any delegate closes over a connection string, an exception thrown from it (or a `SqlException` carrying serve… |
-| Configuration-011 | Low | Testing coverage | `src/Core/ZB.MOM.WW.OtOpcUa.Configuration/Apply/GenerationApplier.cs:7`, `src/Core/ZB.MOM.WW.OtOpcUa.Configuration/Validation/DraftValidator.cs:60` | The companion test project covers the cache, schema compliance, stored procedures, and `DraftValidator` well, but two flagged behaviours are not pinned: (a) `GenerationApplier` ordering/cancellation when a Removed callback fails — no test… |
-| Core-004 | Low | OtOpcUa conventions | `src/Core/ZB.MOM.WW.OtOpcUa.Core/Hosting/DriverHost.cs:55,72,87` | `DriverHost` is a library type whose async calls (`driver.InitializeAsync`, `driver.ShutdownAsync`) do not use `ConfigureAwait(false)`, whereas the sibling `CapabilityInvoker` and `AlarmSurfaceInvoker` in the same module consistently do. T… |
-| Core-008 | Low | Error handling & resilience | `src/Core/ZB.MOM.WW.OtOpcUa.Core/OpcUa/GenericDriverNodeManager.cs:42-64` | The XML summary of `BuildAddressSpaceAsync` states "Driver exceptions are isolated per decision #12 — the driver's subtree is marked Faulted, but other drivers remain available." The method body contains no such isolation: an exception fro… |
-| Core-009 | Low | Performance & resource management | `src/Core/ZB.MOM.WW.OtOpcUa.Core/Resilience/CapabilityInvoker.cs:121-128` | `ExecuteWriteAsync` calls `_optionsAccessor()` three times for a single non-idempotent write (once for the `with` expression, once inside the dictionary initializer for `.Resolve(...)`, plus the discarded base). On the per-write hot path i… |
-| Core-010 | Low | Code organization & conventions | `src/Core/ZB.MOM.WW.OtOpcUa.Core/Resilience/DriverResilienceOptions.cs:45-52` | `DriverResilienceOptions.Resolve` indexes the tier-default dictionary directly (`defaults[capability]`) with no fallback. Any future addition to `DriverCapability` that is not also added to all three tier tables in `GetTierDefaults` will m… |
-| Core-011 | Low | Testing coverage | `src/Core/ZB.MOM.WW.OtOpcUa.Core/Authorization/PermissionTrieBuilder.cs:58-75` | `PermissionTrieBuilder.Descend` has a two-branch behaviour: with a `scopePaths` lookup it descends the real hierarchy; without one it falls back to placing every non-cluster row directly under the root keyed by `ScopeId` ("works for determ… |
-| Core-012 | Low | Documentation & comments | `src/Core/ZB.MOM.WW.OtOpcUa.Core/Stability/WedgeDetector.cs:26`, `src/Core/ZB.MOM.WW.OtOpcUa.Core/Observability/DriverHealthReport.cs:11-22` | Two stale doc comments. (1) `WedgeDetector` — the `<summary>` above the constructor reads "Whether the driver reported itself `DriverState.Healthy` at construction." The constructor takes only a `TimeSpan threshold` and the detector is doc… |
-| Core.Abstractions-004 | Low | Concurrency & thread safety | `src/Core/ZB.MOM.WW.OtOpcUa.Core.Abstractions/DriverTypeRegistry.cs:23-40` | `Register` performs a check-then-act sequence (`snapshot.ContainsKey` then build `next` then `Interlocked.Exchange`) that is not atomic. Two threads registering concurrently can both pass the duplicate check and both build a `next` diction… |
-| Core.Abstractions-005 | Low | Error handling & resilience | `src/Core/ZB.MOM.WW.OtOpcUa.Core.Abstractions/PollGroupEngine.cs:90,99` | Both the initial-poll and steady-state catch blocks use a bare `catch { }` that swallows every exception type, including non-transient programmer errors such as `NullReferenceException` and `ArgumentOutOfRangeException` (see Core.Abstracti… |
-| Core.Abstractions-006 | Low | Code organization & conventions | `src/Core/ZB.MOM.WW.OtOpcUa.Core.Abstractions/IHistoryProvider.cs:63,84-86`, `src/Core/ZB.MOM.WW.OtOpcUa.Core.Abstractions/Historian/IHistorianDataSource.cs:30,63` | The two history-read surfaces use inconsistent integer types for the same "maximum rows" concept. `IHistoryProvider.ReadRawAsync` and `IHistorianDataSource.ReadRawAsync` take `uint maxValuesPerNode`, but `ReadEventsAsync` (on both interfac… |
-| Core.Abstractions-007 | Low | Testing coverage | `tests/Core/ZB.MOM.WW.OtOpcUa.Core.Abstractions.Tests/PollGroupEngineTests.cs` | `PollGroupEngine` is the only behavioural (non-DTO) type in the module and its tests, while solid for the happy paths, miss two paths that this review identifies as defect-prone: (a) no test exercises an array-valued tag whose contents are… |
-| Core.Abstractions-008 | Low | Documentation & comments | `src/Core/ZB.MOM.WW.OtOpcUa.Core.Abstractions/DriverHealth.cs:9`, `src/Core/ZB.MOM.WW.OtOpcUa.Core.Abstractions/IHistoryProvider.cs:39-43,65-69` | Two XML-doc inaccuracies: 1. `DriverHealth.LastError` is documented as "Most recent error message; null when state is Healthy." The `DriverState` enum also defines `Degraded`, `Reconnecting`, and `Faulted` states, all of which carry an err… |
-| Core.AlarmHistorian-008 | Low | Performance & resource management | `src/Core/ZB.MOM.WW.OtOpcUa.Core.AlarmHistorian/SqliteStoreAndForwardSink.cs:107-127,255-278` | Each `EnqueueAsync` (one per alarm transition — a hot path on a busy plant) opens a connection, runs `EnforceCapacity` (a `COUNT(*)` over the queue table on every single enqueue), serializes JSON, inserts, and closes the connection. The un… |
-| Core.AlarmHistorian-011 | Low | Documentation & comments | `src/Core/ZB.MOM.WW.OtOpcUa.Core.AlarmHistorian/IAlarmHistorianSink.cs:5-9,76`, `AlarmHistorianEvent.cs:20` | Several doc-comments reference the retired v1 architecture. The `IAlarmHistorianSink` summary says ingestion "routes through Galaxy.Host's pipe" and `IAlarmHistorianWriter` says "Stream G wires this to the Galaxy.Host IPC client", but `doc… |
-| Core.ScriptedAlarms-003 | Low | Documentation & comments | `ScriptedAlarmEngine.cs:343`, `docs/ScriptedAlarms.md:107` | `docs/ScriptedAlarms.md` (Composition step 3) and the `OnUpstreamChange` comment ("Fire-and-forget so driver-side dispatch isn't blocked", line 225-226) describe the `OnEvent` emission path as non-blocking / fire-and-forget. In the code, `… |
-| Core.ScriptedAlarms-006 | Low | Concurrency & thread safety | `ScriptedAlarmEngine.cs:232`, `ScriptedAlarmEngine.cs:369` | `OnUpstreamChange` and `RunShelvingCheck` both launch fire-and-forget tasks (`_ = ReevaluateAsync(...)`, `_ = ShelvingCheckAsync(...)`) with `CancellationToken.None`. There is no tracking of these in-flight tasks, so `Dispose` cannot await… |
-| Core.ScriptedAlarms-008 | Low | Performance & resource management | `Part9StateMachine.cs:261-268` | `AppendComment` copies the entire existing comment list into a new `List` on every audit-producing transition (ack, confirm, shelve, unshelve, enable, disable, add-comment, auto-unshelve). The `Comments` list is append-only and unbounded —… |
-| Core.ScriptedAlarms-009 | Low | Performance & resource management | `ScriptedAlarmEngine.cs:309-315`, `ScriptedAlarmEngine.cs:271` | `BuildReadCache` allocates a fresh `Dictionary<string, DataValueSnapshot>` on every predicate evaluation, i.e. on every upstream tag change for every referencing alarm. On a busy line where many tags feeding many alarms change frequently,… |
-| Core.ScriptedAlarms-010 | Low | Design-document adherence | `ScriptedAlarmEngine.cs:325-336`, `AlarmPredicateContext.cs:33-40`, `MessageTemplate.cs:47` | Quality handling is inconsistent across the three places that inspect a `DataValueSnapshot.StatusCode`. `AreInputsReady` (engine, line 333) treats only outright Bad (bit 31) as not-ready, so an Uncertain-quality input is fed to the predica… |
-| Core.ScriptedAlarms-011 | Low | Code organization & conventions | `Part9StateMachine.cs:275` | `TransitionResult.NoOp(state, reason)` takes a `reason` string parameter that is documented in the calling code as a diagnostic ("disabled — predicate result ignored", "already acknowledged", etc.) but the factory method silently discards… |
-| Core.Scripting-005 | Low | Correctness & logic bugs | `DependencyExtractor.cs:97` | A raw string literal token passed as the tag path (a raw triple-quote literal) tokenizes as `SingleLineRawStringLiteralToken` / `MultiLineRawStringLiteralToken`, not `StringLiteralToken`. The check `literal.Token.IsKind(SyntaxKind.StringLi… |
-| Core.Scripting-006 | Low | Concurrency & thread safety | `CompiledScriptCache.cs:55` | On a failed compile the `catch` block calls `_cache.TryRemove(key, out _)` without a value comparison. If two threads race a miss for the same bad source, both observe the same faulted `Lazy` and throw, and both call `TryRemove(key)`. If a… |
-| Core.Scripting-008 | Low | Performance & resource management | `CompiledScriptCache.cs:34`, `ScriptEvaluator.cs:34` | `CompiledScriptCache` has no capacity bound (acknowledged in the class remarks) and no eviction. Each cached `ScriptEvaluator` holds a Roslyn `ScriptRunner<T>` delegate, which keeps the dynamically emitted script assembly loaded for the pr… |
-| Core.Scripting-009 | Low | Design-document adherence | `ForbiddenTypeAnalyzer.cs:45` | The Phase 7 plan decision #6 (`docs/v2/implementation/phase-7-scripting-and-alarming.md`) enumerates the forbidden surface as "No HttpClient / File / Process / reflection". `ForbiddenTypeAnalyzer` actually denies a broader set — `System.Th… |
-| Core.Scripting-011 | Low | Testing coverage | `tests/Core/ZB.MOM.WW.OtOpcUa.Core.Scripting.Tests/` | Two source files have no direct test coverage: `ScriptContext` (`Deadband` static helper is exercised only indirectly through `ScriptSandboxTests`, and not for its boundary `tolerance` behaviour) and `ScriptSandbox.Build` itself (the `Argu… |
-| Core.VirtualTags-004 | Low | Correctness & logic bugs | `src/Core/ZB.MOM.WW.OtOpcUa.Core.VirtualTags/VirtualTagEngine.cs:349` | `CoerceResult`'s switch has a default arm (`_ => raw`) that returns the script's raw return value uncoerced for any `DriverDataType` not in the explicit list (e.g. an array type, Byte, or a future enum member). The resulting `DataValueSnap… |
-| Core.VirtualTags-006 | Low | Concurrency & thread safety | `src/Core/ZB.MOM.WW.OtOpcUa.Core.VirtualTags/VirtualTagEngine.cs:177-182`, `:395-401` | `Subscribe` does `_observers.GetOrAdd(path, _ => [])` then `lock (list) { list.Add(observer); }`. When `Unsub.Dispose` removes the last observer, the now-empty List is left in `_observers` and the dictionary entry is never removed. For a l… |
-| Core.VirtualTags-007 | Low | Error handling & resilience | `src/Core/ZB.MOM.WW.OtOpcUa.Core.VirtualTags/TimerTriggerScheduler.cs:58` | `Tick` calls `_engine.EvaluateOneAsync(p, _cts.Token).GetAwaiter().GetResult()`, blocking the `System.Threading.Timer` callback thread (a thread-pool thread) for the full duration of the evaluation. Because `EvaluateInternalAsync` serialis… |
-| Core.VirtualTags-009 | Low | Performance & resource management | `src/Core/ZB.MOM.WW.OtOpcUa.Core.VirtualTags/DependencyGraph.cs:64-65`, `:72-73` | `DirectDependencies` and `DirectDependents` allocate a fresh empty `HashSet<string>` on every call for an unregistered node. `DirectDependents` is called inside the `TopologicalSort` Kahn loop and the `CascadeAsync` DFS, so for a graph wit… |
-| Core.VirtualTags-010 | Low | Documentation & comments | `src/Core/ZB.MOM.WW.OtOpcUa.Core.VirtualTags/ITagUpstreamSource.cs:18`, `VirtualTagContext.cs:30`, `VirtualTagDefinition.cs:28` | Several XML docs reference component names that do not exist in the codebase. `ITagUpstreamSource` XML doc says the subscription path "feeds the engine's ChangeTriggerDispatcher" -- there is no ChangeTriggerDispatcher; the actual path is `… |
-| Core.VirtualTags-011 | Low | Code organization & conventions | `src/Core/ZB.MOM.WW.OtOpcUa.Core.VirtualTags/VirtualTagEngine.cs:404-409` | `VirtualTagState` records a Writes set (the `ctx.SetVirtualTag` targets extracted by `DependencyExtractor`), but nothing in the engine reads it -- it is captured at `Load` and never used. Declared write targets are not validated against th… |
-| Core.VirtualTags-013 | Low | Documentation & comments | `src/Core/ZB.MOM.WW.OtOpcUa.Core.VirtualTags/DependencyGraph.cs:266-270` | `DependencyCycleException.BuildMessage` renders each cycle as `string.Join(" -> ", c) + " -> " + c[0]`, presenting the SCC member list as a traversable edge path that loops back to its first element. Tarjan's algorithm returns the members… |
-| Driver.AbCip-007 | Low | OtOpcUa conventions | `AbCipDriver.cs` (whole file), `AbCipAlarmProjection.cs`, `LibplctagTagRuntime.cs` | `CLAUDE.md` Library Preferences mandate Serilog with a rolling daily file sink. The driver has no logging at all: no `ILogger`/Serilog dependency is injected or used. Failure paths instead swallow exceptions into the `_health` string (`Rea… |
-| Driver.AbCip-011 | Low | Error handling & resilience | `AbCipDriver.cs:144-152`, `AbCipDriverOptions.cs:131-143` | `InitializeAsync` only starts probe loops when `_options.Probe.Enabled` is true AND `Probe.ProbeTagPath` is non-blank. When `Probe.Enabled` is true (the default) but `ProbeTagPath` is null (also the default; the doc comment says "PR 8 wire… |
-| Driver.AbCip-012 | Low | Performance & resource management | `LibplctagTemplateReader.cs:15-35`, `AbCipDriver.cs:88-92` | `LibplctagTemplateReader` is created per `FetchUdtShapeAsync` call, and each call constructs a fresh libplctag `Tag` for the @udt pseudo-tag, initializes it (a CIP connection handshake), reads, and disposes it. There is no reuse of the `Ta… |
-| Driver.AbCip-013 | Low | Design-document adherence | `AbCipDriverOptions.cs:70-73`, `PlcFamilies/AbCipPlcFamilyProfile.cs:13-19`, `LibplctagTagRuntime.cs:16-27` | `driver-specs.md` specifies the AB CIP per-device connection settings as discrete fields: Host, Path, PlcType, TimeoutMs, AllowPacking, ConnectionSize. The implementation instead collapses host + path into a single opaque ab:// URL string… |
-| Driver.AbCip-015 | Low | Documentation & comments | `AbCipDriver.cs:9-11`, `PlcTagHandle.cs:23-27,53-58`, `AbCipTemplateCache.cs:12-15`, `IAbCipTagEnumerator.cs:6-11`, `AbCipDriverOptions.cs:21` | Numerous comments are stale relative to the commit under review. `AbCipDriver.cs:9-11` says the driver "Implements IDriver only for now" with capabilities shipping "in subsequent PRs (3-8)" while the class already implements all of them. `… |
-| Driver.AbCip.Cli-003 | Low | Concurrency & thread safety | `src/Drivers/Cli/ZB.MOM.WW.OtOpcUa.Driver.AbCip.Cli/Commands/SubscribeCommand.cs:50-56,60-61` | The `OnDataChange` handler writes change lines to `console.Output` (a `TextWriter`) from the driver's poll-engine callback thread, while the command's main flow concurrently writes the "Subscribed to ... Ctrl+C to stop." line on the CLI th… |
-| Driver.AbCip.Cli-004 | Low | Error handling & resilience | `src/Drivers/Cli/ZB.MOM.WW.OtOpcUa.Driver.AbCip.Cli/Commands/SubscribeCommand.cs:28,58`; `AbCipCommandBase.cs:26-34` | `--interval-ms` (`IntervalMs`) is taken verbatim and passed as `TimeSpan.FromMilliseconds(IntervalMs)` to `SubscribeAsync` with no validation. A zero or negative value produces a non-positive `TimeSpan`; the option description claims "Poll… |
-| Driver.AbCip.Cli-005 | Low | Performance & resource management | `src/Drivers/Cli/ZB.MOM.WW.OtOpcUa.Driver.Cli.Common/DriverCommandBase.cs:51-59` | `ConfigureLogging` assigns a freshly created Serilog logger to the process-global `Log.Logger` but never calls `Log.CloseAndFlush()`. For a short-lived one-shot command (`probe`, `read`, `write`) the process exit flushes the console sink,… |
-| Driver.AbCip.Cli-006 | Low | Design-document adherence | `src/Drivers/Cli/ZB.MOM.WW.OtOpcUa.Driver.AbCip.Cli/AbCipCommandBase.cs:29-34` | `AbCipCommandBase` overrides the abstract `DriverCommandBase.Timeout` property with a getter derived from `TimeoutMs` and an empty `init` body (`init { /* driven by TimeoutMs */ }`). Because the override has no `[CommandOption]` attribute,… |
-| Driver.AbCip.Cli-007 | Low | Testing coverage | `tests/Drivers/Cli/ZB.MOM.WW.OtOpcUa.Driver.AbCip.Cli.Tests/WriteCommandParseValueTests.cs` | The only test file covers `WriteCommand.ParseValue` and `ReadCommand.SynthesiseTagName` — both pure static helpers. There is no coverage for `AbCipCommandBase.BuildOptions` (the flag-to-`AbCipDriverOptions` mapping that all four commands d… |
-| Driver.AbCip.Cli-008 | Low | Documentation & comments | `docs/Driver.AbCip.Cli.md:8-9` | `docs/Driver.AbCip.Cli.md` opens with "Second of four driver test-client CLIs (Modbus -> AB CIP -> AB Legacy -> S7 -> TwinCAT)." The count "four" contradicts the chain that follows it (five names) and contradicts `docs/DriverClis.md`, whic… |
-| Driver.AbLegacy-005 | Low | OtOpcUa conventions | `AbLegacyDriver.cs` (whole file) | The driver uses no `ILogger`/Serilog at all. Probe-loop failures, runtime initialisation failures, libplctag non-zero statuses, and read/write exceptions are folded into `DriverHealth.Detail` strings but never logged. CLAUDE.md names Seril… |
-| Driver.AbLegacy-011 | Low | Performance & resource management | `AbLegacyDriver.cs:440` | `Dispose()` is implemented as `DisposeAsync().AsTask().GetAwaiter().GetResult()` - sync-over-async. `ShutdownAsync` awaits `_poll.DisposeAsync()` (which completes synchronously) and does no other real async work, so a deadlock is unlikely… |
-| Driver.AbLegacy-013 | Low | Code organization & conventions | `AbLegacyDriver.cs:340-345`, `AbLegacyDriver.cs:238-264` | Two minor organisational issues: 1. `ResolveHost` returns `_options.Devices.FirstOrDefault()?.HostAddress ?? DriverInstanceId` when the reference is unknown and no devices are configured. `DriverInstanceId` is not a host address (ab://...)… |
-| Driver.AbLegacy.Cli-002 | Low | Correctness & logic bugs | `Commands/WriteCommand.cs:27-29`, `Program.cs:6-9` | The `--value` option help text states "booleans accept true/false/1/0", but `ParseBool` (`WriteCommand.cs:74-80`) and the error message also accept `on/off` and `yes/no`, and `DriverClis.md` documents the full `true/false/1/0/yes/no/on/off… |
-| Driver.AbLegacy.Cli-003 | Low | Concurrency & thread safety | `Commands/SubscribeCommand.cs:47-53` | The `OnDataChange` handler calls `console.Output.WriteLine(line)` (the synchronous overload) directly from the `PollGroupEngine` poll thread. The poll engine raises change events from a background timer/loop thread, so two ticks that fire… |
-| Driver.AbLegacy.Cli-004 | Low | Error handling & resilience | `Commands/ProbeCommand.cs:37-56`, `Commands/ReadCommand.cs:39-50`, `Commands/WriteCommand.cs:48-59`, `Commands/SubscribeCommand.cs:41-76` | Every command does `await using var driver = new AbLegacyDriver(...)` *and* an explicit `await driver.ShutdownAsync(...)` in the `finally`. `AbLegacyDriver` `DisposeAsync` itself calls `ShutdownAsync`, so the driver is shut down twice on t… |
-| Driver.AbLegacy.Cli-005 | Low | Design-document adherence | `Commands/SubscribeCommand.cs:23-25`, `docs/Driver.AbLegacy.Cli.md:94-96` | The subscribe command interval option is `--interval-ms` (default 1000). `docs/Driver.AbLegacy.Cli.md` shows the subscribe example as `otopcua-ablegacy-cli subscribe ... -i 500`, which works because of the short alias `'i'`, but the doc ne… |
-| Driver.AbLegacy.Cli-006 | Low | Code organization & conventions | `Commands/ProbeCommand.cs:20-22` | `ProbeCommand` declares its `--type` option with no short alias, while `ReadCommand`, `WriteCommand`, and `SubscribeCommand` all declare `--type` with the short alias `'t'`. `ProbeCommand` also gives `--address` the alias `'a'`, matching t… |
-| Driver.AbLegacy.Cli-007 | Low | Testing coverage | `tests/Drivers/Cli/ZB.MOM.WW.OtOpcUa.Driver.AbLegacy.Cli.Tests/WriteCommandParseValueTests.cs` | The only test file in the CLI test project covers `WriteCommand.ParseValue` and `ReadCommand.SynthesiseTagName`. Two behaviours that are pure logic (testable without a device) are uncovered: (1) `AbLegacyCommandBase.BuildOptions` — that it… |
-| Driver.Cli.Common-004 | Low | Error handling & resilience | `src/Drivers/Cli/ZB.MOM.WW.OtOpcUa.Driver.Cli.Common/SnapshotFormatter.cs:68-70` | `FormatTable` calls `rows.Max(r => r.Tag.Length)` (and the same for the value and status columns) without guarding against empty input. When `tagNames` and `snapshots` are both empty (equal length, so the mismatch check at line 56 passes),… |
-| Driver.Cli.Common-006 | Low | Documentation & comments | `src/Drivers/Cli/ZB.MOM.WW.OtOpcUa.Driver.Cli.Common/SnapshotFormatter.cs:71`, `src/Drivers/Cli/ZB.MOM.WW.OtOpcUa.Driver.Cli.Common/DriverCommandBase.cs:9` | Two minor doc inaccuracies. (1) The comment at `SnapshotFormatter.cs:71` states the "source-time column is fixed-width (ISO-8601 to ms) so no max-measurement needed" — true only when every snapshot has a non-null `SourceTimestampUtc`. `For… |
-| Driver.FOCAS-007 | Low | Error handling & resilience | `FocasDriver.cs:140-148`, `FocasDriver.cs:478-484`, `FocasDriver.cs:529-533`, `FocasAlarmProjection.cs:61-63` | Numerous `try { ... } catch {}` blocks swallow every exception with no logging - `ShutdownAsync` (CTS cancel/dispose), `RecycleLoopAsync` (`DisposeClient`), `FixedTreeLoopAsync` transient catches, `ProbeLoopAsync`, and the alarm projection… |
-| Driver.FOCAS-008 | Low | Performance & resource management | `FocasDriver.cs:201`, `FocasDriver.cs:253` | `ReadAsync` and `WriteAsync` call `FocasAddress.TryParse(def.Address)` on every operation, even though `InitializeAsync` already parsed and validated every tag address. On a subscription hot path (each poll tick re-enters `ReadAsync`) this… |
-| Driver.FOCAS-009 | Low | Design-document adherence | `FocasDriverOptions.cs:110-115`, `FocasDriver.cs:468-486`, `FocasDriverFactoryExtensions.cs:75-80` | `FocasProbeOptions.Timeout` is parsed by the factory (`FocasProbeDto.TimeoutMs` to `FocasProbeOptions.Timeout`) but never consumed. `ProbeLoopAsync` calls `client.ProbeAsync(ct)` with only the probe-loop cancellation token; no per-probe ti… |
-| Driver.FOCAS-010 | Low | Code organization & conventions | `IFocasClient.cs:210-227` (`FocasOpMode`), `FocasConstants.cs:42-78` (`FocasOperationMode`) | There are two parallel operation-mode-to-text mappings with divergent labels. `FocasOpMode.ToText` (used by the driver fixed-tree `OperationMode/ModeText` node) yields `"TJOG"`, `"TEACH_IN_HANDLE"`; `FocasOperationModeExtensions.ToText` (i… |
-| Driver.FOCAS-011 | Low | Code organization & conventions | `IFocasClient.cs:275-287` (`FocasAlarmType`), `FocasAlarmProjection.cs:149-175` | `FocasAlarmType` declares its constants as `public const int`, but the only consumers - `FocasAlarmProjection.MapAlarmType(short type)` and `MapSeverity(short type)` - take a `short` and `switch` against these `int` constants. It compiles… |
-| Driver.FOCAS.Cli-001 | Low | Error handling & resilience | `Commands/WriteCommand.cs:58-68` | `WriteCommand.ParseValue` parses the numeric `--value` types (`Byte`/`Int16`/`Int32`/`Float32`/`Float64`) with `sbyte.Parse` / `short.Parse` / etc. These throw raw `FormatException` or `OverflowException` for malformed or out-of-range inpu… |
-| Driver.FOCAS.Cli-002 | Low | Concurrency & thread safety | `Commands/SubscribeCommand.cs:45-51` | The `subscribe` command attaches an `OnDataChange` handler that calls the synchronous `console.Output.WriteLine`. `OnDataChange` is raised from the driver's `PollGroupEngine` tick thread, while the command's main flow writes the "Subscribe… |
-| Driver.FOCAS.Cli-003 | Low | Error handling & resilience | `FocasCommandBase.cs:19` (`CncPort`), `FocasCommandBase.cs:27` (`TimeoutMs`), `Commands/SubscribeCommand.cs:23` (`IntervalMs`) | The numeric command options `--cnc-port`, `--timeout-ms`, and `--interval-ms` are accepted without range validation. A zero or negative `--cnc-port` produces an invalid `focas://host:<n>` string; `--timeout-ms 0` yields a zero `TimeSpan` o… |
-| Driver.FOCAS.Cli-004 | Low | Performance & resource management | `Commands/ProbeCommand.cs:37,54`; `Commands/ReadCommand.cs:37,46`; `Commands/WriteCommand.cs:45,54`; `Commands/SubscribeCommand.cs:39,73` | Every command declares `await using var driver = new FocasDriver(...)` |
-| Driver.FOCAS.Cli-005 | Low | Design-document adherence | `Commands/WriteCommand.cs:50`, `Commands/ProbeCommand.cs:50` (via `SnapshotFormatter.FormatStatus`) | `docs/Driver.FOCAS.Cli.md` documents `BadDeviceFailure` and `BadCommunicationError` as the key diagnostic signals an operator reads off `probe` / `write` output ("A `BadCommunicationError` means ... `BadDeviceFailure` after a successful co… |
-| Driver.Galaxy-005 | Low | OtOpcUa conventions | `Runtime/EventPump.cs:81-88` | The `BoundedChannelOptions` comment states "Newest-dropped policy: when full, the producer's TryWrite returns false ... We do this manually rather than relying on `BoundedChannelFullMode.DropWrite`" — but the option is then set to `FullMod… |
-| Driver.Galaxy-010 | Low | Security | `GalaxyDriver.cs:311-341` | `ResolveApiKey` supports an `env:`/`file:` indirection and otherwise treats the config string as the literal API key ("Anything else — used as the literal API key. Convenient for dev"). `GalaxyGatewayOptions`' own XML doc claims "the API k… |
-| Driver.Galaxy-012 | Low | Performance & resource management | `Runtime/SubscriptionRegistry.cs:65-67`, `GalaxyDriver.cs:538`, `GalaxyDriver.cs:675` | Several hot paths are O(n^2) per call. `SubscriptionRegistry.ResolveSubscribers` does `entry.Bindings.FirstOrDefault(b => b.ItemHandle == itemHandle)` — a linear scan of the whole binding list for every event dispatch; at 50k tags this is… |
-| Driver.Galaxy-013 | Low | Design-document adherence | `GalaxyDriver.cs:14-27`, `GalaxyDriver.cs:374-382`, `Config/GalaxyDriverOptions.cs:84-86` | Multiple doc comments are stale relative to the shipped code. `GalaxyDriver`'s class summary still describes the file as "the project skeleton with `IDriver` bodies that wire to a future `IGalaxyGatewayClient` abstraction. Capability inter… |
-| Driver.Historian.Wonderware-004 | Low | Correctness and logic bugs | `Backend/SdkAlarmHistorianWriteBackend.cs:198-201` | `ToHistorianEvent` only assigns `historianEvent.Id` when `Guid.TryParse(dto.EventId, ...)` succeeds. If `EventId` is not a parseable GUID (or is empty), `Id` stays `Guid.Empty` and the event is written to the historian with an all-zeros id… |
-| Driver.Historian.Wonderware-005 | Low | Concurrency and thread safety | `Backend/HistorianDataSource.cs:124`, `:126-127` | `GetHealthSnapshot` reads `_activeProcessNode` and `_activeEventNode` inside `_healthLock`, but those two fields are written under `_connectionLock` / `_eventConnectionLock` (lines 183, 243, 209-210, 266-269) — a different lock. The health… |
-| Driver.Historian.Wonderware-007 | Low | Error handling and resilience | `Ipc/PipeServer.cs:70-75` | When `VerifyCaller` rejects the peer SID, the server logs the reason and calls `_current.Disconnect()` with no `HelloAck` frame sent. The shared-secret-mismatch and major-version-mismatch paths below it both send a rejecting `HelloAck` so… |
-| Driver.Historian.Wonderware-008 | Low | Error handling and resilience | `Backend/HistorianDataSource.cs:301-307`, `:374-380` | When `query.StartQuery` returns `false`, `ReadRawAsync` and `ReadAggregateAsync` call `HandleConnectionError()` and return an empty result list. A failed `StartQuery` is not necessarily a connection failure — it can be a bad tag name, an i… |
-| Driver.Historian.Wonderware-010 | Low | Performance and resource management | `Backend/HistorianConfiguration.cs:32-36`, `Backend/HistorianDataSource.cs` (all read methods) | `HistorianConfiguration.RequestTimeoutSeconds` is documented as the "outer safety timeout applied to sync-over-async Historian operations" and is copied around (`SdkAlarmHistorianWriteBackend.CloneConfigWithServerName:346`), but it is neve… |
-| Driver.Historian.Wonderware-011 | Low | Design-document adherence | `Backend/HistorianDataSource.cs:9-12`, `Backend/IHistorianDataSource.cs:9-11`, `Backend/HistorianSample.cs:7-9`, `Backend/HistorianConfiguration.cs:7-9` | Several XML doc comments reference the retired v1 architecture as if it were current: "inside Galaxy.Host", "the Proxy maps returned samples", "the Host returns these across the IPC boundary as `GalaxyDataValue`", "Populated from ... the P… |
-| Driver.Historian.Wonderware-012 | Low | Testing coverage | `Backend/HistorianDataSource.cs`, `tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Historian.Wonderware.Tests/` | The unit-test suite covers `HistorianQualityMapper`, `HistorianClusterEndpointPicker`, `SdkAlarmHistorianWriteBackend`, `AahClientManagedAlarmEventWriter`, the IPC round trip, and `Program` alarm-writer wiring. `HistorianDataSource` itself… |
-| Driver.Historian.Wonderware.Client-003 | Low | Concurrency & thread safety | `WonderwareHistorianClient.cs:207`, `WonderwareHistorianClient.cs:132-150` | `_totalQueries` is mutated with `Interlocked.Increment` in `Invoke`, but read inside `GetHealthSnapshot` under `_healthLock`, and every other counter (`_totalSuccesses`, `_totalFailures`, `_consecutiveFailures`) is mutated only under `_hea… |
-| Driver.Historian.Wonderware.Client-004 | Low | Concurrency & thread safety | `WonderwareHistorianClient.cs:203-267` | A sidecar-reported failure is recorded in two non-atomic steps under separate lock acquisitions: `Invoke` calls `RecordSuccess()` (line 211) and then the caller calls `ThrowIfFailed` which calls `ReclassifySuccessAsFailure()` (line 256), d… |
-| Driver.Historian.Wonderware.Client-006 | Low | Error handling & resilience | `Internal/PipeChannel.cs:96-107`, `WonderwareHistorianClientOptions.cs:11-12` | `PipeChannel.InvokeAsync` retries exactly once on transport failure and otherwise propagates. The options expose `ReconnectInitialBackoff` and `ReconnectMaxBackoff` and `WonderwareHistorianClientOptions` documents them as exponential backo… |
-| Driver.Historian.Wonderware.Client-008 | Low | Security | `ZB.MOM.WW.OtOpcUa.Driver.Historian.Wonderware.Client.csproj:29-32` | The csproj suppresses two NuGet audit advisories (`GHSA-37gx-xxp4-5rgx`, `GHSA-w3x6-4m5h-cxqf`) for the `MessagePack` 2.5.187 dependency with no inline comment recording why the suppression is safe, who reviewed it, or when it should be re… |
-| Driver.Historian.Wonderware.Client-010 | Low | Documentation & comments | `WonderwareHistorianClient.cs:355-361`, `WonderwareHistorianClient.cs:132-150` | Two doc/behaviour mismatches. (1) The `Dispose()` XML comment asserts the underlying channel async cleanup is non-blocking so the `GetAwaiter()/GetResult()` bridge is safe. `PipeChannel.DisposeAsync` calls `ResetTransport()`, which invokes… |
-| Driver.Modbus-003 | Low | Concurrency & thread safety | `ModbusDriver.cs:59,188,241,259,266,726,745,759` | `_health` is a non-`volatile` reference field written from multiple threads (concurrent `ReadAsync` callers, the coalesced-read path, `WriteAsync` indirectly, and `ProbeLoopAsync`) and read by `GetHealth()`. Reference assignment is atomic… |
-| Driver.Modbus-007 | Low | Design-document adherence | `ModbusDriver.cs:1392`, `ModbusDriverOptions.cs:74-80` | Two design-vs-code drifts. (1) `MapDataType` maps `Int64`/`UInt64` to `DriverDataType.Int32` with the inline comment "widening to Int32 loses precision; PR 25 adds Int64 to DriverDataType". The address-space node for a 64-bit Modbus tag is… |
-| Driver.Modbus-008 | Low | Documentation & comments | `ModbusDriver.cs:411-417,700-703,737-744` | Stale/misleading comments. (1) The `<summary>` block at `ModbusDriver.cs:411-417` says auto-prohibited ranges are "Cleared by ReinitializeAsync ... or by an explicit re-probe API (not yet shipped)" — the re-probe loop has shipped (#151, `R… |
-| Driver.Modbus-009 | Low | Correctness & logic bugs | `ModbusDriver.cs:1160-1167`, `ModbusTcpTransport.cs:94-95` | Two edge cases. (1) `RegisterCount` for `ModbusDataType.String` computes `(tag.StringLength + 1) / 2`; a tag configured with `StringLength = 0` yields a register count of 0, flowing into `ReadOneAsync` as `totalRegs = 0` and producing an F… |
-| Driver.Modbus-010 | Low | Error handling & resilience | `ModbusDriver.cs:864-868`, `ModbusDriverOptions.cs:116-125` | When `WriteOnChangeOnly` is enabled and `IsRedundantWrite` returns true, `WriteAsync` returns `WriteResult(0u)` (Good) without touching the wire. The suppression baseline (`_lastWrittenByRef`) is only invalidated by a *read* that returns a… |
-| Driver.Modbus-011 | Low | Code organization & conventions | `ModbusDriver.cs:23-43,89-97,408-432` | Field and member declarations are interleaved with methods throughout `ModbusDriver`. `ResolveHost` (a public method) is the first member of the class, followed by `BuildSlaveHostName`, then a block of fields; `_lastPublishedByRef`/`_lastW… |
-| Driver.Modbus-012 | Low | Testing coverage | `tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Modbus.Tests/` | The unit suite is broad (coalescing, bisection, auto-recovery, byte order, arrays, BCD, RMW, caps, multi-unit, probe, reconnect, subscription). Gaps relative to the findings above: (1) no test exercises concurrent multi-subscription publis… |
-| Driver.Modbus.Addressing-006 | Low | Error handling & resilience | `ModbusAddressParser.cs:297-301` | `TryParseFamilyNative` catches only `ArgumentException` and `OverflowException`. The current helpers throw only those (including `ArgumentOutOfRangeException`, which derives from `ArgumentException`), so today it is correct. But the parser… |
-| Driver.Modbus.Addressing-007 | Low | Design-document adherence | `ModbusDataType.cs:91-95`, `docs/v2/dl205.md` section Strings | `ModbusStringByteOrder` (HighByteFirst / LowByteFirst) is defined in this assembly and documented as the DL205 low-byte-first string-packing knob, but `ParsedModbusAddress` has no field for it and `ModbusAddressParser` never produces or co… |
-| Driver.Modbus.Addressing-009 | Low | Documentation & comments | `ModbusModiconAddress.cs:55-64`, `ModbusModiconAddress.cs:104-110` | The comments on `ModbusModiconAddress.TryParse` are slightly inaccurate. The remark that 5-digit Modicon is always exactly 5 chars (40001..49999) and 6-digit is exactly 6 (400001..465536-shaped) implies the leading digit is always 4, but t… |
-| Driver.Modbus.Cli-003 | Low | Correctness & logic bugs | `src/Drivers/Cli/ZB.MOM.WW.OtOpcUa.Driver.Modbus.Cli/ModbusCommandBase.cs:14-24` | `Port` (`int`) and `TimeoutMs` (`int`) accept any 32-bit value, including negatives and ports above 65535. `UnitId` is a `byte`, so it accepts 0-255 even though the option description and `docs/Driver.Modbus.Cli.md` both say the valid rang… |
-| Driver.Modbus.Cli-004 | Low | Concurrency & thread safety | `src/Drivers/Cli/ZB.MOM.WW.OtOpcUa.Driver.Modbus.Cli/Commands/SubscribeCommand.cs:61-67` | The `OnDataChange` handler is invoked from the driver's `PollGroupEngine` background thread and calls `console.Output.WriteLine` synchronously. An exception thrown inside this handler (e.g. an `IOException` on a redirected or closed stdout… |
-| Driver.Modbus.Cli-005 | Low | Error handling & resilience | `src/Drivers/Cli/ZB.MOM.WW.OtOpcUa.Driver.Modbus.Cli/Commands/ProbeCommand.cs:21-54`; `Commands/ReadCommand.cs:46-75`; `Commands/WriteCommand.cs:54-89` | All three commands call `ConfigureLogging()` then `console.RegisterCancellationHandler()`, but if the operator presses Ctrl+C before `InitializeAsync` completes, the resulting `OperationCancelledException` propagates out of `ExecuteAsync`… |
-| Driver.Modbus.Cli-006 | Low | Error handling & resilience | `src/Drivers/Cli/ZB.MOM.WW.OtOpcUa.Driver.Modbus.Cli/Commands/ProbeCommand.cs:35-53` | `probe` reports `Health: {health.State}` from `GetHealth()`. After a successful `InitializeAsync` the driver sets state to `Healthy` regardless of whether the subsequent probe register read returns Good or a Bad status code. `ReadAsync` do… |
-| Driver.Modbus.Cli-007 | Low | Design-document adherence | `docs/Driver.Modbus.Cli.md:124-156`; `src/Drivers/Cli/ZB.MOM.WW.OtOpcUa.Driver.Modbus.Cli/Commands/ReadCommand.cs` | `docs/Driver.Modbus.Cli.md` devotes a whole "v2 addressing grammar" section to the industry-standard tag-address strings (`40001:F:CDAB`, `HR1:I`, `C100`, `V2000:F:CDAB`, etc.) and says "set the per-tag `addressString` field instead of the… |
-| Driver.Modbus.Cli-008 | Low | Testing coverage | `tests/Drivers/Cli/ZB.MOM.WW.OtOpcUa.Driver.Modbus.Cli.Tests/` | The test project covers only the two pure-function seams: `ReadCommand.SynthesiseTagName` and `WriteCommand.ParseValue`. There is no coverage for `WriteCommand`'s read-only-region rejection (`Region is not (Coils or HoldingRegisters)`), no… |
-| Driver.OpcUaClient-011 | Low | Documentation & comments | `OpcUaClientDriver.cs:783-784` | The comment on the isArray computation states "-1 = scalar; 1+ = array dimensions; 0 = one-dimensional array". This is inaccurate against OPC UA ValueRank semantics: -3 is ScalarOrOneDimension, -2 is Any, -1 is Scalar, and 0 is OneOrMoreDi… |
-| Driver.OpcUaClient-014 | Low | Performance & resource management | `OpcUaClientDriver.cs:904`, `:1035` | `MonitoredItem.Notification += (mi, args) => ...` (and the alarm-event equivalent) attaches a closure-capturing lambda to each monitored item's event. The lambda is never detached. When UnsubscribeAsync removes a subscription it calls Subs… |
-| Driver.S7-003 | Low | Correctness & logic bugs | `S7Driver.cs:172`, `S7Driver.cs:255` | ReadAsync and WriteAsync dereference fullReferences.Count / writes.Count with no null guard. A null argument throws NullReferenceException rather than ArgumentNullException, and the NRE escapes before the _gate is taken so it is not wrappe… |
-| Driver.S7-005 | Low | OtOpcUa conventions | `S7Driver.cs:33`, `S7Driver.cs:433` | System.Collections.Concurrent.ConcurrentDictionary is written out with a fully-qualified namespace at the field declarations instead of a using System.Collections.Concurrent directive. ImplicitUsings is enabled and the rest of the codebase… |
-| Driver.S7-009 | Low | Error handling & resilience | `S7Driver.cs:392` | The subscription poll loop never reflects sustained polling failure anywhere an operator can see it. PollLoopAsync swallows every non-cancellation exception with an empty catch and the comment claims "the health surface reflects it" - but… |
-| Driver.S7-010 | Low | Performance & resource management | `S7Driver.cs:504` | Dispose() is implemented as DisposeAsync().AsTask().GetAwaiter().GetResult() - sync-over-async. Inside the generic host this is currently safe (no captured SynchronizationContext), but it is a known deadlock pattern. The only async work be… |
-| Driver.S7-013 | Low | Code organization & conventions | `S7DriverOptions.cs:90`, `S7Driver.cs:300` | S7TagDefinition.StringLength is a public configured/JSON-bound parameter (default 254) but is dead: S7DataType.String reads and writes both throw NotSupportedException ("...land in a follow-up PR"), so StringLength is never consumed. Likew… |
-| Driver.S7.Cli-004 | Low | Performance & resource management | `src/Drivers/Cli/ZB.MOM.WW.OtOpcUa.Driver.S7.Cli/Commands/ProbeCommand.cs:36,53`, `Commands/ReadCommand.cs:45,54`, `Commands/WriteCommand.cs:51,60`, `Commands/SubscribeCommand.cs:39,73` | Every command declares the driver with `await using var driver = new S7Driver(...)` and *also* calls `await driver.ShutdownAsync(...)` in a `finally` block. `S7Driver.DisposeAsync` itself calls `ShutdownAsync`, so shutdown runs twice per c… |
-| Driver.S7.Cli-005 | Low | Code organization & conventions | `tests/ZB.MOM.WW.OtOpcUa.Driver.S7.Cli.Tests/` | A stale directory `tests/ZB.MOM.WW.OtOpcUa.Driver.S7.Cli.Tests/` exists containing only an `obj/` folder — no `.csproj`, no source. The real test project lives at `tests/Drivers/Cli/ZB.MOM.WW.OtOpcUa.Driver.S7.Cli.Tests/`. The empty direct… |
-| Driver.S7.Cli-006 | Low | Testing coverage | `tests/Drivers/Cli/ZB.MOM.WW.OtOpcUa.Driver.S7.Cli.Tests/WriteCommandParseValueTests.cs` | The only test file covers `WriteCommand.ParseValue` and `ReadCommand.SynthesiseTagName`. `S7CommandBase.BuildOptions` — which maps the host / port / CPU / rack / slot / timeout flags onto an `S7DriverOptions` and forces `Probe.Enabled = fa… |
-| Driver.S7.Cli-007 | Low | Documentation & comments | `src/Drivers/Cli/ZB.MOM.WW.OtOpcUa.Driver.S7.Cli/Commands/SubscribeCommand.cs:45-51` | The Modbus CLI `SubscribeCommand` carries an explanatory comment on the `OnDataChange` handler ("Route every data-change event to the CliFx console (not System.Console — the analyzer flags it + IConsole is the testable abstraction)"). The… |
-| Driver.TwinCAT-004 | Low | Correctness & logic bugs | `TwinCATDataType.cs:24-27` | The inline comments for the IEC time types are inaccurate. TwinCAT `TIME` is a duration (32-bit, milliseconds) — not "ms since epoch of day". `DATE` is stored as seconds since 1970-01-01 (truncated to a day boundary), not "days since 1970-… |
-| Driver.TwinCAT-006 | Low | OtOpcUa conventions | `TwinCATDriver.cs:406-411` | `ResolveHost` falls back to `DriverInstanceId` when there are no configured devices and the reference is unknown. `DriverInstanceId` is a logical config-DB identifier, not a host address; `IPerCallHostResolver` consumers expect a host key… |
-| Driver.TwinCAT-014 | Low | Design-document adherence | `TwinCATDriverOptions.cs:41-43`, `TwinCATDriverOptions.cs:57-62`, `AdsTwinCATClient.cs:145` | Several drifts between the implemented config surface and `docs/v2/driver-specs.md` section 6. The spec connection-settings list has separate `Host` (IP), `AmsNetId`, and `AmsPort` fields; the implementation collapses these into a single `… |
-| Driver.TwinCAT-015 | Low | Code organization & conventions | `TwinCATDriver.cs:431-432` | `Dispose()` runs `DisposeAsync().AsTask().GetAwaiter().GetResult()` — sync-over-async. `docs/v2/driver-stability.md` section Galaxy explicitly lists "sync-over-async on the OPC UA stack thread" among the four 2026-04-13 stability findings… |
-| Driver.TwinCAT-016 | Low | Testing coverage | `tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.TwinCAT.Tests/` | Unit coverage exists for AMS-address parsing, symbol-path parsing, read/write, native notifications, symbol browse, and the capability surface. Gaps tied to the findings above: no test exercises `ReinitializeAsync` with a changed config (D… |
-| Driver.TwinCAT.Cli-001 | Low | Correctness & logic bugs | `TwinCATCommandBase.cs:23-24`, `Commands/SubscribeCommand.cs:23-24`, `Commands/BrowseCommand.cs:21-24` | Numeric command options are accepted without range validation. `--timeout-ms` feeds `Timeout => TimeSpan.FromMilliseconds(TimeoutMs)`; passing `--timeout-ms 0` or a negative value yields `TimeSpan.Zero`/a negative `TimeSpan`, which is then… |
-| Driver.TwinCAT.Cli-002 | Low | Concurrency & thread safety | `Commands/SubscribeCommand.cs:46-58` | The `OnDataChange` handler calls `console.Output.WriteLine(line)` synchronously. In native ADS-notification mode the event is raised from the `Beckhoff.TwinCAT.Ads` notification callback thread (see `TwinCATDriver.SubscribeAsync`, which in… |
-| Driver.TwinCAT.Cli-003 | Low | Error handling & resilience | `Commands/SubscribeCommand.cs:56-58` | The subscribe banner reports the mechanism purely from the `--poll-only` flag (`var mode = PollOnly ? "polling" : "ADS notification"`). The doc (`docs/Driver.TwinCAT.Cli.md`) states the banner "announces which mechanism is in play". The CL… |
-| Driver.TwinCAT.Cli-004 | Low | Design-document adherence | `TwinCATCommandBase.cs:26-29`, `Commands/BrowseCommand.cs` | `--poll-only` is declared on `TwinCATCommandBase`, so it is inherited by `browse`. `BrowseCommand` only ever calls `DiscoverAsync` — it never subscribes — so `UseNativeNotifications = !PollOnly` has no observable effect on a browse run. Th… |
-| Driver.TwinCAT.Cli-005 | Low | Code organization & conventions | `Commands/ProbeCommand.cs:23`, `Commands/ReadCommand.cs:20`, `Commands/WriteCommand.cs:20`, `Commands/SubscribeCommand.cs:18` | The `--type` option is declared with the short alias `-t` on `read`, `write`, and `subscribe`, but `ProbeCommand` declares `[CommandOption("type", ...)]` with no short alias. An operator who has internalised `-t` from the other three verbs… |
-| Driver.TwinCAT.Cli-006 | Low | Testing coverage | `tests/Drivers/Cli/ZB.MOM.WW.OtOpcUa.Driver.TwinCAT.Cli.Tests/WriteCommandParseValueTests.cs` | The only test file covers `WriteCommand.ParseValue` and `ReadCommand.SynthesiseTagName`. Other deterministic, router-independent logic is untested: `TwinCATCommandBase.Gateway` (the `ads://{netId}:{port}` string the driver's `TwinCATAmsAdd… |
-| Driver.TwinCAT.Cli-007 | Low | Documentation & comments | `TwinCATCommandBase.cs:31-36` | The `Timeout` override has an empty `init` accessor with the comment `/* driven by TimeoutMs */`. Because the base `DriverCommandBase.Timeout` is declared `abstract { get; init; }`, the override must supply an `init`, but here it silently… |
-| Server-004 | Low | OtOpcUa conventions | `src/Server/ZB.MOM.WW.OtOpcUa.Server/OpcUa/OtOpcUaServer.cs:187-200` | `RoleBasedIdentity` declares its own `Display` property, but the base `UserIdentity` already has a settable `DisplayName`. `DriverNodeManager.ResolveCallUser`/`RouteScriptedAlarmMethodCalls` read the base `DisplayName`, never `Display`. Si… |
-| Server-006 | Low | Concurrency & thread safety | `src/Server/ZB.MOM.WW.OtOpcUa.Server/OpcUa/DriverNodeManager.cs:478-482, 1342-1348` | `OnReadValue`/`OnWriteValue` are synchronous stack hooks that block on async driver calls via `.GetAwaiter().GetResult()` with `CancellationToken.None`. With `MaxRequestThreadCount = 100`, a burst of reads/writes into a stalled driver pins… |
-| Server-008 | Low | Error handling & resilience | `src/Server/ZB.MOM.WW.OtOpcUa.Server/OpcUa/DriverNodeManager.cs:736` | `RouteScriptedAlarmMethodCalls` marks a handled slot by setting `errors[i] = ServiceResult.Good`, assuming `base.Call` skips non-null *Good* error slots. The stack and `GateCallMethodRequests` only ever pre-populate *Bad* slots; the skip-o… |
-| Server-012 | Low | Performance & resource management | `src/Server/ZB.MOM.WW.OtOpcUa.Server/Hosting/PeerHttpProbeLoop.cs:78-79` | `ProbeAsync` creates an `IHttpClientFactory` client and mutates `client.Timeout` on every 2-second probe tick. The timeout belongs on the request or on the named-client registration, not set per call on a factory-vended instance. |
-| Server-014 | Low | Code organization & conventions | `src/Server/ZB.MOM.WW.OtOpcUa.Server/SealedBootstrap.cs` | `SealedBootstrap` claims in its xml-doc to "close release blocker #2" by consuming the generation-sealed cache + resilient reader + stale-config flag, but `Program.cs` registers and uses `NodeBootstrap` instead. `SealedBootstrap` is never… |
-| Server-015 | Low | Documentation & comments | `src/Server/ZB.MOM.WW.OtOpcUa.Server/OpcUa/OtOpcUaServer.cs:16-21`, `src/Server/ZB.MOM.WW.OtOpcUa.Server/OpcUa/OpcUaServerOptions.cs:21-26` | `OtOpcUaServer`'s class doc still says "PR 16 minimum-viable scope ... no security ... LDAP + security profiles are deferred." `OpcUaServerOptions`'s says "PR 17 minimum-viable scope: no LDAP, no security profiles beyond None." Both are st… |
+_No pending findings._
 
