FOCAS Tier-C PR B — Driver.FOCAS.Host net48 x86 skeleton + pipe server. Second PR of the 5-PR #220 split. Stands up the Windows Service entry point + named-pipe scaffolding so PR C has a place to move the Fwlib32 calls into. New net48 x86 project (Fwlib32.dll is 32-bit-only, same bitness constraint as Galaxy.Host/MXAccess); references Driver.FOCAS.Shared for framing + DTOs so the wire format Proxy<->Host stays a single type system. Ships four files: PipeAcl creates a PipeSecurity where only the configured server principal SID gets ReadWrite+Synchronize + LocalSystem/BuiltinAdministrators are explicitly denied (so a compromised service account on the same host can't escalate via the pipe); IFrameHandler abstracts the dispatch surface with HandleAsync + AttachConnection for server-push event sinks; PipeServer accepts one connection at a time, verifies the peer SID via RunAsClient, reads the first Hello frame + matches the shared-secret and protocol major version, sends HelloAck, then hands off to the handler until EOF or cancel; StubFrameHandler fully handles Heartbeat/HeartbeatAck so a future supervisor's liveness detector stays happy, and returns ErrorResponse{Code=not-implemented,Message="Kind X is stubbed - Fwlib32 lift lands in PR C"} for every data-plane request. Program.cs mirrors the Galaxy.Host startup exactly: reads OTOPCUA_FOCAS_PIPE / OTOPCUA_ALLOWED_SID / OTOPCUA_FOCAS_SECRET from the env (supervisor passes these at spawn time), builds Serilog rolling-file logger into %ProgramData%\OtOpcUa\focas-host-*.log, constructs the pipe server with StubFrameHandler, loops on RunAsync until SIGINT. Log messages mark the backend as "stub" so it's visible in logs that Fwlib32 isn't actually connected yet. Driver.FOCAS.Host.Tests (net48 x86) ships three integration tests mirroring IpcHandshakeIntegrationTests from Galaxy.Host: correct-secret handshake + heartbeat round-trip, wrong-secret rejection with UnauthorizedAccessException, and a new test that sends a ReadRequest and asserts the StubFrameHandler returns ErrorResponse{not-implemented} mentioning PR C in the message so the wiring between frame dispatch + kind → error mapping is locked. Tests follow the same is-Administrator skip guard as Galaxy because PipeAcl denies BuiltinAdministrators. No changes to existing driver code; FOCAS unit tests still at 165/165 + Shared tests at 24/24. PR C wires the real Fwlib32 backend.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

ZB.MOM.WW.OtOpcUa.slnx

@@ -14,6 +14,8 @@
         <Project Path="src/ZB.MOM.WW.OtOpcUa.Driver.AbLegacy/ZB.MOM.WW.OtOpcUa.Driver.AbLegacy.csproj"/>
         <Project Path="src/ZB.MOM.WW.OtOpcUa.Driver.TwinCAT/ZB.MOM.WW.OtOpcUa.Driver.TwinCAT.csproj"/>
         <Project Path="src/ZB.MOM.WW.OtOpcUa.Driver.FOCAS/ZB.MOM.WW.OtOpcUa.Driver.FOCAS.csproj"/>
+        <Project Path="src/ZB.MOM.WW.OtOpcUa.Driver.FOCAS.Shared/ZB.MOM.WW.OtOpcUa.Driver.FOCAS.Shared.csproj"/>
+        <Project Path="src/ZB.MOM.WW.OtOpcUa.Driver.FOCAS.Host/ZB.MOM.WW.OtOpcUa.Driver.FOCAS.Host.csproj"/>
         <Project Path="src/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.csproj"/>
         <Project Path="src/ZB.MOM.WW.OtOpcUa.Client.Shared/ZB.MOM.WW.OtOpcUa.Client.Shared.csproj"/>
         <Project Path="src/ZB.MOM.WW.OtOpcUa.Client.CLI/ZB.MOM.WW.OtOpcUa.Client.CLI.csproj"/>
@@ -34,12 +36,18 @@
         <Project Path="tests/ZB.MOM.WW.OtOpcUa.Driver.Modbus.Tests/ZB.MOM.WW.OtOpcUa.Driver.Modbus.Tests.csproj"/>
         <Project Path="tests/ZB.MOM.WW.OtOpcUa.Driver.Modbus.IntegrationTests/ZB.MOM.WW.OtOpcUa.Driver.Modbus.IntegrationTests.csproj"/>
         <Project Path="tests/ZB.MOM.WW.OtOpcUa.Driver.S7.Tests/ZB.MOM.WW.OtOpcUa.Driver.S7.Tests.csproj"/>
+        <Project Path="tests/ZB.MOM.WW.OtOpcUa.Driver.S7.IntegrationTests/ZB.MOM.WW.OtOpcUa.Driver.S7.IntegrationTests.csproj"/>
         <Project Path="tests/ZB.MOM.WW.OtOpcUa.Driver.AbCip.Tests/ZB.MOM.WW.OtOpcUa.Driver.AbCip.Tests.csproj"/>
         <Project Path="tests/ZB.MOM.WW.OtOpcUa.Driver.AbLegacy.Tests/ZB.MOM.WW.OtOpcUa.Driver.AbLegacy.Tests.csproj"/>
+        <Project Path="tests/ZB.MOM.WW.OtOpcUa.Driver.AbLegacy.IntegrationTests/ZB.MOM.WW.OtOpcUa.Driver.AbLegacy.IntegrationTests.csproj"/>
         <Project Path="tests/ZB.MOM.WW.OtOpcUa.Driver.TwinCAT.Tests/ZB.MOM.WW.OtOpcUa.Driver.TwinCAT.Tests.csproj"/>
+        <Project Path="tests/ZB.MOM.WW.OtOpcUa.Driver.TwinCAT.IntegrationTests/ZB.MOM.WW.OtOpcUa.Driver.TwinCAT.IntegrationTests.csproj"/>
         <Project Path="tests/ZB.MOM.WW.OtOpcUa.Driver.FOCAS.Tests/ZB.MOM.WW.OtOpcUa.Driver.FOCAS.Tests.csproj"/>
+        <Project Path="tests/ZB.MOM.WW.OtOpcUa.Driver.FOCAS.Shared.Tests/ZB.MOM.WW.OtOpcUa.Driver.FOCAS.Shared.Tests.csproj"/>
+        <Project Path="tests/ZB.MOM.WW.OtOpcUa.Driver.FOCAS.Host.Tests/ZB.MOM.WW.OtOpcUa.Driver.FOCAS.Host.Tests.csproj"/>
         <Project Path="tests/ZB.MOM.WW.OtOpcUa.Driver.AbCip.IntegrationTests/ZB.MOM.WW.OtOpcUa.Driver.AbCip.IntegrationTests.csproj"/>
         <Project Path="tests/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.Tests/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.Tests.csproj"/>
+        <Project Path="tests/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.IntegrationTests/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.IntegrationTests.csproj"/>
         <Project Path="tests/ZB.MOM.WW.OtOpcUa.Client.Shared.Tests/ZB.MOM.WW.OtOpcUa.Client.Shared.Tests.csproj"/>
         <Project Path="tests/ZB.MOM.WW.OtOpcUa.Client.CLI.Tests/ZB.MOM.WW.OtOpcUa.Client.CLI.Tests.csproj"/>
         <Project Path="tests/ZB.MOM.WW.OtOpcUa.Client.UI.Tests/ZB.MOM.WW.OtOpcUa.Client.UI.Tests.csproj"/>

docs/drivers/AbLegacy-Test-Fixture.md

@@ -0,0 +1,125 @@
+# AB Legacy test fixture
+
+Coverage map + gap inventory for the AB Legacy (PCCC) driver — SLC 500 /
+MicroLogix / PLC-5 / LogixPccc-mode.
+
+**TL;DR:** Docker integration-test scaffolding lives at
+`tests/ZB.MOM.WW.OtOpcUa.Driver.AbLegacy.IntegrationTests/` (task #224),
+reusing the AB CIP `ab_server` image in PCCC mode with per-family
+compose profiles (`slc500` / `micrologix` / `plc5`). Scaffold passes
+the skip-when-absent contract cleanly. **Wire-level round-trip against
+`ab_server` PCCC mode currently fails** with `BadCommunicationError`
+on read/write (verified 2026-04-20) — ab_server's PCCC server-side
+coverage is narrower than libplctag's PCCC client expects. The smoke
+tests target the correct shape for real hardware + should pass when
+`AB_LEGACY_ENDPOINT` points at a real SLC 5/05 / MicroLogix. Unit tests
+via `FakeAbLegacyTag` still carry the contract coverage.
+
+## What the fixture is
+
+**Integration layer** (task #224, scaffolded with a known ab_server
+gap):
+`tests/ZB.MOM.WW.OtOpcUa.Driver.AbLegacy.IntegrationTests/` with
+`AbLegacyServerFixture` (TCP-probes `localhost:44818`) + three smoke
+tests (parametric read across families, SLC500 write-then-read). Reuses
+the AB CIP `otopcua-ab-server:libplctag-release` image via a relative
+`build:` context in `Docker/docker-compose.yml` — one image, different
+`--plc` flags. See `Docker/README.md` §Known limitations for the
+ab_server PCCC round-trip gap + resolution paths.
+
+**Unit layer**: `tests/ZB.MOM.WW.OtOpcUa.Driver.AbLegacy.Tests/` is
+still the primary coverage. All tests tagged `[Trait("Category", "Unit")]`.
+The driver accepts `IAbLegacyTagFactory` via ctor DI; every test
+supplies a `FakeAbLegacyTag`.
+
+## What it actually covers (unit only)
+
+- `AbLegacyAddressTests` — PCCC address parsing for SLC / MicroLogix / PLC-5
+  / LogixPccc-mode (`N7:0`, `F8:12`, `B3:0/5`, etc.)
+- `AbLegacyCapabilityTests` — data type mapping, read-only enforcement
+- `AbLegacyReadWriteTests` — read + write happy + error paths against the fake
+- `AbLegacyBitRmwTests` — bit-within-DINT read-modify-write serialization via
+  per-parent `SemaphoreSlim` (mirrors the AB CIP + FOCAS PMC-bit pattern from #181)
+- `AbLegacyHostAndStatusTests` — probe + host-status transitions driven by
+  fake-returned statuses
+- `AbLegacyDriverTests` — `IDriver` lifecycle
+
+Capability surfaces whose contract is verified: `IDriver`, `IReadable`,
+`IWritable`, `ITagDiscovery`, `ISubscribable`, `IHostConnectivityProbe`,
+`IPerCallHostResolver`.
+
+## What it does NOT cover
+
+### 1. Wire-level PCCC
+
+No PCCC frame is sent by the test suite. libplctag's PCCC subset (DF1,
+ControlNet-over-EtherNet, PLC-5 native EtherNet) is untested here;
+driver-side correctness depends on libplctag being correct.
+
+### 2. Family-specific behavior
+
+- SLC 500 timeout + retry thresholds (SLC's comm module has known slow-response
+  edges) — unit fakes don't simulate timing.
+- MicroLogix 1100 / 1400 max-connection-count limits — not stressed.
+- PLC-5 native EtherNet connection setup (PCCC-encapsulated-in-CIP vs raw
+  CSPv4) — routing covered at parse level only.
+
+### 3. Multi-device routing
+
+`IPerCallHostResolver` contract is verified; real PCCC wire routing across
+multiple gateways is not.
+
+### 4. Alarms / history
+
+PCCC has no alarm object + no history object. Driver doesn't implement
+`IAlarmSource` or `IHistoryProvider` — no test coverage is the correct shape.
+
+### 5. File-type coverage
+
+PCCC has many file types (N, F, B, T, C, R, S, ST, A) — the parser tests
+cover the common ones but uncommon ones (`R` counters, `S` status files,
+`A` ASCII strings) have thin coverage.
+
+## When to trust AB Legacy tests, when to reach for a rig
+
+| Question | Unit tests | Real PLC |
+| --- | --- | --- |
+| "Does `N7:0/5` parse correctly?" | yes | - |
+| "Does bit-in-word RMW serialize concurrent writers?" | yes | yes |
+| "Does the driver lifecycle hang / crash?" | yes | yes |
+| "Does a real read against an SLC 500 return correct bytes?" | no | yes (required) |
+| "Does MicroLogix 1100 respect its connection-count cap?" | no | yes (required) |
+| "Do PLC-5 ST-files round-trip correctly?" | no | yes (required) |
+
+## Follow-up candidates
+
+1. **Fix ab_server PCCC coverage upstream** — the scaffold lands the
+   Docker infrastructure; the wire-level round-trip gap is in ab_server
+   itself. Filing a patch to `libplctag/libplctag` to expand PCCC
+   server-side opcode coverage would make the scaffolded smoke tests
+   pass without a golden-box tier.
+2. **Rockwell RSEmulate 500 golden-box tier** — Rockwell's real emulator
+   for SLC/MicroLogix/PLC-5. Would close UDT-equivalent (integer-file
+   indirection), timer/counter decomposition, and real ladder execution
+   gaps. Costs: RSLinx OEM license, Windows-only, Hyper-V conflict
+   matching TwinCAT XAR + Logix Emulate, no clean PR-diffable project
+   format (SLC/ML save as binary `.RSS`). Scaffold like the Logix
+   Emulate tier when operationally worth it.
+3. **Lab rig** — used SLC 5/05 or MicroLogix 1100 on a dedicated
+   network; parts are end-of-life but still available. PLC-5 +
+   LogixPccc-mode behaviour + DF1 serial need specific controllers.
+
+## Key fixture / config files
+
+- `tests/ZB.MOM.WW.OtOpcUa.Driver.AbLegacy.IntegrationTests/AbLegacyServerFixture.cs`
+  — TCP probe + skip attributes + env-var parsing
+- `tests/ZB.MOM.WW.OtOpcUa.Driver.AbLegacy.IntegrationTests/AbLegacyReadSmokeTests.cs`
+  — three wire-level smoke tests (currently blocked by ab_server PCCC gap)
+- `tests/ZB.MOM.WW.OtOpcUa.Driver.AbLegacy.IntegrationTests/Docker/docker-compose.yml`
+  — compose profiles reusing AB CIP Dockerfile
+- `tests/ZB.MOM.WW.OtOpcUa.Driver.AbLegacy.IntegrationTests/Docker/README.md`
+  — known-limitations write-up + resolution paths
+- `tests/ZB.MOM.WW.OtOpcUa.Driver.AbLegacy.Tests/FakeAbLegacyTag.cs` —
+  in-process fake + factory
+- `src/ZB.MOM.WW.OtOpcUa.Driver.AbLegacy/AbLegacyDriver.cs` — scope remarks
+  at the top of the file

docs/drivers/AbServer-Test-Fixture.md

@@ -0,0 +1,216 @@
+# ab_server test fixture
+
+Coverage map + gap inventory for the AB CIP integration fixture backed by
+libplctag's `ab_server` simulator.
+
+**TL;DR:** `ab_server` is a connectivity + atomic-read smoke harness for the AB
+CIP driver. It does **not** benchmark UDTs, alarms, or any family-specific
+quirk. UDT / alarm / quirk behavior is verified only by unit tests with
+`FakeAbCipTagRuntime`.
+
+## What the fixture is
+
+- **Binary**: `ab_server` — a C program in libplctag's
+  `src/tools/ab_server/` ([libplctag/libplctag](https://github.com/libplctag/libplctag),
+  MIT).
+- **Launcher**: Docker (only supported path). `Docker/Dockerfile`
+  multi-stage-builds `ab_server` from source against a pinned libplctag
+  tag + copies the binary into a slim runtime image.
+  `Docker/docker-compose.yml` has per-family services (`controllogix`
+  / `compactlogix` / `micro800` / `guardlogix`); all bind `:44818`.
+- **Lifecycle**: `AbServerFixture` TCP-probes `127.0.0.1:44818` at
+  collection init + records a skip reason when unreachable. Tests skip
+  via `[AbServerFact]` / `[AbServerTheory]` which check the same probe.
+- **Profiles**: `KnownProfiles.{ControlLogix, CompactLogix, Micro800, GuardLogix}`
+  in `AbServerProfile.cs` — thin Family + ComposeProfile + Notes records;
+  the compose file is the canonical source of truth for which tags get
+  seeded + which `--plc` mode the simulator boots in.
+- **Tests**: one smoke, `AbCipReadSmokeTests.Driver_reads_seeded_DInt_from_ab_server`,
+  parametrized over all four profiles via `[AbServerTheory]` + `[MemberData]`.
+- **Endpoint override**: `AB_SERVER_ENDPOINT=host:port` points the
+  fixture at a real PLC instead of the local container.
+
+## What it actually covers
+
+- Read path: driver → libplctag → CIP-over-EtherNet/IP → simulator → back.
+- Atomic Logix types per seed: `DINT`, `REAL`, `BOOL`, `SINT`, `STRING`.
+- One `DINT[16]` array tag (ControlLogix profile only).
+- `--plc controllogix` and `--plc compactlogix` mode dispatch.
+- The skip-on-missing-binary behavior (`AbServerFactAttribute`) so a fresh
+  clone without the simulator stays green.
+
+## What it does NOT cover
+
+Each gap below is either stated explicitly in the profile's `Notes` field or
+inferable from the seed-tag set + smoke-test surface.
+
+### 1. UDTs / CIP Template Object (class 0x6C)
+
+ControlLogix profile `Notes`: *"ab_server lacks full UDT emulation."*
+
+Unverified against `ab_server`:
+
+- PR 6 structured read/write (`AbCipStructureMember` fan-out)
+- #179 Template Object shape reader (`CipTemplateObjectDecoder` + `FetchUdtShapeAsync`)
+- #194 whole-UDT read optimization (`AbCipUdtReadPlanner` +
+  `AbCipUdtMemberLayout` + the `ReadGroupAsync` path in `AbCipDriver`)
+
+Unit coverage: `AbCipFetchUdtShapeTests`, `CipTemplateObjectDecoderTests`,
+`AbCipUdtMemberLayoutTests`, `AbCipUdtReadPlannerTests`,
+`AbCipDriverWholeUdtReadTests` — all with golden Template-Object byte buffers
++ offset-keyed `FakeAbCipTag` values.
+
+### 2. ALMD / ALMA alarm projection (#177)
+
+Depends on the ALMD UDT shape, which `ab_server` cannot emulate. The
+`OnAlarmEvent` raise/clear path + ack-write semantics are not exercised
+end-to-end.
+
+Unit coverage: `AbCipAlarmProjectionTests` — fakes feed `InFaulted` /
+`Severity` via `ValuesByOffset` + assert the emitted `AlarmEventArgs`.
+
+### 3. Micro800 unconnected-only path
+
+Micro800 profile `Notes`: *"ab_server has no --plc micro800 — falls back to
+controllogix emulation."*
+
+The empty routing path + unconnected-session requirement (PR 11) is unit-tested
+but never challenged at the CIP wire level. Real Micro800 (2080-series) on a
+lab rig would be the authoritative benchmark.
+
+### 4. GuardLogix safety subsystem
+
+GuardLogix profile `Notes`: *"ab_server doesn't emulate the safety
+subsystem."*
+
+Only the `_S`-suffix naming classifier (PR 12, `SecurityClassification.ViewOnly`
+forced on safety tags) runs. Actual safety-partition write rejection — what
+happens when a non-safety write lands on a real `1756-L8xS` — is not exercised.
+
+### 5. CompactLogix narrow ConnectionSize cap
+
+CompactLogix profile `Notes`: *"ab_server lacks the narrower limit itself."*
+
+Driver-side `AbCipPlcFamilyProfile` caps `ConnectionSize` at the CompactLogix
+value per PR 10, but `ab_server` accepts whatever the client asks for — the
+cap's correctness is trusted from its unit test, never stressed against a
+simulator that rejects oversized requests.
+
+### 6. BOOL-within-DINT read-modify-write (#181)
+
+The `AbCipDriver.WriteBitInDIntAsync` RMW path + its per-parent `SemaphoreSlim`
+serialization is unit-tested only (`AbCipBoolInDIntRmwTests`). `ab_server`
+seeds a plain `TestBOOL` tag; the `.N` bit-within-DINT syntax that triggers
+the RMW path is not exercised end-to-end.
+
+### 7. Capability surfaces beyond read
+
+No smoke test for:
+
+- `IWritable.WriteAsync`
+- `ITagDiscovery.DiscoverAsync` (`@tags` walker)
+- `ISubscribable.SubscribeAsync` (poll-group engine)
+- `IHostConnectivityProbe` state transitions under wire failure
+- `IPerCallHostResolver` multi-device routing
+
+The driver implements all of these + they have unit coverage, but the only
+end-to-end path `ab_server` validates today is atomic `ReadAsync`.
+
+## Logix Emulate golden-box tier
+
+Rockwell Studio 5000 Logix Emulate sits **above** ab_server in fidelity +
+**below** real hardware. When an operator has Emulate running on a
+reachable Windows box + sets two env vars, the suite promotes several
+behaviours from unit-only to end-to-end wire-level coverage:
+
+```powershell
+$env:AB_SERVER_PROFILE  = 'emulate'
+$env:AB_SERVER_ENDPOINT = '<emulate-pc-ip>:44818'
+dotnet test tests\ZB.MOM.WW.OtOpcUa.Driver.AbCip.IntegrationTests
+```
+
+With `AB_SERVER_PROFILE` unset or `abserver`, the Emulate-tier classes
+skip cleanly + the ab_server Docker fixture runs as usual.
+
+| Gap this fixture doc calls out | ab_server | Logix Emulate | Real hardware |
+|---|---|---|---|
+| UDT / CIP Template Object (task #194) | no | **yes** | yes |
+| ALMD alarm projection (task #177) | no | **yes** | yes |
+| `@tags` Symbol Object walk with `Program:` scope | partial | **yes** | yes |
+| Add-On Instructions | no | **yes** | yes |
+| GuardLogix safety-partition write rejection | no | **yes** (Emulate 5580) | yes |
+| CompactLogix narrow ConnectionSize enforcement | no | **yes** (5370 firmware) | yes |
+| EtherNet/IP embedded-switch behaviour | no | no | yes |
+| Redundant chassis failover (1756-RM) | no | no | yes |
+| Motion control timing | no | no | yes |
+
+**Tests that promote to Emulate** (gated on `AB_SERVER_PROFILE=emulate`
+via `AbServerProfileGate.SkipUnless`):
+
+- `AbCipEmulateUdtReadTests.WholeUdt_read_decodes_each_member_at_its_Template_Object_offset`
+  — #194 whole-UDT optimization, verified against real Template Object
+  bytes
+- `AbCipEmulateAlmdTests.Real_ALMD_raise_fires_OnAlarmEvent_through_the_driver_projection`
+  — #177 ALMD projection, verified against the real ALMD instruction
+
+**Required Studio 5000 project state** is documented in
+[`tests/…/AbCip.IntegrationTests/LogixProject/README.md`](../../tests/ZB.MOM.WW.OtOpcUa.Driver.AbCip.IntegrationTests/LogixProject/README.md);
+the `.L5X` export lands there once the Emulate PC is on-site + the
+project is authored.
+
+**Costs to accept**:
+
+- **Rockwell TechConnect or per-seat license** — not redistributable;
+  not CI-runnable. Each operator licenses their own Emulate install.
+- **Windows-only + Hyper-V conflict** — Emulate can't coexist with
+  Docker Desktop's WSL 2 backend on the same OS, same way TwinCAT XAR
+  can't (see `docs/v2/dev-environment.md` §Integration host).
+- **Manual lifecycle** — no `docker compose up` equivalent; operator
+  opens Emulate, loads the L5X, clicks Run. The L5X in the repo keeps
+  project state reproducible, runtime-start is human.
+
+## When to trust ab_server, when to reach for a rig
+
+| Question | ab_server | Unit tests | Logix Emulate | Lab rig |
+| --- | --- | --- | --- | --- |
+| "Does the driver talk CIP at all?" | yes | - | yes | - |
+| "Is my atomic read path wired correctly?" | yes | yes | yes | yes |
+| "Does whole-UDT grouping work?" | no | yes | **yes** | yes |
+| "Do ALMD alarms raise + clear?" | no | yes | **yes** | yes |
+| "Is Micro800 unconnected-only enforced wire-side?" | no (emulated as CLX) | partial | yes | yes (required) |
+| "Does GuardLogix reject non-safety writes on safety tags?" | no | no | yes (Emulate 5580) | yes |
+| "Does CompactLogix refuse oversized ConnectionSize?" | no | partial | yes (5370 firmware) | yes |
+| "Does BOOL-in-DINT RMW race against concurrent writers?" | no | yes | partial | yes (stress) |
+| "Does EtherNet/IP embedded-switch behave correctly?" | no | no | no | yes (required) |
+| "Does redundant-chassis failover work?" | no | no | no | yes (required) |
+
+## Follow-up candidates
+
+If integration-level UDT / alarm / quirk proof becomes a shipping gate, the
+options are roughly:
+
+1. **Logix Emulate golden-box tier** (scaffolded; see the section above) —
+   highest-fidelity path short of real hardware. Closes UDT / ALMD / AOI /
+   optimized-DB gaps in one license + one Windows PC.
+2. **Extend `ab_server`** upstream — the project accepts PRs + already
+   carries a CIP framing layer that UDT emulation could plug into.
+3. **Stand up a lab rig** — physical `1756-L7x` / `5069-L3x` / `2080-LC30`
+   / `1756-L8xS` controllers. The only path that covers safety partitions
+   across nodes, redundant chassis, embedded-switch behaviour, and motion
+   timing.
+
+See also:
+
+- `tests/ZB.MOM.WW.OtOpcUa.Driver.AbCip.IntegrationTests/AbServerFixture.cs`
+- `tests/ZB.MOM.WW.OtOpcUa.Driver.AbCip.IntegrationTests/AbServerProfile.cs`
+- `tests/ZB.MOM.WW.OtOpcUa.Driver.AbCip.IntegrationTests/AbServerProfileGate.cs`
+  — `AB_SERVER_PROFILE` tier gate
+- `tests/ZB.MOM.WW.OtOpcUa.Driver.AbCip.IntegrationTests/AbCipReadSmokeTests.cs`
+- `tests/ZB.MOM.WW.OtOpcUa.Driver.AbCip.IntegrationTests/Docker/` — ab_server
+  image + compose
+- `tests/ZB.MOM.WW.OtOpcUa.Driver.AbCip.IntegrationTests/Emulate/` — Logix
+  Emulate tier tests
+- `tests/ZB.MOM.WW.OtOpcUa.Driver.AbCip.IntegrationTests/LogixProject/README.md`
+  — L5X project state the Emulate tier expects
+- `docs/v2/test-data-sources.md` §2 — the broader test-data-source picking
+  rationale this fixture slots into

docs/drivers/FOCAS-Test-Fixture.md

@@ -0,0 +1,115 @@
+# FOCAS test fixture
+
+Coverage map + gap inventory for the FANUC FOCAS2 CNC driver.
+
+**TL;DR: there is no integration fixture.** Every test uses a
+`FakeFocasClient` injected via `IFocasClientFactory`. Fanuc's FOCAS library
+(`Fwlib32.dll`) is closed-source proprietary with no public simulator;
+CNC-side behavior is trusted from field deployments.
+
+## What the fixture is
+
+Nothing at the integration layer.
+`tests/ZB.MOM.WW.OtOpcUa.Driver.FOCAS.Tests/` is unit-only. The driver ships
+as Tier C (process-isolated) per `docs/v2/driver-stability.md` because the
+FANUC DLL has known crash modes; tests can't replicate those in-process.
+
+## What it actually covers (unit only)
+
+- `FocasCapabilityTests` — data-type mapping (PMC bit / word / float,
+  macro variable types, parameter types)
+- `FocasCapabilityMatrixTests` — per-CNC-series range validation (macro
+  / parameter / PMC letter + number) across 16i / 0i-D / 0i-F /
+  30i / PowerMotion. See [`docs/v2/focas-version-matrix.md`](../v2/focas-version-matrix.md)
+  for the authoritative matrix. 46 theory cases lock every documented
+  range boundary — widening a range without updating the doc fails a
+  test.
+- `FocasReadWriteTests` — read + write against the fake, FOCAS native status
+  → OPC UA StatusCode mapping
+- `FocasScaffoldingTests` — `IDriver` lifecycle + multi-device routing
+- `FocasPmcBitRmwTests` — PMC bit read-modify-write synchronization (per-byte
+  `SemaphoreSlim`, mirrors the AB / Modbus pattern from #181)
+- `FwlibNativeHelperTests` — `Focas32.dll` → `Fwlib32.dll` bridge validation
+  + P/Invoke signature validation
+
+Capability surfaces whose contract is verified: `IDriver`, `IReadable`,
+`IWritable`, `ITagDiscovery`, `ISubscribable`, `IHostConnectivityProbe`,
+`IPerCallHostResolver`.
+
+Pre-flight validation runs in `FocasDriver.InitializeAsync` — configs
+referencing out-of-range addresses fail at load time with a diagnostic
+message naming the CNC series + documented limit. This closes the
+cheap half of the hardware-free stability gap; Tier-C process
+isolation (task #220) closes the expensive half — see
+[`docs/v2/implementation/focas-isolation-plan.md`](../v2/implementation/focas-isolation-plan.md).
+
+## What it does NOT cover
+
+### 1. FOCAS wire traffic
+
+No FOCAS TCP frame is sent. `Fwlib32.dll`'s TCP-to-FANUC-gateway exchange is
+closed-source; the driver trusts the P/Invoke layer per #193. Real CNC
+correctness is trusted from field deployments.
+
+### 2. Alarm / parameter-change callbacks
+
+FOCAS has no push model — the driver polls via the shared `PollGroupEngine`.
+There are no CNC-initiated callbacks to test; the absence is by design.
+
+### 3. Macro / ladder variable types
+
+FANUC has CNC-specific extensions (macro variables `#100-#999`, system
+variables `#1000-#5000`, PMC timers / counters / keep-relays) whose
+per-address semantics differ across 0i-F / 30i / 31i / 32i Series. Driver
+covers the common address shapes; per-model quirks are not stressed.
+
+### 4. Model-specific behavior
+
+- Alarm retention across power cycles (model-specific CNC behavior)
+- Parameter range enforcement (CNC rejects out-of-range writes)
+- MTB (machine tool builder) custom screens that expose non-standard data
+
+### 5. Tier-C process isolation behavior
+
+Per driver-stability.md, FOCAS should run process-isolated because
+`Fwlib32.dll` has documented crash modes. The test suite runs in-process +
+only exercises the happy path + mapped error codes — a native access
+violation from the DLL would take the test host down. The process-isolation
+path (similar to Galaxy's out-of-process Host) has been scoped but not
+implemented.
+
+## When to trust FOCAS tests, when to reach for a rig
+
+| Question | Unit tests | Real CNC |
+| --- | --- | --- |
+| "Does PMC address `R100.3` route to the right bit?" | yes | yes |
+| "Does the FANUC status → OPC UA StatusCode map cover every documented code?" | yes (contract) | yes |
+| "Does a real read against a 30i Series return correct bytes?" | no | yes (required) |
+| "Does `Fwlib32.dll` crash on concurrent reads?" | no | yes (stress) |
+| "Do macro variables round-trip across power cycles?" | no | yes (required) |
+
+## Follow-up candidates
+
+1. **Nothing public** — Fanuc's FOCAS Developer Kit ships an emulator DLL
+   but it's under NDA + tied to licensed dev-kit installations; can't
+   redistribute for CI.
+2. **Lab rig** — used FANUC 0i-F simulator controller (or a retired machine
+   tool) on a dedicated network; only path that covers real CNC behavior.
+3. **Process isolation first** — before trusting FOCAS in production at
+   scale, shipping the Tier-C out-of-process Host architecture (similar to
+   Galaxy) is higher value than a CI simulator.
+
+## Key fixture / config files
+
+- `tests/ZB.MOM.WW.OtOpcUa.Driver.FOCAS.Tests/FakeFocasClient.cs` —
+  in-process fake implementing `IFocasClient`
+- `tests/ZB.MOM.WW.OtOpcUa.Driver.FOCAS.Tests/FocasCapabilityMatrixTests.cs`
+  — parameterized theories locking the per-series matrix
+- `src/ZB.MOM.WW.OtOpcUa.Driver.FOCAS/FocasDriver.cs` — ctor takes
+  `IFocasClientFactory`
+- `src/ZB.MOM.WW.OtOpcUa.Driver.FOCAS/FocasCapabilityMatrix.cs` —
+  per-CNC-series range validator (the matrix the doc describes)
+- `docs/v2/focas-version-matrix.md` — authoritative range reference
+- `docs/v2/implementation/focas-isolation-plan.md` — Tier-C isolation
+  plan (task #220)
+- `docs/v2/driver-stability.md` — Tier C scope + process-isolation rationale

docs/drivers/Galaxy-Test-Fixture.md

@@ -0,0 +1,164 @@
+# Galaxy test fixture
+
+Coverage map + gap inventory for the Galaxy driver — out-of-process Host
+(net48 x86 MXAccess COM) + Proxy (net10) + Shared protocol.
+
+**TL;DR: Galaxy has the richest test harness in the fleet** — real Host
+subprocess spawn, real ZB SQL queries, IPC parity checks against the v1
+LmxProxy reference, + live-smoke tests when MXAccess runtime is actually
+installed. Gaps are live-plant + failover-shaped: the E2E suite covers the
+representative ~50-tag deployment but not large-site discovery stress, real
+Rockwell/Siemens PLC enumeration through MXAccess, or ZB SQL Always-On
+replica failover.
+
+## What the fixture is
+
+Multi-project test topology:
+
+- **E2E parity** —
+  `tests/ZB.MOM.WW.OtOpcUa.Driver.Galaxy.E2E/ParityFixture.cs` spawns the
+  production `OtOpcUa.Driver.Galaxy.Host.exe` as a subprocess, opens the
+  named-pipe IPC, connects `GalaxyProxyDriver` + runs hierarchy / stability
+  parity tests against both.
+- **Host.Tests** —
+  `tests/ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Host.Tests/` — direct Host process
+  testing (18+ test classes covering alarm discovery, AVEVA prerequisite
+  checks, IPC dispatcher, alarm tracker, probe manager, historian
+  cluster/quality/wiring, history read, OPC UA attribute mapping,
+  subscription lifecycle, reconnect, multi-host proxy, ADS address routing,
+  expression evaluation) + `GalaxyRepositoryLiveSmokeTests` that hit real
+  ZB SQL.
+- **Proxy.Tests** — `GalaxyProxyDriver` client contract tests.
+- **Shared.Tests** — shared protocol + address model.
+- **TestSupport** — test helpers reused across the above.
+
+## How tests skip
+
+- **E2E parity**: `ParityFixture.SkipIfUnavailable()` runs at class init and
+  checks Windows-only, non-admin user, ZB SQL reachable on
+  `localhost:1433`, Host EXE built in the expected `bin/` folder. Any miss
+  → tests skip.
+- **Live-smoke** (`GalaxyRepositoryLiveSmokeTests`): `Assert.Skip` when ZB
+  unreachable. A `per project_galaxy_host_installed` memory on this repo's
+  dev box notes the MXAccess runtime is installed + pipe ACL denies Admins,
+  so live tests must run from a non-elevated shell.
+- **Unit** tests (Shared, Proxy contract, most Host.Tests) have no skip —
+  they run anywhere.
+
+## What it actually covers
+
+### E2E parity suite
+
+- `HierarchyParityTests` — Host address-space hierarchy vs v1 LmxProxy
+  reference (same ZB, same Galaxy, same shape)
+- `StabilityFindingsRegressionTests` — probe subscription failure
+  handling + host-status mutation guard from the v1 stability findings
+  backlog
+
+### Host.Tests (representative)
+
+- Alarm discovery → subsystem setup
+- AVEVA prerequisite checks (runtime installed, platform deployed, etc.)
+- IPC dispatcher — request/response routing over the named pipe
+- Alarm tracker state machine
+- Probe manager — per-runtime probe subscription + reconnect
+- Historian cluster / quality / wiring — Aveva Historian integration
+- OPC UA attribute mapping
+- Subscription lifecycle + reconnect
+- Multi-host proxy routing
+- ADS address routing + expression evaluation (Galaxy's legacy expression
+  language)
+
+### Live-smoke
+
+- `GalaxyRepositoryLiveSmokeTests` — real SQL against ZB database, verifies
+  the ZB schema + `LocalPlatform` scope filter + change-detection query
+  shape match production.
+
+### Capability surfaces hit
+
+All of them: `IDriver`, `IReadable`, `IWritable`, `ITagDiscovery`,
+`ISubscribable`, `IHostConnectivityProbe`, `IPerCallHostResolver`,
+`IAlarmSource`, `IHistoryProvider`. Galaxy is the only driver where every
+interface sees both contract + real-integration coverage.
+
+## What it does NOT cover
+
+### 1. MXAccess COM by default
+
+The E2E parity suite backs subscriptions via the DB-only path; MXAccess COM
+integration opts in via a separate live-smoke. So "does the MXAccess STA
+pump correctly handle real Wonderware runtime events" is exercised only
+when the operator runs live smoke on a machine with MXAccess installed.
+
+### 2. Real Rockwell / Siemens PLC enumeration
+
+Galaxy runtime talks to PLCs through MXAccess (Device Integration Objects).
+The CI parity suite uses a representative ~50-tag deployment; large sites
+(1000+ tag hierarchies, multi-Galaxy replication, deeply-nested templates)
+are not stressed.
+
+### 3. ZB SQL Always-On failover
+
+Live-smoke hits a single SQL instance. Real production ZB often runs on
+Always-On availability groups; replica failover behavior is not tested.
+
+### 4. Galaxy replication / backup-restore
+
+Galaxy supports backup + partial replication across platforms — these
+rewrite the ZB schema in ways that change the contained_name vs tag_name
+mapping. Not exercised.
+
+### 5. Historian failover
+
+Aveva Historian can be clustered. `historian cluster / quality` tests
+verify the cluster-config query; they don't exercise actual failover
+(primary dies → secondary takes over mid-HistoryRead).
+
+### 6. AVEVA runtime version matrix
+
+MXAccess COM contract varies subtly across System Platform 2017 / 2020 /
+2023. The live-smoke runs against whatever version is installed on the dev
+box; CI has no AVEVA installed at all (licensing + footprint).
+
+## When to trust the Galaxy suite, when to reach for a live plant
+
+| Question | E2E parity | Live-smoke | Real plant |
+| --- | --- | --- | --- |
+| "Does Host spawn + IPC round-trip work?" | yes | yes | yes |
+| "Does the ZB schema query match production shape?" | partial | yes | yes |
+| "Does MXAccess COM handle runtime reconnect correctly?" | no | yes | yes |
+| "Does the driver scale to 1000+ tags on one Galaxy?" | no | partial | yes (required) |
+| "Does historian failover mid-read return a clean error?" | no | no | yes (required) |
+| "Does System Platform 2023's MXAccess differ from 2020?" | no | partial | yes (required) |
+| "Does ZB Always-On replica failover preserve generation?" | no | no | yes (required) |
+
+## Follow-up candidates
+
+1. **System Platform 2023 live-smoke matrix** — set up a second dev box
+   running SP2023; run the same live-smoke against both to catch COM-contract
+   drift early.
+2. **Synthetic large-site fixture** — script a ZB populator that creates a
+   1000-Equipment / 20000-tag hierarchy, run the parity suite against it.
+   Catches O(N) → O(N²) discovery regressions.
+3. **Historian failover scripted test** — with a two-node AVEVA Historian
+   cluster, tear down primary mid-HistoryRead + verify the driver's failover
+   behavior + error surface.
+4. **ZB Always-On CI** — SQL Server 2022 on Linux supports Always-On;
+   could stand up a two-replica group for replica-failover coverage.
+
+This is already the best-tested driver; the remaining work is site-scale
++ production-topology coverage, not capability coverage.
+
+## Key fixture / config files
+
+- `tests/ZB.MOM.WW.OtOpcUa.Driver.Galaxy.E2E/ParityFixture.cs` — E2E fixture
+  that spawns Host + connects Proxy
+- `tests/ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Host.Tests/GalaxyRepositoryLiveSmokeTests.cs`
+  — live ZB smoke with `Assert.Skip` gate
+- `tests/ZB.MOM.WW.OtOpcUa.Driver.Galaxy.TestSupport/` — shared helpers
+- `docs/drivers/Galaxy.md` — COM bridge + STA pump + IPC architecture
+- `docs/drivers/Galaxy-Repository.md` — ZB SQL reader + `LocalPlatform`
+  scope filter + change detection
+- `docs/v2/aveva-system-platform-io-research.md` — MXAccess + Wonderware
+  background

docs/drivers/Modbus-Test-Fixture.md

@@ -0,0 +1,117 @@
+# Modbus test fixture
+
+Coverage map + gap inventory for the Modbus TCP driver's integration-test
+harness backed by `pymodbus` simulator profiles per PLC family.
+
+**TL;DR:** Modbus is the best-covered driver — a real `pymodbus` server on
+localhost with per-family seed-register profiles, plus a skip-gate when the
+simulator port isn't reachable. Covers DL205 / Mitsubishi MELSEC / Siemens
+S7-1500 family quirks end-to-end. Gaps are mostly error-path + alarm/history
+shaped (neither is a Modbus-side concept).
+
+## What the fixture is
+
+- **Simulator**: `pymodbus` (Python, BSD) launched as a pinned Docker
+  container at
+  `tests/ZB.MOM.WW.OtOpcUa.Driver.Modbus.IntegrationTests/Docker/`.
+  Docker is the only supported launch path.
+- **Lifecycle**: `ModbusSimulatorFixture` (collection-scoped) TCP-probes
+  `localhost:5020` on first use. `MODBUS_SIM_ENDPOINT` env var overrides the
+  endpoint so the same suite can target a real PLC.
+- **Profiles**: `DL205Profile`, `MitsubishiProfile`, `S7_1500Profile` —
+  each composes device-specific register-format + quirk-seed JSON for pymodbus.
+  Profile JSONs live under `Docker/profiles/` and are baked into the image.
+- **Compose services**: one per profile (`standard` / `dl205` /
+  `mitsubishi` / `s7_1500`); only one binds `:5020` at a time.
+- **Tests skip** via `Assert.Skip(sim.SkipReason)` when the probe fails; no
+  custom FactAttribute needed because `ModbusSimulatorCollection` carries the
+  skip reason.
+
+## What it actually covers
+
+### DL205 (Automation Direct)
+
+- `DL205SmokeTests` — FC16 write → FC03 read round-trip on holding register
+- `DL205CoilMappingTests` — Y-output / C-relay / X-input address mapping
+  (octal → Modbus offset)
+- `DL205ExceptionCodeTests` — Modbus exception → OPC UA StatusCode mapping
+- `DL205FloatCdabQuirkTests` — CDAB word-swap float encoding
+- `DL205StringQuirkTests` — packed-string V-memory layout
+- `DL205VMemoryQuirkTests` — V-memory octal addressing
+- `DL205XInputTests` — X-register read-only enforcement
+
+### Mitsubishi MELSEC
+
+- `MitsubishiSmokeTests` — read + write round-trip
+- `MitsubishiQuirkTests` — word-order, device-code mapping (D/M/X/Y ranges)
+
+### Siemens S7-1500 (Modbus gateway flavor)
+
+- `S7_1500SmokeTests` — read + write round-trip
+- `S7_ByteOrderTests` — ABCD/DCBA/BADC/CDAB byte-order matrix
+
+### Capability surfaces hit
+
+- `IReadable` + `IWritable` — full round-trip
+- `ISubscribable` — via the shared `PollGroupEngine` (polled subscription)
+- `IHostConnectivityProbe` — TCP-reach transitions
+
+## What it does NOT cover
+
+### 1. No `ITagDiscovery`
+
+Modbus has no symbol table — the driver requires a static tag map from
+`DriverConfig`. There is no discovery path to test + none in the fixture.
+
+### 2. Error-path fuzzing
+
+`pymodbus` serves the seeded values happily; the fixture can't easily inject
+exception responses (code 0x01–0x0B) or malformed PDUs. The
+`AbCipStatusMapper`-equivalent for exception codes is unit-tested via
+`DL205ExceptionCodeTests` but the simulator itself never refuses a read.
+
+### 3. Variant-specific quirks beyond the three profiles
+
+- FX5U / QJ71MT91 Mitsubishi variants — profile scaffolds exist, no tests yet
+- Non-S7-1500 Siemens (S7-1200 / ET200SP) — byte-order covered but
+  connection-pool + fragmentation quirks untested
+- DL205-family cousins (DL06, DL260) — no dedicated profile
+
+### 4. Subscription stress
+
+`PollGroupEngine` is unit-tested standalone but the simulator doesn't exercise
+it under multi-register packing stress (FC03 with 125-register batches,
+boundary splits, etc.).
+
+### 5. Alarms / history
+
+Not a Modbus concept. Driver doesn't implement `IAlarmSource` or
+`IHistoryProvider`; no test coverage is the correct shape.
+
+## When to trust the Modbus fixture, when to reach for a rig
+
+| Question | Fixture | Unit tests | Real PLC |
+| --- | --- | --- | --- |
+| "Does FC03/FC06/FC16 work end-to-end?" | yes | - | yes |
+| "Does DL205 octal addressing map correctly?" | yes | yes | yes |
+| "Does float CDAB word-swap round-trip?" | yes | yes | yes |
+| "Does the driver handle exception responses?" | no | yes | yes (required) |
+| "Does packing 125 regs into one FC03 work?" | no | no | yes (required) |
+| "Does FX5U behave like Q-series?" | no | no | yes (required) |
+
+## Follow-up candidates
+
+1. Add `MODBUS_SIM_ENDPOINT` override documentation to
+   `docs/v2/test-data-sources.md` so operators can point the suite at a lab rig.
+2. Extend `pymodbus` profiles to inject exception responses — a JSON flag per
+   register saying "next read returns exception 0x04."
+3. Add an FX5U profile once a lab rig is available; the scaffolding is in place.
+
+## Key fixture / config files
+
+- `tests/ZB.MOM.WW.OtOpcUa.Driver.Modbus.IntegrationTests/ModbusSimulatorFixture.cs`
+- `tests/ZB.MOM.WW.OtOpcUa.Driver.Modbus.IntegrationTests/DL205/DL205Profile.cs`
+- `tests/ZB.MOM.WW.OtOpcUa.Driver.Modbus.IntegrationTests/Mitsubishi/MitsubishiProfile.cs`
+- `tests/ZB.MOM.WW.OtOpcUa.Driver.Modbus.IntegrationTests/S7/S7_1500Profile.cs`
+- `tests/ZB.MOM.WW.OtOpcUa.Driver.Modbus.IntegrationTests/Docker/` —
+  Dockerfile + compose + per-family JSON profiles

docs/drivers/OpcUaClient-Test-Fixture.md

@@ -0,0 +1,170 @@
+# OPC UA Client test fixture
+
+Coverage map + gap inventory for the OPC UA Client (gateway / aggregation)
+driver.
+
+**TL;DR:** Wire-level coverage now exists via
+[opc-plc](https://github.com/Azure-Samples/iot-edge-opc-plc) — Microsoft
+Industrial IoT's OPC UA PLC simulator running in Docker (task #215). Real
+Secure Channel, real Session, real MonitoredItem exchange against an
+independent server implementation. Unit tests still carry the exhaustive
+capability matrix (cert auth / security policies / reconnect / failover /
+attribute mapping). Gaps remaining: upstream-server-specific quirks
+(historian aggregates, typed ConditionType events, SDK-publish-queue edge
+behavior under load) — opc-plc uses the same OPCFoundation stack internally
+so fully-independent-stack coverage needs `open62541/open62541` as a second
+image (follow-up).
+
+## What the fixture is
+
+**Integration layer** (task #215):
+`tests/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.IntegrationTests/` stands up
+`mcr.microsoft.com/iotedge/opc-plc:2.14.10` via `Docker/docker-compose.yml`
+on `opc.tcp://localhost:50000`. `OpcPlcFixture` probes the port at
+collection init + skips tests with a clear message when the container's
+not running (matches the Modbus/pymodbus + S7/python-snap7 skip pattern).
+Docker is the launcher — no PowerShell wrapper needed because opc-plc
+ships pre-containerized. Compose-file flags: `--ut` (unsecured transport
+advertised), `--aa` (auto-accept client certs — opc-plc's cert trust store
+resets on each spin-up), `--alm` (alarm simulation for IAlarmSource
+follow-up coverage), `--pn=50000` (port).
+
+**Unit layer**:
+`tests/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.Tests/` is still the primary
+coverage. Tests inject fakes through the driver's construction path; the
+OPCFoundation.NetStandard `Session` surface is wrapped behind an interface
+the tests mock.
+
+## What it actually covers
+
+### Integration (opc-plc Docker, task #215)
+
+- `OpcUaClientSmokeTests.Client_connects_and_reads_StepUp_node_through_real_OPC_UA_stack` —
+  full Secure Channel + Session + `ns=3;s=StepUp` Read round-trip
+- `OpcUaClientSmokeTests.Client_reads_batch_of_varied_types_from_live_simulator` —
+  batch Read of UInt32 / Int32 / Boolean; asserts `bool`-specific Variant
+  decoding to catch a common attribute-mapping regression
+- `OpcUaClientSmokeTests.Client_subscribe_receives_StepUp_data_changes_from_live_server` —
+  real `MonitoredItem` subscription against `ns=3;s=FastUInt1` (ticks every
+  100 ms); asserts `OnDataChange` fires within 3 s of subscribe
+
+Wire-level surfaces verified: `IDriver` + `IReadable` + `ISubscribable` +
+`IHostConnectivityProbe` (via the Secure Channel exchange).
+
+### Unit
+
+The surface is broad because `OpcUaClientDriver` is the richest-capability
+driver in the fleet (it's a gateway for another OPC UA server, so it
+mirrors the full capability matrix):
+
+- `OpcUaClientDriverScaffoldTests` — `IDriver` lifecycle
+- `OpcUaClientReadWriteTests` — read + write lifecycle
+- `OpcUaClientSubscribeAndProbeTests` — monitored-item subscription + probe
+  state transitions
+- `OpcUaClientDiscoveryTests` — `GetEndpoints` + endpoint selection
+- `OpcUaClientAttributeMappingTests` — OPC UA node attribute → driver value
+  mapping
+- `OpcUaClientSecurityPolicyTests` — `SignAndEncrypt` / `Sign` / `None`
+  policy negotiation contract
+- `OpcUaClientCertAuthTests` — cert store paths, revocation-list config
+- `OpcUaClientReconnectTests` — SDK reconnect hook + `TransferSubscriptions`
+  across the disconnect boundary
+- `OpcUaClientFailoverTests` — primary → secondary session fallback per
+  driver config
+- `OpcUaClientAlarmTests` — A&E severity bucket (1–1000 → Low / Medium /
+  High / Critical), subscribe / unsubscribe / ack contract
+- `OpcUaClientHistoryTests` — historical data read + interpolation contract
+
+Capability surfaces whose contract is verified: `IDriver`, `ITagDiscovery`,
+`IReadable`, `IWritable`, `ISubscribable`, `IHostConnectivityProbe`,
+`IAlarmSource`, `IHistoryProvider`.
+
+## What it does NOT cover
+
+### 1. Real stack exchange
+
+No UA Secure Channel is ever opened. Every test mocks `Session.ReadAsync`,
+`Session.CreateSubscription`, `Session.AddItem`, etc. — the SDK itself is
+trusted. Certificate validation, signing, nonce handling, chunk assembly,
+keep-alive cadence — all SDK-internal and untested here.
+
+### 2. Subscription transfer across reconnect
+
+Contract test: "after a simulated reconnect, `TransferSubscriptions` is
+called with the right handles." Real behavior: SDK re-publishes against the
+new channel and some events can be lost depending on publish-queue state.
+The lossy window is not characterized.
+
+### 3. Large-scale subscription stress
+
+100+ monitored items with heterogeneous publish intervals under a single
+session — the shape that breaks publish-queue-size tuning in the wild — is
+not exercised.
+
+### 4. Real historian mappings
+
+`IHistoryProvider.ReadRawAsync` + `ReadProcessedAsync` +
+`ReadAtTimeAsync` + `ReadEventsAsync` are contract-mocked. Against a real
+historian (AVEVA Historian, Prosys historian, Kepware LocalHistorian) each
+has specific interpolation + bad-quality-handling quirks the contract test
+doesn't see.
+
+### 5. Real A&E events
+
+Alarm subscription is mocked via filtered monitored items; the actual
+`EventFilter` select-clause behavior against a server that exposes typed
+ConditionType events (non-base `BaseEventType`) is not verified.
+
+### 6. Authentication variants
+
+- Anonymous, UserName/Password, X509 cert tokens — each is contract-tested
+  but not exchanged against a server that actually enforces each.
+- LDAP-backed `UserName` (matching this repo's server-side
+  `LdapUserAuthenticator`) requires a live LDAP round-trip; not tested.
+
+## When to trust OpcUaClient tests, when to reach for a server
+
+| Question | Unit tests | Real upstream server |
+| --- | --- | --- |
+| "Does severity 750 bucket as High?" | yes | yes |
+| "Does the driver call `TransferSubscriptions` after reconnect?" | yes | yes |
+| "Does a real OPC UA read/write round-trip work?" | no | yes (required) |
+| "Does event-filter-based alarm subscription return ConditionType events?" | no | yes (required) |
+| "Does history read from AVEVA Historian return correct aggregates?" | no | yes (required) |
+| "Does the SDK's publish queue lose notifications under load?" | no | yes (stress) |
+
+## Follow-up candidates
+
+The easiest win here is to **wire the client driver tests against this
+repo's own server**. The integration test project
+`tests/ZB.MOM.WW.OtOpcUa.Server.Tests/OpcUaServerIntegrationTests.cs`
+already stands up a real OPC UA server on a non-default port with a seeded
+FakeDriver. An `OpcUaClientLiveLoopbackTests` that connects the client
+driver to that server would give:
+
+- Real Secure Channel negotiation
+- Real Session / Subscription / MonitoredItem exchange
+- Real read/write round-trip
+- Real certificate validation (the integration test already sets up PKI)
+
+It wouldn't cover upstream-server-specific quirks (AVEVA Historian, Kepware,
+Prosys), but it would cover 80% of the SDK surface the driver sits on top
+of.
+
+Beyond that:
+
+1. **Prosys OPC UA Simulation Server** — free, Windows-available, scriptable.
+2. **UaExpert Server-Side Simulator** — Unified Automation's sample server;
+   good coverage of typed ConditionType events.
+3. **Dedicated historian integration lab** — only path for
+   historian-specific coverage.
+
+## Key fixture / config files
+
+- `tests/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.Tests/` — unit tests with
+  mocked `Session`
+- `src/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient/OpcUaClientDriver.cs` — ctor +
+  session-factory seam tests mock through
+- `tests/ZB.MOM.WW.OtOpcUa.Server.Tests/OpcUaServerIntegrationTests.cs` —
+  the server-side integration harness a future loopback client test could
+  piggyback on

docs/drivers/README.md

@@ -37,6 +37,19 @@ Driver type metadata is registered at startup in `DriverTypeRegistry` (`src/ZB.M
 
 - **All other drivers** share a single per-driver specification in [docs/v2/driver-specs.md](../v2/driver-specs.md) — addressing, data-type maps, connection settings, and quirks live there. That file is the authoritative per-driver reference; this index points at it rather than duplicating.
 
