refactor(modbus-rtu): distinct CrcMismatch/UnitMismatch desync reasons

The RTU framer overloaded DesyncReason.TruncatedFrame for three distinct failures — a genuine short read, a CRC-16 validation failure, and a CRC-valid reply from the wrong RS-485 slave. Split the latter two into dedicated CrcMismatch / UnitMismatch enum members so a future .Reason consumer (metrics, operator diagnostics) can tell a wiring/EMI CRC fault apart from a mis-addressed multi-drop reply. Behaviour is unchanged — all three still throw ModbusTransportDesyncException and tear the socket down. Framing tests now assert the specific Reason on each path. Follow-up #12 from the Modbus RTU-over-TCP plan. Claude-Session: https://claude.ai/code/session_01GASWkNEi68FSCtvr6rLoEW
docs(modbus-rtu): record Wave-1 RTU-over-TCP live /run gate result (PASSED)
2026-07-25 15:13:48 -04:00 · 2026-07-24 15:50:10 -04:00 · 2026-07-24 15:33:49 -04:00 · 2026-07-24 14:36:00 -04:00 · 2026-07-24 14:29:10 -04:00 · 2026-07-24 14:19:15 -04:00
141 changed files with 1730 additions and 15402 deletions
@@ -77,10 +77,6 @@
    <PackageVersion Include="Moq" Version="4.20.72" />
    <PackageVersion Include="Novell.Directory.Ldap.NETStandard" Version="3.6.0" />
    <PackageVersion Include="OPCFoundation.NetStandard.Opc.Ua.Client" Version="1.5.378.106" />
-    <!-- Core carries Opc.Ua.StatusCodes, the oracle StatusCodeParityTests checks the drivers'
-         hard-coded uint constants against. Referenced by that TEST project only — the drivers
-         themselves stay SDK-free by design and keep spelling status codes as bare uints. -->
-    <PackageVersion Include="OPCFoundation.NetStandard.Opc.Ua.Core" Version="1.5.378.106" />
    <PackageVersion Include="OPCFoundation.NetStandard.Opc.Ua.Configuration" Version="1.5.378.106" />
    <PackageVersion Include="OPCFoundation.NetStandard.Opc.Ua.Server" Version="1.5.378.106" />
    <!-- OpenTelemetry.Api < 1.15.3 has GHSA-g94r-2vxg-569j (header-parsing memory DoS). The trio
@@ -29,9 +29,6 @@
    <Project Path="src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Modbus/ZB.MOM.WW.OtOpcUa.Driver.Modbus.csproj" />
    <Project Path="src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Modbus.Addressing/ZB.MOM.WW.OtOpcUa.Driver.Modbus.Addressing.csproj" />
    <Project Path="src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Modbus.Contracts/ZB.MOM.WW.OtOpcUa.Driver.Modbus.Contracts.csproj" />
-    <Project Path="src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Sql/ZB.MOM.WW.OtOpcUa.Driver.Sql.csproj" />
-    <Project Path="src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Sql.Browser/ZB.MOM.WW.OtOpcUa.Driver.Sql.Browser.csproj" />
-    <Project Path="src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Sql.Contracts/ZB.MOM.WW.OtOpcUa.Driver.Sql.Contracts.csproj" />
    <Project Path="src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.S7/ZB.MOM.WW.OtOpcUa.Driver.S7.csproj" />
    <Project Path="src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.S7.Contracts/ZB.MOM.WW.OtOpcUa.Driver.S7.Contracts.csproj" />
    <Project Path="src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.AbCip/ZB.MOM.WW.OtOpcUa.Driver.AbCip.csproj" />
@@ -93,9 +90,6 @@
    <Project Path="tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Modbus.Tests/ZB.MOM.WW.OtOpcUa.Driver.Modbus.Tests.csproj" />
    <Project Path="tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Modbus.Addressing.Tests/ZB.MOM.WW.OtOpcUa.Driver.Modbus.Addressing.Tests.csproj" />
    <Project Path="tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Modbus.IntegrationTests/ZB.MOM.WW.OtOpcUa.Driver.Modbus.IntegrationTests.csproj" />
-    <Project Path="tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Sql.Tests/ZB.MOM.WW.OtOpcUa.Driver.Sql.Tests.csproj" />
-    <Project Path="tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Sql.Browser.Tests/ZB.MOM.WW.OtOpcUa.Driver.Sql.Browser.Tests.csproj" />
-    <Project Path="tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Sql.IntegrationTests/ZB.MOM.WW.OtOpcUa.Driver.Sql.IntegrationTests.csproj" />
    <Project Path="tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.S7.Tests/ZB.MOM.WW.OtOpcUa.Driver.S7.Tests.csproj" />
    <Project Path="tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.S7.IntegrationTests/ZB.MOM.WW.OtOpcUa.Driver.S7.IntegrationTests.csproj" />
    <Project Path="tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.AbCip.Tests/ZB.MOM.WW.OtOpcUa.Driver.AbCip.Tests.csproj" />
@@ -272,12 +272,6 @@ services:
      OTOPCUA_ROLES: "admin,driver,cluster-MAIN"
      ASPNETCORE_URLS: "http://+:9000"
      ConnectionStrings__ConfigDb: "Server=sql,1433;Database=OtOpcUa;User Id=sa;Password=OtOpcUa!Dev123;TrustServerCertificate=True;"
-      # Sql poll driver — the named connection string a Sql driver instance references by
-      # `connectionStringRef: "DevSql"`. Resolved in-process by SqlConnectionStringResolver (driver
-      # node) and SqlDriverBrowser (AdminUI browse), env-only, never persisted to ConfigDb. Points at
-      # the rig's own `sql` container, a SEPARATE `DevSql` database seeded with dbo.TagValues (KeyValue)
-      # + dbo.LatestStatus (WideRow). Committed-dev-secret exception, same as ConfigDb above.
-      Sql__ConnectionStrings__DevSql: "Server=sql,1433;Database=DevSql;User Id=sa;Password=OtOpcUa!Dev123;TrustServerCertificate=True;"
      Cluster__Hostname: "0.0.0.0"
      Cluster__Port: "4053"
      Cluster__PublicHostname: "central-1"
@@ -397,12 +391,6 @@ services:
      OTOPCUA_ROLES: "admin,driver,cluster-MAIN"
      ASPNETCORE_URLS: "http://+:9000"
      ConnectionStrings__ConfigDb: "Server=sql,1433;Database=OtOpcUa;User Id=sa;Password=OtOpcUa!Dev123;TrustServerCertificate=True;"
-      # Sql poll driver — the named connection string a Sql driver instance references by
-      # `connectionStringRef: "DevSql"`. Resolved in-process by SqlConnectionStringResolver (driver
-      # node) and SqlDriverBrowser (AdminUI browse), env-only, never persisted to ConfigDb. Points at
-      # the rig's own `sql` container, a SEPARATE `DevSql` database seeded with dbo.TagValues (KeyValue)
-      # + dbo.LatestStatus (WideRow). Committed-dev-secret exception, same as ConfigDb above.
-      Sql__ConnectionStrings__DevSql: "Server=sql,1433;Database=DevSql;User Id=sa;Password=OtOpcUa!Dev123;TrustServerCertificate=True;"
      Cluster__Hostname: "0.0.0.0"
      Cluster__Port: "4053"
      Cluster__PublicHostname: "central-2"
@@ -102,45 +102,6 @@ Persisted scope per plan decision #14: `Enabled`, `Acked`, `Confirmed`, `Shelvin