 ## Closed findings
 
@@ -390,3 +233,159 @@ Findings with status `Resolved`, `Won't Fix`, or `Deferred`.
 | Server-010 | Medium | Resolved | Security | `src/Server/ZB.MOM.WW.OtOpcUa.Server/OpcUa/OpcUaServerOptions.cs:59`, `src/Server/ZB.MOM.WW.OtOpcUa.Server/OpcUa/OpcUaApplicationHost.cs:284-291` |
 | Server-011 | Medium | Resolved | Security | `src/Server/ZB.MOM.WW.OtOpcUa.Server/OpcUa/OpcUaApplicationHost.cs:322-346` |
 | Server-013 | Medium | Resolved | Design-document adherence | `src/Server/ZB.MOM.WW.OtOpcUa.Server/OpcUa/OpcUaServerOptions.cs:9-19`, `src/Server/ZB.MOM.WW.OtOpcUa.Server/OpcUa/OpcUaApplicationHost.cs:296-346`, `src/Server/ZB.MOM.WW.OtOpcUa.Server/Program.cs:89` |
+| Admin-010 | Low | Resolved | OtOpcUa conventions | `Components/App.razor:9,16` |
+| Admin-011 | Low | Resolved | Concurrency & thread safety | `Hubs/FleetStatusPoller.cs:24-26,98-103` |
+| Admin-012 | Low | Resolved | Design-document adherence | `Services/EquipmentCsvImporter.cs:18-19,33-37,229,232` |
+| Analyzers-002 | Low | Resolved | Correctness & logic bugs | `src/Tooling/ZB.MOM.WW.OtOpcUa.Analyzers/UnwrappedCapabilityCallAnalyzer.cs:46-50,130` |
+| Analyzers-003 | Low | Resolved | Error handling & resilience | `src/Tooling/ZB.MOM.WW.OtOpcUa.Analyzers/UnwrappedCapabilityCallAnalyzer.cs:80,114-116` |
+| Analyzers-004 | Low | Resolved | Performance & resource management | `src/Tooling/ZB.MOM.WW.OtOpcUa.Analyzers/UnwrappedCapabilityCallAnalyzer.cs:95-112` |
+| Analyzers-005 | Low | Resolved | Design-document adherence | `src/Tooling/ZB.MOM.WW.OtOpcUa.Analyzers/UnwrappedCapabilityCallAnalyzer.cs:33-43` |
+| Analyzers-007 | Low | Resolved | Documentation & comments | `src/Tooling/ZB.MOM.WW.OtOpcUa.Analyzers/UnwrappedCapabilityCallAnalyzer.cs:21-26` |
+| Client.CLI-002 | Low | Resolved | Correctness & logic bugs | `Commands/SubscribeCommand.cs:129-137` |
+| Client.CLI-003 | Low | Resolved | Correctness & logic bugs | `Commands/BrowseCommand.cs:29-30`, `Commands/SubscribeCommand.cs:20-27`, `Commands/AlarmsCommand.cs:28-29`, `Commands/HistoryReadCommand.cs:42-43` |
+| Client.CLI-004 | Low | Resolved | OtOpcUa conventions | `Commands/SubscribeCommand.cs:13-37` |
+| Client.CLI-006 | Low | Resolved | Error handling & resilience | `Commands/HistoryReadCommand.cs:73`, `Commands/HistoryReadCommand.cs:76`, `Helpers/NodeIdParser.cs:39` |
+| Client.CLI-007 | Low | Resolved | Performance & resource management | `CommandBase.cs:112-123` |
+| Client.CLI-008 | Low | Resolved | Documentation & comments | `docs/Client.CLI.md:158-217` |
+| Client.CLI-009 | Low | Resolved | Code organization & conventions | `Commands/SubscribeCommand.cs:66-165`, `Commands/AlarmsCommand.cs:52-91` |
+| Client.CLI-010 | Low | Resolved | Testing coverage | `tests/Client/ZB.MOM.WW.OtOpcUa.Client.CLI.Tests/SubscribeCommandTests.cs` |
+| Client.Shared-003 | Low | Resolved | Correctness & logic bugs | `Adapters/DefaultSessionAdapter.cs:76`, `Adapters/DefaultSessionAdapter.cs:273` |
+| Client.Shared-004 | Low | Resolved | OtOpcUa conventions | `Adapters/DefaultSessionAdapter.cs:228`, `Adapters/DefaultSessionAdapter.cs:121`, `Adapters/DefaultSessionAdapter.cs:172` |
+| Client.Shared-009 | Low | Resolved | Error handling & resilience / Documentation & comments | `OpcUaClientService.cs:302-322` |
+| Client.Shared-010 | Low | Resolved | Performance & resource management | `Models/ConnectionSettings.cs:48`, `OpcUaClientService.cs:408-417` |
+| Client.Shared-011 | Low | Resolved | Testing coverage | `tests/Client/ZB.MOM.WW.OtOpcUa.Client.Shared.Tests/OpcUaClientServiceTests.cs` |
+| Client.UI-003 | Low | Resolved | OtOpcUa conventions | `ZB.MOM.WW.OtOpcUa.Client.UI.csproj:20-21`, `Program.cs:14-20` |
+| Client.UI-004 | Low | Resolved | OtOpcUa conventions | `Views/MainWindow.axaml.cs:125-138` |
+| Client.UI-006 | Low | Resolved | Error handling & resilience | `ViewModels/MainWindowViewModel.cs:244-252`, `ViewModels/AlarmsViewModel.cs:88-112`, `ViewModels/SubscriptionsViewModel.cs:79-94` |
+| Client.UI-009 | Low | Resolved | Design-document adherence | `ViewModels/HistoryViewModel.cs:44-54` |
+| Client.UI-010 | Low | Resolved | Code organization & conventions | `Controls/DateTimeRangePicker.axaml.cs:33-37`, `Controls/DateTimeRangePicker.axaml.cs:70-80` |
+| Client.UI-011 | Low | Resolved | Documentation & comments | `Views/MainWindow.axaml:81`, `Services/JsonSettingsService.cs:11-15` |
+| Configuration-004 | Low | Resolved | OtOpcUa conventions | `src/Core/ZB.MOM.WW.OtOpcUa.Configuration/Enums/NodePermissions.cs:8`, `src/Core/ZB.MOM.WW.OtOpcUa.Configuration/OtOpcUaConfigDbContext.cs:417` |
+| Configuration-005 | Low | Resolved | Concurrency & thread safety | `src/Core/ZB.MOM.WW.OtOpcUa.Configuration/LocalCache/LiteDbConfigCache.cs:50` |
+| Configuration-007 | Low | Resolved | Error handling & resilience | `src/Core/ZB.MOM.WW.OtOpcUa.Configuration/Apply/GenerationApplier.cs:44` |
+| Configuration-010 | Low | Resolved | Security | `src/Core/ZB.MOM.WW.OtOpcUa.Configuration/LocalCache/ResilientConfigReader.cs:81` |
+| Configuration-011 | Low | Resolved | Testing coverage | `src/Core/ZB.MOM.WW.OtOpcUa.Configuration/Apply/GenerationApplier.cs:7`, `src/Core/ZB.MOM.WW.OtOpcUa.Configuration/Validation/DraftValidator.cs:60` |
+| Core-004 | Low | Resolved | OtOpcUa conventions | `src/Core/ZB.MOM.WW.OtOpcUa.Core/Hosting/DriverHost.cs:55,72,87` |
+| Core-008 | Low | Resolved | Error handling & resilience | `src/Core/ZB.MOM.WW.OtOpcUa.Core/OpcUa/GenericDriverNodeManager.cs:42-64` |
+| Core-009 | Low | Resolved | Performance & resource management | `src/Core/ZB.MOM.WW.OtOpcUa.Core/Resilience/CapabilityInvoker.cs:121-128` |
+| Core-010 | Low | Resolved | Code organization & conventions | `src/Core/ZB.MOM.WW.OtOpcUa.Core/Resilience/DriverResilienceOptions.cs:45-52` |
+| Core-011 | Low | Resolved | Testing coverage | `src/Core/ZB.MOM.WW.OtOpcUa.Core/Authorization/PermissionTrieBuilder.cs:58-75` |
+| Core-012 | Low | Resolved | Documentation & comments | `src/Core/ZB.MOM.WW.OtOpcUa.Core/Stability/WedgeDetector.cs:26`, `src/Core/ZB.MOM.WW.OtOpcUa.Core/Observability/DriverHealthReport.cs:11-22` |
+| Core.Abstractions-004 | Low | Resolved | Concurrency & thread safety | `src/Core/ZB.MOM.WW.OtOpcUa.Core.Abstractions/DriverTypeRegistry.cs:23-40` |
+| Core.Abstractions-005 | Low | Resolved | Error handling & resilience | `src/Core/ZB.MOM.WW.OtOpcUa.Core.Abstractions/PollGroupEngine.cs:90,99` |
+| Core.Abstractions-006 | Low | Resolved | Code organization & conventions | `src/Core/ZB.MOM.WW.OtOpcUa.Core.Abstractions/IHistoryProvider.cs:63,84-86`, `src/Core/ZB.MOM.WW.OtOpcUa.Core.Abstractions/Historian/IHistorianDataSource.cs:30,63` |
+| Core.Abstractions-007 | Low | Resolved | Testing coverage | `tests/Core/ZB.MOM.WW.OtOpcUa.Core.Abstractions.Tests/PollGroupEngineTests.cs` |
+| Core.Abstractions-008 | Low | Resolved | Documentation & comments | `src/Core/ZB.MOM.WW.OtOpcUa.Core.Abstractions/DriverHealth.cs:9`, `src/Core/ZB.MOM.WW.OtOpcUa.Core.Abstractions/IHistoryProvider.cs:39-43,65-69` |
+| Core.AlarmHistorian-008 | Low | Resolved | Performance & resource management | `src/Core/ZB.MOM.WW.OtOpcUa.Core.AlarmHistorian/SqliteStoreAndForwardSink.cs:107-127,255-278` |
+| Core.AlarmHistorian-011 | Low | Resolved | Documentation & comments | `src/Core/ZB.MOM.WW.OtOpcUa.Core.AlarmHistorian/IAlarmHistorianSink.cs:5-9,76`, `AlarmHistorianEvent.cs:20` |
+| Core.ScriptedAlarms-003 | Low | Resolved | Documentation & comments | `ScriptedAlarmEngine.cs:343`, `docs/ScriptedAlarms.md:107` |
+| Core.ScriptedAlarms-006 | Low | Resolved | Concurrency & thread safety | `ScriptedAlarmEngine.cs:232`, `ScriptedAlarmEngine.cs:369` |
+| Core.ScriptedAlarms-008 | Low | Resolved | Performance & resource management | `Part9StateMachine.cs:261-268` |
+| Core.ScriptedAlarms-009 | Low | Won't Fix | Performance & resource management | `ScriptedAlarmEngine.cs:309-315`, `ScriptedAlarmEngine.cs:271` |
+| Core.ScriptedAlarms-010 | Low | Resolved | Design-document adherence | `ScriptedAlarmEngine.cs:325-336`, `AlarmPredicateContext.cs:33-40`, `MessageTemplate.cs:47` |
+| Core.ScriptedAlarms-011 | Low | Resolved | Code organization & conventions | `Part9StateMachine.cs:275` |
+| Core.Scripting-005 | Low | Resolved | Correctness & logic bugs | `DependencyExtractor.cs:97` |
+| Core.Scripting-006 | Low | Resolved | Concurrency & thread safety | `CompiledScriptCache.cs:55` |
+| Core.Scripting-008 | Low | Won't Fix | Performance & resource management | `CompiledScriptCache.cs:34`, `ScriptEvaluator.cs:34` |
+| Core.Scripting-009 | Low | Resolved | Design-document adherence | `ForbiddenTypeAnalyzer.cs:45` |
+| Core.Scripting-011 | Low | Resolved | Testing coverage | `tests/Core/ZB.MOM.WW.OtOpcUa.Core.Scripting.Tests/` |
+| Core.VirtualTags-004 | Low | Resolved | Correctness & logic bugs | `src/Core/ZB.MOM.WW.OtOpcUa.Core.VirtualTags/VirtualTagEngine.cs:349` |
+| Core.VirtualTags-006 | Low | Resolved | Concurrency & thread safety | `src/Core/ZB.MOM.WW.OtOpcUa.Core.VirtualTags/VirtualTagEngine.cs:177-182`, `:395-401` |
+| Core.VirtualTags-007 | Low | Resolved | Error handling & resilience | `src/Core/ZB.MOM.WW.OtOpcUa.Core.VirtualTags/TimerTriggerScheduler.cs:58` |
+| Core.VirtualTags-009 | Low | Resolved | Performance & resource management | `src/Core/ZB.MOM.WW.OtOpcUa.Core.VirtualTags/DependencyGraph.cs:64-65`, `:72-73` |
+| Core.VirtualTags-010 | Low | Resolved | Documentation & comments | `src/Core/ZB.MOM.WW.OtOpcUa.Core.VirtualTags/ITagUpstreamSource.cs:18`, `VirtualTagContext.cs:30`, `VirtualTagDefinition.cs:28` |
+| Core.VirtualTags-011 | Low | Resolved | Code organization & conventions | `src/Core/ZB.MOM.WW.OtOpcUa.Core.VirtualTags/VirtualTagEngine.cs:404-409` |
+| Core.VirtualTags-013 | Low | Resolved | Documentation & comments | `src/Core/ZB.MOM.WW.OtOpcUa.Core.VirtualTags/DependencyGraph.cs:266-270` |
+| Driver.AbCip-007 | Low | Resolved | OtOpcUa conventions | `AbCipDriver.cs` (whole file), `AbCipAlarmProjection.cs`, `LibplctagTagRuntime.cs` |
+| Driver.AbCip-011 | Low | Resolved | Error handling & resilience | `AbCipDriver.cs:144-152`, `AbCipDriverOptions.cs:131-143` |
+| Driver.AbCip-012 | Low | Resolved | Performance & resource management | `LibplctagTemplateReader.cs:15-35`, `AbCipDriver.cs:88-92` |
+| Driver.AbCip-013 | Low | Resolved | Design-document adherence | `AbCipDriverOptions.cs:70-73`, `PlcFamilies/AbCipPlcFamilyProfile.cs:13-19`, `LibplctagTagRuntime.cs:16-27` |
+| Driver.AbCip-015 | Low | Resolved | Documentation & comments | `AbCipDriver.cs:9-11`, `PlcTagHandle.cs:23-27,53-58`, `AbCipTemplateCache.cs:12-15`, `IAbCipTagEnumerator.cs:6-11`, `AbCipDriverOptions.cs:21` |
+| Driver.AbCip.Cli-003 | Low | Resolved | Concurrency & thread safety | `src/Drivers/Cli/ZB.MOM.WW.OtOpcUa.Driver.AbCip.Cli/Commands/SubscribeCommand.cs:50-56,60-61` |
+| Driver.AbCip.Cli-004 | Low | Resolved | Error handling & resilience | `src/Drivers/Cli/ZB.MOM.WW.OtOpcUa.Driver.AbCip.Cli/Commands/SubscribeCommand.cs:28,58`; `AbCipCommandBase.cs:26-34` |
+| Driver.AbCip.Cli-005 | Low | Resolved | Performance & resource management | `src/Drivers/Cli/ZB.MOM.WW.OtOpcUa.Driver.Cli.Common/DriverCommandBase.cs:51-59` |
+| Driver.AbCip.Cli-006 | Low | Resolved | Design-document adherence | `src/Drivers/Cli/ZB.MOM.WW.OtOpcUa.Driver.AbCip.Cli/AbCipCommandBase.cs:29-34` |
+| Driver.AbCip.Cli-007 | Low | Resolved | Testing coverage | `tests/Drivers/Cli/ZB.MOM.WW.OtOpcUa.Driver.AbCip.Cli.Tests/WriteCommandParseValueTests.cs` |
+| Driver.AbCip.Cli-008 | Low | Resolved | Documentation & comments | `docs/Driver.AbCip.Cli.md:8-9` |
+| Driver.AbLegacy-005 | Low | Resolved | OtOpcUa conventions | `AbLegacyDriver.cs` (whole file) |
+| Driver.AbLegacy-011 | Low | Resolved | Performance & resource management | `AbLegacyDriver.cs:440` |
+| Driver.AbLegacy-013 | Low | Resolved | Code organization & conventions | `AbLegacyDriver.cs:340-345`, `AbLegacyDriver.cs:238-264` |
+| Driver.AbLegacy.Cli-002 | Low | Resolved | Correctness & logic bugs | `Commands/WriteCommand.cs:27-29`, `Program.cs:6-9` |
+| Driver.AbLegacy.Cli-003 | Low | Resolved | Concurrency & thread safety | `Commands/SubscribeCommand.cs:47-53` |
+| Driver.AbLegacy.Cli-004 | Low | Resolved | Error handling & resilience | `Commands/ProbeCommand.cs:37-56`, `Commands/ReadCommand.cs:39-50`, `Commands/WriteCommand.cs:48-59`, `Commands/SubscribeCommand.cs:41-76` |
+| Driver.AbLegacy.Cli-005 | Low | Resolved | Design-document adherence | `Commands/SubscribeCommand.cs:23-25`, `docs/Driver.AbLegacy.Cli.md:94-96` |
+| Driver.AbLegacy.Cli-006 | Low | Resolved | Code organization & conventions | `Commands/ProbeCommand.cs:20-22` |
+| Driver.AbLegacy.Cli-007 | Low | Resolved | Testing coverage | `tests/Drivers/Cli/ZB.MOM.WW.OtOpcUa.Driver.AbLegacy.Cli.Tests/WriteCommandParseValueTests.cs` |
+| Driver.Cli.Common-004 | Low | Resolved | Error handling & resilience | `src/Drivers/Cli/ZB.MOM.WW.OtOpcUa.Driver.Cli.Common/SnapshotFormatter.cs:68-70` |
+| Driver.Cli.Common-006 | Low | Resolved | Documentation & comments | `src/Drivers/Cli/ZB.MOM.WW.OtOpcUa.Driver.Cli.Common/SnapshotFormatter.cs:71`, `src/Drivers/Cli/ZB.MOM.WW.OtOpcUa.Driver.Cli.Common/DriverCommandBase.cs:9` |
+| Driver.FOCAS-007 | Low | Resolved | Error handling & resilience | `FocasDriver.cs:140-148`, `FocasDriver.cs:478-484`, `FocasDriver.cs:529-533`, `FocasAlarmProjection.cs:61-63` |
+| Driver.FOCAS-008 | Low | Resolved | Performance & resource management | `FocasDriver.cs:201`, `FocasDriver.cs:253` |
+| Driver.FOCAS-009 | Low | Resolved | Design-document adherence | `FocasDriverOptions.cs:110-115`, `FocasDriver.cs:468-486`, `FocasDriverFactoryExtensions.cs:75-80` |
+| Driver.FOCAS-010 | Low | Resolved | Code organization & conventions | `IFocasClient.cs:210-227` (`FocasOpMode`), `FocasConstants.cs:42-78` (`FocasOperationMode`) |
+| Driver.FOCAS-011 | Low | Resolved | Code organization & conventions | `IFocasClient.cs:275-287` (`FocasAlarmType`), `FocasAlarmProjection.cs:149-175` |
+| Driver.FOCAS.Cli-001 | Low | Resolved | Error handling & resilience | `Commands/WriteCommand.cs:58-68` |
+| Driver.FOCAS.Cli-002 | Low | Resolved | Concurrency & thread safety | `Commands/SubscribeCommand.cs:45-51` |
+| Driver.FOCAS.Cli-003 | Low | Resolved | Error handling & resilience | `FocasCommandBase.cs:19` (`CncPort`), `FocasCommandBase.cs:27` (`TimeoutMs`), `Commands/SubscribeCommand.cs:23` (`IntervalMs`) |
+| Driver.FOCAS.Cli-004 | Low | Resolved | Performance & resource management | `Commands/ProbeCommand.cs:37,54`; `Commands/ReadCommand.cs:37,46`; `Commands/WriteCommand.cs:45,54`; `Commands/SubscribeCommand.cs:39,73` |
+| Driver.FOCAS.Cli-005 | Low | Deferred | Design-document adherence | `Commands/WriteCommand.cs:50`, `Commands/ProbeCommand.cs:50` (via `SnapshotFormatter.FormatStatus`) |
+| Driver.Galaxy-005 | Low | Resolved | OtOpcUa conventions | `Runtime/EventPump.cs:81-88` |
+| Driver.Galaxy-010 | Low | Resolved | Security | `GalaxyDriver.cs:311-341` |
+| Driver.Galaxy-012 | Low | Resolved | Performance & resource management | `Runtime/SubscriptionRegistry.cs:65-67`, `GalaxyDriver.cs:538`, `GalaxyDriver.cs:675` |
+| Driver.Galaxy-013 | Low | Resolved | Design-document adherence | `GalaxyDriver.cs:14-27`, `GalaxyDriver.cs:374-382`, `Config/GalaxyDriverOptions.cs:84-86` |
+| Driver.Historian.Wonderware-004 | Low | Resolved | Correctness and logic bugs | `Backend/SdkAlarmHistorianWriteBackend.cs:198-201` |
+| Driver.Historian.Wonderware-005 | Low | Resolved | Concurrency and thread safety | `Backend/HistorianDataSource.cs:124`, `:126-127` |
+| Driver.Historian.Wonderware-007 | Low | Resolved | Error handling and resilience | `Ipc/PipeServer.cs:70-75` |
+| Driver.Historian.Wonderware-008 | Low | Resolved | Error handling and resilience | `Backend/HistorianDataSource.cs:301-307`, `:374-380` |
+| Driver.Historian.Wonderware-010 | Low | Resolved | Performance and resource management | `Backend/HistorianConfiguration.cs:32-36`, `Backend/HistorianDataSource.cs` (all read methods) |
+| Driver.Historian.Wonderware-011 | Low | Resolved | Design-document adherence | `Backend/HistorianDataSource.cs:9-12`, `Backend/IHistorianDataSource.cs:9-11`, `Backend/HistorianSample.cs:7-9`, `Backend/HistorianConfiguration.cs:7-9` |
+| Driver.Historian.Wonderware-012 | Low | Resolved | Testing coverage | `Backend/HistorianDataSource.cs`, `tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Historian.Wonderware.Tests/` |
+| Driver.Historian.Wonderware.Client-003 | Low | Resolved | Concurrency & thread safety | `WonderwareHistorianClient.cs:207`, `WonderwareHistorianClient.cs:132-150` |
+| Driver.Historian.Wonderware.Client-004 | Low | Resolved | Concurrency & thread safety | `WonderwareHistorianClient.cs:203-267` |
+| Driver.Historian.Wonderware.Client-006 | Low | Resolved | Error handling & resilience | `Internal/PipeChannel.cs:96-107`, `WonderwareHistorianClientOptions.cs:11-12` |
+| Driver.Historian.Wonderware.Client-008 | Low | Resolved | Security | `ZB.MOM.WW.OtOpcUa.Driver.Historian.Wonderware.Client.csproj:29-32` |
+| Driver.Historian.Wonderware.Client-010 | Low | Resolved | Documentation & comments | `WonderwareHistorianClient.cs:355-361`, `WonderwareHistorianClient.cs:132-150` |
+| Driver.Modbus-003 | Low | Resolved | Concurrency & thread safety | `ModbusDriver.cs:59,188,241,259,266,726,745,759` |
+| Driver.Modbus-007 | Low | Resolved | Design-document adherence | `ModbusDriver.cs:1392`, `ModbusDriverOptions.cs:74-80` |
+| Driver.Modbus-008 | Low | Resolved | Documentation & comments | `ModbusDriver.cs:411-417,700-703,737-744` |
+| Driver.Modbus-009 | Low | Resolved | Correctness & logic bugs | `ModbusDriver.cs:1160-1167`, `ModbusTcpTransport.cs:94-95` |
+| Driver.Modbus-010 | Low | Resolved | Error handling & resilience | `ModbusDriver.cs:864-868`, `ModbusDriverOptions.cs:116-125` |
+| Driver.Modbus-011 | Low | Resolved | Code organization & conventions | `ModbusDriver.cs:23-43,89-97,408-432` |
+| Driver.Modbus-012 | Low | Resolved | Testing coverage | `tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Modbus.Tests/` |
+| Driver.Modbus.Addressing-006 | Low | Resolved | Error handling & resilience | `ModbusAddressParser.cs:297-301` |
+| Driver.Modbus.Addressing-007 | Low | Resolved | Design-document adherence | `ModbusDataType.cs:91-95`, `docs/v2/dl205.md` section Strings |
+| Driver.Modbus.Addressing-009 | Low | Resolved | Documentation & comments | `ModbusModiconAddress.cs:55-64`, `ModbusModiconAddress.cs:104-110` |
+| Driver.Modbus.Cli-003 | Low | Resolved | Correctness & logic bugs | `src/Drivers/Cli/ZB.MOM.WW.OtOpcUa.Driver.Modbus.Cli/ModbusCommandBase.cs:14-24` |
+| Driver.Modbus.Cli-004 | Low | Resolved | Concurrency & thread safety | `src/Drivers/Cli/ZB.MOM.WW.OtOpcUa.Driver.Modbus.Cli/Commands/SubscribeCommand.cs:61-67` |
+| Driver.Modbus.Cli-005 | Low | Resolved | Error handling & resilience | `src/Drivers/Cli/ZB.MOM.WW.OtOpcUa.Driver.Modbus.Cli/Commands/ProbeCommand.cs:21-54`; `Commands/ReadCommand.cs:46-75`; `Commands/WriteCommand.cs:54-89` |
+| Driver.Modbus.Cli-006 | Low | Resolved | Error handling & resilience | `src/Drivers/Cli/ZB.MOM.WW.OtOpcUa.Driver.Modbus.Cli/Commands/ProbeCommand.cs:35-53` |
+| Driver.Modbus.Cli-007 | Low | Resolved | Design-document adherence | `docs/Driver.Modbus.Cli.md:124-156`; `src/Drivers/Cli/ZB.MOM.WW.OtOpcUa.Driver.Modbus.Cli/Commands/ReadCommand.cs` |
+| Driver.Modbus.Cli-008 | Low | Resolved | Testing coverage | `tests/Drivers/Cli/ZB.MOM.WW.OtOpcUa.Driver.Modbus.Cli.Tests/` |
+| Driver.OpcUaClient-011 | Low | Resolved | Documentation & comments | `OpcUaClientDriver.cs:1007-1015` |
+| Driver.OpcUaClient-014 | Low | Resolved | Performance & resource management | `OpcUaClientDriver.cs:1138`, `:1314` |
+| Driver.S7-003 | Low | Resolved | Correctness & logic bugs | `S7Driver.cs:172`, `S7Driver.cs:255` |
+| Driver.S7-005 | Low | Resolved | OtOpcUa conventions | `S7Driver.cs:33`, `S7Driver.cs:433` |
+| Driver.S7-009 | Low | Resolved | Error handling & resilience | `S7Driver.cs:392` |
+| Driver.S7-010 | Low | Resolved | Performance & resource management | `S7Driver.cs:504` |
+| Driver.S7-013 | Low | Resolved | Code organization & conventions | `S7DriverOptions.cs:90`, `S7Driver.cs:300` |
+| Driver.S7.Cli-004 | Low | Resolved | Performance & resource management | `src/Drivers/Cli/ZB.MOM.WW.OtOpcUa.Driver.S7.Cli/Commands/ProbeCommand.cs:36,53`, `Commands/ReadCommand.cs:45,54`, `Commands/WriteCommand.cs:51,60`, `Commands/SubscribeCommand.cs:39,73` |
+| Driver.S7.Cli-005 | Low | Resolved | Code organization & conventions | `tests/ZB.MOM.WW.OtOpcUa.Driver.S7.Cli.Tests/` |
+| Driver.S7.Cli-006 | Low | Resolved | Testing coverage | `tests/Drivers/Cli/ZB.MOM.WW.OtOpcUa.Driver.S7.Cli.Tests/WriteCommandParseValueTests.cs` |
+| Driver.S7.Cli-007 | Low | Resolved | Documentation & comments | `src/Drivers/Cli/ZB.MOM.WW.OtOpcUa.Driver.S7.Cli/Commands/SubscribeCommand.cs:45-51` |
+| Driver.TwinCAT-004 | Low | Resolved | Correctness & logic bugs | `TwinCATDataType.cs:24-27` |
+| Driver.TwinCAT-006 | Low | Resolved | OtOpcUa conventions | `TwinCATDriver.cs:406-411` |
+| Driver.TwinCAT-014 | Low | Resolved | Design-document adherence | `TwinCATDriverOptions.cs:41-43`, `TwinCATDriverOptions.cs:57-62`, `AdsTwinCATClient.cs:145` |
+| Driver.TwinCAT-015 | Low | Resolved | Code organization & conventions | `TwinCATDriver.cs:431-432` |
+| Driver.TwinCAT-016 | Low | Resolved | Testing coverage | `tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.TwinCAT.Tests/` |
+| Driver.TwinCAT.Cli-001 | Low | Resolved | Correctness & logic bugs | `TwinCATCommandBase.cs:23-24`, `Commands/SubscribeCommand.cs:23-24`, `Commands/BrowseCommand.cs:21-24` |
+| Driver.TwinCAT.Cli-002 | Low | Resolved | Concurrency & thread safety | `Commands/SubscribeCommand.cs:46-58` |
+| Driver.TwinCAT.Cli-003 | Low | Resolved | Error handling & resilience | `Commands/SubscribeCommand.cs:56-58` |
+| Driver.TwinCAT.Cli-004 | Low | Resolved | Design-document adherence | `TwinCATCommandBase.cs:26-29`, `Commands/BrowseCommand.cs` |
+| Driver.TwinCAT.Cli-005 | Low | Resolved | Code organization & conventions | `Commands/ProbeCommand.cs:23`, `Commands/ReadCommand.cs:20`, `Commands/WriteCommand.cs:20`, `Commands/SubscribeCommand.cs:18` |
+| Driver.TwinCAT.Cli-006 | Low | Resolved | Testing coverage | `tests/Drivers/Cli/ZB.MOM.WW.OtOpcUa.Driver.TwinCAT.Cli.Tests/WriteCommandParseValueTests.cs` |
+| Driver.TwinCAT.Cli-007 | Low | Resolved | Documentation & comments | `TwinCATCommandBase.cs:31-36` |
+| Server-004 | Low | Resolved | OtOpcUa conventions | `src/Server/ZB.MOM.WW.OtOpcUa.Server/OpcUa/OtOpcUaServer.cs:187-200` |
+| Server-006 | Low | Resolved | Concurrency & thread safety | `src/Server/ZB.MOM.WW.OtOpcUa.Server/OpcUa/DriverNodeManager.cs:478-482, 1342-1348` |
+| Server-008 | Low | Resolved | Error handling & resilience | `src/Server/ZB.MOM.WW.OtOpcUa.Server/OpcUa/DriverNodeManager.cs:736` |
+| Server-012 | Low | Resolved | Performance & resource management | `src/Server/ZB.MOM.WW.OtOpcUa.Server/Hosting/PeerHttpProbeLoop.cs:78-79` |
+| Server-014 | Low | Resolved | Code organization & conventions | `src/Server/ZB.MOM.WW.OtOpcUa.Server/SealedBootstrap.cs` |
+| Server-015 | Low | Resolved | Documentation & comments | `src/Server/ZB.MOM.WW.OtOpcUa.Server/OpcUa/OtOpcUaServer.cs:16-21`, `src/Server/ZB.MOM.WW.OtOpcUa.Server/OpcUa/OpcUaServerOptions.cs:21-26` |

code-reviews/Server/findings.md

@@ -7,7 +7,7 @@
 | Review date | 2026-05-22 |
 | Commit reviewed | `76d35d1` |
 | Status | Reviewed |
-| Open findings | 6 |
+| Open findings | 0 |
 
 ## Checklist coverage
 
@@ -74,13 +74,13 @@
 | Severity | Low |
 | Category | OtOpcUa conventions |
 | Location | `src/Server/ZB.MOM.WW.OtOpcUa.Server/OpcUa/OtOpcUaServer.cs:187-200` |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** `RoleBasedIdentity` declares its own `Display` property, but the base `UserIdentity` already has a settable `DisplayName`. `DriverNodeManager.ResolveCallUser`/`RouteScriptedAlarmMethodCalls` read the base `DisplayName`, never `Display`. Since the ctor passes only `userName` to base, `DisplayName` resolves to the username — so scripted-alarm Ack/Confirm/Shelve audit entries record the raw username, not the LDAP-resolved display name the comment promises. `Display` is dead code.
 
 **Recommendation:** Drop `Display`; set the base `DisplayName = displayName ?? userName;`. Verify `ResolveCallUser` yields the resolved display name.
 
-**Resolution:** _(open)_
+**Resolution:** Resolved 2026-05-23 — re-triaged: in the pinned SDK version (1.5.374.126) `UserIdentity.DisplayName` is a sealed-virtual auto-property with no public setter, so the base `DisplayName = …` assignment the original recommendation suggested won't compile. Instead the fix passes `displayName ?? userName` as the first arg to the base `UserIdentity(string, string)` ctor — the SDK seeds `DisplayName` from that arg internally — and removes the dead `Display` property. `RoleBasedIdentity` is now `internal sealed` so `DriverNodeManager.ResolveCallUser` can be unit-tested against the production identity type. Regression tests `RoleBasedIdentityTests.DisplayName_returns_LDAP_resolved_display_name_when_present`, `DisplayName_falls_back_to_userName_when_LDAP_display_name_is_null`, and `ResolveCallUser_yields_LDAP_resolved_display_name` cover the behaviour.
 
 ### Server-005
 | Field | Value |
@@ -102,13 +102,13 @@
 | Severity | Low |
 | Category | Concurrency & thread safety |
 | Location | `src/Server/ZB.MOM.WW.OtOpcUa.Server/OpcUa/DriverNodeManager.cs:478-482, 1342-1348` |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** `OnReadValue`/`OnWriteValue` are synchronous stack hooks that block on async driver calls via `.GetAwaiter().GetResult()` with `CancellationToken.None`. With `MaxRequestThreadCount = 100`, a burst of reads/writes into a stalled driver pins request threads for the full pipeline timeout, exhausting the pool and stalling unrelated sessions. The call cannot be cancelled by a client timeout.
 
 **Recommendation:** Derive a `CancellationToken` from the `OperationContext` / `TransportQuotas.OperationTimeout` so a stuck driver call is abandoned. Longer term, use the stack's async service overrides if available.
 
-**Resolution:** _(open)_
+**Resolution:** Resolved 2026-05-23 — added `DriverNodeManager.DeriveOperationCancellation(ISystemContext, TimeSpan fallback)` helper that reads `SystemContext.OperationContext.OperationDeadline` (which the stack sets from the client's `RequestHeader.TimeoutHint`). `OnReadValue` and `OnWriteValue` now pass `cts.Token` to `_invoker.ExecuteAsync` / `ExecuteWriteAsync` instead of `CancellationToken.None`, and surface `BadTimeout` (instead of `BadInternalError`) when the deadline fires. Handles both the SDK's sentinel deadlines: `DateTime.MinValue` (no deadline plumbed) and `DateTime.MaxValue` (TimeoutHint=0, the SDK default) collapse to a 30-s fallback. A deadline > Int32.MaxValue ms in the future also clamps to the fallback so the read path never throws `ArgumentOutOfRangeException` from inside `CancellationTokenSource(TimeSpan)`. Regression tests in `DriverNodeManagerCancellationTests` cover all five paths (future / past / missing / MinValue / MaxValue).
 
 ### Server-007
 | Field | Value |
@@ -130,13 +130,13 @@
 | Severity | Low |
 | Category | Error handling & resilience |
 | Location | `src/Server/ZB.MOM.WW.OtOpcUa.Server/OpcUa/DriverNodeManager.cs:736` |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** `RouteScriptedAlarmMethodCalls` marks a handled slot by setting `errors[i] = ServiceResult.Good`, assuming `base.Call` skips non-null *Good* error slots. The stack and `GateCallMethodRequests` only ever pre-populate *Bad* slots; the skip-on-Good assumption is not a guaranteed SDK contract. If `base.Call` re-dispatches, the engine method and the stack's built-in Part 9 handler both fire — double transition.
 
 **Recommendation:** Verify against the pinned SDK whether `base.Call` skips Good-pre-populated slots. If not, exclude routed slots from `methodsToCall` before `base.Call`. Add a test asserting exactly-once engine transition for a routed Acknowledge.
 
-**Resolution:** _(open)_
+**Resolution:** Resolved 2026-05-23 — verified against the pinned SDK (DeepWiki query against OPCFoundation/UA-.NETStandard): `CustomNodeManager2.Call` / `CallInternalAsync` skip slots whose `CallMethodRequest.Processed` flag is `true`, not slots whose `errors[i]` is a non-Bad `ServiceResult`. `RouteScriptedAlarmMethodCalls` now sets `request.Processed = true` on every handled slot — success, `ArgumentException`, and generic exception paths — so `base.Call` never re-dispatches a routed Acknowledge / Confirm / AddComment to the stack's built-in Part 9 handler. Regression tests in `ScriptedAlarmMethodRoutingProcessedFlagTests` assert `Processed` is `true` after each engine path and `false` for slots the helper passes through to `base.Call`.
 
 ### Server-009
 | Field | Value |
@@ -186,13 +186,13 @@
 | Severity | Low |
 | Category | Performance & resource management |
 | Location | `src/Server/ZB.MOM.WW.OtOpcUa.Server/Hosting/PeerHttpProbeLoop.cs:78-79` |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** `ProbeAsync` creates an `IHttpClientFactory` client and mutates `client.Timeout` on every 2-second probe tick. The timeout belongs on the request or on the named-client registration, not set per call on a factory-vended instance.
 
 **Recommendation:** Configure the timeout once via `AddHttpClient(HttpClientName).ConfigureHttpClient(...)`, or use a per-request linked `CancellationTokenSource(_options.HttpProbeTimeout)`; drop the per-call `client.Timeout` mutation.
 
-**Resolution:** _(open)_
+**Resolution:** Resolved 2026-05-23 — `ProbeAsync` no longer mutates `client.Timeout`. Replaced with a per-call `CancellationTokenSource(_options.HttpProbeTimeout)` linked to the loop's shutdown token; `GetAsync` consumes the linked token so the per-request deadline is enforced via cancellation instead of via the factory-vended `HttpClient` instance. Regression test `PeerHttpProbeLoopTests.Tick_does_not_mutate_factory_vended_client_Timeout` asserts the timeout-on-client mutation is gone.
 
 ### Server-013
 | Field | Value |
@@ -214,13 +214,13 @@
 | Severity | Low |
 | Category | Code organization & conventions |
 | Location | `src/Server/ZB.MOM.WW.OtOpcUa.Server/SealedBootstrap.cs` |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** `SealedBootstrap` claims in its xml-doc to "close release blocker #2" by consuming the generation-sealed cache + resilient reader + stale-config flag, but `Program.cs` registers and uses `NodeBootstrap` instead. `SealedBootstrap` is never registered in DI nor referenced by `OpcUaServerService` — it and its `StaleConfigFlag` plumbing are dead in the production wire-up; the release blocker remains open in practice.
 
 **Recommendation:** Either register `SealedBootstrap` (with `GenerationSealedCache`/`ResilientConfigReader`/`StaleConfigFlag`) and wire `StaleConfigFlag` into the health host, or delete `SealedBootstrap` and correct the release-readiness doc.
 
-**Resolution:** _(open)_
+**Resolution:** Resolved 2026-05-23 — added `ServerWiring.AddSealedBootstrap` DI helper that registers `GenerationSealedCache` (rooted at a `.sealed` sibling of `NodeOptions.LocalCachePath`), `StaleConfigFlag`, `ResilientConfigReader`, and `SealedBootstrap`. `Program.cs` calls it after `AddSingleton<NodeBootstrap>()`; `OpcUaServerService` now consumes `SealedBootstrap` instead of `NodeBootstrap`; `OpcUaApplicationHost` is constructed with `staleConfigFlag` resolved from DI so `/healthz`'s `usingStaleConfig` reflects the cache-fallback state. The legacy `NodeBootstrap` registration stays for back-compat with the integration tests that construct it directly. Regression test `SealedBootstrapWiringTests.SealedBootstrap_and_its_dependencies_are_registered_in_DI` asserts the registrations compose without missing-service exceptions; `SealedBootstrap.cs`'s xml-doc updated to describe the live wire-up rather than the deferred plan.
 
 ### Server-015
 | Field | Value |
@@ -228,10 +228,10 @@
 | Severity | Low |
 | Category | Documentation & comments |
 | Location | `src/Server/ZB.MOM.WW.OtOpcUa.Server/OpcUa/OtOpcUaServer.cs:16-21`, `src/Server/ZB.MOM.WW.OtOpcUa.Server/OpcUa/OpcUaServerOptions.cs:21-26` |
-| Status | Open |
+| Status | Resolved |
 
 **Description:** `OtOpcUaServer`'s class doc still says "PR 16 minimum-viable scope ... no security ... LDAP + security profiles are deferred." `OpcUaServerOptions`'s says "PR 17 minimum-viable scope: no LDAP, no security profiles beyond None." Both are stale — the class now does LDAP UserName auth, anonymous-role mapping, and a configurable security profile. A reader would wrongly conclude the server has no authentication.
 
 **Recommendation:** Update both class summaries to describe current behaviour and drop the "deferred to a future PR" language.
 
-**Resolution:** _(open)_
+**Resolution:** Resolved 2026-05-23 — rewrote both class summaries. `OtOpcUaServer` now describes the live LDAP UserName / Anonymous identity-token flow, the `RoleBasedIdentity` wrapper, and the configurable `SecurityProfile` driven by `OpcUaServerOptions`. `OpcUaServerOptions` now describes endpoint + identity + PKI + health + LDAP + anonymous-role surfaces and points at `docs/security.md`. The stale "PR 16 / PR 17 minimum-viable scope" and "deferred to their own PR" language is gone.

docs/Client.CLI.md

@@ -149,53 +149,77 @@ otopcua-cli browse -u opc.tcp://localhost:4840/OtOpcUa -U admin -P admin123 -r -
 
 ### subscribe
 
-Monitors a node for value changes using OPC UA subscriptions. Prints each data change notification with timestamp, value, and status code. Runs until Ctrl+C, then unsubscribes and disconnects cleanly.
+Monitors a node (or every Variable in its subtree) for value changes using OPC UA subscriptions.
+Prints each data-change notification with timestamp, value, and status code, then prints a
+summary on exit. Exits on Ctrl+C, or automatically after `--duration` seconds.
 
 ```bash
+# Subscribe to a single node
 otopcua-cli subscribe -u opc.tcp://localhost:4840 -n "ns=2;s=MyNode" -i 500
+
+# Browse a subtree and subscribe to every Variable, run for 60 seconds, write the summary to disk
+otopcua-cli subscribe -u opc.tcp://localhost:4840 -n "ns=3;s=ZB" -r --max-depth 4 \
+  --duration 60 --quiet --summary-file C:\Temp\subscribe-summary.txt
 ```
 
 | Flag | Description |
 |------|-------------|
-| `-n` / `--node` | Node ID to monitor (required) |
-| `-i` / `--interval` | Sampling/publishing interval in milliseconds (default: 1000) |
+| `-n` / `--node` | Node ID to monitor (required). When `--recursive` is set, this is the browse root. |
+| `-i` / `--interval` | Sampling interval in milliseconds (default: 1000) |
+| `-r` / `--recursive` | Browse recursively from `--node` and subscribe to every Variable found |
+| `--max-depth` | Maximum recursion depth when `--recursive` is set (default: 10) |
+| `-q` / `--quiet` | Suppress per-update output; only print the final summary |
+| `--duration` | Auto-exit after N seconds and print the summary (0 = run until Ctrl+C, default: 0) |
+| `--summary-file` | Also write the summary to this file path on exit |
+
+#### Summary buckets
+
+The summary prints per-node counts across these buckets:
+
+- **Ever went BAD during window** — node received at least one notification whose status was not Good.
+- **NEVER went bad (suspect)** — node received at least one notification and every one was Good.
+- **Last status GOOD / NOT-GOOD** — final observed status across nodes that received any update.
+- **No update received at all** — node was subscribed but no notification arrived during the window.
 