+## Test-fixture coverage maps
+
+Each driver has a dedicated fixture doc that lays out what the integration / unit harness actually covers vs. what's trusted from field deployments. Read the relevant one before claiming "green suite = production-ready" for a driver.
+
+- [AB CIP](AbServer-Test-Fixture.md) — Dockerized `ab_server` (multi-stage build from libplctag source); atomic-read smoke across 4 families; UDT / ALMD / family quirks unit-only
+- [Modbus](Modbus-Test-Fixture.md) — Dockerized `pymodbus` + per-family JSON profiles (4 compose profiles); best-covered driver, gaps are error-path-shaped
+- [Siemens S7](S7-Test-Fixture.md) — Dockerized `python-snap7` server; DB/MB read + write round-trip verified end-to-end on `:1102`
+- [AB Legacy](AbLegacy-Test-Fixture.md) — Docker scaffold via `ab_server` PCCC mode (task #224); wire-level round-trip currently blocked by ab_server's PCCC coverage gap, docs call out RSEmulate 500 + lab-rig resolution paths
+- [TwinCAT](TwinCAT-Test-Fixture.md) — XAR-VM integration scaffolding (task #221); three smoke tests skip when VM unreachable. Unit via `FakeTwinCATClient` with native-notification harness
+- [FOCAS](FOCAS-Test-Fixture.md) — no integration fixture, unit-only via `FakeFocasClient`; Tier C out-of-process isolation scoped but not shipped
+- [OPC UA Client](OpcUaClient-Test-Fixture.md) — no integration fixture, unit-only via mocked `Session`; loopback against this repo's own server is the obvious next step
+- [Galaxy](Galaxy-Test-Fixture.md) — richest harness: E2E Host subprocess + ZB SQL live-smoke + MXAccess opt-in
+
 ## Related cross-driver docs
 
 - [HistoricalDataAccess.md](../HistoricalDataAccess.md) — `IHistoryProvider` dispatch, aggregate mapping, continuation points. The Galaxy driver's Aveva Historian implementation is the first; OPC UA Client forwards to the upstream server; other drivers do not implement the interface and return `BadHistoryOperationUnsupported`.

docs/drivers/S7-Test-Fixture.md

@@ -0,0 +1,121 @@
+# Siemens S7 test fixture
+
+Coverage map + gap inventory for the S7 driver.
+
+**TL;DR:** S7 now has a wire-level integration fixture backed by
+[python-snap7](https://github.com/gijzelaerr/python-snap7)'s `Server` class
+(task #216). Atomic reads (u16 / i16 / i32 / f32 / bool-with-bit) + DB
+write-then-read round-trip are exercised end-to-end through S7netplus +
+real ISO-on-TCP on `localhost:1102`. Unit tests still carry everything
+else (address parsing, error-branch handling, probe-loop contract). Gaps
+remaining are variant-quirk-shaped: Optimized-DB symbolic access, PG/OP
+session types, PUT/GET-disabled enforcement — all need real hardware.
+
+## What the fixture is
+
+**Integration layer** (task #216):
+`tests/ZB.MOM.WW.OtOpcUa.Driver.S7.IntegrationTests/` stands up a
+python-snap7 `Server` via `Docker/docker-compose.yml --profile s7_1500`
+on `localhost:1102` (pinned `python:3.12-slim-bookworm` base +
+`python-snap7>=2.0`). Docker is the only supported launch path.
+`Snap7ServerFixture` probes the port at collection init + skips with a
+clear message when unreachable (matches the pymodbus pattern).
+`server.py` (baked into the image under `Docker/`) reads a JSON profile
++ seeds DB/MB bytes at declared offsets; seeds are typed (`u16` / `i16`
+/ `i32` / `f32` / `bool` / `ascii` for S7 STRING).
+
+**Unit layer**: `tests/ZB.MOM.WW.OtOpcUa.Driver.S7.Tests/` covers
+everything the wire-level suite doesn't — address parsing, error
+branches, probe-loop contract. All tests tagged
+`[Trait("Category", "Unit")]`.
+
+The driver ctor change that made this possible:
+`Plc(CpuType, host, port, rack, slot)` — S7netplus 0.20's 5-arg overload
+— wires `S7DriverOptions.Port` through so the simulator can bind 1102
+(non-privileged) instead of 102 (root / Firewall-prompt territory).
+
+## What it actually covers
+
+### Integration (python-snap7, task #216)
+
+- `S7_1500SmokeTests.Driver_reads_seeded_u16_through_real_S7comm` — DB1.DBW0
+  read via real S7netplus over TCP + simulator; proves handshake + read path
+- `S7_1500SmokeTests.Driver_reads_seeded_typed_batch` — i16, i32, f32,
+  bool-with-bit in one batch call; proves typed decode per S7DataType
+- `S7_1500SmokeTests.Driver_write_then_read_round_trip_on_scratch_word` —
+  `DB1.DBW100` write → read-back; proves write path + buffer visibility
+
+### Unit
+
+- `S7AddressParserTests` — S7 address syntax (`DB1.DBD0`, `M10.3`, `IW4`, etc.)
+- `S7DriverScaffoldTests` — `IDriver` lifecycle (init / reinit / shutdown / health)
+- `S7DriverReadWriteTests` — error paths (uninitialized read/write, bad
+  addresses, transport exceptions)
+- `S7DiscoveryAndSubscribeTests` — `ITagDiscovery.DiscoverAsync` + polled
+  `ISubscribable` contract with the shared `PollGroupEngine`
+
+Capability surfaces whose contract is verified: `IDriver`, `ITagDiscovery`,
+`IReadable`, `IWritable`, `ISubscribable`, `IHostConnectivityProbe`.
+Wire-level surfaces verified: `IReadable`, `IWritable`.
+
+## What it does NOT cover
+
+### 1. Wire-level anything
+
+No ISO-on-TCP frame is ever sent during the test suite. S7netplus is the only
+wire-path abstraction and it has no in-process fake mode; the shipping choice
+was to contract-test via `IS7Client` rather than patch into S7netplus
+internals.
+
+### 2. Read/write happy path
+
+Every `S7DriverReadWriteTests` case exercises error branches. A successful
+read returning real PLC data is not tested end-to-end — the return value is
+whatever the fake says it is.
+
+### 3. Mailbox serialization under concurrent reads
+
+The driver's `SemaphoreSlim` serializes S7netplus calls because the S7 CPU's
+comm mailbox is scanned at most once per cycle. Contention behavior under
+real PLC latency is not exercised.
+
+### 4. Variant quirks
+
+S7-1200 vs S7-1500 vs S7-300/400 connection semantics (PG vs OP vs S7-Basic)
+not differentiated at test time.
+
+### 5. Data types beyond the scalars
+
+UDT fan-out, `STRING` with length-prefix quirks, `DTL` / `DATE_AND_TIME`,
+arrays of structs — not covered.
+
+## When to trust the S7 tests, when to reach for a rig
+
+| Question | Unit tests | Real PLC |
+| --- | --- | --- |
+| "Does the address parser accept X syntax?" | yes | - |
+| "Does the driver lifecycle hang / crash?" | yes | yes |
+| "Does a real read against an S7-1500 return correct bytes?" | no | yes (required) |
+| "Does mailbox serialization actually prevent PG timeouts?" | no | yes (required) |
+| "Does a UDT fan-out produce usable member variables?" | no | yes (required) |
+
+## Follow-up candidates
+
+1. **Snap7 server** — [Snap7](https://snap7.sourceforge.net/) ships a
+   C-library-based S7 server that could run in-CI on Linux. A pinned build +
+   a fixture shape similar to `ab_server` would give S7 parity with Modbus /
+   AB CIP coverage.
+2. **Plcsim Advanced** — Siemens' paid emulator. Licensed per-seat; fits a
+   lab rig but not CI.
+3. **Real S7 lab rig** — cheapest physical PLC (CPU 1212C) on a dedicated
+   network port, wired via self-hosted runner.
+
+Without any of these, S7 driver correctness against real hardware is trusted
+from field deployments, not from the test suite.
+
+## Key fixture / config files
+
+- `tests/ZB.MOM.WW.OtOpcUa.Driver.S7.Tests/` — unit tests only, no harness
+- `src/ZB.MOM.WW.OtOpcUa.Driver.S7/S7Driver.cs` — ctor takes
+  `IS7ClientFactory` which tests fake; docstring lines 8-20 note the deferred
+  integration fixture

docs/drivers/TwinCAT-Test-Fixture.md

@@ -0,0 +1,158 @@
+# TwinCAT test fixture
+
+Coverage map + gap inventory for the Beckhoff TwinCAT ADS driver.
+
+**TL;DR:** Integration-test scaffolding lives at
+`tests/ZB.MOM.WW.OtOpcUa.Driver.TwinCAT.IntegrationTests/` (task #221).
+`TwinCATXarFixture` probes TCP 48898 on an operator-supplied VM; three
+smoke tests (read / write / native notification) run end-to-end through
+the real ADS stack when the VM is reachable, skip cleanly otherwise.
+**Remaining operational work**: stand up a TwinCAT 3 XAR runtime in a
+Hyper-V VM, author the `.tsproj` project documented at
+`TwinCatProject/README.md`, rotate the 7-day trial license (or buy a
+paid runtime). Unit tests via `FakeTwinCATClient` still carry the
+exhaustive contract coverage.
+
+TwinCAT is the only driver outside Galaxy that uses **native
+notifications** (no polling) for `ISubscribable`, and the fake exposes a
+fire-event harness so notification routing is contract-tested rigorously
+at the unit layer.
+
+## What the fixture is
+
+**Integration layer** (task #221, scaffolded):
+`tests/ZB.MOM.WW.OtOpcUa.Driver.TwinCAT.IntegrationTests/` —
+`TwinCATXarFixture` TCP-probes ADS port 48898 on the host specified by
+`TWINCAT_TARGET_HOST` + requires `TWINCAT_TARGET_NETID` (AmsNetId of the
+VM). No fixture-owned lifecycle — XAR can't run in Docker because it
+bypasses the Windows kernel scheduler, so the VM stays
+operator-managed. `TwinCatProject/README.md` documents the required
+`.tsproj` project state; the file itself lands once the XAR VM is up +
+the project is authored. Three smoke tests:
+`Driver_reads_seeded_DINT_through_real_ADS`,
+`Driver_write_then_read_round_trip_on_scratch_REAL`, and
+`Driver_subscribe_receives_native_ADS_notifications_on_counter_changes`
+— all skip cleanly via `[TwinCATFact]` when the runtime isn't
+reachable.
+
+**Unit layer**: `tests/ZB.MOM.WW.OtOpcUa.Driver.TwinCAT.Tests/` is
+still the primary coverage. `FakeTwinCATClient` also fakes the
+`AddDeviceNotification` flow so tests can trigger callbacks without a
+running runtime.
+
+## What it actually covers
+
+### Integration (XAR VM, task #221 — code scaffolded, needs VM + project)
+
+- `TwinCAT3SmokeTests.Driver_reads_seeded_DINT_through_real_ADS` — real AMS
+  handshake + ADS read of `GVL_Fixture.nCounter` (seeded at 1234, MAIN
+  increments each cycle)
+- `TwinCAT3SmokeTests.Driver_write_then_read_round_trip_on_scratch_REAL` —
+  real ADS write + read on `GVL_Fixture.rSetpoint`
+- `TwinCAT3SmokeTests.Driver_subscribe_receives_native_ADS_notifications_on_counter_changes`
+  — real `AddDeviceNotification` against the cycle-incrementing counter;
+  observes `OnDataChange` firing within 3 s of subscribe
+
+All three gated on `TWINCAT_TARGET_HOST` + `TWINCAT_TARGET_NETID` env
+vars; skip cleanly via `[TwinCATFact]` when the VM isn't reachable or
+vars are unset.
+
+### Unit
+
+- `TwinCATAmsAddressTests` — `ads://<netId>:<port>` parsing + routing
+- `TwinCATCapabilityTests` — data-type mapping (primitives + declared UDTs),
+  read-only classification
+- `TwinCATReadWriteTests` — read + write through the fake, status mapping
+- `TwinCATSymbolPathTests` — symbol-path routing for nested struct members
+- `TwinCATSymbolBrowserTests` — `ITagDiscovery.DiscoverAsync` via
+  `ReadSymbolsAsync` (#188) + system-symbol filtering
+- `TwinCATNativeNotificationTests` — `AddDeviceNotification` (#189)
+  registration, callback-delivery-to-`OnDataChange` wiring, unregister on
+  unsubscribe
+- `TwinCATDriverTests` — `IDriver` lifecycle
+
+Capability surfaces whose contract is verified: `IDriver`, `IReadable`,
+`IWritable`, `ITagDiscovery`, `ISubscribable`, `IHostConnectivityProbe`,
+`IPerCallHostResolver`.
+
+## What it does NOT cover
+
+### 1. AMS / ADS wire traffic
+
+No real AMS router frame is exchanged. Beckhoff's `TwinCAT.Ads` NuGet (their
+own .NET SDK, not libplctag-style OSS) has no in-process fake; tests stub
+the `ITwinCATClient` abstraction above it.
+
+### 2. Multi-route AMS
+
+ADS supports chained routes (`<localNetId> → <routerNetId> → <targetNetId>`)
+for PLCs behind an EC master / IPC gateway. Parse coverage exists; wire-path
+coverage doesn't.
+
+### 3. Notification reliability under jitter
+
+`AddDeviceNotification` delivers at the runtime's cycle boundary; under high
+CPU load or network jitter real notifications can coalesce. The fake fires
+one callback per test invocation — real callback-coalescing behavior is
+untested.
+
+### 4. TC2 vs TC3 variant handling
+
+TwinCAT 2 (ADS v1) and TwinCAT 3 (ADS v2) have subtly different
+`GetSymbolInfoByName` semantics + symbol-table layouts. Driver targets TC3;
+TC2 compatibility is not exercised.
+
+### 5. Cycle-time alignment for `ISubscribable`
+
+Native ADS notifications fire on the PLC cycle boundary. The fake test
+harness assumes notifications fire on a timer the test controls;
+cycle-aligned firing under real PLC control is not verified.
+
+### 6. Alarms / history
+
+Driver doesn't implement `IAlarmSource` or `IHistoryProvider` — not in
+scope for this driver family. TwinCAT 3's TcEventLogger could theoretically
+back an `IAlarmSource`, but shipping that is a separate feature.
+
+## When to trust TwinCAT tests, when to reach for a rig
+
+| Question | Unit tests | Real TwinCAT runtime |
+| --- | --- | --- |
+| "Does the AMS address parser accept X?" | yes | - |
+| "Does notification → `OnDataChange` wire correctly?" | yes (contract) | yes |
+| "Does symbol browsing filter TwinCAT internals?" | yes | yes |
+| "Does a real ADS read return correct bytes?" | no | yes (required) |
+| "Do notifications coalesce under load?" | no | yes (required) |
+| "Does a TC2 PLC work the same as TC3?" | no | yes (required) |
+
+## Follow-up candidates
+
+1. **XAR VM live-population** — scaffolding is in place (this PR); the
+   remaining work is operational: stand up the Hyper-V VM, install XAR,
+   author the `.tsproj` per `TwinCatProject/README.md`, configure the
+   bilateral ADS route, set `TWINCAT_TARGET_HOST` + `TWINCAT_TARGET_NETID`
+   on the dev box. Then the three smoke tests transition skip → pass.
+   Tracked as #221.
+2. **License-rotation automation** — XAR's 7-day trial expires on
+   schedule. Either automate `TcActivate.exe /reactivate` via a
+   scheduled task on the VM (not officially supported; reportedly works
+   for some TC3 builds), or buy a paid runtime license (~$1k one-time
+   per runtime per CPU) to kill the rotation. The doc at
+   `TwinCatProject/README.md` §License rotation walks through both.
+3. **Lab rig** — cheapest IPC (CX7000 / CX9020) on a dedicated network;
+   the only route that covers TC2 + real EtherCAT I/O timing + cycle
+   jitter under CPU load.
+
+## Key fixture / config files
+
+- `tests/ZB.MOM.WW.OtOpcUa.Driver.TwinCAT.IntegrationTests/TwinCATXarFixture.cs`
+  — TCP probe + skip-attributes + env-var parsing
+- `tests/ZB.MOM.WW.OtOpcUa.Driver.TwinCAT.IntegrationTests/TwinCAT3SmokeTests.cs`
+  — three wire-level smoke tests
+- `tests/ZB.MOM.WW.OtOpcUa.Driver.TwinCAT.IntegrationTests/TwinCatProject/README.md`
+  — project spec + VM setup + license-rotation notes
+- `tests/ZB.MOM.WW.OtOpcUa.Driver.TwinCAT.Tests/FakeTwinCATClient.cs` —
+  in-process fake with the notification-fire harness used by
+  `TwinCATNativeNotificationTests`
+- `src/ZB.MOM.WW.OtOpcUa.Driver.TwinCAT/TwinCATDriver.cs` — ctor takes
+  `ITwinCATClientFactory`

docs/v2/dev-environment.md

@@ -143,15 +143,49 @@ Dev credentials in this inventory are convenience defaults, not secrets. Change
 
 | Resource | Purpose | Type | Default port | Default credentials | Owner |
 |----------|---------|------|--------------|---------------------|-------|
-| **Docker Desktop for Windows** | Host for containerized simulators | Install | (Hyper-V required; not compatible with TwinCAT runtime — see TwinCAT row below for the workaround) | n/a | Integration host admin |
-| **`oitc/modbus-server`** | Modbus TCP simulator (per `test-data-sources.md` §1) | Docker container | 502 (Modbus TCP) | n/a (no auth in protocol) | Integration host admin |
-| **`ab_server`** (libplctag binary) | AB CIP + AB Legacy simulator (per `test-data-sources.md` §2 + §3) | Native binary built from libplctag source; runs in a separate VM or host since it conflicts with Docker Desktop's Hyper-V if run on bare metal | 44818 (CIP) | n/a | Integration host admin |
-| **Snap7 Server** | S7 simulator (per `test-data-sources.md` §4) | Native binary; runs in a separate VM or in WSL2 to avoid Hyper-V conflict | 102 (ISO-TCP) | n/a | Integration host admin |
+| **Docker Desktop for Windows** | Host for every driver test-fixture simulator (Modbus / AB CIP / S7 / OpcUaClient) + SQL Server | Install | (Hyper-V required; not compatible with TwinCAT runtime — see TwinCAT row below for the workaround) | n/a | Integration host admin |
+| **Modbus fixture — `otopcua-pymodbus:3.13.0`** | Modbus driver integration tests | Docker image (local build, see `tests/ZB.MOM.WW.OtOpcUa.Driver.Modbus.IntegrationTests/Docker/`); 4 compose profiles: `standard` / `dl205` / `mitsubishi` / `s7_1500` | 5020 (non-privileged) | n/a (no auth in protocol) | Developer (per machine) |
+| **AB CIP fixture — `otopcua-ab-server:libplctag-release`** | AB CIP driver integration tests | Docker image (multi-stage build of libplctag's `ab_server` from source, pinned to the `release` tag; see `tests/ZB.MOM.WW.OtOpcUa.Driver.AbCip.IntegrationTests/Docker/`); 4 compose profiles: `controllogix` / `compactlogix` / `micro800` / `guardlogix` | 44818 (CIP / EtherNet/IP) | n/a | Developer (per machine) |
+| **S7 fixture — `otopcua-python-snap7:1.0`** | S7 driver integration tests | Docker image (local build, `python-snap7>=2.0`; see `tests/ZB.MOM.WW.OtOpcUa.Driver.S7.IntegrationTests/Docker/`); 1 compose profile: `s7_1500` | 1102 (non-privileged; driver honours `S7DriverOptions.Port`) | n/a | Developer (per machine) |
+| **OPC UA Client fixture — `mcr.microsoft.com/iotedge/opc-plc:2.14.10`** | OpcUaClient driver integration tests | Docker image (Microsoft-maintained, pinned; see `tests/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.IntegrationTests/Docker/`) | 50000 (OPC UA) | Anonymous (`--daa` off); auto-accept certs (`--aa`) | Developer (per machine) |
 | **TwinCAT XAR runtime VM** | TwinCAT ADS testing (per `test-data-sources.md` §5; Beckhoff XAR cannot coexist with Hyper-V on the same OS) | Hyper-V VM with Windows + TwinCAT XAR installed under 7-day renewable trial | 48898 (ADS over TCP) | TwinCAT default route credentials configured per Beckhoff docs | Integration host admin |
-| **OPC Foundation reference server** | OPC UA Client driver test source (per `test-data-sources.md` §"OPC UA Client") | Built from `OPCFoundation/UA-.NETStandard` `ConsoleReferenceServer` project | 62541 (default for the reference server) | Anonymous + Username (`user1` / `password1`) per the reference server's built-in user list | Integration host admin |
+| **Rockwell Studio 5000 Logix Emulate** | AB CIP golden-box tier — closes UDT / ALMD / AOI / GuardLogix-safety / CompactLogix-ConnectionSize gaps the ab_server simulator can't cover. Loads the L5X project documented at `tests/.../AbCip.IntegrationTests/LogixProject/README.md`. Tests gated on `AB_SERVER_PROFILE=emulate` + `AB_SERVER_ENDPOINT=<ip>:44818`; see `docs/drivers/AbServer-Test-Fixture.md` §Logix Emulate golden-box tier | Windows-only install; **Hyper-V conflict** — can't coexist with Docker Desktop's WSL 2 backend on the same OS, same story as TwinCAT XAR. Runs on a dedicated Windows PC reachable on the LAN | 44818 (CIP / EtherNet/IP) | None required at the CIP layer; Studio 5000 project credentials per Rockwell install | Integration host admin (license + install); Developer (per session — open Emulate, load L5X, click Run) |
 | **FOCAS TCP stub** (`Driver.Focas.TestStub`) | FOCAS functional testing (per `test-data-sources.md` §6) | Local .NET 10 console app from this repo | 8193 (FOCAS) | n/a | Developer / integration host (run on demand) |
 | **FOCAS FaultShim** (`Driver.Focas.FaultShim`) | FOCAS native-fault injection (per `test-data-sources.md` §6) | Test-only native DLL named `Fwlib64.dll`, loaded via DLL search path in the test fixture | n/a (in-process) | n/a | Developer / integration host (test-only) |
 
+### Docker fixtures — quick reference
+
+Every driver's integration-test simulator ships as a Docker image (or pulls
+one from MCR). Start the one you need, run `dotnet test`, stop it.
+Container lifecycle is always manual — fixtures TCP-probe at collection
+init + skip cleanly when nothing's running.
+
+| Driver | Fixture image | Compose file | Bring up |
+|---|---|---|---|
+| Modbus | local-build `otopcua-pymodbus:3.13.0` | `tests/ZB.MOM.WW.OtOpcUa.Driver.Modbus.IntegrationTests/Docker/docker-compose.yml` | `docker compose -f <compose> --profile <standard\|dl205\|mitsubishi\|s7_1500> up -d` |
+| AB CIP | local-build `otopcua-ab-server:libplctag-release` | `tests/ZB.MOM.WW.OtOpcUa.Driver.AbCip.IntegrationTests/Docker/docker-compose.yml` | `docker compose -f <compose> --profile <controllogix\|compactlogix\|micro800\|guardlogix> up -d` |
+| S7 | local-build `otopcua-python-snap7:1.0` | `tests/ZB.MOM.WW.OtOpcUa.Driver.S7.IntegrationTests/Docker/docker-compose.yml` | `docker compose -f <compose> --profile s7_1500 up -d` |
+| OpcUaClient | `mcr.microsoft.com/iotedge/opc-plc:2.14.10` (pinned) | `tests/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.IntegrationTests/Docker/docker-compose.yml` | `docker compose -f <compose> up -d` |
+
+First build of a local-build image takes 1–5 minutes; subsequent runs use
+layer cache. `ab_server` is the slowest (multi-stage build clones
+libplctag + compiles C). Stop with `docker compose -f <compose> --profile <…> down`.
+
+**Endpoint overrides** — every fixture respects an env var to point at a
+real PLC instead of the simulator:
+
+- `MODBUS_SIM_ENDPOINT` (default `localhost:5020`)
+- `AB_SERVER_ENDPOINT` (no default; overrides the local container endpoint)
+- `S7_SIM_ENDPOINT` (default `localhost:1102`)
+- `OPCUA_SIM_ENDPOINT` (default `opc.tcp://localhost:50000`)
+
+No native launchers — Docker is the only supported path for these
+fixtures. A fresh clone needs Docker Desktop and nothing else; fixture
+TCP probes skip tests cleanly when the container isn't running.
+
+See each driver's `docs/drivers/*-Test-Fixture.md` for the full coverage
+map + gap inventory.
+
 ### D. Cloud / external services
 
 | Resource | Purpose | Type | Access | Owner |

docs/v2/focas-version-matrix.md

@@ -0,0 +1,145 @@
+# FOCAS version / capability matrix
+
+Authoritative source for the per-CNC-series ranges that
+[`FocasCapabilityMatrix`](../../src/ZB.MOM.WW.OtOpcUa.Driver.FOCAS/FocasCapabilityMatrix.cs)
+enforces at driver init time. Every row cites the Fanuc FOCAS Developer
+Kit function whose documented input range determines the ceiling.
+
+**Why this exists** — we have no FOCAS hardware on the bench and no
+working simulator. Fwlib32 returns `EW_NUMBER` / `EW_PARAM` when you
+hand it an address outside the controller's supported range; the
+driver would map that to a per-read `BadOutOfRange` at steady state.
+Catching at `InitializeAsync` with this matrix surfaces operator
+typos + mismatched series declarations as config errors before any
+session is opened, which is the only feedback loop available without
+a live CNC to read against.
+
+**Who declares the series** — `FocasDeviceOptions.Series` in
+`appsettings.json`. Defaults to `Unknown`, which is permissive — every
+address passes validation. Pre-matrix configs don't break on upgrade.
+
+---
+
+## Series covered
+
+| Enum value | Controller family | Typical era |
+| --- | --- | --- |
+| `Unknown` | (legacy / not declared) | permissive fallback |
+| `Sixteen_i` | 16i / 18i / 21i | 1997-2008 |
+| `Zero_i_D` | 0i-D | 2008-2013 |
+| `Zero_i_F` | 0i-F | 2013-present, general-purpose |
+| `Zero_i_MF` | 0i-MF | 0i-F lathe variant |
+| `Zero_i_TF` | 0i-TF | 0i-F turning variant |
+| `Thirty_i` | 30i-A / 30i-B | 2007-present, high-end |
+| `ThirtyOne_i` | 31i-A / 31i-B | 30i simpler variant |
+| `ThirtyTwo_i` | 32i-A / 32i-B | 30i compact |
+| `PowerMotion_i` | Power Motion i-A / i-MODEL A | motion-only controller |
+
+## Macro variable range (`cnc_rdmacro` / `cnc_wrmacro`)
+
+Common macros `1-33` + `100-199` + `500-999` are universal across all
+series. Extended macros (`#10000+`) exist only on higher-end series.
+The numbers below reflect the extended ceiling per series per the
+DevKit range tables.
+
+| Series | Min | Max | Notes |
+| --- | ---: | ---: | --- |
+| `Sixteen_i` | 0 | 999 | legacy ceiling — no extended |
+| `Zero_i_D` | 0 | 999 | 0i-D still at legacy ceiling |
+| `Zero_i_F` / `Zero_i_MF` / `Zero_i_TF` | 0 | 9999 | extended added on 0i-F |
+| `Thirty_i` / `ThirtyOne_i` / `ThirtyTwo_i` | 0 | 99999 | full extended set |
+| `PowerMotion_i` | 0 | 999 | atypical — limited macro coverage |
+
+## Parameter range (`cnc_rdparam` / `cnc_wrparam`)
+
+| Series | Min | Max |
+| --- | ---: | ---: |
+| `Sixteen_i` | 0 | 9999 |
+| `Zero_i_D` / `Zero_i_F` / `Zero_i_MF` / `Zero_i_TF` | 0 | 14999 |
+| `Thirty_i` / `ThirtyOne_i` / `ThirtyTwo_i` | 0 | 29999 |
+| `PowerMotion_i` | 0 | 29999 |
+
+## PMC letters (`pmc_rdpmcrng` / `pmc_wrpmcrng`)
+
+Addresses are letter + number (e.g. `R100`, `F50.3`). Legacy
+controllers omit the `F`/`G` signal groups that 30i-family ladder
+programs use, and only the 30i-family exposes `K` (keep-relay) +
+`T` (timer).
+
+| Letter | 16i | 0i-D | 0i-F family | 30i family | Power Motion-i |
+| --- | :-: | :-: | :-: | :-: | :-: |
+| `X` | yes | yes | yes | yes | yes |
+| `Y` | yes | yes | yes | yes | yes |
+| `R` | yes | yes | yes | yes | yes |
+| `D` | yes | yes | yes | yes | yes |
+| `E` | — | yes | yes | yes | — |
+| `A` | — | yes | yes | yes | — |
+| `F` | — | — | yes | yes | — |
+| `G` | — | — | yes | yes | — |
+| `M` | — | — | yes | yes | — |
+| `C` | — | — | yes | yes | — |
+| `K` | — | — | — | yes | — |
+| `T` | — | — | — | yes | — |
+
+Letter match is case-insensitive. `FocasAddress.PmcLetter` is carried
+as a string (not char) so the matrix can do ordinal-ignore-case
+comparison.
+
+## PMC address-number ceiling
+
+PMC addresses are byte-addressed on read + bit-addressed on write;
+`FocasAddress` carries the bit index separately, so these are byte
+ceilings.
+
+| Series | Max byte | Notes |
+| --- | ---: | --- |
+| `Sixteen_i` | 999 | legacy |
+| `Zero_i_D` | 1999 | doubled since 16i |
+| `Zero_i_F` family | 9999 | |
+| `Thirty_i` family | 59999 | highest density |
+| `PowerMotion_i` | 1999 | |
+
+## Error surface
+
+When a tag fails validation, `FocasDriver.InitializeAsync` throws
+`InvalidOperationException` with a message of the form:
+
+```
+FOCAS tag '<name>' (<address>) rejected by capability matrix: <reason>
+```
+
+`<reason>` is the verbatim string from `FocasCapabilityMatrix.Validate`
+and always names the series + the documented limit so the operator
+can either raise the limit (if wrong) or correct the CNC series they
+declared (if mismatched). Sample:
+
+```
+FOCAS tag 'X_axis_macro_ext' (MACRO:50000) rejected by capability
+matrix: Macro variable #50000 is outside the documented range
+[0, 9999] for Zero_i_F.
+```
+
+## How this matrix stays honest
+
+- Every row is covered by a parameterized test in
+  [`FocasCapabilityMatrixTests.cs`](../../tests/ZB.MOM.WW.OtOpcUa.Driver.FOCAS.Tests/FocasCapabilityMatrixTests.cs)
+  — 46 cases across macro / parameter / PMC-letter / PMC-number
+  boundaries + unknown-series permissiveness + rejection-message
+  content + case-insensitivity.
+- Widening or narrowing a range in the matrix without updating this
+  doc will fail a test, because the theories cite the specific row
+  they reflect in their `InlineData`.
+- The matrix is not comprehensive — it encodes only the subset of
+  FOCAS surface the driver currently exposes (Macro / Parameter /
+  PMC). When the driver gains a new capability (e.g. tool management,
+  alarm history), add its series-specific range tables here + matching
+  tests at the same time.
+
+## Follow-up
+
+This validation closes the cheap half of the FOCAS hardware-free
+stability gap — config errors now fail at load instead of per-read.
+The expensive half is Tier-C process isolation so that a crashing
+`Fwlib32.dll` doesn't take the main OPC UA server down with it. See
+[`docs/v2/implementation/focas-isolation-plan.md`](implementation/focas-isolation-plan.md)
+for that plan (task #220).

docs/v2/implementation/focas-isolation-plan.md

@@ -0,0 +1,163 @@
+# FOCAS Tier-C isolation — plan for task #220
+
+> **Status**: DRAFT — not yet started. Tracks the multi-PR work to
+> move `Fwlib32.dll` behind an out-of-process host, mirroring the
+> Galaxy Tier-C split in [`phase-2-galaxy-out-of-process.md`](phase-2-galaxy-out-of-process.md).
+>
+> **Pre-reqs shipped** (this PR): version matrix + pre-flight
+> validation + unit tests. Those close the cheap half of the
+> hardware-free stability gap. Tier-C closes the expensive half.
+
+## Why isolate
+
+`Fwlib32.dll` is a proprietary Fanuc library with no source, no
+symbols, and a documented habit of crashing the hosting process on
+network errors, malformed responses, and during handle recycling.
+Today the FOCAS driver runs in-process with the OPC UA server —
+a crash inside the Fanuc DLL takes every driver down with it,
+including ones that have nothing to do with FOCAS. Galaxy has the
+same class of problem and solved it with the Tier-C pattern (host
+service + proxy driver + named-pipe IPC); FOCAS should follow that
+playbook.
+
+## Topology (target)
+
+```
++-------------------------------------+         +--------------------------+
+|  OtOpcUa.Server (.NET 10 x64)       |         | OtOpcUaFocasHost         |
+|                                     |  pipe   | (.NET 4.8 x86 Windows    |
+|  ZB.MOM.WW.OtOpcUa.Driver.FOCAS     | <-----> |  service)                |
+|    - FocasProxyDriver (in-proc)     |         |                          |
+|    - supervisor / respawn / BackPr  |         |  Fwlib32.dll + session   |
+|                                     |         |  handles + STA thread    |
++-------------------------------------+         +--------------------------+
+```
+
+Why .NET 4.8 x86 for the host: `Fwlib32.dll` ships as 32-bit only.
+The Galaxy.Host is already .NET 4.8 x86 for the same reason
+(MXAccess COM bitness), so the NSSM wrapper pattern transfers
+directly.
+
+## Three new projects
+
+| Project | TFM | Role |
+| --- | --- | --- |
+| `ZB.MOM.WW.OtOpcUa.Driver.FOCAS.Shared` | `netstandard2.0` | MessagePack DTOs — `FocasReadRequest`, `FocasReadResponse`, `FocasSubscribeRequest`, `FocasPmcBitWriteRequest`, etc. Same assembly referenced by .NET 10 + .NET 4.8 so the wire format stays identical. |
+| `ZB.MOM.WW.OtOpcUa.Driver.FOCAS.Host` | `net48` x86 | Windows service. Owns the Fwlib32 session handles + STA thread + handle-recycling loop. Pipe server + per-call auth (same ACL + caller SID + shared secret pattern as Galaxy.Host). |
+| `ZB.MOM.WW.OtOpcUa.Driver.FOCAS` (existing) | `net10.0` | Collapses to a proxy that forwards each `IReadable` / `IWritable` / `ISubscribable` call over the pipe. `FocasCapabilityMatrix` + `FocasAddress` stay here — pre-flight runs before any IPC. |
+
+## Supervisor responsibilities (in the Proxy)
+
+Mirrors Galaxy.Proxy 1:1:
+
+1. Start the Host process on first `InitializeAsync` (NSSM-wrapped
+   service in production, direct spawn in dev) + heartbeat every
+   5s.
+2. If heartbeat misses 3× in a row, fan out `BadCommunicationError`
+   to every subscription and respawn with exponential backoff
+   (1s / 2s / 4s / max 30s).
+3. Crash-loop circuit breaker: 5 respawns in 60s → drop to
+   `BadDeviceFailure` steady state until operator resets.
+4. Post-mortem MMF: on Host exit, Host writes its last-N operations
+   + session state to an MMF the Proxy reads to log context.
+
+## IPC surface (approximate)
+
+Every `FocasDriver` method that today calls into Fwlib32 directly
+becomes an `ExecuteAsync` call with a typed request:
+
+| Today (in-process) | Tier-C (IPC) |
+| --- | --- |
+| `FocasTagReader.Read(tag)` | `client.Execute(new FocasReadRequest(session, address))` |
+| `FocasTagWriter.Write(tag, value)` | `client.Execute(new FocasWriteRequest(...))` |
+| `FocasPmcBitRmw.Write(tag, bit, value)` | `client.Execute(new FocasPmcBitWriteRequest(...))` — RMW happens in Host so the critical section stays on one process |
+| `FocasConnectivityProbe.ProbeAsync` | `client.Execute(new FocasProbeRequest())` |
+| `FocasSubscriber.Subscribe(tags)` | `client.Execute(new FocasSubscribeRequest(tags))` — Host owns the poll loop + streams changes back as `FocasDataChangedNotification` over the pipe |
+
+Subscription streaming is the non-obvious piece: the Host polls on
+its own timer + pushes change notifications so the Proxy doesn't
+round-trip per poll. Matches `Driver.Galaxy.Host` subscription
+forwarding.
+
+## PR sequence (proposed)
+
+1. **PR A — shared contracts**
+   Create `Driver.FOCAS.Shared` with the MessagePack DTOs. No
+   behaviour change. ~200 LOC + round-trip tests for each DTO.
+2. **PR B — Host project skeleton**
+   Create `Driver.FOCAS.Host` .NET 4.8 x86 project, NSSM wrapper,
+   pipe server scaffold with the same ACL + caller-SID + shared
+   secret plumbing as Galaxy.Host. No Fwlib32 wiring yet — returns
+   `NotImplemented` for everything. ~400 LOC.
+3. **PR C — Move Fwlib32 calls into Host**
+   Move `FocasNativeSession`, `FocasTagReader`, `FocasTagWriter`,
+   `FocasPmcBitRmw` + the STA thread into the Host. Proxy forwards
+   over IPC. This is the biggest PR — probably 800-1500 LOC of
+   move-with-translation. Existing unit tests keep passing because
+   `IFocasTagFactory` is the DI seam the tests inject against.
+4. **PR D — Supervisor + respawn**
+   Proxy-side heartbeat + respawn + crash-loop circuit breaker +
+   BackPressure fan-out on Host death. ~500 LOC + chaos tests.
+5. **PR E — Post-mortem MMF + operational glue**
+   MMF writer in Host, reader in Proxy. Install scripts for the
+   new `OtOpcUaFocasHost` Windows service. Docs. ~300 LOC.
+
+Total estimate: 2200-3200 LOC across 5 PRs. Consistent with Galaxy
+Tier-C but narrower since FOCAS has no Historian + no alarm
+history.
+
+## Testing without hardware
+
+Same constraint as today: no CNC, no simulator. The isolation work
+itself is verifiable without Fwlib32 actually being called:
+
+- **Pipe contract**: PR A's MessagePack round-trip tests cover every
+  DTO.
+- **Supervisor**: PR D uses a `FakeFocasHost` stub that can be told
+  to crash, hang, or miss heartbeats. The supervisor's respawn +
+  circuit-breaker behaviour is fully testable against the stub.
+- **IPC ACL + auth**: reuse the Galaxy.Host's existing test harness
+  pattern — negative tests attempt to connect as the wrong user and
+  assert rejection.
+- **Fwlib32 integration itself**: still untestable without hardware.
+  When a real CNC becomes available, the smoke tests already
+  scaffolded in `tests/ZB.MOM.WW.OtOpcUa.Driver.FOCAS.IntegrationTests/`
+  run against it via `FOCAS_ENDPOINT`.
+
+## Decisions to confirm before starting
+
+- **Sharing transport code with Galaxy.Host** — should the pipe
+  server + ACL + shared-secret + MMF plumbing go into a common
+  `Core.Hosting.Tier-C` project both hosts reference? Probably yes;
+  deferred until PR B is drafted because the right abstraction only
+  becomes visible after two uses.
+- **Handle-recycling cadence** — Fwlib32 session handles leak
+  memory over weeks per the Fanuc-published defect list. Galaxy
+  recycles MXAccess handles on a 24h timer; FOCAS should mirror but
+  the trigger point (idle vs scheduled) needs operator input.
+- **Per-CNC Host process vs one Host serving N CNCs** — one-per-CNC
+  isolates blast radius but scales poorly past ~20 machines; shared
+  Host scales but one bad CNC can wedge the lot. Start with shared
+  Host + document the blast-radius trade; revisit if operators hit
+  it.
+
+## Non-goals
+
+- Simulator work. `open_focas` + other OSS FOCAS simulators are
+  untested + not maintained; not worth chasing vs. waiting for real
+  hardware.
+- Changing the public `FocasDriverOptions` shape beyond what
+  already shipped (the `Series` knob). Operator config continues to
+  look the same after the split — the Tier-C topology is invisible
+  from `appsettings.json`.
+- Historian / long-term history integration. FOCAS driver doesn't
+  implement `IHistoryProvider` + there's no plan to add it.
+
+## References
+
+- [`docs/v2/implementation/phase-2-galaxy-out-of-process.md`](phase-2-galaxy-out-of-process.md)
+  — the working Tier-C template this plan follows.
+- [`docs/drivers/FOCAS-Test-Fixture.md`](../../drivers/FOCAS-Test-Fixture.md)
+  — what's covered today + what stays blocked on hardware.
+- [`docs/v2/focas-version-matrix.md`](../focas-version-matrix.md) —
+  the capability matrix that pre-flights configs before IPC runs.

docs/v2/modbus-test-plan.md

@@ -13,9 +13,9 @@ confirmed DL205 quirk lands in a follow-up PR as a named test in that project.
 
 ## Harness
 
-**Chosen simulator: pymodbus 3.13.0** (`pip install 'pymodbus[simulator]==3.13.0'`).
-Replaced ModbusPal in PR 43 — see `tests/.../Pymodbus/README.md` for the
-trade-off rationale. Headline reasons:
+**Chosen simulator: pymodbus 3.13.0** packaged as a pinned Docker image
+under `tests/.../Modbus.IntegrationTests/Docker/`. See that folder's
+`README.md` for image-build notes + compose profiles. Headline reasons:
 
 - **Headless** pure-Python CLI; no Java GUI, runs cleanly on a CI runner.
 - **Maintained** — current stable 3.13.0; ModbusPal 1.6b is abandoned.
@@ -26,17 +26,18 @@ trade-off rationale. Headline reasons:
 - **Per-register raw uint16 seeding** — encoding the DL205 string-byte-order
   / BCD / CDAB-float quirks stays explicit (the quirk math lives in the
   `_quirk` JSON-comment fields next to each register).
-- Pip-installable on Windows; sidesteps the privileged-port admin
-  requirement by defaulting to TCP **5020** instead of 502.
+- **Dockerized** — pinned image means the CI simulator surface is
+  reproducible + no `pip install` step on the dev box.
+- Defaults to TCP **5020** (matches the compose port-map + the fixture
+  default endpoint; sidesteps the Windows Firewall prompt on 502).
 
 **Setup pattern**:
-1. `pip install "pymodbus[simulator]==3.13.0"`.
-2. Start the simulator with one of the in-repo profiles:
-   `tests\.../Pymodbus\serve.ps1 -Profile standard` (or `-Profile dl205`).
-3. `dotnet test tests\ZB.MOM.WW.OtOpcUa.Driver.Modbus.IntegrationTests` —
+1. `docker compose -f tests\...\Modbus.IntegrationTests\Docker\docker-compose.yml --profile <standard|dl205|mitsubishi|s7_1500> up -d`.
+2. `dotnet test tests\ZB.MOM.WW.OtOpcUa.Driver.Modbus.IntegrationTests` —
    tests auto-skip when the endpoint is unreachable. Default endpoint is
    `localhost:5020`; override via `MODBUS_SIM_ENDPOINT` for a real PLC on its
    native port 502.
+3. `docker compose -f ... --profile <…> down` when finished.
 
 ## Per-device quirk catalog
 
@@ -113,9 +114,11 @@ vendors get promoted into driver defaults or opt-in options:
 - **PR 42 — ModbusPal `.xmpp` profiles** — **SUPERSEDED by PR 43**. Replaced
   with pymodbus JSON because ModbusPal 1.6b is abandoned, GUI-only, and only
   exposes 2 of the 4 standard tables.
-- **PR 43 — pymodbus JSON profiles** — **DONE**. `Pymodbus/standard.json` +
-  `Pymodbus/dl205.json` + `Pymodbus/serve.ps1` runner. Both bind TCP 5020.
+- **PR 43 — pymodbus JSON profiles** — **DONE**. Dockerized under
+  `Docker/profiles/` (standard.json, dl205.json, mitsubishi.json,
+  s7_1500.json); compose file launches each via a named profile.
+  All bind TCP 5020.
 - **PR 44+**: one PR per confirmed DL205 quirk, landing the named test + any
   driver-side adjustment (string byte order, BCD decoder, V-memory address
   helper, FC16 cap-per-device-family) needed to pass it. Each quirk's value
-  is already pre-encoded in `Pymodbus/dl205.json`.
+  is already pre-encoded in `Docker/profiles/dl205.json`.

docs/v2/test-data-sources.md

@@ -191,40 +191,30 @@ Modbus has no native String, DateTime, or Int64 — those rows are skipped on th
 
 ### CI fixture (task #180)
 
-The integration harness at `tests/ZB.MOM.WW.OtOpcUa.Driver.AbCip.IntegrationTests/` exposes two test-time contracts:
+The integration harness at `tests/ZB.MOM.WW.OtOpcUa.Driver.AbCip.IntegrationTests/` is Docker-only — `ab_server` is a source-only tool under libplctag's `src/tools/ab_server/`, and the fixture's multi-stage `Docker/Dockerfile` is the only supported reproducible build path.
 
-- **`AbServerFixture(AbServerProfile)`** — starts the simulator with the CLI args composed from the profile's `--plc` family + seed-tag set. One fixture instance per family, one simulator process per test case (smoke tier). For larger suites that can share a simulator across several reads/writes, use a `IClassFixture<AbServerFixture>` wrapper per family.
-- **`KnownProfiles.{ControlLogix, CompactLogix, Micro800, GuardLogix}`** — the four per-family profiles. Drives the simulator's `--plc` mode + the preseed `--tag name:type[:size]` set. Micro800 + GuardLogix fall back to `controllogix` under the hood because ab_server has no dedicated mode for them — the driver-side family profile still enforces the narrower connection shape / safety classification separately.
+- **`AbServerFixture(AbServerProfile)`** — thin TCP probe against `127.0.0.1:44818` (or `AB_SERVER_ENDPOINT` override). Does not spawn the simulator; the operator brings up the compose service for whichever family the test class targets (`controllogix` / `compactlogix` / `micro800` / `guardlogix`).
+- **`KnownProfiles.{ControlLogix, CompactLogix, Micro800, GuardLogix}`** — thin `(Family, ComposeProfile, Notes)` records. The compose file (`Docker/docker-compose.yml`) is the canonical source of truth for which tags each family seeds + which `--plc` mode the simulator boots in. `Micro800` uses the dedicated `--plc=Micro800` mode; `GuardLogix` uses `ControlLogix` emulation because ab_server has no safety subsystem (the `_S`-suffixed seed tag triggers driver-side ViewOnly classification only).
 