 Every mutation the state machine produces is immediately persisted inside the engine's `_evalGate` semaphore, so the store's view is always consistent with the in-memory state.

-### Post-(re)load condition-node re-assert (#487)
-
-A deploy that triggers a **full address-space rebuild** clears `_alarmConditions` and re-materialises every
-condition node fresh — inactive, acked, confirmed, unshelved. The engine, reloading in parallel, restores each
-alarm's persisted state and re-derives `Active` from the predicate, so it ends up *correct*; but a still-active
-alarm has **no transition to report**, so `LoadAsync` yields `EmissionKind.None` and `OnEngineEmission` drops it.
-Nothing then writes the node. Before this fix, an active alarm with static dependencies read **normal** to every
-OPC UA client after such a deploy, until its next real transition — which for a static-dependency alarm may
-never come.
-
-`ScriptedAlarmHostActor.ReassertConditionNodes` closes it. After each load completes it reads
-`ScriptedAlarmEngine.GetProjections()` — a plain read returning `ScriptedAlarmProjection` (condition state +
-the definition's severity + the resolved message template + last-observed worst-input quality) — and sends one
-`OpcUaPublishActor.AlarmStateUpdate` per alarm that is **not** in the Part 9 no-event position.
-
-Four properties are load-bearing:
-
- **Node-only.** It sends `AlarmStateUpdate` and nothing else — never the `alerts` topic, never the telemetry
-  hub. `alerts` is the historization path, so an alerts row per alarm per deploy would append a duplicate
-  historian / AVEVA record every time anyone deploys. This is why the re-assert reads a projection instead of
-  re-emitting: `ScriptedAlarmProjection` carries no `EmissionKind`, so there is nothing for the emission
-  machinery — or a future refactor — to mistake for a transition.
- **Only non-normal alarms.** An alarm in the no-event position (enabled, inactive, acked, confirmed,
-  unshelved) already matches what the materialise built, so it is skipped. That keeps a never-fired alarm
-  byte-identical to a deploy without this pass — including its Message, which the materialise seeds with the
-  alarm's display name — and writes nothing at all on the common all-normal deploy.
- **Ordering.** `DriverHostActor` tells `RebuildAddressSpace` to the publish actor *before* it tells
-  `ApplyScriptedAlarms` to the host, and the re-assert runs later still (after an awaited `LoadAsync` pipes
-  back). Both are local `Tell`s, which enqueue synchronously, so the re-materialise is already queued ahead of
-  these writes.
- **No duplicate Part 9 events.** `WriteAlarmCondition`'s delta-gate compares the incoming snapshot against
-  the node's *current* state: a re-assert onto a freshly materialised (normal) node is a genuine delta and
-  fires exactly one condition event — correct, since the rebuild reset what clients see — while a re-assert
-  onto a surgically-preserved node that already holds the same state is suppressed. The write is ungated by
-  redundancy role, like every other node write here; the Secondary keeps its address space warm for failover.
-
-The timestamp carried is the condition's own `LastTransitionUtc`, **not** the deploy instant, so a client
-reading `Time` / `ReceiveTime` after a rebuild still sees when the alarm actually went active.
-
 ## Source integration