 ### historyread
 
 Reads historical data from a node. Supports raw history reads and aggregate (processed) history reads.
+`--start` and `--end` are parsed with `CultureInfo.InvariantCulture` and treated as UTC; supply
+them in ISO 8601 UTC form (`YYYY-MM-DDTHH:MM:SSZ`) for unambiguous behaviour across hosts.
 
 ```bash
 # Raw history
 otopcua-cli historyread -u opc.tcp://localhost:4840/OtOpcUa \
   -n "ns=1;s=TestMachine_001.TestHistoryValue" \
-  --start "2026-03-25" --end "2026-03-30"
+  --start "2026-03-25T00:00:00Z" --end "2026-03-30T00:00:00Z"
 
 # Aggregate: 1-hour average
 otopcua-cli historyread -u opc.tcp://localhost:4840/OtOpcUa \
   -n "ns=1;s=TestMachine_001.TestHistoryValue" \
-  --start "2026-03-25" --end "2026-03-30" \
+  --start "2026-03-25T00:00:00Z" --end "2026-03-30T00:00:00Z" \
   --aggregate Average --interval 3600000
 ```
 
 | Flag | Description |
 |------|-------------|
 | `-n` / `--node` | Node ID to read history for (required) |
-| `--start` | Start time, ISO 8601 or date string (default: 24 hours ago) |
-| `--end` | End time, ISO 8601 or date string (default: now) |
+| `--start` | Start time in ISO 8601 UTC format, e.g. `2026-01-15T08:00:00Z` (default: 24 hours ago) |
+| `--end` | End time in ISO 8601 UTC format, e.g. `2026-01-15T09:00:00Z` (default: now) |
 | `--max` | Maximum number of values (default: 1000) |
-| `--aggregate` | Aggregate function: Average, Minimum, Maximum, Count, Start, End |
+| `--aggregate` | Aggregate function: Average, Minimum, Maximum, Count, Start, End, StandardDeviation |
 | `--interval` | Processing interval in milliseconds for aggregates (default: 3600000) |
 
 #### Aggregate mapping
 
-| Name | OPC UA Node ID |
-|------|---------------|
-| `Average` | `AggregateFunction_Average` |
-| `Minimum` | `AggregateFunction_Minimum` |
-| `Maximum` | `AggregateFunction_Maximum` |
-| `Count` | `AggregateFunction_Count` |
-| `Start` | `AggregateFunction_Start` |
-| `End` | `AggregateFunction_End` |
+| Name | Aliases | OPC UA Node ID |
+|------|---------|---------------|
+| `Average` | `avg` | `AggregateFunction_Average` |
+| `Minimum` | `min` | `AggregateFunction_Minimum` |
+| `Maximum` | `max` | `AggregateFunction_Maximum` |
+| `Count` |  | `AggregateFunction_Count` |
+| `Start` | `first` | `AggregateFunction_Start` |
+| `End` | `last` | `AggregateFunction_End` |
+| `StandardDeviation` | `stddev`, `stdev` | `AggregateFunction_StandardDeviationSample` |
 
 ### alarms
 

docs/Client.UI.md

@@ -198,7 +198,7 @@ All times are in UTC. Invalid input turns red on blur.
 
 | Option | Description |
 |--------|-------------|
-| Aggregate | Raw (default), Average, Minimum, Maximum, Count, Start, End |
+| Aggregate | Raw (default), Average, Minimum, Maximum, Count, Start, End, Standard Deviation |
 | Interval (ms) | Processing interval for aggregate queries (shown only for aggregates) |
 | Max Values | Maximum number of raw values to return (default 1000) |
 

docs/Driver.AbCip.Cli.md

@@ -4,8 +4,9 @@ Ad-hoc probe / read / write / subscribe tool for ControlLogix / CompactLogix /
 Micro800 / GuardLogix PLCs, talking to the **same** `AbCipDriver` the OtOpcUa
 server uses (libplctag under the hood).
 
-Second of four driver test-client CLIs (Modbus → AB CIP → AB Legacy → S7 →
-TwinCAT). Shares `Driver.Cli.Common` with the others.
+Second of six driver test-client CLIs (Modbus → AB CIP → AB Legacy → S7 →
+TwinCAT → FOCAS). Shares `Driver.Cli.Common` with the others; see
+[DriverClis.md](DriverClis.md) for the authoritative roster.
 