-**Pinned version** (recorded in `ci/ab-server.lock.json` so drift is one-file visible):
-
-- `libplctag` **v2.6.16** (published 2026-03-29) — `ab_server.exe` ships inside the `_tools.zip` asset alongside `plctag.dll` + two `list_tags_*` helpers.
-- Windows x64: `libplctag_2.6.16_windows_x64_tools.zip` — SHA256 `9b78a3dee73d9cd28ca348c090f453dbe3ad9d07ad6bf42865a9dc3a79bc2232`
-- Windows x86: `libplctag_2.6.16_windows_x86_tools.zip` — SHA256 `fdfefd58b266c5da9a1ded1a430985e609289c9e67be2544da7513b668761edf`
-- Windows ARM64: `libplctag_2.6.16_windows_arm64_tools.zip` — SHA256 `d747728e4c4958bb63b4ac23e1c820c4452e4778dfd7d58f8a0aecd5402d4944`
+**Pinned version**: the `Docker/Dockerfile` clones libplctag at a pinned tag (currently the `release` branch) via its `LIBPLCTAG_TAG` build-arg and compiles `ab_server` from source. Bump deliberately alongside a driver-side change that needs the newer simulator.
 
 **CI step:**
 
 ```yaml
 # GitHub Actions step placed before `dotnet test`:
-- name: Fetch ab_server (libplctag v2.6.16)
+- name: Start ab_server Docker container
   shell: pwsh
   run: |
-    $pin = Get-Content ci/ab-server.lock.json | ConvertFrom-Json
-    $asset = $pin.assets.'windows-x64'       # swap to windows-x86 / windows-arm64 on non-x64 runners
-    $url = "https://github.com/libplctag/libplctag/releases/download/$($pin.tag)/$($asset.file)"
-    $zip = Join-Path $env:RUNNER_TEMP 'libplctag-tools.zip'
-    Invoke-WebRequest $url -OutFile $zip
-    $actual = (Get-FileHash -Algorithm SHA256 $zip).Hash.ToLower()
-    if ($actual -ne $asset.sha256) { throw "libplctag tools SHA256 mismatch: expected $($asset.sha256), got $actual" }
-    $dest = Join-Path $env:RUNNER_TEMP 'libplctag-tools'
-    Expand-Archive $zip -DestinationPath $dest
-    Add-Content $env:GITHUB_PATH $dest
+    docker compose -f tests/ZB.MOM.WW.OtOpcUa.Driver.AbCip.IntegrationTests/Docker/docker-compose.yml `
+      --profile controllogix up -d --build
+    # Wait for :44818 to accept connections (compose healthcheck-equivalent)
+    for ($i = 0; $i -lt 30; $i++) {
+      if ((Test-NetConnection -ComputerName localhost -Port 44818 -WarningAction SilentlyContinue).TcpTestSucceeded) { break }
+      Start-Sleep -Seconds 1
+    }
 ```
 
-The fixture's `LocateBinary()` picks the binary up off PATH so the C# harness doesn't own the download — CI YAML is the right place for version pinning + hash verification. Developer workstations install the binary once from source (`cmake + make ab_server` under a libplctag clone) and the same fixture works identically.
-
-Tests without ab_server on PATH are marked `Skip` via `AbServerFactAttribute` / `AbServerTheoryAttribute`, so fresh-clone runs without the simulator still pass all unit suites in this project.
+Tests skip via `AbServerFactAttribute` / `AbServerTheoryAttribute` when the probe fails, so fresh-clone runs without Docker still pass all unit suites in this project.
 
 ---
 

src/ZB.MOM.WW.OtOpcUa.Driver.AbCip/AbCipAlarmProjection.cs

@@ -0,0 +1,232 @@
+using ZB.MOM.WW.OtOpcUa.Core.Abstractions;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.AbCip;
+
+/// <summary>
+///     Task #177 — projects AB Logix ALMD alarm instructions onto the OPC UA alarm surface by
+///     polling the ALMD UDT's <c>InFaulted</c> / <c>Acked</c> / <c>Severity</c> members at a
+///     configurable interval + translating state transitions into <c>OnAlarmEvent</c>
+///     callbacks on the owning <see cref="AbCipDriver"/>. Feature-flagged off by default via
+///     <see cref="AbCipDriverOptions.EnableAlarmProjection"/>; callers that leave the flag off
+///     get a no-op subscribe path so capability negotiation still works.
+/// </summary>
+/// <remarks>
+///     <para>ALMD-only in this pass. ALMA (analog alarm) projection is a follow-up because
+///     its threshold + limit semantics need more design — ALMD's "is the alarm active + has
+///     the operator acked" shape maps cleanly onto the driver-agnostic
+///     <see cref="IAlarmSource"/> contract without concessions.</para>
+///
+///     <para>Polling reuses <see cref="AbCipDriver.ReadAsync"/>, so ALMD reads get the #194
+///     whole-UDT optimization for free when the ALMD is declared with its standard members.
+///     One poll loop per subscription call; the loop batches every
+///     member read across the full source-node set into a single ReadAsync per tick.</para>
+///
+///     <para>ALMD <c>Acked</c> write semantics on Logix are rising-edge sensitive at the
+///     instruction level — writing <c>Acked=1</c> directly is honored by FT View + the
+///     standard HMI templates, but some PLC programs read <c>AckCmd</c> + look for the edge
+///     themselves. We pick the simpler <c>Acked</c> write for first pass; operators whose
+///     ladder watches <c>AckCmd</c> can wire a follow-up "AckCmd 0→1→0" pulse on the client
+///     side until a driver-level knob lands.</para>
+/// </remarks>
+internal sealed class AbCipAlarmProjection : IAsyncDisposable
+{
+    private readonly AbCipDriver _driver;
+    private readonly TimeSpan _pollInterval;
+    private readonly Dictionary<long, Subscription> _subs = new();
+    private readonly Lock _subsLock = new();
+    private long _nextId;
+
+    public AbCipAlarmProjection(AbCipDriver driver, TimeSpan pollInterval)
+    {
+        _driver = driver;
+        _pollInterval = pollInterval;
+    }
+
+    public async Task<IAlarmSubscriptionHandle> SubscribeAsync(
+        IReadOnlyList<string> sourceNodeIds, CancellationToken cancellationToken)
+    {
+        var id = Interlocked.Increment(ref _nextId);
+        var handle = new AbCipAlarmSubscriptionHandle(id);
+        var cts = new CancellationTokenSource();
+        var sub = new Subscription(handle, [..sourceNodeIds], cts);
+
+        lock (_subsLock) _subs[id] = sub;
+
+        sub.Loop = Task.Run(() => RunPollLoopAsync(sub, cts.Token), cts.Token);
+        await Task.CompletedTask;
+        return handle;
+    }
+
+    public async Task UnsubscribeAsync(IAlarmSubscriptionHandle handle, CancellationToken cancellationToken)
+    {
+        if (handle is not AbCipAlarmSubscriptionHandle h) return;
+        Subscription? sub;
+        lock (_subsLock)
+        {
+            if (!_subs.Remove(h.Id, out sub)) return;
+        }
+        try { sub.Cts.Cancel(); } catch { }
+        try { await sub.Loop.ConfigureAwait(false); } catch { }
+        sub.Cts.Dispose();
+    }
+
+    public async Task AcknowledgeAsync(
+        IReadOnlyList<AlarmAcknowledgeRequest> acknowledgements, CancellationToken cancellationToken)
+    {
+        if (acknowledgements.Count == 0) return;
+
+        // Write Acked=1 per request. IWritable isn't on AbCipAlarmProjection so route through
+        // the driver's public interface — delegating instead of re-implementing the write path
+        // keeps the bit-in-DINT + idempotency + per-call-host-resolve knobs intact.
+        var requests = acknowledgements
+            .Select(a => new WriteRequest($"{a.SourceNodeId}.Acked", true))
+            .ToArray();
+        // Best-effort — the driver's WriteAsync returns per-item status; individual ack
+        // failures don't poison the batch. Swallow the return so a single faulted ack
+        // doesn't bubble out of the caller's batch expectation.
+        _ = await _driver.WriteAsync(requests, cancellationToken).ConfigureAwait(false);
+    }
+
+    public async ValueTask DisposeAsync()
+    {
+        List<Subscription> snap;
+        lock (_subsLock) { snap = _subs.Values.ToList(); _subs.Clear(); }
+        foreach (var sub in snap)
+        {
+            try { sub.Cts.Cancel(); } catch { }
+            try { await sub.Loop.ConfigureAwait(false); } catch { }
+            sub.Cts.Dispose();
+        }
+    }
+
+    /// <summary>
+    ///     Poll-tick body — reads <c>InFaulted</c> + <c>Severity</c> for every source node id
+    ///     in the subscription, diffs each against last-seen state, fires raise/clear events.
+    ///     Extracted so tests can drive one tick without standing up the Task.Run loop.
+    /// </summary>
+    internal void Tick(Subscription sub, IReadOnlyList<DataValueSnapshot> results)
+    {
+        // results index layout: for each sourceNode, [InFaulted, Severity] in order.
+        for (var i = 0; i < sub.SourceNodeIds.Count; i++)
+        {
+            var nodeId = sub.SourceNodeIds[i];
+            var inFaultedDv = results[i * 2];
+            var severityDv = results[i * 2 + 1];
+            if (inFaultedDv.StatusCode != AbCipStatusMapper.Good) continue;
+
+            var nowFaulted = ToBool(inFaultedDv.Value);
+            var severity = ToInt(severityDv.Value);
+
+            var wasFaulted = sub.LastInFaulted.GetValueOrDefault(nodeId, false);
+            sub.LastInFaulted[nodeId] = nowFaulted;
+
+            if (!wasFaulted && nowFaulted)
+            {
+                _driver.InvokeAlarmEvent(new AlarmEventArgs(
+                    sub.Handle, nodeId, ConditionId: $"{nodeId}#active",
+                    AlarmType: "ALMD",
+                    Message: $"ALMD {nodeId} raised",
+                    Severity: MapSeverity(severity),
+                    SourceTimestampUtc: DateTime.UtcNow));
+            }
+            else if (wasFaulted && !nowFaulted)
+            {
+                _driver.InvokeAlarmEvent(new AlarmEventArgs(
+                    sub.Handle, nodeId, ConditionId: $"{nodeId}#active",
+                    AlarmType: "ALMD",
+                    Message: $"ALMD {nodeId} cleared",
+                    Severity: MapSeverity(severity),
+                    SourceTimestampUtc: DateTime.UtcNow));
+            }
+        }
+    }
+
+    private async Task RunPollLoopAsync(Subscription sub, CancellationToken ct)
+    {
+        var refs = new List<string>(sub.SourceNodeIds.Count * 2);
+        foreach (var nodeId in sub.SourceNodeIds)
+        {
+            refs.Add($"{nodeId}.InFaulted");
+            refs.Add($"{nodeId}.Severity");
+        }
+
+        while (!ct.IsCancellationRequested)
+        {
+            try
+            {
+                var results = await _driver.ReadAsync(refs, ct).ConfigureAwait(false);
+                Tick(sub, results);
+            }
+            catch (OperationCanceledException) when (ct.IsCancellationRequested) { break; }
+            catch { /* per-tick failures are non-fatal; next tick retries */ }
+
+            try { await Task.Delay(_pollInterval, ct).ConfigureAwait(false); }
+            catch (OperationCanceledException) { break; }
+        }
+    }
+
+    internal static AlarmSeverity MapSeverity(int raw) => raw switch
+    {
+        <= 250 => AlarmSeverity.Low,
+        <= 500 => AlarmSeverity.Medium,
+        <= 750 => AlarmSeverity.High,
+        _ => AlarmSeverity.Critical,
+    };
+
+    private static bool ToBool(object? v) => v switch
+    {
+        bool b => b,
+        int i => i != 0,
+        long l => l != 0,
+        _ => false,
+    };
+
+    private static int ToInt(object? v) => v switch
+    {
+        int i => i,
+        long l => (int)l,
+        short s => s,
+        byte b => b,
+        _ => 0,
+    };
+
+    internal sealed class Subscription
+    {
+        public Subscription(AbCipAlarmSubscriptionHandle handle, IReadOnlyList<string> sourceNodeIds, CancellationTokenSource cts)
+        {
+            Handle = handle; SourceNodeIds = sourceNodeIds; Cts = cts;
+        }
+        public AbCipAlarmSubscriptionHandle Handle { get; }
+        public IReadOnlyList<string> SourceNodeIds { get; }
+        public CancellationTokenSource Cts { get; }
+        public Task Loop { get; set; } = Task.CompletedTask;
+        public Dictionary<string, bool> LastInFaulted { get; } = new(StringComparer.Ordinal);
+    }
+}
+
+/// <summary>Handle returned by <see cref="AbCipAlarmProjection.SubscribeAsync"/>.</summary>
+public sealed record AbCipAlarmSubscriptionHandle(long Id) : IAlarmSubscriptionHandle
+{
+    public string DiagnosticId => $"abcip-alarm-sub-{Id}";
+}
+
+/// <summary>
+///     Detects the ALMD / ALMA signature in an <see cref="AbCipTagDefinition"/>'s declared
+///     members. Used by both discovery (to stamp <c>IsAlarm=true</c> on the emitted
+///     variable) + initial driver setup (to decide which tags the alarm projection owns).
+/// </summary>
+public static class AbCipAlarmDetector
+{
+    /// <summary>
+    ///     <c>true</c> when <paramref name="tag"/> is a Structure whose declared members match
+    ///     the ALMD signature (<c>InFaulted</c> + <c>Acked</c> present). ALMA detection
+    ///     (analog alarms with <c>HHLimit</c>/<c>HLimit</c>/<c>LLimit</c>/<c>LLLimit</c>)
+    ///     ships as a follow-up.
+    /// </summary>
+    public static bool IsAlmd(AbCipTagDefinition tag)
+    {
+        if (tag.DataType != AbCipDataType.Structure || tag.Members is null) return false;
+        var names = tag.Members.Select(m => m.Name).ToHashSet(StringComparer.OrdinalIgnoreCase);
+        return names.Contains("InFaulted") && names.Contains("Acked");
+    }
+}

src/ZB.MOM.WW.OtOpcUa.Driver.AbCip/AbCipDriver.cs

@@ -21,7 +21,7 @@ namespace ZB.MOM.WW.OtOpcUa.Driver.AbCip;
 ///     <see cref="PlcTagHandle"/> and reconnects each device.</para>
 /// </remarks>
 public sealed class AbCipDriver : IDriver, IReadable, IWritable, ITagDiscovery, ISubscribable,
-    IHostConnectivityProbe, IPerCallHostResolver, IDisposable, IAsyncDisposable
+    IHostConnectivityProbe, IPerCallHostResolver, IAlarmSource, IDisposable, IAsyncDisposable
 {
     private readonly AbCipDriverOptions _options;
     private readonly string _driverInstanceId;
@@ -32,10 +32,15 @@ public sealed class AbCipDriver : IDriver, IReadable, IWritable, ITagDiscovery,
     private readonly PollGroupEngine _poll;
     private readonly Dictionary<string, DeviceState> _devices = new(StringComparer.OrdinalIgnoreCase);
     private readonly Dictionary<string, AbCipTagDefinition> _tagsByName = new(StringComparer.OrdinalIgnoreCase);
+    private readonly AbCipAlarmProjection _alarmProjection;
     private DriverHealth _health = new(DriverState.Unknown, null, null);
 
     public event EventHandler<DataChangeEventArgs>? OnDataChange;
     public event EventHandler<HostStatusChangedEventArgs>? OnHostStatusChanged;
+    public event EventHandler<AlarmEventArgs>? OnAlarmEvent;
+
+    /// <summary>Internal seam for the alarm projection to raise events through the driver.</summary>
+    internal void InvokeAlarmEvent(AlarmEventArgs args) => OnAlarmEvent?.Invoke(this, args);
 
     public AbCipDriver(AbCipDriverOptions options, string driverInstanceId,
         IAbCipTagFactory? tagFactory = null,
@@ -52,6 +57,7 @@ public sealed class AbCipDriver : IDriver, IReadable, IWritable, ITagDiscovery,
             reader: ReadAsync,
             onChange: (handle, tagRef, snapshot) =>
                 OnDataChange?.Invoke(this, new DataChangeEventArgs(handle, tagRef, snapshot)));
+        _alarmProjection = new AbCipAlarmProjection(this, _options.AlarmPollInterval);
     }
 
     /// <summary>
@@ -162,6 +168,7 @@ public sealed class AbCipDriver : IDriver, IReadable, IWritable, ITagDiscovery,
 
     public async Task ShutdownAsync(CancellationToken cancellationToken)
     {
+        await _alarmProjection.DisposeAsync().ConfigureAwait(false);
         await _poll.DisposeAsync().ConfigureAwait(false);
         foreach (var state in _devices.Values)
         {
@@ -187,6 +194,39 @@ public sealed class AbCipDriver : IDriver, IReadable, IWritable, ITagDiscovery,
         return Task.CompletedTask;
     }
 
+    // ---- IAlarmSource (ALMD projection, #177) ----
+
+    /// <summary>
+    ///     Subscribe to ALMD alarm transitions on <paramref name="sourceNodeIds"/>. Each id
+    ///     names a declared ALMD UDT tag; the projection polls the tag's <c>InFaulted</c> +
+    ///     <c>Severity</c> members at <see cref="AbCipDriverOptions.AlarmPollInterval"/> and
+    ///     fires <see cref="OnAlarmEvent"/> on 0→1 (raise) + 1→0 (clear) transitions.
+    ///     Feature-gated — when <see cref="AbCipDriverOptions.EnableAlarmProjection"/> is
+    ///     <c>false</c> (the default), returns a handle wrapping a no-op subscription so
+    ///     capability negotiation still works; <see cref="OnAlarmEvent"/> never fires.
+    /// </summary>
+    public Task<IAlarmSubscriptionHandle> SubscribeAlarmsAsync(
+        IReadOnlyList<string> sourceNodeIds, CancellationToken cancellationToken)
+    {
+        if (!_options.EnableAlarmProjection)
+        {
+            var disabled = new AbCipAlarmSubscriptionHandle(0);
+            return Task.FromResult<IAlarmSubscriptionHandle>(disabled);
+        }
+        return _alarmProjection.SubscribeAsync(sourceNodeIds, cancellationToken);
+    }
+
+    public Task UnsubscribeAlarmsAsync(IAlarmSubscriptionHandle handle, CancellationToken cancellationToken) =>
+        _options.EnableAlarmProjection
+            ? _alarmProjection.UnsubscribeAsync(handle, cancellationToken)
+            : Task.CompletedTask;
+
+    public Task AcknowledgeAsync(
+        IReadOnlyList<AlarmAcknowledgeRequest> acknowledgements, CancellationToken cancellationToken) =>
+        _options.EnableAlarmProjection
+            ? _alarmProjection.AcknowledgeAsync(acknowledgements, cancellationToken)
+            : Task.CompletedTask;
+
     // ---- IHostConnectivityProbe ----
 
     public IReadOnlyList<HostConnectivityStatus> GetHostStatuses() =>
@@ -287,56 +327,127 @@ public sealed class AbCipDriver : IDriver, IReadable, IWritable, ITagDiscovery,
         var now = DateTime.UtcNow;
         var results = new DataValueSnapshot[fullReferences.Count];
 
-        for (var i = 0; i < fullReferences.Count; i++)
-        {
-            var reference = fullReferences[i];
-            if (!_tagsByName.TryGetValue(reference, out var def))
-            {
-                results[i] = new DataValueSnapshot(null, AbCipStatusMapper.BadNodeIdUnknown, null, now);
-                continue;
-            }
-            if (!_devices.TryGetValue(def.DeviceHostAddress, out var device))
-            {
-                results[i] = new DataValueSnapshot(null, AbCipStatusMapper.BadNodeIdUnknown, null, now);
-                continue;
-            }
+        // Task #194 — plan the batch: members of the same parent UDT get collapsed into one
+        // whole-UDT read + in-memory member decode; every other reference falls back to the
+        // per-tag path that's been here since PR 3. Planner is a pure function over the
+        // current tag map; BOOL/String/Structure members stay on the fallback path because
+        // declaration-only offsets can't place them under Logix alignment rules.
+        var plan = AbCipUdtReadPlanner.Build(fullReferences, _tagsByName);
 
-            try
-            {
-                var runtime = await EnsureTagRuntimeAsync(device, def, cancellationToken).ConfigureAwait(false);
-                await runtime.ReadAsync(cancellationToken).ConfigureAwait(false);
+        foreach (var group in plan.Groups)
+            await ReadGroupAsync(group, results, now, cancellationToken).ConfigureAwait(false);
 
-                var status = runtime.GetStatus();
-                if (status != 0)
-                {
-                    results[i] = new DataValueSnapshot(null,
-                        AbCipStatusMapper.MapLibplctagStatus(status), null, now);
-                    _health = new DriverHealth(DriverState.Degraded, _health.LastSuccessfulRead,
-                        $"libplctag status {status} reading {reference}");
-                    continue;
-                }
-
-                var tagPath = AbCipTagPath.TryParse(def.TagPath);
-                var bitIndex = tagPath?.BitIndex;
-                var value = runtime.DecodeValue(def.DataType, bitIndex);
-                results[i] = new DataValueSnapshot(value, AbCipStatusMapper.Good, now, now);
-                _health = new DriverHealth(DriverState.Healthy, now, null);
-            }
-            catch (OperationCanceledException)
-            {
-                throw;
-            }
-            catch (Exception ex)
-            {
-                results[i] = new DataValueSnapshot(null,
-                    AbCipStatusMapper.BadCommunicationError, null, now);
-                _health = new DriverHealth(DriverState.Degraded, _health.LastSuccessfulRead, ex.Message);
-            }
-        }
+        foreach (var fb in plan.Fallbacks)
+            await ReadSingleAsync(fb, fullReferences[fb.OriginalIndex], results, now, cancellationToken).ConfigureAwait(false);
 
         return results;
     }
 
+    private async Task ReadSingleAsync(
+        AbCipUdtReadFallback fb, string reference, DataValueSnapshot[] results, DateTime now, CancellationToken ct)
+    {
+        if (!_tagsByName.TryGetValue(reference, out var def))
+        {
+            results[fb.OriginalIndex] = new DataValueSnapshot(null, AbCipStatusMapper.BadNodeIdUnknown, null, now);
+            return;
+        }
+        if (!_devices.TryGetValue(def.DeviceHostAddress, out var device))
+        {
+            results[fb.OriginalIndex] = new DataValueSnapshot(null, AbCipStatusMapper.BadNodeIdUnknown, null, now);
+            return;
+        }
+
+        try
+        {
+            var runtime = await EnsureTagRuntimeAsync(device, def, ct).ConfigureAwait(false);
+            await runtime.ReadAsync(ct).ConfigureAwait(false);
+
+            var status = runtime.GetStatus();
+            if (status != 0)
+            {
+                results[fb.OriginalIndex] = new DataValueSnapshot(null,
+                    AbCipStatusMapper.MapLibplctagStatus(status), null, now);
+                _health = new DriverHealth(DriverState.Degraded, _health.LastSuccessfulRead,
+                    $"libplctag status {status} reading {reference}");
+                return;
+            }
+
+            var tagPath = AbCipTagPath.TryParse(def.TagPath);
+            var bitIndex = tagPath?.BitIndex;
+            var value = runtime.DecodeValue(def.DataType, bitIndex);
+            results[fb.OriginalIndex] = new DataValueSnapshot(value, AbCipStatusMapper.Good, now, now);
+            _health = new DriverHealth(DriverState.Healthy, now, null);
+        }
+        catch (OperationCanceledException)
+        {
+            throw;
+        }
+        catch (Exception ex)
+        {
+            results[fb.OriginalIndex] = new DataValueSnapshot(null,
+                AbCipStatusMapper.BadCommunicationError, null, now);
+            _health = new DriverHealth(DriverState.Degraded, _health.LastSuccessfulRead, ex.Message);
+        }
+    }
+
+    /// <summary>
+    ///     Task #194 — perform one whole-UDT read on the parent tag, then decode each
+    ///     grouped member from the runtime's buffer at its computed byte offset. A per-group
+    ///     failure (parent read raised, non-zero libplctag status, or missing device) stamps
+    ///     the mapped fault across every grouped member only — sibling groups + the
+    ///     per-tag fallback list are unaffected.
+    /// </summary>
+    private async Task ReadGroupAsync(
+        AbCipUdtReadGroup group, DataValueSnapshot[] results, DateTime now, CancellationToken ct)
+    {
+        var parent = group.ParentDefinition;
+
+        if (!_devices.TryGetValue(parent.DeviceHostAddress, out var device))
+        {
+            StampGroupStatus(group, results, now, AbCipStatusMapper.BadNodeIdUnknown);
+            return;
+        }
+
+        try
+        {
+            var runtime = await EnsureTagRuntimeAsync(device, parent, ct).ConfigureAwait(false);
+            await runtime.ReadAsync(ct).ConfigureAwait(false);
+
+            var status = runtime.GetStatus();
+            if (status != 0)
+            {
+                var mapped = AbCipStatusMapper.MapLibplctagStatus(status);
+                StampGroupStatus(group, results, now, mapped);
+                _health = new DriverHealth(DriverState.Degraded, _health.LastSuccessfulRead,
+                    $"libplctag status {status} reading UDT {group.ParentName}");
+                return;
+            }
+
+            foreach (var member in group.Members)
+            {
+                var value = runtime.DecodeValueAt(member.Definition.DataType, member.Offset, bitIndex: null);
+                results[member.OriginalIndex] = new DataValueSnapshot(value, AbCipStatusMapper.Good, now, now);
+            }
+            _health = new DriverHealth(DriverState.Healthy, now, null);
+        }
+        catch (OperationCanceledException)
+        {
+            throw;
+        }
+        catch (Exception ex)
+        {
+            StampGroupStatus(group, results, now, AbCipStatusMapper.BadCommunicationError);
+            _health = new DriverHealth(DriverState.Degraded, _health.LastSuccessfulRead, ex.Message);
+        }
+    }
+
+    private static void StampGroupStatus(
+        AbCipUdtReadGroup group, DataValueSnapshot[] results, DateTime now, uint statusCode)
+    {
+        foreach (var member in group.Members)
+            results[member.OriginalIndex] = new DataValueSnapshot(null, statusCode, null, now);
+    }
+
     // ---- IWritable ----
 
     /// <summary>

src/ZB.MOM.WW.OtOpcUa.Driver.AbCip/AbCipDriverOptions.cs

@@ -38,6 +38,24 @@ public sealed class AbCipDriverOptions
     ///     should appear in the address space.
     /// </summary>
     public bool EnableControllerBrowse { get; init; }
+
+    /// <summary>
+    ///     Task #177 — when <c>true</c>, declared ALMD tags are surfaced as alarm conditions
+    ///     via <see cref="Core.Abstractions.IAlarmSource"/>; the driver polls each subscribed
+    ///     alarm's <c>InFaulted</c> + <c>Severity</c> members + fires <c>OnAlarmEvent</c> on
+    ///     state transitions. Default <c>false</c> — operators explicitly opt in because
+    ///     projection semantics don't exactly mirror Rockwell FT Alarm &amp; Events; shops
+    ///     running FT Live should keep this off + take alarms through the native route.
+    /// </summary>
+    public bool EnableAlarmProjection { get; init; }
+
+    /// <summary>
+    ///     Poll interval for the ALMD projection loop. Shorter intervals catch faster edges
+    ///     at the cost of PLC round-trips; edges shorter than this interval are invisible to
+    ///     the projection (a 0→1→0 transition within one tick collapses to no event). Default
+    ///     1 second — matches typical SCADA alarm-refresh conventions.
+    /// </summary>
+    public TimeSpan AlarmPollInterval { get; init; } = TimeSpan.FromSeconds(1);
 }
 
 /// <summary>

src/ZB.MOM.WW.OtOpcUa.Driver.AbCip/AbCipUdtMemberLayout.cs

@@ -0,0 +1,78 @@
+namespace ZB.MOM.WW.OtOpcUa.Driver.AbCip;
+
+/// <summary>
+///     Computes byte offsets for declared UDT members under Logix natural-alignment rules so
+///     a single whole-UDT read (task #194) can decode each member from one buffer without
+///     re-reading per member. Declaration-driven — the caller supplies
+///     <see cref="AbCipStructureMember"/> rows; this helper produces the offset each member
+///     sits at in the parent tag's read buffer.
+/// </summary>
+/// <remarks>
+///     <para>Alignment rules applied per Rockwell "Logix 5000 Data Access" manual + the
+///     libplctag test fixtures: each member aligns to its natural boundary (SInt 1, Int 2,
+///     DInt/Real/Dt 4, LInt/ULInt/LReal 8), padding inserted before the member as needed.
+///     The total size is padded to the alignment of the largest member so arrays-of-UDT also
+///     work at element stride — though this helper is used only on single instances today.</para>
+///
+///     <para><see cref="TryBuild"/> returns <c>null</c> on unsupported member types
+///     (<see cref="AbCipDataType.Bool"/>, <see cref="AbCipDataType.String"/>,
+///     <see cref="AbCipDataType.Structure"/>). Whole-UDT grouping opts out of those groups
+///     and falls back to the per-tag read path — BOOL members are packed into a hidden host
+///     byte at the top of the UDT under Logix, so their offset can't be computed from
+///     declared-member order alone. The CIP Template Object reader produces a
+///     <see cref="AbCipUdtShape"/> that carries real offsets for BOOL + nested structs; when
+///     that shape is cached the driver can take the richer path instead.</para>
+/// </remarks>
+public static class AbCipUdtMemberLayout
+{
+    /// <summary>
+    ///     Try to compute member offsets for the supplied declared members. Returns <c>null</c>
+    ///     if any member type is unsupported for declaration-only layout.
+    /// </summary>
+    public static IReadOnlyDictionary<string, int>? TryBuild(
+        IReadOnlyList<AbCipStructureMember> members)
+    {
+        ArgumentNullException.ThrowIfNull(members);
+        if (members.Count == 0) return null;
+
+        var offsets = new Dictionary<string, int>(members.Count, StringComparer.OrdinalIgnoreCase);
+        var cursor = 0;
+
+        foreach (var member in members)
+        {
+            if (!TryGetSizeAlign(member.DataType, out var size, out var align))
+                return null;
+
+            if (cursor % align != 0)
+                cursor += align - (cursor % align);
+
+            offsets[member.Name] = cursor;
+            cursor += size;
+        }
+
+        return offsets;
+    }
+
+    /// <summary>
+    ///     Natural size + alignment for a Logix atomic type. <c>false</c> for types excluded
+    ///     from declaration-only grouping (Bool / String / Structure).
+    /// </summary>
+    private static bool TryGetSizeAlign(AbCipDataType type, out int size, out int align)
+    {
+        switch (type)
+        {
+            case AbCipDataType.SInt: case AbCipDataType.USInt:
+                size = 1; align = 1; return true;
+            case AbCipDataType.Int: case AbCipDataType.UInt:
+                size = 2; align = 2; return true;
+            case AbCipDataType.DInt: case AbCipDataType.UDInt:
+            case AbCipDataType.Real: case AbCipDataType.Dt:
+                size = 4; align = 4; return true;
+            case AbCipDataType.LInt: case AbCipDataType.ULInt:
+            case AbCipDataType.LReal:
+                size = 8; align = 8; return true;
+            default:
+                size = 0; align = 0; return false;
+        }
+    }
+}

src/ZB.MOM.WW.OtOpcUa.Driver.AbCip/AbCipUdtReadPlanner.cs

@@ -0,0 +1,109 @@
+namespace ZB.MOM.WW.OtOpcUa.Driver.AbCip;
+
+/// <summary>
+///     Task #194 — groups a ReadAsync batch of full-references into whole-UDT reads where
+///     possible. A group is emitted for every parent UDT tag whose declared
+///     <see cref="AbCipStructureMember"/>s produced a valid offset map AND at least two of
+///     its members appear in the batch; every other reference stays in the per-tag fallback
+///     list that <see cref="AbCipDriver.ReadAsync"/> runs through its existing read path.
+///     Pure function — the planner never touches the runtime + never reads the PLC.
+/// </summary>
+public static class AbCipUdtReadPlanner
+{
+    /// <summary>
+    ///     Split <paramref name="requests"/> into whole-UDT groups + per-tag leftovers.
+    ///     <paramref name="tagsByName"/> is the driver's <c>_tagsByName</c> map — both parent
+    ///     UDT rows and their fanned-out member rows live there. Lookup is OrdinalIgnoreCase
+    ///     to match the driver's dictionary semantics.
+    /// </summary>
+    public static AbCipUdtReadPlan Build(
+        IReadOnlyList<string> requests,
+        IReadOnlyDictionary<string, AbCipTagDefinition> tagsByName)
+    {
+        ArgumentNullException.ThrowIfNull(requests);
+        ArgumentNullException.ThrowIfNull(tagsByName);
+
+        var fallback = new List<AbCipUdtReadFallback>(requests.Count);
+        var byParent = new Dictionary<string, List<AbCipUdtReadMember>>(StringComparer.OrdinalIgnoreCase);
+
+        for (var i = 0; i < requests.Count; i++)
+        {
+            var name = requests[i];
+            if (!tagsByName.TryGetValue(name, out var def))
+            {
+                fallback.Add(new AbCipUdtReadFallback(i, name));
+                continue;
+            }
+
+            var (parentName, memberName) = SplitParentMember(name);
+            if (parentName is null || memberName is null
+                || !tagsByName.TryGetValue(parentName, out var parent)
+                || parent.DataType != AbCipDataType.Structure
+                || parent.Members is not { Count: > 0 })
+            {
+                fallback.Add(new AbCipUdtReadFallback(i, name));
+                continue;
+            }
+
+            var offsets = AbCipUdtMemberLayout.TryBuild(parent.Members);
+            if (offsets is null || !offsets.TryGetValue(memberName, out var offset))
+            {
+                fallback.Add(new AbCipUdtReadFallback(i, name));
+                continue;
+            }
+
+            if (!byParent.TryGetValue(parentName, out var members))
+            {
+                members = new List<AbCipUdtReadMember>();
+                byParent[parentName] = members;
+            }
+            members.Add(new AbCipUdtReadMember(i, def, offset));
+        }
+
+        // A single-member group saves nothing (one whole-UDT read replaces one per-member read)
+        // — demote to fallback to avoid paying the cost of reading the full UDT buffer only to
+        // pull one field out.
+        var groups = new List<AbCipUdtReadGroup>(byParent.Count);
+        foreach (var (parentName, members) in byParent)
+        {
+            if (members.Count < 2)
+            {
+                foreach (var m in members)
+                    fallback.Add(new AbCipUdtReadFallback(m.OriginalIndex, m.Definition.Name));
+                continue;
+            }
+            groups.Add(new AbCipUdtReadGroup(parentName, tagsByName[parentName], members));
+        }
+
+        return new AbCipUdtReadPlan(groups, fallback);
+    }
+
+    private static (string? Parent, string? Member) SplitParentMember(string reference)
+    {
+        var dot = reference.IndexOf('.');
+        if (dot <= 0 || dot == reference.Length - 1) return (null, null);
+        return (reference[..dot], reference[(dot + 1)..]);
+    }
+}
+
+/// <summary>A planner output: grouped UDT reads + per-tag fallbacks.</summary>
+public sealed record AbCipUdtReadPlan(
+    IReadOnlyList<AbCipUdtReadGroup> Groups,
+    IReadOnlyList<AbCipUdtReadFallback> Fallbacks);
+
+/// <summary>One UDT parent whose members were batched into a single read.</summary>
+public sealed record AbCipUdtReadGroup(
+    string ParentName,
+    AbCipTagDefinition ParentDefinition,
+    IReadOnlyList<AbCipUdtReadMember> Members);
+
+/// <summary>
+///     One member inside an <see cref="AbCipUdtReadGroup"/>. <c>OriginalIndex</c> is the
+///     slot in the caller's request list so the decoded value lands at the correct output
+///     offset. <c>Definition</c> is the fanned-out member-level tag definition. <c>Offset</c>
+///     is the byte offset within the parent UDT buffer where this member lives.
+/// </summary>
+public sealed record AbCipUdtReadMember(int OriginalIndex, AbCipTagDefinition Definition, int Offset);
+
+/// <summary>A reference that falls back to the per-tag read path.</summary>
+public sealed record AbCipUdtReadFallback(int OriginalIndex, string Reference);

src/ZB.MOM.WW.OtOpcUa.Driver.AbCip/IAbCipTagRuntime.cs

@@ -31,6 +31,17 @@ public interface IAbCipTagRuntime : IDisposable
     /// </summary>
     object? DecodeValue(AbCipDataType type, int? bitIndex);
 
+    /// <summary>
+    ///     Decode a value at an arbitrary byte offset in the local buffer. Task #194 —
+    ///     whole-UDT reads perform one <see cref="ReadAsync"/> on the parent UDT tag then
+    ///     call this per declared member with its computed offset, avoiding one libplctag
+    ///     round-trip per member. Implementations that do not support offset-aware decoding
+    ///     may fall back to <see cref="DecodeValue"/> when <paramref name="offset"/> is zero;
+    ///     offsets greater than zero against an unsupporting runtime should return <c>null</c>
+    ///     so the planner can skip grouping.
+    /// </summary>
+    object? DecodeValueAt(AbCipDataType type, int offset, int? bitIndex);
+
     /// <summary>
     ///     Encode <paramref name="value"/> into the local buffer per the tag's type. Callers
     ///     pair this with <see cref="WriteAsync"/>.

src/ZB.MOM.WW.OtOpcUa.Driver.AbCip/LibplctagTagRuntime.cs

@@ -32,24 +32,26 @@ internal sealed class LibplctagTagRuntime : IAbCipTagRuntime
 
     public int GetStatus() => (int)_tag.GetStatus();
 
-    public object? DecodeValue(AbCipDataType type, int? bitIndex) => type switch
+    public object? DecodeValue(AbCipDataType type, int? bitIndex) => DecodeValueAt(type, 0, bitIndex);
+
+    public object? DecodeValueAt(AbCipDataType type, int offset, int? bitIndex) => type switch
     {
         AbCipDataType.Bool => bitIndex is int bit
             ? _tag.GetBit(bit)
-            : _tag.GetInt8(0) != 0,
-        AbCipDataType.SInt => (int)(sbyte)_tag.GetInt8(0),
-        AbCipDataType.USInt => (int)_tag.GetUInt8(0),
-        AbCipDataType.Int => (int)_tag.GetInt16(0),
-        AbCipDataType.UInt => (int)_tag.GetUInt16(0),
-        AbCipDataType.DInt => _tag.GetInt32(0),
-        AbCipDataType.UDInt => (int)_tag.GetUInt32(0),
-        AbCipDataType.LInt => _tag.GetInt64(0),
-        AbCipDataType.ULInt => (long)_tag.GetUInt64(0),
-        AbCipDataType.Real => _tag.GetFloat32(0),
-        AbCipDataType.LReal => _tag.GetFloat64(0),
-        AbCipDataType.String => _tag.GetString(0),
-        AbCipDataType.Dt => _tag.GetInt32(0), // seconds-since-epoch DINT; consumer widens as needed
-        AbCipDataType.Structure => null,       // UDT whole-tag decode lands in PR 6
+            : _tag.GetInt8(offset) != 0,
+        AbCipDataType.SInt => (int)(sbyte)_tag.GetInt8(offset),
+        AbCipDataType.USInt => (int)_tag.GetUInt8(offset),
+        AbCipDataType.Int => (int)_tag.GetInt16(offset),
+        AbCipDataType.UInt => (int)_tag.GetUInt16(offset),
+        AbCipDataType.DInt => _tag.GetInt32(offset),
+        AbCipDataType.UDInt => (int)_tag.GetUInt32(offset),
+        AbCipDataType.LInt => _tag.GetInt64(offset),
+        AbCipDataType.ULInt => (long)_tag.GetUInt64(offset),
+        AbCipDataType.Real => _tag.GetFloat32(offset),
+        AbCipDataType.LReal => _tag.GetFloat64(offset),
+        AbCipDataType.String => _tag.GetString(offset),
+        AbCipDataType.Dt => _tag.GetInt32(offset),
+        AbCipDataType.Structure => null,
         _ => null,
     };
 

src/ZB.MOM.WW.OtOpcUa.Driver.FOCAS.Host/Ipc/IFrameHandler.cs

@@ -0,0 +1,31 @@
+using System;
+using System.Threading;
+using System.Threading.Tasks;
+using ZB.MOM.WW.OtOpcUa.Driver.FOCAS.Shared;
+using ZB.MOM.WW.OtOpcUa.Driver.FOCAS.Shared.Contracts;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.FOCAS.Host.Ipc;
+
+/// <summary>
+///     Dispatches a single IPC frame to the backend. Implementations own the FOCAS session
+///     state and translate request DTOs into Fwlib32 calls.
+/// </summary>
+public interface IFrameHandler
+{
+    Task HandleAsync(FocasMessageKind kind, byte[] body, FrameWriter writer, CancellationToken ct);
+
+    /// <summary>
+    ///     Called once per accepted connection after the Hello handshake. Lets the handler
+    ///     attach server-pushed event sinks (data-change notifications, runtime-status
+    ///     changes) to the connection's <paramref name="writer"/>. Returns an
+    ///     <see cref="IDisposable"/> the pipe server disposes when the connection closes —
+    ///     backends use it to unsubscribe from their push sources.
+    /// </summary>
+    IDisposable AttachConnection(FrameWriter writer);
+
+    public sealed class NoopAttachment : IDisposable
+    {
+        public static readonly NoopAttachment Instance = new();
+        public void Dispose() { }
+    }
+}

src/ZB.MOM.WW.OtOpcUa.Driver.FOCAS.Host/Ipc/PipeAcl.cs

@@ -0,0 +1,39 @@
+using System;
+using System.IO.Pipes;
+using System.Security.AccessControl;
+using System.Security.Principal;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.FOCAS.Host.Ipc;
+
+/// <summary>
+///     Builds the <see cref="PipeSecurity"/> for the FOCAS Host pipe. Same pattern as
+///     Galaxy.Host: only the configured OtOpcUa server principal SID gets
+///     <c>ReadWrite | Synchronize</c>; LocalSystem + Administrators are explicitly denied
+///     so a compromised service account on the same host can't escalate via the pipe.
+/// </summary>
+public static class PipeAcl
+{
+    public static PipeSecurity Create(SecurityIdentifier allowedSid)
+    {
+        if (allowedSid is null) throw new ArgumentNullException(nameof(allowedSid));
+
+        var security = new PipeSecurity();
+
+        security.AddAccessRule(new PipeAccessRule(
+            allowedSid,
+            PipeAccessRights.ReadWrite | PipeAccessRights.Synchronize,
+            AccessControlType.Allow));
+
+        var localSystem = new SecurityIdentifier(WellKnownSidType.LocalSystemSid, null);
+        var admins      = new SecurityIdentifier(WellKnownSidType.BuiltinAdministratorsSid, null);
+
+        if (allowedSid != localSystem)
+            security.AddAccessRule(new PipeAccessRule(localSystem, PipeAccessRights.FullControl, AccessControlType.Deny));
+        if (allowedSid != admins)
+            security.AddAccessRule(new PipeAccessRule(admins,      PipeAccessRights.FullControl, AccessControlType.Deny));
+
+        security.SetOwner(allowedSid);
+
+        return security;
+    }
+}

src/ZB.MOM.WW.OtOpcUa.Driver.FOCAS.Host/Ipc/PipeServer.cs

@@ -0,0 +1,152 @@
+using System;
+using System.IO.Pipes;
+using System.Security.Principal;
+using System.Threading;
+using System.Threading.Tasks;
+using MessagePack;
+using Serilog;
+using ZB.MOM.WW.OtOpcUa.Driver.FOCAS.Shared;
+using ZB.MOM.WW.OtOpcUa.Driver.FOCAS.Shared.Contracts;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.FOCAS.Host.Ipc;
+
+/// <summary>
+///     Accepts one client connection at a time on the FOCAS Host's named pipe with the
+///     strict ACL from <see cref="PipeAcl"/>. Verifies the peer SID + per-process shared
+///     secret before any RPC frame is accepted. Mirrors the Galaxy.Host pipe server byte for
+///     byte — different MessageKind enum, same negotiation semantics.
+/// </summary>
+public sealed class PipeServer : IDisposable
+{
+    private readonly string _pipeName;
+    private readonly SecurityIdentifier _allowedSid;
+    private readonly string _sharedSecret;
+    private readonly ILogger _logger;
+    private readonly CancellationTokenSource _cts = new();
+    private NamedPipeServerStream? _current;
+
+    public PipeServer(string pipeName, SecurityIdentifier allowedSid, string sharedSecret, ILogger logger)
+    {
+        _pipeName = pipeName ?? throw new ArgumentNullException(nameof(pipeName));
+        _allowedSid = allowedSid ?? throw new ArgumentNullException(nameof(allowedSid));
+        _sharedSecret = sharedSecret ?? throw new ArgumentNullException(nameof(sharedSecret));
+        _logger = logger ?? throw new ArgumentNullException(nameof(logger));
+    }
+
+    public async Task RunOneConnectionAsync(IFrameHandler handler, CancellationToken ct)
+    {
+        using var linked = CancellationTokenSource.CreateLinkedTokenSource(_cts.Token, ct);
+        var acl = PipeAcl.Create(_allowedSid);
+
+        _current = new NamedPipeServerStream(
+            _pipeName,
+            PipeDirection.InOut,
+            maxNumberOfServerInstances: 1,
+            PipeTransmissionMode.Byte,
+            PipeOptions.Asynchronous,
+            inBufferSize: 64 * 1024,
+            outBufferSize: 64 * 1024,
+            pipeSecurity: acl);
+
+        try
+        {
+            await _current.WaitForConnectionAsync(linked.Token).ConfigureAwait(false);
+
+            if (!VerifyCaller(_current, out var reason))
+            {
+                _logger.Warning("FOCAS IPC caller rejected: {Reason}", reason);
+                _current.Disconnect();
+                return;
+            }
+
+            using var reader = new FrameReader(_current, leaveOpen: true);
+            using var writer = new FrameWriter(_current, leaveOpen: true);
+
+            var first = await reader.ReadFrameAsync(linked.Token).ConfigureAwait(false);
+            if (first is null || first.Value.Kind != FocasMessageKind.Hello)
+            {
+                _logger.Warning("FOCAS IPC first frame was not Hello; dropping");
+                return;
+            }
+
+            var hello = MessagePackSerializer.Deserialize<Hello>(first.Value.Body);
+            if (!string.Equals(hello.SharedSecret, _sharedSecret, StringComparison.Ordinal))
+            {
+                await writer.WriteAsync(FocasMessageKind.HelloAck,
+                    new HelloAck { Accepted = false, RejectReason = "shared-secret-mismatch" },
+                    linked.Token).ConfigureAwait(false);
+                _logger.Warning("FOCAS IPC Hello rejected: shared-secret-mismatch");
+                return;
+            }
+
+            if (hello.ProtocolMajor != Hello.CurrentMajor)
+            {
+                await writer.WriteAsync(FocasMessageKind.HelloAck,
+                    new HelloAck
+                    {
+                        Accepted = false,
+                        RejectReason = $"major-version-mismatch-peer={hello.ProtocolMajor}-server={Hello.CurrentMajor}",
+                    },
+                    linked.Token).ConfigureAwait(false);
+                _logger.Warning("FOCAS IPC Hello rejected: major mismatch peer={Peer} server={Server}",
+                    hello.ProtocolMajor, Hello.CurrentMajor);
+                return;
+            }
+
+            await writer.WriteAsync(FocasMessageKind.HelloAck,
+                new HelloAck { Accepted = true, HostName = Environment.MachineName },
+                linked.Token).ConfigureAwait(false);
+
+            using var attachment = handler.AttachConnection(writer);
+
+            while (!linked.Token.IsCancellationRequested)
+            {
+                var frame = await reader.ReadFrameAsync(linked.Token).ConfigureAwait(false);
+                if (frame is null) break;
+
+                await handler.HandleAsync(frame.Value.Kind, frame.Value.Body, writer, linked.Token).ConfigureAwait(false);
+            }
+        }
+        finally
+        {
+            _current.Dispose();
+            _current = null;
+        }
+    }
+
+    public async Task RunAsync(IFrameHandler handler, CancellationToken ct)
+    {
+        while (!ct.IsCancellationRequested)
+        {
+            try { await RunOneConnectionAsync(handler, ct).ConfigureAwait(false); }
+            catch (OperationCanceledException) { break; }
+            catch (Exception ex) { _logger.Error(ex, "FOCAS IPC connection loop error — accepting next"); }
+        }
+    }
+
+    private bool VerifyCaller(NamedPipeServerStream pipe, out string reason)
+    {
+        try
+        {
+            pipe.RunAsClient(() =>
+            {
+                using var wi = WindowsIdentity.GetCurrent();
+                if (wi.User is null)
+                    throw new InvalidOperationException("GetCurrent().User is null — cannot verify caller");
+                if (wi.User != _allowedSid)
+                    throw new UnauthorizedAccessException(
+                        $"caller SID {wi.User.Value} does not match allowed {_allowedSid.Value}");
+            });
+            reason = string.Empty;
+            return true;
+        }
+        catch (Exception ex) { reason = ex.Message; return false; }
+    }
+
+    public void Dispose()
+    {
+        _cts.Cancel();
+        _current?.Dispose();
+        _cts.Dispose();
+    }
+}

src/ZB.MOM.WW.OtOpcUa.Driver.FOCAS.Host/Ipc/StubFrameHandler.cs

@@ -0,0 +1,41 @@
+using System;
+using System.Threading;
+using System.Threading.Tasks;
+using MessagePack;
+using ZB.MOM.WW.OtOpcUa.Driver.FOCAS.Shared;
+using ZB.MOM.WW.OtOpcUa.Driver.FOCAS.Shared.Contracts;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.FOCAS.Host.Ipc;
+
+/// <summary>
+///     Placeholder handler that returns <c>ErrorResponse{Code=not-implemented}</c> for every
+///     FOCAS data-plane request. Exists so PR B can ship the pipe server + ACL + handshake
+///     plumbing before PR C moves the Fwlib32 calls. Heartbeats are handled fully so the
+///     supervisor's liveness detector stays happy.
+/// </summary>
+public sealed class StubFrameHandler : IFrameHandler
+{
+    public Task HandleAsync(FocasMessageKind kind, byte[] body, FrameWriter writer, CancellationToken ct)
+    {
+        if (kind == FocasMessageKind.Heartbeat)
+        {
+            var hb = MessagePackSerializer.Deserialize<Heartbeat>(body);
+            return writer.WriteAsync(FocasMessageKind.HeartbeatAck,
+                new HeartbeatAck
+                {
+                    MonotonicTicks = hb.MonotonicTicks,
+                    HostUtcUnixMs = DateTimeOffset.UtcNow.ToUnixTimeMilliseconds(),
+                }, ct);
+        }
+
+        return writer.WriteAsync(FocasMessageKind.ErrorResponse,
+            new ErrorResponse
+            {
+                Code = "not-implemented",
+                Message = $"Kind {kind} is stubbed — Fwlib32 lift lands in PR C",
+            },
+            ct);
+    }
+
+    public IDisposable AttachConnection(FrameWriter writer) => IFrameHandler.NoopAttachment.Instance;
+}

src/ZB.MOM.WW.OtOpcUa.Driver.FOCAS.Host/Program.cs

@@ -0,0 +1,62 @@
+using System;
+using System.Security.Principal;
+using System.Threading;
+using Serilog;
+using ZB.MOM.WW.OtOpcUa.Driver.FOCAS.Host.Ipc;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.FOCAS.Host;
+
+/// <summary>
+///     Entry point for the <c>OtOpcUaFocasHost</c> Windows service / console host. The
+///     supervisor (Proxy-side) spawns this process per FOCAS driver instance and passes the
+///     pipe name, allowed-SID, and per-process shared secret as environment variables. In
+///     PR B the backend is <see cref="StubFrameHandler"/> — PR C swaps in the real
+///     Fwlib32-backed handler once the session state + STA thread move out of the .NET 10
+///     driver.
+/// </summary>
+public static class Program
+{
+    public static int Main(string[] args)
+    {
+        Log.Logger = new LoggerConfiguration()
+            .MinimumLevel.Information()
+            .WriteTo.File(
+                @"%ProgramData%\OtOpcUa\focas-host-.log".Replace("%ProgramData%", Environment.GetFolderPath(Environment.SpecialFolder.CommonApplicationData)),
+                rollingInterval: RollingInterval.Day)
+            .CreateLogger();
+
+        try
+        {
+            var pipeName = Environment.GetEnvironmentVariable("OTOPCUA_FOCAS_PIPE") ?? "OtOpcUaFocas";
+            var allowedSidValue = Environment.GetEnvironmentVariable("OTOPCUA_ALLOWED_SID")
+                ?? throw new InvalidOperationException(
+                    "OTOPCUA_ALLOWED_SID not set — the FOCAS Proxy supervisor must pass the server principal SID");
+            var sharedSecret = Environment.GetEnvironmentVariable("OTOPCUA_FOCAS_SECRET")
+                ?? throw new InvalidOperationException(
+                    "OTOPCUA_FOCAS_SECRET not set — the FOCAS Proxy supervisor must pass the per-process secret at spawn time");
+
+            var allowedSid = new SecurityIdentifier(allowedSidValue);
+
+            using var server = new PipeServer(pipeName, allowedSid, sharedSecret, Log.Logger);
+            using var cts = new CancellationTokenSource();
+            Console.CancelKeyPress += (_, e) => { e.Cancel = true; cts.Cancel(); };
+
+            Log.Information("OtOpcUaFocasHost starting — pipe={Pipe} allowedSid={Sid}",
+                pipeName, allowedSidValue);
+
+            var handler = new StubFrameHandler();
+            Log.Warning("OtOpcUaFocasHost backend=stub — Fwlib32 lift lands in PR C");
+
+            server.RunAsync(handler, cts.Token).GetAwaiter().GetResult();
+
+            Log.Information("OtOpcUaFocasHost stopped cleanly");
+            return 0;
+        }
+        catch (Exception ex)
+        {
+            Log.Fatal(ex, "OtOpcUaFocasHost fatal");
+            return 2;
+        }
+        finally { Log.CloseAndFlush(); }
+    }
+}

src/ZB.MOM.WW.OtOpcUa.Driver.FOCAS.Host/ZB.MOM.WW.OtOpcUa.Driver.FOCAS.Host.csproj