 `ScriptedAlarmSource` (`ScriptedAlarmSource.cs`) adapts the engine to the driver-agnostic `IAlarmSource` interface. The existing `AlarmSurfaceInvoker` + `GenericDriverNodeManager` fan-out consumes it the same way it consumes Galaxy / AB CIP / FOCAS sources — there is no scripted-alarm-specific code path in the server plumbing. From that point on, the flow into `AlarmConditionState` nodes, the `AlarmAck` session check, and the Historian sink is shared — see [AlarmTracking.md](AlarmTracking.md).
@@ -271,7 +271,7 @@ public sealed class GatewayQualityMapperTests
 {
    [Theory]
    [InlineData(192, 0x00000000u)] // Good
-    [InlineData(216, 0x00960000u)] // Good_LocalOverride
+    [InlineData(216, 0x00D80000u)] // Good_LocalOverride
    [InlineData(64,  0x40000000u)] // Uncertain
    [InlineData(0,   0x80000000u)] // Bad
    [InlineData(8,   0x808A0000u)] // Bad_NotConnected
@@ -307,7 +307,7 @@ public sealed class SampleMapperTests
    {
        var a = new HistorianAggregateSample { Tag = "T", /* Value unset */ EndTime = Ts(2026,1,1,0,0,0) };
        var snap = SampleMapper.ToAggregateSnapshot(a);
-        Assert.Equal(0x809B0000u, snap.StatusCode); // BadNoData
+        Assert.Equal(0x800E0000u, snap.StatusCode); // BadNoData
        Assert.Null(snap.Value);
    }
    // Ts(...) builds a Google.Protobuf.WellKnownTypes.Timestamp from UTC parts.
@@ -323,7 +323,7 @@ public sealed class SampleMapperTests
  - `StatusCode`: `GatewayQualityMapper.Map((byte)s.OpcQuality)` (prefer `opc_quality`; if zero/unset and `quality` carries the OPC-DA byte, fall back to `quality` — match whatever the gateway populates; document the choice).
  - `SourceTimestampUtc`: `s.Timestamp.ToDateTime()` (UTC kind).
  - `ServerTimestampUtc`: `DateTime.UtcNow`.
- `SampleMapper.ToAggregateSnapshot(HistorianAggregateSample)` → null aggregate value ⇒ `StatusCode 0x809B0000` (BadNoData), non-null ⇒ Good (`0x00000000`) with the value; `SourceTimestampUtc` ← the bucket end/start timestamp (match the Wonderware `ToAggregateSnapshots` convention — it stamps the bucket timestamp). Provide `IReadOnlyList<>` batch helpers too.
+- `SampleMapper.ToAggregateSnapshot(HistorianAggregateSample)` → null aggregate value ⇒ `StatusCode 0x800E0000` (BadNoData), non-null ⇒ Good (`0x00000000`) with the value; `SourceTimestampUtc` ← the bucket end/start timestamp (match the Wonderware `ToAggregateSnapshots` convention — it stamps the bucket timestamp). Provide `IReadOnlyList<>` batch helpers too.

 **Step 4: run, expect PASS.**

@@ -98,7 +98,7 @@ Pure function in `.Contracts` (shared by driver, browser-commit, and the typed e
 | `EVENT` free text (`Program`, `Block`, `Message`) | `String` |
 | `CONDITION` | `String` (state word; §3.6) |

-**Quality mapping (`DataValueSnapshot.StatusCode`):** an observation value of `UNAVAILABLE` (MTConnect's explicit no-data sentinel) → **`BadNoCommunication` (`0x80310000u`)** with a null value, not the literal string — this is *the* UNAVAILABLE code, used everywhere in this design (read, subscribe, and the §8 fixtures). Rationale + fleet fit: semantically, `UNAVAILABLE` means the Agent is reachable but has no device-backed value (the adapter↔device link is down or the item has never reported) — exactly OPC UA's `BadNoCommunication` ("communication to the data source has failed"). The fleet grep shows no competing convention for this case: every existing driver's `BadCommunicationError` (`0x80050000u`, Modbus/FOCAS/TwinCAT/OpcUaClient/S7/AbCip/AbLegacy/Galaxy) marks the **driver's own transport failure** to its peer — a different failure (and the code this driver also uses when the *Agent* HTTP call fails, per §7) — while `BadNoData` (`0x809B0000u`) is historian-domain only (`Historian.Gateway/Mapping/SampleMapper.cs`). `BadNoCommunication` is already in the CLI's `SnapshotFormatter` name table (`src/Drivers/Cli/ZB.MOM.WW.OtOpcUa.Driver.Cli.Common/SnapshotFormatter.cs`), so it renders by name, not hex. Declare it as a `private const uint` in `MTConnectDriver` (the Modbus `StatusBadCommunicationError` pattern). Missing dataItem / empty condition → `Bad`. `observation.timestamp` → `SourceTimestamp` (not a separate node).
+**Quality mapping (`DataValueSnapshot.StatusCode`):** an observation value of `UNAVAILABLE` (MTConnect's explicit no-data sentinel) → **`BadNoCommunication` (`0x80310000u`)** with a null value, not the literal string — this is *the* UNAVAILABLE code, used everywhere in this design (read, subscribe, and the §8 fixtures). Rationale + fleet fit: semantically, `UNAVAILABLE` means the Agent is reachable but has no device-backed value (the adapter↔device link is down or the item has never reported) — exactly OPC UA's `BadNoCommunication` ("communication to the data source has failed"). The fleet grep shows no competing convention for this case: every existing driver's `BadCommunicationError` (`0x80050000u`, Modbus/FOCAS/TwinCAT/OpcUaClient/S7/AbCip/AbLegacy/Galaxy) marks the **driver's own transport failure** to its peer — a different failure (and the code this driver also uses when the *Agent* HTTP call fails, per §7) — while `BadNoData` (`0x800E0000u`) is historian-domain only (`Historian.Gateway/Mapping/SampleMapper.cs`). `BadNoCommunication` is already in the CLI's `SnapshotFormatter` name table (`src/Drivers/Cli/ZB.MOM.WW.OtOpcUa.Driver.Cli.Common/SnapshotFormatter.cs`), so it renders by name, not hex. Declare it as a `private const uint` in `MTConnectDriver` (the Modbus `StatusBadCommunicationError` pattern). Missing dataItem / empty condition → `Bad`. `observation.timestamp` → `SourceTimestamp` (not a separate node).