 ## Build + run
 

docs/Driver.AbLegacy.Cli.md

@@ -95,6 +95,9 @@ PLC-managed — use with caution.
 otopcua-ablegacy-cli subscribe -g ab://192.168.1.20/1,0 -a N7:10 -t Int -i 500
 ```
 
+`-i` / `--interval-ms` is the publishing interval in milliseconds — default
+`1000`. `PollGroupEngine` floors sub-250 ms values, so `-i 100` runs at 250 ms.
+
 ## Known caveat — ab_server upstream gap
 
 The integration-fixture `ab_server` Docker container accepts TCP but its PCCC

docs/Driver.Modbus.Cli.md

@@ -122,6 +122,14 @@ gives plausible values is the correct one for that device.
 
 ## v2 addressing grammar
 
+> **CLI scope:** the `read` / `write` / `subscribe` commands accept only
+> the structured `--region` + `--address` + `--type` triple. The
+> address-string grammar below is a **`DriverConfig` JSON** feature
+> consumed by the driver itself; it is not reachable from this CLI's
+> flags. To experiment with it via the CLI, use the structured flags;
+> to deploy spreadsheets as-is, hand-author a `DriverConfig` and run
+> the server.
+
 The driver accepts the industry-standard tag-address grammar so you can
 paste tag spreadsheets from Wonderware / Kepware / Ignition without
 per-row manual translation. Full reference + grammar rules:

docs/ScriptedAlarms.md

@@ -35,7 +35,7 @@ new ScriptedAlarmDefinition(
 
 ## Predicate evaluation
 
-Alarm predicates reuse the same Roslyn sandbox as virtual tags — `ScriptEvaluator<AlarmPredicateContext, bool>` compiles the source, `TimedScriptEvaluator` wraps it with the configured timeout (default from `TimedScriptEvaluator.DefaultTimeout`), and `DependencyExtractor` statically harvests the tag paths the script reads. The sandbox rules (forbidden types, cancellation, logging sinks) are documented in [VirtualTags.md](VirtualTags.md); ScriptedAlarms does not redefine them. The known memory / CPU resource limits are documented there as well.
+Alarm predicates reuse the same Roslyn sandbox as virtual tags — `ScriptEvaluator<AlarmPredicateContext, bool>` compiles the source, `TimedScriptEvaluator` wraps it with the configured timeout (default from `TimedScriptEvaluator.DefaultTimeout`), and `DependencyExtractor` statically harvests the tag paths the script reads. The sandbox rules (forbidden types, cancellation, logging sinks) are documented in [VirtualTags.md](VirtualTags.md); ScriptedAlarms does not redefine them. The known resource limits — unbounded script-side memory, the per-publish accretion of dynamically-emitted script assemblies (Core.Scripting-008), and the orphan-thread CPU-budget caveat — are documented in that file as well.
 
 `AlarmPredicateContext` (`AlarmPredicateContext.cs`) is the script's `ScriptContext` subclass:
 
@@ -79,6 +79,17 @@ Two invariants the machine enforces:
 
 Fallback rules: a resolved `DataValueSnapshot` with a non-zero `StatusCode`, a `null` `Value`, or an unknown path becomes `{?}`. The event still fires — the operator sees where the reference broke rather than having the alarm swallowed.
 
+## Input-quality policy
+
+Predicate evaluation and message-template resolution deliberately treat tag-input quality differently:
+
+| Surface | Quality bar | Rationale |
+|---|---|---|
+| `ScriptedAlarmEngine.AreInputsReady` (predicate gate) | **Bad rejected** (`StatusCode` bit 31 set). `Good` and `Uncertain` are both accepted. | Uncertain quality still carries a value the predicate can inspect; rejecting it would mask a transitional alarm condition. Predicate evaluation is a state-machine input — operators want it to track reality as closely as the quality allows. |
+| `MessageTemplate.Resolve` (operator-facing message) | **Any non-zero `StatusCode` rejected** — only `Good` substitutes; `Uncertain` / Bad / unknown all render as `{?}`. | The message is a human-readable signal; substituting an Uncertain value would let operators act on a questionable reading without seeing the qualifier. Rendering `{?}` makes the doubt explicit. |
+
+`AlarmPredicateContext.GetTag` returns a `BadNodeIdUnknown` (`0x80340000`) snapshot for missing or empty paths, so a typo in the predicate flows through `AreInputsReady` (Bad → predicate skipped, prior state held) and `MessageTemplate.Resolve` (non-Good → `{?}`) without crashing the engine. (Core.ScriptedAlarms-010)
+
 ## State persistence
 
 `IAlarmStateStore` (`IAlarmStateStore.cs`) is the persistence contract: `LoadAsync(alarmId)`, `LoadAllAsync`, `SaveAsync(state)`, `RemoveAsync(alarmId)`. `InMemoryAlarmStateStore` in the same file is the default for tests and dev deployments without a SQL backend. Stream E wires the production implementation against the `ScriptedAlarmState` config-DB table with audit logging through `Core.Abstractions.IAuditLogger`.

docs/VirtualTags.md

@@ -28,7 +28,9 @@ Similarly, **`System.Threading.Tasks` is now denied** (Core.Scripting-003), whic
 
 ### Compile cache (`CompiledScriptCache<TContext, TResult>`)
 
-`ConcurrentDictionary<string, Lazy<ScriptEvaluator<...>>>` keyed on `SHA-256(UTF8(source))` rendered to hex. `Lazy<T>` with `ExecutionAndPublication` mode means two threads racing a miss compile exactly once. Failed compiles evict the entry so a corrected retry can succeed (used during Admin UI authoring). No capacity bound — scripts are operator-authored and bounded by the config DB. Whitespace changes miss the cache on purpose. `Clear()` is called on config-publish.
+`ConcurrentDictionary<string, Lazy<ScriptEvaluator<...>>>` keyed on `SHA-256(UTF8(source))` rendered to hex. `Lazy<T>` with `ExecutionAndPublication` mode means two threads racing a miss compile exactly once. Failed compiles evict the entry (via the `TryRemove(KeyValuePair<,>)` overload so a concurrently re-added retry entry is not collateral damage — Core.Scripting-006) so a corrected retry can succeed (used during Admin UI authoring). No capacity bound — scripts are operator-authored and bounded by the config DB. Whitespace changes miss the cache on purpose. `Clear()` is called on config-publish.
+
+**Per-publish assembly accretion (accepted limitation, Core.Scripting-008).** Each compiled `ScriptEvaluator` holds a Roslyn `ScriptRunner<T>` delegate, which keeps the dynamically-emitted script assembly loaded for the process lifetime. Emitted assemblies in the default `AssemblyLoadContext` cannot be unloaded; `CompiledScriptCache.Clear()` drops the dictionary entries but does **not** unload the underlying assemblies. Across many config-publish generations (each `Clear()` followed by recompiling every script), the process accumulates dead script assemblies. For the expected "low thousands" of scripts this is benign, but a long-running server with very frequent publishes will see steady managed-memory growth that does not return until the process restarts. Out-of-process script evaluation or a collectible `AssemblyLoadContext` is a v3 concern; deployments with high-publish-frequency requirements should schedule a periodic server restart to reclaim the accrued assemblies.
 
 ### Per-evaluation timeout (`TimedScriptEvaluator<TContext, TResult>`)
 

docs/v2/Galaxy.Performance.md

@@ -150,3 +150,9 @@ substantive driver change, and revise this table when the data does.
    leak guard. Likely culprits: lingering subscription handles in
    `SubscriptionRegistry`, or a downstream consumer retaining
    `DataValueSnapshot` references past their useful life.
+
+## Scripted-alarm engine — known hot-path allocations
+
+`ScriptedAlarmEngine.BuildReadCache` allocates a fresh `Dictionary<string, DataValueSnapshot>` and `AlarmPredicateContext` on every predicate evaluation — i.e. once per upstream tag change per referencing alarm. On a busy line where many tags feeding many alarms change frequently, this is a steady stream of short-lived dictionary allocations on the hot path. (Core.ScriptedAlarms-009)
+
+The allocations are deliberate for now: predicate evaluation is already serialised under `_evalGate`, so a single reused scratch dictionary would be safe, but the per-call dictionary keeps the evaluation surface immutable and trivially safe against future refactors. If a future scripted-alarm soak surfaces allocation pressure on this path, the mitigation is a per-alarm scratch buffer cleared between evaluations — note here before changing the engine.

docs/v2/dl205.md

@@ -43,6 +43,15 @@ that a naive Modbus client will byte-swap [1][2].
   really "read 10 consecutive holding registers starting at the Modbus address
   that V2000 translates to (see next section), unpack each register low-byte
   then high-byte, stop at the first `0x00`."
+- **Grammar scope** (Driver.Modbus.Addressing-007): the
+  `ModbusStringByteOrder` knob (HighByteFirst / LowByteFirst) is **not**
+  expressible through the `ModbusAddressParser` grammar string — the 3rd grammar
+  field is the multi-register word/byte order (ABCD/CDAB/BADC/DCBA) and the 4th
+  is the array count, so there is no token slot for the per-string byte order.
+  Tags that need low-byte-first packing on DL205 must set
+  `ModbusTagDefinition.StringByteOrder = LowByteFirst` via the structured tag
+  form (the driver config DTO). The grammar default produces high-byte-first
+  strings (matches Ignition / Kepware default behaviour).
 
 Test names:
 `DL205_String_low_byte_first_within_register`,

docs/v2/implementation/phase-7-scripting-and-alarming.md

@@ -29,7 +29,7 @@ Tie-in capability — **historian alarm sink**:
 | 3 | Evaluation trigger = **change-driven + timer-driven**; operator chooses per-tag | Change-driven is cheap at steady state; timer is the escape hatch for polling derivations that don't have a discrete "input changed" signal. |
 | 4 | Script shape = **Shape A — one script per virtual tag/alarm**; `return` produces the value (or `bool` for alarm condition) | Minimal surface; no predicate/action split. Alarm side-effects (severity, message) configured out-of-band, not in the script. |
 | 5 | Alarm fidelity = **full OPC UA Part 9** | Uniform with Galaxy + ALMD on the wire; client-side tooling (HMIs, historians, event pipelines) gets one shape. |
-| 6 | Sandbox = **read-only context**; scripts can only read any tag + write to virtual tags | Strict Roslyn `ScriptOptions` allow-list. No HttpClient / File / Process / reflection. |
+| 6 | Sandbox = **read-only context**; scripts can only read any tag + write to virtual tags | Strict Roslyn `ScriptOptions` allow-list. Authoritative deny-list (`ForbiddenTypeAnalyzer`): namespace-prefix deny `System.IO`, `System.Net`, `System.Diagnostics`, `System.Reflection`, `System.Threading.Tasks` (Task / Parallel fan-out — Core.Scripting-003), `System.Runtime.InteropServices`, `Microsoft.Win32`; type-granular deny `System.Environment`, `System.AppDomain`, `System.GC`, `System.Activator`, `System.Threading.Thread` (these live directly in the allow-listed `System` / `System.Threading` namespaces, so a prefix rule cannot reach them without blocking primitives — Core.Scripting-001 / -009). |
 | 7 | Dependency declaration = **AST inference**; operator doesn't maintain a separate dependency list | `CSharpSyntaxWalker` extracts `ctx.GetTag("path")` string-literal calls at compile time; dynamic paths rejected at publish. |
 | 8 | Config storage = **config DB with generation-sealed cache** (same as driver instances) | Virtual tags + alarms publish atomically in the same generation as the driver instance config they may depend on. |
 | 9 | Script return value shape (`ctx.GetTag`) = **`DataValue { Value, StatusCode, Timestamp }`** | Scripts branch on quality naturally without separate `ctx.GetQuality(...)` calls. |
@@ -162,7 +162,7 @@ Tie-in capability — **historian alarm sink**:
 
 ## Compliance Checks (run at exit gate)
 
-- [ ] **Sandbox escape**: attempts to reference `System.IO.File`, `System.Net.Http.HttpClient`, `System.Diagnostics.Process`, or `typeof(X).Assembly.Load` fail at script compile with an actionable error.
+- [ ] **Sandbox escape**: attempts to reference any deny-listed namespace prefix (`System.IO`, `System.Net`, `System.Diagnostics`, `System.Reflection`, `System.Threading.Tasks`, `System.Runtime.InteropServices`, `Microsoft.Win32`) or any of the type-granular forbidden types (`System.Environment`, `System.AppDomain`, `System.GC`, `System.Activator`, `System.Threading.Thread`) fail at script compile with an actionable error. Vectors include direct calls, `typeof(T)`, generic type arguments, casts, `is`/`as` patterns, `default(T)`, array element types, and explicitly-typed local declarations.
 - [ ] **Dependency inference**: `ctx.GetTag(myStringVar)` (non-literal path) is rejected at publish with a span-pointed error; `ctx.GetTag("Line1/Speed")` is accepted + appears in the inferred input set.
 - [ ] **Change cascade**: tag A → virtual tag B → virtual tag C. When A changes, B recomputes, then C recomputes. Single change event triggers the full cascade in topological order within one evaluation pass.
 - [ ] **Cycle rejection**: publish a config where virtual tag B depends on A and A depends on B. Publish fails pre-commit with a clear cycle message.

src/Client/ZB.MOM.WW.OtOpcUa.Client.CLI/CommandBase.cs

@@ -109,8 +109,16 @@ public abstract class CommandBase : ICommand
     /// <summary>
     ///     Configures Serilog based on the verbose flag.
     /// </summary>
+    /// <remarks>
+    ///     Disposes the previously assigned <see cref="Log.Logger" /> via <see cref="Log.CloseAndFlush" />
+    ///     before installing the new one, so repeated CLI invocations (e.g. in the test suite) do not
+    ///     leak the prior logger's console sink.
+    /// </remarks>
     protected void ConfigureLogging()
     {
+        // Dispose any previously installed logger before swapping in a new one.
+        Log.CloseAndFlush();
+
         var config = new LoggerConfiguration();
         if (Verbose)
             config.MinimumLevel.Debug()

src/Client/ZB.MOM.WW.OtOpcUa.Client.CLI/Commands/AlarmsCommand.cs

@@ -1,6 +1,8 @@
 using System.Threading.Channels;
 using CliFx.Attributes;
+using CliFx.Exceptions;
 using CliFx.Infrastructure;
+using Opc.Ua;
 using ZB.MOM.WW.OtOpcUa.Client.CLI.Helpers;
 using ZB.MOM.WW.OtOpcUa.Client.Shared;
 using ZB.MOM.WW.OtOpcUa.Client.Shared.Models;
@@ -43,14 +45,25 @@ public class AlarmsCommand : CommandBase
     public override async ValueTask ExecuteAsync(IConsole console)
     {
         ConfigureLogging();
+        if (Interval <= 0)
+            throw new CommandException($"--interval must be greater than 0 (was {Interval}).");
+
+        NodeId? sourceNodeId;
+        try
+        {
+            sourceNodeId = NodeIdParser.Parse(NodeId);
+        }
+        catch (Exception ex) when (ex is FormatException or ArgumentException)
+        {
+            throw new CommandException($"Invalid --node value: {ex.Message}");
+        }
+
         IOpcUaClientService? service = null;
         try
         {
             var ct = console.RegisterCancellationHandler();
             (service, _) = await CreateServiceAndConnectAsync(ct);
 
-            var sourceNodeId = NodeIdParser.Parse(NodeId);
-
             // Channel serialises SDK notification-thread writes to the main async loop so
             // that concurrent alarm callbacks never interleave on the shared TextWriter.
             var outputChannel = Channel.CreateUnbounded<string>(

src/Client/ZB.MOM.WW.OtOpcUa.Client.CLI/Commands/BrowseCommand.cs

@@ -1,4 +1,5 @@
 using CliFx.Attributes;
+using CliFx.Exceptions;
 using CliFx.Infrastructure;
 using Opc.Ua;
 using ZB.MOM.WW.OtOpcUa.Client.CLI.Helpers;
@@ -42,13 +43,25 @@ public class BrowseCommand : CommandBase
     public override async ValueTask ExecuteAsync(IConsole console)
     {
         ConfigureLogging();
+        if (Depth <= 0)
+            throw new CommandException($"--depth must be greater than 0 (was {Depth}).");
+
+        NodeId? startNode;
+        try
+        {
+            startNode = NodeIdParser.Parse(NodeId);
+        }
+        catch (Exception ex) when (ex is FormatException or ArgumentException)
+        {
+            throw new CommandException($"Invalid --node value: {ex.Message}");
+        }
+
         IOpcUaClientService? service = null;
         try
         {
             var ct = console.RegisterCancellationHandler();
             (service, _) = await CreateServiceAndConnectAsync(ct);
 
-            var startNode = NodeIdParser.Parse(NodeId);
             var maxDepth = Recursive ? Depth : 1;
 
             await BrowseNodeAsync(service, console, startNode, maxDepth, 0, ct);

src/Client/ZB.MOM.WW.OtOpcUa.Client.CLI/Commands/HistoryReadCommand.cs

@@ -1,5 +1,6 @@
 using System.Globalization;
 using CliFx.Attributes;
+using CliFx.Exceptions;
 using CliFx.Infrastructure;
 using Opc.Ua;
 using ZB.MOM.WW.OtOpcUa.Client.CLI.Helpers;
@@ -62,22 +63,65 @@ public class HistoryReadCommand : CommandBase
     public override async ValueTask ExecuteAsync(IConsole console)
     {
         ConfigureLogging();
+        if (MaxValues <= 0)
+            throw new CommandException($"--max must be greater than 0 (was {MaxValues}).");
+        if (!string.IsNullOrEmpty(Aggregate) && IntervalMs <= 0)
+            throw new CommandException($"--interval must be greater than 0 (was {IntervalMs}).");
+
+        NodeId nodeId;
+        try
+        {
+            nodeId = NodeIdParser.ParseRequired(NodeId);
+        }
+        catch (Exception ex) when (ex is FormatException or ArgumentException)
+        {
+            throw new CommandException($"Invalid --node value: {ex.Message}");
+        }
+
+        DateTime start, end;
+        try
+        {
+            start = string.IsNullOrEmpty(StartTime)
+                ? DateTime.UtcNow.AddHours(-24)
+                : DateTime.Parse(StartTime, CultureInfo.InvariantCulture,
+                    DateTimeStyles.AssumeUniversal | DateTimeStyles.AdjustToUniversal);
+        }
+        catch (FormatException ex)
+        {
+            throw new CommandException($"Invalid --start value '{StartTime}': {ex.Message}. Expected ISO 8601 UTC format, e.g. 2026-01-15T08:00:00Z.");
+        }
+
+        try
+        {
+            end = string.IsNullOrEmpty(EndTime)
+                ? DateTime.UtcNow
+                : DateTime.Parse(EndTime, CultureInfo.InvariantCulture,
+                    DateTimeStyles.AssumeUniversal | DateTimeStyles.AdjustToUniversal);
+        }
+        catch (FormatException ex)
+        {
+            throw new CommandException($"Invalid --end value '{EndTime}': {ex.Message}. Expected ISO 8601 UTC format, e.g. 2026-01-15T08:00:00Z.");
+        }
+
+        AggregateType aggregateType = default;
+        if (!string.IsNullOrEmpty(Aggregate))
+        {
+            try
+            {
+                aggregateType = ParseAggregateType(Aggregate);
+            }
+            catch (ArgumentException ex)
+            {
+                throw new CommandException($"Invalid --aggregate value: {ex.Message}");
+            }
+        }
+
         IOpcUaClientService? service = null;
         try
         {
             var ct = console.RegisterCancellationHandler();
             (service, _) = await CreateServiceAndConnectAsync(ct);
 
-            var nodeId = NodeIdParser.ParseRequired(NodeId);
-            var start = string.IsNullOrEmpty(StartTime)
-                ? DateTime.UtcNow.AddHours(-24)
-                : DateTime.Parse(StartTime, CultureInfo.InvariantCulture,
-                    DateTimeStyles.AssumeUniversal | DateTimeStyles.AdjustToUniversal);
-            var end = string.IsNullOrEmpty(EndTime)
-                ? DateTime.UtcNow
-                : DateTime.Parse(EndTime, CultureInfo.InvariantCulture,
-                    DateTimeStyles.AssumeUniversal | DateTimeStyles.AdjustToUniversal);
-
             IReadOnlyList<DataValue> values;
 
             if (string.IsNullOrEmpty(Aggregate))
@@ -88,7 +132,6 @@ public class HistoryReadCommand : CommandBase
             }
             else
             {
-                var aggregateType = ParseAggregateType(Aggregate);
                 await console.Output.WriteLineAsync(
                     $"History for {NodeId} ({Aggregate}, interval={IntervalMs}ms)");
                 values = await service.HistoryReadAggregateAsync(

src/Client/ZB.MOM.WW.OtOpcUa.Client.CLI/Commands/ReadCommand.cs

@@ -1,5 +1,7 @@
 using CliFx.Attributes;
+using CliFx.Exceptions;
 using CliFx.Infrastructure;
+using Opc.Ua;
 using ZB.MOM.WW.OtOpcUa.Client.CLI.Helpers;
 using ZB.MOM.WW.OtOpcUa.Client.Shared;
 
@@ -29,13 +31,23 @@ public class ReadCommand : CommandBase
     public override async ValueTask ExecuteAsync(IConsole console)
     {
         ConfigureLogging();
+
+        NodeId nodeId;
+        try
+        {
+            nodeId = NodeIdParser.ParseRequired(NodeId);
+        }
+        catch (Exception ex) when (ex is FormatException or ArgumentException)
+        {
+            throw new CommandException($"Invalid --node value: {ex.Message}");
+        }
+
         IOpcUaClientService? service = null;
         try
         {
             var ct = console.RegisterCancellationHandler();
             (service, _) = await CreateServiceAndConnectAsync(ct);
 
-            var nodeId = NodeIdParser.ParseRequired(NodeId);
             var value = await service.ReadValueAsync(nodeId, ct);
 
             await console.Output.WriteLineAsync($"Node:        {NodeId}");

src/Client/ZB.MOM.WW.OtOpcUa.Client.CLI/Commands/SubscribeCommand.cs

@@ -1,6 +1,7 @@
 using System.Collections.Concurrent;
 using System.Threading.Channels;
 using CliFx.Attributes;
+using CliFx.Exceptions;
 using CliFx.Infrastructure;
 using Opc.Ua;
 using ZB.MOM.WW.OtOpcUa.Client.CLI.Helpers;
@@ -12,42 +13,92 @@ namespace ZB.MOM.WW.OtOpcUa.Client.CLI.Commands;
 [Command("subscribe", Description = "Monitor a node for value changes")]
 public class SubscribeCommand : CommandBase
 {
+    /// <summary>
+    /// Creates the subscribe command used to monitor a node (or a subtree of nodes) for data-change
+    /// notifications.
+    /// </summary>
+    /// <param name="factory">The factory that creates the shared client service for the command run.</param>
     public SubscribeCommand(IOpcUaClientServiceFactory factory) : base(factory)
     {
     }
 
+    /// <summary>
+    /// Gets the node ID to monitor. When <see cref="Recursive" /> is set, this node is the browse root
+    /// and every <c>Variable</c> child it reaches is subscribed.
+    /// </summary>
     [CommandOption("node", 'n', Description = "Node ID to monitor", IsRequired = true)]
     public string NodeId { get; init; } = default!;
 
+    /// <summary>
+    /// Gets the sampling interval, in milliseconds, requested for every monitored item.
+    /// </summary>
     [CommandOption("interval", 'i', Description = "Sampling interval in milliseconds")]
     public int Interval { get; init; } = 1000;
 
+    /// <summary>
+    /// Gets a value indicating whether the command should browse from <see cref="NodeId" />
+    /// and subscribe to every <c>Variable</c> in the subtree.
+    /// </summary>
     [CommandOption("recursive", 'r', Description = "Browse recursively from --node and subscribe to every Variable found")]
     public bool Recursive { get; init; }
 
+    /// <summary>
+    /// Gets the maximum recursion depth applied while collecting variables when <see cref="Recursive" /> is set.
+    /// </summary>
     [CommandOption("max-depth", Description = "Maximum recursion depth when --recursive is set")]
     public int MaxDepth { get; init; } = 10;
 
+    /// <summary>
+    /// Gets a value indicating whether per-update lines should be suppressed in favour of the final summary only.
+    /// </summary>
     [CommandOption("quiet", 'q', Description = "Suppress per-update output; only print a final summary on Ctrl+C")]
     public bool Quiet { get; init; }
 
+    /// <summary>
+    /// Gets the duration, in seconds, before the command auto-exits and prints its summary.
+    /// A value of <c>0</c> means the command runs until Ctrl+C.
+    /// </summary>
     [CommandOption("duration", Description = "Auto-exit after N seconds and print summary (0 = run until Ctrl+C)")]
     public int DurationSeconds { get; init; } = 0;
 
+    /// <summary>
+    /// Gets the optional path that the command should write the final summary to on exit, in addition to stdout.
+    /// </summary>
     [CommandOption("summary-file", Description = "Write summary to this file path on exit (in addition to stdout)")]
     public string? SummaryFile { get; init; }
 
+    /// <summary>
+    /// Connects to the server, subscribes to <see cref="NodeId" /> (or its subtree when recursive),
+    /// streams data-change notifications to the console, and prints a summary when the command exits.
+    /// </summary>
+    /// <param name="console">The CLI console used for output and cancellation handling.</param>
     public override async ValueTask ExecuteAsync(IConsole console)
     {
         ConfigureLogging();
+
+        if (Interval <= 0)
+            throw new CommandException($"--interval must be greater than 0 (was {Interval}).");
+        if (Recursive && MaxDepth <= 0)
+            throw new CommandException($"--max-depth must be greater than 0 (was {MaxDepth}).");
+        if (DurationSeconds < 0)
+            throw new CommandException($"--duration must be 0 or a positive number (was {DurationSeconds}).");
+
+        NodeId rootNodeId;
+        try
+        {
+            rootNodeId = NodeIdParser.ParseRequired(NodeId);
+        }
+        catch (Exception ex) when (ex is FormatException or ArgumentException)
+        {
+            throw new CommandException($"Invalid --node value: {ex.Message}");
+        }
+
         IOpcUaClientService? service = null;
         try
         {
             var ct = console.RegisterCancellationHandler();
             (service, _) = await CreateServiceAndConnectAsync(ct);
 
-            var rootNodeId = NodeIdParser.ParseRequired(NodeId);
-
             var targets = new List<(NodeId nodeId, string displayPath)>();
             if (Recursive)
             {

src/Client/ZB.MOM.WW.OtOpcUa.Client.CLI/Commands/WriteCommand.cs

@@ -1,4 +1,5 @@
 using CliFx.Attributes;
+using CliFx.Exceptions;
 using CliFx.Infrastructure;
 using Opc.Ua;
 using ZB.MOM.WW.OtOpcUa.Client.CLI.Helpers;
@@ -37,14 +38,23 @@ public class WriteCommand : CommandBase
     public override async ValueTask ExecuteAsync(IConsole console)
     {
         ConfigureLogging();
+
+        NodeId nodeId;
+        try
+        {
+            nodeId = NodeIdParser.ParseRequired(NodeId);
+        }
+        catch (Exception ex) when (ex is FormatException or ArgumentException)
+        {
+            throw new CommandException($"Invalid --node value: {ex.Message}");
+        }
+
         IOpcUaClientService? service = null;
         try
         {
             var ct = console.RegisterCancellationHandler();
             (service, _) = await CreateServiceAndConnectAsync(ct);
 
-            var nodeId = NodeIdParser.ParseRequired(NodeId);
-
             // Read current value to determine type for conversion
             var currentValue = await service.ReadValueAsync(nodeId, ct);
             var typedValue = ValueConverter.ConvertValue(Value, currentValue.Value);

src/Client/ZB.MOM.WW.OtOpcUa.Client.Shared/Adapters/DefaultApplicationConfigurationFactory.cs

@@ -14,7 +14,13 @@ internal sealed class DefaultApplicationConfigurationFactory : IApplicationConfi
 
     public async Task<ApplicationConfiguration> CreateAsync(ConnectionSettings settings, CancellationToken ct)
     {
-        var storePath = settings.CertificateStorePath;
+        // Resolve the canonical PKI path lazily on first use so constructing a
+        // ConnectionSettings instance — including the throwaway copies the client
+        // service builds per failover attempt — does not touch the filesystem.
+        // Callers that supply an explicit path override the default.
+        var storePath = string.IsNullOrWhiteSpace(settings.CertificateStorePath)
+            ? ClientStoragePaths.GetPkiPath()
+            : settings.CertificateStorePath;
 
         var config = new ApplicationConfiguration
         {

src/Client/ZB.MOM.WW.OtOpcUa.Client.Shared/Adapters/DefaultEndpointDiscovery.cs

@@ -24,9 +24,47 @@ internal sealed class DefaultEndpointDiscovery : IEndpointDiscovery
         using var client = DiscoveryClient.Create(new Uri(endpointUrl));
         var allEndpoints = client.GetEndpoints(null);
 
+        return EndpointSelector.SelectBest(allEndpoints, endpointUrl, requestedMode);
+    }
+}
+
+/// <summary>
+///     Pure best-endpoint selection logic, extracted from <see cref="DefaultEndpointDiscovery"/>
+///     so it can be unit tested without standing up a real <see cref="DiscoveryClient"/>.
+/// </summary>
+internal static class EndpointSelector
+{
+    private static readonly ILogger Logger = Log.ForContext(typeof(EndpointSelector));
+
+    /// <summary>
+    ///     Picks the best endpoint from the discovery response that matches the requested
+    ///     security mode, preferring <c>Basic256Sha256</c>, and rewrites the endpoint URL
+    ///     host to match the user-supplied URL when the discovery response advertises a
+    ///     different hostname.
+    /// </summary>
+    /// <param name="allEndpoints">Endpoints returned by the discovery query, in any order.</param>
+    /// <param name="endpointUrl">The endpoint URL the operator supplied; supplies the hostname rewrite target.</param>
+    /// <param name="requestedMode">The requested OPC UA message security mode.</param>
+    /// <exception cref="InvalidOperationException">
+    ///     Thrown when no endpoint matches <paramref name="requestedMode"/>; the message lists the
+    ///     security mode + policy combinations the server returned so operators can diagnose mismatches.
+    /// </exception>
+    public static EndpointDescription SelectBest(
+        IEnumerable<EndpointDescription> allEndpoints,
+        string endpointUrl,
+        MessageSecurityMode requestedMode)
+    {
+        ArgumentNullException.ThrowIfNull(allEndpoints);
+        if (string.IsNullOrWhiteSpace(endpointUrl))
+            throw new ArgumentException("Endpoint URL must not be null or empty.", nameof(endpointUrl));
+
+        // Materialise once so we can both iterate and produce a diagnostic message
+        // without re-running the underlying discovery enumeration.
+        var endpoints = allEndpoints.ToList();
+
         EndpointDescription? best = null;
 
-        foreach (var ep in allEndpoints)
+        foreach (var ep in endpoints)
         {
             if (ep.SecurityMode != requestedMode)
                 continue;
@@ -37,18 +75,21 @@ internal sealed class DefaultEndpointDiscovery : IEndpointDiscovery
                 continue;
             }
 
+            // Prefer Basic256Sha256 when multiple endpoints match the requested mode.
             if (ep.SecurityPolicyUri == SecurityPolicies.Basic256Sha256)
                 best = ep;
         }
 
         if (best == null)
         {
-            var available = string.Join(", ", allEndpoints.Select(e => $"{e.SecurityMode}/{e.SecurityPolicyUri}"));
+            var available = string.Join(", ", endpoints.Select(e => $"{e.SecurityMode}/{e.SecurityPolicyUri}"));
             throw new InvalidOperationException(
                 $"No endpoint found with security mode '{requestedMode}'. Available endpoints: {available}");
         }
 