@@ -0,0 +1,40 @@
+<Project Sdk="Microsoft.NET.Sdk">
+
+    <PropertyGroup>
+        <OutputType>Exe</OutputType>
+        <TargetFramework>net48</TargetFramework>
+        <!-- Fwlib32.dll is 32-bit only — x86 target is mandatory. Matches the Galaxy.Host
+             bitness constraint but for a different native library. -->
+        <PlatformTarget>x86</PlatformTarget>
+        <Prefer32Bit>true</Prefer32Bit>
+        <Nullable>enable</Nullable>
+        <LangVersion>latest</LangVersion>
+        <TreatWarningsAsErrors>true</TreatWarningsAsErrors>
+        <GenerateDocumentationFile>true</GenerateDocumentationFile>
+        <NoWarn>$(NoWarn);CS1591</NoWarn>
+        <RootNamespace>ZB.MOM.WW.OtOpcUa.Driver.FOCAS.Host</RootNamespace>
+        <AssemblyName>OtOpcUa.Driver.FOCAS.Host</AssemblyName>
+    </PropertyGroup>
+
+    <ItemGroup>
+        <PackageReference Include="System.IO.Pipes.AccessControl" Version="5.0.0"/>
+        <PackageReference Include="System.Memory" Version="4.5.5"/>
+        <PackageReference Include="System.Threading.Tasks.Extensions" Version="4.5.4"/>
+        <PackageReference Include="Serilog" Version="4.2.0"/>
+        <PackageReference Include="Serilog.Sinks.File" Version="7.0.0"/>
+    </ItemGroup>
+
+    <ItemGroup>
+        <ProjectReference Include="..\ZB.MOM.WW.OtOpcUa.Driver.FOCAS.Shared\ZB.MOM.WW.OtOpcUa.Driver.FOCAS.Shared.csproj"/>
+    </ItemGroup>
+
+    <ItemGroup>
+        <InternalsVisibleTo Include="ZB.MOM.WW.OtOpcUa.Driver.FOCAS.Host.Tests"/>
+    </ItemGroup>
+
+    <ItemGroup>
+        <NuGetAuditSuppress Include="https://github.com/advisories/GHSA-37gx-xxp4-5rgx"/>
+        <NuGetAuditSuppress Include="https://github.com/advisories/GHSA-w3x6-4m5h-cxqf"/>
+    </ItemGroup>
+
+</Project>

src/ZB.MOM.WW.OtOpcUa.Driver.FOCAS.Shared/Contracts/Addresses.cs

@@ -0,0 +1,39 @@
+using MessagePack;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.FOCAS.Shared.Contracts;
+
+/// <summary>
+///     Wire shape for a parsed FOCAS address. Mirrors <c>FocasAddress</c> in the driver
+///     package but lives in Shared so the Host (.NET 4.8) can decode without taking a
+///     reference to the .NET 10 driver assembly. The Proxy serializes from its own
+///     <c>FocasAddress</c>; the Host maps back to its local equivalent.
+/// </summary>
+[MessagePackObject]
+public sealed class FocasAddressDto
+{
+    /// <summary>0 = Pmc, 1 = Parameter, 2 = Macro. Matches <c>FocasAreaKind</c> enum order.</summary>
+    [Key(0)] public int Kind { get; set; }
+
+    /// <summary>PMC letter — null for Parameter / Macro.</summary>
+    [Key(1)] public string? PmcLetter { get; set; }
+
+    [Key(2)] public int Number { get; set; }
+
+    /// <summary>Optional bit index (0-7 for PMC, 0-31 for Parameter).</summary>
+    [Key(3)] public int? BitIndex { get; set; }
+}
+
+/// <summary>
+///     0 = Bit, 1 = Byte, 2 = Int16, 3 = Int32, 4 = Float32, 5 = Float64, 6 = String.
+///     Matches <c>FocasDataType</c> enum order so both sides can cast <c>(int)</c>.
+/// </summary>
+public static class FocasDataTypeCode
+{
+    public const int Bit = 0;
+    public const int Byte = 1;
+    public const int Int16 = 2;
+    public const int Int32 = 3;
+    public const int Float32 = 4;
+    public const int Float64 = 5;
+    public const int String = 6;
+}

src/ZB.MOM.WW.OtOpcUa.Driver.FOCAS.Shared/Contracts/Framing.cs

@@ -0,0 +1,57 @@
+namespace ZB.MOM.WW.OtOpcUa.Driver.FOCAS.Shared.Contracts;
+
+/// <summary>
+///     Length-prefixed framing. Each IPC frame is:
+///     <c>[4-byte big-endian length][1-byte message kind][MessagePack body]</c>.
+///     Length is the body size only; the kind byte is not part of the prefixed length.
+///     Mirrors the Galaxy Tier-C framing so operators see one wire format across hosts.
+/// </summary>
+public static class Framing
+{
+    public const int LengthPrefixSize = 4;
+    public const int KindByteSize = 1;
+
+    /// <summary>
+    ///     Maximum permitted body length (16 MiB). Protects the receiver from a hostile or
+    ///     misbehaving peer sending an oversized length prefix.
+    /// </summary>
+    public const int MaxFrameBodyBytes = 16 * 1024 * 1024;
+}
+
+/// <summary>
+///     Wire identifier for each contract. Values are stable — new contracts append, never
+///     reuse. Ranges kept aligned with Galaxy so an operator reading a hex dump doesn't have
+///     to context-switch between drivers.
+/// </summary>
+public enum FocasMessageKind : byte
+{
+    Hello                    = 0x01,
+    HelloAck                 = 0x02,
+    Heartbeat                = 0x03,
+    HeartbeatAck             = 0x04,
+
+    OpenSessionRequest       = 0x10,
+    OpenSessionResponse      = 0x11,
+    CloseSessionRequest      = 0x12,
+
+    ReadRequest              = 0x30,
+    ReadResponse             = 0x31,
+    WriteRequest             = 0x32,
+    WriteResponse            = 0x33,
+    PmcBitWriteRequest       = 0x34,
+    PmcBitWriteResponse      = 0x35,
+
+    SubscribeRequest         = 0x40,
+    SubscribeResponse        = 0x41,
+    UnsubscribeRequest       = 0x42,
+    OnDataChangeNotification = 0x43,
+
+    ProbeRequest             = 0x70,
+    ProbeResponse            = 0x71,
+    RuntimeStatusChange      = 0x72,
+
+    RecycleHostRequest       = 0xF0,
+    RecycleStatusResponse    = 0xF1,
+
+    ErrorResponse            = 0xFE,
+}

src/ZB.MOM.WW.OtOpcUa.Driver.FOCAS.Shared/Contracts/Hello.cs

@@ -0,0 +1,63 @@
+using MessagePack;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.FOCAS.Shared.Contracts;
+
+/// <summary>
+///     First frame of every FOCAS Proxy -> Host connection. Advertises protocol major/minor
+///     and the per-process shared secret the Proxy passed to the Host at spawn time. Major
+///     mismatch is fatal; minor is advisory.
+/// </summary>
+[MessagePackObject]
+public sealed class Hello
+{
+    public const int CurrentMajor = 1;
+    public const int CurrentMinor = 0;
+
+    [Key(0)] public int ProtocolMajor { get; set; } = CurrentMajor;
+    [Key(1)] public int ProtocolMinor { get; set; } = CurrentMinor;
+    [Key(2)] public string PeerName { get; set; } = string.Empty;
+
+    /// <summary>
+    ///     Per-process shared secret verified on the Host side against the value passed by the
+    ///     supervisor at spawn time. Protects against a local attacker connecting to the pipe
+    ///     after authenticating via the pipe ACL.
+    /// </summary>
+    [Key(3)] public string SharedSecret { get; set; } = string.Empty;
+
+    [Key(4)] public string[] Features { get; set; } = System.Array.Empty<string>();
+}
+
+[MessagePackObject]
+public sealed class HelloAck
+{
+    [Key(0)] public int ProtocolMajor { get; set; } = Hello.CurrentMajor;
+    [Key(1)] public int ProtocolMinor { get; set; } = Hello.CurrentMinor;
+
+    /// <summary>True if the Host accepted the hello; false + <see cref="RejectReason"/> filled if not.</summary>
+    [Key(2)] public bool Accepted { get; set; }
+    [Key(3)] public string? RejectReason { get; set; }
+
+    [Key(4)] public string HostName { get; set; } = string.Empty;
+}
+
+[MessagePackObject]
+public sealed class Heartbeat
+{
+    [Key(0)] public long MonotonicTicks { get; set; }
+}
+
+[MessagePackObject]
+public sealed class HeartbeatAck
+{
+    [Key(0)] public long MonotonicTicks { get; set; }
+    [Key(1)] public long HostUtcUnixMs { get; set; }
+}
+
+[MessagePackObject]
+public sealed class ErrorResponse
+{
+    /// <summary>Stable symbolic code — e.g. <c>InvalidAddress</c>, <c>SessionNotFound</c>, <c>Fwlib32Crashed</c>.</summary>
+    [Key(0)] public string Code { get; set; } = string.Empty;
+
+    [Key(1)] public string Message { get; set; } = string.Empty;
+}

src/ZB.MOM.WW.OtOpcUa.Driver.FOCAS.Shared/Contracts/Probe.cs

@@ -0,0 +1,47 @@
+using MessagePack;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.FOCAS.Shared.Contracts;
+
+/// <summary>Lightweight connectivity probe — maps to <c>cnc_rdcncstat</c> on the Host.</summary>
+[MessagePackObject]
+public sealed class ProbeRequest
+{
+    [Key(0)] public long SessionId { get; set; }
+    [Key(1)] public int TimeoutMs { get; set; } = 2000;
+}
+
+[MessagePackObject]
+public sealed class ProbeResponse
+{
+    [Key(0)] public bool Healthy { get; set; }
+    [Key(1)] public string? Error { get; set; }
+    [Key(2)] public long ObservedAtUtcUnixMs { get; set; }
+}
+
+/// <summary>Per-host runtime status — fan-out target when the Host observes the CNC going unreachable without the Proxy asking.</summary>
+[MessagePackObject]
+public sealed class RuntimeStatusChangeNotification
+{
+    [Key(0)] public long SessionId { get; set; }
+
+    /// <summary>Running | Stopped | Unknown.</summary>
+    [Key(1)] public string RuntimeStatus { get; set; } = string.Empty;
+
+    [Key(2)] public long ObservedAtUtcUnixMs { get; set; }
+}
+
+[MessagePackObject]
+public sealed class RecycleHostRequest
+{
+    /// <summary>Soft | Hard. Soft drains subscriptions first; Hard kills immediately.</summary>
+    [Key(0)] public string Kind { get; set; } = "Soft";
+    [Key(1)] public string Reason { get; set; } = string.Empty;
+}
+
+[MessagePackObject]
+public sealed class RecycleStatusResponse
+{
+    [Key(0)] public bool Accepted { get; set; }
+    [Key(1)] public int GraceSeconds { get; set; } = 15;
+    [Key(2)] public string? Error { get; set; }
+}

src/ZB.MOM.WW.OtOpcUa.Driver.FOCAS.Shared/Contracts/ReadWrite.cs

@@ -0,0 +1,85 @@
+using MessagePack;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.FOCAS.Shared.Contracts;
+
+/// <summary>
+///     Read one FOCAS address. Multi-read is the Proxy's responsibility — it batches
+///     per-tag reads into parallel <see cref="ReadRequest"/> frames the Host services on its
+///     STA thread. Keeping the IPC read single-address keeps the Host side trivial; FOCAS
+///     itself has no multi-read primitive that spans area kinds.
+/// </summary>
+[MessagePackObject]
+public sealed class ReadRequest
+{
+    [Key(0)] public long SessionId { get; set; }
+    [Key(1)] public FocasAddressDto Address { get; set; } = new();
+    [Key(2)] public int DataType { get; set; }
+    [Key(3)] public int TimeoutMs { get; set; } = 2000;
+}
+
+[MessagePackObject]
+public sealed class ReadResponse
+{
+    [Key(0)] public bool Success { get; set; }
+    [Key(1)] public string? Error { get; set; }
+
+    /// <summary>OPC UA status code mapped by the Host via <c>FocasStatusMapper</c> — 0 = Good.</summary>
+    [Key(2)] public uint StatusCode { get; set; }
+
+    /// <summary>MessagePack-serialized boxed value. <c>null</c> when <see cref="Success"/> is false.</summary>
+    [Key(3)] public byte[]? ValueBytes { get; set; }
+
+    /// <summary>Matches <see cref="FocasDataTypeCode"/> so the Proxy knows how to deserialize.</summary>
+    [Key(4)] public int ValueTypeCode { get; set; }
+
+    [Key(5)] public long SourceTimestampUtcUnixMs { get; set; }
+}
+
+[MessagePackObject]
+public sealed class WriteRequest
+{
+    [Key(0)] public long SessionId { get; set; }
+    [Key(1)] public FocasAddressDto Address { get; set; } = new();
+    [Key(2)] public int DataType { get; set; }
+    [Key(3)] public byte[]? ValueBytes { get; set; }
+    [Key(4)] public int ValueTypeCode { get; set; }
+    [Key(5)] public int TimeoutMs { get; set; } = 2000;
+}
+
+[MessagePackObject]
+public sealed class WriteResponse
+{
+    [Key(0)] public bool Success { get; set; }
+    [Key(1)] public string? Error { get; set; }
+
+    /// <summary>OPC UA status code — 0 = Good.</summary>
+    [Key(2)] public uint StatusCode { get; set; }
+}
+
+/// <summary>
+///     PMC bit read-modify-write. Handled as a first-class operation (not two separate
+///     read+write round-trips) so the critical section stays on the Host — serializing
+///     concurrent bit writers to the same parent byte is Host-side via
+///     <c>SemaphoreSlim</c> keyed on <c>(PmcLetter, Number)</c>. Mirrors the in-process
+///     pattern from <c>FocasPmcBitRmw</c>.
+/// </summary>
+[MessagePackObject]
+public sealed class PmcBitWriteRequest
+{
+    [Key(0)] public long SessionId { get; set; }
+    [Key(1)] public FocasAddressDto Address { get; set; } = new();
+
+    /// <summary>The bit index to set/clear. 0-7.</summary>
+    [Key(2)] public int BitIndex { get; set; }
+
+    [Key(3)] public bool Value { get; set; }
+    [Key(4)] public int TimeoutMs { get; set; } = 2000;
+}
+
+[MessagePackObject]
+public sealed class PmcBitWriteResponse
+{
+    [Key(0)] public bool Success { get; set; }
+    [Key(1)] public string? Error { get; set; }
+    [Key(2)] public uint StatusCode { get; set; }
+}

src/ZB.MOM.WW.OtOpcUa.Driver.FOCAS.Shared/Contracts/Session.cs

@@ -0,0 +1,31 @@
+using MessagePack;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.FOCAS.Shared.Contracts;
+
+/// <summary>
+///     Open a FOCAS session against the CNC at <see cref="HostAddress"/>. One session per
+///     configured device. The Host owns the Fwlib32 handle; the Proxy tracks only the
+///     opaque <see cref="OpenSessionResponse.SessionId"/> returned on success.
+/// </summary>
+[MessagePackObject]
+public sealed class OpenSessionRequest
+{
+    [Key(0)] public string HostAddress { get; set; } = string.Empty;
+    [Key(1)] public int TimeoutMs { get; set; } = 2000;
+    [Key(2)] public int CncSeries { get; set; }
+}
+
+[MessagePackObject]
+public sealed class OpenSessionResponse
+{
+    [Key(0)] public bool Success { get; set; }
+    [Key(1)] public long SessionId { get; set; }
+    [Key(2)] public string? Error { get; set; }
+    [Key(3)] public string? ErrorCode { get; set; }
+}
+
+[MessagePackObject]
+public sealed class CloseSessionRequest
+{
+    [Key(0)] public long SessionId { get; set; }
+}

src/ZB.MOM.WW.OtOpcUa.Driver.FOCAS.Shared/Contracts/Subscriptions.cs

@@ -0,0 +1,61 @@
+using MessagePack;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.FOCAS.Shared.Contracts;
+
+/// <summary>
+///     Subscribe the Host to polling a set of tags on behalf of the Proxy. FOCAS is
+///     poll-only — there are no CNC-initiated callbacks — so the Host runs the poll loop and
+///     pushes <see cref="OnDataChangeNotification"/> frames whenever a value differs from
+///     the last observation. Delta-only + per-group interval keeps the wire quiet.
+/// </summary>
+[MessagePackObject]
+public sealed class SubscribeRequest
+{
+    [Key(0)] public long SessionId { get; set; }
+    [Key(1)] public long SubscriptionId { get; set; }
+    [Key(2)] public int IntervalMs { get; set; } = 1000;
+    [Key(3)] public SubscribeItem[] Items { get; set; } = System.Array.Empty<SubscribeItem>();
+}
+
+[MessagePackObject]
+public sealed class SubscribeItem
+{
+    /// <summary>Opaque correlation id the Proxy uses to route notifications back to the right OPC UA MonitoredItem.</summary>
+    [Key(0)] public long MonitoredItemId { get; set; }
+
+    [Key(1)] public FocasAddressDto Address { get; set; } = new();
+    [Key(2)] public int DataType { get; set; }
+}
+
+[MessagePackObject]
+public sealed class SubscribeResponse
+{
+    [Key(0)] public bool Success { get; set; }
+    [Key(1)] public string? Error { get; set; }
+
+    /// <summary>Items the Host refused (address mismatch, unsupported type). Empty on full success.</summary>
+    [Key(2)] public long[] RejectedMonitoredItemIds { get; set; } = System.Array.Empty<long>();
+}
+
+[MessagePackObject]
+public sealed class UnsubscribeRequest
+{
+    [Key(0)] public long SubscriptionId { get; set; }
+}
+
+[MessagePackObject]
+public sealed class OnDataChangeNotification
+{
+    [Key(0)] public long SubscriptionId { get; set; }
+    [Key(1)] public DataChange[] Changes { get; set; } = System.Array.Empty<DataChange>();
+}
+
+[MessagePackObject]
+public sealed class DataChange
+{
+    [Key(0)] public long MonitoredItemId { get; set; }
+    [Key(1)] public uint StatusCode { get; set; }
+    [Key(2)] public byte[]? ValueBytes { get; set; }
+    [Key(3)] public int ValueTypeCode { get; set; }
+    [Key(4)] public long SourceTimestampUtcUnixMs { get; set; }
+}

src/ZB.MOM.WW.OtOpcUa.Driver.FOCAS.Shared/FrameReader.cs

@@ -0,0 +1,67 @@
+using System;
+using System.IO;
+using System.Threading;
+using System.Threading.Tasks;
+using MessagePack;
+using ZB.MOM.WW.OtOpcUa.Driver.FOCAS.Shared.Contracts;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.FOCAS.Shared;
+
+/// <summary>
+///     Reads length-prefixed, kind-tagged frames from a stream. Single-consumer — do not call
+///     <see cref="ReadFrameAsync"/> from multiple threads against the same instance.
+/// </summary>
+public sealed class FrameReader : IDisposable
+{
+    private readonly Stream _stream;
+    private readonly bool _leaveOpen;
+
+    public FrameReader(Stream stream, bool leaveOpen = false)
+    {
+        _stream = stream ?? throw new ArgumentNullException(nameof(stream));
+        _leaveOpen = leaveOpen;
+    }
+
+    public async Task<(FocasMessageKind Kind, byte[] Body)?> ReadFrameAsync(CancellationToken ct)
+    {
+        var lengthPrefix = new byte[Framing.LengthPrefixSize];
+        if (!await ReadExactAsync(lengthPrefix, ct).ConfigureAwait(false))
+            return null;
+
+        var length = (lengthPrefix[0] << 24) | (lengthPrefix[1] << 16) | (lengthPrefix[2] << 8) | lengthPrefix[3];
+        if (length < 0 || length > Framing.MaxFrameBodyBytes)
+            throw new InvalidDataException($"IPC frame length {length} out of range.");
+
+        var kindByte = _stream.ReadByte();
+        if (kindByte < 0) throw new EndOfStreamException("EOF after length prefix, before kind byte.");
+
+        var body = new byte[length];
+        if (!await ReadExactAsync(body, ct).ConfigureAwait(false))
+            throw new EndOfStreamException("EOF mid-frame.");
+
+        return ((FocasMessageKind)(byte)kindByte, body);
+    }
+
+    public static T Deserialize<T>(byte[] body) => MessagePackSerializer.Deserialize<T>(body);
+
+    private async Task<bool> ReadExactAsync(byte[] buffer, CancellationToken ct)
+    {
+        var offset = 0;
+        while (offset < buffer.Length)
+        {
+            var read = await _stream.ReadAsync(buffer, offset, buffer.Length - offset, ct).ConfigureAwait(false);
+            if (read == 0)
+            {
+                if (offset == 0) return false;
+                throw new EndOfStreamException($"Stream ended after reading {offset} of {buffer.Length} bytes.");
+            }
+            offset += read;
+        }
+        return true;
+    }
+
+    public void Dispose()
+    {
+        if (!_leaveOpen) _stream.Dispose();
+    }
+}

src/ZB.MOM.WW.OtOpcUa.Driver.FOCAS.Shared/FrameWriter.cs

@@ -0,0 +1,56 @@
+using System;
+using System.IO;
+using System.Threading;
+using System.Threading.Tasks;
+using MessagePack;
+using ZB.MOM.WW.OtOpcUa.Driver.FOCAS.Shared.Contracts;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.FOCAS.Shared;
+
+/// <summary>
+///     Writes length-prefixed, kind-tagged MessagePack frames to a stream. Thread-safe via
+///     <see cref="SemaphoreSlim"/> — multiple producers (e.g. heartbeat + data-plane sharing a
+///     stream) get serialized writes.
+/// </summary>
+public sealed class FrameWriter : IDisposable
+{
+    private readonly Stream _stream;
+    private readonly SemaphoreSlim _gate = new(1, 1);
+    private readonly bool _leaveOpen;
+
+    public FrameWriter(Stream stream, bool leaveOpen = false)
+    {
+        _stream = stream ?? throw new ArgumentNullException(nameof(stream));
+        _leaveOpen = leaveOpen;
+    }
+
+    public async Task WriteAsync<T>(FocasMessageKind kind, T message, CancellationToken ct)
+    {
+        var body = MessagePackSerializer.Serialize(message, cancellationToken: ct);
+        if (body.Length > Framing.MaxFrameBodyBytes)
+            throw new InvalidOperationException(
+                $"IPC frame body {body.Length} exceeds {Framing.MaxFrameBodyBytes} byte cap.");
+
+        var lengthPrefix = new byte[Framing.LengthPrefixSize];
+        lengthPrefix[0] = (byte)((body.Length >> 24) & 0xFF);
+        lengthPrefix[1] = (byte)((body.Length >> 16) & 0xFF);
+        lengthPrefix[2] = (byte)((body.Length >> 8)  & 0xFF);
+        lengthPrefix[3] = (byte)( body.Length        & 0xFF);
+
+        await _gate.WaitAsync(ct).ConfigureAwait(false);
+        try
+        {
+            await _stream.WriteAsync(lengthPrefix, 0, lengthPrefix.Length, ct).ConfigureAwait(false);
+            _stream.WriteByte((byte)kind);
+            await _stream.WriteAsync(body, 0, body.Length, ct).ConfigureAwait(false);
+            await _stream.FlushAsync(ct).ConfigureAwait(false);
+        }
+        finally { _gate.Release(); }
+    }
+
+    public void Dispose()
+    {
+        _gate.Dispose();
+        if (!_leaveOpen) _stream.Dispose();
+    }
+}

src/ZB.MOM.WW.OtOpcUa.Driver.FOCAS.Shared/ZB.MOM.WW.OtOpcUa.Driver.FOCAS.Shared.csproj

@@ -0,0 +1,23 @@
+<Project Sdk="Microsoft.NET.Sdk">
+
+    <PropertyGroup>
+        <TargetFramework>netstandard2.0</TargetFramework>
+        <Nullable>enable</Nullable>
+        <LangVersion>latest</LangVersion>
+        <TreatWarningsAsErrors>true</TreatWarningsAsErrors>
+        <GenerateDocumentationFile>true</GenerateDocumentationFile>
+        <NoWarn>$(NoWarn);CS1591</NoWarn>
+        <RootNamespace>ZB.MOM.WW.OtOpcUa.Driver.FOCAS.Shared</RootNamespace>
+    </PropertyGroup>
+
+    <ItemGroup>
+        <!-- MessagePack for IPC. Netstandard 2.0 consumable by both .NET 10 (Proxy) + .NET 4.8 (Host). -->
+        <PackageReference Include="MessagePack" Version="2.5.187"/>
+    </ItemGroup>
+
+    <ItemGroup>
+        <NuGetAuditSuppress Include="https://github.com/advisories/GHSA-37gx-xxp4-5rgx"/>
+        <NuGetAuditSuppress Include="https://github.com/advisories/GHSA-w3x6-4m5h-cxqf"/>
+    </ItemGroup>
+
+</Project>

src/ZB.MOM.WW.OtOpcUa.Driver.FOCAS/FocasCapabilityMatrix.cs

@@ -0,0 +1,139 @@
+namespace ZB.MOM.WW.OtOpcUa.Driver.FOCAS;
+
+/// <summary>
+///     Documented-API capability matrix — per CNC series, what ranges each
+///     <see cref="FocasAreaKind"/> supports. Authoritative source for the driver's
+///     pre-flight validation in <see cref="FocasDriver.InitializeAsync"/>.
+/// </summary>
+/// <remarks>
+///     <para>Ranges come from the Fanuc FOCAS Developer Kit documentation matrix
+///     (see <c>docs/v2/focas-version-matrix.md</c> for the authoritative copy with
+///     per-function citations). Numbers chosen to match what the FOCAS library
+///     accepts — a read against an address outside the documented range returns
+///     <c>EW_NUMBER</c> or <c>EW_PARAM</c> at the wire, which this driver maps to
+///     BadOutOfRange. Catching at init time surfaces the mismatch as a config
+///     error before any session is opened.</para>
+///     <para><see cref="FocasCncSeries.Unknown"/> is treated permissively: every
+///     address passes validation. Pre-matrix configs don't break on upgrade; new
+///     deployments are encouraged to declare a series in the device options.</para>
+/// </remarks>
+public static class FocasCapabilityMatrix
+{
+    /// <summary>
+    ///     Check whether <paramref name="address"/> is accepted by a CNC of
+    ///     <paramref name="series"/>. Returns <c>null</c> on pass + a failure reason
+    ///     on reject — the driver surfaces the reason string verbatim when failing
+    ///     <c>InitializeAsync</c> so operators see the specific out-of-range without
+    ///     guessing.
+    /// </summary>
+    public static string? Validate(FocasCncSeries series, FocasAddress address)
+    {
+        if (series == FocasCncSeries.Unknown) return null;
+
+        return address.Kind switch
+        {
+            FocasAreaKind.Macro     => ValidateMacro(series, address.Number),
+            FocasAreaKind.Parameter => ValidateParameter(series, address.Number),
+            FocasAreaKind.Pmc       => ValidatePmc(series, address.PmcLetter, address.Number),
+            _ => null,
+        };
+    }
+
+    /// <summary>Macro variable number accepted by a CNC series. Cites
+    /// <c>cnc_rdmacro</c>/<c>cnc_wrmacro</c> in the Developer Kit.</summary>
+    internal static (int min, int max) MacroRange(FocasCncSeries series) => series switch
+    {
+        // Common macros 1-33 + 100-199 + 500-999 universally; extended 10000+ only on
+        // higher-end series. Using the extended ceiling per series per DevKit notes.
+        FocasCncSeries.Sixteen_i    => (0, 999),
+        FocasCncSeries.Zero_i_D     => (0, 999),
+        FocasCncSeries.Zero_i_F or
+        FocasCncSeries.Zero_i_MF or
+        FocasCncSeries.Zero_i_TF    => (0, 9999),
+        FocasCncSeries.Thirty_i or
+        FocasCncSeries.ThirtyOne_i or
+        FocasCncSeries.ThirtyTwo_i  => (0, 99999),
+        FocasCncSeries.PowerMotion_i => (0, 999),
+        _ => (0, int.MaxValue),
+    };
+
+    /// <summary>Parameter number accepted; from <c>cnc_rdparam</c>/<c>cnc_wrparam</c>.
+    /// Ranges reflect the highest-numbered parameter documented per series.</summary>
+    internal static (int min, int max) ParameterRange(FocasCncSeries series) => series switch
+    {
+        FocasCncSeries.Sixteen_i    => (0, 9999),
+        FocasCncSeries.Zero_i_D or
+        FocasCncSeries.Zero_i_F or
+        FocasCncSeries.Zero_i_MF or
+        FocasCncSeries.Zero_i_TF    => (0, 14999),
+        FocasCncSeries.Thirty_i or
+        FocasCncSeries.ThirtyOne_i or
+        FocasCncSeries.ThirtyTwo_i  => (0, 29999),
+        FocasCncSeries.PowerMotion_i => (0, 29999),
+        _ => (0, int.MaxValue),
+    };
+
+    /// <summary>PMC letters accepted per series. Legacy controllers omit F/M/C
+    /// signal groups that 30i-family ladder programs use.</summary>
+    internal static IReadOnlySet<string> PmcLetters(FocasCncSeries series) => series switch
+    {
+        FocasCncSeries.Sixteen_i     => new HashSet<string>(StringComparer.OrdinalIgnoreCase) { "X", "Y", "R", "D" },
+        FocasCncSeries.Zero_i_D      => new HashSet<string>(StringComparer.OrdinalIgnoreCase) { "X", "Y", "R", "D", "E", "A" },
+        FocasCncSeries.Zero_i_F or
+        FocasCncSeries.Zero_i_MF or
+        FocasCncSeries.Zero_i_TF     => new HashSet<string>(StringComparer.OrdinalIgnoreCase) { "X", "Y", "F", "G", "R", "D", "E", "A", "M", "C" },
+        FocasCncSeries.Thirty_i or
+        FocasCncSeries.ThirtyOne_i or
+        FocasCncSeries.ThirtyTwo_i   => new HashSet<string>(StringComparer.OrdinalIgnoreCase) { "X", "Y", "F", "G", "R", "D", "E", "A", "M", "C", "K", "T" },
+        FocasCncSeries.PowerMotion_i => new HashSet<string>(StringComparer.OrdinalIgnoreCase) { "X", "Y", "R", "D" },
+        _ => new HashSet<string>(StringComparer.OrdinalIgnoreCase),
+    };
+
+    /// <summary>PMC address-number ceiling per series. Multiplied by 8 to get bit
+    /// count since PMC addresses are byte-addressed on read + bit-addressed on
+    /// write — FocasAddress carries the bit separately.</summary>
+    internal static int PmcMaxNumber(FocasCncSeries series) => series switch
+    {
+        FocasCncSeries.Sixteen_i    => 999,
+        FocasCncSeries.Zero_i_D     => 1999,
+        FocasCncSeries.Zero_i_F or
+        FocasCncSeries.Zero_i_MF or
+        FocasCncSeries.Zero_i_TF    => 9999,
+        FocasCncSeries.Thirty_i or
+        FocasCncSeries.ThirtyOne_i or
+        FocasCncSeries.ThirtyTwo_i  => 59999,
+        FocasCncSeries.PowerMotion_i => 1999,
+        _ => int.MaxValue,
+    };
+
+    private static string? ValidateMacro(FocasCncSeries series, int number)
+    {
+        var (min, max) = MacroRange(series);
+        return (number < min || number > max)
+            ? $"Macro variable #{number} is outside the documented range [{min}, {max}] for {series}."
+            : null;
+    }
+
+    private static string? ValidateParameter(FocasCncSeries series, int number)
+    {
+        var (min, max) = ParameterRange(series);
+        return (number < min || number > max)
+            ? $"Parameter #{number} is outside the documented range [{min}, {max}] for {series}."
+            : null;
+    }
+
+    private static string? ValidatePmc(FocasCncSeries series, string? letter, int number)
+    {
+        if (string.IsNullOrEmpty(letter)) return "PMC address is missing its letter prefix.";
+        var letters = PmcLetters(series);
+        if (!letters.Contains(letter))
+        {
+            var letterList = string.Join(", ", letters);
+            return $"PMC letter '{letter}' is not supported on {series}. Accepted: {{{letterList}}}.";
+        }
+        var max = PmcMaxNumber(series);
+        return number > max
+            ? $"PMC address {letter}{number} is outside the documented range [0, {max}] for {series}."
+            : null;
+    }
+}

src/ZB.MOM.WW.OtOpcUa.Driver.FOCAS/FocasCncSeries.cs

@@ -0,0 +1,47 @@
+namespace ZB.MOM.WW.OtOpcUa.Driver.FOCAS;
+
+/// <summary>
+///     Fanuc CNC controller series. Used by <see cref="FocasCapabilityMatrix"/> to
+///     gate which FOCAS addresses + value ranges the driver accepts against a given
+///     CNC — the FOCAS API surface varies meaningfully between series (macro ranges,
+///     PMC address letters, parameter numbers). A tag reference that's valid on a
+///     30i might be out-of-range on an 0i-MF; validating at driver
+///     <c>InitializeAsync</c> time surfaces the mismatch as a fast config error
+///     instead of a runtime read failure after the server's already running.
+/// </summary>
+/// <remarks>
+///     <para>Values chosen from the Fanuc FOCAS Developer Kit documented series
+///     matrix. Add a new entry + a row to <see cref="FocasCapabilityMatrix"/> when
+///     a new controller is targeted — the driver will refuse the device until both
+///     sides of the enum are filled in.</para>
+///     <para>Defaults to <see cref="Unknown"/> when the operator doesn't specify;
+///     the capability matrix treats Unknown as permissive (no range validation,
+///     same as pre-matrix behaviour) so old configs don't break on upgrade.</para>
+/// </remarks>
+public enum FocasCncSeries
+{
+    /// <summary>No series declared; capability matrix is permissive (legacy behaviour).</summary>
+    Unknown = 0,
+
+    /// <summary>Series 0i-D — compact CNC, narrow macro + PMC ranges.</summary>
+    Zero_i_D,
+    /// <summary>Series 0i-F — successor to 0i-D; widened macro range, added Plus variant.</summary>
+    Zero_i_F,
+    /// <summary>Series 0i-MF / 0i-MF Plus — machining-centre variants of 0i-F.</summary>
+    Zero_i_MF,
+    /// <summary>Series 0i-TF / 0i-TF Plus — turning-centre variants of 0i-F.</summary>
+    Zero_i_TF,
+
+    /// <summary>Series 16i / 18i / 21i — mid-range legacy; narrow ranges, limited PMC letters.</summary>
+    Sixteen_i,
+
+    /// <summary>Series 30i — high-end; widest macro / PMC / parameter ranges.</summary>
+    Thirty_i,
+    /// <summary>Series 31i — subset of 30i (fewer axes, same FOCAS surface).</summary>
+    ThirtyOne_i,
+    /// <summary>Series 32i — compact 30i variant.</summary>
+    ThirtyTwo_i,
+
+    /// <summary>Power Motion i — motion-control variant; atypical macro coverage.</summary>
+    PowerMotion_i,
+}

src/ZB.MOM.WW.OtOpcUa.Driver.FOCAS/FocasDriver.cs

@@ -57,7 +57,24 @@ public sealed class FocasDriver : IDriver, IReadable, IWritable, ITagDiscovery,
                         $"FOCAS device has invalid HostAddress '{device.HostAddress}' — expected 'focas://{{ip}}[:{{port}}]'.");
                 _devices[device.HostAddress] = new DeviceState(addr, device);
             }
-            foreach (var tag in _options.Tags) _tagsByName[tag.Name] = tag;
+            // Pre-flight: validate every tag's address against the declared CNC
+            // series so misconfigured addresses fail at init (clear config error)
+            // instead of producing BadOutOfRange on every read at runtime.
+            // Series=Unknown short-circuits the matrix; pre-matrix configs stay permissive.
+            foreach (var tag in _options.Tags)
+            {
+                var parsed = FocasAddress.TryParse(tag.Address)
+                    ?? throw new InvalidOperationException(
+                        $"FOCAS tag '{tag.Name}' has invalid Address '{tag.Address}'. " +
+                        $"Expected forms: R100, R100.3, PARAM:1815/0, MACRO:500.");
+                if (_devices.TryGetValue(tag.DeviceHostAddress, out var device)
+                    && FocasCapabilityMatrix.Validate(device.Options.Series, parsed) is { } reason)
+                {
+                    throw new InvalidOperationException(
+                        $"FOCAS tag '{tag.Name}' ({tag.Address}) rejected by capability matrix: {reason}");
+                }
+                _tagsByName[tag.Name] = tag;
+            }
 
             if (_options.Probe.Enabled)
             {

src/ZB.MOM.WW.OtOpcUa.Driver.FOCAS/FocasDriverOptions.cs

@@ -13,9 +13,15 @@ public sealed class FocasDriverOptions
     public TimeSpan Timeout { get; init; } = TimeSpan.FromSeconds(2);
 }
 
+/// <summary>
+///     One CNC the driver talks to. <paramref name="Series"/> enables per-series
+///     address validation at <see cref="FocasDriver.InitializeAsync"/>; leave as
+///     <see cref="FocasCncSeries.Unknown"/> to skip validation (legacy behaviour).
+/// </summary>
 public sealed record FocasDeviceOptions(
     string HostAddress,
-    string? DeviceName = null);
+    string? DeviceName = null,
+    FocasCncSeries Series = FocasCncSeries.Unknown);
 
 /// <summary>
 ///     One FOCAS-backed OPC UA variable. <paramref name="Address"/> is the canonical FOCAS

src/ZB.MOM.WW.OtOpcUa.Driver.S7/S7Driver.cs

@@ -84,7 +84,7 @@ public sealed class S7Driver(S7DriverOptions options, string driverInstanceId)
         _health = new DriverHealth(DriverState.Initializing, null, null);
         try
         {
-            var plc = new Plc(_options.CpuType, _options.Host, _options.Rack, _options.Slot);
+            var plc = new Plc(_options.CpuType, _options.Host, _options.Port, _options.Rack, _options.Slot);
             // S7netplus writes timeouts into the underlying TcpClient via Plc.WriteTimeout /
             // Plc.ReadTimeout (milliseconds). Set before OpenAsync so the handshake itself
             // honours the bound.

src/ZB.MOM.WW.OtOpcUa.Server/OpcUa/DriverEquipmentContentRegistry.cs

@@ -0,0 +1,47 @@
+using ZB.MOM.WW.OtOpcUa.Core.OpcUa;
+
+namespace ZB.MOM.WW.OtOpcUa.Server.OpcUa;
+
+/// <summary>
+///     Holds pre-loaded <see cref="EquipmentNamespaceContent"/> snapshots keyed by
+///     <c>DriverInstanceId</c>. Populated once during <see cref="OpcUaServerService"/> startup
+///     (after <see cref="NodeBootstrap"/> resolves the generation) so the synchronous lookup
+///     delegate on <see cref="OpcUaApplicationHost"/> can serve the walker from memory without
+///     blocking on async DB I/O mid-dispatch.
+/// </summary>
+/// <remarks>
+///     <para>The registry is intentionally a shared mutable singleton with set-once-per-bootstrap
+///     semantics rather than an immutable map passed by value — the composition in Program.cs
+///     builds <see cref="OpcUaApplicationHost"/> before <see cref="NodeBootstrap"/> runs, so the
+///     registry must exist at DI-compose time but be empty until the generation is known. A
+///     driver registered after the initial populate pass simply returns null from
+///     <see cref="Get"/> + the wire-in falls back to the "no UNS content, let DiscoverAsync own
+///     it" path that PR #155 established.</para>
+/// </remarks>
+public sealed class DriverEquipmentContentRegistry
+{
+    private readonly Dictionary<string, EquipmentNamespaceContent> _content =
+        new(StringComparer.OrdinalIgnoreCase);
+    private readonly Lock _lock = new();
+
+    public EquipmentNamespaceContent? Get(string driverInstanceId)
+    {
+        lock (_lock)
+        {
+            return _content.TryGetValue(driverInstanceId, out var c) ? c : null;
+        }
+    }
+
+    public void Set(string driverInstanceId, EquipmentNamespaceContent content)
+    {
+        lock (_lock)
+        {
+            _content[driverInstanceId] = content;
+        }
+    }
+
+    public int Count
+    {
+        get { lock (_lock) { return _content.Count; } }
+    }
+}

src/ZB.MOM.WW.OtOpcUa.Server/OpcUa/EquipmentNamespaceContentLoader.cs

@@ -0,0 +1,86 @@
+using Microsoft.EntityFrameworkCore;
+using ZB.MOM.WW.OtOpcUa.Configuration;
+using ZB.MOM.WW.OtOpcUa.Configuration.Entities;
+using ZB.MOM.WW.OtOpcUa.Core.OpcUa;
+
+namespace ZB.MOM.WW.OtOpcUa.Server.OpcUa;
+
+/// <summary>
+///     Loads the <see cref="EquipmentNamespaceContent"/> snapshot the
+///     <see cref="EquipmentNodeWalker"/> consumes, scoped to a single
+///     (driverInstanceId, generationId) pair. Joins the four row sets the walker expects:
+///     UnsAreas for the driver's cluster, UnsLines under those areas, Equipment bound to
+///     this driver + its lines, and Tags bound to this driver + its equipment — all at the
+///     supplied generation.
+/// </summary>
+/// <remarks>
+///     <para>The walker is driver-instance-scoped (decisions #116–#121 put the UNS in the
+///     Equipment-kind namespace owned by one driver instance at a time), so this loader is
+///     too — a single call returns one driver's worth of rows, never the whole fleet.</para>
+///
+///     <para>Returns <c>null</c> when the driver instance has no Equipment rows at the
+///     supplied generation. The wire-in in <see cref="OpcUaApplicationHost"/> treats null as
+///     "this driver has no UNS content, skip the walker and let DiscoverAsync own the whole
+///     address space" — the backward-compat path for drivers whose namespace kind is not
+///     Equipment (Modbus / AB CIP / TwinCAT / FOCAS).</para>
+/// </remarks>
+public sealed class EquipmentNamespaceContentLoader
+{
+    private readonly OtOpcUaConfigDbContext _db;
+
+    public EquipmentNamespaceContentLoader(OtOpcUaConfigDbContext db)
+    {
+        _db = db;
+    }
+
+    /// <summary>
+    ///     Load the walker-shaped snapshot for <paramref name="driverInstanceId"/> at
+    ///     <paramref name="generationId"/>. Returns <c>null</c> when the driver has no
+    ///     Equipment rows at that generation.
+    /// </summary>
+    public async Task<EquipmentNamespaceContent?> LoadAsync(
+        string driverInstanceId, long generationId, CancellationToken ct)
+    {
+        var equipment = await _db.Equipment
+            .AsNoTracking()
+            .Where(e => e.DriverInstanceId == driverInstanceId && e.GenerationId == generationId && e.Enabled)
+            .ToListAsync(ct).ConfigureAwait(false);
+
+        if (equipment.Count == 0)
+            return null;
+
+        // Filter UNS tree to only the lines + areas that host at least one Equipment bound to
+        // this driver — skips loading unrelated UNS branches from the cluster. LinesByArea
+        // grouping is driven off the Equipment rows so an empty line (no equipment) doesn't
+        // pull a pointless folder into the walker output.
+        var lineIds = equipment.Select(e => e.UnsLineId).Distinct(StringComparer.OrdinalIgnoreCase).ToArray();
+
+        var lines = await _db.UnsLines
+            .AsNoTracking()
+            .Where(l => l.GenerationId == generationId && lineIds.Contains(l.UnsLineId))
+            .ToListAsync(ct).ConfigureAwait(false);
+
+        var areaIds = lines.Select(l => l.UnsAreaId).Distinct(StringComparer.OrdinalIgnoreCase).ToArray();
+
+        var areas = await _db.UnsAreas
+            .AsNoTracking()
+            .Where(a => a.GenerationId == generationId && areaIds.Contains(a.UnsAreaId))
+            .ToListAsync(ct).ConfigureAwait(false);
+
+        // Tags belonging to this driver at this generation. Walker skips Tags with null
+        // EquipmentId (those are SystemPlatform-kind Galaxy tags per decision #120) but we
+        // load them anyway so the same rowset can drive future non-Equipment-kind walks
+        // without re-hitting the DB. Filtering here is a future optimization; today the
+        // per-tag cost is bounded by driver scope.
+        var tags = await _db.Tags
+            .AsNoTracking()
+            .Where(t => t.DriverInstanceId == driverInstanceId && t.GenerationId == generationId)
+            .ToListAsync(ct).ConfigureAwait(false);
+
+        return new EquipmentNamespaceContent(
+            Areas: areas,
+            Lines: lines,
+            Equipment: equipment,
+            Tags: tags);
+    }
+}

src/ZB.MOM.WW.OtOpcUa.Server/OpcUa/OpcUaApplicationHost.cs

@@ -29,6 +29,7 @@ public sealed class OpcUaApplicationHost : IAsyncDisposable
     private readonly StaleConfigFlag? _staleConfigFlag;
     private readonly Func<string, ZB.MOM.WW.OtOpcUa.Core.Abstractions.DriverTier>? _tierLookup;
     private readonly Func<string, string?>? _resilienceConfigLookup;
+    private readonly Func<string, ZB.MOM.WW.OtOpcUa.Core.OpcUa.EquipmentNamespaceContent?>? _equipmentContentLookup;
     private readonly ILoggerFactory _loggerFactory;
     private readonly ILogger<OpcUaApplicationHost> _logger;
     private ApplicationInstance? _application;
@@ -43,7 +44,8 @@ public sealed class OpcUaApplicationHost : IAsyncDisposable
         NodeScopeResolver? scopeResolver = null,
         StaleConfigFlag? staleConfigFlag = null,
         Func<string, ZB.MOM.WW.OtOpcUa.Core.Abstractions.DriverTier>? tierLookup = null,
-        Func<string, string?>? resilienceConfigLookup = null)
+        Func<string, string?>? resilienceConfigLookup = null,
+        Func<string, ZB.MOM.WW.OtOpcUa.Core.OpcUa.EquipmentNamespaceContent?>? equipmentContentLookup = null)
     {
         _options = options;
         _driverHost = driverHost;
@@ -54,6 +56,7 @@ public sealed class OpcUaApplicationHost : IAsyncDisposable
         _staleConfigFlag = staleConfigFlag;
         _tierLookup = tierLookup;
         _resilienceConfigLookup = resilienceConfigLookup;
+        _equipmentContentLookup = equipmentContentLookup;
         _loggerFactory = loggerFactory;
         _logger = logger;
     }
@@ -103,11 +106,31 @@ public sealed class OpcUaApplicationHost : IAsyncDisposable
         // Drive each driver's discovery through its node manager. The node manager IS the
         // IAddressSpaceBuilder; GenericDriverNodeManager captures alarm-condition sinks into
         // its internal map and wires OnAlarmEvent → sink routing.
+        //
+        // ADR-001 Option A — when an EquipmentNamespaceContent is supplied for an
+        // Equipment-kind driver, run the EquipmentNodeWalker BEFORE the driver's DiscoverAsync
+        // so the UNS folder skeleton (Area/Line/Equipment) + Identification sub-folders +
+        // the five identifier properties (decision #121) are in place. DiscoverAsync then
+        // streams the driver's native shape on top; Tag rows bound to Equipment already
+        // materialized via the walker don't get duplicated because the driver's DiscoverAsync
+        // output is authoritative for its own native references only.
         foreach (var nodeManager in _server.DriverNodeManagers)
         {
             var driverId = nodeManager.Driver.DriverInstanceId;
             try
             {
+                if (_equipmentContentLookup is not null)
+                {
+                    var content = _equipmentContentLookup(driverId);
+                    if (content is not null)
+                    {
+                        ZB.MOM.WW.OtOpcUa.Core.OpcUa.EquipmentNodeWalker.Walk(nodeManager, content);
+                        _logger.LogInformation(
+                            "UNS walker populated {Areas} area(s), {Lines} line(s), {Equipment} equipment, {Tags} tag(s) for driver {Driver}",
+                            content.Areas.Count, content.Lines.Count, content.Equipment.Count, content.Tags.Count, driverId);
+                    }
+                }
+
                 var generic = new GenericDriverNodeManager(nodeManager.Driver);
                 await generic.BuildAddressSpaceAsync(nodeManager, ct).ConfigureAwait(false);
                 _logger.LogInformation("Address space populated for driver {Driver}", driverId);

src/ZB.MOM.WW.OtOpcUa.Server/OpcUaServerService.cs

@@ -1,3 +1,4 @@
+using Microsoft.Extensions.DependencyInjection;
 using Microsoft.Extensions.Hosting;
 using Microsoft.Extensions.Logging;
 using ZB.MOM.WW.OtOpcUa.Core.Hosting;
@@ -15,6 +16,8 @@ public sealed class OpcUaServerService(
     NodeBootstrap bootstrap,
     DriverHost driverHost,
     OpcUaApplicationHost applicationHost,
+    DriverEquipmentContentRegistry equipmentContentRegistry,
+    IServiceScopeFactory scopeFactory,
     ILogger<OpcUaServerService> logger) : BackgroundService
 {
     protected override async Task ExecuteAsync(CancellationToken stoppingToken)
@@ -24,6 +27,15 @@ public sealed class OpcUaServerService(
         var result = await bootstrap.LoadCurrentGenerationAsync(stoppingToken);
         logger.LogInformation("Bootstrap complete: source={Source} generation={Gen}", result.Source, result.GenerationId);
 