 ### 3.4 `IReadable` — `/current`

@@ -588,40 +588,6 @@ SQL Server client works cross-platform, so `Sql` runs on macOS dev too (unlike G
  `dialect.QuoteIdentifier` (which escapes/rejects embedded quote characters). A table/column string
  in a `TagConfig` is validated against the live catalog (or an allow-list) before it's ever quoted
  into text; an unknown identifier rejects the tag (→ `BadNodeIdUnknown`) rather than executing.
-
-  **Implemented (Gitea #496).** `SqlCatalogGate` + `SqlCatalogLoader`, run from
-  `SqlDriver.InitializeAsync` after the liveness check and before the driver reports Healthy. Shape,
-  and the decisions worth knowing before touching it:
-
-  - **The catalog's spelling is substituted, not merely checked.** An accepted identifier is rewritten
-    to the string the catalog returned, so the text quoted into a poll query is one this driver read
-    back out of `ListSchemas`/`ListTables`/`ListColumns` — not operator input. Matching is
-    exact-ordinal first, then a *unique* case-insensitive hit (SQL Server's default collation is CI, so
-    case variants have always worked and rejecting them would break valid configs); an ambiguous CI
-    match under a case-sensitive collation is refused rather than guessed, because picking one would
-    publish another column's data under the operator's node.
-  - **Charset check first, catalog lookup second.** Each identifier goes through `QuoteIdentifier` for
-    its rejection rules *before* being looked up, so a name carrying a control or Unicode format
-    character is rejected **without its value being echoed** into a log line (Trojan-Source). A name
-    that passes is safe to render, which is why catalog-miss messages *do* name it — an operator
-    hunting a typo has to see what they wrote.
-  - **Rejection is per-tag and keeps the node.** The rejected tag is dropped from the *polled* table
-    but stays in the *authored* table, so it still materializes as a node and reads
-    `BadNodeIdUnknown` (§8.1's specified outcome) instead of vanishing from the address space. Every
-    drop is logged at Warning with the tag, the field and the reason.
-  - **A catalog that cannot be read faults Initialize; it does not reject every tag.** An unreadable
-    catalog is the *absence* of evidence about the tags, not evidence against them — rejecting all of
-    them would serve a confidently-empty address space and send the operator hunting typos that do not
-    exist. Zero visible schemas is treated the same way, because that is what a missing GRANT looks
-    like. Faulting lands `DriverInstanceActor` in Reconnecting with its retry timer running.
-  - **Bounded load:** one schema-list query, one default-schema scalar (`ISqlDialect.DefaultSchemaSql`,
-    added for this — an unqualified `TagValues` must resolve in whatever schema the *server* says, not
-    a guessed `dbo`), then one `ListTables` per distinct authored schema and one `ListColumns` per
-    distinct authored relation. It never enumerates the whole catalog, and the load runs under the same
-    wall-clock bound as the liveness check (R2-01 / STAB-14).
-  - **Accepted v1 limitation:** a 3-part `db.schema.table` (or a linked-server name) addresses a
-    catalog this connection cannot enumerate, so it cannot be allow-listed and is rejected with a
-    message pointing at the fix — expose the data through a view in the connected database.
 - **Treat any code path that builds SQL by string-concatenating a tag field as a defect** — enforce
  with a review checklist item + a unit test that feeds a malicious `keyValue`/`table`
  (`'; DROP TABLE …`) and asserts it either binds harmlessly (value) or is rejected (identifier),
@@ -641,15 +607,8 @@ comment) and the env-overridable ConfigDb connection string:
  file. Direct env read (not `IConfiguration`) is deliberate: the factory registry materializes
  drivers via a static `(id, json)` closure (Modbus pattern) with no `IConfiguration` in reach, so
  this keeps the factory shape unchanged.
- **An inline `connectionString` is not permitted at all** — the earlier "dev convenience, redacted in
-  the UI" carve-out is withdrawn (Gitea #498). Redaction only hides a credential that has *already been
-  written* to the config DB and replicated to every node's artifact cache. `SqlDriverConfigDto` has no
-  such property and `UnmappedMemberHandling.Skip` drops the key on read, but that protects only the read
-  path; config blobs are schemaless JSON columns, so nothing stopped the key being **written**.
-  `DraftValidator.ValidateSqlConnectionStringNotPersisted` now fails the deploy
-  (`SqlConnectionStringPersisted`) for a `connectionString` key at the top level of a Sql driver's
-  `DriverConfig` **or** of the `DeviceConfig` of any device beneath it (the two are merged before the DTO
-  sees them). The key is matched case-insensitively, and the error text never echoes the value.
+- If an inline `connectionString` is ever permitted (dev convenience only), the AdminUI **redacts** it
+  in display/logging and flags it dev-only.
 - **Never log the resolved connection string.** Log only provider + server host + database name.
 - Prefer integrated/managed auth where the estate supports it (`Integrated Security=true` / Azure AD /
  Kerberos) so no password transits config at all.
@@ -94,14 +94,7 @@ dual-namespace + event-delivery), Runtime 377 (+ VT reassert regression), AdminU