-        // Rewrite endpoint URL hostname to match user-supplied hostname
+        // Rewrite endpoint URL hostname to match user-supplied hostname. Necessary
+        // when the OPC UA server returns a discovery URL using a different hostname
+        // (e.g. internal DNS name) than the one the operator routed to.
         var serverUri = new Uri(best.EndpointUrl);
         var requestedUri = new Uri(endpointUrl);
         if (serverUri.Host != requestedUri.Host)

src/Client/ZB.MOM.WW.OtOpcUa.Client.Shared/Adapters/DefaultSessionAdapter.cs

@@ -73,6 +73,17 @@ internal sealed class DefaultSessionAdapter : ISessionAdapter
 
         var writeCollection = new WriteValueCollection { writeValue };
         var response = await _session.WriteAsync(null, writeCollection, ct);
+        // A malformed or service-level-faulted response can come back with an empty
+        // Results collection alongside a service fault. Surface the service result
+        // (or BadUnexpectedError) rather than letting Results[0] throw
+        // IndexOutOfRangeException upstream.
+        if (response.Results == null || response.Results.Count == 0)
+        {
+            var serviceResult = response.ResponseHeader?.ServiceResult.Code ?? StatusCodes.BadUnexpectedError;
+            throw new ServiceResultException(serviceResult,
+                $"Write response contained no results for node {nodeId}.");
+        }
+
         return response.Results[0];
     }
 
@@ -143,15 +154,18 @@ internal sealed class DefaultSessionAdapter : ISessionAdapter
             if (continuationPoint != null)
                 nodesToRead[0].ContinuationPoint = continuationPoint;
 
-            _session.HistoryRead(
+            // Use the async overload so this method is genuinely asynchronous,
+            // honors the cancellation token, and does not block the caller's thread
+            // (which would block the UI dispatcher for client.ui consumers).
+            var response = await _session.HistoryReadAsync(
                 null,
                 new ExtensionObject(details),
                 TimestampsToReturn.Source,
                 continuationPoint != null,
                 nodesToRead,
-                out var results,
-                out _);
+                ct).ConfigureAwait(false);
 
+            var results = response.Results;
             if (results == null || results.Count == 0)
                 break;
 
@@ -186,15 +200,17 @@ internal sealed class DefaultSessionAdapter : ISessionAdapter
             new HistoryReadValueId { NodeId = nodeId }
         };
 
-        _session.HistoryRead(
+        // Use the async overload so the method honors the cancellation token and
+        // does not block on a synchronous service round-trip.
+        var response = await _session.HistoryReadAsync(
             null,
             new ExtensionObject(details),
             TimestampsToReturn.Source,
             false,
             nodesToRead,
-            out var results,
-            out _);
+            ct).ConfigureAwait(false);
 
+        var results = response.Results;
         var allValues = new List<DataValue>();
 
         if (results != null && results.Count > 0)
@@ -229,7 +245,9 @@ internal sealed class DefaultSessionAdapter : ISessionAdapter
     {
         try
         {
-            if (_session.Connected) _session.Close();
+            // Use the async overload so the caller does not block on the close
+            // service round-trip and the cancellation token is honored.
+            if (_session.Connected) await _session.CloseAsync(ct).ConfigureAwait(false);
         }
         catch (Exception ex)
         {
@@ -270,6 +288,15 @@ internal sealed class DefaultSessionAdapter : ISessionAdapter
             },
             ct);
 
+        // An empty Results collection paired with a service fault must surface as
+        // a ServiceResultException, not an IndexOutOfRangeException from Results[0].
+        if (result.Results == null || result.Results.Count == 0)
+        {
+            var serviceResult = result.ResponseHeader?.ServiceResult.Code ?? StatusCodes.BadUnexpectedError;
+            throw new ServiceResultException(serviceResult,
+                $"Call response contained no results for method {methodId} on {objectId}.");
+        }
+
         var callResult = result.Results[0];
         if (StatusCode.IsBad(callResult.StatusCode))
             throw new ServiceResultException(callResult.StatusCode);

src/Client/ZB.MOM.WW.OtOpcUa.Client.Shared/IOpcUaClientService.cs

@@ -96,6 +96,11 @@ public interface IOpcUaClientService : IDisposable
     /// <param name="eventId">The event identifier returned by the OPC UA server for the alarm event.</param>
     /// <param name="comment">The operator acknowledgment comment to write with the method call.</param>
     /// <param name="ct">The cancellation token that aborts the acknowledgment request.</param>
+    /// <returns>
+    /// <see cref="StatusCodes.Good"/> on success, or the server's bad <see cref="StatusCode"/>
+    /// (from the underlying <see cref="ServiceResultException"/>) when the acknowledge call
+    /// returns a bad result. Other transport-level failures still surface as exceptions.
+    /// </returns>
     Task<StatusCode> AcknowledgeAlarmAsync(string conditionNodeId, byte[] eventId, string comment, CancellationToken ct = default);
 
     /// <summary>

src/Client/ZB.MOM.WW.OtOpcUa.Client.Shared/Models/ConnectionSettings.cs

@@ -41,11 +41,13 @@ public sealed class ConnectionSettings
     public bool AutoAcceptCertificates { get; set; } = true;
 
     /// <summary>
-    ///     Path to the certificate store. Defaults to a subdirectory under LocalApplicationData
-    ///     resolved via <see cref="ClientStoragePaths"/> so the one-shot legacy-folder migration
-    ///     runs before the path is returned.
+    ///     Path to the certificate store. Defaults to <see cref="string.Empty"/>; the
+    ///     consuming application configuration factory resolves the canonical path via
+    ///     <see cref="ClientStoragePaths.GetPkiPath"/> lazily on first connect, so
+    ///     constructing settings — including the throwaway copies built per failover
+    ///     attempt — does not touch disk or run the legacy-folder migration probe.
     /// </summary>
-    public string CertificateStorePath { get; set; } = ClientStoragePaths.GetPkiPath();
+    public string CertificateStorePath { get; set; } = string.Empty;
 
     /// <summary>
     ///     Validates the settings and throws if any required values are missing or invalid.

src/Client/ZB.MOM.WW.OtOpcUa.Client.Shared/OpcUaClientService.cs

@@ -353,11 +353,24 @@ public sealed class OpcUaClientService : IOpcUaClientService
             : NodeId.Parse(conditionNodeId + ".Condition");
         var acknowledgeMethodId = MethodIds.AcknowledgeableConditionType_Acknowledge;
 
-        await _session!.CallMethodAsync(
-            conditionObjId,
-            acknowledgeMethodId,
-            [eventId, new LocalizedText(comment)],
-            ct);
+        // CallMethodAsync throws ServiceResultException on a bad call result;
+        // surface that as the returned StatusCode so callers using the documented
+        // `Task<StatusCode>` contract (e.g. `if (StatusCode.IsBad(result))`) see
+        // the failure instead of an uncaught exception they did not anticipate.
+        try
+        {
+            await _session!.CallMethodAsync(
+                conditionObjId,
+                acknowledgeMethodId,
+                [eventId, new LocalizedText(comment)],
+                ct);
+        }
+        catch (ServiceResultException ex)
+        {
+            Logger.Warning(ex, "Failed to acknowledge alarm on {ConditionId} (status {Status})",
+                conditionNodeId, ex.StatusCode);
+            return ex.StatusCode;
+        }
 
         Logger.Debug("Acknowledged alarm on {ConditionId}", conditionNodeId);
         return StatusCodes.Good;

src/Client/ZB.MOM.WW.OtOpcUa.Client.UI/Controls/DateTimeRangePicker.axaml.cs

@@ -30,12 +30,6 @@ public partial class DateTimeRangePicker : UserControl
     public static readonly StyledProperty<string> EndTextProperty =
         AvaloniaProperty.Register<DateTimeRangePicker, string>(nameof(EndText), defaultValue: "");
 
-    public static readonly StyledProperty<DateTimeOffset?> MinDateTimeProperty =
-        AvaloniaProperty.Register<DateTimeRangePicker, DateTimeOffset?>(nameof(MinDateTime));
-
-    public static readonly StyledProperty<DateTimeOffset?> MaxDateTimeProperty =
-        AvaloniaProperty.Register<DateTimeRangePicker, DateTimeOffset?>(nameof(MaxDateTime));
-
     private bool _isUpdating;
 
     public DateTimeRangePicker()
@@ -67,18 +61,6 @@ public partial class DateTimeRangePicker : UserControl
         set => SetValue(EndTextProperty, value);
     }
 
-    public DateTimeOffset? MinDateTime
-    {
-        get => GetValue(MinDateTimeProperty);
-        set => SetValue(MinDateTimeProperty, value);
-    }
-
-    public DateTimeOffset? MaxDateTime
-    {
-        get => GetValue(MaxDateTimeProperty);
-        set => SetValue(MaxDateTimeProperty, value);
-    }
-
     protected override void OnLoaded(RoutedEventArgs e)
     {
         base.OnLoaded(e);

src/Client/ZB.MOM.WW.OtOpcUa.Client.UI/Program.cs

@@ -1,4 +1,6 @@
 using Avalonia;
+using Serilog;
+using ZB.MOM.WW.OtOpcUa.Client.Shared;
 
 namespace ZB.MOM.WW.OtOpcUa.Client.UI;
 
@@ -7,8 +9,16 @@ public class Program
     [STAThread]
     public static void Main(string[] args)
     {
-        BuildAvaloniaApp()
-            .StartWithClassicDesktopLifetime(args);
+        ConfigureLogging();
+        try
+        {
+            BuildAvaloniaApp()
+                .StartWithClassicDesktopLifetime(args);
+        }
+        finally
+        {
+            Log.CloseAndFlush();
+        }
     }
 
     public static AppBuilder BuildAvaloniaApp()
@@ -18,4 +28,35 @@ public class Program
             .WithInterFont()
             .LogToTrace();
     }
+
+    /// <summary>
+    ///     Initializes the Serilog root logger with a console sink + a rolling daily file sink
+    ///     under <c>{LocalAppData}/OtOpcUaClient/logs/</c>. CLAUDE.md mandates Serilog with a
+    ///     rolling daily file sink as the project standard; this is also the only way the swallow
+    ///     blocks in the alarms / subscriptions / redundancy view-models surface a diagnosable
+    ///     trace when an operator hits a problem in the field.
+    /// </summary>
+    private static void ConfigureLogging()
+    {
+        var logsDir = Path.Combine(ClientStoragePaths.GetRoot(), "logs");
+        try
+        {
+            Directory.CreateDirectory(logsDir);
+        }
+        catch
+        {
+            // Best-effort; file sink will gracefully fall back if the dir can't be created.
+        }
+
+        Log.Logger = new LoggerConfiguration()
+            .MinimumLevel.Information()
+            .Enrich.FromLogContext()
+            .WriteTo.Console()
+            .WriteTo.File(
+                path: Path.Combine(logsDir, "client-ui-.log"),
+                rollingInterval: RollingInterval.Day,
+                retainedFileCountLimit: 14,
+                shared: true)
+            .CreateLogger();
+    }
 }

src/Client/ZB.MOM.WW.OtOpcUa.Client.UI/ViewModels/AlarmsViewModel.cs

@@ -2,6 +2,7 @@ using System.Collections.ObjectModel;
 using CommunityToolkit.Mvvm.ComponentModel;
 using CommunityToolkit.Mvvm.Input;
 using Opc.Ua;
+using Serilog;
 using ZB.MOM.WW.OtOpcUa.Client.Shared;
 using ZB.MOM.WW.OtOpcUa.Client.Shared.Models;
 using ZB.MOM.WW.OtOpcUa.Client.UI.Services;
@@ -13,9 +14,18 @@ namespace ZB.MOM.WW.OtOpcUa.Client.UI.ViewModels;
 /// </summary>
 public partial class AlarmsViewModel : ObservableObject
 {
+    private static readonly ILogger Logger = Log.ForContext<AlarmsViewModel>();
+
     private readonly IUiDispatcher _dispatcher;
     private readonly IOpcUaClientService _service;
 
+    /// <summary>
+    ///     Last user-visible status message — set when an alarm subscribe / unsubscribe / refresh
+    ///     operation fails so the shell can surface the diagnostic instead of silently dropping it.
+    ///     Genuine failures are distinguished from "feature not supported" (condition refresh).
+    /// </summary>
+    [ObservableProperty] private string? _statusMessage;
+
     [ObservableProperty] private int _interval = 1000;
 
     [ObservableProperty]
@@ -95,19 +105,25 @@ public partial class AlarmsViewModel : ObservableObject
 
             await _service.SubscribeAlarmsAsync(sourceNodeId, Interval);
             IsSubscribed = true;
+            StatusMessage = null;
 
             try
             {
                 await _service.RequestConditionRefreshAsync();
             }
-            catch
+            catch (Exception refreshEx)
             {
-                // Refresh not supported
+                // Condition refresh is optional on the server side — log at info level and surface
+                // a soft notice rather than a hard failure so the operator can tell apart "server
+                // does not advertise refresh" from a genuine subscribe failure.
+                Logger.Information(refreshEx, "RequestConditionRefresh not supported by server");
+                StatusMessage = "Condition refresh not supported by server (subscribed).";
             }
         }
-        catch
+        catch (Exception ex)
         {
-            // Subscribe failed
+            Logger.Warning(ex, "SubscribeAlarms failed for {Source}", MonitoredNodeIdText ?? "(all)");
+            StatusMessage = $"Subscribe to alarms failed: {ex.Message}";
         }
     }
 
@@ -123,10 +139,12 @@ public partial class AlarmsViewModel : ObservableObject
         {
             await _service.UnsubscribeAlarmsAsync();
             IsSubscribed = false;
+            StatusMessage = null;
         }
-        catch
+        catch (Exception ex)
         {
-            // Unsubscribe failed
+            Logger.Warning(ex, "UnsubscribeAlarms failed");
+            StatusMessage = $"Unsubscribe alarms failed: {ex.Message}";
         }
     }
 
@@ -136,10 +154,14 @@ public partial class AlarmsViewModel : ObservableObject
         try
         {
             await _service.RequestConditionRefreshAsync();
+            StatusMessage = null;
         }
-        catch
+        catch (Exception ex)
         {
-            // Refresh failed
+            // Same as the subscribe-time fallback: refresh is server-side optional. Information-
+            // level log + soft status so the operator sees why an explicit refresh did nothing.
+            Logger.Information(ex, "RequestConditionRefresh not supported by server");
+            StatusMessage = "Condition refresh not supported by server.";
         }
     }
 
@@ -189,19 +211,22 @@ public partial class AlarmsViewModel : ObservableObject
 
             await _service.SubscribeAlarmsAsync(nodeId, Interval);
             IsSubscribed = true;
+            StatusMessage = null;
 
             try
             {
                 await _service.RequestConditionRefreshAsync();
             }
-            catch
+            catch (Exception refreshEx)
             {
-                // Refresh not supported
+                Logger.Information(refreshEx, "RequestConditionRefresh not supported by server (restore path)");
+                StatusMessage = "Condition refresh not supported by server (restored subscription).";
             }
         }
-        catch
+        catch (Exception ex)
         {
-            // Subscribe failed
+            Logger.Warning(ex, "RestoreAlarmSubscription failed for {Source}", sourceNodeId);
+            StatusMessage = $"Restore alarm subscription failed: {ex.Message}";
         }
     }
 

src/Client/ZB.MOM.WW.OtOpcUa.Client.UI/ViewModels/MainWindowViewModel.cs

@@ -1,6 +1,7 @@
 using System.Collections.ObjectModel;
 using CommunityToolkit.Mvvm.ComponentModel;
 using CommunityToolkit.Mvvm.Input;
+using Serilog;
 using ZB.MOM.WW.OtOpcUa.Client.Shared;
 using ZB.MOM.WW.OtOpcUa.Client.Shared.Models;
 using ZB.MOM.WW.OtOpcUa.Client.UI.Services;
@@ -12,6 +13,8 @@ namespace ZB.MOM.WW.OtOpcUa.Client.UI.ViewModels;
 /// </summary>
 public partial class MainWindowViewModel : ObservableObject, IDisposable
 {
+    private static readonly ILogger Logger = Log.ForContext<MainWindowViewModel>();
+
     private readonly IUiDispatcher _dispatcher;
     private readonly IOpcUaClientServiceFactory _factory;
     private readonly ISettingsService _settingsService;
@@ -137,6 +140,15 @@ public partial class MainWindowViewModel : ObservableObject, IDisposable
         {
             if (args.PropertyName == nameof(AlarmsViewModel.ActiveAlarmCount))
                 _dispatcher.Post(() => ActiveAlarmCount = Alarms.ActiveAlarmCount);
+            else if (args.PropertyName == nameof(AlarmsViewModel.StatusMessage)
+                     && !string.IsNullOrEmpty(Alarms.StatusMessage))
+                _dispatcher.Post(() => StatusMessage = Alarms.StatusMessage!);
+        };
+        Subscriptions.PropertyChanged += (_, args) =>
+        {
+            if (args.PropertyName == nameof(SubscriptionsViewModel.StatusMessage)
+                && !string.IsNullOrEmpty(Subscriptions.StatusMessage))
+                _dispatcher.Post(() => StatusMessage = Subscriptions.StatusMessage!);
         };
         History = new HistoryViewModel(_service, _dispatcher);
 
@@ -244,15 +256,17 @@ public partial class MainWindowViewModel : ObservableObject, IDisposable
                 SessionLabel = $"{info.ServerName} | Session: {info.SessionName} ({info.SessionId})";
             });
 
-            // Load redundancy info
+            // Load redundancy info — the server may not implement the redundancy facet, in which
+            // case we leave RedundancyInfo null but log so a field diagnosis can tell the difference
+            // between "facet not advertised" and "facet errored". The connection itself stays up.
             try
             {
                 var redundancy = await _service!.GetRedundancyInfoAsync();
                 _dispatcher.Post(() => RedundancyInfo = redundancy);
             }
-            catch
+            catch (Exception redundancyEx)
             {
-                // Redundancy info not available
+                Logger.Information(redundancyEx, "GetRedundancyInfo unavailable on this server");
             }
 
             // Load root nodes

src/Client/ZB.MOM.WW.OtOpcUa.Client.UI/ViewModels/SubscriptionsViewModel.cs

@@ -2,6 +2,7 @@ using System.Collections.ObjectModel;
 using CommunityToolkit.Mvvm.ComponentModel;
 using CommunityToolkit.Mvvm.Input;
 using Opc.Ua;
+using Serilog;
 using ZB.MOM.WW.OtOpcUa.Client.Shared;
 using ZB.MOM.WW.OtOpcUa.Client.Shared.Models;
 using ZB.MOM.WW.OtOpcUa.Client.UI.Services;
@@ -13,9 +14,17 @@ namespace ZB.MOM.WW.OtOpcUa.Client.UI.ViewModels;
 /// </summary>
 public partial class SubscriptionsViewModel : ObservableObject
 {
+    private static readonly ILogger Logger = Log.ForContext<SubscriptionsViewModel>();
+
     private readonly IUiDispatcher _dispatcher;
     private readonly IOpcUaClientService _service;
 
+    /// <summary>
+    ///     Last user-visible status message — set when a subscribe/unsubscribe operation fails so the
+    ///     shell can surface the diagnostic instead of silently dropping the error. Cleared on success.
+    /// </summary>
+    [ObservableProperty] private string? _statusMessage;
+
     [ObservableProperty]
     [NotifyCanExecuteChangedFor(nameof(AddSubscriptionCommand))]
     [NotifyCanExecuteChangedFor(nameof(RemoveSubscriptionCommand))]
@@ -85,11 +94,13 @@ public partial class SubscriptionsViewModel : ObservableObject
             {
                 ActiveSubscriptions.Add(new SubscriptionItemViewModel(nodeIdStr, interval));
                 SubscriptionCount = ActiveSubscriptions.Count;
+                StatusMessage = null;
             });
         }
-        catch
+        catch (Exception ex)
         {
-            // Subscription failed; no item added
+            Logger.Warning(ex, "AddSubscription failed for {NodeId}", nodeIdStr);
+            _dispatcher.Post(() => StatusMessage = $"Subscribe failed for {nodeIdStr}: {ex.Message}");
         }
     }
 
@@ -116,9 +127,11 @@ public partial class SubscriptionsViewModel : ObservableObject
 
                 _dispatcher.Post(() => ActiveSubscriptions.Remove(item));
             }
-            catch
+            catch (Exception ex)
             {
-                // Unsubscribe failed for this item; continue with others
+                Logger.Warning(ex, "Unsubscribe failed for {NodeId}", item.NodeId);
+                _dispatcher.Post(() => StatusMessage = $"Unsubscribe failed for {item.NodeId}: {ex.Message}");
+                // Continue with the other items in the batch.
             }
         }
 
@@ -146,11 +159,13 @@ public partial class SubscriptionsViewModel : ObservableObject
             {
                 ActiveSubscriptions.Add(new SubscriptionItemViewModel(nodeIdStr, intervalMs));
                 SubscriptionCount = ActiveSubscriptions.Count;
+                StatusMessage = null;
             });
         }
-        catch
+        catch (Exception ex)
         {
-            // Subscription failed
+            Logger.Warning(ex, "AddSubscriptionForNode failed for {NodeId}", nodeIdStr);
+            _dispatcher.Post(() => StatusMessage = $"Subscribe failed for {nodeIdStr}: {ex.Message}");
         }
     }
 
@@ -186,9 +201,10 @@ public partial class SubscriptionsViewModel : ObservableObject
             foreach (var child in children)
                 await AddSubscriptionRecursiveAsync(child.NodeId, child.NodeClass, intervalMs, maxDepth, currentDepth + 1);
         }
-        catch
+        catch (Exception ex)
         {
-            // Browse failed for this node; skip it
+            Logger.Warning(ex, "Recursive browse failed for {NodeId}; skipping subtree", nodeIdStr);
+            _dispatcher.Post(() => StatusMessage = $"Browse failed for {nodeIdStr}: {ex.Message}");
         }
     }
 

src/Client/ZB.MOM.WW.OtOpcUa.Client.UI/Views/MainWindow.axaml

@@ -78,7 +78,7 @@
                                     <TextBox Text="{Binding CertificateStorePath}"
                                              Width="370"
                                              IsReadOnly="True"
-                                             Watermark="(default: AppData/LmxOpcUaClient/pki)" />
+                                             Watermark="(default: AppData/OtOpcUaClient/pki)" />
                                     <Button Name="BrowseCertPathButton"
                                             Content="..."
                                             Width="30"

src/Client/ZB.MOM.WW.OtOpcUa.Client.UI/Views/MainWindow.axaml.cs

@@ -2,6 +2,7 @@ using System.ComponentModel;
 using System.Reflection;
 using Avalonia.Controls;
 using Avalonia.Interactivity;
+using Avalonia.Platform.Storage;
 using SkiaSharp;
 using Svg.Skia;
 using ZB.MOM.WW.OtOpcUa.Client.UI.ViewModels;
@@ -126,15 +127,34 @@ public partial class MainWindow : Window
     {
         if (DataContext is not MainWindowViewModel vm) return;
 
-        var dialog = new OpenFolderDialog
+        var topLevel = TopLevel.GetTopLevel(this);
+        if (topLevel == null) return;
+
+        IStorageFolder? startLocation = null;
+        if (!string.IsNullOrEmpty(vm.CertificateStorePath))
+        {
+            try
+            {
+                startLocation = await topLevel.StorageProvider.TryGetFolderFromPathAsync(vm.CertificateStorePath);
+            }
+            catch
+            {
+                // Best-effort: if the existing path can't be resolved (missing/permission), open the dialog without it.
+            }
+        }
+
+        var folders = await topLevel.StorageProvider.OpenFolderPickerAsync(new FolderPickerOpenOptions
         {
             Title = "Select Certificate Store Folder",
-            Directory = vm.CertificateStorePath
-        };
+            AllowMultiple = false,
+            SuggestedStartLocation = startLocation
+        });
 
-        var result = await dialog.ShowAsync(this);
-        if (!string.IsNullOrEmpty(result))
-            vm.CertificateStorePath = result;
+        if (folders.Count == 0) return;
+
+        var picked = folders[0].TryGetLocalPath();
+        if (!string.IsNullOrEmpty(picked))
+            vm.CertificateStorePath = picked;
     }
 
     protected override void OnClosing(WindowClosingEventArgs e)

src/Client/ZB.MOM.WW.OtOpcUa.Client.UI/ZB.MOM.WW.OtOpcUa.Client.UI.csproj

@@ -19,6 +19,7 @@
         <PackageReference Include="CommunityToolkit.Mvvm" Version="8.4.0"/>
         <PackageReference Include="Serilog" Version="4.2.0"/>
         <PackageReference Include="Serilog.Sinks.Console" Version="6.0.0"/>
+        <PackageReference Include="Serilog.Sinks.File" Version="7.0.0"/>
     </ItemGroup>
 
     <ItemGroup>

src/Core/ZB.MOM.WW.OtOpcUa.Configuration/Apply/GenerationApplier.cs

@@ -19,6 +19,10 @@ public sealed class GenerationApplier(ApplyCallbacks callbacks) : IGenerationApp
 
         foreach (var kind in new[] { ChangeKind.Added, ChangeKind.Modified })
         {
+            // Honour cancellation between passes — a caller can abort the apply between Removed
+            // and Added phases even if individual callbacks don't observe the token themselves
+            // (Configuration-007).
+            ct.ThrowIfCancellationRequested();
             await ApplyPass(diff.Namespaces, kind, callbacks.OnNamespace, errors, ct);
             await ApplyPass(diff.Drivers, kind, callbacks.OnDriver, errors, ct);
             await ApplyPass(diff.Devices, kind, callbacks.OnDevice, errors, ct);
@@ -42,6 +46,12 @@ public sealed class GenerationApplier(ApplyCallbacks callbacks) : IGenerationApp
         foreach (var change in changes.Where(c => c.Kind == kind))
         {
             try { await callback(change, ct); }
+            // Configuration-007: cancellation must propagate, not be silently recorded as an
+            // entity error. Distinguish caller cancellation (token signalled) from any
+            // OperationCanceledException raised independently of the caller's token, which we
+            // still want to surface as an entity error so a single misbehaving callback does
+            // not crash the entire apply.
+            catch (OperationCanceledException) when (ct.IsCancellationRequested) { throw; }
             catch (Exception ex) { errors.Add($"{typeof(T).Name} {change.Kind} '{change.LogicalId}': {ex.Message}"); }
         }
     }

src/Core/ZB.MOM.WW.OtOpcUa.Configuration/Enums/NodePermissions.cs

@@ -5,7 +5,7 @@ namespace ZB.MOM.WW.OtOpcUa.Configuration.Enums;
 ///     Stored as <c>int</c> bitmask in <see cref="Entities.NodeAcl.PermissionFlags"/>.
 /// </summary>
 [Flags]
-public enum NodePermissions : uint
+public enum NodePermissions : int
 {
     None = 0,
 

src/Core/ZB.MOM.WW.OtOpcUa.Configuration/LocalCache/ILocalConfigCache.cs

@@ -4,6 +4,13 @@ namespace ZB.MOM.WW.OtOpcUa.Configuration.LocalCache;
 ///     Per-node local cache of the most-recently-applied generation(s). Used to bootstrap the
 ///     address space when the central DB is unreachable (decision #79 — degraded-but-running).
 /// </summary>
+/// <remarks>
+///     <para><b>Concurrency contract:</b> implementations must serialize writes — specifically,
+///     <see cref="PutAsync"/> for the same <c>(ClusterId, GenerationId)</c> from concurrent
+///     callers must not produce duplicate rows. Reads may run concurrently with reads and writes.
+///     The <see cref="LiteDbConfigCache"/> implementation enforces this via an instance-level
+///     <see cref="SemaphoreSlim"/> around the find-then-insert/update window.</para>
+/// </remarks>
 public interface ILocalConfigCache
 {
     Task<GenerationSnapshot?> GetMostRecentAsync(string clusterId, CancellationToken ct = default);

src/Core/ZB.MOM.WW.OtOpcUa.Configuration/LocalCache/LiteDbConfigCache.cs

@@ -13,6 +13,12 @@ public sealed class LiteDbConfigCache : ILocalConfigCache, IDisposable
     private const string CollectionName = "generations";
     private readonly LiteDatabase _db;
     private readonly ILiteCollection<GenerationSnapshot> _col;
+    // PutAsync is a find-then-insert/update; without serialization, two concurrent puts for the
+    // same (ClusterId, GenerationId) can both observe `existing is null` and both Insert,
+    // producing duplicate rows (Configuration-005). Serialize writes through this semaphore so
+    // the read-modify-write block is atomic for a given instance. LiteDB itself only locks the
+    // page-level write, not the find-then-insert window.
+    private readonly SemaphoreSlim _writeGate = new(initialCount: 1, maxCount: 1);
 
     public LiteDbConfigCache(string dbPath)
     {
@@ -47,23 +53,32 @@ public sealed class LiteDbConfigCache : ILocalConfigCache, IDisposable
         return Task.FromResult<GenerationSnapshot?>(snapshot);
     }
 
-    public Task PutAsync(GenerationSnapshot snapshot, CancellationToken ct = default)
+    public async Task PutAsync(GenerationSnapshot snapshot, CancellationToken ct = default)
     {
         ct.ThrowIfCancellationRequested();
-        // upsert by (ClusterId, GenerationId) — replace in place if already cached
-        var existing = _col
-            .Find(s => s.ClusterId == snapshot.ClusterId && s.GenerationId == snapshot.GenerationId)
-            .FirstOrDefault();
-
-        if (existing is null)
-            _col.Insert(snapshot);
-        else
+        // Serialize the find-then-insert/update so concurrent callers do not observe a stale
+        // `existing is null` and both Insert (Configuration-005). LiteDB's per-call lock is
+        // not enough — the read and the write are independent calls.
+        await _writeGate.WaitAsync(ct).ConfigureAwait(false);
+        try
         {
-            snapshot.Id = existing.Id;
-            _col.Update(snapshot);
-        }
+            // upsert by (ClusterId, GenerationId) — replace in place if already cached
+            var existing = _col
+                .Find(s => s.ClusterId == snapshot.ClusterId && s.GenerationId == snapshot.GenerationId)
+                .FirstOrDefault();
 
-        return Task.CompletedTask;
+            if (existing is null)
+                _col.Insert(snapshot);
+            else
+            {
+                snapshot.Id = existing.Id;
+                _col.Update(snapshot);
+            }
+        }
+        finally
+        {
+            _writeGate.Release();
+        }
     }
 
     public Task PruneOldGenerationsAsync(string clusterId, int keepLatest = 10, CancellationToken ct = default)
@@ -82,7 +97,11 @@ public sealed class LiteDbConfigCache : ILocalConfigCache, IDisposable
         return Task.CompletedTask;
     }
 
-    public void Dispose() => _db.Dispose();
+    public void Dispose()
+    {
+        _writeGate.Dispose();
+        _db.Dispose();
+    }
 }
 
 public sealed class LocalConfigCacheCorruptException(string message, Exception inner)

src/Core/ZB.MOM.WW.OtOpcUa.Configuration/LocalCache/ResilientConfigReader.cs

@@ -1,3 +1,4 @@
+using System.Text.RegularExpressions;
 using Microsoft.Extensions.Logging;
 using Polly;
 using Polly.Retry;