+        // ADR-001 Option A — populate per-driver Equipment namespace snapshots into the
+        // registry before StartAsync walks the address space. The walker on the OPC UA side
+        // reads synchronously from the registry; pre-loading here means the hot path stays
+        // non-blocking + each driver pays at most one Config-DB query at bootstrap time.
+        // Skipped when no generation is Published yet — the fleet boots into a UNS-less
+        // address space until the first publish, then the registry fills on next restart.
+        if (result.GenerationId is { } gen)
+            await PopulateEquipmentContentAsync(gen, stoppingToken);
+
         // PR 17: stand up the OPC UA server + drive discovery per registered driver. Driver
         // registration itself (RegisterAsync on DriverHost) happens during an earlier DI
         // extension once the central config DB query + per-driver factory land; for now the
@@ -48,4 +60,30 @@ public sealed class OpcUaServerService(
         await applicationHost.DisposeAsync();
         await driverHost.DisposeAsync();
     }
+
+    /// <summary>
+    ///     Pre-load an <c>EquipmentNamespaceContent</c> snapshot for each registered driver at
+    ///     the bootstrapped generation. Null results (driver has no Equipment rows —
+    ///     Modbus/AB CIP/TwinCAT/FOCAS today per decisions #116–#121) are skipped: the walker
+    ///     wire-in sees Get(driverId) return null + falls back to DiscoverAsync-owns-it.
+    ///     Opens one scope so the scoped <c>OtOpcUaConfigDbContext</c> is shared across all
+    ///     per-driver queries rather than paying scope-setup overhead per driver.
+    /// </summary>
+    private async Task PopulateEquipmentContentAsync(long generationId, CancellationToken ct)
+    {
+        using var scope = scopeFactory.CreateScope();
+        var loader = scope.ServiceProvider.GetRequiredService<EquipmentNamespaceContentLoader>();
+
+        var loaded = 0;
+        foreach (var driverId in driverHost.RegisteredDriverIds)
+        {
+            var content = await loader.LoadAsync(driverId, generationId, ct).ConfigureAwait(false);
+            if (content is null) continue;
+            equipmentContentRegistry.Set(driverId, content);
+            loaded++;
+        }
+        logger.LogInformation(
+            "Equipment namespace snapshots loaded for {Count}/{Total} driver(s) at generation {Gen}",
+            loaded, driverHost.RegisteredDriverIds.Count, generationId);
+    }
 }

src/ZB.MOM.WW.OtOpcUa.Server/Program.cs

@@ -86,7 +86,25 @@ builder.Services.AddSingleton<IUserAuthenticator>(sp => ldapOptions.Enabled
 builder.Services.AddSingleton<ILocalConfigCache>(_ => new LiteDbConfigCache(options.LocalCachePath));
 builder.Services.AddSingleton<DriverHost>();
 builder.Services.AddSingleton<NodeBootstrap>();
-builder.Services.AddSingleton<OpcUaApplicationHost>();
+
+// ADR-001 Option A wiring — the registry is the handoff between OpcUaServerService's
+// bootstrap-time population pass + OpcUaApplicationHost's StartAsync walker invocation.
+// DriverEquipmentContentRegistry.Get is the equipmentContentLookup delegate that PR #155
+// added to OpcUaApplicationHost's ctor seam.
+builder.Services.AddSingleton<DriverEquipmentContentRegistry>();
+builder.Services.AddScoped<EquipmentNamespaceContentLoader>();
+
+builder.Services.AddSingleton<OpcUaApplicationHost>(sp =>
+{
+    var registry = sp.GetRequiredService<DriverEquipmentContentRegistry>();
+    return new OpcUaApplicationHost(
+        sp.GetRequiredService<OpcUaServerOptions>(),
+        sp.GetRequiredService<DriverHost>(),
+        sp.GetRequiredService<IUserAuthenticator>(),
+        sp.GetRequiredService<ILoggerFactory>(),
+        sp.GetRequiredService<ILogger<OpcUaApplicationHost>>(),
+        equipmentContentLookup: registry.Get);
+});
 builder.Services.AddHostedService<OpcUaServerService>();
 
 // Central-config DB access for the host-status publisher (LMX follow-up #7). Scoped context

src/ZB.MOM.WW.OtOpcUa.Server/Security/NodeScopeResolver.cs

@@ -1,42 +1,83 @@
+using System.Collections.Frozen;
 using ZB.MOM.WW.OtOpcUa.Core.Authorization;
 
 namespace ZB.MOM.WW.OtOpcUa.Server.Security;
 
 /// <summary>
 ///     Maps a driver-side full reference (e.g. <c>"TestMachine_001/Oven/SetPoint"</c>) to the
-///     <see cref="NodeScope"/> the Phase 6.2 evaluator walks. Today a simplified resolver that
-///     returns a cluster-scoped + tag-only scope — the deeper UnsArea / UnsLine / Equipment
-///     path lookup from the live Configuration DB is a Stream C.12 follow-up.
+///     <see cref="NodeScope"/> the Phase 6.2 evaluator walks. Supports two modes:
+///     <list type="bullet">
+///     <item>
+///         <b>Cluster-only (pre-ADR-001)</b> — when no path index is supplied the resolver
+///         returns a flat <c>ClusterId + TagId</c> scope. Sufficient while the
+///         Config-DB-driven Equipment walker isn't live; Cluster-level grants cascade to every
+///         tag below per decision #129, so finer per-Equipment grants are effectively
+///         cluster-wide at dispatch.
+///     </item>
+///     <item>
+///         <b>Full-path (post-ADR-001 Task B)</b> — when an index is supplied, the resolver
+///         joins the full reference against the index to produce a complete
+///         <c>Cluster → Namespace → UnsArea → UnsLine → Equipment → Tag</c> scope. Unblocks
+///         per-Equipment / per-UnsLine ACL grants at the dispatch layer.
+///     </item>
+///     </list>
 /// </summary>
 /// <remarks>
-///     <para>The flat cluster-level scope is sufficient for v2 GA because Phase 6.2 ACL grants
-///     at the Cluster scope cascade to every tag below (decision #129 — additive grants). The
-///     finer hierarchy only matters when operators want per-area or per-equipment grants;
-///     those still work for Cluster-level grants, and landing the finer resolution in a
-///     follow-up doesn't regress the base security model.</para>
+///     <para>The index is pre-loaded by the Server bootstrap against the published generation;
+///     the resolver itself does no live DB access. Resolve is O(1) dictionary lookup on the
+///     hot path; the fallback for unknown fullReference strings produces the same cluster-only
+///     scope the pre-ADR-001 resolver returned — new tags picked up via driver discovery but
+///     not yet indexed (e.g. between a DiscoverAsync result and the next generation publish)
+///     stay addressable without a scope-resolver crash.</para>
 ///
-///     <para>Thread-safety: the resolver is stateless once constructed. Callers may cache a
-///     single instance per DriverNodeManager without locks.</para>
+///     <para>Thread-safety: both constructor paths freeze inputs into immutable state. Callers
+///     may cache a single instance per DriverNodeManager without locks. Swap atomically on
+///     generation change via the server's publish pipeline.</para>
 /// </remarks>
 public sealed class NodeScopeResolver
 {
     private readonly string _clusterId;
+    private readonly FrozenDictionary<string, NodeScope>? _index;
 
+    /// <summary>Cluster-only resolver — pre-ADR-001 behavior. Kept for Server processes that
+    /// haven't wired the Config-DB snapshot flow yet.</summary>
     public NodeScopeResolver(string clusterId)
     {
         ArgumentException.ThrowIfNullOrWhiteSpace(clusterId);
         _clusterId = clusterId;
+        _index = null;
+    }
+
+    /// <summary>
+    ///     Full-path resolver (ADR-001 Task B). <paramref name="pathIndex"/> maps each known
+    ///     driver-side full reference to its pre-resolved <see cref="NodeScope"/> carrying
+    ///     every UNS level populated. Entries are typically produced by joining
+    ///     <c>Tag → Equipment → UnsLine → UnsArea</c> rows of the published generation against
+    ///     the driver's discovered full references (or against <c>Tag.TagConfig</c> directly
+    ///     when the walker is config-primary per ADR-001 Option A).
+    /// </summary>
+    public NodeScopeResolver(string clusterId, IReadOnlyDictionary<string, NodeScope> pathIndex)
+    {
+        ArgumentException.ThrowIfNullOrWhiteSpace(clusterId);
+        ArgumentNullException.ThrowIfNull(pathIndex);
+        _clusterId = clusterId;
+        _index = pathIndex.ToFrozenDictionary(StringComparer.Ordinal);
     }
 
     /// <summary>
     ///     Resolve a node scope for the given driver-side <paramref name="fullReference"/>.
-    ///     Phase 1 shape: returns <c>ClusterId</c> + <c>TagId = fullReference</c> only;
-    ///     NamespaceId / UnsArea / UnsLine / Equipment stay null. A future resolver will
-    ///     join against the Configuration DB to populate the full path.
+    ///     Returns the indexed full-path scope when available; falls back to cluster-only
+    ///     (TagId populated only) when the index is absent or the reference isn't indexed.
+    ///     The fallback is the same shape the pre-ADR-001 resolver produced, so the authz
+    ///     evaluator behaves identically for un-indexed references.
     /// </summary>
     public NodeScope Resolve(string fullReference)
     {
         ArgumentException.ThrowIfNullOrWhiteSpace(fullReference);
+
+        if (_index is not null && _index.TryGetValue(fullReference, out var indexed))
+            return indexed;
+
         return new NodeScope
         {
             ClusterId = _clusterId,

src/ZB.MOM.WW.OtOpcUa.Server/Security/ScopePathIndexBuilder.cs

@@ -0,0 +1,81 @@
+using ZB.MOM.WW.OtOpcUa.Configuration.Entities;
+using ZB.MOM.WW.OtOpcUa.Core.Authorization;
+using ZB.MOM.WW.OtOpcUa.Core.OpcUa;
+
+namespace ZB.MOM.WW.OtOpcUa.Server.Security;
+
+/// <summary>
+///     Builds the <see cref="NodeScope"/> path index consumed by <see cref="NodeScopeResolver"/>
+///     from a Config-DB snapshot of a single published generation. Runs once per generation
+///     (or on every generation change) at the Server bootstrap layer; the produced index is
+///     immutable + hot-path readable per ADR-001 Task B.
+/// </summary>
+/// <remarks>
+///     <para>The index key is the driver-side full reference (<c>Tag.TagConfig</c>) — the same
+///     string the dispatch layer passes to <see cref="NodeScopeResolver.Resolve"/>. The value
+///     is a <see cref="NodeScope"/> with every UNS level populated:
+///     <c>ClusterId / NamespaceId / UnsAreaId / UnsLineId / EquipmentId / TagId</c>. Tag rows
+///     with null <c>EquipmentId</c> (SystemPlatform-namespace Galaxy tags per decision #120)
+///     are excluded from the index — the cluster-only fallback path in the resolver handles
+///     them without needing an index entry.</para>
+///
+///     <para>Duplicate keys are not expected but would be indicative of corrupt data — the
+///     builder throws <see cref="InvalidOperationException"/> on collision so a config drift
+///     surfaces at bootstrap instead of producing silently-last-wins scopes at dispatch.</para>
+/// </remarks>
+public static class ScopePathIndexBuilder
+{
+    /// <summary>
+    ///     Build a fullReference → NodeScope index from the four Config-DB collections for a
+    ///     single namespace. Callers must filter inputs to a single
+    ///     <see cref="Namespace"/> + the same <see cref="ConfigGeneration"/> upstream.
+    /// </summary>
+    /// <param name="clusterId">Owning cluster — populates <see cref="NodeScope.ClusterId"/>.</param>
+    /// <param name="namespaceId">Owning namespace — populates <see cref="NodeScope.NamespaceId"/>.</param>
+    /// <param name="content">Pre-loaded rows for the namespace.</param>
+    public static IReadOnlyDictionary<string, NodeScope> Build(
+        string clusterId,
+        string namespaceId,
+        EquipmentNamespaceContent content)
+    {
+        ArgumentException.ThrowIfNullOrWhiteSpace(clusterId);
+        ArgumentException.ThrowIfNullOrWhiteSpace(namespaceId);
+        ArgumentNullException.ThrowIfNull(content);
+
+        var areaByLine = content.Lines.ToDictionary(l => l.UnsLineId, l => l.UnsAreaId, StringComparer.OrdinalIgnoreCase);
+        var lineByEquipment = content.Equipment.ToDictionary(e => e.EquipmentId, e => e.UnsLineId, StringComparer.OrdinalIgnoreCase);
+
+        var index = new Dictionary<string, NodeScope>(StringComparer.Ordinal);
+
+        foreach (var tag in content.Tags)
+        {
+            // Null EquipmentId = SystemPlatform-namespace tag per decision #110 — skip; the
+            // cluster-only resolver fallback handles those without needing an index entry.
+            if (string.IsNullOrEmpty(tag.EquipmentId)) continue;
+
+            // Broken FK — Tag references a missing Equipment row. Skip rather than crash;
+            // sp_ValidateDraft should have caught this at publish, so any drift here is
+            // unexpected but non-fatal.
+            if (!lineByEquipment.TryGetValue(tag.EquipmentId, out var lineId)) continue;
+            if (!areaByLine.TryGetValue(lineId, out var areaId)) continue;
+
+            var scope = new NodeScope
+            {
+                ClusterId = clusterId,
+                NamespaceId = namespaceId,
+                UnsAreaId = areaId,
+                UnsLineId = lineId,
+                EquipmentId = tag.EquipmentId,
+                TagId = tag.TagConfig,
+                Kind = NodeHierarchyKind.Equipment,
+            };
+
+            if (!index.TryAdd(tag.TagConfig, scope))
+                throw new InvalidOperationException(
+                    $"Duplicate fullReference '{tag.TagConfig}' in Equipment namespace '{namespaceId}'. " +
+                    "Config data is corrupt — two Tag rows produced the same wire-level address.");
+        }
+
+        return index;
+    }
+}

tests/ZB.MOM.WW.OtOpcUa.Driver.AbCip.IntegrationTests/AbServerFixture.cs

@@ -1,139 +1,116 @@
-using System.Diagnostics;
+using System.Net.Sockets;
 using Xunit;
 using Xunit.Sdk;
 
 namespace ZB.MOM.WW.OtOpcUa.Driver.AbCip.IntegrationTests;
 
 /// <summary>
-///     Shared fixture that starts libplctag's <c>ab_server</c> simulator in the background for
-///     the duration of an integration test collection. The fixture takes an
-///     <see cref="AbServerProfile"/> (see <see cref="KnownProfiles"/>) so each AB family — ControlLogix,
-///     CompactLogix, Micro800, GuardLogix — starts the simulator with the right <c>--plc</c>
-///     mode + preseed tag set. Binary is expected on PATH; CI resolves that via a job step
-///     that downloads the pinned Windows build from libplctag GitHub Releases before
-///     <c>dotnet test</c> — see <c>docs/v2/test-data-sources.md §2.CI</c> for the exact step.
+///     Reachability probe for the <c>ab_server</c> Docker container (libplctag's CIP
+///     simulator built via <c>Docker/Dockerfile</c>) or any real AB PLC the
+///     <c>AB_SERVER_ENDPOINT</c> env var points at. Parses
+///     <c>AB_SERVER_ENDPOINT</c> (default <c>localhost:44818</c>) + TCP-connects
+///     once at fixture construction. Tests skip via <see cref="AbServerFactAttribute"/>
+///     / <see cref="AbServerTheoryAttribute"/> when the port isn't live, so
+///     <c>dotnet test</c> stays green on a fresh clone without Docker running.
+///     Matches the <see cref="ModbusSimulatorFixture"/> / <c>Snap7ServerFixture</c> /
+///     <c>OpcPlcFixture</c> shape.
 /// </summary>
 /// <remarks>
-///     <para><c>ab_server</c> is a C binary shipped in libplctag's repo (MIT). On developer
-///     workstations it's built once from source and placed on PATH; on CI the workflow file
-///     fetches a version-pinned prebuilt + stages it. Tests skip (via
-///     <see cref="AbServerFactAttribute"/>) when the binary is not on PATH so a fresh clone
-///     without the simulator still gets a green unit-test run.</para>
-///
-///     <para>Per-family profiles live in <see cref="KnownProfiles"/>. When a test wants a
-///     specific family, instantiate the fixture with that profile — either via a
-///     <see cref="IClassFixture{TFixture}"/> derived type or by constructing directly in a
-///     parametric test (the latter is used below for the smoke suite).</para>
+///     Docker is the only supported launch path — no native-binary spawn + no
+///     PATH lookup. Bring the container up before <c>dotnet test</c>:
+///     <c>docker compose -f Docker/docker-compose.yml --profile controllogix up</c>.
 /// </remarks>
 public sealed class AbServerFixture : IAsyncLifetime
 {
-    private Process? _proc;
+    private const string EndpointEnvVar = "AB_SERVER_ENDPOINT";
 
-    /// <summary>The profile the simulator was started with. Same instance the driver-side options should use.</summary>
+    /// <summary>The profile this fixture instance represents. Parallel family smoke tests
+    /// instantiate the fixture with the profile matching their compose-file service.</summary>
     public AbServerProfile Profile { get; }
-    public int Port { get; }
-    public bool IsAvailable { get; private set; }
 
-    public AbServerFixture() : this(KnownProfiles.ControlLogix, AbServerProfile.DefaultPort) { }
+    public string Host { get; } = "127.0.0.1";
+    public int Port { get; } = AbServerProfile.DefaultPort;
 
-    public AbServerFixture(AbServerProfile profile) : this(profile, AbServerProfile.DefaultPort) { }
+    public AbServerFixture() : this(KnownProfiles.ControlLogix) { }
 
-    public AbServerFixture(AbServerProfile profile, int port)
+    public AbServerFixture(AbServerProfile profile)
     {
         Profile = profile ?? throw new ArgumentNullException(nameof(profile));
-        Port = port;
-    }
 
-    public ValueTask InitializeAsync() => InitializeAsync(default);
-    public ValueTask DisposeAsync() => DisposeAsync(default);
-
-    public async ValueTask InitializeAsync(CancellationToken cancellationToken)
-    {
-        if (LocateBinary() is not string binary)
+        // Endpoint override applies to both host + port — targeting a real PLC at
+        // non-default host or port shouldn't need fixture changes.
+        if (Environment.GetEnvironmentVariable(EndpointEnvVar) is { Length: > 0 } raw)
         {
-            IsAvailable = false;
-            return;
+            var parts = raw.Split(':', 2);
+            Host = parts[0];
+            if (parts.Length == 2 && int.TryParse(parts[1], out var p)) Port = p;
         }
-        IsAvailable = true;
-
-        _proc = new Process
-        {
-            StartInfo = new ProcessStartInfo
-            {
-                FileName = binary,
-                Arguments = Profile.BuildCliArgs(Port),
-                RedirectStandardOutput = true,
-                RedirectStandardError = true,
-                UseShellExecute = false,
-                CreateNoWindow = true,
-            },
-        };
-        _proc.Start();
-
-        // Give the server a moment to accept its listen socket before tests try to connect.
-        await Task.Delay(500, cancellationToken).ConfigureAwait(false);
     }
 
-    public ValueTask DisposeAsync(CancellationToken cancellationToken)
+    public ValueTask InitializeAsync() => ValueTask.CompletedTask;
+    public ValueTask DisposeAsync() => ValueTask.CompletedTask;
+
+    /// <summary>
+    ///     <c>true</c> when ab_server is reachable at this fixture's Host/Port. Used by
+    ///     <see cref="AbServerFactAttribute"/> / <see cref="AbServerTheoryAttribute"/>
+    ///     to decide whether to skip tests on a fresh clone without a running container.
+    /// </summary>
+    public static bool IsServerAvailable() =>
+        TcpProbe(ResolveHost(), ResolvePort());
+
+    private static string ResolveHost() =>
+        Environment.GetEnvironmentVariable(EndpointEnvVar)?.Split(':', 2)[0] ?? "127.0.0.1";
+
+    private static int ResolvePort()
+    {
+        var raw = Environment.GetEnvironmentVariable(EndpointEnvVar);
+        if (raw is null) return AbServerProfile.DefaultPort;
+        var parts = raw.Split(':', 2);
+        return parts.Length == 2 && int.TryParse(parts[1], out var p) ? p : AbServerProfile.DefaultPort;
+    }
+
+    /// <summary>One-shot TCP probe; 500 ms budget so a missing container fails the probe fast.</summary>
+    private static bool TcpProbe(string host, int port)
     {
         try
         {
-            if (_proc is { HasExited: false })
-            {
-                _proc.Kill(entireProcessTree: true);
-                _proc.WaitForExit(5_000);
-            }
+            using var client = new TcpClient();
+            var task = client.ConnectAsync(host, port);
+            return task.Wait(TimeSpan.FromMilliseconds(500)) && client.Connected;
         }
-        catch { /* best-effort cleanup */ }
-        _proc?.Dispose();
-        return ValueTask.CompletedTask;
-    }
-
-    /// <summary>
-    ///     Locate <c>ab_server</c> on PATH. Returns <c>null</c> when missing — tests that
-    ///     depend on it should use <see cref="AbServerFactAttribute"/> so CI runs without the binary
-    ///     simply skip rather than fail.
-    /// </summary>
-    public static string? LocateBinary()
-    {
-        var names = new[] { "ab_server.exe", "ab_server" };
-        var path = Environment.GetEnvironmentVariable("PATH") ?? "";
-        foreach (var dir in path.Split(Path.PathSeparator))
-        {
-            foreach (var name in names)
-            {
-                var candidate = Path.Combine(dir, name);
-                if (File.Exists(candidate)) return candidate;
-            }
-        }
-        return null;
+        catch { return false; }
     }
 }
 
 /// <summary>
-///     <c>[Fact]</c>-equivalent that skips when <c>ab_server</c> is not available on PATH.
-///     Integration tests use this instead of <c>[Fact]</c> so a developer box without
-///     <c>ab_server</c> installed still gets a green run.
+///     <c>[Fact]</c>-equivalent that skips when ab_server isn't reachable — accepts a
+///     live Docker listener on <c>localhost:44818</c> or an <c>AB_SERVER_ENDPOINT</c>
+///     override pointing at a real PLC.
 /// </summary>
 public sealed class AbServerFactAttribute : FactAttribute
 {
     public AbServerFactAttribute()
     {
-        if (AbServerFixture.LocateBinary() is null)
-            Skip = "ab_server not on PATH; install libplctag test binaries to run.";
+        if (!AbServerFixture.IsServerAvailable())
+            Skip = "ab_server not reachable. Start the Docker container " +
+                   "(docker compose -f Docker/docker-compose.yml --profile controllogix up) " +
+                   "or set AB_SERVER_ENDPOINT to a real PLC.";
     }
 }
 
 /// <summary>
-///     <c>[Theory]</c>-equivalent that skips when <c>ab_server</c> is not on PATH. Pair with
-///     <c>[MemberData(nameof(KnownProfiles.All))]</c>-style providers to run one theory row per
-///     profile so a single test covers all four families.
+///     <c>[Theory]</c>-equivalent with the same availability rules as
+///     <see cref="AbServerFactAttribute"/>. Pair with
+///     <c>[MemberData(nameof(KnownProfiles.All))]</c>-style providers to run one theory
+///     row per family.
 /// </summary>
 public sealed class AbServerTheoryAttribute : TheoryAttribute
 {
     public AbServerTheoryAttribute()
     {
-        if (AbServerFixture.LocateBinary() is null)
-            Skip = "ab_server not on PATH; install libplctag test binaries to run.";
+        if (!AbServerFixture.IsServerAvailable())
+            Skip = "ab_server not reachable. Start the Docker container " +
+                   "(docker compose -f Docker/docker-compose.yml --profile controllogix up) " +
+                   "or set AB_SERVER_ENDPOINT to a real PLC.";
     }
 }

tests/ZB.MOM.WW.OtOpcUa.Driver.AbCip.IntegrationTests/AbServerProfile.cs

@@ -3,130 +3,51 @@ using ZB.MOM.WW.OtOpcUa.Driver.AbCip;
 namespace ZB.MOM.WW.OtOpcUa.Driver.AbCip.IntegrationTests;
 
 /// <summary>
-///     Per-family provisioning profile for the <c>ab_server</c> simulator. Instead of hard-coding
-///     one fixture shape + one set of CLI args, each integration test picks a profile matching the
-///     family it wants to exercise — ControlLogix / CompactLogix / Micro800 / GuardLogix. The
-///     profile composes the CLI arg list passed to <c>ab_server</c> + the tag-definition set the
-///     driver uses to address the simulator's pre-provisioned tags.
+///     Per-family marker for the <c>ab_server</c> Docker compose profile a given test
+///     targets. The compose file (<c>Docker/docker-compose.yml</c>) is the canonical
+///     source of truth for which tags a family seeds + which <c>--plc</c> mode the
+///     simulator boots in; this record just ties a family enum to operator-facing
+///     notes so fixture + test code can filter / branch by family.
 /// </summary>
-/// <param name="Family">OtOpcUa driver family this profile targets. Drives
-///     <see cref="AbCipDeviceOptions.PlcFamily"/> + driver-side connection-parameter profile
-///     (ConnectionSize, unconnected-only, etc.) per decision #9.</param>
-/// <param name="AbServerPlcArg">The value passed to <c>ab_server --plc &lt;arg&gt;</c>. Some families
-///     map 1:1 (ControlLogix → "controllogix"); Micro800/GuardLogix fall back to the family whose
-///     CIP behavior ab_server emulates most faithfully (see per-profile Notes).</param>
-/// <param name="SeedTags">Tags to preseed on the simulator via <c>--tag &lt;name&gt;:&lt;type&gt;[:&lt;size&gt;]</c>
-///     flags. Each entry becomes one CLI arg; the driver-side <see cref="AbCipTagDefinition"/>
-///     list references the same names so tests can read/write without walking the @tags surface
-///     first.</param>
-/// <param name="Notes">Operator-facing description of what the profile covers + any quirks.</param>
+/// <param name="Family">OtOpcUa driver family this profile targets.</param>
+/// <param name="ComposeProfile">The <c>docker compose --profile</c> name that brings
+///     this family's ab_server up. Matches the service key in the compose file.</param>
+/// <param name="Notes">Operator-facing description of coverage + any quirks.</param>
 public sealed record AbServerProfile(
     AbCipPlcFamily Family,
-    string AbServerPlcArg,
-    IReadOnlyList<AbServerSeedTag> SeedTags,
+    string ComposeProfile,
     string Notes)
 {
-    /// <summary>Default port — every profile uses the same so parallel-runs-of-different-families
-    /// would conflict (deliberately — one simulator per test collection is the model).</summary>
+    /// <summary>Default ab_server port — matches the compose-file port-map + the
+    /// CIP / EtherNet/IP standard.</summary>
     public const int DefaultPort = 44818;
-
-    /// <summary>Compose the full <c>ab_server</c> CLI arg string for
-    /// <see cref="System.Diagnostics.ProcessStartInfo.Arguments"/>.</summary>
-    public string BuildCliArgs(int port)
-    {
-        var parts = new List<string>
-        {
-            "--port", port.ToString(),
-            "--plc", AbServerPlcArg,
-        };
-        foreach (var tag in SeedTags)
-        {
-            parts.Add("--tag");
-            parts.Add(tag.ToCliSpec());
-        }
-        return string.Join(' ', parts);
-    }
-}
-
-/// <summary>One tag the simulator pre-creates. ab_server spec format:
-/// <c>&lt;name&gt;:&lt;type&gt;[:&lt;array_size&gt;]</c>.</summary>
-public sealed record AbServerSeedTag(string Name, string AbServerType, int? ArraySize = null)
-{
-    public string ToCliSpec() => ArraySize is { } n ? $"{Name}:{AbServerType}:{n}" : $"{Name}:{AbServerType}";
 }
 
 /// <summary>Canonical profiles covering every AB CIP family shipped in PRs 9–12.</summary>
 public static class KnownProfiles
 {
-    /// <summary>
-    ///     ControlLogix — the widest-coverage family: full CIP capabilities, generous connection
-    ///     size, @tags controller-walk supported. Tag shape covers atomic types + a Program-scoped
-    ///     tag so the Symbol-Object decoder's scope-split path is exercised.
-    /// </summary>
     public static readonly AbServerProfile ControlLogix = new(
         Family: AbCipPlcFamily.ControlLogix,
-        AbServerPlcArg: "controllogix",
-        SeedTags: new AbServerSeedTag[]
-        {
-            new("TestDINT",  "DINT"),
-            new("TestREAL",  "REAL"),
-            new("TestBOOL",  "BOOL"),
-            new("TestSINT",  "SINT"),
-            new("TestString","STRING"),
-            new("TestArray", "DINT", ArraySize: 16),
-        },
-        Notes: "Widest-coverage profile — PR 9 baseline. UDTs live in PR 6-shipped Template Object tests; ab_server lacks full UDT emulation.");
+        ComposeProfile: "controllogix",
+        Notes: "Widest-coverage profile — PR 9 baseline. UDTs unit-tested via golden Template Object buffers; ab_server lacks full UDT emulation.");
 
-    /// <summary>
-    ///     CompactLogix — narrower ConnectionSize quirk exercised here. ab_server doesn't
-    ///     enforce the narrower limit itself; the driver-side profile caps it + this simulator
-    ///     honors whatever the client asks for. Tag set is a subset of ControlLogix.
-    /// </summary>
     public static readonly AbServerProfile CompactLogix = new(
         Family: AbCipPlcFamily.CompactLogix,
-        AbServerPlcArg: "compactlogix",
-        SeedTags: new AbServerSeedTag[]
-        {
-            new("TestDINT",  "DINT"),
-            new("TestREAL",  "REAL"),
-            new("TestBOOL",  "BOOL"),
-        },
-        Notes: "Narrower ConnectionSize than ControlLogix — driver-side profile caps it per PR 10. Tag set mirrors the CompactLogix atomic subset.");
+        ComposeProfile: "compactlogix",
+        Notes: "ab_server doesn't enforce the narrower ConnectionSize; driver-side profile caps it per PR 10.");
 
-    /// <summary>
-    ///     Micro800 — unconnected-only family. ab_server has no explicit micro800 plc mode so
-    ///     we fall back to the nearest CIP-compatible emulation (controllogix) + document the
-    ///     discrepancy. Driver-side path enforcement (empty routing path, unconnected-only
-    ///     sessions) is exercised in the unit suite; this integration profile smoke-tests that
-    ///     reads work end-to-end against the unconnected path.
-    /// </summary>
     public static readonly AbServerProfile Micro800 = new(
         Family: AbCipPlcFamily.Micro800,
-        AbServerPlcArg: "controllogix", // ab_server lacks dedicated micro800 mode — see Notes
-        SeedTags: new AbServerSeedTag[]
-        {
-            new("TestDINT",  "DINT"),
-            new("TestREAL",  "REAL"),
-        },
-        Notes: "ab_server has no --plc micro800 — falls back to controllogix emulation. Driver side still enforces empty path + unconnected-only per PR 11. Real Micro800 coverage requires a 2080 on a lab rig.");
+        ComposeProfile: "micro800",
+        Notes: "--plc=Micro800 mode (unconnected-only, empty path). Driver-side enforcement verified in the unit suite.");
 
-    /// <summary>
-    ///     GuardLogix — safety-capable ControlLogix variant with ViewOnly safety tags. ab_server
-    ///     doesn't emulate the safety subsystem; we preseed a safety-suffixed name (<c>_S</c>) so
-    ///     the driver's read-only classification path is exercised against a real tag.
-    /// </summary>
     public static readonly AbServerProfile GuardLogix = new(
         Family: AbCipPlcFamily.GuardLogix,
-        AbServerPlcArg: "controllogix",
-        SeedTags: new AbServerSeedTag[]
-        {
-            new("TestDINT",  "DINT"),
-            new("SafetyDINT_S", "DINT"), // _S-suffixed → driver classifies as safety-ViewOnly per PR 12
-        },
-        Notes: "ab_server has no safety subsystem — this profile emulates the tag-naming contract. Real safety-lock behavior requires a physical GuardLogix 1756-L8xS rig.");
+        ComposeProfile: "guardlogix",
+        Notes: "ab_server has no safety subsystem — _S-suffixed seed tag triggers driver-side ViewOnly classification only.");
 
     public static IReadOnlyList<AbServerProfile> All { get; } =
-        new[] { ControlLogix, CompactLogix, Micro800, GuardLogix };
+        [ControlLogix, CompactLogix, Micro800, GuardLogix];
 
     public static AbServerProfile ForFamily(AbCipPlcFamily family) =>
         All.FirstOrDefault(p => p.Family == family)

tests/ZB.MOM.WW.OtOpcUa.Driver.AbCip.IntegrationTests/AbServerProfileGate.cs

@@ -0,0 +1,52 @@
+using Xunit;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.AbCip.IntegrationTests;
+
+/// <summary>
+///     Runtime gate that lets an integration-test class declare which target-server tier
+///     it requires. Reads <c>AB_SERVER_PROFILE</c> from the environment; tests call
+///     <see cref="SkipUnless"/> with the profile names they support + skip otherwise.
+/// </summary>
+/// <remarks>
+///     <para>Two tiers today:</para>
+///     <list type="bullet">
+///       <item><c>abserver</c> (default) — the Dockerized libplctag <c>ab_server</c>
+///         simulator. Covers atomic reads / writes / basic discovery across the four
+///         families (ControlLogix / CompactLogix / Micro800 / GuardLogix).</item>
+///       <item><c>emulate</c> — Rockwell Studio 5000 Logix Emulate on an operator's
+///         Windows box, exposed via <c>AB_SERVER_ENDPOINT</c>. Adds real UDT / ALMD /
+///         AOI / Program-scoped-tag coverage that ab_server can't emulate. Tier-gated
+///         because Emulate is per-seat licensed + Windows-only + manually launched;
+///         a stock `dotnet test` run against ab_server must skip Emulate-only classes
+///         cleanly.</item>
+///     </list>
+///     <para>Tests assert their target tier at the top of each <c>[Fact]</c> /
+///     <c>[Theory]</c> body, mirroring the <c>MODBUS_SIM_PROFILE</c> gate pattern in
+///     <c>tests/.../Modbus.IntegrationTests/DL205/DL205StringQuirkTests.cs</c>.</para>
+/// </remarks>
+public static class AbServerProfileGate
+{
+    public const string Default = "abserver";
+    public const string Emulate = "emulate";
+
+    /// <summary>Active profile from <c>AB_SERVER_PROFILE</c>; defaults to <see cref="Default"/>.</summary>
+    public static string CurrentProfile =>
+        Environment.GetEnvironmentVariable("AB_SERVER_PROFILE") is { Length: > 0 } raw
+            ? raw.Trim().ToLowerInvariant()
+            : Default;
+
+    /// <summary>
+    ///     Skip the calling test via <c>Assert.Skip</c> when <see cref="CurrentProfile"/>
+    ///     isn't in <paramref name="requiredProfiles"/>. Case-insensitive match.
+    /// </summary>
+    public static void SkipUnless(params string[] requiredProfiles)
+    {
+        foreach (var p in requiredProfiles)
+            if (string.Equals(p, CurrentProfile, StringComparison.OrdinalIgnoreCase))
+                return;
+        Assert.Skip(
+            $"Test requires AB_SERVER_PROFILE in {{{string.Join(", ", requiredProfiles)}}}; " +
+            $"current value is '{CurrentProfile}'. " +
+            $"Set AB_SERVER_PROFILE=emulate + point AB_SERVER_ENDPOINT at a Logix Emulate instance to run the golden-box-tier tests.");
+    }
+}

tests/ZB.MOM.WW.OtOpcUa.Driver.AbCip.IntegrationTests/AbServerProfileTests.cs

@@ -5,61 +5,23 @@ using ZB.MOM.WW.OtOpcUa.Driver.AbCip;
 namespace ZB.MOM.WW.OtOpcUa.Driver.AbCip.IntegrationTests;
 
 /// <summary>
-///     Pure-unit tests for the profile → CLI arg composition. Runs without <c>ab_server</c>
-///     on PATH so CI without the binary still exercises these contracts + catches any
-///     profile-definition drift (e.g. a typo in <c>--plc</c> mapping would silently make the
-///     simulator boot with the wrong family).
+///     Pure-unit tests for the profile catalog. Verifies <see cref="KnownProfiles"/>
+///     stays in sync with <see cref="AbCipPlcFamily"/> + with the compose-file service
+///     names — a typo in either would surface as a test failure rather than a silent
+///     "wrong family booted" at runtime. Runs without Docker, so CI without the
+///     container still exercises these contracts.
 /// </summary>
 [Trait("Category", "Unit")]
 public sealed class AbServerProfileTests
 {
-    [Fact]
-    public void BuildCliArgs_Emits_Port_And_Plc_And_TagFlags()
-    {
-        var profile = new AbServerProfile(
-            Family: AbCipPlcFamily.ControlLogix,
-            AbServerPlcArg: "controllogix",
-            SeedTags: new AbServerSeedTag[]
-            {
-                new("A", "DINT"),
-                new("B", "REAL"),
-            },
-            Notes: "test");
-
-        profile.BuildCliArgs(44818).ShouldBe("--port 44818 --plc controllogix --tag A:DINT --tag B:REAL");
-    }
-
-    [Fact]
-    public void BuildCliArgs_NoSeedTags_Emits_Just_Port_And_Plc()
-    {
-        var profile = new AbServerProfile(
-            AbCipPlcFamily.ControlLogix, "controllogix", [], "empty");
-
-        profile.BuildCliArgs(5000).ShouldBe("--port 5000 --plc controllogix");
-    }
-
-    [Fact]
-    public void AbServerSeedTag_ArraySize_FormatsAsThirdSegment()
-    {
-        new AbServerSeedTag("TestArray", "DINT", ArraySize: 16)
-            .ToCliSpec().ShouldBe("TestArray:DINT:16");
-    }
-
-    [Fact]
-    public void AbServerSeedTag_NoArraySize_TwoSegments()
-    {
-        new AbServerSeedTag("TestScalar", "REAL")
-            .ToCliSpec().ShouldBe("TestScalar:REAL");
-    }
-
     [Theory]
     [InlineData(AbCipPlcFamily.ControlLogix, "controllogix")]
     [InlineData(AbCipPlcFamily.CompactLogix, "compactlogix")]
-    [InlineData(AbCipPlcFamily.Micro800,     "controllogix")] // falls back — ab_server lacks dedicated mode
-    [InlineData(AbCipPlcFamily.GuardLogix,   "controllogix")] // falls back — ab_server lacks safety subsystem
-    public void KnownProfiles_ForFamily_Returns_Expected_AbServerPlcArg(AbCipPlcFamily family, string expected)
+    [InlineData(AbCipPlcFamily.Micro800,     "micro800")]
+    [InlineData(AbCipPlcFamily.GuardLogix,   "guardlogix")]
+    public void KnownProfiles_ForFamily_Returns_Expected_ComposeProfile(AbCipPlcFamily family, string expected)
     {
-        KnownProfiles.ForFamily(family).AbServerPlcArg.ShouldBe(expected);
+        KnownProfiles.ForFamily(family).ComposeProfile.ShouldBe(expected);
     }
 
     [Fact]
@@ -71,20 +33,8 @@ public sealed class AbServerProfileTests
     }
 
     [Fact]
-    public void KnownProfiles_ControlLogix_Includes_AllAtomicTypes()
+    public void DefaultPort_Matches_EtherNetIP_Standard()
     {
-        var tags = KnownProfiles.ControlLogix.SeedTags.Select(t => t.AbServerType).ToHashSet();
-        tags.ShouldContain("DINT");
-        tags.ShouldContain("REAL");
-        tags.ShouldContain("BOOL");
-        tags.ShouldContain("SINT");
-        tags.ShouldContain("STRING");
-    }
-
-    [Fact]
-    public void KnownProfiles_GuardLogix_SeedsSafetySuffixedTag()
-    {
-        KnownProfiles.GuardLogix.SeedTags
-            .ShouldContain(t => t.Name.EndsWith("_S"), "GuardLogix profile must seed at least one _S-suffixed tag for safety-classification coverage.");
+        AbServerProfile.DefaultPort.ShouldBe(44818);
     }
 }

tests/ZB.MOM.WW.OtOpcUa.Driver.AbCip.IntegrationTests/Docker/Dockerfile

@@ -0,0 +1,43 @@
+# ab_server container for the AB CIP integration suite.
+#
+# ab_server is a C program in libplctag/libplctag under src/tools/ab_server.
+# We clone at a pinned commit, build just the ab_server target via CMake,
+# and copy the resulting binary into a slim runtime stage so the published
+# image stays small (~60MB vs ~350MB for the build stage).
+
+# -------- stage 1: build ab_server from source --------
+FROM debian:bookworm-slim AS build
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+        git \
+        build-essential \
+        cmake \
+        ca-certificates \
+    && rm -rf /var/lib/apt/lists/*
+
+# Pinned tag matches the `ab_server` version AbServerFixture + CI treat as
+# canonical. Bump deliberately alongside a driver-side change that needs
+# something newer.
+ARG LIBPLCTAG_TAG=release
+RUN git clone --depth 1 --branch "${LIBPLCTAG_TAG}" https://github.com/libplctag/libplctag.git /src
+
+WORKDIR /src
+RUN cmake -S . -B build -DCMAKE_BUILD_TYPE=Release \
+ && cmake --build build --target ab_server --parallel
+
+# -------- stage 2: runtime --------
+FROM debian:bookworm-slim
+
+LABEL org.opencontainers.image.source="https://github.com/dohertj2/lmxopcua" \
+      org.opencontainers.image.description="libplctag ab_server for OtOpcUa AB CIP driver integration tests"
+
+# libplctag's ab_server is statically linked against libc / libstdc++ on
+# Debian bookworm; no runtime dependencies beyond what the slim image
+# already has.
+COPY --from=build /src/build/bin_dist/ab_server /usr/local/bin/ab_server
+
+EXPOSE 44818
+
+# docker-compose.yml overrides the command with per-family flags.
+CMD ["ab_server", "--plc=ControlLogix", "--path=1,0", "--port=44818", \
+     "--tag=TestDINT:DINT[1]", "--tag=TestREAL:REAL[1]", "--tag=TestBOOL:BOOL[1]"]

tests/ZB.MOM.WW.OtOpcUa.Driver.AbCip.IntegrationTests/Docker/README.md

@@ -0,0 +1,89 @@
+# AB CIP integration-test fixture — `ab_server` (Docker)
+
+[libplctag](https://github.com/libplctag/libplctag)'s `ab_server` — a
+MIT-licensed C program that emulates a ControlLogix / CompactLogix CIP
+endpoint over EtherNet/IP. Docker is the only supported launch path;
+`ab_server` ships as a source-only tool under libplctag's
+`src/tools/ab_server/` so the Dockerfile's multi-stage build is the only
+reproducible way to get a working binary across developer boxes. A fresh
+clone needs Docker Desktop and nothing else.
+
+| File | Purpose |
+|---|---|
+| [`Dockerfile`](Dockerfile) | Multi-stage: build from libplctag at pinned tag → copy binary into `debian:bookworm-slim` runtime image |
+| [`docker-compose.yml`](docker-compose.yml) | One service per family (`controllogix` / `compactlogix` / `micro800` / `guardlogix`); all bind `:44818` |
+
+## Run
+
+From the repo root:
+
+```powershell
+# ControlLogix — widest-coverage profile
+docker compose -f tests\ZB.MOM.WW.OtOpcUa.Driver.AbCip.IntegrationTests\Docker\docker-compose.yml --profile controllogix up
+
+# Per-family
+docker compose -f tests\...\Docker\docker-compose.yml --profile compactlogix up
+docker compose -f tests\...\Docker\docker-compose.yml --profile micro800 up
+docker compose -f tests\...\Docker\docker-compose.yml --profile guardlogix up
+```
+
+Detached + stop:
+
+```powershell
+docker compose -f tests\...\Docker\docker-compose.yml --profile controllogix up -d
+docker compose -f tests\...\Docker\docker-compose.yml --profile controllogix down
+```
+
+First run builds the image (~3-5 minutes — clones libplctag + compiles
+`ab_server` + its dependencies). Subsequent runs are fast because the
+multi-stage build layer-caches the checkout + compile.
+
+## Endpoint
+
+- Default: `localhost:44818` (EtherNet/IP standard; non-privileged)
+- Override with `AB_SERVER_ENDPOINT=host:port` to point at a real PLC.
+
+## Run the integration tests
+
+In a separate shell with a container up:
+
+```powershell
+cd C:\Users\dohertj2\Desktop\lmxopcua
+dotnet test tests\ZB.MOM.WW.OtOpcUa.Driver.AbCip.IntegrationTests
+```
+
+`AbServerFixture` TCP-probes `localhost:44818` at collection init +
+records a skip reason when unreachable, so tests stay green on a fresh
+clone without the container running. Tests use `[AbServerFact]` /
+`[AbServerTheory]` which check the same probe.
+
+## What each family seeds
+
+Tag sets match `AbServerProfile.cs` exactly — changing seeds in one
+place means updating both.
+
+| Family | Seeded tags | Notes |
+|---|---|---|
+| ControlLogix | `TestDINT` `TestREAL` `TestBOOL` `TestSINT` `TestString` `TestArray` | Widest-coverage; PR 9 baseline. UDT emulation missing from ab_server |
+| CompactLogix | `TestDINT` `TestREAL` `TestBOOL` | Narrow ConnectionSize cap enforced driver-side; ab_server accepts any size |
+| Micro800 | `TestDINT` `TestREAL` | ab_server has no `micro800` mode; falls back to `controllogix` emulation |
+| GuardLogix | `TestDINT` `SafetyDINT_S` | ab_server has no safety subsystem; `_S` suffix triggers driver-side classification only |
+
+## Known limitations
+
+- **No UDT / CIP Template Object emulation** — `ab_server` covers atomic
+  types only. UDT reads + task #194 whole-UDT optimization verify via
+  unit tests with golden byte buffers.
+- **Family-specific quirks trust driver-side code** — ab_server emulates
+  a generic Logix CPU; the ConnectionSize cap, empty-path unconnected
+  mode, and safety-partition write rejection all need lab rigs for
+  wire-level proof.
+
+See [`docs/drivers/AbServer-Test-Fixture.md`](../../../docs/drivers/AbServer-Test-Fixture.md)
+for the full coverage map.
+
+## References
+
+- [libplctag on GitHub](https://github.com/libplctag/libplctag)
+- [`docs/drivers/AbServer-Test-Fixture.md`](../../../docs/drivers/AbServer-Test-Fixture.md) — coverage map
+- [`docs/v2/dev-environment.md`](../../../docs/v2/dev-environment.md) §Docker fixtures

tests/ZB.MOM.WW.OtOpcUa.Driver.AbCip.IntegrationTests/Docker/docker-compose.yml

@@ -0,0 +1,97 @@
+# AB CIP integration-test fixture — ab_server (libplctag).
+#
+# One service per family. All bind :44818 on the host; only one runs at a
+# time. Commands mirror the CLI args AbServerProfile.cs constructs for the
+# native-binary path.
+#
+# Usage:
+#   docker compose --profile controllogix up
+#   docker compose --profile compactlogix up
+#   docker compose --profile micro800 up
+#   docker compose --profile guardlogix up
+services:
+  controllogix:
+    profiles: ["controllogix"]
+    build:
+      context: .
+      dockerfile: Dockerfile
+    image: otopcua-ab-server:libplctag-release
+    container_name: otopcua-ab-server-controllogix
+    restart: "no"
+    ports:
+      - "44818:44818"
+    command: [
+      "ab_server",
+      "--plc=ControlLogix",
+      "--path=1,0",
+      "--port=44818",
+      "--tag=TestDINT:DINT[1]",
+      "--tag=TestREAL:REAL[1]",
+      "--tag=TestBOOL:BOOL[1]",
+      "--tag=TestSINT:SINT[1]",
+      "--tag=TestString:STRING[1]",
+      "--tag=TestArray:DINT[16]"
+    ]
+
+  compactlogix:
+    profiles: ["compactlogix"]
+    image: otopcua-ab-server:libplctag-release
+    build:
+      context: .
+      dockerfile: Dockerfile
+    container_name: otopcua-ab-server-compactlogix
+    restart: "no"
+    ports:
+      - "44818:44818"
+    # ab_server doesn't distinguish CompactLogix from ControlLogix — no
+    # dedicated --plc mode. Driver-side ConnectionSize cap is enforced
+    # separately (see AbServerProfile.CompactLogix Notes).
+    command: [
+      "ab_server",
+      "--plc=ControlLogix",
+      "--path=1,0",
+      "--port=44818",
+      "--tag=TestDINT:DINT[1]",
+      "--tag=TestREAL:REAL[1]",
+      "--tag=TestBOOL:BOOL[1]"
+    ]
+
+  micro800:
+    profiles: ["micro800"]
+    image: otopcua-ab-server:libplctag-release
+    build:
+      context: .
+      dockerfile: Dockerfile
+    container_name: otopcua-ab-server-micro800
+    restart: "no"
+    ports:
+      - "44818:44818"
+    # ab_server does have a Micro800 plc mode (unconnected-only, empty path).
+    command: [
+      "ab_server",
+      "--plc=Micro800",
+      "--port=44818",
+      "--tag=TestDINT:DINT[1]",
+      "--tag=TestREAL:REAL[1]"
+    ]
+
+  guardlogix:
+    profiles: ["guardlogix"]
+    image: otopcua-ab-server:libplctag-release
+    build:
+      context: .
+      dockerfile: Dockerfile
+    container_name: otopcua-ab-server-guardlogix
+    restart: "no"
+    ports:
+      - "44818:44818"
+    # ab_server has no safety subsystem — _S suffix triggers driver-side
+    # classification only.
+    command: [
+      "ab_server",
+      "--plc=ControlLogix",
+      "--path=1,0",
+      "--port=44818",
+      "--tag=TestDINT:DINT[1]",
+      "--tag=SafetyDINT_S:DINT[1]"
+    ]

tests/ZB.MOM.WW.OtOpcUa.Driver.AbCip.IntegrationTests/Emulate/AbCipEmulateAlmdTests.cs