 ## Documented follow-ups (non-blocking)

- **Scripted-alarm redeploy recovery — FIXED (issue #487), see `docs/ScriptedAlarms.md` §"Post-(re)load
-  condition-node re-assert".** Landed as the proposed shape below: `ScriptedAlarmHostActor.ReassertConditionNodes`
-  in `OnAlarmsLoaded`, node-only, never the `alerts` topic. Two deviations from the sketch, both deliberate:
-  it reads a new `ScriptedAlarmEngine.GetProjections()` rather than `GetState(alarmId)` + `LoadedAlarmIds`
-  (a projection also carries the definition's severity, the resolved message template, and the last-observed
-  worst-input quality — `GetState` alone would have clobbered severity/message on the node); and it skips
-  alarms sitting in the Part 9 no-event position, so a deploy where nothing is in alarm writes no condition
-  nodes at all. The original deferral text follows for context.
+- **Scripted-alarm redeploy recovery (CONFIRMED pre-existing bug, deferred — deserves its own careful fix). Filed as issue #487.**
  The scripted-alarm Part 9 condition node has the same redeploy-reset race the VT `ReassertValue` fix closed:
  `RebuildAddressSpace` clears `_alarmConditions` and `MaterialiseScriptedAlarms` recreates each condition
  fresh/normal, but `ScriptedAlarmEngine.LoadAsync` reloads from the persisted state and yields
@@ -30,7 +30,7 @@ it reaches 📝.
 | Wave | Deliverable | Design | Impl. plan | Status | Effort | Fixture / hardware |
 |---|---|---|---|---|---|---|
 | **0** | Universal Discover-backed browser | [design](2026-07-15-universal-discovery-browser-design.md) | [plan](2026-07-15-universal-discovery-browser-implementation.md) · [tasks](2026-07-15-universal-discovery-browser-implementation.md.tasks.json) | 🟡 **Live gate open** | S–M | none (retrofits shipped drivers) |
-| **1** | Modbus RTU (extend Modbus) | [design](2026-07-15-modbus-rtu-driver-design.md) | [plan](2026-07-24-modbus-rtu-driver.md) · [tasks](2026-07-24-modbus-rtu-driver.md.tasks.json) | 📝 **Plan ready** (11 tasks) | **S (lowest)** | `pymodbus` `rtu_over_tcp` — CI-simulatable, no new infra |
+| **1** | Modbus RTU (extend Modbus) | [design](2026-07-15-modbus-rtu-driver-design.md) | [plan](2026-07-24-modbus-rtu-driver.md) · [tasks](2026-07-24-modbus-rtu-driver.md.tasks.json) | 🟢 **Built — live gate PASSED** (11 tasks, branch `feat/modbus-rtu-driver`, pending merge) | **S (lowest)** | `pymodbus` `rtu_over_tcp` — CI-simulatable, no new infra |
 | **1** | SQL poll | [design](2026-07-15-sql-poll-driver-design.md) | [plan](2026-07-24-sql-poll-driver.md) · [tasks](2026-07-24-sql-poll-driver.md.tasks.json) | 📝 **Plan ready** (22 tasks) | S–M | **existing central SQL Server** `10.100.0.35,14330` + SQLite unit |
 | **2** | MTConnect Agent | [design](2026-07-15-mtconnect-driver-design.md) | [plan](2026-07-24-mtconnect-driver.md) · [tasks](2026-07-24-mtconnect-driver.md.tasks.json) | 📝 **Plan ready** (23 tasks) | S–M | Dockerized `mtconnect/cppagent` — CI-simulatable |
 | **2** | MQTT / Sparkplug B | [design](2026-07-15-mqtt-sparkplug-driver-design.md) | [plan](2026-07-24-mqtt-sparkplug-driver.md) · [tasks](2026-07-24-mqtt-sparkplug-driver.md.tasks.json) | 📝 **Plan ready** (27 tasks, P1+P2) | M–L | Mosquitto/EMQX + C# Sparkplug sim — CI-simulatable |
@@ -92,16 +92,30 @@ marginal cost.
 Both are **fully CI-simulatable with zero new hardware**; Modbus RTU needs no new infra at all, and
 SQL poll reuses the always-on central SQL Server. This is the recommended next build.