@@ -61,6 +62,23 @@ public sealed class ResilientConfigReader
         _pipeline = builder.Build();
     }
 
+    /// <summary>
+    ///     Configuration-010: redact connection-string fragments (Password, User Id, Pwd, etc.)
+    ///     that a caller's exception message could carry. Conservative regex pass — anything
+    ///     matching <c>Key=Value</c> with a known credential key gets its value replaced.
+    /// </summary>
+    private static readonly Regex SecretsRegex = new(
+        @"(?ix)\b(Password|Pwd|User\s*Id|Uid|AccessToken|Authorization|Api[-_]?Key)\s*=\s*[^;,)\s]*",
+        RegexOptions.Compiled);
+
+    internal static string ScrubSecrets(string? message)
+    {
+        if (string.IsNullOrEmpty(message)) return message ?? string.Empty;
+        // Replace the entire matched fragment (key + value) with a redaction marker so the
+        // key name itself doesn't leak — log scrapers grep for "Password=" too.
+        return SecretsRegex.Replace(message, "[redacted credential]");
+    }
+
     /// <summary>
     ///     Execute <paramref name="centralFetch"/> through the resilience pipeline. On full failure
     ///     (post-retry), reads the sealed cache for <paramref name="clusterId"/> and passes the
@@ -88,7 +106,15 @@ public sealed class ResilientConfigReader
         // that case, not propagate. Only rethrow if the caller actually requested cancellation.
         catch (Exception ex) when (ex is not OperationCanceledException || !cancellationToken.IsCancellationRequested)
         {
-            _logger.LogWarning(ex, "Central-DB read failed after retries; falling back to sealed cache for cluster {ClusterId}", clusterId);
+            // Configuration-010: do NOT pass the raw exception object — it carries the stack
+            // and inner-exception chain, and SqlException/wrapping delegates can surface
+            // connection-string fragments (Password=…, User Id=…) embedded in messages.
+            // Log only the exception type and a scrubbed message so secrets stay out of logs.
+            _logger.LogWarning(
+                "Central-DB read failed after retries ({ExceptionType}: {SanitizedMessage}); falling back to sealed cache for cluster {ClusterId}",
+                ex.GetType().Name,
+                ScrubSecrets(ex.Message),
+                clusterId);
             // GenerationCacheUnavailableException surfaces intentionally — fails the caller's
             // operation. StaleConfigFlag stays unchanged; the flag only flips when we actually
             // served a cache snapshot.

src/Core/ZB.MOM.WW.OtOpcUa.Core.Abstractions/DriverHealth.cs

@@ -6,7 +6,15 @@ namespace ZB.MOM.WW.OtOpcUa.Core.Abstractions;
 /// </summary>
 /// <param name="State">Current driver-instance state.</param>
 /// <param name="LastSuccessfulRead">Timestamp of the most recent successful equipment read; null if never.</param>
-/// <param name="LastError">Most recent error message; null when state is Healthy.</param>
+/// <param name="LastError">
+///     Most recent error message; null when no error has been recorded. The type makes no
+///     guarantee about correlation with <paramref name="State"/> — a driver in
+///     <see cref="DriverState.Healthy"/> may legitimately retain the last error from a recovered
+///     failure (useful for diagnostics), and <see cref="DriverState.Degraded"/> /
+///     <see cref="DriverState.Reconnecting"/> / <see cref="DriverState.Faulted"/> states may all
+///     carry a non-null message. Callers must not key behaviour on the LastError-null ↔ Healthy
+///     pairing (Core.Abstractions-008).
+/// </param>
 public sealed record DriverHealth(
     DriverState State,
     DateTime? LastSuccessfulRead,

src/Core/ZB.MOM.WW.OtOpcUa.Core.Abstractions/DriverTypeRegistry.cs

@@ -10,33 +10,46 @@ namespace ZB.MOM.WW.OtOpcUa.Core.Abstractions;
 ///     and #111 (driver type → namespace kind mapping enforced by sp_ValidateDraft).
 ///     The registry is the source of truth for both checks.
 ///
-///     Thread-safety: registration happens at startup (single thread); lookups happen on every
-///     config-apply (multi-threaded). The internal dictionary is replaced atomically via
-///     <see cref="System.Threading.Interlocked"/> on register; readers see a stable snapshot.
+///     Thread-safety: registration is typically single-threaded at startup; lookups happen on
+///     every config-apply (multi-threaded). The check-then-act inside <see cref="Register"/> is
+///     guarded by a private lock so concurrent registrations are atomic — the "registered only
+///     once per process" guarantee holds even if two callers race. Readers operate against the
+///     volatile snapshot reference produced by the last successful <see cref="Register"/> and
+///     never block.
 /// </remarks>
 public sealed class DriverTypeRegistry
 {
+    private readonly Lock _writeLock = new();
+
     private IReadOnlyDictionary<string, DriverTypeMetadata> _types =
         new Dictionary<string, DriverTypeMetadata>(StringComparer.OrdinalIgnoreCase);
 
     /// <summary>Register a driver type. Throws if the type name is already registered.</summary>
+    /// <remarks>
+    ///     The check-then-act (duplicate check → copy-on-write rebuild → swap) is performed under
+    ///     <see cref="_writeLock"/> so concurrent <see cref="Register"/> calls cannot silently
+    ///     discard each other's registrations — see Core.Abstractions-004.
+    /// </remarks>
     public void Register(DriverTypeMetadata metadata)
     {
         ArgumentNullException.ThrowIfNull(metadata);
 
-        var snapshot = _types;
-        if (snapshot.ContainsKey(metadata.TypeName))
+        lock (_writeLock)
         {
-            throw new InvalidOperationException(
-                $"Driver type '{metadata.TypeName}' is already registered. " +
-                $"Each driver type may be registered only once per process.");
-        }
+            var snapshot = _types;
+            if (snapshot.ContainsKey(metadata.TypeName))
+            {
+                throw new InvalidOperationException(
+                    $"Driver type '{metadata.TypeName}' is already registered. " +
+                    $"Each driver type may be registered only once per process.");
+            }
 
-        var next = new Dictionary<string, DriverTypeMetadata>(snapshot, StringComparer.OrdinalIgnoreCase)
-        {
-            [metadata.TypeName] = metadata,
-        };
-        Interlocked.Exchange(ref _types, next);
+            var next = new Dictionary<string, DriverTypeMetadata>(snapshot, StringComparer.OrdinalIgnoreCase)
+            {
+                [metadata.TypeName] = metadata,
+            };
+            _types = next;
+        }
     }
 
     /// <summary>Look up a driver type by name. Throws if unknown.</summary>

src/Core/ZB.MOM.WW.OtOpcUa.Core.Abstractions/Historian/IHistorianDataSource.cs

@@ -59,6 +59,21 @@ public interface IHistorianDataSource : IDisposable
     ///     Distinct from any live event stream; sources here come from the historian's
     ///     event log. <paramref name="sourceName"/> is null to return all sources.
     /// </summary>
+    /// <remarks>
+    ///     Note on parameter types — <paramref name="maxEvents"/> is <see cref="int"/> (not
+    ///     <see cref="uint"/>) so callers can pass <c>0</c> or a negative value as a "use the
+    ///     backend's default cap" sentinel; see <c>WonderwareHistorianClient</c> /
+    ///     <c>HistorianDataSource</c> and Core.Abstractions-006 for the rationale. The sibling
+    ///     <see cref="ReadRawAsync"/> / <see cref="ReadProcessedAsync"/> use
+    ///     <c>uint maxValuesPerNode</c> because their OPC UA HistoryRead surface has no
+    ///     equivalent "use default" sentinel.
+    ///
+    ///     This surface declares <see cref="ReadAtTimeAsync"/> and <see cref="ReadEventsAsync"/>
+    ///     as required members — a server-side historian owns the full read surface, unlike
+    ///     <see cref="IHistoryProvider"/> where the same two methods are optional default-impl
+    ///     methods so legacy drivers can stay raw-only. The asymmetry is intentional
+    ///     (Core.Abstractions-008).
+    /// </remarks>
     Task<HistoricalEventsResult> ReadEventsAsync(
         string? sourceName,
         DateTime startUtc,

src/Core/ZB.MOM.WW.OtOpcUa.Core.Abstractions/IHistoryProvider.cs

@@ -6,6 +6,14 @@ namespace ZB.MOM.WW.OtOpcUa.Core.Abstractions;
 ///     Galaxy (Wonderware Historian via the optional plugin), OPC UA Client (forward
 ///     to upstream server).
 /// </summary>
+/// <remarks>
+///     <see cref="ReadAtTimeAsync"/> and <see cref="ReadEventsAsync"/> are C# default interface
+///     methods that throw <see cref="NotSupportedException"/> — drivers opt in by overriding so
+///     a raw-only driver compiles without forcing it to provide at-time / event surfaces it
+///     has no backend for. The sibling server-side surface, <see cref="IHistorianDataSource"/>,
+///     declares both methods as required because a registered historian owns the full read
+///     surface; the asymmetry is intentional (Core.Abstractions-008).
+/// </remarks>
 public interface IHistoryProvider
 {
     /// <summary>
@@ -60,12 +68,24 @@ public interface IHistoryProvider
     /// </param>
     /// <param name="startUtc">Inclusive lower bound on <c>EventTimeUtc</c>.</param>
     /// <param name="endUtc">Exclusive upper bound on <c>EventTimeUtc</c>.</param>
-    /// <param name="maxEvents">Upper cap on returned events — the driver's backend enforces this.</param>
+    /// <param name="maxEvents">
+    ///     Upper cap on returned events — the driver's backend enforces this. The type is
+    ///     <see cref="int"/> rather than <see cref="uint"/> (which the sibling raw / processed
+    ///     reads use for <c>maxValuesPerNode</c>) because callers and downstream historian
+    ///     adapters historically treat <c>maxEvents &lt;= 0</c> as a sentinel meaning
+    ///     "use the backend's default cap" (see <c>WonderwareHistorianClient</c> /
+    ///     <c>HistorianDataSource</c>). The asymmetry is intentional — Core.Abstractions-006.
+    /// </param>
     /// <param name="cancellationToken">Request cancellation.</param>
     /// <remarks>
     ///     Default implementation throws. Only drivers with an event historian (Galaxy via the
     ///     Wonderware Alarm &amp; Events log) override. Modbus / the OPC UA Client driver stay
     ///     with the default and let callers see <c>BadHistoryOperationUnsupported</c>.
+    ///
+    ///     Note the type asymmetry with <see cref="ReadRawAsync"/> /
+    ///     <see cref="ReadProcessedAsync"/> (both use <c>uint maxValuesPerNode</c>): event
+    ///     readers accept a signed <c>int maxEvents</c> so callers can pass 0 / negative as a
+    ///     "use default cap" sentinel without an extra parameter or overload.
     /// </remarks>
     Task<HistoricalEventsResult> ReadEventsAsync(
         string? sourceName,

src/Core/ZB.MOM.WW.OtOpcUa.Core.Abstractions/PollGroupEngine.cs

@@ -19,14 +19,21 @@ namespace ZB.MOM.WW.OtOpcUa.Core.Abstractions;
 ///     from the previously-seen snapshot.</para>
 ///
 ///     <para>Exceptions thrown by the reader on the initial poll or any subsequent poll are
-///     swallowed — the loop continues on the next tick. The driver's own health surface is
-///     where transient poll failures should be reported; the engine intentionally does not
-///     double-book that responsibility.</para>
+///     caught — the loop continues on the next tick. When an <c>onError</c> callback is supplied
+///     to the constructor the caught exception is routed to it so the driver's health surface
+///     can record the failure. Without an <c>onError</c> callback the exception is silently
+///     swallowed (preserves the original behaviour for drivers that have not opted in yet).</para>
+///
+///     <para>Programmer errors and obviously-fatal exceptions (<see cref="OutOfMemoryException"/>,
+///     <see cref="ThreadAbortException"/>, <see cref="StackOverflowException"/>,
+///     <see cref="AccessViolationException"/>) are NOT caught — they propagate and tear the poll
+///     loop down rather than spin a silently-broken subscription.</para>
 /// </remarks>
 public sealed class PollGroupEngine : IAsyncDisposable
 {
     private readonly Func<IReadOnlyList<string>, CancellationToken, Task<IReadOnlyList<DataValueSnapshot>>> _reader;
     private readonly Action<ISubscriptionHandle, string, DataValueSnapshot> _onChange;
+    private readonly Action<Exception>? _onError;
     private readonly TimeSpan _minInterval;
     private readonly ConcurrentDictionary<long, SubscriptionState> _subscriptions = new();
     private long _nextId;
@@ -40,15 +47,21 @@ public sealed class PollGroupEngine : IAsyncDisposable
     ///     <see cref="ISubscribable.OnDataChange"/> event.</param>
     /// <param name="minInterval">Interval floor; anything below is clamped. Defaults to 100 ms
     ///     per <see cref="DefaultMinInterval"/>.</param>
+    /// <param name="onError">Optional error sink — invoked once per caught reader exception (or
+    ///     internal contract-violation throw) so the owning driver can route the failure to its
+    ///     health surface (Core.Abstractions-005). Defensive: an <c>onError</c> handler that
+    ///     itself throws is silently absorbed so a buggy forwarder cannot crash the poll loop.</param>
     public PollGroupEngine(
         Func<IReadOnlyList<string>, CancellationToken, Task<IReadOnlyList<DataValueSnapshot>>> reader,
         Action<ISubscriptionHandle, string, DataValueSnapshot> onChange,
-        TimeSpan? minInterval = null)
+        TimeSpan? minInterval = null,
+        Action<Exception>? onError = null)
     {
         ArgumentNullException.ThrowIfNull(reader);
         ArgumentNullException.ThrowIfNull(onChange);
         _reader = reader;
         _onChange = onChange;
+        _onError = onError;
         _minInterval = minInterval ?? DefaultMinInterval;
     }
 
@@ -102,19 +115,54 @@ public sealed class PollGroupEngine : IAsyncDisposable
         // whether it has changed, satisfying OPC UA Part 4 initial-value semantics.
         try { await PollOnceAsync(state, forceRaise: true, ct).ConfigureAwait(false); }
         catch (OperationCanceledException) { return; }
-        catch { /* first-read error tolerated — loop continues */ }
+        catch (Exception ex) when (!IsFatal(ex))
+        {
+            // first-read error tolerated — loop continues; forward to driver health surface.
+            ReportError(ex);
+        }
 
         while (!ct.IsCancellationRequested)
         {
             try { await Task.Delay(state.Interval, ct).ConfigureAwait(false); }
             catch (OperationCanceledException) { return; }
+            // Defensive: the CTS may be disposed by Unsubscribe/DisposeAsync between the
+            // cancellation check above and the Task.Delay touching the token. Treat that race
+            // as a normal cancellation rather than a fatal exception.
+            catch (ObjectDisposedException) { return; }
 
             try { await PollOnceAsync(state, forceRaise: false, ct).ConfigureAwait(false); }
             catch (OperationCanceledException) { return; }
-            catch { /* transient poll error — loop continues, driver health surface logs it */ }
+            catch (Exception ex) when (!IsFatal(ex))
+            {
+                // transient poll error — loop continues, driver health surface logs it
+                // via the supplied onError callback (Core.Abstractions-005).
+                ReportError(ex);
+            }
         }
     }
 
+    /// <summary>
+    ///     Programmer-error / process-fatal exception classification: anything that cannot be
+    ///     safely "swallowed and retry on the next tick" must escape the poll loop instead.
+    /// </summary>
+    private static bool IsFatal(Exception ex)
+        => ex is OutOfMemoryException
+            or StackOverflowException
+            or AccessViolationException
+            or ThreadAbortException;
+
+    /// <summary>
+    ///     Forward a caught exception to the optional <c>onError</c> callback. Defensive
+    ///     against an <c>onError</c> implementation that itself throws — that would crash the
+    ///     poll loop and re-introduce the silent-stall failure mode this method exists to prevent.
+    /// </summary>
+    private void ReportError(Exception ex)
+    {
+        if (_onError is null) return;
+        try { _onError(ex); }
+        catch { /* never let a buggy error sink stop the poll loop */ }
+    }
+
     private async Task PollOnceAsync(SubscriptionState state, bool forceRaise, CancellationToken ct)
     {
         var snapshots = await _reader(state.TagReferences, ct).ConfigureAwait(false);

src/Core/ZB.MOM.WW.OtOpcUa.Core.AlarmHistorian/SqliteStoreAndForwardSink.cs

@@ -87,6 +87,25 @@ public sealed class SqliteStoreAndForwardSink : IAlarmHistorianSink, IDisposable
     // having to scrape the WARN log.
     private long _evictedCount;
 
+    // Core.AlarmHistorian-008: keep an approximate in-memory count of non-dead-lettered
+    // rows so EnqueueAsync does not need to run a SELECT COUNT(*) on every call. The
+    // counter is seeded from storage at construction, kept current by every mutation
+    // (Enqueue, Drain, RetryDeadLettered, PurgeAgedDeadLetters, EnforceCapacity), and
+    // periodically re-synced from storage as a safety net against drift.
+    // Mutations cross threads (EnqueueAsync is called from the emitting thread, drain
+    // runs on the timer / drain thread) so it is updated via Interlocked.
+    private long _queuedRowCount;
+    // Probe counter — incremented every time we actually issue a real COUNT(*) for
+    // capacity enforcement. Public for test instrumentation only.
+    private long _capacityProbeCount;
+    // After every Nth enqueue we resync the in-memory counter from storage to defend
+    // against silent drift (e.g. an external process editing the DB).
+    private const long ResyncEnqueueInterval = 10_000;
+    private long _enqueuesSinceResync;
+
+    /// <summary>Test-only: number of times the perf-optimised path fell through to a real <c>COUNT(*)</c>.</summary>
+    public long DebugCapacityProbeCount => Interlocked.Read(ref _capacityProbeCount);
+
     public SqliteStoreAndForwardSink(
         string databasePath,
         IAlarmHistorianWriter writer,
@@ -115,6 +134,9 @@ public sealed class SqliteStoreAndForwardSink : IAlarmHistorianSink, IDisposable
         }.ToString();
 
         InitializeSchema();
+        // Core.AlarmHistorian-008: seed the in-memory counter from storage so the
+        // perf-optimised EnqueueAsync path starts in sync with what's on disk.
+        _queuedRowCount = ProbeQueuedRowCount();
     }
 
     /// <summary>
@@ -223,7 +245,11 @@ public sealed class SqliteStoreAndForwardSink : IAlarmHistorianSink, IDisposable
         await conn.OpenAsync(cancellationToken).ConfigureAwait(false);
         await ApplyPragmasAsync(conn, cancellationToken).ConfigureAwait(false);
 
-        await EnforceCapacityAsync(conn, cancellationToken).ConfigureAwait(false);
+        // Core.AlarmHistorian-008: use the in-memory counter to short-circuit the
+        // capacity check on every enqueue. The bare hot path is now one INSERT — no
+        // SELECT COUNT(*). We fall back to a real probe only when the cached counter
+        // says we're at or above capacity, or periodically to defend against drift.
+        await EnforceCapacityFastPathAsync(conn, cancellationToken).ConfigureAwait(false);
 
         using var cmd = conn.CreateCommand();
         cmd.CommandText = """
@@ -234,6 +260,57 @@ public sealed class SqliteStoreAndForwardSink : IAlarmHistorianSink, IDisposable
         cmd.Parameters.AddWithValue("$enqueued", _clock().ToString("O"));
         cmd.Parameters.AddWithValue("$payload", JsonSerializer.Serialize(evt));
         await cmd.ExecuteNonQueryAsync(cancellationToken).ConfigureAwait(false);
+
+        Interlocked.Increment(ref _queuedRowCount);
+    }
+
+    /// <summary>
+    ///     Capacity enforcement on the hot enqueue path: consults the in-memory counter
+    ///     first and only probes storage with a real <c>COUNT(*)</c> when (a) the
+    ///     cached value indicates the capacity wall is in reach, or (b) the periodic
+    ///     resync interval has elapsed. The actual eviction (when over capacity) goes
+    ///     through <see cref="EnforceCapacityAsync"/> which still runs a precise
+    ///     COUNT to compute the exact number of rows to evict.
+    /// </summary>
+    private async Task EnforceCapacityFastPathAsync(SqliteConnection conn, CancellationToken ct)
+    {
+        var enqueuesSinceResync = Interlocked.Increment(ref _enqueuesSinceResync);
+        var cached = Interlocked.Read(ref _queuedRowCount);
+
+        // Periodic resync — bounded amount of drift even under exotic conditions.
+        if (enqueuesSinceResync >= ResyncEnqueueInterval)
+        {
+            await ResyncQueuedRowCountAsync(conn, ct).ConfigureAwait(false);
+            cached = Interlocked.Read(ref _queuedRowCount);
+            Interlocked.Exchange(ref _enqueuesSinceResync, 0);
+        }
+
+        // Below capacity per the cached counter — skip the COUNT(*) entirely.
+        if (cached < _capacity) return;
+
+        // Cached counter says we're at or above the capacity wall — fall back to the
+        // precise path which probes COUNT(*) and evicts whatever's needed.
+        await EnforceCapacityAsync(conn, ct).ConfigureAwait(false);
+    }
+
+    /// <summary>Synchronously query <c>COUNT(*)</c> of non-dead-lettered rows. Used at startup.</summary>
+    private long ProbeQueuedRowCount()
+    {
+        Interlocked.Increment(ref _capacityProbeCount);
+        using var conn = OpenConnection();
+        using var cmd = conn.CreateCommand();
+        cmd.CommandText = "SELECT COUNT(*) FROM Queue WHERE DeadLettered = 0";
+        return (long)(cmd.ExecuteScalar() ?? 0L);
+    }
+
+    /// <summary>Re-sync the in-memory counter from storage (async path).</summary>
+    private async Task ResyncQueuedRowCountAsync(SqliteConnection conn, CancellationToken ct)
+    {
+        Interlocked.Increment(ref _capacityProbeCount);
+        using var cmd = conn.CreateCommand();
+        cmd.CommandText = "SELECT COUNT(*) FROM Queue WHERE DeadLettered = 0";
+        var live = (long)(await cmd.ExecuteScalarAsync(ct).ConfigureAwait(false) ?? 0L);
+        Interlocked.Exchange(ref _queuedRowCount, live);
     }
 
     /// <summary>
@@ -242,6 +319,12 @@ public sealed class SqliteStoreAndForwardSink : IAlarmHistorianSink, IDisposable
     ///     on RetryPlease. Safe to call from multiple threads; the semaphore enforces
     ///     serial execution.
     /// </summary>
+    /// <remarks>
+    ///     Core.AlarmHistorian-008: every per-tick SQLite operation runs through a
+    ///     single shared connection (purge, read, corrupt-row dead-letter, and the
+    ///     outcome-applying transaction). Pre-fix the drain opened three independent
+    ///     connections per tick, each paying the open + PRAGMA cost.
+    /// </remarks>
     public async Task DrainOnceAsync(CancellationToken ct)
     {
         if (_disposed) return;
@@ -254,8 +337,12 @@ public sealed class SqliteStoreAndForwardSink : IAlarmHistorianSink, IDisposable
                 _lastDrainUtc = _clock();
             }
 
-            PurgeAgedDeadLetters();
-            var batch = ReadBatch();
+            // One connection per drain tick — used by purge, read, corrupt-dead-letter,
+            // and the outcome-applying transaction.
+            using var conn = OpenConnection();
+
+            PurgeAgedDeadLetters(conn);
+            var batch = ReadBatch(conn);
             if (batch.Count == 0)
             {
                 lock (_statusLock) { _drainState = HistorianDrainState.Idle; }
@@ -271,11 +358,13 @@ public sealed class SqliteStoreAndForwardSink : IAlarmHistorianSink, IDisposable
 
             if (corruptRowIds.Count > 0)
             {
-                using var corruptConn = OpenConnection();
-                using var corruptTx = corruptConn.BeginTransaction();
+                using var corruptTx = conn.BeginTransaction();
                 foreach (var rowId in corruptRowIds)
-                    DeadLetterRow(corruptConn, corruptTx, rowId, $"corrupt payload at {_clock():O}");
+                    DeadLetterRow(conn, corruptTx, rowId, $"corrupt payload at {_clock():O}");
                 corruptTx.Commit();
+                // Each corrupt row leaves the non-dead-lettered queue — bookkeeping for
+                // the in-memory counter (Core.AlarmHistorian-008).
+                Interlocked.Add(ref _queuedRowCount, -corruptRowIds.Count);
                 _logger.Warning(
                     "Dead-lettered {Count} historian queue row(s) with un-deserializable payload",
                     corruptRowIds.Count);
@@ -330,26 +419,34 @@ public sealed class SqliteStoreAndForwardSink : IAlarmHistorianSink, IDisposable
                 return;
             }
 
-            using var conn = OpenConnection();
-            using var tx = conn.BeginTransaction();
-            for (var i = 0; i < outcomes.Count; i++)
+            int rowsLeavingQueue = 0;
+            using (var tx = conn.BeginTransaction())
             {
-                var outcome = outcomes[i];
-                var rowId = liveRows[i].RowId;
-                switch (outcome)
+                for (var i = 0; i < outcomes.Count; i++)
                 {
-                    case HistorianWriteOutcome.Ack:
-                        DeleteRow(conn, tx, rowId);
-                        break;
-                    case HistorianWriteOutcome.PermanentFail:
-                        DeadLetterRow(conn, tx, rowId, $"permanent fail at {_clock():O}");
-                        break;
-                    case HistorianWriteOutcome.RetryPlease:
-                        BumpAttempt(conn, tx, rowId, "retry-please");
-                        break;
+                    var outcome = outcomes[i];
+                    var rowId = liveRows[i].RowId;
+                    switch (outcome)
+                    {
+                        case HistorianWriteOutcome.Ack:
+                            DeleteRow(conn, tx, rowId);
+                            rowsLeavingQueue++;
+                            break;
+                        case HistorianWriteOutcome.PermanentFail:
+                            DeadLetterRow(conn, tx, rowId, $"permanent fail at {_clock():O}");
+                            rowsLeavingQueue++;
+                            break;
+                        case HistorianWriteOutcome.RetryPlease:
+                            BumpAttempt(conn, tx, rowId, "retry-please");
+                            break;
+                    }
                 }
+                tx.Commit();
             }
-            tx.Commit();
+            // Ack-deleted + PermanentFail-dead-lettered rows both leave the
+            // non-dead-lettered queue — keep the counter aligned (Core.AlarmHistorian-008).
+            if (rowsLeavingQueue > 0)
+                Interlocked.Add(ref _queuedRowCount, -rowsLeavingQueue);
 
             var acks = outcomes.Count(o => o == HistorianWriteOutcome.Ack);
             lock (_statusLock)
@@ -375,15 +472,15 @@ public sealed class SqliteStoreAndForwardSink : IAlarmHistorianSink, IDisposable
 
     public HistorianSinkStatus GetStatus()
     {
-        using var conn = OpenConnection();
+        // Core.AlarmHistorian-008: read the non-dead-lettered count from the in-memory
+        // counter so a busy Admin UI / health probe does not hammer the DB. Dead-letter
+        // depth is rare-path only (it lives in the queue until retention) so a real
+        // COUNT(*) on a single combined connection is fine.
+        var queued = Interlocked.Read(ref _queuedRowCount);
+        if (queued < 0) queued = 0;
 
-        long queued;
         long deadlettered;
-        using (var cmd = conn.CreateCommand())
-        {
-            cmd.CommandText = "SELECT COUNT(*) FROM Queue WHERE DeadLettered = 0";
-            queued = (long)(cmd.ExecuteScalar() ?? 0L);
-        }
+        using (var conn = OpenConnection())
         using (var cmd = conn.CreateCommand())
         {
             cmd.CommandText = "SELECT COUNT(*) FROM Queue WHERE DeadLettered = 1";
@@ -421,7 +518,11 @@ public sealed class SqliteStoreAndForwardSink : IAlarmHistorianSink, IDisposable
         using var conn = OpenConnection();
         using var cmd = conn.CreateCommand();
         cmd.CommandText = "UPDATE Queue SET DeadLettered = 0, AttemptCount = 0, LastError = NULL WHERE DeadLettered = 1";
-        return cmd.ExecuteNonQuery();
+        var revived = cmd.ExecuteNonQuery();
+        // Dead-lettered rows rejoin the non-dead-lettered queue — keep the in-memory
+        // counter aligned (Core.AlarmHistorian-008).
+        if (revived > 0) Interlocked.Add(ref _queuedRowCount, revived);
+        return revived;
     }
 
     /// <summary>
@@ -432,10 +533,9 @@ public sealed class SqliteStoreAndForwardSink : IAlarmHistorianSink, IDisposable
     /// </summary>
     private readonly record struct QueueRow(long RowId, AlarmHistorianEvent? Event);
 
-    private List<QueueRow> ReadBatch()
+    private List<QueueRow> ReadBatch(SqliteConnection conn)
     {
         var rows = new List<QueueRow>();
-        using var conn = OpenConnection();
         using var cmd = conn.CreateCommand();
         cmd.CommandText = """
             SELECT RowId, PayloadJson FROM Queue
@@ -501,50 +601,21 @@ public sealed class SqliteStoreAndForwardSink : IAlarmHistorianSink, IDisposable
         cmd.ExecuteNonQuery();
     }
 
-    private void EnforceCapacity(SqliteConnection conn)
-    {
-        // Count non-dead-lettered rows only — dead-lettered rows retain for
-        // post-mortem per the configured retention window.
-        long count;
-        using (var cmd = conn.CreateCommand())
-        {
-            cmd.CommandText = "SELECT COUNT(*) FROM Queue WHERE DeadLettered = 0";
-            count = (long)(cmd.ExecuteScalar() ?? 0L);
-        }
-        if (count < _capacity) return;
-
-        var toEvict = count - _capacity + 1;
-        using (var cmd = conn.CreateCommand())
-        {
-            cmd.CommandText = """
-                DELETE FROM Queue
-                WHERE RowId IN (
-                    SELECT RowId FROM Queue
-                    WHERE DeadLettered = 0
-                    ORDER BY RowId ASC
-                    LIMIT $n
-                )
-                """;
-            cmd.Parameters.AddWithValue("$n", toEvict);
-            cmd.ExecuteNonQuery();
-        }
-        // Core.AlarmHistorian-009: increment the lifetime eviction counter so the
-        // Admin UI / health check can report overflow without requiring log scraping.
-        lock (_statusLock) { _evictedCount += toEvict; }
-        _logger.Warning(
-            "Historian queue at capacity {Cap} — evicted {Count} oldest row(s) to make room (lifetime evictions: {Total})",
-            _capacity, toEvict, _evictedCount);
-    }
-
     // Async variant used by EnqueueAsync (Core.AlarmHistorian-003).
+    // Core.AlarmHistorian-008: the precise path — runs COUNT(*) to compute the exact