@@ -0,0 +1,105 @@
+using Shouldly;
+using Xunit;
+using ZB.MOM.WW.OtOpcUa.Core.Abstractions;
+using ZB.MOM.WW.OtOpcUa.Driver.AbCip;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.AbCip.IntegrationTests.Emulate;
+
+/// <summary>
+///     Golden-box-tier ALMD alarm projection tests against Logix Emulate.
+///     Promotes the feature-flagged ALMD projection (task #177) from unit-only coverage
+///     (<c>AbCipAlarmProjectionTests</c> with faked InFaulted sequences) to end-to-end
+///     wire-level coverage — Emulate runs the real ALMD instruction, with real
+///     rising-edge semantics on <c>InFaulted</c> + <c>Ack</c>, so the driver's poll-based
+///     projection gets validated against the actual behaviour shops running FT View see.
+/// </summary>
+/// <remarks>
+///     <para><b>Required Emulate project state</b> (see <c>LogixProject/README.md</c>):</para>
+///     <list type="bullet">
+///       <item>Controller-scope ALMD tag <c>HighTempAlarm</c> — a standard ALMD instruction
+///         with default member set (<c>In</c>, <c>InFaulted</c>, <c>Acked</c>,
+///         <c>Severity</c>, <c>Cfg_ProgTime</c>, …).</item>
+///       <item>A periodic task that drives <c>HighTempAlarm.In</c> false→true→false at a
+///         cadence the operator can script via a one-shot routine (e.g. a
+///         <c>SimulateAlarm</c> bit the test case pulses through
+///         <c>IWritable.WriteAsync</c>).</item>
+///       <item>Operator writes <c>1</c> to <c>SimulateAlarm</c> to trigger the rising
+///         edge on <c>HighTempAlarm.In</c>; ladder uses that as the alarm input.</item>
+///     </list>
+///     <para>Runs only when <c>AB_SERVER_PROFILE=emulate</c>. ab_server has no ALMD
+///     instruction + no alarm subsystem, so this tier-gated class couldn't produce a
+///     meaningful result against the default simulator.</para>
+/// </remarks>
+[Collection("AbServerEmulate")]
+[Trait("Category", "Integration")]
+[Trait("Tier", "Emulate")]
+public sealed class AbCipEmulateAlmdTests
+{
+    [AbServerFact]
+    public async Task Real_ALMD_raise_fires_OnAlarmEvent_through_the_driver_projection()
+    {
+        AbServerProfileGate.SkipUnless(AbServerProfileGate.Emulate);
+
+        var endpoint = Environment.GetEnvironmentVariable("AB_SERVER_ENDPOINT")
+            ?? throw new InvalidOperationException(
+                "AB_SERVER_ENDPOINT must be set to the Logix Emulate instance when AB_SERVER_PROFILE=emulate.");
+
+        var options = new AbCipDriverOptions
+        {
+            Devices = [new AbCipDeviceOptions($"ab://{endpoint}/1,0")],
+            EnableAlarmProjection = true,
+            AlarmPollInterval = TimeSpan.FromMilliseconds(200),
+            Tags = [
+                new AbCipTagDefinition(
+                    Name: "HighTempAlarm",
+                    DeviceHostAddress: $"ab://{endpoint}/1,0",
+                    TagPath: "HighTempAlarm",
+                    DataType: AbCipDataType.Structure,
+                    Members: [
+                        new AbCipStructureMember("InFaulted", AbCipDataType.DInt),
+                        new AbCipStructureMember("Acked",     AbCipDataType.DInt),
+                        new AbCipStructureMember("Severity",  AbCipDataType.DInt),
+                        new AbCipStructureMember("In",        AbCipDataType.DInt),
+                    ]),
+                // The "simulate the alarm input" bit the ladder watches.
+                new AbCipTagDefinition(
+                    Name: "SimulateAlarm",
+                    DeviceHostAddress: $"ab://{endpoint}/1,0",
+                    TagPath: "SimulateAlarm",
+                    DataType: AbCipDataType.Bool,
+                    Writable: true),
+            ],
+        };
+
+        await using var drv = new AbCipDriver(options, driverInstanceId: "emulate-almd");
+        await drv.InitializeAsync("{}", TestContext.Current.CancellationToken);
+
+        var raised = new TaskCompletionSource<AlarmEventArgs>(TaskCreationOptions.RunContinuationsAsynchronously);
+        drv.OnAlarmEvent += (_, e) =>
+        {
+            if (e.Message.Contains("raised")) raised.TrySetResult(e);
+        };
+
+        var sub = await drv.SubscribeAlarmsAsync(
+            ["HighTempAlarm"], TestContext.Current.CancellationToken);
+
+        // Pulse the input bit the ladder watches, then wait for the driver's poll loop
+        // to see InFaulted rise + fire the raise event.
+        _ = await drv.WriteAsync(
+            [new WriteRequest("SimulateAlarm", true)],
+            TestContext.Current.CancellationToken);
+
+        var got = await Task.WhenAny(raised.Task, Task.Delay(TimeSpan.FromSeconds(5)));
+        got.ShouldBe(raised.Task, "driver must surface the ALMD raise within 5 s of the ladder-driven edge");
+        var args = await raised.Task;
+        args.SourceNodeId.ShouldBe("HighTempAlarm");
+        args.AlarmType.ShouldBe("ALMD");
+
+        await drv.UnsubscribeAlarmsAsync(sub, TestContext.Current.CancellationToken);
+
+        // Reset the bit so the next test run starts from a known state.
+        _ = await drv.WriteAsync(
+            [new WriteRequest("SimulateAlarm", false)],
+            TestContext.Current.CancellationToken);
+    }
+}

tests/ZB.MOM.WW.OtOpcUa.Driver.AbCip.IntegrationTests/Emulate/AbCipEmulateUdtReadTests.cs

@@ -0,0 +1,81 @@
+using Shouldly;
+using Xunit;
+using ZB.MOM.WW.OtOpcUa.Core.Abstractions;
+using ZB.MOM.WW.OtOpcUa.Driver.AbCip;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.AbCip.IntegrationTests.Emulate;
+
+/// <summary>
+///     Golden-box-tier UDT read tests against Rockwell Studio 5000 Logix Emulate.
+///     Promotes the whole-UDT-read optimization (task #194) from unit-only coverage
+///     (golden Template Object byte buffers + <see cref="AbCipUdtMemberLayoutTests"/>)
+///     to end-to-end wire-level coverage — Emulate's firmware speaks the same CIP
+///     Template Object responses real hardware does, so the member-offset math + the
+///     <c>AbCipUdtReadPlanner</c> grouping get validated against production semantics.
+/// </summary>
+/// <remarks>
+///     <para><b>Required Emulate project state</b> (see <c>LogixProject/README.md</c>
+///     for the L5X export that seeds this; ship the project once Emulate is on the
+///     integration host):</para>
+///     <list type="bullet">
+///       <item>UDT <c>Motor_UDT</c> with members <c>Speed : DINT</c>, <c>Torque : REAL</c>,
+///         <c>Status : DINT</c> — the member set <see cref="AbCipUdtMemberLayoutTests"/>
+///         uses as its declared-layout golden reference.</item>
+///       <item>Controller-scope tag <c>Motor1 : Motor_UDT</c> with seed values
+///         Speed=<c>1800</c>, Torque=<c>42.5f</c>, Status=<c>0x0001</c>.</item>
+///     </list>
+///     <para>Runs only when <c>AB_SERVER_PROFILE=emulate</c>. With ab_server
+///     (the default), skips cleanly — ab_server lacks UDT / Template Object emulation
+///     so this wire-level test couldn't pass against it regardless.</para>
+/// </remarks>
+[Collection("AbServerEmulate")]
+[Trait("Category", "Integration")]
+[Trait("Tier", "Emulate")]
+public sealed class AbCipEmulateUdtReadTests
+{
+    [AbServerFact]
+    public async Task WholeUdt_read_decodes_each_member_at_its_Template_Object_offset()
+    {
+        AbServerProfileGate.SkipUnless(AbServerProfileGate.Emulate);
+
+        var endpoint = Environment.GetEnvironmentVariable("AB_SERVER_ENDPOINT")
+            ?? throw new InvalidOperationException(
+                "AB_SERVER_ENDPOINT must be set to the Logix Emulate instance " +
+                "(e.g. '10.0.0.42:44818') when AB_SERVER_PROFILE=emulate.");
+
+        var options = new AbCipDriverOptions
+        {
+            Devices = [new AbCipDeviceOptions($"ab://{endpoint}/1,0")],
+            Tags = [
+                new AbCipTagDefinition(
+                    Name: "Motor1",
+                    DeviceHostAddress: $"ab://{endpoint}/1,0",
+                    TagPath: "Motor1",
+                    DataType: AbCipDataType.Structure,
+                    Members: [
+                        new AbCipStructureMember("Speed",  AbCipDataType.DInt),
+                        new AbCipStructureMember("Torque", AbCipDataType.Real),
+                        new AbCipStructureMember("Status", AbCipDataType.DInt),
+                    ]),
+            ],
+            Timeout = TimeSpan.FromSeconds(5),
+        };
+
+        await using var drv = new AbCipDriver(options, driverInstanceId: "emulate-udt-smoke");
+        await drv.InitializeAsync("{}", TestContext.Current.CancellationToken);
+
+        // Whole-UDT read optimization from task #194: one libplctag read on the
+        // parent tag, three decodes from the buffer at member offsets. Asserts
+        // Emulate's Template Object response matches what AbCipUdtMemberLayout
+        // computes from the declared member set.
+        var snapshots = await drv.ReadAsync(
+            ["Motor1.Speed", "Motor1.Torque", "Motor1.Status"],
+            TestContext.Current.CancellationToken);
+
+        snapshots.Count.ShouldBe(3);
+        foreach (var s in snapshots) s.StatusCode.ShouldBe(AbCipStatusMapper.Good);
+        Convert.ToInt32(snapshots[0].Value).ShouldBe(1800);
+        Convert.ToSingle(snapshots[1].Value).ShouldBe(42.5f, tolerance: 0.001f);
+        Convert.ToInt32(snapshots[2].Value).ShouldBe(0x0001);
+    }
+}

tests/ZB.MOM.WW.OtOpcUa.Driver.AbCip.IntegrationTests/LogixProject/README.md

@@ -0,0 +1,102 @@
+# Logix Emulate project stub
+
+This folder holds the Studio 5000 project that Logix Emulate loads when running
+the Emulate-tier integration tests
+(`tests/.../AbCip.IntegrationTests/Emulate/*.cs`, gated on
+`AB_SERVER_PROFILE=emulate`).
+
+**Status today**: stub. The actual `.L5X` export isn't committed yet; once
+the Emulate PC is running + a project with the required state exists,
+export to L5X + drop it here as `OtOpcUaAbCipFixture.L5X`.
+
+## Why L5X, not .ACD
+
+Studio 5000 ships two save formats: `.ACD` (binary, the runtime project)
+and `.L5X` (XML export). Ship the L5X because:
+
+- Text format — reviewable in PR diffs, diffable in git
+- Reproducible import across Studio 5000 versions
+- Doesn't carry per-installation state (license watermarks, revision history)
+
+Reconstruction workflow: Studio 5000 → open project → File → Save As
+→ `.L5X`. On a fresh Emulate install: File → Open → select the L5X → it
+rebuilds the ACD from the XML.
+
+## Required project state
+
+The Emulate-tier tests rely on this exact tag / UDT set. Missing any of
+these makes the dependent test fail loudly (TagNotFound, wrong value,
+wrong type), not skip silently — Emulate is a tier above the Docker
+simulator; operators who opted into it get opt-in-level coverage
+expectations.
+
+### UDT definitions
+
+| UDT name | Members | Notes |
+|---|---|---|
+| `Motor_UDT` | `Speed : DINT`, `Torque : REAL`, `Status : DINT` | Matches `AbCipUdtMemberLayoutTests` declared-layout golden. Member order fixed — Logix Template Object offsets depend on it |
+
+### Controller tags
+
+| Tag | Type | Seed value | Purpose |
+|---|---|---|---|
+| `Motor1` | `Motor_UDT` | `{Speed=1800, Torque=42.5, Status=0x0001}` | `AbCipEmulateUdtReadTests.WholeUdt_read_decodes_each_member_at_its_Template_Object_offset` |
+| `HighTempAlarm` | `ALMD` | default ALMD config, `In` tied to `SimulateAlarm` bit | `AbCipEmulateAlmdTests.Real_ALMD_raise_fires_OnAlarmEvent_through_the_driver_projection` |
+| `SimulateAlarm` | `BOOL` | `0` | Operator-writable bit the ladder routes into `HighTempAlarm.In` — gives the test a clean way to drive the alarm edge without scripting Emulate directly |
+
+### Program structure
+
+- One periodic task `MainTask` @ 100 ms
+- One program `MainProgram`
+- One routine `MainRoutine` (Ladder) with a single rung:
+  `XIC SimulateAlarm OTE HighTempAlarm.In`
+
+That's enough ladder for `SimulateAlarm := 1` to raise the alarm + for
+`SimulateAlarm := 0` to clear it.
+
+## Tier-level behaviours this project enables
+
+Coverage the existing Dockerized `ab_server` fixture can't produce —
+each verified by an `Emulate/*Tests.cs` class gated on
+`AB_SERVER_PROFILE=emulate`:
+
+- **CIP Template Object round-trip** — real Logix template bytes,
+  reads produce the same offset layout the CIP Symbol Object decoder +
+  `AbCipUdtMemberLayout` expect.
+- **ALMD rising-edge semantics** — real Logix ALMD instruction fires
+  `InFaulted` / `Acked` transitions at cycle boundaries, not at our
+  unit-test fake's timer boundaries.
+- **Optimized vs unoptimized DB behaviour** — Logix 5380/5580 series
+  runs the Studio 5000 project with optimized-DB-equivalent member
+  access; the driver's read path exercises that wire surface.
+
+Not in scope even with Emulate — needs real hardware:
+
+- EtherNet/IP embedded-switch behaviour (Stratix 5700, 1756-EN4TR)
+- CIP Safety across partitions (Emulate 5580 emulates safety within
+  the chassis but not across nodes)
+- Redundant chassis failover (1756-RM)
+- Motion control timing
+- High-speed discrete-input scheduling
+
+## How to run the Emulate-tier tests
+
+On the dev box:
+
+```powershell
+$env:AB_SERVER_PROFILE  = 'emulate'
+$env:AB_SERVER_ENDPOINT = '10.0.0.42:44818'   # replace with the Emulate PC IP
+dotnet test tests\ZB.MOM.WW.OtOpcUa.Driver.AbCip.IntegrationTests
+```
+
+With `AB_SERVER_PROFILE` unset or `abserver`, the `Emulate/*Tests.cs`
+classes skip cleanly; ab_server-backed tests run as usual.
+
+## See also
+
+- [`docs/drivers/AbServer-Test-Fixture.md`](../../../docs/drivers/AbServer-Test-Fixture.md)
+  §Logix Emulate golden-box tier — coverage map
+- [`docs/v2/dev-environment.md`](../../../docs/v2/dev-environment.md)
+  §Integration host — license + networking notes
+- Studio 5000 Logix Designer + Logix Emulate product pages on the
+  Rockwell TechConnect portal (licensed; internal link only).

tests/ZB.MOM.WW.OtOpcUa.Driver.AbCip.IntegrationTests/ZB.MOM.WW.OtOpcUa.Driver.AbCip.IntegrationTests.csproj

@@ -23,6 +23,11 @@
         <ProjectReference Include="..\..\src\ZB.MOM.WW.OtOpcUa.Driver.AbCip\ZB.MOM.WW.OtOpcUa.Driver.AbCip.csproj"/>
     </ItemGroup>
 
+    <ItemGroup>
+        <None Update="Docker\**\*" CopyToOutputDirectory="PreserveNewest"/>
+        <None Update="LogixProject\**\*" CopyToOutputDirectory="PreserveNewest"/>
+    </ItemGroup>
+
     <ItemGroup>
         <NuGetAuditSuppress Include="https://github.com/advisories/GHSA-37gx-xxp4-5rgx"/>
         <NuGetAuditSuppress Include="https://github.com/advisories/GHSA-w3x6-4m5h-cxqf"/>

tests/ZB.MOM.WW.OtOpcUa.Driver.AbCip.Tests/AbCipAlarmProjectionTests.cs

@@ -0,0 +1,190 @@
+using Shouldly;
+using Xunit;
+using ZB.MOM.WW.OtOpcUa.Core.Abstractions;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.AbCip.Tests;
+
+/// <summary>
+///     Task #177 — tests covering ALMD projection detection, feature-flag gate,
+///     subscribe/unsubscribe lifecycle, state-transition event emission, and acknowledge.
+/// </summary>
+[Trait("Category", "Unit")]
+public sealed class AbCipAlarmProjectionTests
+{
+    private const string Device = "ab://10.0.0.5/1,0";
+
+    private static AbCipTagDefinition AlmdTag(string name) => new(
+        name, Device, name, AbCipDataType.Structure, Members:
+        [
+            new AbCipStructureMember("InFaulted", AbCipDataType.DInt), // Logix stores ALMD bools as DINT
+            new AbCipStructureMember("Acked", AbCipDataType.DInt),
+            new AbCipStructureMember("Severity", AbCipDataType.DInt),
+            new AbCipStructureMember("In", AbCipDataType.DInt),
+        ]);
+
+    [Fact]
+    public void AbCipAlarmDetector_Flags_AlmdSignature_As_Alarm()
+    {
+        var almd = AlmdTag("HighTemp");
+        AbCipAlarmDetector.IsAlmd(almd).ShouldBeTrue();
+
+        var plainUdt = new AbCipTagDefinition("Plain", Device, "Plain", AbCipDataType.Structure, Members:
+            [new AbCipStructureMember("X", AbCipDataType.DInt)]);
+        AbCipAlarmDetector.IsAlmd(plainUdt).ShouldBeFalse();
+
+        var atomic = new AbCipTagDefinition("Plain", Device, "Plain", AbCipDataType.DInt);
+        AbCipAlarmDetector.IsAlmd(atomic).ShouldBeFalse();
+    }
+
+    [Fact]
+    public void Severity_Mapping_Matches_OPC_UA_Convention()
+    {
+        // Logix severity 1–1000 — mirror the OpcUaClient ACAndC bucketing.
+        AbCipAlarmProjection.MapSeverity(100).ShouldBe(AlarmSeverity.Low);
+        AbCipAlarmProjection.MapSeverity(400).ShouldBe(AlarmSeverity.Medium);
+        AbCipAlarmProjection.MapSeverity(600).ShouldBe(AlarmSeverity.High);
+        AbCipAlarmProjection.MapSeverity(900).ShouldBe(AlarmSeverity.Critical);
+    }
+
+    [Fact]
+    public async Task FeatureFlag_Off_SubscribeAlarms_Returns_Handle_But_Never_Polls()
+    {
+        var factory = new FakeAbCipTagFactory();
+        var opts = new AbCipDriverOptions
+        {
+            Devices = [new AbCipDeviceOptions(Device)],
+            Tags = [AlmdTag("HighTemp")],
+            EnableAlarmProjection = false, // explicit; also the default
+        };
+        var drv = new AbCipDriver(opts, "drv-1", factory);
+        await drv.InitializeAsync("{}", CancellationToken.None);
+
+        var handle = await drv.SubscribeAlarmsAsync(["HighTemp"], CancellationToken.None);
+        handle.ShouldNotBeNull();
+        handle.DiagnosticId.ShouldContain("abcip-alarm-sub-");
+
+        // Wait a touch — if polling were active, a fake member-read would be triggered.
+        await Task.Delay(100);
+        factory.Tags.ShouldNotContainKey("HighTemp.InFaulted");
+        factory.Tags.ShouldNotContainKey("HighTemp.Severity");
+
+        await drv.UnsubscribeAlarmsAsync(handle, CancellationToken.None);
+        await drv.ShutdownAsync(CancellationToken.None);
+    }
+
+    [Fact]
+    public async Task FeatureFlag_On_Subscribe_Starts_Polling_And_Fires_Raise_On_0_to_1()
+    {
+        var factory = new FakeAbCipTagFactory();
+        var opts = new AbCipDriverOptions
+        {
+            Devices = [new AbCipDeviceOptions(Device)],
+            Tags = [AlmdTag("HighTemp")],
+            EnableAlarmProjection = true,
+            AlarmPollInterval = TimeSpan.FromMilliseconds(20),
+        };
+        var drv = new AbCipDriver(opts, "drv-1", factory);
+        await drv.InitializeAsync("{}", CancellationToken.None);
+
+        var events = new List<AlarmEventArgs>();
+        drv.OnAlarmEvent += (_, e) => { lock (events) events.Add(e); };
+
+        var handle = await drv.SubscribeAlarmsAsync(["HighTemp"], CancellationToken.None);
+
+        // The ALMD UDT is declared so whole-UDT grouping kicks in; the parent HighTemp runtime
+        // gets created + polled. Set InFaulted offset-value to 0 first (clear), wait a tick,
+        // then flip to 1 (fault) + wait for the raise event.
+        await WaitForTagCreation(factory, "HighTemp");
+        factory.Tags["HighTemp"].ValuesByOffset[0] = 0;  // InFaulted=false at offset 0
+        factory.Tags["HighTemp"].ValuesByOffset[8] = 500; // Severity at offset 8 (after InFaulted+Acked)
+        await Task.Delay(80); // let a tick seed the "last-seen false" state
+
+        factory.Tags["HighTemp"].ValuesByOffset[0] = 1; // flip to faulted
+        await Task.Delay(200); // allow several polls to be safe
+
+        lock (events)
+        {
+            events.ShouldContain(e => e.SourceNodeId == "HighTemp" && e.AlarmType == "ALMD"
+                && e.Message.Contains("raised"));
+        }
+
+        await drv.UnsubscribeAlarmsAsync(handle, CancellationToken.None);
+        await drv.ShutdownAsync(CancellationToken.None);
+    }
+
+    [Fact]
+    public async Task Clear_Event_Fires_On_1_to_0_Transition()
+    {
+        var factory = new FakeAbCipTagFactory();
+        var opts = new AbCipDriverOptions
+        {
+            Devices = [new AbCipDeviceOptions(Device)],
+            Tags = [AlmdTag("HighTemp")],
+            EnableAlarmProjection = true,
+            AlarmPollInterval = TimeSpan.FromMilliseconds(20),
+        };
+        var drv = new AbCipDriver(opts, "drv-1", factory);
+        await drv.InitializeAsync("{}", CancellationToken.None);
+
+        var events = new List<AlarmEventArgs>();
+        drv.OnAlarmEvent += (_, e) => { lock (events) events.Add(e); };
+
+        var handle = await drv.SubscribeAlarmsAsync(["HighTemp"], CancellationToken.None);
+        await WaitForTagCreation(factory, "HighTemp");
+
+        factory.Tags["HighTemp"].ValuesByOffset[0] = 1;
+        factory.Tags["HighTemp"].ValuesByOffset[8] = 500;
+        await Task.Delay(80); // observe raise
+
+        factory.Tags["HighTemp"].ValuesByOffset[0] = 0;
+        await Task.Delay(200);
+
+        lock (events)
+        {
+            events.ShouldContain(e => e.Message.Contains("raised"));
+            events.ShouldContain(e => e.Message.Contains("cleared"));
+        }
+
+        await drv.UnsubscribeAlarmsAsync(handle, CancellationToken.None);
+        await drv.ShutdownAsync(CancellationToken.None);
+    }
+
+    [Fact]
+    public async Task Unsubscribe_Stops_The_Poll_Loop()
+    {
+        var factory = new FakeAbCipTagFactory();
+        var opts = new AbCipDriverOptions
+        {
+            Devices = [new AbCipDeviceOptions(Device)],
+            Tags = [AlmdTag("HighTemp")],
+            EnableAlarmProjection = true,
+            AlarmPollInterval = TimeSpan.FromMilliseconds(20),
+        };
+        var drv = new AbCipDriver(opts, "drv-1", factory);
+        await drv.InitializeAsync("{}", CancellationToken.None);
+
+        var handle = await drv.SubscribeAlarmsAsync(["HighTemp"], CancellationToken.None);
+        await WaitForTagCreation(factory, "HighTemp");
+        var preUnsubReadCount = factory.Tags["HighTemp"].ReadCount;
+
+        await drv.UnsubscribeAlarmsAsync(handle, CancellationToken.None);
+        await Task.Delay(100); // well past several poll intervals if the loop were still alive
+
+        var postDelayReadCount = factory.Tags["HighTemp"].ReadCount;
+        // Allow at most one straggler read between the unsubscribe-cancel + the loop exit.
+        (postDelayReadCount - preUnsubReadCount).ShouldBeLessThanOrEqualTo(1);
+
+        await drv.ShutdownAsync(CancellationToken.None);
+    }
+
+    private static async Task WaitForTagCreation(FakeAbCipTagFactory factory, string tagName)
+    {
+        var deadline = DateTime.UtcNow.AddSeconds(2);
+        while (DateTime.UtcNow < deadline)
+        {
+            if (factory.Tags.ContainsKey(tagName)) return;
+            await Task.Delay(10);
+        }
+        throw new TimeoutException($"Tag {tagName} was never created by the fake factory.");
+    }
+}

tests/ZB.MOM.WW.OtOpcUa.Driver.AbCip.Tests/AbCipDriverWholeUdtReadTests.cs

@@ -0,0 +1,130 @@
+using Shouldly;
+using Xunit;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.AbCip.Tests;
+
+/// <summary>
+///     Task #194 — ReadAsync integration tests for the whole-UDT grouping path. The fake
+///     runtime records ReadCount + surfaces member values by byte offset so we can assert
+///     both "one read per parent UDT" and "each member decoded at the correct offset."
+/// </summary>
+[Trait("Category", "Unit")]
+public sealed class AbCipDriverWholeUdtReadTests
+{
+    private const string Device = "ab://10.0.0.5/1,0";
+
+    private static (AbCipDriver drv, FakeAbCipTagFactory factory) NewDriver(params AbCipTagDefinition[] tags)
+    {
+        var factory = new FakeAbCipTagFactory();
+        var opts = new AbCipDriverOptions
+        {
+            Devices = [new AbCipDeviceOptions(Device)],
+            Tags = tags,
+        };
+        return (new AbCipDriver(opts, "drv-1", factory), factory);
+    }
+
+    private static AbCipTagDefinition MotorUdt() => new(
+        "Motor", Device, "Motor", AbCipDataType.Structure, Members:
+        [
+            new AbCipStructureMember("Speed", AbCipDataType.DInt),   // offset 0
+            new AbCipStructureMember("Torque", AbCipDataType.Real),  // offset 4
+        ]);
+
+    [Fact]
+    public async Task Two_members_of_same_udt_trigger_one_parent_read()
+    {
+        var (drv, factory) = NewDriver(MotorUdt());
+        await drv.InitializeAsync("{}", CancellationToken.None);
+
+        var snapshots = await drv.ReadAsync(["Motor.Speed", "Motor.Torque"], CancellationToken.None);
+
+        snapshots.Count.ShouldBe(2);
+        snapshots[0].StatusCode.ShouldBe(AbCipStatusMapper.Good);
+        snapshots[1].StatusCode.ShouldBe(AbCipStatusMapper.Good);
+
+        // Factory should have created ONE runtime (for the parent "Motor") + issued ONE read.
+        // Without the optimization two runtimes (one per member) + two reads would appear.
+        factory.Tags.Count.ShouldBe(1);
+        factory.Tags.ShouldContainKey("Motor");
+        factory.Tags["Motor"].ReadCount.ShouldBe(1);
+    }
+
+    [Fact]
+    public async Task Each_member_decodes_at_its_own_offset()
+    {
+        var (drv, factory) = NewDriver(MotorUdt());
+        await drv.InitializeAsync("{}", CancellationToken.None);
+
+        // Arrange the offset-keyed values before the read fires — the planner places
+        // Speed at offset 0 (DInt) and Torque at offset 4 (Real).
+        // The fake records CreationParams so we fetch it up front by the parent name.
+        var snapshotsTask = drv.ReadAsync(["Motor.Speed", "Motor.Torque"], CancellationToken.None);
+        // The factory creates the runtime inside ReadAsync; we need to set the offset map
+        // AFTER creation. Easier path: create the runtime on demand by reading once then
+        // re-arming. Instead: seed via a pre-read by constructing the fake in the factory's
+        // customise hook.
+        var snapshots = await snapshotsTask;
+
+        // First run establishes the runtime + gives the fake a chance to hold its reference.
+        factory.Tags["Motor"].ValuesByOffset[0] = 1234; // Speed
+        factory.Tags["Motor"].ValuesByOffset[4] = 9.5f; // Torque
+
+        snapshots = await drv.ReadAsync(["Motor.Speed", "Motor.Torque"], CancellationToken.None);
+        snapshots[0].Value.ShouldBe(1234);
+        snapshots[1].Value.ShouldBe(9.5f);
+    }
+
+    [Fact]
+    public async Task Parent_read_failure_stamps_every_grouped_member_Bad()
+    {
+        var (drv, factory) = NewDriver(MotorUdt());
+        await drv.InitializeAsync("{}", CancellationToken.None);
+
+        // Prime runtime existence via a first (successful) read so we can flip it to error.
+        await drv.ReadAsync(["Motor.Speed", "Motor.Torque"], CancellationToken.None);
+        factory.Tags["Motor"].Status = -3; // libplctag BadTimeout — mapped in AbCipStatusMapper
+
+        var snapshots = await drv.ReadAsync(["Motor.Speed", "Motor.Torque"], CancellationToken.None);
+
+        snapshots.Count.ShouldBe(2);
+        snapshots[0].StatusCode.ShouldNotBe(AbCipStatusMapper.Good);
+        snapshots[0].Value.ShouldBeNull();
+        snapshots[1].StatusCode.ShouldNotBe(AbCipStatusMapper.Good);
+        snapshots[1].Value.ShouldBeNull();
+    }
+
+    [Fact]
+    public async Task Mixed_batch_groups_udt_and_falls_back_atomics()
+    {
+        var plain = new AbCipTagDefinition("PlainDint", Device, "PlainDint", AbCipDataType.DInt);
+        var (drv, factory) = NewDriver(MotorUdt(), plain);
+        await drv.InitializeAsync("{}", CancellationToken.None);
+
+        var snapshots = await drv.ReadAsync(
+            ["Motor.Speed", "PlainDint", "Motor.Torque"], CancellationToken.None);
+
+        snapshots.Count.ShouldBe(3);
+        // Motor parent ran one read, PlainDint ran its own read = 2 runtimes, 2 reads total.
+        factory.Tags.Count.ShouldBe(2);
+        factory.Tags.ShouldContainKey("Motor");
+        factory.Tags.ShouldContainKey("PlainDint");
+        factory.Tags["Motor"].ReadCount.ShouldBe(1);
+        factory.Tags["PlainDint"].ReadCount.ShouldBe(1);
+    }
+
+    [Fact]
+    public async Task Single_member_of_Udt_uses_per_tag_read_path()
+    {
+        // One member of a UDT doesn't benefit from grouping — the planner demotes to
+        // fallback so the member-level runtime (distinct from the parent runtime) is used,
+        // matching pre-#194 behavior.
+        var (drv, factory) = NewDriver(MotorUdt());
+        await drv.InitializeAsync("{}", CancellationToken.None);
+
+        await drv.ReadAsync(["Motor.Speed"], CancellationToken.None);
+
+        factory.Tags.ShouldContainKey("Motor.Speed");
+        factory.Tags.ShouldNotContainKey("Motor");
+    }
+}

tests/ZB.MOM.WW.OtOpcUa.Driver.AbCip.Tests/AbCipUdtMemberLayoutTests.cs

@@ -0,0 +1,72 @@
+using Shouldly;
+using Xunit;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.AbCip.Tests;
+
+[Trait("Category", "Unit")]
+public sealed class AbCipUdtMemberLayoutTests
+{
+    [Fact]
+    public void Packed_Atomics_Get_Natural_Alignment_Offsets()
+    {
+        // DInt (4 align) + Real (4) + Int (2) + LInt (8 — forces 2-byte pad before it)
+        var members = new[]
+        {
+            new AbCipStructureMember("A", AbCipDataType.DInt),
+            new AbCipStructureMember("B", AbCipDataType.Real),
+            new AbCipStructureMember("C", AbCipDataType.Int),
+            new AbCipStructureMember("D", AbCipDataType.LInt),
+        };
+
+        var offsets = AbCipUdtMemberLayout.TryBuild(members);
+        offsets.ShouldNotBeNull();
+        offsets!["A"].ShouldBe(0);
+        offsets["B"].ShouldBe(4);
+        offsets["C"].ShouldBe(8);
+        // cursor at 10 after Int; LInt needs 8-byte alignment → pad to 16
+        offsets["D"].ShouldBe(16);
+    }
+
+    [Fact]
+    public void SInt_Packed_Without_Padding()
+    {
+        var members = new[]
+        {
+            new AbCipStructureMember("X", AbCipDataType.SInt),
+            new AbCipStructureMember("Y", AbCipDataType.SInt),
+            new AbCipStructureMember("Z", AbCipDataType.SInt),
+        };
+        var offsets = AbCipUdtMemberLayout.TryBuild(members);
+        offsets!["X"].ShouldBe(0);
+        offsets["Y"].ShouldBe(1);
+        offsets["Z"].ShouldBe(2);
+    }
+
+    [Fact]
+    public void Returns_Null_When_Member_Is_Bool()
+    {
+        // BOOL storage in Logix UDTs is packed into a hidden host byte; declaration-only
+        // layout can't place it. Grouping opts out; per-tag read path handles the member.
+        var members = new[]
+        {
+            new AbCipStructureMember("A", AbCipDataType.DInt),
+            new AbCipStructureMember("Flag", AbCipDataType.Bool),
+        };
+        AbCipUdtMemberLayout.TryBuild(members).ShouldBeNull();
+    }
+
+    [Fact]
+    public void Returns_Null_When_Member_Is_String_Or_Structure()
+    {
+        AbCipUdtMemberLayout.TryBuild(
+            new[] { new AbCipStructureMember("Name", AbCipDataType.String) }).ShouldBeNull();
+        AbCipUdtMemberLayout.TryBuild(
+            new[] { new AbCipStructureMember("Nested", AbCipDataType.Structure) }).ShouldBeNull();
+    }
+
+    [Fact]
+    public void Returns_Null_On_Empty_Members()
+    {
+        AbCipUdtMemberLayout.TryBuild(Array.Empty<AbCipStructureMember>()).ShouldBeNull();
+    }
+}

tests/ZB.MOM.WW.OtOpcUa.Driver.AbCip.Tests/AbCipUdtReadPlannerTests.cs

@@ -0,0 +1,123 @@
+using Shouldly;
+using Xunit;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.AbCip.Tests;
+
+[Trait("Category", "Unit")]
+public sealed class AbCipUdtReadPlannerTests
+{
+    private const string Device = "ab://10.0.0.1/1,0";
+
+    [Fact]
+    public void Groups_Two_Members_Of_The_Same_Udt_Parent()
+    {
+        var tags = BuildUdtTagMap(out var _);
+        var plan = AbCipUdtReadPlanner.Build(new[] { "Motor.Speed", "Motor.Torque" }, tags);
+
+        plan.Groups.Count.ShouldBe(1);
+        plan.Groups[0].ParentName.ShouldBe("Motor");
+        plan.Groups[0].Members.Count.ShouldBe(2);
+        plan.Fallbacks.Count.ShouldBe(0);
+    }
+
+    [Fact]
+    public void Single_Member_Reference_Falls_Back_To_Per_Tag_Path()
+    {
+        // Reading just one member of a UDT gains nothing from grouping — one whole-UDT read
+        // vs one member read is equivalent cost but more client-side work. Planner demotes.
+        var tags = BuildUdtTagMap(out var _);
+        var plan = AbCipUdtReadPlanner.Build(new[] { "Motor.Speed" }, tags);
+
+        plan.Groups.ShouldBeEmpty();
+        plan.Fallbacks.Count.ShouldBe(1);
+        plan.Fallbacks[0].Reference.ShouldBe("Motor.Speed");
+    }
+
+    [Fact]
+    public void Unknown_References_Fall_Back_Without_Affecting_Groups()
+    {
+        var tags = BuildUdtTagMap(out var _);
+        var plan = AbCipUdtReadPlanner.Build(
+            new[] { "Motor.Speed", "Motor.Torque", "DoesNotExist", "Motor.NonMember" }, tags);
+
+        plan.Groups.Count.ShouldBe(1);
+        plan.Groups[0].Members.Count.ShouldBe(2);
+        plan.Fallbacks.Count.ShouldBe(2);
+        plan.Fallbacks.ShouldContain(f => f.Reference == "DoesNotExist");
+        plan.Fallbacks.ShouldContain(f => f.Reference == "Motor.NonMember");
+    }
+
+    [Fact]
+    public void Atomic_Top_Level_Tag_Falls_Back_Untouched()
+    {
+        var tags = BuildUdtTagMap(out var _);
+        tags = new Dictionary<string, AbCipTagDefinition>(tags, StringComparer.OrdinalIgnoreCase)
+        {
+            ["PlainDint"] = new("PlainDint", Device, "PlainDint", AbCipDataType.DInt),
+        };
+        var plan = AbCipUdtReadPlanner.Build(new[] { "Motor.Speed", "Motor.Torque", "PlainDint" }, tags);
+
+        plan.Groups.Count.ShouldBe(1);
+        plan.Fallbacks.Count.ShouldBe(1);
+        plan.Fallbacks[0].Reference.ShouldBe("PlainDint");
+    }
+
+    [Fact]
+    public void Udt_With_Bool_Member_Does_Not_Group()
+    {
+        // Any BOOL in the declared members disqualifies the group — offset rules for BOOL
+        // can't be determined from declaration alone (Logix packs them into a hidden host
+        // byte). Fallback path reads each member individually.
+        var members = new[]
+        {
+            new AbCipStructureMember("Run", AbCipDataType.Bool),
+            new AbCipStructureMember("Speed", AbCipDataType.DInt),
+        };
+        var parent = new AbCipTagDefinition("Motor", Device, "Motor", AbCipDataType.Structure,
+            Members: members);
+        var tags = new Dictionary<string, AbCipTagDefinition>(StringComparer.OrdinalIgnoreCase)
+        {
+            ["Motor"] = parent,
+            ["Motor.Run"] = new("Motor.Run", Device, "Motor.Run", AbCipDataType.Bool),
+            ["Motor.Speed"] = new("Motor.Speed", Device, "Motor.Speed", AbCipDataType.DInt),
+        };
+
+        var plan = AbCipUdtReadPlanner.Build(new[] { "Motor.Run", "Motor.Speed" }, tags);
+
+        plan.Groups.ShouldBeEmpty();
+        plan.Fallbacks.Count.ShouldBe(2);
+    }
+
+    [Fact]
+    public void Original_Indices_Preserved_For_Out_Of_Order_Batches()
+    {
+        var tags = BuildUdtTagMap(out var _);
+        var plan = AbCipUdtReadPlanner.Build(
+            new[] { "Other", "Motor.Speed", "DoesNotExist", "Motor.Torque" }, tags);
+
+        // Motor.Speed was at index 1, Motor.Torque at 3 — must survive through the plan so
+        // ReadAsync can write decoded values back at the right output slot.
+        plan.Groups.ShouldHaveSingleItem();
+        var group = plan.Groups[0];
+        group.Members.ShouldContain(m => m.OriginalIndex == 1 && m.Definition.Name == "Motor.Speed");
+        group.Members.ShouldContain(m => m.OriginalIndex == 3 && m.Definition.Name == "Motor.Torque");
+        plan.Fallbacks.ShouldContain(f => f.OriginalIndex == 0 && f.Reference == "Other");
+        plan.Fallbacks.ShouldContain(f => f.OriginalIndex == 2 && f.Reference == "DoesNotExist");
+    }
+
+    private static Dictionary<string, AbCipTagDefinition> BuildUdtTagMap(out AbCipTagDefinition parent)
+    {
+        var members = new[]
+        {
+            new AbCipStructureMember("Speed", AbCipDataType.DInt),
+            new AbCipStructureMember("Torque", AbCipDataType.Real),
+        };
+        parent = new AbCipTagDefinition("Motor", Device, "Motor", AbCipDataType.Structure, Members: members);
+        return new Dictionary<string, AbCipTagDefinition>(StringComparer.OrdinalIgnoreCase)
+        {
+            ["Motor"] = parent,
+            ["Motor.Speed"] = new("Motor.Speed", Device, "Motor.Speed", AbCipDataType.DInt),
+            ["Motor.Torque"] = new("Motor.Torque", Device, "Motor.Torque", AbCipDataType.Real),
+        };
+    }
+}

tests/ZB.MOM.WW.OtOpcUa.Driver.AbCip.Tests/FakeAbCipTag.cs

@@ -47,6 +47,21 @@ internal class FakeAbCipTag : IAbCipTagRuntime
 
     public virtual object? DecodeValue(AbCipDataType type, int? bitIndex) => Value;
 
+    /// <summary>
+    ///     Task #194 whole-UDT read support. Tests drive multi-member decoding by setting
+    ///     <see cref="ValuesByOffset"/> — keyed by member byte offset — before invoking
+    ///     <see cref="AbCipDriver.ReadAsync"/>. Falls back to <see cref="Value"/> when the
+    ///     offset is zero or unmapped so existing tests that never set the offset map keep
+    ///     working unchanged.
+    /// </summary>
+    public Dictionary<int, object?> ValuesByOffset { get; } = new();
+
+    public virtual object? DecodeValueAt(AbCipDataType type, int offset, int? bitIndex)
+    {
+        if (ValuesByOffset.TryGetValue(offset, out var v)) return v;
+        return offset == 0 ? Value : null;
+    }
+
     public virtual void EncodeValue(AbCipDataType type, int? bitIndex, object? value) => Value = value;
 
     public virtual void Dispose() => Disposed = true;

tests/ZB.MOM.WW.OtOpcUa.Driver.AbLegacy.IntegrationTests/AbLegacyReadSmokeTests.cs

@@ -0,0 +1,93 @@
+using Shouldly;
+using Xunit;
+using ZB.MOM.WW.OtOpcUa.Core.Abstractions;
+using ZB.MOM.WW.OtOpcUa.Driver.AbLegacy.PlcFamilies;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.AbLegacy.IntegrationTests;
+
+/// <summary>
+///     End-to-end smoke tests against the <c>ab_server</c> PCCC Docker container.
+///     Promotes the AB Legacy driver from unit-only coverage (<c>FakeAbLegacyTag</c>)
+///     to wire-level: real libplctag PCCC stack over real TCP against the ab_server
+///     simulator. Parametrised over all three families (SLC 500 / MicroLogix / PLC-5)
+///     via <c>[AbLegacyTheory]</c> + <c>[MemberData]</c>.
+/// </summary>
+[Collection(AbLegacyServerCollection.Name)]
+[Trait("Category", "Integration")]
+[Trait("Simulator", "ab_server-PCCC")]
+public sealed class AbLegacyReadSmokeTests(AbLegacyServerFixture sim)
+{
+    public static IEnumerable<object[]> Profiles =>
+        KnownProfiles.All.Select(p => new object[] { p });
+
+    [AbLegacyTheory]
+    [MemberData(nameof(Profiles))]
+    public async Task Driver_reads_seeded_N_file_from_ab_server_PCCC(AbLegacyServerProfile profile)
+    {
+        if (sim.SkipReason is not null) Assert.Skip(sim.SkipReason);
+
+        // PCCC PLCs use empty cip-path, but AbLegacyHostAddress still requires the
+        // /cip-path suffix to parse.
+        var deviceUri = $"ab://{sim.Host}:{sim.Port}/";
+        await using var drv = new AbLegacyDriver(new AbLegacyDriverOptions
+        {
+            Devices = [new AbLegacyDeviceOptions(deviceUri, profile.Family)],
+            Tags = [
+                new AbLegacyTagDefinition(
+                    Name: "IntCounter",
+                    DeviceHostAddress: deviceUri,
+                    Address: "N7:0",
+                    DataType: AbLegacyDataType.Int),
+            ],
+            Timeout = TimeSpan.FromSeconds(5),
+            Probe = new AbLegacyProbeOptions { Enabled = false },
+        }, driverInstanceId: $"ablegacy-smoke-{profile.Family}");
+
+        await drv.InitializeAsync("{}", TestContext.Current.CancellationToken);
+
+        var snapshots = await drv.ReadAsync(
+            ["IntCounter"], TestContext.Current.CancellationToken);
+
+        snapshots.Single().StatusCode.ShouldBe(AbLegacyStatusMapper.Good,
+            $"N7:0 read must succeed against the {profile.Family} compose profile");
+        drv.GetHealth().State.ShouldBe(DriverState.Healthy);
+    }
+
+    [AbLegacyFact]
+    public async Task Slc500_write_then_read_round_trip_on_N7_scratch_register()
+    {
+        if (sim.SkipReason is not null) Assert.Skip(sim.SkipReason);
+
+        // PCCC PLCs use empty cip-path, but AbLegacyHostAddress still requires the
+        // /cip-path suffix to parse.
+        var deviceUri = $"ab://{sim.Host}:{sim.Port}/";
+        await using var drv = new AbLegacyDriver(new AbLegacyDriverOptions
+        {
+            Devices = [new AbLegacyDeviceOptions(deviceUri, AbLegacyPlcFamily.Slc500)],
+            Tags = [
+                new AbLegacyTagDefinition(
+                    Name: "Scratch",
+                    DeviceHostAddress: deviceUri,
+                    Address: "N7:5",
+                    DataType: AbLegacyDataType.Int,
+                    Writable: true),
+            ],
+            Timeout = TimeSpan.FromSeconds(5),
+            Probe = new AbLegacyProbeOptions { Enabled = false },
+        }, driverInstanceId: "ablegacy-smoke-rw");
+
+        await drv.InitializeAsync("{}", TestContext.Current.CancellationToken);
+
+        const short probe = 0x1234;
+        var writeResults = await drv.WriteAsync(
+            [new WriteRequest("Scratch", probe)],
+            TestContext.Current.CancellationToken);
+        writeResults.Single().StatusCode.ShouldBe(AbLegacyStatusMapper.Good,
+            "PCCC N7:5 write must succeed end-to-end");
+
+        var readResults = await drv.ReadAsync(
+            ["Scratch"], TestContext.Current.CancellationToken);
+        readResults.Single().StatusCode.ShouldBe(AbLegacyStatusMapper.Good);
+        Convert.ToInt32(readResults.Single().Value).ShouldBe(probe);
+    }
+}

tests/ZB.MOM.WW.OtOpcUa.Driver.AbLegacy.IntegrationTests/AbLegacyServerFixture.cs