-### Modbus RTU — 📝 Plan ready
+### Modbus RTU — 🟢 Built, live gate PASSED (branch `feat/modbus-rtu-driver`, pending merge)
 - **Design:** [`2026-07-15-modbus-rtu-driver-design.md`](2026-07-15-modbus-rtu-driver-design.md)
- **Implementation plan:** [`2026-07-24-modbus-rtu-driver.md`](2026-07-24-modbus-rtu-driver.md) · [`.tasks.json`](2026-07-24-modbus-rtu-driver.md.tasks.json) — **11 tasks** (1 trivial / 5 small / 2 standard / 3 high-risk).
+- **Implementation plan:** [`2026-07-24-modbus-rtu-driver.md`](2026-07-24-modbus-rtu-driver.md) · [`.tasks.json`](2026-07-24-modbus-rtu-driver.md.tasks.json) — **11 tasks** (1 trivial / 5 small / 2 standard / 3 high-risk), all complete via subagent-driven-development.
 - **Scope:** extend the existing Modbus driver with a `Transport` selector (RTU CRC-16 + FC-aware
  length, no TxId) + a `rtu_over_tcp` `pymodbus` docker profile + the AdminUI selector.
  **Direct-serial transport is descoped** (user, 2026-07-15) — RTU-over-TCP via a serial→Ethernet
  gateway is the only shipped mode, so there is no serial hardware gate.
- **Fixture:** add an `rtu_over_tcp` profile to the existing Modbus integration fixture. First P1
-  step is confirming the pymodbus simulator exposes the RTU framer on a TCP server.
- **Effort:** **S — the lowest on the roadmap.** Recommended first.
+- **Fixture:** added the `rtu_over_tcp` profile (`framer=rtu`, host `:5021`, co-runs with `standard`)
+  to the Modbus integration fixture. **Unknown confirmed:** pymodbus 3.13's simulator DOES honour
+  `framer=rtu` on a TCP server (wire-probed a pure RTU FC03 response, no MBAP) — so the simple profile
+  path was taken; **no stdlib fallback server was needed.**
+- **Verification (all green):** unit suite **344/344**; full solution build 0 errors; the 2 RTU
+  integration tests pass **live** against the real `framer=rtu` fixture (read HR5→5, write+readback
+  HR200←4242). Per-task review chain (spec + code reviewers) + a final whole-branch review, all
+  approved-to-merge.
+- **Live `/run` gate — PASSED (2026-07-24, docker-dev rebuilt from this branch):**
+  - AdminUI `/raw` Modbus **driver** config modal renders the new **Transport** selector (with the
+    operator hint) — set to `RtuOverTcp`, saved.
+  - **Device Test Connect → `OK · 23 MS`** — the probe built a `ModbusRtuOverTcpTransport` via the
+    factory and spoke **FC03 over real RTU framing** to `10.100.0.35:5021`.
+  - Authored raw tags HR5 (r/o) + HR200 (r/w) → **deployment `06ec1632` Sealed** (all 6 nodes acked).
+  - Client.CLI on `opc.tcp://localhost:4840` (`multi-role`/`password`): **read** `ns=2;s=rtu-gate/Device1/HR5`
+    → **5, Good**; **write** `ns=2;s=rtu-gate/Device1/HR200` = 4242 → readback **4242, Good**.
+- **Effort:** **S — the lowest on the roadmap.** Delivered first, as recommended.

 ### SQL poll — 📝 Plan ready
 - **Design:** [`2026-07-15-sql-poll-driver-design.md`](2026-07-15-sql-poll-driver-design.md)
@@ -41,100 +41,9 @@ public static class DraftValidator
        ValidateUnsEffectiveLeafUniqueness(draft, errors);
        ValidateEquipReferenceResolution(draft, errors);
        ValidateCalculationTags(draft, errors);
-        ValidateSqlConnectionStringNotPersisted(draft, errors);
        return errors;
    }