+    // number of rows to evict. Reached only from the fast-path fallback when the
+    // in-memory counter says we are at or above capacity.
     private async Task EnforceCapacityAsync(SqliteConnection conn, CancellationToken ct)
     {
+        Interlocked.Increment(ref _capacityProbeCount);
         long count;
         using (var cmd = conn.CreateCommand())
         {
             cmd.CommandText = "SELECT COUNT(*) FROM Queue WHERE DeadLettered = 0";
             count = (long)(await cmd.ExecuteScalarAsync(ct).ConfigureAwait(false) ?? 0L);
         }
+        // Resync the in-memory counter while we have a fresh number.
+        Interlocked.Exchange(ref _queuedRowCount, count);
         if (count < _capacity) return;
 
         var toEvict = count - _capacity + 1;
@@ -562,16 +633,16 @@ public sealed class SqliteStoreAndForwardSink : IAlarmHistorianSink, IDisposable
             cmd.Parameters.AddWithValue("$n", toEvict);
             await cmd.ExecuteNonQueryAsync(ct).ConfigureAwait(false);
         }
+        Interlocked.Add(ref _queuedRowCount, -toEvict);
         lock (_statusLock) { _evictedCount += toEvict; }
         _logger.Warning(
             "Historian queue at capacity {Cap} — evicted {Count} oldest row(s) to make room (lifetime evictions: {Total})",
             _capacity, toEvict, _evictedCount);
     }
 
-    private void PurgeAgedDeadLetters()
+    private void PurgeAgedDeadLetters(SqliteConnection conn)
     {
         var cutoff = (_clock() - _deadLetterRetention).ToString("O");
-        using var conn = OpenConnection();
         using var cmd = conn.CreateCommand();
         cmd.CommandText = """
             DELETE FROM Queue

src/Core/ZB.MOM.WW.OtOpcUa.Core.ScriptedAlarms/AlarmConditionState.cs

@@ -1,3 +1,5 @@
+using System.Collections.Immutable;
+
 namespace ZB.MOM.WW.OtOpcUa.Core.ScriptedAlarms;
 
 /// <summary>
@@ -17,7 +19,10 @@ namespace ZB.MOM.WW.OtOpcUa.Core.ScriptedAlarms;
 ///     <para>
 ///         <see cref="Comments"/> is append-only; comments + ack/confirm user identities
 ///         are the audit surface regulators consume. The engine never rewrites past
-///         entries.
+///         entries. The runtime type is <see cref="ImmutableList{AlarmComment}"/> so
+///         each append is O(log n) rather than the O(n) copy a plain
+///         <c>IReadOnlyList&lt;AlarmComment&gt;</c> would force on every audit-producing
+///         transition. (Core.ScriptedAlarms-008)
 ///     </para>
 /// </remarks>
 public sealed record AlarmConditionState(
@@ -36,7 +41,7 @@ public sealed record AlarmConditionState(
     DateTime? LastConfirmUtc,
     string? LastConfirmUser,
     string? LastConfirmComment,
-    IReadOnlyList<AlarmComment> Comments)
+    ImmutableList<AlarmComment> Comments)
 {
     /// <summary>Initial-load state for a newly registered alarm — everything in the "no-event" position.</summary>
     public static AlarmConditionState Fresh(string alarmId, DateTime nowUtc) => new(
@@ -55,7 +60,7 @@ public sealed record AlarmConditionState(
         LastConfirmUtc: null,
         LastConfirmUser: null,
         LastConfirmComment: null,
-        Comments: []);
+        Comments: ImmutableList<AlarmComment>.Empty);
 }
 
 /// <summary>

src/Core/ZB.MOM.WW.OtOpcUa.Core.ScriptedAlarms/MessageTemplate.cs

@@ -33,6 +33,16 @@ public static class MessageTemplate
     ///     has a non-Good <see cref="DataValueSnapshot.StatusCode"/> or a null
     ///     <see cref="DataValueSnapshot.Value"/> resolve to <c>{?}</c>.
     /// </summary>
+    /// <remarks>
+    ///     Quality bar is intentionally <em>stricter</em> than predicate evaluation:
+    ///     only Good (StatusCode == 0) is substituted; Uncertain renders as
+    ///     <c>{?}</c>. The predicate gate (<c>ScriptedAlarmEngine.AreInputsReady</c>)
+    ///     accepts Uncertain because it still carries a value the predicate can
+    ///     inspect, but the operator-facing message must make doubt explicit rather
+    ///     than substituting a value an operator might act on. See the
+    ///     "Input-quality policy" section in <c>docs/ScriptedAlarms.md</c>.
+    ///     (Core.ScriptedAlarms-010)
+    /// </remarks>
     public static string Resolve(string template, Func<string, DataValueSnapshot?> resolveTag)
     {
         if (string.IsNullOrEmpty(template)) return template ?? string.Empty;

src/Core/ZB.MOM.WW.OtOpcUa.Core.ScriptedAlarms/Part9StateMachine.cs

@@ -1,3 +1,5 @@
+using System.Collections.Immutable;
+
 namespace ZB.MOM.WW.OtOpcUa.Core.ScriptedAlarms;
 
 /// <summary>
@@ -258,21 +260,33 @@ public static class Part9StateMachine
         return s.UnshelveAtUtc is DateTime t && nowUtc >= t ? ShelvingState.Unshelved : s;
     }
 
-    private static IReadOnlyList<AlarmComment> AppendComment(
-        IReadOnlyList<AlarmComment> existing, DateTime ts, string user, string kind, string? text)
-    {
-        var list = new List<AlarmComment>(existing.Count + 1);
-        list.AddRange(existing);
-        list.Add(new AlarmComment(ts, user, kind, text ?? string.Empty));
-        return list;
-    }
+    private static ImmutableList<AlarmComment> AppendComment(
+        ImmutableList<AlarmComment> existing, DateTime ts, string user, string kind, string? text)
+        => existing.Add(new AlarmComment(ts, user, kind, text ?? string.Empty));
 }
 
 /// <summary>Result of a state-machine operation — new state + what to emit (if anything).</summary>
-public sealed record TransitionResult(AlarmConditionState State, EmissionKind Emission)
+/// <remarks>
+///     <para>
+///         <see cref="NoOpReason"/> carries a short diagnostic string for the
+///         <see cref="NoOp(AlarmConditionState, string)"/> case (e.g.
+///         "disabled — predicate result ignored", "already acknowledged"). The
+///         engine logs this at debug level when a no-op result is observed, so
+///         the class-level remarks on <see cref="Part9StateMachine"/> hold:
+///         disabled-alarm and idempotent ack/confirm/shelve/unshelve
+///         transitions do produce a diagnostic log line. Plain
+///         <see cref="None(AlarmConditionState)"/> results (state unchanged,
+///         no operator intent recorded — e.g. a predicate re-evaluation that
+///         confirms the existing active state) leave <see cref="NoOpReason"/>
+///         null because there is nothing to surface to an operator.
+///         (Core.ScriptedAlarms-011)
+///     </para>
+/// </remarks>
+public sealed record TransitionResult(AlarmConditionState State, EmissionKind Emission, string? NoOpReason = null)
 {
     public static TransitionResult None(AlarmConditionState state) => new(state, EmissionKind.None);
-    public static TransitionResult NoOp(AlarmConditionState state, string reason) => new(state, EmissionKind.None);
+    public static TransitionResult NoOp(AlarmConditionState state, string reason)
+        => new(state, EmissionKind.None, reason);
 }
 
 /// <summary>What kind of event, if any, the engine should emit after a transition.</summary>

src/Core/ZB.MOM.WW.OtOpcUa.Core.ScriptedAlarms/ScriptedAlarmEngine.cs

@@ -59,6 +59,15 @@ public sealed class ScriptedAlarmEngine : IDisposable
     private bool _loaded;
     private bool _disposed;
 
+    // Tracks fire-and-forget background work launched by OnUpstreamChange
+    // (ReevaluateAsync) and RunShelvingCheck (ShelvingCheckAsync). Dispose drains
+    // these so a re-evaluation in flight when shutdown begins finishes its
+    // SaveAsync before the engine returns control to the caller. The HashSet is
+    // accessed under its own lock — never under _evalGate — so registration /
+    // unregistration cannot deadlock against the gate. (Core.ScriptedAlarms-006)
+    private readonly HashSet<Task> _inFlight = [];
+    private readonly object _inFlightLock = new();
+
     public ScriptedAlarmEngine(
         ITagUpstreamSource upstream,
         IAlarmStateStore store,
@@ -92,6 +101,7 @@ public sealed class ScriptedAlarmEngine : IDisposable
         if (_disposed) throw new ObjectDisposedException(nameof(ScriptedAlarmEngine));
         if (definitions is null) throw new ArgumentNullException(nameof(definitions));
 
+        var pending = new List<ScriptedAlarmEvent>(0);
         await _evalGate.WaitAsync(ct).ConfigureAwait(false);
         try
         {
@@ -157,11 +167,14 @@ public sealed class ScriptedAlarmEngine : IDisposable
 
             // Restore persisted state, falling back to Fresh where nothing was saved,
             // then re-derive ActiveState from the current predicate per decision #14.
+            // Any predicate emissions queue into `pending` and fire after the gate
+            // is released — so a startup-recovery activation event can call back into
+            // the engine without deadlocking. (Core.ScriptedAlarms-003)
             foreach (var (alarmId, state) in _alarms)
             {
                 var persisted = await _store.LoadAsync(alarmId, ct).ConfigureAwait(false);
                 var seed = persisted ?? state.Condition;
-                var afterPredicate = await EvaluatePredicateToStateAsync(state, seed, nowUtc: _clock(), ct)
+                var afterPredicate = await EvaluatePredicateToStateAsync(state, seed, nowUtc: _clock(), ct, pending)
                     .ConfigureAwait(false);
                 _alarms[alarmId] = state with { Condition = afterPredicate };
                 await _store.SaveAsync(afterPredicate, ct).ConfigureAwait(false);
@@ -192,6 +205,10 @@ public sealed class ScriptedAlarmEngine : IDisposable
         {
             _evalGate.Release();
         }
+
+        // Fire any emissions collected during startup recovery OUTSIDE the gate so
+        // subscribers can re-enter the engine safely. (Core.ScriptedAlarms-003)
+        foreach (var evt in pending) FireEvent(evt);
     }
 
     /// <summary>
@@ -234,6 +251,7 @@ public sealed class ScriptedAlarmEngine : IDisposable
         if (!_alarms.TryGetValue(alarmId, out var state))
             throw new ArgumentException($"Unknown alarm {alarmId}", nameof(alarmId));
 
+        ScriptedAlarmEvent? pending = null;
         await _evalGate.WaitAsync(ct).ConfigureAwait(false);
         try
         {
@@ -244,27 +262,50 @@ public sealed class ScriptedAlarmEngine : IDisposable
             // the exception propagates to the caller. (Core.ScriptedAlarms-007)
             await _store.SaveAsync(result.State, ct).ConfigureAwait(false);
             _alarms[alarmId] = state with { Condition = result.State };
-            if (result.Emission != EmissionKind.None) EmitEvent(state, result.State, result.Emission);
+            // Build the emission event under the gate (it captures a coherent
+            // snapshot of state + message-template values) but defer the actual
+            // OnEvent dispatch until after Release() so a slow subscriber or a
+            // subscriber that re-enters the engine doesn't block / deadlock.
+            // (Core.ScriptedAlarms-003)
+            if (result.Emission != EmissionKind.None)
+                pending = BuildEmission(state, result.State, result.Emission);
+            else if (result.NoOpReason is { } reason)
+            {
+                // The Part9StateMachine remarks promise a diagnostic log line for
+                // disabled-alarm no-ops + idempotent ack/confirm/shelve/unshelve
+                // calls. We surface them at debug so they're available when
+                // investigating "why didn't my ack take effect?" without spamming
+                // the main info log. (Core.ScriptedAlarms-011)
+                state.Logger.Debug("Alarm {AlarmId} no-op transition: {Reason}", alarmId, reason);
+            }
         }
         finally { _evalGate.Release(); }
+
+        // OnEvent dispatch happens OUTSIDE _evalGate so subscribers can call back
+        // into the engine (e.g. AcknowledgeAsync from inside an Activated handler)
+        // without deadlocking against the non-reentrant SemaphoreSlim.
+        if (pending is not null) FireEvent(pending);
     }
 
     /// <summary>
     ///     Upstream-change callback. Updates the value cache + enqueues predicate
     ///     re-evaluation for every alarm referencing the changed path. Fire-and-forget
-    ///     so driver-side dispatch isn't blocked.
+    ///     so driver-side dispatch isn't blocked; the background task is tracked so
+    ///     <see cref="Dispose"/> can drain it. (Core.ScriptedAlarms-006)
     /// </summary>
     internal void OnUpstreamChange(string path, DataValueSnapshot value)
     {
         _valueCache[path] = value;
+        if (_disposed) return; // don't queue new work against a disposing engine
         if (_alarmsReferencing.TryGetValue(path, out var alarmIds))
         {
-            _ = ReevaluateAsync(alarmIds.ToArray(), CancellationToken.None);
+            TrackBackgroundTask(ReevaluateAsync(alarmIds.ToArray(), CancellationToken.None));
         }
     }
 
     private async Task ReevaluateAsync(IReadOnlyList<string> alarmIds, CancellationToken ct)
     {
+        var pending = new List<ScriptedAlarmEvent>(0);
         try
         {
             await _evalGate.WaitAsync(ct).ConfigureAwait(false);
@@ -280,7 +321,7 @@ public sealed class ScriptedAlarmEngine : IDisposable
                 {
                     if (!_alarms.TryGetValue(id, out var state)) continue;
                     var newState = await EvaluatePredicateToStateAsync(
-                        state, state.Condition, _clock(), ct).ConfigureAwait(false);
+                        state, state.Condition, _clock(), ct, pending).ConfigureAwait(false);
                     if (!ReferenceEquals(newState, state.Condition))
                     {
                         // Persist before updating in-memory so a store failure leaves
@@ -295,16 +336,23 @@ public sealed class ScriptedAlarmEngine : IDisposable
         catch (Exception ex)
         {
             _engineLogger.Error(ex, "ScriptedAlarmEngine reevaluate failed");
+            return;
         }
+        // Fire emissions OUTSIDE _evalGate so subscriber callbacks can re-enter
+        // the engine without deadlocking. (Core.ScriptedAlarms-003)
+        foreach (var evt in pending) FireEvent(evt);
     }
 
     /// <summary>
     ///     Evaluate the predicate + apply the resulting state-machine transition.
-    ///     Returns the new condition state. Emits the appropriate event if the
-    ///     transition produces one.
+    ///     Returns the new condition state. If the transition produces an emission,
+    ///     appends it to <paramref name="pendingEmissions"/> so the caller can fire
+    ///     them after releasing <c>_evalGate</c> — keeping subscriber callbacks
+    ///     outside the gate. (Core.ScriptedAlarms-003)
     /// </summary>
     private async Task<AlarmConditionState> EvaluatePredicateToStateAsync(
-        AlarmState state, AlarmConditionState seed, DateTime nowUtc, CancellationToken ct)
+        AlarmState state, AlarmConditionState seed, DateTime nowUtc, CancellationToken ct,
+        List<ScriptedAlarmEvent>? pendingEmissions = null)
     {
         var inputs = BuildReadCache(state.Inputs);
 
@@ -340,7 +388,14 @@ public sealed class ScriptedAlarmEngine : IDisposable
 
         var result = Part9StateMachine.ApplyPredicate(seed, predicateTrue, nowUtc);
         if (result.Emission != EmissionKind.None)
-            EmitEvent(state, result.State, result.Emission);
+        {
+            var evt = BuildEmission(state, result.State, result.Emission);
+            if (evt is not null)
+            {
+                if (pendingEmissions is not null) pendingEmissions.Add(evt);
+                else FireEvent(evt); // LoadAsync path: no caller-supplied list, fire here.
+            }
+        }
         return result.State;
     }
 
@@ -373,14 +428,24 @@ public sealed class ScriptedAlarmEngine : IDisposable
         return true;
     }
 
-    private void EmitEvent(AlarmState state, AlarmConditionState condition, EmissionKind kind)
+    /// <summary>
+    ///     Build (but do not fire) the <see cref="ScriptedAlarmEvent"/> for a
+    ///     transition. Returns null for kinds that should not be published
+    ///     (<see cref="EmissionKind.Suppressed"/> and
+    ///     <see cref="EmissionKind.None"/>). Pure construction — called under
+    ///     <c>_evalGate</c> so the message-template resolution uses a coherent
+    ///     value-cache snapshot. The actual <see cref="OnEvent"/> dispatch is
+    ///     done by <see cref="FireEvent(ScriptedAlarmEvent)"/> AFTER the gate is
+    ///     released. (Core.ScriptedAlarms-003)
+    /// </summary>
+    private ScriptedAlarmEvent? BuildEmission(AlarmState state, AlarmConditionState condition, EmissionKind kind)
     {
         // Suppressed kind means shelving ate the emission — we don't fire for subscribers
         // but the state record still advanced so startup recovery reflects reality.
-        if (kind == EmissionKind.Suppressed || kind == EmissionKind.None) return;
+        if (kind == EmissionKind.Suppressed || kind == EmissionKind.None) return null;
 
         var message = MessageTemplate.Resolve(state.Definition.MessageTemplate, TryLookup);
-        var evt = new ScriptedAlarmEvent(
+        return new ScriptedAlarmEvent(
             AlarmId: state.Definition.AlarmId,
             EquipmentPath: state.Definition.EquipmentPath,
             AlarmName: state.Definition.AlarmName,
@@ -390,10 +455,22 @@ public sealed class ScriptedAlarmEngine : IDisposable
             Condition: condition,
             Emission: kind,
             TimestampUtc: _clock());
+    }
+
+    /// <summary>
+    ///     Invoke the <see cref="OnEvent"/> handler for a built emission. Must be
+    ///     called OUTSIDE <c>_evalGate</c>: a slow subscriber would otherwise
+    ///     block the gate for every other engine operation, and a subscriber
+    ///     that re-enters the engine (e.g. calls AcknowledgeAsync) would
+    ///     deadlock against the non-reentrant SemaphoreSlim.
+    ///     (Core.ScriptedAlarms-003)
+    /// </summary>
+    private void FireEvent(ScriptedAlarmEvent evt)
+    {
         try { OnEvent?.Invoke(this, evt); }
         catch (Exception ex)
         {
-            _engineLogger.Warning(ex, "ScriptedAlarmEngine OnEvent subscriber threw for {AlarmId}", state.Definition.AlarmId);
+            _engineLogger.Warning(ex, "ScriptedAlarmEngine OnEvent subscriber threw for {AlarmId}", evt.AlarmId);
         }
     }
 
@@ -404,7 +481,24 @@ public sealed class ScriptedAlarmEngine : IDisposable
     {
         if (_disposed) return;
         var ids = _alarms.Keys.ToArray();
-        _ = ShelvingCheckAsync(ids, CancellationToken.None);
+        TrackBackgroundTask(ShelvingCheckAsync(ids, CancellationToken.None));
+    }
+
+    /// <summary>
+    ///     Register a fire-and-forget task so <see cref="Dispose"/> can await it.
+    ///     The task removes itself from the set on completion via a continuation.
+    ///     (Core.ScriptedAlarms-006)
+    /// </summary>
+    private void TrackBackgroundTask(Task task)
+    {
+        lock (_inFlightLock) { _inFlight.Add(task); }
+        // Use ContinueWith with ExecuteSynchronously so the removal runs on the
+        // completing thread — avoids scheduler delay between completion and
+        // unregistration that would otherwise let Dispose see a stale set.
+        task.ContinueWith(t =>
+        {
+            lock (_inFlightLock) { _inFlight.Remove(t); }
+        }, CancellationToken.None, TaskContinuationOptions.ExecuteSynchronously, TaskScheduler.Default);
     }
 
     /// <summary>
@@ -416,6 +510,7 @@ public sealed class ScriptedAlarmEngine : IDisposable
 
     private async Task ShelvingCheckAsync(IReadOnlyList<string> alarmIds, CancellationToken ct)
     {
+        var pending = new List<ScriptedAlarmEvent>(0);
         try
         {
             await _evalGate.WaitAsync(ct).ConfigureAwait(false);
@@ -440,7 +535,10 @@ public sealed class ScriptedAlarmEngine : IDisposable
                         await _store.SaveAsync(result.State, ct).ConfigureAwait(false);
                         _alarms[id] = state with { Condition = result.State };
                         if (result.Emission != EmissionKind.None)
-                            EmitEvent(state, result.State, result.Emission);
+                        {
+                            var evt = BuildEmission(state, result.State, result.Emission);
+                            if (evt is not null) pending.Add(evt);
+                        }
                     }
                 }
             }
@@ -449,7 +547,10 @@ public sealed class ScriptedAlarmEngine : IDisposable
         catch (Exception ex)
         {
             _engineLogger.Warning(ex, "ScriptedAlarmEngine shelving-check failed");
+            return;
         }
+        // Fire emissions OUTSIDE _evalGate. (Core.ScriptedAlarms-003)
+        foreach (var evt in pending) FireEvent(evt);
     }
 
     private void UnsubscribeFromUpstream()
@@ -473,6 +574,28 @@ public sealed class ScriptedAlarmEngine : IDisposable
         _disposed = true;
         _shelvingTimer?.Dispose();
         UnsubscribeFromUpstream();
+
+        // Drain any fire-and-forget background work (ReevaluateAsync from
+        // OnUpstreamChange + ShelvingCheckAsync from the 5s timer) that started
+        // before _disposed = true was visible. Without this, a SaveAsync in
+        // flight can outlive the engine and write to a (possibly disposed) store
+        // after Dispose() has returned. The tasks re-check _disposed after
+        // acquiring the gate and bail out, but the await still has to complete.
+        // (Core.ScriptedAlarms-006)
+        Task[] toAwait;
+        lock (_inFlightLock) { toAwait = [.. _inFlight]; }
+        if (toAwait.Length > 0)
+        {
+            try { Task.WhenAll(toAwait).GetAwaiter().GetResult(); }
+            catch (Exception ex)
+            {
+                // Background task failures already logged inside ReevaluateAsync /
+                // ShelvingCheckAsync; surface here at debug so a parent shutdown is
+                // not noisy. The key invariant is that the tasks have COMPLETED.
+                _engineLogger.Debug(ex, "ScriptedAlarmEngine background task threw during shutdown drain");
+            }
+        }
+
         // Do NOT clear _alarms here: Timer.Dispose() does not wait for in-flight callbacks,
         // so a ShelvingCheckAsync or ReevaluateAsync can still be running inside _evalGate.
         // Those paths now re-check _disposed after acquiring the gate and bail out safely.

src/Core/ZB.MOM.WW.OtOpcUa.Core.Scripting/CompiledScriptCache.cs

@@ -58,8 +58,13 @@ public sealed class CompiledScriptCache<TContext, TResult>
         }
         catch
         {
-            // Failed compile — evict so a retry with corrected source can succeed.
-            _cache.TryRemove(key, out _);
+            // Failed compile — evict the SPECIFIC faulted Lazy instance so a retry with
+            // corrected source can succeed. The KeyValuePair<,> overload compares the
+            // value reference, so if two threads race the same bad source both observe
+            // the same faulted Lazy and both reach this catch, and a concurrent retry
+            // re-added a fresh Lazy under the same key between the two removals, the
+            // second removal does NOT evict the in-flight retry. (Core.Scripting-006.)
+            _cache.TryRemove(new KeyValuePair<string, Lazy<ScriptEvaluator<TContext, TResult>>>(key, lazy));
             throw;
         }
     }

src/Core/ZB.MOM.WW.OtOpcUa.Core.Scripting/DependencyExtractor.cs

@@ -103,8 +103,14 @@ public static class DependencyExtractor
             }
 
             var pathArg = args[0].Expression;
+            // Accept any string-literal expression, including raw-string forms which
+            // tokenize as SingleLineRawStringLiteralToken / MultiLineRawStringLiteralToken
+            // rather than StringLiteralToken. Checking the expression kind
+            // (StringLiteralExpression) covers all token kinds Roslyn assigns to literal
+            // strings, so a """raw""" path is harvested rather than mis-rejected as a
+            // dynamic path. (Core.Scripting-005.)
             if (pathArg is not LiteralExpressionSyntax literal
-                || !literal.Token.IsKind(SyntaxKind.StringLiteralToken))
+                || !literal.IsKind(SyntaxKind.StringLiteralExpression))
             {
                 _rejections.Add(new DependencyRejection(
                     Span: pathArg.Span,

src/Core/ZB.MOM.WW.OtOpcUa.Core.VirtualTags/DependencyGraph.cs

@@ -31,6 +31,13 @@ public sealed class DependencyGraph
     private readonly Dictionary<string, HashSet<string>> _dependsOn = new(StringComparer.Ordinal);
     private readonly Dictionary<string, HashSet<string>> _dependents = new(StringComparer.Ordinal);
 
+    // Shared empty set returned from DirectDependencies / DirectDependents on a miss.
+    // The CascadeAsync DFS and the Kahn topological sort both call DirectDependents
+    // per leaf per pass; allocating a fresh HashSet each time would churn the GC on
+    // every change-cascade event. Returning a shared immutable-via-convention empty
+    // set is safe because callers only enumerate (the IReadOnlySet contract).
+    private static readonly IReadOnlySet<string> EmptySet = new HashSet<string>(StringComparer.Ordinal);
+
     // Cached topological rank — built lazily by TransitiveDependentsInOrder and
     // invalidated whenever the graph is mutated (Add / Clear). Avoids re-running
     // a full O(V+E) Kahn pass on every change-cascade event.
@@ -68,7 +75,7 @@ public sealed class DependencyGraph
 
     /// <summary>Tag paths <paramref name="nodeId"/> directly reads.</summary>
     public IReadOnlySet<string> DirectDependencies(string nodeId) =>
-        _dependsOn.TryGetValue(nodeId, out var set) ? set : (IReadOnlySet<string>)new HashSet<string>();
+        _dependsOn.TryGetValue(nodeId, out var set) ? set : EmptySet;
 
     /// <summary>
     ///     Tags whose evaluation depends on <paramref name="nodeId"/> — i.e. when
@@ -76,7 +83,7 @@ public sealed class DependencyGraph
     ///     transitive propagation falls out of the topological sort.
     /// </summary>
     public IReadOnlySet<string> DirectDependents(string nodeId) =>
-        _dependents.TryGetValue(nodeId, out var set) ? set : (IReadOnlySet<string>)new HashSet<string>();
+        _dependents.TryGetValue(nodeId, out var set) ? set : EmptySet;
 
     /// <summary>
     ///     Full transitive dependent closure of <paramref name="nodeId"/> in topological
@@ -284,7 +291,14 @@ public sealed class DependencyCycleException : Exception
 
     private static string BuildMessage(IReadOnlyList<IReadOnlyList<string>> cycles)
     {
-        var lines = cycles.Select(c => "  - " + string.Join(" -> ", c) + " -> " + c[0]);
+        // Render each cycle as a comma-separated list of MEMBERS rather than an arrowed
+        // edge path. Tarjan's algorithm returns SCC members in stack-pop order, which is
+        // not guaranteed to be a valid edge sequence — for an SCC larger than two nodes
+        // the previously-emitted "A -> B -> C -> A" rendering could list edges that do
+        // not exist, sending operators looking for the wrong edge. Member framing avoids
+        // implying an order or set of edges.
+        var lines = cycles.Select(c =>
+            "  - cycle members: " + string.Join(", ", c));
         return "Virtual-tag dependency graph contains cycle(s):\n" + string.Join("\n", lines);
     }
 }

src/Core/ZB.MOM.WW.OtOpcUa.Core.VirtualTags/ITagUpstreamSource.cs

@@ -15,10 +15,11 @@ namespace ZB.MOM.WW.OtOpcUa.Core.VirtualTags;
 ///         from a last-known-value cache populated by the subscription callbacks.
 ///     </para>
 ///     <para>
-///         The subscription path feeds the engine's <c>ChangeTriggerDispatcher</c> so
-///         change-driven virtual tags re-evaluate on any upstream delta (value, status,
-///         or timestamp). One subscription per distinct upstream tag path; the engine
-///         tracks the mapping itself.
+///         The subscription path feeds <see cref="VirtualTagEngine"/>'s
+///         <c>OnUpstreamChange</c> callback, which updates the engine's value cache and
+///         schedules <c>CascadeAsync</c> to re-evaluate every change-driven dependent in
+///         topological order. One subscription per distinct upstream tag path; the
+///         engine tracks the mapping itself.
 ///     </para>
 /// </remarks>
 public interface ITagUpstreamSource

src/Core/ZB.MOM.WW.OtOpcUa.Core.VirtualTags/TimerTriggerScheduler.cs

@@ -9,12 +9,24 @@ namespace ZB.MOM.WW.OtOpcUa.Core.VirtualTags;
 ///     <see cref="System.Threading.Timer"/> per interval-group keeps the wire count
 ///     low regardless of tag count.
 /// </summary>
+/// <remarks>
+///     <para>
+///         Each timer group carries a per-group in-flight flag (see
+///         <c>TickGroup.InFlight</c>). When the timer fires while a tick for the same
+///         group is still running, the new callback skips the work and increments
+///         <see cref="SkippedTickCount"/> rather than blocking a thread-pool thread on
+///         the engine's evaluation gate. This bounds the work outstanding at one tick
+///         per group, regardless of how long an individual evaluation takes.
+///     </para>
+/// </remarks>
 public sealed class TimerTriggerScheduler : IDisposable
 {
     private readonly VirtualTagEngine _engine;
     private readonly ILogger _logger;
     private readonly List<Timer> _timers = [];
+    private readonly List<TickGroup> _groups = [];
     private readonly CancellationTokenSource _cts = new();
+    private long _skippedTickCount;
     private bool _disposed;
 
     public TimerTriggerScheduler(VirtualTagEngine engine, ILogger logger)
@@ -23,6 +35,13 @@ public sealed class TimerTriggerScheduler : IDisposable
         _logger = logger ?? throw new ArgumentNullException(nameof(logger));
     }
 
+    /// <summary>
+    ///     Diagnostic counter: number of timer callbacks that skipped their work because
+    ///     the prior tick for the same group was still running. Exposed for tests +
+    ///     operational metrics. Monotonic; never resets.
+    /// </summary>
+    public long SkippedTickCount => Interlocked.Read(ref _skippedTickCount);
+
     /// <summary>
     ///     Stand up one <see cref="Timer"/> per unique interval. All tags with
     ///     matching interval share a timer; each tick triggers re-evaluation of the
@@ -41,31 +60,60 @@ public sealed class TimerTriggerScheduler : IDisposable
         {
             var paths = group.Select(d => d.Path).ToArray();
             var interval = group.Key;
-            var timer = new Timer(_ => Tick(paths), null, interval, interval);
+            var ctx = new TickGroup(paths);
+            _groups.Add(ctx);
+            var timer = new Timer(_ => OnTimer(ctx), null, interval, interval);
             _timers.Add(timer);
             _logger.Information("TimerTriggerScheduler: {TagCount} tag(s) on {Interval} cadence",
                 paths.Length, interval);
         }
     }
 
-    private void Tick(IReadOnlyList<string> paths)
+    private void OnTimer(TickGroup ctx)
     {