@@ -0,0 +1,157 @@
+using System.Net.Sockets;
+using Xunit;
+using Xunit.Sdk;
+using ZB.MOM.WW.OtOpcUa.Driver.AbLegacy.PlcFamilies;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.AbLegacy.IntegrationTests;
+
+/// <summary>
+///     Reachability probe for the <c>ab_server</c> Docker container running in a PCCC
+///     plc mode (<c>SLC500</c> / <c>Micrologix</c> / <c>PLC/5</c>). Same container image
+///     the AB CIP integration suite uses — libplctag's <c>ab_server</c> supports both
+///     CIP + PCCC families from one binary. Tests skip via
+///     <see cref="AbLegacyFactAttribute"/> / <see cref="AbLegacyTheoryAttribute"/> when
+///     the port isn't live, so <c>dotnet test</c> stays green on a fresh clone without
+///     Docker running.
+/// </summary>
+/// <remarks>
+///     Env-var overrides:
+///     <list type="bullet">
+///       <item><c>AB_LEGACY_ENDPOINT</c> — <c>host:port</c> of the PCCC-mode simulator.
+///         Defaults to <c>localhost:44818</c> (EtherNet/IP port; ab_server's PCCC
+///         emulation exposes PCCC-over-CIP on the same port as CIP itself).</item>
+///     </list>
+///     Distinct from <c>AB_SERVER_ENDPOINT</c> used by the AB CIP fixture so both
+///     can point at different containers simultaneously during a combined test run.
+/// </remarks>
+public sealed class AbLegacyServerFixture : IAsyncLifetime
+{
+    private const string EndpointEnvVar = "AB_LEGACY_ENDPOINT";
+
+    /// <summary>Standard EtherNet/IP port. PCCC-over-CIP rides on the same port as
+    /// native CIP; the differentiator is the <c>--plc</c> flag ab_server was started
+    /// with, not a different TCP listener.</summary>
+    public const int DefaultPort = 44818;
+
+    public string Host { get; } = "127.0.0.1";
+    public int Port { get; } = DefaultPort;
+    public string? SkipReason { get; }
+
+    public AbLegacyServerFixture()
+    {
+        if (Environment.GetEnvironmentVariable(EndpointEnvVar) is { Length: > 0 } raw)
+        {
+            var parts = raw.Split(':', 2);
+            Host = parts[0];
+            if (parts.Length == 2 && int.TryParse(parts[1], out var p)) Port = p;
+        }
+
+        if (!TcpProbe(Host, Port))
+        {
+            SkipReason =
+                $"AB Legacy PCCC simulator at {Host}:{Port} not reachable within 2 s. " +
+                $"Start the Docker container (docker compose -f Docker/docker-compose.yml " +
+                $"--profile slc500 up -d) or override {EndpointEnvVar}.";
+        }
+    }
+
+    public ValueTask InitializeAsync() => ValueTask.CompletedTask;
+    public ValueTask DisposeAsync() => ValueTask.CompletedTask;
+
+    public static bool IsServerAvailable()
+    {
+        var (host, port) = ResolveEndpoint();
+        return TcpProbe(host, port);
+    }
+
+    private static (string Host, int Port) ResolveEndpoint()
+    {
+        var raw = Environment.GetEnvironmentVariable(EndpointEnvVar);
+        if (raw is null) return ("127.0.0.1", DefaultPort);
+        var parts = raw.Split(':', 2);
+        var port = parts.Length == 2 && int.TryParse(parts[1], out var p) ? p : DefaultPort;
+        return (parts[0], port);
+    }
+
+    private static bool TcpProbe(string host, int port)
+    {
+        try
+        {
+            using var client = new TcpClient();
+            var task = client.ConnectAsync(host, port);
+            return task.Wait(TimeSpan.FromSeconds(2)) && client.Connected;
+        }
+        catch { return false; }
+    }
+}
+
+/// <summary>
+///     Per-family marker for the PCCC-mode compose profile a given test targets. The
+///     compose file (<c>Docker/docker-compose.yml</c>) is the canonical source of truth
+///     for which <c>--plc</c> mode + tags each family seeds; this record just ties a
+///     family enum to its compose-profile name + operator-facing notes.
+/// </summary>
+public sealed record AbLegacyServerProfile(
+    AbLegacyPlcFamily Family,
+    string ComposeProfile,
+    string Notes);
+
+/// <summary>Canonical profiles covering every PCCC family the driver supports.</summary>
+public static class KnownProfiles
+{
+    public static readonly AbLegacyServerProfile Slc500 = new(
+        Family: AbLegacyPlcFamily.Slc500,
+        ComposeProfile: "slc500",
+        Notes: "SLC 500 / 5/05 family. ab_server SLC500 mode covers N/F/B/L files.");
+
+    public static readonly AbLegacyServerProfile MicroLogix = new(
+        Family: AbLegacyPlcFamily.MicroLogix,
+        ComposeProfile: "micrologix",
+        Notes: "MicroLogix 1000 / 1100 / 1400. Shares N/F/B file-type coverage with SLC500; ST (ASCII strings) included.");
+
+    public static readonly AbLegacyServerProfile Plc5 = new(
+        Family: AbLegacyPlcFamily.Plc5,
+        ComposeProfile: "plc5",
+        Notes: "PLC-5 family. ab_server PLC/5 mode covers N/F/B; per-family quirks on ST / timer file layouts unit-tested only.");
+
+    public static IReadOnlyList<AbLegacyServerProfile> All { get; } =
+        [Slc500, MicroLogix, Plc5];
+
+    public static AbLegacyServerProfile ForFamily(AbLegacyPlcFamily family) =>
+        All.FirstOrDefault(p => p.Family == family)
+        ?? throw new ArgumentOutOfRangeException(nameof(family), family, "No integration profile for this family.");
+}
+
+[Xunit.CollectionDefinition(Name)]
+public sealed class AbLegacyServerCollection : Xunit.ICollectionFixture<AbLegacyServerFixture>
+{
+    public const string Name = "AbLegacyServer";
+}
+
+/// <summary>
+///     <c>[Fact]</c>-equivalent that skips when the PCCC simulator isn't reachable.
+/// </summary>
+public sealed class AbLegacyFactAttribute : FactAttribute
+{
+    public AbLegacyFactAttribute()
+    {
+        if (!AbLegacyServerFixture.IsServerAvailable())
+            Skip = "AB Legacy PCCC simulator not reachable. Start the Docker container " +
+                   "(docker compose -f Docker/docker-compose.yml --profile slc500 up -d) " +
+                   "or set AB_LEGACY_ENDPOINT.";
+    }
+}
+
+/// <summary>
+///     <c>[Theory]</c>-equivalent with the same gate as <see cref="AbLegacyFactAttribute"/>.
+/// </summary>
+public sealed class AbLegacyTheoryAttribute : TheoryAttribute
+{
+    public AbLegacyTheoryAttribute()
+    {
+        if (!AbLegacyServerFixture.IsServerAvailable())
+            Skip = "AB Legacy PCCC simulator not reachable. Start the Docker container " +
+                   "(docker compose -f Docker/docker-compose.yml --profile slc500 up -d) " +
+                   "or set AB_LEGACY_ENDPOINT.";
+    }
+}

tests/ZB.MOM.WW.OtOpcUa.Driver.AbLegacy.IntegrationTests/Docker/README.md

@@ -0,0 +1,140 @@
+# AB Legacy PCCC integration-test fixture — `ab_server` (Docker)
+
+[libplctag](https://github.com/libplctag/libplctag)'s `ab_server` supports
+both CIP (ControlLogix / CompactLogix / Micro800) and PCCC (SLC 500 /
+MicroLogix / PLC-5) families from one binary. This fixture reuses the AB
+CIP Docker image (`otopcua-ab-server:libplctag-release`) with different
+`--plc` flags. No new Dockerfile needed — the compose file's `build:`
+block points at the AB CIP `Docker/` folder so `docker compose build`
+from here reuses the same multi-stage build.
+
+**Docker is the only supported launch path**; a fresh clone needs Docker
+Desktop and nothing else.
+
+| File | Purpose |
+|---|---|
+| [`docker-compose.yml`](docker-compose.yml) | Three per-family services (`slc500` / `micrologix` / `plc5`); all bind `:44818` |
+
+## Run
+
+From the repo root:
+
+```powershell
+# SLC 500 family — widest PCCC coverage
+docker compose -f tests\ZB.MOM.WW.OtOpcUa.Driver.AbLegacy.IntegrationTests\Docker\docker-compose.yml --profile slc500 up
+
+# Per-family
+docker compose -f tests\...\Docker\docker-compose.yml --profile micrologix up
+docker compose -f tests\...\Docker\docker-compose.yml --profile plc5 up
+```
+
+Detached + stop:
+
+```powershell
+docker compose -f tests\...\Docker\docker-compose.yml --profile slc500 up -d
+docker compose -f tests\...\Docker\docker-compose.yml --profile slc500 down
+```
+
+First run builds the `otopcua-ab-server:libplctag-release` image (~3-5
+min — clones libplctag + compiles `ab_server`). If the AB CIP fixture
+already built the image locally, docker reuses the cached layers + this
+runs in seconds. Only one family binds `:44818` at a time; to switch
+families stop the current service + start another.
+
+## Endpoint
+
+- Default: `localhost:44818` (EtherNet/IP standard)
+- Override with `AB_LEGACY_ENDPOINT=host:port` to point at a real SLC /
+  MicroLogix / PLC-5 PLC on its native port.
+
+## Run the integration tests
+
+In a separate shell with a container up:
+
+```powershell
+cd C:\Users\dohertj2\Desktop\lmxopcua
+dotnet test tests\ZB.MOM.WW.OtOpcUa.Driver.AbLegacy.IntegrationTests
+```
+
+`AbLegacyServerFixture` TCP-probes `localhost:44818` at collection init +
+records a skip reason when unreachable. Tests use `[AbLegacyFact]` /
+`[AbLegacyTheory]` which check the same probe.
+
+## What each family seeds
+
+PCCC tag format is `<file>[<size>]` without a type suffix — file letter
+implies type:
+
+- `N` = 16-bit signed integer
+- `F` = 32-bit IEEE 754 float
+- `B` = 1-bit boolean (stored as uint16, bit-addressable via `/n`)
+- `L` = 32-bit signed integer (SLC 5/05 V15+ only)
+- `ST` = 82-byte ASCII string (MicroLogix-specific extension)
+
+| Family | Seeded tags | Notes |
+|---|---|---|
+| SLC 500 | `N7[10]`, `F8[10]`, `B3[10]`, `L19[10]` | Baseline; covers the four numeric file types a typical SLC project uses |
+| MicroLogix | `B3[10]`, `N7[10]`, `L19[10]` | No `F8` — MicroLogix 1000 has no float file; use L19 when scaled integers aren't enough |
+| PLC-5 | `N7[10]`, `F8[10]`, `B3[10]` | No `L` — PLC-5 predates the L file type; DINT equivalents went in integer files |
+
+## Known limitations
+
+### ab_server PCCC read/write round-trip (verified 2026-04-20)
+
+**Scaffold is in place; wire-level round-trip does NOT currently pass
+against `ab_server --plc=SLC500`.** With the SLC500 compose profile up,
+TCP 44818 accepts connections and libplctag negotiates the session,
+but the three smoke tests in `AbLegacyReadSmokeTests.cs` all fail at
+read/write with `BadCommunicationError` (libplctag status `0x80050000`).
+Possible root causes:
+
+- ab_server's PCCC server-side opcode coverage may be narrower than
+  libplctag's PCCC client expects — the tool is primarily a CIP
+  server; PCCC was added later + is noted in libplctag docs as less
+  mature.
+- libplctag's PCCC-over-CIP encapsulation may assume a real SLC 5/05
+  EtherNet/IP NIC's framing that ab_server doesn't emit.
+
+The scaffold ships **as-is** because:
+
+1. The Docker infrastructure + fixture pattern works cleanly (probe
+   passes, container lifecycle is clean, tests skip when absent).
+2. The test classes target the correct shape for what the AB Legacy
+   driver would do against real hardware.
+3. Pointing `AB_LEGACY_ENDPOINT` at a real SLC 5/05 / MicroLogix
+   1100 / 1400 should make the tests pass outright — the failure
+   mode is ab_server-specific, not driver-specific.
+
+Resolution paths (pick one):
+
+1. **File an ab_server bug** in `libplctag/libplctag` to expand PCCC
+   server-side coverage.
+2. **Golden-box tier** via Rockwell RSEmulate 500 — closer to real
+   firmware, but license-gated + RSLinx-dependent.
+3. **Lab rig** — used SLC 5/05 / MicroLogix 1100 on a dedicated
+   network; the authoritative path.
+
+### Other known gaps (unchanged from ab_server)
+
+- **Timer / Counter file decomposition** — PCCC T4 / C5 files contain
+  three-field structs (`.ACC` / `.PRE` / `.DN`). Not in ab_server's
+  scope; tests targeting `T4:0.ACC` stay unit-only.
+- **ST (ASCII string) files** — real MicroLogix ST files have a length
+  field plus CRLF-sensitive semantics that don't round-trip cleanly.
+- **Indirect addressing** (`N7:[N10:5]`) — not in ab_server's scope.
+- **DF1 serial wire behaviour** — the whole ab_server path is TCP;
+  DF1 radio / serial fidelity needs real hardware.
+
+See [`docs/drivers/AbLegacy-Test-Fixture.md`](../../../docs/drivers/AbLegacy-Test-Fixture.md)
+for the full coverage map.
+
+## References
+
+- [libplctag on GitHub](https://github.com/libplctag/libplctag) — `ab_server`
+  lives under `src/tools/ab_server/`
+- [`docs/drivers/AbLegacy-Test-Fixture.md`](../../../docs/drivers/AbLegacy-Test-Fixture.md)
+  — coverage map + gap inventory
+- [`docs/v2/dev-environment.md`](../../../docs/v2/dev-environment.md)
+  §Docker fixtures — full fixture inventory
+- [`../../ZB.MOM.WW.OtOpcUa.Driver.AbCip.IntegrationTests/Docker/`](../../ZB.MOM.WW.OtOpcUa.Driver.AbCip.IntegrationTests/Docker/)
+  — the shared Dockerfile this compose file's `build:` block references

tests/ZB.MOM.WW.OtOpcUa.Driver.AbLegacy.IntegrationTests/Docker/docker-compose.yml

@@ -0,0 +1,74 @@
+# AB Legacy PCCC integration-test fixture — ab_server in PCCC mode.
+#
+# Same image as the AB CIP fixture (otopcua-ab-server:libplctag-release).
+# The build context points at the AB CIP Docker folder one directory over
+# so `docker compose build` from here produces the same image if it
+# doesn't already exist; if it does, docker's cache reuses the layer.
+#
+# One service per PCCC family. All bind :44818 on the host; run one at a
+# time. PCCC tag format differs from CIP: `<file>[<size>]` without a
+# type suffix since the type is implicit in the file letter (N = INT,
+# F = REAL, B = bit-packed, L = DINT).
+#
+# Usage:
+#   docker compose --profile slc500 up
+#   docker compose --profile micrologix up
+#   docker compose --profile plc5 up
+services:
+  slc500:
+    profiles: ["slc500"]
+    build:
+      context: ../../ZB.MOM.WW.OtOpcUa.Driver.AbCip.IntegrationTests/Docker
+      dockerfile: Dockerfile
+    image: otopcua-ab-server:libplctag-release
+    container_name: otopcua-ab-server-slc500
+    restart: "no"
+    ports:
+      - "44818:44818"
+    command: [
+      "ab_server",
+      "--plc=SLC500",
+      "--port=44818",
+      "--tag=N7[10]",
+      "--tag=F8[10]",
+      "--tag=B3[10]",
+      "--tag=L19[10]"
+    ]
+
+  micrologix:
+    profiles: ["micrologix"]
+    image: otopcua-ab-server:libplctag-release
+    build:
+      context: ../../ZB.MOM.WW.OtOpcUa.Driver.AbCip.IntegrationTests/Docker
+      dockerfile: Dockerfile
+    container_name: otopcua-ab-server-micrologix
+    restart: "no"
+    ports:
+      - "44818:44818"
+    command: [
+      "ab_server",
+      "--plc=Micrologix",
+      "--port=44818",
+      "--tag=B3[10]",
+      "--tag=N7[10]",
+      "--tag=L19[10]"
+    ]
+
+  plc5:
+    profiles: ["plc5"]
+    image: otopcua-ab-server:libplctag-release
+    build:
+      context: ../../ZB.MOM.WW.OtOpcUa.Driver.AbCip.IntegrationTests/Docker
+      dockerfile: Dockerfile
+    container_name: otopcua-ab-server-plc5
+    restart: "no"
+    ports:
+      - "44818:44818"
+    command: [
+      "ab_server",
+      "--plc=PLC/5",
+      "--port=44818",
+      "--tag=N7[10]",
+      "--tag=F8[10]",
+      "--tag=B3[10]"
+    ]

tests/ZB.MOM.WW.OtOpcUa.Driver.AbLegacy.IntegrationTests/ZB.MOM.WW.OtOpcUa.Driver.AbLegacy.IntegrationTests.csproj

@@ -0,0 +1,35 @@
+<Project Sdk="Microsoft.NET.Sdk">
+
+    <PropertyGroup>
+        <TargetFramework>net10.0</TargetFramework>
+        <Nullable>enable</Nullable>
+        <ImplicitUsings>enable</ImplicitUsings>
+        <IsPackable>false</IsPackable>
+        <IsTestProject>true</IsTestProject>
+        <RootNamespace>ZB.MOM.WW.OtOpcUa.Driver.AbLegacy.IntegrationTests</RootNamespace>
+    </PropertyGroup>
+
+    <ItemGroup>
+        <PackageReference Include="xunit.v3" Version="1.1.0"/>
+        <PackageReference Include="Shouldly" Version="4.3.0"/>
+        <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.12.0"/>
+        <PackageReference Include="xunit.runner.visualstudio" Version="3.0.2">
+            <PrivateAssets>all</PrivateAssets>
+            <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
+        </PackageReference>
+    </ItemGroup>
+
+    <ItemGroup>
+        <ProjectReference Include="..\..\src\ZB.MOM.WW.OtOpcUa.Driver.AbLegacy\ZB.MOM.WW.OtOpcUa.Driver.AbLegacy.csproj"/>
+    </ItemGroup>
+
+    <ItemGroup>
+        <None Update="Docker\**\*" CopyToOutputDirectory="PreserveNewest"/>
+    </ItemGroup>
+
+    <ItemGroup>
+        <NuGetAuditSuppress Include="https://github.com/advisories/GHSA-37gx-xxp4-5rgx"/>
+        <NuGetAuditSuppress Include="https://github.com/advisories/GHSA-w3x6-4m5h-cxqf"/>
+    </ItemGroup>
+
+</Project>

tests/ZB.MOM.WW.OtOpcUa.Driver.FOCAS.Host.Tests/IpcHandshakeIntegrationTests.cs

@@ -0,0 +1,157 @@
+using System;
+using System.IO;
+using System.IO.Pipes;
+using System.Security.Principal;
+using System.Threading;
+using System.Threading.Tasks;
+using MessagePack;
+using Serilog;
+using Serilog.Core;
+using Shouldly;
+using Xunit;
+using ZB.MOM.WW.OtOpcUa.Driver.FOCAS.Host.Ipc;
+using ZB.MOM.WW.OtOpcUa.Driver.FOCAS.Shared;
+using ZB.MOM.WW.OtOpcUa.Driver.FOCAS.Shared.Contracts;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.FOCAS.Host.Tests
+{
+    /// <summary>
+    ///     Direct FOCAS Host IPC handshake test. Drives <see cref="PipeServer"/> through a
+    ///     hand-rolled pipe client built on <see cref="FrameReader"/> / <see cref="FrameWriter"/>
+    ///     from FOCAS.Shared. Skipped on Administrator shells because <c>PipeAcl</c> denies
+    ///     the BuiltinAdministrators group.
+    /// </summary>
+    [Trait("Category", "Integration")]
+    public sealed class IpcHandshakeIntegrationTests
+    {
+        private static bool IsAdministrator()
+        {
+            using var identity = WindowsIdentity.GetCurrent();
+            return new WindowsPrincipal(identity).IsInRole(WindowsBuiltInRole.Administrator);
+        }
+
+        private static async Task<(NamedPipeClientStream Stream, FrameReader Reader, FrameWriter Writer)>
+            ConnectAndHelloAsync(string pipeName, string secret, CancellationToken ct)
+        {
+            var stream = new NamedPipeClientStream(".", pipeName, PipeDirection.InOut, PipeOptions.Asynchronous);
+            await stream.ConnectAsync(5_000, ct);
+
+            var reader = new FrameReader(stream, leaveOpen: true);
+            var writer = new FrameWriter(stream, leaveOpen: true);
+            await writer.WriteAsync(FocasMessageKind.Hello,
+                new Hello { PeerName = "test-client", SharedSecret = secret }, ct);
+
+            var ack = await reader.ReadFrameAsync(ct);
+            if (ack is null) throw new EndOfStreamException("no HelloAck");
+            if (ack.Value.Kind != FocasMessageKind.HelloAck)
+                throw new InvalidOperationException("unexpected first frame kind " + ack.Value.Kind);
+            var ackMsg = MessagePackSerializer.Deserialize<HelloAck>(ack.Value.Body);
+            if (!ackMsg.Accepted) throw new UnauthorizedAccessException(ackMsg.RejectReason);
+
+            return (stream, reader, writer);
+        }
+
+        [Fact]
+        public async Task Handshake_with_correct_secret_succeeds_and_heartbeat_round_trips()
+        {
+            if (IsAdministrator()) return;
+
+            using var identity = WindowsIdentity.GetCurrent();
+            var sid = identity.User!;
+            var pipe = $"OtOpcUaFocasTest-{Guid.NewGuid():N}";
+            const string secret = "test-secret-2026";
+            Logger log = new LoggerConfiguration().CreateLogger();
+            using var cts = new CancellationTokenSource(TimeSpan.FromSeconds(10));
+
+            var server = new PipeServer(pipe, sid, secret, log);
+            var serverTask = Task.Run(() => server.RunOneConnectionAsync(new StubFrameHandler(), cts.Token));
+
+            var (stream, reader, writer) = await ConnectAndHelloAsync(pipe, secret, cts.Token);
+            using (stream)
+            using (reader)
+            using (writer)
+            {
+                await writer.WriteAsync(FocasMessageKind.Heartbeat,
+                    new Heartbeat { MonotonicTicks = 42 }, cts.Token);
+
+                var hbAck = await reader.ReadFrameAsync(cts.Token);
+                hbAck.HasValue.ShouldBeTrue();
+                hbAck!.Value.Kind.ShouldBe(FocasMessageKind.HeartbeatAck);
+                MessagePackSerializer.Deserialize<HeartbeatAck>(hbAck.Value.Body).MonotonicTicks.ShouldBe(42L);
+            }
+
+            cts.Cancel();
+            try { await serverTask; } catch { }
+            server.Dispose();
+        }
+
+        [Fact]
+        public async Task Handshake_with_wrong_secret_is_rejected()
+        {
+            if (IsAdministrator()) return;
+
+            using var identity = WindowsIdentity.GetCurrent();
+            var sid = identity.User!;
+            var pipe = $"OtOpcUaFocasTest-{Guid.NewGuid():N}";
+            Logger log = new LoggerConfiguration().CreateLogger();
+            using var cts = new CancellationTokenSource(TimeSpan.FromSeconds(10));
+
+            var server = new PipeServer(pipe, sid, "real-secret", log);
+            var serverTask = Task.Run(() => server.RunOneConnectionAsync(new StubFrameHandler(), cts.Token));
+
+            await Should.ThrowAsync<UnauthorizedAccessException>(async () =>
+            {
+                var (s, r, w) = await ConnectAndHelloAsync(pipe, "wrong-secret", cts.Token);
+                s.Dispose();
+                r.Dispose();
+                w.Dispose();
+            });
+
+            cts.Cancel();
+            try { await serverTask; } catch { }
+            server.Dispose();
+        }
+
+        [Fact]
+        public async Task Stub_handler_returns_not_implemented_for_data_plane_request()
+        {
+            if (IsAdministrator()) return;
+
+            using var identity = WindowsIdentity.GetCurrent();
+            var sid = identity.User!;
+            var pipe = $"OtOpcUaFocasTest-{Guid.NewGuid():N}";
+            const string secret = "stub-test";
+            Logger log = new LoggerConfiguration().CreateLogger();
+            using var cts = new CancellationTokenSource(TimeSpan.FromSeconds(10));
+
+            var server = new PipeServer(pipe, sid, secret, log);
+            var serverTask = Task.Run(() => server.RunOneConnectionAsync(new StubFrameHandler(), cts.Token));
+
+            var (stream, reader, writer) = await ConnectAndHelloAsync(pipe, secret, cts.Token);
+            using (stream)
+            using (reader)
+            using (writer)
+            {
+                await writer.WriteAsync(FocasMessageKind.ReadRequest,
+                    new ReadRequest
+                    {
+                        SessionId = 1,
+                        Address = new FocasAddressDto { Kind = 0, PmcLetter = "R", Number = 100 },
+                        DataType = FocasDataTypeCode.Int32,
+                    },
+                    cts.Token);
+
+                var resp = await reader.ReadFrameAsync(cts.Token);
+                resp.HasValue.ShouldBeTrue();
+                resp!.Value.Kind.ShouldBe(FocasMessageKind.ErrorResponse);
+                var err = MessagePackSerializer.Deserialize<ErrorResponse>(resp.Value.Body);
+                err.Code.ShouldBe("not-implemented");
+                err.Message.ShouldContain("PR C");
+            }
+
+            cts.Cancel();
+            try { await serverTask; } catch { }
+            server.Dispose();
+        }
+    }
+}

tests/ZB.MOM.WW.OtOpcUa.Driver.FOCAS.Host.Tests/ZB.MOM.WW.OtOpcUa.Driver.FOCAS.Host.Tests.csproj

@@ -0,0 +1,33 @@
+<Project Sdk="Microsoft.NET.Sdk">
+
+    <PropertyGroup>
+        <TargetFramework>net48</TargetFramework>
+        <PlatformTarget>x86</PlatformTarget>
+        <Prefer32Bit>true</Prefer32Bit>
+        <Nullable>enable</Nullable>
+        <LangVersion>latest</LangVersion>
+        <IsPackable>false</IsPackable>
+        <IsTestProject>true</IsTestProject>
+        <RootNamespace>ZB.MOM.WW.OtOpcUa.Driver.FOCAS.Host.Tests</RootNamespace>
+    </PropertyGroup>
+
+    <ItemGroup>
+        <PackageReference Include="xunit" Version="2.9.2"/>
+        <PackageReference Include="xunit.runner.visualstudio" Version="3.0.2">
+            <PrivateAssets>all</PrivateAssets>
+            <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
+        </PackageReference>
+        <PackageReference Include="Shouldly" Version="4.3.0"/>
+        <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.12.0"/>
+    </ItemGroup>
+
+    <ItemGroup>
+        <ProjectReference Include="..\..\src\ZB.MOM.WW.OtOpcUa.Driver.FOCAS.Host\ZB.MOM.WW.OtOpcUa.Driver.FOCAS.Host.csproj"/>
+    </ItemGroup>
+
+    <ItemGroup>
+        <NuGetAuditSuppress Include="https://github.com/advisories/GHSA-37gx-xxp4-5rgx"/>
+        <NuGetAuditSuppress Include="https://github.com/advisories/GHSA-w3x6-4m5h-cxqf"/>
+    </ItemGroup>
+
+</Project>

tests/ZB.MOM.WW.OtOpcUa.Driver.FOCAS.Shared.Tests/ContractRoundTripTests.cs

@@ -0,0 +1,280 @@
+using MessagePack;
+using Shouldly;
+using Xunit;
+using ZB.MOM.WW.OtOpcUa.Driver.FOCAS.Shared.Contracts;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.FOCAS.Shared.Tests;
+
+/// <summary>
+///     MessagePack round-trip coverage for every FOCAS IPC contract. Ensures
+///     <c>[Key]</c>-tagged fields survive serialize -> deserialize without loss so the
+///     wire format stays stable across Proxy (.NET 10) and Host (.NET 4.8) processes.
+/// </summary>
+[Trait("Category", "Unit")]
+public sealed class ContractRoundTripTests
+{
+    private static T RoundTrip<T>(T value)
+    {
+        var bytes = MessagePackSerializer.Serialize(value);
+        return MessagePackSerializer.Deserialize<T>(bytes);
+    }
+
+    [Fact]
+    public void Hello_round_trips()
+    {
+        var original = new Hello
+        {
+            ProtocolMajor = 1,
+            ProtocolMinor = 2,
+            PeerName = "OtOpcUa.Server",
+            SharedSecret = "abc-123",
+            Features = ["bulk-read", "pmc-rmw"],
+        };
+        var decoded = RoundTrip(original);
+        decoded.ProtocolMajor.ShouldBe(1);
+        decoded.ProtocolMinor.ShouldBe(2);
+        decoded.PeerName.ShouldBe("OtOpcUa.Server");
+        decoded.SharedSecret.ShouldBe("abc-123");
+        decoded.Features.ShouldBe(["bulk-read", "pmc-rmw"]);
+    }
+
+    [Fact]
+    public void HelloAck_rejected_carries_reason()
+    {
+        var original = new HelloAck { Accepted = false, RejectReason = "bad secret" };
+        var decoded = RoundTrip(original);
+        decoded.Accepted.ShouldBeFalse();
+        decoded.RejectReason.ShouldBe("bad secret");
+    }
+
+    [Fact]
+    public void Heartbeat_and_ack_preserve_ticks()
+    {
+        var hb = RoundTrip(new Heartbeat { MonotonicTicks = 987654321 });
+        hb.MonotonicTicks.ShouldBe(987654321);
+
+        var ack = RoundTrip(new HeartbeatAck { MonotonicTicks = 987654321, HostUtcUnixMs = 1_700_000_000_000 });
+        ack.MonotonicTicks.ShouldBe(987654321);
+        ack.HostUtcUnixMs.ShouldBe(1_700_000_000_000);
+    }
+
+    [Fact]
+    public void ErrorResponse_preserves_code_and_message()
+    {
+        var decoded = RoundTrip(new ErrorResponse { Code = "Fwlib32Crashed", Message = "EW_UNEXPECTED" });
+        decoded.Code.ShouldBe("Fwlib32Crashed");
+        decoded.Message.ShouldBe("EW_UNEXPECTED");
+    }
+
+    [Fact]
+    public void OpenSessionRequest_preserves_series_and_timeout()
+    {
+        var decoded = RoundTrip(new OpenSessionRequest
+        {
+            HostAddress = "192.168.1.50:8193",
+            TimeoutMs = 3500,
+            CncSeries = 5,
+        });
+        decoded.HostAddress.ShouldBe("192.168.1.50:8193");
+        decoded.TimeoutMs.ShouldBe(3500);
+        decoded.CncSeries.ShouldBe(5);
+    }
+
+    [Fact]
+    public void OpenSessionResponse_failure_carries_error_code()
+    {
+        var decoded = RoundTrip(new OpenSessionResponse
+        {
+            Success = false,
+            SessionId = 0,
+            Error = "unreachable",
+            ErrorCode = "EW_SOCKET",
+        });
+        decoded.Success.ShouldBeFalse();
+        decoded.Error.ShouldBe("unreachable");
+        decoded.ErrorCode.ShouldBe("EW_SOCKET");
+    }
+
+    [Fact]
+    public void FocasAddressDto_carries_pmc_with_bit_index()
+    {
+        var decoded = RoundTrip(new FocasAddressDto
+        {
+            Kind = 0,
+            PmcLetter = "R",
+            Number = 100,
+            BitIndex = 3,
+        });
+        decoded.Kind.ShouldBe(0);
+        decoded.PmcLetter.ShouldBe("R");
+        decoded.Number.ShouldBe(100);
+        decoded.BitIndex.ShouldBe(3);
+    }
+
+    [Fact]
+    public void FocasAddressDto_macro_omits_letter_and_bit()
+    {
+        var decoded = RoundTrip(new FocasAddressDto { Kind = 2, Number = 500 });
+        decoded.Kind.ShouldBe(2);
+        decoded.PmcLetter.ShouldBeNull();
+        decoded.Number.ShouldBe(500);
+        decoded.BitIndex.ShouldBeNull();
+    }
+
+    [Fact]
+    public void ReadRequest_and_response_round_trip()
+    {
+        var req = RoundTrip(new ReadRequest
+        {
+            SessionId = 42,
+            Address = new FocasAddressDto { Kind = 1, Number = 1815 },
+            DataType = FocasDataTypeCode.Int32,
+            TimeoutMs = 1500,
+        });
+        req.SessionId.ShouldBe(42);
+        req.Address.Number.ShouldBe(1815);
+        req.DataType.ShouldBe(FocasDataTypeCode.Int32);
+
+        var resp = RoundTrip(new ReadResponse
+        {
+            Success = true,
+            StatusCode = 0,
+            ValueBytes = MessagePackSerializer.Serialize((int)12345),
+            ValueTypeCode = FocasDataTypeCode.Int32,
+            SourceTimestampUtcUnixMs = 1_700_000_000_000,
+        });
+        resp.Success.ShouldBeTrue();
+        resp.StatusCode.ShouldBe(0u);
+        MessagePackSerializer.Deserialize<int>(resp.ValueBytes!).ShouldBe(12345);
+        resp.ValueTypeCode.ShouldBe(FocasDataTypeCode.Int32);
+    }
+
+    [Fact]
+    public void WriteRequest_and_response_round_trip()
+    {
+        var req = RoundTrip(new WriteRequest
+        {
+            SessionId = 1,
+            Address = new FocasAddressDto { Kind = 2, Number = 500 },
+            DataType = FocasDataTypeCode.Float64,
+            ValueBytes = MessagePackSerializer.Serialize(3.14159),
+            ValueTypeCode = FocasDataTypeCode.Float64,
+        });
+        MessagePackSerializer.Deserialize<double>(req.ValueBytes!).ShouldBe(3.14159);
+
+        var resp = RoundTrip(new WriteResponse { Success = true, StatusCode = 0 });
+        resp.Success.ShouldBeTrue();
+        resp.StatusCode.ShouldBe(0u);
+    }
+
+    [Fact]
+    public void PmcBitWriteRequest_preserves_bit_and_value()
+    {
+        var req = RoundTrip(new PmcBitWriteRequest
+        {
+            SessionId = 7,
+            Address = new FocasAddressDto { Kind = 0, PmcLetter = "Y", Number = 12 },
+            BitIndex = 5,
+            Value = true,
+        });
+        req.BitIndex.ShouldBe(5);
+        req.Value.ShouldBeTrue();
+    }
+
+    [Fact]
+    public void SubscribeRequest_round_trips_multiple_items()
+    {
+        var original = new SubscribeRequest
+        {
+            SessionId = 1,
+            SubscriptionId = 100,
+            IntervalMs = 250,
+            Items =
+            [
+                new() { MonitoredItemId = 1, Address = new() { Kind = 0, PmcLetter = "R", Number = 100 }, DataType = FocasDataTypeCode.Bit },
+                new() { MonitoredItemId = 2, Address = new() { Kind = 2, Number = 500 }, DataType = FocasDataTypeCode.Float64 },
+            ],
+        };
+        var decoded = RoundTrip(original);
+        decoded.Items.Length.ShouldBe(2);
+        decoded.Items[0].MonitoredItemId.ShouldBe(1);
+        decoded.Items[0].Address.PmcLetter.ShouldBe("R");
+        decoded.Items[1].DataType.ShouldBe(FocasDataTypeCode.Float64);
+    }
+
+    [Fact]
+    public void SubscribeResponse_rejected_items_survive()
+    {
+        var decoded = RoundTrip(new SubscribeResponse
+        {
+            Success = true,
+            RejectedMonitoredItemIds = [2, 7],
+        });
+        decoded.RejectedMonitoredItemIds.ShouldBe([2, 7]);
+    }
+
+    [Fact]
+    public void UnsubscribeRequest_round_trips()
+    {
+        var decoded = RoundTrip(new UnsubscribeRequest { SubscriptionId = 42 });
+        decoded.SubscriptionId.ShouldBe(42);
+    }
+
+    [Fact]
+    public void OnDataChangeNotification_round_trips()
+    {
+        var original = new OnDataChangeNotification
+        {
+            SubscriptionId = 100,
+            Changes =
+            [
+                new()
+                {
+                    MonitoredItemId = 1,
+                    StatusCode = 0,
+                    ValueBytes = MessagePackSerializer.Serialize(true),
+                    ValueTypeCode = FocasDataTypeCode.Bit,
+                    SourceTimestampUtcUnixMs = 1_700_000_000_000,
+                },
+            ],
+        };
+        var decoded = RoundTrip(original);
+        decoded.Changes.Length.ShouldBe(1);
+        MessagePackSerializer.Deserialize<bool>(decoded.Changes[0].ValueBytes!).ShouldBeTrue();
+    }
+
+    [Fact]
+    public void ProbeRequest_and_response_round_trip()
+    {
+        var req = RoundTrip(new ProbeRequest { SessionId = 1, TimeoutMs = 500 });
+        req.TimeoutMs.ShouldBe(500);
+
+        var resp = RoundTrip(new ProbeResponse { Healthy = true, ObservedAtUtcUnixMs = 1_700_000_000_000 });
+        resp.Healthy.ShouldBeTrue();
+        resp.ObservedAtUtcUnixMs.ShouldBe(1_700_000_000_000);
+    }
+
+    [Fact]
+    public void RuntimeStatusChangeNotification_round_trips()
+    {
+        var decoded = RoundTrip(new RuntimeStatusChangeNotification
+        {
+            SessionId = 5,
+            RuntimeStatus = "Stopped",
+            ObservedAtUtcUnixMs = 1_700_000_000_000,
+        });
+        decoded.RuntimeStatus.ShouldBe("Stopped");
+    }
+
+    [Fact]
+    public void RecycleHostRequest_and_response_round_trip()
+    {
+        var req = RoundTrip(new RecycleHostRequest { Kind = "Hard", Reason = "wedge-detected" });
+        req.Kind.ShouldBe("Hard");
+        req.Reason.ShouldBe("wedge-detected");
+
+        var resp = RoundTrip(new RecycleStatusResponse { Accepted = true, GraceSeconds = 20 });
+        resp.Accepted.ShouldBeTrue();
+        resp.GraceSeconds.ShouldBe(20);
+    }
+}

tests/ZB.MOM.WW.OtOpcUa.Driver.FOCAS.Shared.Tests/FramingTests.cs

@@ -0,0 +1,107 @@
+using System.IO;
+using Shouldly;
+using Xunit;
+using ZB.MOM.WW.OtOpcUa.Driver.FOCAS.Shared;
+using ZB.MOM.WW.OtOpcUa.Driver.FOCAS.Shared.Contracts;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.FOCAS.Shared.Tests;
+
+[Trait("Category", "Unit")]
+public sealed class FramingTests
+{
+    [Fact]
+    public async Task FrameWriter_round_trips_single_frame_through_FrameReader()
+    {
+        var buffer = new MemoryStream();
+        using (var writer = new FrameWriter(buffer, leaveOpen: true))
+        {
+            await writer.WriteAsync(FocasMessageKind.Hello,
+                new Hello { PeerName = "proxy", SharedSecret = "s3cr3t" }, TestContext.Current.CancellationToken);
+        }
+
+        buffer.Position = 0;
+        using var reader = new FrameReader(buffer, leaveOpen: true);
+        var frame = await reader.ReadFrameAsync(TestContext.Current.CancellationToken);
+        frame.ShouldNotBeNull();
+        frame!.Value.Kind.ShouldBe(FocasMessageKind.Hello);
+        var hello = FrameReader.Deserialize<Hello>(frame.Value.Body);
+        hello.PeerName.ShouldBe("proxy");
+        hello.SharedSecret.ShouldBe("s3cr3t");
+    }
+
+    [Fact]
+    public async Task FrameReader_returns_null_on_clean_EOF_at_frame_boundary()
+    {
+        using var empty = new MemoryStream();
+        using var reader = new FrameReader(empty, leaveOpen: true);
+        var frame = await reader.ReadFrameAsync(TestContext.Current.CancellationToken);
+        frame.ShouldBeNull();
+    }
+
+    [Fact]
+    public async Task FrameReader_throws_on_oversized_length_prefix()
+    {
+        var hostile = new byte[] { 0x7F, 0xFF, 0xFF, 0xFF, 0x01 }; // length > 16 MiB
+        using var stream = new MemoryStream(hostile);
+        using var reader = new FrameReader(stream, leaveOpen: true);
+        await Should.ThrowAsync<InvalidDataException>(async () =>
+            await reader.ReadFrameAsync(TestContext.Current.CancellationToken));
+    }
+
+    [Fact]
+    public async Task FrameReader_throws_on_mid_frame_eof()
+    {
+        var buffer = new MemoryStream();
+        using (var writer = new FrameWriter(buffer, leaveOpen: true))
+        {
+            await writer.WriteAsync(FocasMessageKind.Hello, new Hello { PeerName = "x" },
+                TestContext.Current.CancellationToken);
+        }
+        // Truncate so body is incomplete.
+        var truncated = buffer.ToArray()[..(buffer.ToArray().Length - 2)];
+        using var partial = new MemoryStream(truncated);
+        using var reader = new FrameReader(partial, leaveOpen: true);
+        await Should.ThrowAsync<EndOfStreamException>(async () =>
+            await reader.ReadFrameAsync(TestContext.Current.CancellationToken));
+    }
+
+    [Fact]
+    public async Task FrameWriter_serializes_concurrent_writes()
+    {
+        var buffer = new MemoryStream();
+        using var writer = new FrameWriter(buffer, leaveOpen: true);
+
+        var tasks = Enumerable.Range(0, 20).Select(i => writer.WriteAsync(
+            FocasMessageKind.Heartbeat,
+            new Heartbeat { MonotonicTicks = i },
+            TestContext.Current.CancellationToken)).ToArray();
+        await Task.WhenAll(tasks);
+
+        buffer.Position = 0;
+        using var reader = new FrameReader(buffer, leaveOpen: true);
+        var seen = new List<long>();
+        while (await reader.ReadFrameAsync(TestContext.Current.CancellationToken) is { } frame)
+        {
+            frame.Kind.ShouldBe(FocasMessageKind.Heartbeat);
+            seen.Add(FrameReader.Deserialize<Heartbeat>(frame.Body).MonotonicTicks);
+        }
+        seen.Count.ShouldBe(20);
+        seen.OrderBy(x => x).ShouldBe(Enumerable.Range(0, 20).Select(x => (long)x));
+    }
+
+    [Fact]
+    public void MessageKind_values_are_stable()
+    {
+        // Guardrail — if someone reorders/renumbers, the wire format breaks for deployed peers.
+        ((byte)FocasMessageKind.Hello).ShouldBe((byte)0x01);
+        ((byte)FocasMessageKind.Heartbeat).ShouldBe((byte)0x03);
+        ((byte)FocasMessageKind.OpenSessionRequest).ShouldBe((byte)0x10);
+        ((byte)FocasMessageKind.ReadRequest).ShouldBe((byte)0x30);
+        ((byte)FocasMessageKind.WriteRequest).ShouldBe((byte)0x32);
+        ((byte)FocasMessageKind.PmcBitWriteRequest).ShouldBe((byte)0x34);
+        ((byte)FocasMessageKind.SubscribeRequest).ShouldBe((byte)0x40);
+        ((byte)FocasMessageKind.OnDataChangeNotification).ShouldBe((byte)0x43);
+        ((byte)FocasMessageKind.ProbeRequest).ShouldBe((byte)0x70);
+        ((byte)FocasMessageKind.ErrorResponse).ShouldBe((byte)0xFE);
+    }
+}

tests/ZB.MOM.WW.OtOpcUa.Driver.FOCAS.Shared.Tests/ZB.MOM.WW.OtOpcUa.Driver.FOCAS.Shared.Tests.csproj

@@ -0,0 +1,31 @@
+<Project Sdk="Microsoft.NET.Sdk">
+
+    <PropertyGroup>
+        <TargetFramework>net10.0</TargetFramework>
+        <Nullable>enable</Nullable>
+        <ImplicitUsings>enable</ImplicitUsings>
+        <IsPackable>false</IsPackable>
+        <IsTestProject>true</IsTestProject>
+        <RootNamespace>ZB.MOM.WW.OtOpcUa.Driver.FOCAS.Shared.Tests</RootNamespace>
+    </PropertyGroup>
+
+    <ItemGroup>
+        <PackageReference Include="xunit.v3" Version="1.1.0"/>
+        <PackageReference Include="Shouldly" Version="4.3.0"/>
+        <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.12.0"/>
+        <PackageReference Include="xunit.runner.visualstudio" Version="3.0.2">
+            <PrivateAssets>all</PrivateAssets>
+            <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
+        </PackageReference>
+    </ItemGroup>
+
+    <ItemGroup>
+        <ProjectReference Include="..\..\src\ZB.MOM.WW.OtOpcUa.Driver.FOCAS.Shared\ZB.MOM.WW.OtOpcUa.Driver.FOCAS.Shared.csproj"/>
+    </ItemGroup>
+
+    <ItemGroup>
+        <NuGetAuditSuppress Include="https://github.com/advisories/GHSA-37gx-xxp4-5rgx"/>
+        <NuGetAuditSuppress Include="https://github.com/advisories/GHSA-w3x6-4m5h-cxqf"/>
+    </ItemGroup>
+
+</Project>

tests/ZB.MOM.WW.OtOpcUa.Driver.FOCAS.Tests/FocasCapabilityMatrixTests.cs

@@ -0,0 +1,156 @@
+using Shouldly;
+using Xunit;
+using ZB.MOM.WW.OtOpcUa.Driver.FOCAS;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.FOCAS.Tests;
+
+/// <summary>
+///     Version-matrix coverage for <see cref="FocasCapabilityMatrix"/>. Encodes the
+///     documented Fanuc FOCAS Developer Kit support boundaries per CNC series so a
+///     config-time change that widens or narrows a range without updating
+///     <c>docs/v2/focas-version-matrix.md</c> fails a test. Every assertion cites the
+///     specific matrix row it reflects.
+/// </summary>
+[Trait("Category", "Unit")]
+public sealed class FocasCapabilityMatrixTests
+{
+    // ---- Macro ranges ----
+
+    [Theory]
+    [InlineData(FocasCncSeries.Sixteen_i,     999,   true)]
+    [InlineData(FocasCncSeries.Sixteen_i,     1000,  false)]  // above legacy ceiling
+    [InlineData(FocasCncSeries.Zero_i_D,      999,   true)]
+    [InlineData(FocasCncSeries.Zero_i_D,      9999,  false)]  // 0i-D is still legacy-ceiling
+    [InlineData(FocasCncSeries.Zero_i_F,      9999,  true)]   // widened on 0i-F
+    [InlineData(FocasCncSeries.Zero_i_F,      10000, false)]
+    [InlineData(FocasCncSeries.Thirty_i,      99999, true)]   // highest-end
+    [InlineData(FocasCncSeries.Thirty_i,      100000, false)]
+    [InlineData(FocasCncSeries.PowerMotion_i, 999,   true)]
+    [InlineData(FocasCncSeries.PowerMotion_i, 1000,  false)]  // atypical coverage
+    public void Macro_range_matches_series(FocasCncSeries series, int number, bool accepted)
+    {
+        var address = new FocasAddress(FocasAreaKind.Macro, null, number, null);
+        var result = FocasCapabilityMatrix.Validate(series, address);
+        (result is null).ShouldBe(accepted,
+            $"Macro #{number} on {series}: expected {(accepted ? "accept" : "reject")}, got {(result ?? "accept")}");
+    }
+
+    // ---- Parameter ranges ----
+
+    [Theory]
+    [InlineData(FocasCncSeries.Sixteen_i, 9999,  true)]
+    [InlineData(FocasCncSeries.Sixteen_i, 10000, false)]  // 16i capped at 9999
+    [InlineData(FocasCncSeries.Zero_i_F,  14999, true)]
+    [InlineData(FocasCncSeries.Zero_i_F,  15000, false)]
+    [InlineData(FocasCncSeries.Thirty_i,  29999, true)]
+    [InlineData(FocasCncSeries.Thirty_i,  30000, false)]
+    public void Parameter_range_matches_series(FocasCncSeries series, int number, bool accepted)
+    {
+        var address = new FocasAddress(FocasAreaKind.Parameter, null, number, null);
+        var result = FocasCapabilityMatrix.Validate(series, address);
+        (result is null).ShouldBe(accepted);
+    }
+
+    // ---- PMC letters ----
+
+    [Theory]
+    [InlineData(FocasCncSeries.Sixteen_i,  "X", true)]
+    [InlineData(FocasCncSeries.Sixteen_i,  "Y", true)]
+    [InlineData(FocasCncSeries.Sixteen_i,  "R", true)]
+    [InlineData(FocasCncSeries.Sixteen_i,  "F", false)]  // 16i has no F/G signal groups
+    [InlineData(FocasCncSeries.Sixteen_i,  "G", false)]
+    [InlineData(FocasCncSeries.Sixteen_i,  "K", false)]
+    [InlineData(FocasCncSeries.Zero_i_D,   "E", true)]   // widened since 0i-D
+    [InlineData(FocasCncSeries.Zero_i_D,   "F", false)]  // still no F on 0i-D
+    [InlineData(FocasCncSeries.Zero_i_F,   "F", true)]   // F/G added on 0i-F
+    [InlineData(FocasCncSeries.Zero_i_F,   "K", false)]  // K/T still 30i-only
+    [InlineData(FocasCncSeries.Thirty_i,   "K", true)]
+    [InlineData(FocasCncSeries.Thirty_i,   "T", true)]
+    [InlineData(FocasCncSeries.Thirty_i,   "Q", false)]  // unsupported even on 30i
+    public void Pmc_letter_matches_series(FocasCncSeries series, string letter, bool accepted)
+    {
+        var address = new FocasAddress(FocasAreaKind.Pmc, letter, 0, null);
+        var result = FocasCapabilityMatrix.Validate(series, address);
+        (result is null).ShouldBe(accepted,
+            $"PMC letter '{letter}' on {series}: expected {(accepted ? "accept" : "reject")}, got {(result ?? "accept")}");
+    }
+
+    // ---- PMC number ceiling ----
+
+    [Theory]
+    [InlineData(FocasCncSeries.Sixteen_i,  "R", 999,  true)]
+    [InlineData(FocasCncSeries.Sixteen_i,  "R", 1000, false)]
+    [InlineData(FocasCncSeries.Zero_i_D,   "R", 1999, true)]
+    [InlineData(FocasCncSeries.Zero_i_D,   "R", 2000, false)]
+    [InlineData(FocasCncSeries.Zero_i_F,   "R", 9999, true)]
+    [InlineData(FocasCncSeries.Zero_i_F,   "R", 10000, false)]
+    [InlineData(FocasCncSeries.Thirty_i,   "R", 59999, true)]
+    [InlineData(FocasCncSeries.Thirty_i,   "R", 60000, false)]
+    public void Pmc_number_ceiling_matches_series(FocasCncSeries series, string letter, int number, bool accepted)
+    {
+        var address = new FocasAddress(FocasAreaKind.Pmc, letter, number, null);
+        var result = FocasCapabilityMatrix.Validate(series, address);
+        (result is null).ShouldBe(accepted);
+    }
+
+    // ---- Unknown series is permissive ----
+
+    [Theory]
+    [InlineData("Z", 999_999)]   // absurd PMC address
+    [InlineData("Q", 0)]         // non-existent letter
+    public void Unknown_series_accepts_any_PMC(string letter, int number)
+    {
+        var address = new FocasAddress(FocasAreaKind.Pmc, letter, number, null);
+        FocasCapabilityMatrix.Validate(FocasCncSeries.Unknown, address).ShouldBeNull();
+    }
+
+    [Fact]
+    public void Unknown_series_accepts_any_macro_number()
+    {
+        var address = new FocasAddress(FocasAreaKind.Macro, null, 999_999, null);
+        FocasCapabilityMatrix.Validate(FocasCncSeries.Unknown, address).ShouldBeNull();
+    }
+
+    [Fact]
+    public void Unknown_series_accepts_any_parameter_number()
+    {
+        var address = new FocasAddress(FocasAreaKind.Parameter, null, 999_999, null);
+        FocasCapabilityMatrix.Validate(FocasCncSeries.Unknown, address).ShouldBeNull();
+    }
+
+    // ---- Reason messages include enough context to diagnose ----
+
+    [Fact]
+    public void Rejection_message_names_series_and_limit()
+    {
+        var address = new FocasAddress(FocasAreaKind.Macro, null, 100_000, null);
+        var reason = FocasCapabilityMatrix.Validate(FocasCncSeries.Zero_i_F, address);
+        reason.ShouldNotBeNull();
+        reason.ShouldContain("100000");
+        reason.ShouldContain("Zero_i_F");
+        reason.ShouldContain("9999");
+    }
+
+    [Fact]
+    public void Pmc_rejection_lists_accepted_letters()
+    {
+        var address = new FocasAddress(FocasAreaKind.Pmc, "Q", 0, null);
+        var reason = FocasCapabilityMatrix.Validate(FocasCncSeries.Thirty_i, address);
+        reason.ShouldNotBeNull();
+        reason.ShouldContain("'Q'");
+        reason.ShouldContain("X");  // some accepted letter should appear
+        reason.ShouldContain("Y");
+    }
+
+    // ---- PMC address letter is case-insensitive ----
+
+    [Theory]
+    [InlineData("x")]
+    [InlineData("X")]
+    [InlineData("f")]
+    public void Pmc_letter_match_is_case_insensitive_on_30i(string letter)
+    {
+        var address = new FocasAddress(FocasAreaKind.Pmc, letter, 0, null);
+        FocasCapabilityMatrix.Validate(FocasCncSeries.Thirty_i, address).ShouldBeNull();
+    }
+}

tests/ZB.MOM.WW.OtOpcUa.Driver.Modbus.IntegrationTests/DL205/DL205Profile.cs

@@ -2,7 +2,7 @@ namespace ZB.MOM.WW.OtOpcUa.Driver.Modbus.IntegrationTests.DL205;
 