-    /// <summary>
-    ///     The <c>Sql</c> driver's "a pasted literal connection string is never persisted" guarantee, enforced
-    ///     at the deploy gate (Gitea #498).
-    /// </summary>
-    /// <remarks>
-    ///     <para>A Sql driver names its credentials indirectly — <c>connectionStringRef</c> resolves from the
-    ///     environment / secret store at Initialize — so a deployed artifact carries no database password.
-    ///     Until now that guarantee rested entirely on the <b>read</b> path: <c>SqlDriverConfigDto</c> has no
-    ///     <c>connectionString</c> property and <c>UnmappedMemberHandling.Skip</c> drops the key on
-    ///     deserialization. Nothing stopped the key being <b>written</b>. Config blobs are schemaless JSON
-    ///     columns, and the fallback authoring pattern for a driver without a typed form is a raw-JSON
-    ///     textarea, so an operator pasting <c>{"connectionString":"Server=…;Password=…"}</c> would put a live
-    ///     credential in the ConfigDb — persisted, replicated to every node's artifact cache, and readable by
-    ///     anyone with config access — while the runtime silently ignored it and the driver failed to connect.
-    ///     Discarding a secret on read is not the same as refusing to store it.</para>
-    ///     <para>Checked on <b>both</b> config surfaces a Sql driver reads: the instance's
-    ///     <see cref="DriverInstance.DriverConfig"/> and the <see cref="Device.DeviceConfig"/> of every device
-    ///     beneath it, because the two are merged before the DTO sees them — a credential pasted into the
-    ///     device blob lands in exactly the same place.</para>
-    ///     <para>The key is matched <b>case-insensitively</b>: <c>System.Text.Json</c> binds
-    ///     <c>ConnectionString</c> to a <c>connectionString</c> property by default, so a case variant is the
-    ///     same key, not a different one. Only the top level is scanned — the DTO is flat, so a nested
-    ///     occurrence cannot bind and is not the credential-shaped mistake this rule exists to catch.</para>
-    ///     <para><b>The message never echoes the value.</b> Validation errors reach the AdminUI, the deploy
-    ///     log and the audit trail; repeating the offending string there would leak the very credential the
-    ///     rule is refusing to store.</para>
-    /// </remarks>
-    private static void ValidateSqlConnectionStringNotPersisted(DraftSnapshot draft, List<ValidationError> errors)
-    {
-        const string ForbiddenKey = "connectionString";
-
-        var sqlInstanceIds = draft.DriverInstances
-            .Where(d => string.Equals(d.DriverType, Core.Abstractions.DriverTypeNames.Sql, StringComparison.Ordinal))
-            .Select(d => d.DriverInstanceId)
-            .ToHashSet(StringComparer.Ordinal);
-        if (sqlInstanceIds.Count == 0) return;
-
-        foreach (var d in draft.DriverInstances)
-        {
-            if (!sqlInstanceIds.Contains(d.DriverInstanceId)) continue;
-            if (!HasTopLevelKey(d.DriverConfig, ForbiddenKey)) continue;
-            errors.Add(new("SqlConnectionStringPersisted",
-                $"Sql driver instance '{d.DriverInstanceId}' has a '{ForbiddenKey}' key in its DriverConfig. " +
-                "A Sql driver must name its credentials indirectly via 'connectionStringRef', which resolves " +
-                "from the environment / secret store at Initialize; a literal connection string here would be " +
-                "stored in the config database and replicated to every node, and the runtime ignores it anyway. " +
-                "Remove the key and set 'connectionStringRef'.",
-                d.DriverInstanceId));
-        }
-
-        foreach (var dev in draft.Devices)
-        {
-            if (!sqlInstanceIds.Contains(dev.DriverInstanceId)) continue;
-            if (!HasTopLevelKey(dev.DeviceConfig, ForbiddenKey)) continue;
-            errors.Add(new("SqlConnectionStringPersisted",
-                $"Device '{dev.DeviceId}' on Sql driver instance '{dev.DriverInstanceId}' has a " +
-                $"'{ForbiddenKey}' key in its DeviceConfig. DeviceConfig is merged onto DriverConfig before " +
-                "the driver reads it, so this is the same leak: use 'connectionStringRef' on the driver instead.",
-                dev.DeviceId));
-        }
-    }
-
-    /// <summary>
-    ///     True when <paramref name="json"/> is a JSON object carrying <paramref name="key"/> at its top level,
-    ///     matched case-insensitively. Never throws — a blank, malformed or non-object blob simply has no keys,
-    ///     and shaping the config JSON is another rule's job.
-    /// </summary>
-    /// <param name="json">The config blob to inspect.</param>
-    /// <param name="key">The property name to look for.</param>
-    /// <returns><see langword="true"/> when the key is present at the top level.</returns>
-    private static bool HasTopLevelKey(string? json, string key)
-    {
-        if (string.IsNullOrWhiteSpace(json)) return false;
-        try
-        {
-            using var doc = System.Text.Json.JsonDocument.Parse(json);
-            if (doc.RootElement.ValueKind != System.Text.Json.JsonValueKind.Object) return false;
-            foreach (var property in doc.RootElement.EnumerateObject())
-            {
-                if (string.Equals(property.Name, key, StringComparison.OrdinalIgnoreCase)) return true;
-            }
-
-            return false;
-        }
-        catch (System.Text.Json.JsonException)
-        {
-            return false;
-        }
-    }
-
    /// <summary>WP7 Calculation-driver deploy gates. For every tag bound to a <c>Calculation</c> driver:
    /// <list type="number">
    ///   <item><b>scriptId existence</b> — the tag's <c>TagConfig.scriptId</c> must be present and resolve to
@@ -53,9 +53,6 @@ public static class DriverTypeNames
    /// <summary>Calculation pseudo-driver — tags computed by C# scripts over other tags' live values.</summary>
    public const string Calculation = "Calculation";

-    /// <summary>Read-only SQL Server table/view poller — publishes columns as OPC UA variables.</summary>
-    public const string Sql = "Sql";
-
    /// <summary>
    ///     Every driver-type string declared above, for callers that need to enumerate
    ///     the full set (e.g. validation of an authored <c>DriverType</c>).
@@ -71,6 +68,5 @@ public static class DriverTypeNames
        OpcUaClient,
        Galaxy,
        Calculation,
-        Sql,
    ];
 }
@@ -334,48 +334,6 @@ public sealed class ScriptedAlarmEngine : IDisposable
    public IReadOnlyCollection<AlarmConditionState> GetAllStates()
        => _alarms.Values.Select(a => a.Condition).ToArray();