         if (_cts.IsCancellationRequested) return;
-        foreach (var p in paths)
+
+        // Skip the tick when the prior one for this group is still running. Without
+        // this guard a slow evaluation (or one waiting on the engine's _evalGate) would
+        // cause subsequent timer callbacks to each pin a thread-pool thread on the
+        // gate, compounding under high tick rates.
+        if (Interlocked.CompareExchange(ref ctx.InFlight, 1, 0) != 0)
         {
-            try
+            Interlocked.Increment(ref _skippedTickCount);
+            return;
+        }
+
+        // Run async without blocking the timer's pool-thread callback. The task is
+        // fire-and-forget — failures are logged inside RunTickAsync; the InFlight flag
+        // is reset in the finally block so the next tick can proceed.
+        _ = RunTickAsync(ctx);
+    }
+
+    private async Task RunTickAsync(TickGroup ctx)
+    {
+        try
+        {
+            foreach (var p in ctx.Paths)
             {
-                _engine.EvaluateOneAsync(p, _cts.Token).GetAwaiter().GetResult();
-            }
-            catch (OperationCanceledException)
-            {
-                return;
-            }
-            catch (Exception ex)
-            {
-                _logger.Error(ex, "TimerTriggerScheduler evaluate failed for {Path}", p);
+                if (_cts.IsCancellationRequested) return;
+                try
+                {
+                    await _engine.EvaluateOneAsync(p, _cts.Token).ConfigureAwait(false);
+                }
+                catch (OperationCanceledException)
+                {
+                    return;
+                }
+                catch (Exception ex)
+                {
+                    _logger.Error(ex, "TimerTriggerScheduler evaluate failed for {Path}", p);
+                }
             }
         }
+        finally
+        {
+            Interlocked.Exchange(ref ctx.InFlight, 0);
+        }
     }
 
     public void Dispose()
@@ -78,6 +126,21 @@ public sealed class TimerTriggerScheduler : IDisposable
             try { t.Dispose(); } catch { }
         }
         _timers.Clear();
+        _groups.Clear();
         _cts.Dispose();
     }
+
+    private sealed class TickGroup
+    {
+        // 0 = idle, 1 = a tick is currently running (or queued) for this group. Use
+        // Interlocked.CompareExchange so a timer callback observes a consistent "is the
+        // prior tick still running" answer without taking a lock.
+        public int InFlight;
+        public IReadOnlyList<string> Paths { get; }
+
+        public TickGroup(IReadOnlyList<string> paths)
+        {
+            Paths = paths;
+        }
+    }
 }

src/Core/ZB.MOM.WW.OtOpcUa.Core.VirtualTags/VirtualTagContext.cs

@@ -8,8 +8,9 @@ namespace ZB.MOM.WW.OtOpcUa.Core.VirtualTags;
 ///     Per-evaluation <see cref="ScriptContext"/> for a virtual-tag script. Reads come
 ///     out of the engine's last-known-value cache (driver tags updated via the
 ///     <see cref="ITagUpstreamSource"/> subscription, virtual tags updated by prior
-///     evaluations). Writes route through the engine's <c>SetVirtualTag</c> callback so
-///     cross-tag write side effects still participate in change-trigger cascades.
+///     evaluations). Writes route through <see cref="VirtualTagEngine"/>'s
+///     <c>OnScriptSetVirtualTag</c> callback so cross-tag write side effects still
+///     participate in change-trigger cascades (via the engine's <c>CascadeAsync</c>).
 /// </summary>
 /// <remarks>
 ///     <para>

src/Core/ZB.MOM.WW.OtOpcUa.Core.VirtualTags/VirtualTagDefinition.cs

@@ -24,8 +24,8 @@ namespace ZB.MOM.WW.OtOpcUa.Core.VirtualTags;
 /// </param>
 /// <param name="TimerInterval">
 ///     Optional periodic re-evaluation cadence. Null = timer-driven disabled. Both can
-///     be enabled simultaneously; independent scheduling paths both feed
-///     <c>EvaluationPipeline</c>.
+///     be enabled simultaneously; independent scheduling paths both end at
+///     <see cref="VirtualTagEngine"/>'s <c>EvaluateInternalAsync</c>.
 /// </param>
 /// <param name="Historize">
 ///     When true, every evaluation result is forwarded to the configured

src/Core/ZB.MOM.WW.OtOpcUa.Core.VirtualTags/VirtualTagEngine.cs

@@ -85,6 +85,13 @@ public sealed class VirtualTagEngine : IDisposable
                 continue;
             }
 
+            if (!IsSupportedDataType(def.DataType))
+            {
+                compileFailures.Add(
+                    $"{def.Path}: unsupported DataType DriverDataType.{def.DataType} — virtual tags only support scalar primitive types");
+                continue;
+            }
+
             try
             {
                 var extraction = DependencyExtractor.Extract(def.ScriptSource);
@@ -108,6 +115,22 @@ public sealed class VirtualTagEngine : IDisposable
             }
         }
 
+        // Validate every ctx.SetVirtualTag write target resolves to a registered virtual
+        // tag. A script writing to a non-existent virtual path would otherwise be silently
+        // dropped at runtime by OnScriptSetVirtualTag's warning-and-drop branch; catching
+        // it here surfaces operator typos as a publish failure.
+        foreach (var (path, state) in _tags)
+        {
+            foreach (var writeTarget in state.Writes)
+            {
+                if (!_tags.ContainsKey(writeTarget))
+                {
+                    compileFailures.Add(
+                        $"{path}: ctx.SetVirtualTag target '{writeTarget}' is not a registered virtual tag");
+                }
+            }
+        }
+
         if (compileFailures.Count > 0)
         {
             var joined = string.Join("\n  ", compileFailures);
@@ -184,9 +207,28 @@ public sealed class VirtualTagEngine : IDisposable
     /// </summary>
     public IDisposable Subscribe(string path, Action<string, DataValueSnapshot> observer)
     {
-        var list = _observers.GetOrAdd(path, _ => []);
-        lock (list) { list.Add(observer); }
-        return new Unsub(this, path, observer);
+        // Race-safe pattern paired with Unsub.Dispose: if Unsub.Dispose removed the
+        // dictionary entry between our GetOrAdd and the lock-protected Add, the list
+        // we hold a reference to is orphaned. Re-check the map under the lock and
+        // re-insert the list (or grab the current one) if needed, retrying until the
+        // dictionary observably contains the list we just added our observer to.
+        while (true)
+        {
+            var list = _observers.GetOrAdd(path, _ => []);
+            lock (list)
+            {
+                // Confirm the list is still the dictionary's value for this key. If
+                // Dispose removed the entry, _observers[path] either doesn't exist or
+                // points at a different (newer) list — retry.
+                if (_observers.TryGetValue(path, out var current) && ReferenceEquals(current, list))
+                {
+                    list.Add(observer);
+                    return new Unsub(this, path, observer);
+                }
+            }
+            // Lost the race — Dispose pruned the list out from under us. Loop and
+            // either re-create or pick up the newer list.
+        }
     }
 
     /// <summary>
@@ -367,13 +409,24 @@ public sealed class VirtualTagEngine : IDisposable
             return target switch
             {
                 DriverDataType.Boolean => Convert.ToBoolean(raw),
+                DriverDataType.Int16 => Convert.ToInt16(raw),
                 DriverDataType.Int32 => Convert.ToInt32(raw),
                 DriverDataType.Int64 => Convert.ToInt64(raw),
+                DriverDataType.UInt16 => Convert.ToUInt16(raw),
+                DriverDataType.UInt32 => Convert.ToUInt32(raw),
+                DriverDataType.UInt64 => Convert.ToUInt64(raw),
                 DriverDataType.Float32 => Convert.ToSingle(raw),
                 DriverDataType.Float64 => Convert.ToDouble(raw),
                 DriverDataType.String => Convert.ToString(raw) ?? string.Empty,
                 DriverDataType.DateTime => raw is DateTime dt ? dt : Convert.ToDateTime(raw),
-                _ => raw,
+                // Any DriverDataType not in the explicit list (currently Reference, or any
+                // future enum member added without coercion support) must NOT silently
+                // return the uncoerced raw value — that would surface as a wire-level
+                // type mismatch on the OPC UA Variant. Throwing here is caught by the
+                // outer catch and mapped to BadInternalError. Load-time validation in
+                // IsSupportedDataType ensures operators never publish such a tag.
+                _ => throw new InvalidOperationException(
+                    $"Virtual-tag CoerceResult does not support DriverDataType.{target}"),
             };
         }
         catch
@@ -384,6 +437,28 @@ public sealed class VirtualTagEngine : IDisposable
         }
     }
 
+    /// <summary>
+    ///     The set of <see cref="DriverDataType"/> values <see cref="CoerceResult"/> can
+    ///     honour. Definitions declaring any other type are rejected at <see cref="Load"/>
+    ///     so an operator typo (or a future enum member added without coercion support) is
+    ///     caught at publish time rather than silently producing a type-mismatched value.
+    /// </summary>
+    private static bool IsSupportedDataType(DriverDataType t) => t switch
+    {
+        DriverDataType.Boolean => true,
+        DriverDataType.Int16 => true,
+        DriverDataType.Int32 => true,
+        DriverDataType.Int64 => true,
+        DriverDataType.UInt16 => true,
+        DriverDataType.UInt32 => true,
+        DriverDataType.UInt64 => true,
+        DriverDataType.Float32 => true,
+        DriverDataType.Float64 => true,
+        DriverDataType.String => true,
+        DriverDataType.DateTime => true,
+        _ => false,
+    };
+
     private void UnsubscribeFromUpstream()
     {
         foreach (var s in _upstreamSubscriptions)
@@ -423,7 +498,23 @@ public sealed class VirtualTagEngine : IDisposable
         {
             if (_engine._observers.TryGetValue(_path, out var list))
             {
-                lock (list) { list.Remove(_observer); }
+                lock (list)
+                {
+                    list.Remove(_observer);
+                    // If we removed the last observer, prune the dictionary entry so a
+                    // long-running server doesn't accumulate empty Lists for paths that
+                    // saw transient subscriptions. The emptiness check is inside the same
+                    // lock so a concurrent Subscribe can't slip an observer in after we
+                    // observe the list as empty.
+                    if (list.Count == 0)
+                    {
+                        // ICollection<KeyValuePair<,>> removal is value-typed — only removes
+                        // if both key + value still match (i.e. the dictionary still points
+                        // at this list). This keeps a racing Subscribe's brand-new list safe.
+                        ((ICollection<KeyValuePair<string, List<Action<string, DataValueSnapshot>>>>)_engine._observers)
+                            .Remove(new KeyValuePair<string, List<Action<string, DataValueSnapshot>>>(_path, list));
+                    }
+                }
             }
         }
     }

src/Core/ZB.MOM.WW.OtOpcUa.Core/Authorization/PermissionTrieBuilder.cs

@@ -26,11 +26,27 @@ public static class PermissionTrieBuilder
     ///     Build a trie for one cluster/generation from the supplied rows. The caller is
     ///     responsible for pre-filtering rows to the target generation + cluster.
     /// </summary>
+    /// <param name="clusterId">Cluster the trie is being built for; rows for other clusters are skipped.</param>
+    /// <param name="generationId">Config-generation the rows belong to; stamped on the returned trie.</param>
+    /// <param name="rows">ACL rows for this cluster + generation.</param>
+    /// <param name="scopePaths">
+    ///     Optional <c>ScopeId</c> → multi-level trie-path lookup. When supplied, sub-cluster rows
+    ///     descend to their structurally-correct trie node. When null, sub-cluster rows fall back
+    ///     to a direct child of the trie root keyed on <c>ScopeId</c> — deterministic-test mode.
+    /// </param>
+    /// <param name="diagnostic">
+    ///     Optional callback invoked when a sub-cluster row's <c>ScopeId</c> cannot be located
+    ///     in <paramref name="scopePaths"/>. Production callers should wire a logger here so
+    ///     orphaned grants surface — silently dropping them under the wrong trie level was the
+    ///     Core-011 production hazard. The callback fires only when <paramref name="scopePaths"/>
+    ///     is non-null (a null lookup is the explicit deterministic-test fallback mode).
+    /// </param>
     public static PermissionTrie Build(
         string clusterId,
         long generationId,
         IReadOnlyList<NodeAcl> rows,
-        IReadOnlyDictionary<string, NodeAclPath>? scopePaths = null)
+        IReadOnlyDictionary<string, NodeAclPath>? scopePaths = null,
+        Action<PermissionTrieBuildDiagnostic>? diagnostic = null)
     {
         ArgumentException.ThrowIfNullOrWhiteSpace(clusterId);
         ArgumentNullException.ThrowIfNull(rows);
@@ -45,7 +61,7 @@ public static class PermissionTrieBuilder
             var node = row.ScopeKind switch
             {
                 NodeAclScopeKind.Cluster => trie.Root,
-                _ => Descend(trie.Root, row, scopePaths),
+                _ => Descend(trie.Root, row, scopePaths, diagnostic),
             };
 
             if (node is not null)
@@ -55,16 +71,30 @@ public static class PermissionTrieBuilder
         return trie;
     }
 
-    private static PermissionTrieNode? Descend(PermissionTrieNode root, NodeAcl row, IReadOnlyDictionary<string, NodeAclPath>? scopePaths)
+    private static PermissionTrieNode? Descend(
+        PermissionTrieNode root,
+        NodeAcl row,
+        IReadOnlyDictionary<string, NodeAclPath>? scopePaths,
+        Action<PermissionTrieBuildDiagnostic>? diagnostic)
     {
         if (string.IsNullOrEmpty(row.ScopeId)) return null;
 
         // For sub-cluster scopes the caller supplies a path lookup so we know the containing
         // namespace / UnsArea / UnsLine ids. Without a path lookup we fall back to putting the
         // row directly under the root using its ScopeId — works for deterministic tests, not
-        // for production where the hierarchy must be honored.
+        // for production where the hierarchy must be honored. If a scopePaths lookup IS
+        // provided but is missing the row's ScopeId, surface a diagnostic so the caller can
+        // log the orphan instead of silently dropping the grant under an unreachable node.
         if (scopePaths is null || !scopePaths.TryGetValue(row.ScopeId, out var path))
         {
+            if (scopePaths is not null)
+            {
+                diagnostic?.Invoke(new PermissionTrieBuildDiagnostic(
+                    NodeAclId: row.NodeAclId,
+                    ScopeKind: row.ScopeKind,
+                    ScopeId: row.ScopeId,
+                    Reason: PermissionTrieBuildDiagnosticReason.MissingScopePath));
+            }
             return EnsureChild(root, row.ScopeId);
         }
 
@@ -95,3 +125,30 @@ public static class PermissionTrieBuilder
 ///     applicable; or (for SystemPlatform kind) NamespaceId / FolderSegment / .../TagId.
 /// </param>
 public sealed record NodeAclPath(IReadOnlyList<string> Segments);
+
+/// <summary>
+///     Diagnostic emitted by <see cref="PermissionTrieBuilder.Build"/> when a row could not be
+///     placed at its structurally-correct trie node. Production callers should log these so
+///     orphaned grants surface instead of being silently dropped under an unreachable node
+///     (Core-011).
+/// </summary>
+/// <param name="NodeAclId">The offending row's logical id.</param>
+/// <param name="ScopeKind">The row's <see cref="NodeAclScopeKind"/>.</param>
+/// <param name="ScopeId">The row's <c>ScopeId</c> that could not be located.</param>
+/// <param name="Reason">Why the diagnostic fired.</param>
+public sealed record PermissionTrieBuildDiagnostic(
+    string NodeAclId,
+    NodeAclScopeKind ScopeKind,
+    string ScopeId,
+    PermissionTrieBuildDiagnosticReason Reason);
+
+/// <summary>Reasons <see cref="PermissionTrieBuildDiagnostic"/> can be emitted.</summary>
+public enum PermissionTrieBuildDiagnosticReason
+{
+    /// <summary>
+    ///     The row's <c>ScopeId</c> was not present in the supplied <c>scopePaths</c> lookup.
+    ///     The grant is placed as a direct child of the trie root keyed on <c>ScopeId</c> — a
+    ///     position the production trie walker cannot reach for multi-level scopes.
+    /// </summary>
+    MissingScopePath,
+}

src/Core/ZB.MOM.WW.OtOpcUa.Core/Hosting/DriverHost.cs

@@ -52,7 +52,7 @@ public sealed class DriverHost : IAsyncDisposable
             _drivers[id] = driver;
         }
 
-        try { await driver.InitializeAsync(driverConfigJson, ct); }
+        try { await driver.InitializeAsync(driverConfigJson, ct).ConfigureAwait(false); }
         catch
         {
             // Keep the driver registered — operator will see Faulted state and can reinitialize.
@@ -69,7 +69,7 @@ public sealed class DriverHost : IAsyncDisposable
             _drivers.Remove(driverInstanceId);
         }
 
-        try { await driver.ShutdownAsync(ct); }
+        try { await driver.ShutdownAsync(ct).ConfigureAwait(false); }
         catch { /* shutdown is best-effort; logs elsewhere */ }
     }
 
@@ -84,7 +84,7 @@ public sealed class DriverHost : IAsyncDisposable
 
         foreach (var driver in snapshot)
         {
-            try { await driver.ShutdownAsync(CancellationToken.None); } catch { /* ignore */ }
+            try { await driver.ShutdownAsync(CancellationToken.None).ConfigureAwait(false); } catch { /* ignore */ }
             (driver as IDisposable)?.Dispose();
         }
     }

src/Core/ZB.MOM.WW.OtOpcUa.Core/Observability/DriverHealthReport.cs

@@ -15,11 +15,13 @@ namespace ZB.MOM.WW.OtOpcUa.Core.Observability;
 ///             → /readyz 503 (not yet ready).</item>
 ///         <item><see cref="DriverState.Healthy"/> → /readyz 200.</item>
 ///         <item><see cref="DriverState.Degraded"/> → /readyz 200 with flagged driver IDs.</item>
+///         <item><see cref="DriverState.Reconnecting"/> → /readyz 200 with flagged driver IDs
+///             (driver alive but not serving live data; same verdict as Degraded).</item>
 ///         <item><see cref="DriverState.Faulted"/> → /readyz 503.</item>
 ///     </list>
 ///     The overall verdict is computed across the fleet: any Faulted → Faulted; any
-///     Unknown/Initializing → NotReady; any Degraded → Degraded; else Healthy. An empty fleet
-///     is Healthy (nothing to degrade).
+///     Unknown/Initializing → NotReady; any Degraded or Reconnecting → Degraded; else
+///     Healthy. An empty fleet is Healthy (nothing to degrade).
 /// </remarks>
 public static class DriverHealthReport
 {

src/Core/ZB.MOM.WW.OtOpcUa.Core/OpcUa/GenericDriverNodeManager.cs

@@ -39,8 +39,11 @@ public class GenericDriverNodeManager(IDriver driver) : IDisposable
     ///     If called a second time (e.g. Galaxy redeploy via <c>IRediscoverable.OnRediscoveryNeeded</c>)
     ///     the previous alarm subscription is torn down and the sink registry is cleared before
     ///     re-walking, preventing double delivery of alarm transitions.
-    ///     Exception isolation (marking the driver's subtree Faulted) is the caller's responsibility —
-    ///     exceptions from <see cref="ITagDiscovery.DiscoverAsync"/> propagate to the caller.
+    ///     Exception isolation (per decision #12 — marking the driver's subtree Faulted while other
+    ///     drivers stay available) is the caller's responsibility; exceptions from
+    ///     <see cref="ITagDiscovery.DiscoverAsync"/> propagate unhandled to the caller. The Server
+    ///     project's <c>OpcUaApplicationHost.PopulateAddressSpaces</c> wraps this call in a per-driver
+    ///     try/catch that logs + leaves the driver's subtree empty until a Reinitialize succeeds.
     /// </summary>
     public async Task BuildAddressSpaceAsync(IAddressSpaceBuilder builder, CancellationToken ct)
     {

src/Core/ZB.MOM.WW.OtOpcUa.Core/Resilience/CapabilityInvoker.cs

@@ -118,11 +118,15 @@ public sealed class CapabilityInvoker
 
         if (!isIdempotent)
         {
-            var noRetryOptions = _optionsAccessor() with
+            // Snapshot the options exactly once per call — invoking _optionsAccessor twice can
+            // (a) observe two different snapshots if an Admin edit lands between them and
+            // (b) wastes an allocation on the per-write hot path (Phase 6.1 1% pipeline budget).
+            var snapshot = _optionsAccessor();
+            var noRetryOptions = snapshot with
             {
                 CapabilityPolicies = new Dictionary<DriverCapability, CapabilityPolicy>
                 {
-                    [DriverCapability.Write] = _optionsAccessor().Resolve(DriverCapability.Write) with { RetryCount = 0 },
+                    [DriverCapability.Write] = snapshot.Resolve(DriverCapability.Write) with { RetryCount = 0 },
                 },
             };
             var pipeline = _builder.GetOrCreate(_driverInstanceId, $"{hostName}::non-idempotent", DriverCapability.Write, noRetryOptions);

src/Core/ZB.MOM.WW.OtOpcUa.Core/Resilience/DriverResilienceOptions.cs

@@ -42,13 +42,27 @@ public sealed record DriverResilienceOptions
     ///     Look up the effective policy for a capability, falling back to tier defaults when no
     ///     override is configured. Never returns null.
     /// </summary>
+    /// <exception cref="KeyNotFoundException">
+    ///     Thrown when neither the override map nor the tier defaults carry an entry for the
+    ///     requested capability. The <c>TierDefaults_Cover_EveryCapability</c> invariant test
+    ///     in <c>DriverResilienceOptionsTests</c> guarantees every defined enum value is present
+    ///     in each tier's table, so this only fires when a caller passes an out-of-range value
+    ///     or someone adds a <see cref="DriverCapability"/> member without updating
+    ///     <see cref="GetTierDefaults"/>. The message names the missing capability and tier.
+    /// </exception>
     public CapabilityPolicy Resolve(DriverCapability capability)
     {
         if (CapabilityPolicies.TryGetValue(capability, out var policy))
             return policy;
 
         var defaults = GetTierDefaults(Tier);
-        return defaults[capability];
+        if (defaults.TryGetValue(capability, out var fallback))
+            return fallback;
+
+        throw new KeyNotFoundException(
+            $"No policy defined for capability '{capability}' under tier '{Tier}'. " +
+            $"This indicates a {nameof(DriverCapability)} enum value missing from {nameof(GetTierDefaults)} — " +
+            "add the capability to every tier's default table.");
     }
 
     /// <summary>

src/Core/ZB.MOM.WW.OtOpcUa.Core/Stability/WedgeDetector.cs

@@ -23,7 +23,15 @@ public sealed class WedgeDetector
     /// <summary>Wedge-detection threshold; pass &lt; 60 s and the detector clamps to 60 s.</summary>
     public TimeSpan Threshold { get; }
 
-    /// <summary>Whether the driver reported itself <see cref="DriverState.Healthy"/> at construction.</summary>
+    /// <summary>
+    ///     Construct with the wedge-detection threshold; values below 60 s clamp to 60 s so
+    ///     the detector never fires below the documented floor.
+    /// </summary>
+    /// <param name="threshold">
+    ///     Time without a successful unit of work after which a Healthy driver with pending
+    ///     work is considered Faulted. Clamped to a minimum of 60 s per the plan-default of
+    ///     5 × PublishingInterval.
+    /// </param>
     public WedgeDetector(TimeSpan threshold)
     {
         Threshold = threshold < TimeSpan.FromSeconds(60) ? TimeSpan.FromSeconds(60) : threshold;

src/Drivers/Cli/ZB.MOM.WW.OtOpcUa.Driver.AbCip.Cli/AbCipCommandBase.cs

@@ -27,10 +27,28 @@ public abstract class AbCipCommandBase : DriverCommandBase
     public int TimeoutMs { get; init; } = 5000;
 
     /// <inheritdoc />
+    /// <remarks>
+    ///     The getter validates <see cref="TimeoutMs"/> (Driver.AbCip.Cli-004) — a zero or
+    ///     negative <c>--timeout-ms</c> would otherwise propagate as a non-positive
+    ///     <see cref="TimeSpan"/> into the driver. The <c>init</c> accessor is unreachable
+    ///     because CliFx binds <see cref="TimeoutMs"/> rather than <c>Timeout</c>; it throws
+    ///     <see cref="NotSupportedException"/> so an object-initializer assignment
+    ///     (<c>new ReadCommand { Timeout = ... }</c>) fails fast instead of being silently
+    ///     discarded (Driver.AbCip.Cli-006).
+    /// </remarks>
     public override TimeSpan Timeout
     {
-        get => TimeSpan.FromMilliseconds(TimeoutMs);
-        init { /* driven by TimeoutMs */ }
+        get
+        {
+            if (TimeoutMs <= 0)
+                throw new CliFx.Exceptions.CommandException(
+                    $"--timeout-ms must be > 0 (got {TimeoutMs}). " +
+                    "Pick a positive number of milliseconds for the per-operation timeout.");
+            return TimeSpan.FromMilliseconds(TimeoutMs);
+        }
+        init => throw new NotSupportedException(
+            $"{nameof(AbCipCommandBase)}.{nameof(Timeout)} is derived from {nameof(TimeoutMs)} " +
+            "and cannot be assigned directly. Set TimeoutMs instead.");
     }
 
     /// <summary>

src/Drivers/Cli/ZB.MOM.WW.OtOpcUa.Driver.AbCip.Cli/Commands/ProbeCommand.cs

@@ -54,6 +54,9 @@ public sealed class ProbeCommand : AbCipCommandBase
         finally
         {
             await driver.ShutdownAsync(CancellationToken.None);
+            // Driver.AbCip.Cli-005 — flush Serilog before process exit so buffered log
+            // output emitted during driver shutdown is not lost.
+            FlushLogging();
         }
     }
 }

src/Drivers/Cli/ZB.MOM.WW.OtOpcUa.Driver.AbCip.Cli/Commands/ReadCommand.cs

@@ -49,6 +49,9 @@ public sealed class ReadCommand : AbCipCommandBase
         finally
         {
             await driver.ShutdownAsync(CancellationToken.None);
+            // Driver.AbCip.Cli-005 — flush Serilog before process exit so buffered log
+            // output emitted during driver shutdown is not lost.
+            FlushLogging();
         }
     }
 

src/Drivers/Cli/ZB.MOM.WW.OtOpcUa.Driver.AbCip.Cli/Commands/SubscribeCommand.cs

@@ -31,6 +31,10 @@ public sealed class SubscribeCommand : AbCipCommandBase
     {
         ConfigureLogging();
         RejectStructure(DataType);
+        ValidateInterval(IntervalMs);
+        // Touch Timeout to surface the --timeout-ms guard (Driver.AbCip.Cli-004) before
+        // we open a driver — fast-fail with a clean CommandException on bad operator input.
+        _ = Timeout;
         var ct = console.RegisterCancellationHandler();
 
         var tagName = ReadCommand.SynthesiseTagName(TagPath, DataType);
@@ -48,6 +52,13 @@ public sealed class SubscribeCommand : AbCipCommandBase
         {
             await driver.InitializeAsync("{}", ct);
 
+            // Driver.AbCip.Cli-003 — emit the banner BEFORE wiring OnDataChange so the
+            // main-thread write cannot interleave with poll-thread change-event writes.
+            // TextWriter.WriteLine is not guaranteed thread-safe; once the handler is
+            // attached and SubscribeAsync starts, change events run on the poll thread.
+            await console.Output.WriteLineAsync(
+                $"Subscribed to {TagPath} @ {IntervalMs}ms. Ctrl+C to stop.");
+
             driver.OnDataChange += (_, e) =>
             {
                 var line = $"[{DateTime.UtcNow:HH:mm:ss.fff}] " +
@@ -58,8 +69,6 @@ public sealed class SubscribeCommand : AbCipCommandBase
 
             handle = await driver.SubscribeAsync([tagName], TimeSpan.FromMilliseconds(IntervalMs), ct);
 
-            await console.Output.WriteLineAsync(
-                $"Subscribed to {TagPath} @ {IntervalMs}ms. Ctrl+C to stop.");
             try
             {
                 await Task.Delay(System.Threading.Timeout.InfiniteTimeSpan, ct);
@@ -77,6 +86,23 @@ public sealed class SubscribeCommand : AbCipCommandBase
                 catch { /* teardown best-effort */ }
             }
             await driver.ShutdownAsync(CancellationToken.None);
+            // Driver.AbCip.Cli-005 — flush Serilog before process exit so buffered log
+            // lines emitted just before Ctrl+C are not lost on abrupt termination.
+            FlushLogging();
         }
     }
+
+    /// <summary>
+    ///     Guards <c>--interval-ms</c> against zero or negative values (Driver.AbCip.Cli-004).
+    ///     A non-positive interval would produce a non-positive <see cref="TimeSpan"/> into
+    ///     <c>SubscribeAsync</c>; the CLI should fail fast with an actionable error rather
+    ///     than relying on the downstream <c>PollGroupEngine</c> to clamp the value.
+    /// </summary>
+    internal static void ValidateInterval(int intervalMs)
+    {
+        if (intervalMs <= 0)
+            throw new CliFx.Exceptions.CommandException(
+                $"--interval-ms must be > 0 (got {intervalMs}). " +
+                "PollGroupEngine floors sub-250ms values, but accepts any positive integer.");
+    }
 }

src/Drivers/Cli/ZB.MOM.WW.OtOpcUa.Driver.AbCip.Cli/Commands/WriteCommand.cs

@@ -60,6 +60,9 @@ public sealed class WriteCommand : AbCipCommandBase
         finally
         {
             await driver.ShutdownAsync(CancellationToken.None);
+            // Driver.AbCip.Cli-005 — flush Serilog before process exit so buffered log
+            // output emitted during driver shutdown is not lost.
+            FlushLogging();
         }
     }
 

src/Drivers/Cli/ZB.MOM.WW.OtOpcUa.Driver.AbLegacy.Cli/Commands/ProbeCommand.cs

@@ -17,7 +17,7 @@ public sealed class ProbeCommand : AbLegacyCommandBase
         "the pre-populated register every SLC / MicroLogix / PLC-5 ships with.")]
     public string Address { get; init; } = "N7:0";
 
-    [CommandOption("type", Description =
+    [CommandOption("type", 't', Description =
         "PCCC data type of the probe address (default Int — matches N files).")]
     public AbLegacyDataType DataType { get; init; } = AbLegacyDataType.Int;
 
@@ -34,7 +34,10 @@ public sealed class ProbeCommand : AbLegacyCommandBase
             Writable: false);
         var options = BuildOptions([probeTag]);
 
-        await using var driver = new AbLegacyDriver(options, DriverInstanceId);
+        // Plain `var driver`: explicit ShutdownAsync(CancellationToken.None) in the
+        // finally is the deliberate teardown path; combining it with `await using`
+        // (which itself calls ShutdownAsync) would tear the driver down twice.
+        var driver = new AbLegacyDriver(options, DriverInstanceId);
         try
         {
             await driver.InitializeAsync("{}", ct);