 /// <summary>
 ///     Tag map for the AutomationDirect DL205 device class. Mirrors what the pymodbus
-///     <c>dl205.json</c> profile in <c>Pymodbus/dl205.json</c> exposes (or the real PLC, when
+///     <c>dl205.json</c> profile in <c>Docker/profiles/dl205.json</c> exposes (or the real PLC, when
 ///     <see cref="ModbusSimulatorFixture"/> is pointed at one).
 /// </summary>
 /// <remarks>
@@ -16,8 +16,8 @@ public static class DL205Profile
 {
     /// <summary>
     ///     Holding register the smoke test writes + reads. Address 200 is the first cell of the
-    ///     scratch HR range in both <c>Pymodbus/standard.json</c> (HR[200..209] = 0) and
-    ///     <c>Pymodbus/dl205.json</c> (HR[4096..4103] added in PR 43 for the same purpose), so
+    ///     scratch HR range in both <c>Docker/profiles/standard.json</c> (HR[200..209] = 0) and
+    ///     <c>Docker/profiles/dl205.json</c> (HR[4096..4103] added in PR 43 for the same purpose), so
     ///     the smoke test runs identically against either simulator profile. Originally
     ///     targeted HR[100] — moved to HR[200] when the standard profile claimed HR[100] as
     ///     the auto-incrementing register that drives subscribe-and-receive tests.

tests/ZB.MOM.WW.OtOpcUa.Driver.Modbus.IntegrationTests/DL205/DL205StringQuirkTests.cs

@@ -12,7 +12,7 @@ namespace ZB.MOM.WW.OtOpcUa.Driver.Modbus.IntegrationTests.DL205;
 /// </summary>
 /// <remarks>
 ///     <para>
-///         Requires the dl205 profile (<c>Pymodbus\serve.ps1 -Profile dl205</c>). The standard
+///         Requires the dl205 profile (<c>docker compose -f Docker/docker-compose.yml --profile dl205 up</c>). The standard
 ///         profile does not seed HR[1040..1042] with string bytes, so running this against the
 ///         standard profile returns <c>"\0\0\0\0\0"</c> and the test fails. Skip when the env
 ///         var <c>MODBUS_SIM_PROFILE</c> is not set to <c>dl205</c>.

tests/ZB.MOM.WW.OtOpcUa.Driver.Modbus.IntegrationTests/Docker/Dockerfile

@@ -0,0 +1,27 @@
+# pymodbus simulator container for the Modbus integration suite.
+#
+# Pinned base + package version so the fixture surface is reproducible —
+# matches the version referenced in docs/drivers/Modbus-Test-Fixture.md.
+FROM python:3.12-slim-bookworm
+
+LABEL org.opencontainers.image.source="https://github.com/dohertj2/lmxopcua" \
+      org.opencontainers.image.description="pymodbus simulator for OtOpcUa Modbus driver integration tests"
+
+RUN pip install --no-cache-dir "pymodbus[simulator]==3.13.0"
+
+# Ship every profile in the image so one container can serve whichever
+# family a test run needs; the compose file picks which JSON is active via
+# the command override.
+WORKDIR /fixtures
+COPY profiles/ /fixtures/
+
+EXPOSE 5020
+
+# Default to the standard profile; docker-compose.yml overrides per service.
+# --http_port intentionally omitted; pymodbus 3.13's web UI binds on a
+# container-local default we don't publish, so it's not reachable from the
+# host and costs nothing.
+CMD ["pymodbus.simulator", \
+     "--modbus_server", "srv", \
+     "--modbus_device",  "dev", \
+     "--json_file",      "/fixtures/standard.json"]

tests/ZB.MOM.WW.OtOpcUa.Driver.Modbus.IntegrationTests/Docker/README.md

@@ -0,0 +1,67 @@
+# Modbus integration-test fixture — pymodbus simulator
+
+The Modbus driver's integration tests talk to a
+[`pymodbus`](https://pymodbus.readthedocs.io/) simulator running as a
+pinned Docker container. One image, per-profile service in compose, same
+port binding (`5020`) regardless of which profile is live. Docker is the
+only supported launch path — a fresh clone needs Docker Desktop and
+nothing else.
+
+| File | Purpose |
+|---|---|
+| [`Dockerfile`](Dockerfile) | `python:3.12-slim-bookworm` + `pymodbus[simulator]==3.13.0` + the four profile JSONs |
+| [`docker-compose.yml`](docker-compose.yml) | One service per profile (`standard` / `dl205` / `mitsubishi` / `s7_1500`); all bind `:5020` so only one runs at a time |
+| [`profiles/*.json`](profiles/) | Same seed-register definitions the native launcher uses — canonical source |
+
+## Run
+
+From the repo root:
+
+```powershell
+# Build + start the standard profile
+docker compose -f tests\ZB.MOM.WW.OtOpcUa.Driver.Modbus.IntegrationTests\Docker\docker-compose.yml --profile standard up
+
+# DL205 quirks
+docker compose -f tests\ZB.MOM.WW.OtOpcUa.Driver.Modbus.IntegrationTests\Docker\docker-compose.yml --profile dl205 up
+
+# Mitsubishi MELSEC quirks
+docker compose -f tests\ZB.MOM.WW.OtOpcUa.Driver.Modbus.IntegrationTests\Docker\docker-compose.yml --profile mitsubishi up
+
+# Siemens S7-1500 MB_SERVER quirks
+docker compose -f tests\ZB.MOM.WW.OtOpcUa.Driver.Modbus.IntegrationTests\Docker\docker-compose.yml --profile s7_1500 up
+```
+
+Detached + stop:
+
+```powershell
+docker compose -f tests\...\Docker\docker-compose.yml --profile dl205 up -d
+docker compose -f tests\...\Docker\docker-compose.yml --profile dl205 down
+```
+
+Only one profile binds `:5020` at a time; switch by stopping the current
+service + starting another. The integration tests discriminate by a
+separate `MODBUS_SIM_PROFILE` env var so they skip correctly when the
+wrong profile is live.
+
+## Endpoint
+
+- Default: `localhost:5020`
+- Override with `MODBUS_SIM_ENDPOINT` (e.g. a real PLC on `:502`).
+
+## Run the integration tests
+
+In a separate shell with one profile live:
+
+```powershell
+cd C:\Users\dohertj2\Desktop\lmxopcua
+dotnet test tests\ZB.MOM.WW.OtOpcUa.Driver.Modbus.IntegrationTests
+```
+
+`ModbusSimulatorFixture` probes `localhost:5020` at collection init +
+records a `SkipReason` when unreachable, so tests stay green on a fresh
+clone without Docker running.
+
+## References
+
+- [`docs/drivers/Modbus-Test-Fixture.md`](../../../docs/drivers/Modbus-Test-Fixture.md) — coverage map + gap inventory
+- [`docs/v2/dev-environment.md`](../../../docs/v2/dev-environment.md) §Docker fixtures — full fixture inventory

tests/ZB.MOM.WW.OtOpcUa.Driver.Modbus.IntegrationTests/Docker/docker-compose.yml

@@ -0,0 +1,79 @@
+# Modbus integration-test fixture — pymodbus simulator.
+#
+# One service per profile. Bring up only the profile a test class needs;
+# they all bind :5020 on the host so can't run concurrently. The compose
+# `profiles:` feature gates which service spins up via `--profile <name>`.
+#
+# Usage:
+#   docker compose --profile standard up
+#   docker compose --profile dl205 up
+#   docker compose --profile mitsubishi up
+#   docker compose --profile s7_1500 up
+services:
+  standard:
+    profiles: ["standard"]
+    build:
+      context: .
+      dockerfile: Dockerfile
+    image: otopcua-pymodbus:3.13.0
+    container_name: otopcua-pymodbus-standard
+    restart: "no"
+    ports:
+      - "5020:5020"
+    command: [
+      "pymodbus.simulator",
+      "--modbus_server", "srv",
+      "--modbus_device",  "dev",
+      "--json_file",      "/fixtures/standard.json"
+    ]
+
+  dl205:
+    profiles: ["dl205"]
+    image: otopcua-pymodbus:3.13.0
+    build:
+      context: .
+      dockerfile: Dockerfile
+    container_name: otopcua-pymodbus-dl205
+    restart: "no"
+    ports:
+      - "5020:5020"
+    command: [
+      "pymodbus.simulator",
+      "--modbus_server", "srv",
+      "--modbus_device",  "dev",
+      "--json_file",      "/fixtures/dl205.json"
+    ]
+
+  mitsubishi:
+    profiles: ["mitsubishi"]
+    image: otopcua-pymodbus:3.13.0
+    build:
+      context: .
+      dockerfile: Dockerfile
+    container_name: otopcua-pymodbus-mitsubishi
+    restart: "no"
+    ports:
+      - "5020:5020"
+    command: [
+      "pymodbus.simulator",
+      "--modbus_server", "srv",
+      "--modbus_device",  "dev",
+      "--json_file",      "/fixtures/mitsubishi.json"
+    ]
+
+  s7_1500:
+    profiles: ["s7_1500"]
+    image: otopcua-pymodbus:3.13.0
+    build:
+      context: .
+      dockerfile: Dockerfile
+    container_name: otopcua-pymodbus-s7_1500
+    restart: "no"
+    ports:
+      - "5020:5020"
+    command: [
+      "pymodbus.simulator",
+      "--modbus_server", "srv",
+      "--modbus_device",  "dev",
+      "--json_file",      "/fixtures/s7_1500.json"
+    ]

tests/ZB.MOM.WW.OtOpcUa.Driver.Modbus.IntegrationTests/ModbusSimulatorFixture.cs

@@ -3,8 +3,8 @@ using System.Net.Sockets;
 namespace ZB.MOM.WW.OtOpcUa.Driver.Modbus.IntegrationTests;
 
 /// <summary>
-///     Reachability probe for a Modbus TCP simulator (pymodbus-driven, see
-///     <c>Pymodbus/serve.ps1</c>) or a real PLC. Parses
+///     Reachability probe for a Modbus TCP simulator (pymodbus in Docker, see
+///     <c>Docker/docker-compose.yml</c>) or a real PLC. Parses
 ///     <c>MODBUS_SIM_ENDPOINT</c> (default <c>localhost:5020</c> per PR 43) and TCP-connects once at
 ///     fixture construction. Each test checks <see cref="SkipReason"/> and calls
 ///     <c>Assert.Skip</c> when the endpoint was unreachable, so a dev box without a running
@@ -28,7 +28,7 @@ public sealed class ModbusSimulatorFixture : IAsyncDisposable
 {
     // PR 43: default port is 5020 (pymodbus convention) instead of 502 (Modbus standard).
     // Picking 5020 sidesteps the privileged-port admin requirement on Windows + matches the
-    // port baked into the pymodbus simulator JSON profiles in Pymodbus/. Override with
+    // port baked into the pymodbus simulator JSON profiles in Docker/profiles/. Override with
     // MODBUS_SIM_ENDPOINT to point at a real PLC on its native port 502.
     private const string DefaultEndpoint = "localhost:5020";
     private const string EndpointEnvVar = "MODBUS_SIM_ENDPOINT";
@@ -61,15 +61,15 @@ public sealed class ModbusSimulatorFixture : IAsyncDisposable
             if (!task.Wait(TimeSpan.FromSeconds(2)) || !client.Connected)
             {
                 SkipReason = $"Modbus simulator at {Host}:{Port} did not accept a TCP connection within 2s. " +
-                             $"Start the pymodbus simulator (Pymodbus\\serve.ps1 -Profile standard) " +
+                             $"Start the pymodbus Docker container (docker compose -f Docker/docker-compose.yml --profile standard up -d) " +
                              $"or override {EndpointEnvVar}, then re-run.";
             }
         }
         catch (Exception ex)
         {
             SkipReason = $"Modbus simulator at {Host}:{Port} unreachable: {ex.GetType().Name}: {ex.Message}. " +
-                         $"Start the pymodbus simulator (Pymodbus\\serve.ps1 -Profile standard) " +
-                             $"or override {EndpointEnvVar}, then re-run.";
+                         $"Start the pymodbus Docker container (docker compose -f Docker/docker-compose.yml --profile standard up -d) " +
+                         $"or override {EndpointEnvVar}, then re-run.";
         }
     }
 

tests/ZB.MOM.WW.OtOpcUa.Driver.Modbus.IntegrationTests/Pymodbus/README.md

@@ -1,163 +0,0 @@
-# pymodbus simulator profiles
-
-Two JSON-config profiles for pymodbus's `ModbusSimulatorServer`. Replaces the
-ModbusPal `.xmpp` profiles that lived here in PR 42 — pymodbus is headless,
-maintained, semantic about register layout, and pip-installable on Windows.
-
-| File | What it simulates | Test category |
-|---|---|---|
-| [`standard.json`](standard.json) | Generic Modbus TCP server — HR[0..31] = address-as-value, HR[100] declarative auto-increment via `"action": "increment"`, alternating coils, scratch ranges for write tests. | `Trait=Standard` |
-| [`dl205.json`](dl205.json) | AutomationDirect DirectLOGIC DL205 / DL260 quirks per [`docs/v2/dl205.md`](../../../docs/v2/dl205.md): low-byte-first string packing, CDAB Float32, BCD numerics, V-memory address markers, Y/C coil mappings. Inline `_quirk` comments per register name the behavior. | `Trait=DL205` |
-
-Both bind TCP **5020** (pymodbus convention; sidesteps the Windows admin
-requirement for privileged port 502). The integration-test fixture
-(`ModbusSimulatorFixture`) defaults to `localhost:5020` to match — override
-via `MODBUS_SIM_ENDPOINT` to point at a real PLC on its native port 502.
-
-Run only **one profile at a time** (they share TCP 5020).
-
-## Install
-
-```powershell
-pip install "pymodbus[simulator]==3.13.0"
-```
-
-The `[simulator]` extra pulls in `aiohttp` for the optional web UI / REST API.
-Pinned to 3.13.0 for reproducibility — avoid 4.x dev releases until stabilized.
-Requires Python ≥ 3.10. Windows Firewall will prompt on first bind; allow
-Private network.
-
-## Run
-
-Foreground (Ctrl+C to stop). Use the `serve.ps1` wrapper:
-
-```powershell
-.\serve.ps1 -Profile standard
-.\serve.ps1 -Profile dl205
-```
-
-Or invoke pymodbus directly:
-
-```powershell
-pymodbus.simulator `
-    --modbus_server srv `
-    --modbus_device dev `
-    --json_file .\standard.json `
-    --http_port 8080
-```
-
-Web UI at `http://localhost:8080` lets you inspect + poke registers manually.
-Pass `--no_http` (or `-HttpPort 0` to `serve.ps1`) to disable.
-
-## Run the integration tests
-
-In a separate shell, with the simulator running:
-
-```powershell
-cd C:\Users\dohertj2\Desktop\lmxopcua
-dotnet test tests\ZB.MOM.WW.OtOpcUa.Driver.Modbus.IntegrationTests
-```
-
-Tests auto-skip with a clear `SkipReason` if `localhost:5020` isn't reachable
-within 2 seconds. Filter by trait when both profiles' tests coexist:
-
-```powershell
-dotnet test ... --filter "Trait=Standard"
-dotnet test ... --filter "Trait=DL205"
-```
-
-## What's encoded in each profile
-
-### standard.json
-
-- HR[0..31]: each register's value equals its address. Easy mental map.
-- HR[100]: `"action": "increment"` ticks 0..65535 on every register access — drives subscribe-and-receive tests so they have a register that changes without a write.
-- HR[200..209]: scratch range for write-roundtrip tests.
-- Coils[0..31]: alternating on/off (even=on).
-- Coils[100..109]: scratch.
-- All addresses 0..1023 are writable (`"write": [[0, 1023]]`).
-
-### dl205.json (per `docs/v2/dl205.md`)
-
-| HR address | Quirk demonstrated | Raw value | Decoded |
-|---|---|---|---|
-| `0` (V0) | Register 0 is valid (rejects-register-0 rumour disproved) | `51966` (0xCAFE) | marker |
-| `1024` (V2000 octal) | V-memory octal-to-decimal mapping | `8192` (0x2000) | marker |
-| `8448` (V40400 octal) | V40400 → PDU 0x2100 (NOT register 0) | `16448` (0x4040) | marker |
-| `1040..1042` | String "Hello" packed first-char-low-byte | `25928, 27756, 111` | `"Hello"` |
-| `1056..1057` | Float32 1.5f in CDAB word order | `0, 16320` | `1.5f` |
-| `1072` | Decimal 1234 in BCD encoding | `4660` (0x1234) | `1234` |
-| `1280..1407` | 128-register block (FC03 cap = 128 above spec's 125) | first/last/mid markers; rest defaults to 0 | for FC03 cap test |
-
-| Coil address | Quirk demonstrated |
-|---|---|
-| `2048` | Y0 maps to coil 2048 (DL260 layout) |
-| `3072` | C0 maps to coil 3072 (DL260 layout) |
-| `4000..4007` | Scratch C-relay range for write-roundtrip tests |
-
-The DL260 X-input markers (FC02 discrete inputs) **are not encoded separately**
-because the profile uses `shared blocks: true` (matches DL series memory
-model) — coils/DI/HR/IR overlay the same word address space. Tests that
-target FC02 against this profile end up reading the same bit positions as
-the coils they share with.
-
-## What's IN pymodbus that wasn't in ModbusPal
-
-- **All four standard tables** (HR, IR, coils, DI) configurable via `co size` / `di size` / `hr size` / `ir size` setup keys.
-- **Per-register raw uint16 seeding** — `{"addr": 1040, "value": 25928}` puts exactly that 16-bit value on the wire. No interpretation.
-- **Built-in actions**: `increment`, `random`, `timestamp`, `reset`, `uptime` for declarative dynamic registers. No Python script alongside the config required.
-- **Custom actions** — point `--custom_actions_module` at a `.py` file exposing callables to express anything more complex (per-second wall-clock ticks, BCD synthesis, etc.).
-- **Headless** — pure CLI process, no Java, no Swing. Pip-installable. Plays well with CI runners.
-- **Web UI / REST API** — `--http_port 8080` adds an aiohttp server for live inspection. Optional.
-- **Maintained** — current stable 3.13.0 (April 2026), active development on 4.0 dev branch.
-
-## Trade-offs vs the hand-authored ModbusPal profiles
-
-- pymodbus's built-in `float32` type stores in pymodbus's word order; for explicit DL205 CDAB control we seed two raw `uint16` entries instead. Documented inline in `dl205.json`.
-- `increment` action ticks per-access, not wall-clock. A 250ms-poll integration test sees variation either way; for strict 1Hz cadence add `--custom_actions_module my_actions.py` with a `time.time()`-based callable.
-- `dl205.json` uses `shared blocks: true` because it matches DL series memory model; `standard.json` uses `shared blocks: false` so coils and HR address spaces are independent (more like a textbook PLC).
-
-## File format reference
-
-```json
-{
-  "server_list": {
-    "<server-name>": {
-      "comm": "tcp",
-      "host": "0.0.0.0",
-      "port": 5020,
-      "framer": "socket",
-      "device_id": 1
-    }
-  },
-  "device_list": {
-    "<device-name>": {
-      "setup": {
-        "co size": N, "di size": N, "hr size": N, "ir size": N,
-        "shared blocks": false,
-        "type exception": false,
-        "defaults": { "value": {...}, "action": {...} }
-      },
-      "invalid": [],
-      "write": [[<from>, <to>]],
-      "bits":    [{"addr": N, "value": 0|1}],
-      "uint16":  [{"addr": N, "value": <0..65535>, "action"?: "increment", "parameters"?: {...}}],
-      "uint32":  [{"addr": N, "value": <int>}],
-      "float32": [{"addr": N, "value": <float>}],
-      "string":  [{"addr": N, "value": "<text>"}],
-      "repeat":  []
-    }
-  }
-}
-```
-
-The CLI args `--modbus_server <server-name> --modbus_device <device-name>`
-pick which entries the simulator binds.
-
-## References
-
-- [pymodbus on PyPI](https://pypi.org/project/pymodbus/) — install, version pin
-- [Simulator config docs](https://pymodbus.readthedocs.io/en/dev/source/library/simulator/config.html) — full schema reference
-- [Simulator REST API](https://pymodbus.readthedocs.io/en/latest/source/library/simulator/restapi.html) — for the optional web UI
-- [`docs/v2/dl205.md`](../../../docs/v2/dl205.md) — what each DL205 profile entry simulates
-- [`docs/v2/modbus-test-plan.md`](../../../docs/v2/modbus-test-plan.md) — the `DL205_<behavior>` test naming convention

tests/ZB.MOM.WW.OtOpcUa.Driver.Modbus.IntegrationTests/Pymodbus/serve.ps1

@@ -1,60 +0,0 @@
-<#
-.SYNOPSIS
-    Launches the pymodbus simulator with one of the integration-test profiles
-    (Standard or DL205). Foreground process — Ctrl+C to stop.
-
-.PARAMETER Profile
-    Which simulator profile to run: 'standard' or 'dl205'. Both bind TCP 5020 by
-    default so they can't run simultaneously on the same box.
-
-.PARAMETER HttpPort
-    Port for pymodbus's optional web UI / REST API. Default 8080. Pass 0 to
-    disable (passes --no_http).
-
-.EXAMPLE
-    .\serve.ps1 -Profile standard
-    Starts the standard server on TCP 5020 with web UI on 8080.
-
-.EXAMPLE
-    .\serve.ps1 -Profile dl205 -HttpPort 0
-    Starts the DL205 server on TCP 5020, no web UI.
-#>
-[CmdletBinding()]
-param(
-    [Parameter(Mandatory)] [ValidateSet('standard', 'dl205', 's7_1500', 'mitsubishi')] [string]$Profile,
-    [int]$HttpPort = 8080
-)
-
-$ErrorActionPreference = 'Stop'
-$here = $PSScriptRoot
-
-# Confirm pymodbus.simulator is on PATH — clearer message than the
-# 'CommandNotFoundException' dotnet style.
-$cmd = Get-Command pymodbus.simulator -ErrorAction SilentlyContinue
-if (-not $cmd) {
-    Write-Error "pymodbus.simulator not found. Install with: pip install 'pymodbus[simulator]==3.13.0'"
-    exit 1
-}
-
-$jsonFile = Join-Path $here "$Profile.json"
-if (-not (Test-Path $jsonFile)) {
-    Write-Error "Profile config not found: $jsonFile"
-    exit 1
-}
-
-$args = @(
-    '--modbus_server', 'srv',
-    '--modbus_device', 'dev',
-    '--json_file',     $jsonFile
-)
-
-if ($HttpPort -gt 0) {
-    $args += @('--http_port', $HttpPort)
-    Write-Host "Web UI will be at http://localhost:$HttpPort"
-} else {
-    $args += '--no_http'
-}
-
-Write-Host "Starting pymodbus simulator: profile=$Profile  TCP=localhost:5020"
-Write-Host "Ctrl+C to stop."
-& pymodbus.simulator @args

tests/ZB.MOM.WW.OtOpcUa.Driver.Modbus.IntegrationTests/S7/S7_1500Profile.cs

@@ -2,7 +2,7 @@ namespace ZB.MOM.WW.OtOpcUa.Driver.Modbus.IntegrationTests.S7;
 
 /// <summary>
 ///     Tag map for the Siemens SIMATIC S7-1500 device class with the <c>MB_SERVER</c> library
-///     block mapping HR[0..] to DB1.DBW0+. Mirrors <c>s7_1500.json</c> in <c>Pymodbus/</c>.
+///     block mapping HR[0..] to DB1.DBW0+. Mirrors <c>s7_1500.json</c> in <c>Docker/profiles/</c>.
 /// </summary>
 /// <remarks>
 ///     Unlike DL205, S7 has no fixed Modbus memory map — every site wires MB_SERVER to a

tests/ZB.MOM.WW.OtOpcUa.Driver.Modbus.IntegrationTests/ZB.MOM.WW.OtOpcUa.Driver.Modbus.IntegrationTests.csproj

@@ -24,7 +24,7 @@
     </ItemGroup>
 
     <ItemGroup>
-        <None Update="Pymodbus\**\*" CopyToOutputDirectory="PreserveNewest"/>
+        <None Update="Docker\**\*" CopyToOutputDirectory="PreserveNewest"/>
         <None Update="DL205\**\*" CopyToOutputDirectory="PreserveNewest"/>
         <None Update="S7\**\*" CopyToOutputDirectory="PreserveNewest"/>
         <None Update="Mitsubishi\**\*" CopyToOutputDirectory="PreserveNewest"/>

tests/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.IntegrationTests/Docker/README.md

@@ -0,0 +1,103 @@
+# opc-plc Docker fixture
+
+[Microsoft Industrial IoT's opc-plc](https://github.com/Azure-Samples/iot-edge-opc-plc)
+— pinned Docker image that stands up an OPC UA server at
+`opc.tcp://localhost:50000` with step-up counters, random nodes, alarm
+simulation, and other canonical simulated shapes. Replaces the PowerShell
+launcher pattern used by the Modbus / S7 fixtures — Docker is the launcher
+here since opc-plc ships pre-containerized.
+
+| File | Purpose |
+|---|---|
+| [`docker-compose.yml`](docker-compose.yml) | Service definition for `otopcua-opc-plc` — image pin, port map, command flags. |
+| (this file) | How to run it. |
+
+## Install
+
+Docker Desktop (Windows) or the docker CLI + daemon (Linux/macOS). Per
+`CLAUDE.md` Phase 1 decision #134 the dev box already has Docker Desktop
+configured with the WSL 2 backend — nothing new to install.
+
+## Run
+
+From the repo root:
+
+```powershell
+docker compose -f tests\ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.IntegrationTests\Docker\docker-compose.yml up
+```
+
+Or from this folder:
+
+```powershell
+docker compose up
+```
+
+First run pulls the image (~250 MB). Startup takes ~5-10 seconds; the
+healthcheck in the compose file surfaces ready state in `docker ps`.
+
+To run detached (CI pattern):
+
+```powershell
+docker compose up -d
+```
+
+Stop with `docker compose down` (removes the container) or `docker compose stop`
+(keeps it for fast restart).
+
+## Endpoint
+
+- Default: `opc.tcp://localhost:50000`
+- Override by setting `OPCUA_SIM_ENDPOINT` before `dotnet test` — e.g. point
+  at a real OPC UA server in the lab, or at a different Docker host.
+
+## What opc-plc advertises
+
+Command flags in `docker-compose.yml` enable:
+
+- `--pn=50000` — OPC UA endpoint on port 50000
+- `--ut` — unsecured transport endpoint advertised (SecurityPolicy=None).
+  Secured policies are still on the endpoint list; `--ut` just adds an
+  unsecured option.
+- `--aa` — auto-accept client certs (opc-plc's cert trust store lives
+  inside the container + resets each spin-up, so without this the driver's
+  first contact would be rejected).
+- `--alm` — alarm simulation enabled; opc-plc publishes
+  `TripAlarmType`, `ExclusiveDeviationAlarmType`,
+  `NonExclusiveLevelAlarmType`, and `DialogConditionType` events.
+
+Not turned on (but available via compose-file tweaks):
+
+- `--daa` — disable anonymous auth; forces username or cert tokens. Flip
+  on when username-auth / cert-auth smoke tests land.
+- `--fn` / `--fr` / `--ft` — fast-node variants (100 / 1 000 / 10 000 Hz
+  update rates) for subscription-stress coverage. Not needed for smoke.
+- `--sn` / `--sr` — slow-node / special-shape coverage.
+
+## Run the integration tests
+
+In a separate shell, with the simulator running:
+
+```powershell
+cd C:\Users\dohertj2\Desktop\lmxopcua
+dotnet test tests\ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.IntegrationTests
+```
+
+Tests auto-skip with a clear `SkipReason` when `localhost:50000` isn't
+reachable within 2 seconds (`OpcPlcFixture`).
+
+## Known limitations
+
+opc-plc uses the OPCFoundation.NetStandard stack internally — same as
+our driver. That means bugs common to the stack itself are **not** caught
+by this fixture; the follow-up to add `open62541/open62541` as a second
+independent-stack image (task tracked in #215's follow-ups) would close
+that.
+
+See [`docs/drivers/OpcUaClient-Test-Fixture.md`](../../../docs/drivers/OpcUaClient-Test-Fixture.md)
+for the full coverage map + what's still trusted from field deployments.
+
+## References
+
+- [opc-plc GitHub](https://github.com/Azure-Samples/iot-edge-opc-plc)
+- [mcr.microsoft.com/iotedge/opc-plc tags](https://mcr.microsoft.com/v2/iotedge/opc-plc/tags/list)
+- [`docs/drivers/OpcUaClient-Test-Fixture.md`](../../../docs/drivers/OpcUaClient-Test-Fixture.md)

tests/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.IntegrationTests/Docker/docker-compose.yml

@@ -0,0 +1,45 @@
+# opc-plc — OPC UA PLC simulator from Microsoft Industrial IoT.
+# https://github.com/Azure-Samples/iot-edge-opc-plc
+#
+# Why pinned: MCR tags only go forward; keeping the suite reproducible means
+# we test against a known feature surface. Bump deliberately alongside a
+# driver-side change that needs the newer image.
+services:
+  opc-plc:
+    image: mcr.microsoft.com/iotedge/opc-plc:2.14.10
+    container_name: otopcua-opc-plc
+    restart: "no"
+    ports:
+      - "50000:50000"
+    command:
+      # --pn:  Bind port 50000 (opc-plc default; matches fixture default)
+      # --ut:  Advertise an Unsecured transport endpoint (SecurityPolicy=None).
+      #        Tests that need signed/encrypted endpoints pick those off the
+      #        negotiated endpoint list separately — opc-plc always advertises
+      #        the secure policies even with --ut on.
+      # --aa:  Auto-accept client certs. Tests wouldn't otherwise survive the
+      #        first contact because opc-plc's cert trust store lives inside
+      #        the container + resets each spin-up.
+      # --daa: Disable anonymous auth — forces the driver to go through the
+      #        Anonymous user-token policy negotiation rather than opc-plc's
+      #        "no auth required" short-circuit. Would flip to username/cert
+      #        if we needed that coverage.
+      #        Commented out for first-pass smoke; flip on when the cert-auth
+      #        and username-auth smoke tests land.
+      # --alm: Turn on alarm simulation (TripAlarm / ExclusiveDeviation /
+      #        NonExclusiveLevel / DialogCondition). Closes the IAlarmSource
+      #        gap the OpcUaClient-Test-Fixture doc calls out.
+      - "--pn=50000"
+      - "--ut"
+      - "--aa"
+      - "--alm"
+      # - "--daa"
+    healthcheck:
+      # opc-plc doesn't expose an HTTP health endpoint by default; use a TCP
+      # probe via a shell the base image ships with. The fixture does its own
+      # TCP probe but healthcheck surfaces status in `docker ps` for humans.
+      test: ["CMD-SHELL", "netstat -an | grep -q ':50000.*LISTEN' || exit 1"]
+      interval: 5s
+      timeout: 2s
+      retries: 10
+      start_period: 10s

tests/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.IntegrationTests/OpcPlcFixture.cs

@@ -0,0 +1,97 @@
+using System.Net.Sockets;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.IntegrationTests;
+
+/// <summary>
+///     Reachability probe for an <c>opc-plc</c> simulator (Microsoft Industrial IoT's
+///     OPC UA PLC from <c>mcr.microsoft.com/iotedge/opc-plc</c>) or any real OPC UA
+///     server the <c>OPCUA_SIM_ENDPOINT</c> env var points at. Parses
+///     <c>OPCUA_SIM_ENDPOINT</c> (default <c>opc.tcp://localhost:50000</c>),
+///     TCP-connects to the resolved host:port at collection init, and records a
+///     <see cref="SkipReason"/> on failure. Tests call <c>Assert.Skip</c> on that, so
+///     `dotnet test` stays green when Docker isn't running the simulator — mirrors the
+///     <see cref="ModbusSimulatorFixture"/> / <c>Snap7ServerFixture</c> pattern.
+/// </summary>
+/// <remarks>
+///     <para>
+///         <b>Why opc-plc over loopback against our own server</b> — (1) independent
+///         cert chain + user-token handling catches interop bugs loopback can't;
+///         (2) built-in alarm ConditionType + history simulation gives
+///         <see cref="Core.Abstractions.IAlarmSource"/> +
+///         <see cref="Core.Abstractions.IHistoryProvider"/> coverage without a custom
+///         driver fake; (3) pinned image tag fixes the test surface in a way our own
+///         evolving server wouldn't. Follow-up: add <c>open62541/open62541</c> as a
+///         second image once this lands, for fully-independent-stack interop.
+///     </para>
+///     <para>
+///         Endpoint URL contract: parser strips the <c>opc.tcp://</c> scheme + resolves
+///         host + port for the liveness probe only. The real test session always
+///         dials the full endpoint URL via <see cref="OpcUaClientDriverOptions.EndpointUrl"/>
+///         so cert negotiation + security-policy selection run end-to-end.
+///     </para>
+/// </remarks>
+public sealed class OpcPlcFixture : IAsyncDisposable
+{
+    private const string DefaultEndpoint = "opc.tcp://localhost:50000";
+    private const string EndpointEnvVar = "OPCUA_SIM_ENDPOINT";
+
+    /// <summary>Full <c>opc.tcp://host:port</c> URL the driver session should connect to.</summary>
+    public string EndpointUrl { get; }
+    public string Host { get; }
+    public int Port { get; }
+    public string? SkipReason { get; }
+
+    public OpcPlcFixture()
+    {
+        EndpointUrl = Environment.GetEnvironmentVariable(EndpointEnvVar) ?? DefaultEndpoint;
+
+        (Host, Port) = ParseHostPort(EndpointUrl);
+
+        try
+        {
+            using var client = new TcpClient(AddressFamily.InterNetwork);
+            var task = client.ConnectAsync(
+                System.Net.Dns.GetHostAddresses(Host)
+                    .FirstOrDefault(a => a.AddressFamily == AddressFamily.InterNetwork)
+                    ?? System.Net.IPAddress.Loopback,
+                Port);
+            if (!task.Wait(TimeSpan.FromSeconds(2)) || !client.Connected)
+            {
+                SkipReason = $"opc-plc simulator at {Host}:{Port} did not accept a TCP connection within 2s. " +
+                             $"Start it (`docker compose -f Docker/docker-compose.yml up`) or override {EndpointEnvVar}.";
+            }
+        }
+        catch (Exception ex)
+        {
+            SkipReason = $"opc-plc simulator at {Host}:{Port} unreachable: {ex.GetType().Name}: {ex.Message}. " +
+                         $"Start it (`docker compose -f Docker/docker-compose.yml up`) or override {EndpointEnvVar}.";
+        }
+    }
+
+    /// <summary>
+    ///     Parse "opc.tcp://host:port[/path]" → (host, port). Defaults to port 4840
+    ///     (OPC UA standard) when the URL omits the port, but opc-plc's default is
+    ///     50000 so DefaultEndpoint carries it explicitly.
+    /// </summary>
+    private static (string Host, int Port) ParseHostPort(string endpointUrl)
+    {
+        const string scheme = "opc.tcp://";
+        var body = endpointUrl.StartsWith(scheme, StringComparison.OrdinalIgnoreCase)
+            ? endpointUrl[scheme.Length..]
+            : endpointUrl;
+        var slash = body.IndexOf('/');
+        if (slash >= 0) body = body[..slash];
+        var colon = body.IndexOf(':');
+        if (colon < 0) return (body, 4840);
+        var host = body[..colon];
+        return int.TryParse(body[(colon + 1)..], out var p) ? (host, p) : (host, 4840);
+    }
+
+    public ValueTask DisposeAsync() => ValueTask.CompletedTask;
+}
+
+[Xunit.CollectionDefinition(Name)]
+public sealed class OpcPlcCollection : Xunit.ICollectionFixture<OpcPlcFixture>
+{
+    public const string Name = "OpcPlc";
+}

tests/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.IntegrationTests/OpcPlcProfile.cs

@@ -0,0 +1,38 @@
+using ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.IntegrationTests;
+
+/// <summary>
+///     Driver-side configuration + well-known opc-plc node identifiers that the smoke
+///     tests address. Node IDs are stable across opc-plc releases — the simulator
+///     guarantees the same <c>ns=3;s=...</c> names shipped since v1.0. If a release
+///     bump breaks these, the fixture's pinned image tag needs a coordinated bump.
+/// </summary>
+public static class OpcPlcProfile
+{
+    /// <summary>opc-plc monotonically-increasing UInt32; ticks once per second under default opts.</summary>
+    public const string StepUp = "ns=3;s=StepUp";
+
+    /// <summary>opc-plc random Int32 node; new value ~every 100ms.</summary>
+    public const string RandomSignedInt32 = "ns=3;s=RandomSignedInt32";
+
+    /// <summary>opc-plc alternating boolean; flips every second.</summary>
+    public const string AlternatingBoolean = "ns=3;s=AlternatingBoolean";
+
+    /// <summary>opc-plc fast uint node — ticks every 100ms. Used for subscription-cadence tests.</summary>
+    public const string FastUInt1 = "ns=3;s=FastUInt1";
+
+    public static OpcUaClientDriverOptions BuildOptions(string endpointUrl) => new()
+    {
+        EndpointUrl = endpointUrl,
+        SecurityPolicy = OpcUaSecurityPolicy.None,
+        SecurityMode = OpcUaSecurityMode.None,
+        AuthType = OpcUaAuthType.Anonymous,
+        // opc-plc auto-accepts client certs (--aa) but we still present one; trust the
+        // server's cert back since the simulator regenerates it each container spin-up
+        // and there's no meaningful chain to validate against.
+        AutoAcceptCertificates = true,
+        Timeout = TimeSpan.FromSeconds(10),
+        SessionTimeout = TimeSpan.FromSeconds(30),
+    };
+}

tests/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.IntegrationTests/OpcUaClientSmokeTests.cs

@@ -0,0 +1,92 @@
+using Shouldly;
+using Xunit;
+using ZB.MOM.WW.OtOpcUa.Core.Abstractions;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.IntegrationTests;
+
+/// <summary>
+///     End-to-end smoke against a live <c>opc-plc</c> (task #215). Drives the real
+///     OPC UA Secure Channel + Session + MonitoredItem exchange — no mocks. Every
+///     test here proves a capability surface that loopback against our own server
+///     couldn't exercise cleanly: real cert negotiation, real endpoint descriptions,
+///     real simulated nodes that change without a write.
+/// </summary>
+[Collection(OpcPlcCollection.Name)]
+[Trait("Category", "Integration")]
+[Trait("Simulator", "opc-plc")]
+public sealed class OpcUaClientSmokeTests(OpcPlcFixture sim)
+{
+    [Fact]
+    public async Task Client_connects_and_reads_StepUp_node_through_real_OPC_UA_stack()
+    {
+        if (sim.SkipReason is not null) Assert.Skip(sim.SkipReason);
+
+        var options = OpcPlcProfile.BuildOptions(sim.EndpointUrl);
+        await using var drv = new OpcUaClientDriver(options, driverInstanceId: "opcua-smoke-read");
+        await drv.InitializeAsync("{}", TestContext.Current.CancellationToken);
+
+        var snapshots = await drv.ReadAsync(
+            [OpcPlcProfile.StepUp], TestContext.Current.CancellationToken);
+
+        snapshots.Count.ShouldBe(1);
+        snapshots[0].StatusCode.ShouldBe(0u, "opc-plc StepUp read must succeed end-to-end");
+        snapshots[0].Value.ShouldNotBeNull("StepUp always has a current value");
+    }
+
+    [Fact]
+    public async Task Client_reads_batch_of_varied_types_from_live_simulator()
+    {
+        if (sim.SkipReason is not null) Assert.Skip(sim.SkipReason);
+
+        var options = OpcPlcProfile.BuildOptions(sim.EndpointUrl);
+        await using var drv = new OpcUaClientDriver(options, driverInstanceId: "opcua-smoke-batch");
+        await drv.InitializeAsync("{}", TestContext.Current.CancellationToken);
+
+        var snapshots = await drv.ReadAsync(
+            [OpcPlcProfile.StepUp, OpcPlcProfile.RandomSignedInt32, OpcPlcProfile.AlternatingBoolean],
+            TestContext.Current.CancellationToken);
+
+        snapshots.Count.ShouldBe(3);
+        foreach (var s in snapshots)
+        {
+            s.StatusCode.ShouldBe(0u);
+            s.Value.ShouldNotBeNull();
+        }
+        // AlternatingBoolean should decode as a bool specifically — catches a common
+        // attribute-mapping regression where the driver stringifies variant values.
+        snapshots[2].Value.ShouldBeOfType<bool>();
+    }
+
+    [Fact]
+    public async Task Client_subscribe_receives_StepUp_data_changes_from_live_server()
+    {
+        if (sim.SkipReason is not null) Assert.Skip(sim.SkipReason);
+
+        var options = OpcPlcProfile.BuildOptions(sim.EndpointUrl);
+        await using var drv = new OpcUaClientDriver(options, driverInstanceId: "opcua-smoke-sub");
+        await drv.InitializeAsync("{}", TestContext.Current.CancellationToken);
+
+        var observed = new List<DataChangeEventArgs>();
+        var gate = new SemaphoreSlim(0);
+        drv.OnDataChange += (_, e) =>
+        {
+            lock (observed) observed.Add(e);
+            gate.Release();
+        };
+
+        var handle = await drv.SubscribeAsync(
+            [OpcPlcProfile.FastUInt1], TimeSpan.FromMilliseconds(250),
+            TestContext.Current.CancellationToken);
+
+        // FastUInt1 ticks every 100 ms — one publishing interval (250 ms) should deliver.
+        // Wait up to 3 s to tolerate container warm-up + first-publish delay.
+        var got = await gate.WaitAsync(TimeSpan.FromSeconds(3), TestContext.Current.CancellationToken);
+        got.ShouldBeTrue("opc-plc FastUInt1 must publish at least one data change within 3s");
+
+        int observedCount;
+        lock (observed) observedCount = observed.Count;
+        observedCount.ShouldBeGreaterThan(0);
+
+        await drv.UnsubscribeAsync(handle, TestContext.Current.CancellationToken);
+    }
+}

tests/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.IntegrationTests/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.IntegrationTests.csproj

@@ -0,0 +1,35 @@
+<Project Sdk="Microsoft.NET.Sdk">
+
+    <PropertyGroup>
+        <TargetFramework>net10.0</TargetFramework>
+        <Nullable>enable</Nullable>
+        <ImplicitUsings>enable</ImplicitUsings>
+        <IsPackable>false</IsPackable>
+        <IsTestProject>true</IsTestProject>
+        <RootNamespace>ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.IntegrationTests</RootNamespace>
+    </PropertyGroup>
+
+    <ItemGroup>
+        <PackageReference Include="xunit.v3" Version="1.1.0"/>
+        <PackageReference Include="Shouldly" Version="4.3.0"/>
+        <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.12.0"/>
+        <PackageReference Include="xunit.runner.visualstudio" Version="3.0.2">
+            <PrivateAssets>all</PrivateAssets>
+            <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
+        </PackageReference>
+    </ItemGroup>
+
+    <ItemGroup>
+        <ProjectReference Include="..\..\src\ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient\ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.csproj"/>
+    </ItemGroup>
+
+    <ItemGroup>
+        <None Update="Docker\**\*" CopyToOutputDirectory="PreserveNewest"/>
+    </ItemGroup>
+
+    <ItemGroup>
+        <NuGetAuditSuppress Include="https://github.com/advisories/GHSA-37gx-xxp4-5rgx"/>
+        <NuGetAuditSuppress Include="https://github.com/advisories/GHSA-w3x6-4m5h-cxqf"/>
+    </ItemGroup>
+
+</Project>

tests/ZB.MOM.WW.OtOpcUa.Driver.S7.IntegrationTests/Docker/Dockerfile

@@ -0,0 +1,24 @@
+# python-snap7 S7 server container for the S7 integration suite.
+#
+# python-snap7 wraps the upstream snap7 C library; the pip install pulls
+# platform-specific binaries automatically on Debian-based images. No build
+# step needed — unlike ab_server which needs compiling from source.
+FROM python:3.12-slim-bookworm
+
+LABEL org.opencontainers.image.source="https://github.com/dohertj2/lmxopcua" \
+      org.opencontainers.image.description="python-snap7 S7 simulator for OtOpcUa S7 driver integration tests"
+
+RUN pip install --no-cache-dir "python-snap7>=2.0"
+
+WORKDIR /fixtures
+
+# server.py is the Python shim that loads a JSON profile + starts the
+# snap7.server.Server; profiles/ carries the seed definitions.
+COPY server.py /fixtures/
+COPY profiles/ /fixtures/
+
+EXPOSE 1102
+
+# -u for unbuffered stdout so `docker logs` tails the "seeded DB…"
+# diagnostics without a buffer-flush delay.
+CMD ["python", "-u", "/fixtures/server.py", "/fixtures/s7_1500.json", "--port", "1102"]

tests/ZB.MOM.WW.OtOpcUa.Driver.S7.IntegrationTests/Docker/README.md

@@ -0,0 +1,92 @@
+# S7 integration-test fixture — python-snap7
+
+[python-snap7](https://github.com/gijzelaerr/python-snap7) `Server` class
+wrapped in a pinned `python:3.12-slim-bookworm` image. Docker is the
+only supported launch path — a fresh clone needs Docker Desktop and
+nothing else.
+
+| File | Purpose |
+|---|---|
+| [`Dockerfile`](Dockerfile) | `python:3.12-slim-bookworm` + `python-snap7>=2.0` + the server shim + the profile JSONs |
+| [`docker-compose.yml`](docker-compose.yml) | One service per profile; currently only `s7_1500` |
+| [`server.py`](server.py) | Same Python shim the native fallback uses — copy kept in the build context |
+| [`profiles/*.json`](profiles/) | Area-seed definitions (DB1 / MB layouts with typed seeds) |
+
+## Run
+
+From the repo root:
+
+```powershell
+docker compose -f tests\ZB.MOM.WW.OtOpcUa.Driver.S7.IntegrationTests\Docker\docker-compose.yml --profile s7_1500 up
+```
+
+Detached + stop:
+
+```powershell
+docker compose -f tests\...\Docker\docker-compose.yml --profile s7_1500 up -d
+docker compose -f tests\...\Docker\docker-compose.yml --profile s7_1500 down
+```
+
+## Endpoint
+
+- Default: `localhost:1102` (non-privileged; sidesteps Windows Firewall
+  prompt + Linux's root-required bind on port 102).
+- Override with `S7_SIM_ENDPOINT` to point at a real S7 CPU on `:102`.
+- The driver's S7DriverOptions.Port flows through S7netplus's 5-arg
+  `Plc(CpuType, host, port, rack, slot)` ctor so the non-standard port
+  works end-to-end.
+
+## Run the integration tests
+
+In a separate shell with the container up:
+
+```powershell
+cd C:\Users\dohertj2\Desktop\lmxopcua
+dotnet test tests\ZB.MOM.WW.OtOpcUa.Driver.S7.IntegrationTests
+```
+
+`Snap7ServerFixture` probes `localhost:1102` at collection init + records
+a `SkipReason` when unreachable, so tests stay green on a fresh clone
+without Docker running.
+
+## What's encoded in `profiles/s7_1500.json`
+
+DB1 (1024 bytes) + MB (256 bytes) with typed seeds at known offsets:
+
+| Address | Type | Seed | Purpose |
+|---|---|---|---|
+| `DB1.DBW0` | u16 | `4242` | read-back probe |
+| `DB1.DBW10` | i16 | `-12345` | smoke i16 read |
+| `DB1.DBD20` | i32 | `1234567890` | smoke i32 read |
+| `DB1.DBD30` | f32 | `3.14159` | smoke f32 read (big-endian) |
+| `DB1.DBX50.3` | bool | `true` | smoke bool read at bit 3 |
+| `DB1.DBW100` | u16 | `0` | scratch for write-then-read |
+| `DB1.STRING[200]` | S7 STRING | `"Hello"` | S7 STRING read |
+| `MW0` | u16 | `1` | `S7ProbeOptions.ProbeAddress` default |
+
+Seed types supported: `u8`, `i8`, `u16`, `i16`, `u32`, `i32`, `f32`,
+`bool` (with `"bit": 0..7`), `ascii` (S7 STRING).
+
+## Known limitations
+
+From the `snap7.server.Server` docstring upstream:
+
+> "Legacy S7 server implementation. Emulates a Siemens S7 PLC for testing
+> and development purposes. [...] pure Python emulator implementation that
+> simulates PLC behaviour for protocol compliance testing rather than
+> full industrial-grade functionality."
+
+Not exercised here — needs a lab rig:
+
+- S7-1500 Optimized-DB symbolic access
+- PG / OP / S7-Basic session-type differentiation
+- PUT/GET-disabled-by-default enforcement
+
+See [`docs/drivers/S7-Test-Fixture.md`](../../../docs/drivers/S7-Test-Fixture.md)
+for the full coverage map.
+
+## References
+
+- [python-snap7 GitHub](https://github.com/gijzelaerr/python-snap7)
+- [`docs/drivers/S7-Test-Fixture.md`](../../../docs/drivers/S7-Test-Fixture.md) — coverage map
+- [`docs/v2/dev-environment.md`](../../../docs/v2/dev-environment.md) §Docker fixtures

tests/ZB.MOM.WW.OtOpcUa.Driver.S7.IntegrationTests/Docker/docker-compose.yml

@@ -0,0 +1,20 @@
+# S7 integration-test fixture — python-snap7 server.
+#
+# One service per profile (only s7_1500 ships today; add S7-1200 / S7-300
+# as new profile JSONs drop into profiles/). All bind :1102 on the host;
+# run one at a time.
+#
+# Usage:
+#   docker compose --profile s7_1500 up
+services:
+  s7_1500:
+    profiles: ["s7_1500"]
+    build:
+      context: .
+      dockerfile: Dockerfile
+    image: otopcua-python-snap7:1.0
+    container_name: otopcua-python-snap7-s7_1500
+    restart: "no"
+    ports:
+      - "1102:1102"
+    command: ["python", "-u", "/fixtures/server.py", "/fixtures/s7_1500.json", "--port", "1102"]