-    /// <summary>
-    ///     #487 — the currently-held condition of every loaded alarm, packaged with the definition's
-    ///     severity, the rendered message template and the last-observed input quality, i.e. everything
-    ///     a caller needs to <b>project</b> the alarm onto an OPC UA condition node without waiting for
-    ///     the next transition.
-    /// </summary>
-    /// <remarks>
-    ///     <para>
-    ///         <b>This is a read, not an emission.</b> It deliberately returns a distinct type rather
-    ///         than a <see cref="ScriptedAlarmEvent"/>, and it never touches <see cref="OnEvent"/>. A
-    ///         still-active alarm produces <see cref="EmissionKind.None"/> at load (there is no
-    ///         transition to report), so the transition stream cannot carry the current state — that is
-    ///         exactly why the caller needs this. Routing these through the emission path instead would
-    ///         append a duplicate historian / <c>alerts</c> row on every deploy, so the shape here is
-    ///         intentionally one the emission machinery cannot consume.
-    ///     </para>
-    ///     <para>
-    ///         <b>Synchronization.</b> Reads <c>_alarms</c> and <c>_valueCache</c> — both
-    ///         <see cref="ConcurrentDictionary{TKey, TValue}"/> — without taking <c>_evalGate</c>, the
-    ///         same posture as <see cref="GetState"/> / <see cref="GetAllStates"/>. Each projection is
-    ///         individually coherent; the set as a whole is not an atomic snapshot across a concurrent
-    ///         re-evaluation. That is sufficient for the node-projection use: an evaluation racing this
-    ///         read publishes its own transition through the normal path.
-    ///     </para>
-    /// </remarks>
-    /// <returns>One projection per loaded alarm; empty before the first <see cref="LoadAsync"/>.</returns>
-    public IReadOnlyList<ScriptedAlarmProjection> GetProjections()
-    {
-        var projections = new List<ScriptedAlarmProjection>(_alarms.Count);
-        foreach (var (alarmId, state) in _alarms)
-        {
-            projections.Add(new ScriptedAlarmProjection(
-                AlarmId: alarmId,
-                Severity: state.Definition.Severity,
-                Message: MessageTemplate.Resolve(state.Definition.MessageTemplate, TryLookup),
-                Condition: state.Condition,
-                WorstInputStatusCode: LastWorstStatus(alarmId)));
-        }
-
-        return projections;
-    }
-
    /// <summary>Acknowledges the specified alarm on behalf of the given user.</summary>
    /// <param name="alarmId">The alarm identifier.</param>
    /// <param name="user">The user performing the acknowledgment.</param>
@@ -1016,26 +974,6 @@ public sealed record ScriptedAlarmEvent(
    // the top-2 severity bits. Default 0u == Good keeps every existing constructor call unchanged.
    uint WorstInputStatusCode = 0u);

-/// <summary>
-///     #487 — a loaded alarm's current condition, ready to be projected onto its OPC UA node.
-///     Produced by <see cref="ScriptedAlarmEngine.GetProjections"/> on demand; it is <b>not</b> an
-///     emission and never travels the <see cref="ScriptedAlarmEngine.OnEvent"/> path, so it can never
-///     become an <c>alerts</c> row or a historian record. Deliberately a separate type from
-///     <see cref="ScriptedAlarmEvent"/> — it carries no <see cref="EmissionKind"/>, so there is nothing
-///     for a future refactor to mistake for a transition.
-/// </summary>
-/// <param name="AlarmId">The alarm identifier (also its OPC UA condition NodeId).</param>
-/// <param name="Severity">The definition's severity bucket.</param>
-/// <param name="Message">The message template resolved against the current value cache.</param>
-/// <param name="Condition">The Part 9 condition state the engine currently holds.</param>
-/// <param name="WorstInputStatusCode">The last-observed worst OPC UA StatusCode across the alarm's inputs.</param>
-public sealed record ScriptedAlarmProjection(
-    string AlarmId,
-    AlarmSeverity Severity,
-    string Message,
-    AlarmConditionState Condition,
-    uint WorstInputStatusCode);
-
 /// <summary>
 ///     Upstream source abstraction — intentionally identical shape to the virtual-tag
 ///     engine's so Stream G can compose them behind one driver bridge.
@@ -35,7 +35,7 @@ namespace ZB.MOM.WW.OtOpcUa.Driver.AbCip;
 public static class AbCipStatusMapper
 {
    public const uint Good = 0u;
-    public const uint GoodMoreData = 0x00A60000u;
+    public const uint GoodMoreData = 0x00A70000u;
    public const uint BadInternalError = 0x80020000u;
    public const uint BadNodeIdUnknown = 0x80340000u;
    public const uint BadNotWritable = 0x803B0000u;
@@ -44,7 +44,7 @@ public static class AbCipStatusMapper
    public const uint BadDeviceFailure = 0x808B0000u;
    public const uint BadCommunicationError = 0x80050000u;
    public const uint BadTimeout = 0x800A0000u;
-    public const uint BadTypeMismatch = 0x80740000u;
+    public const uint BadTypeMismatch = 0x80730000u;

    /// <summary>Map a CIP general-status byte to an OPC UA StatusCode.</summary>
    /// <param name="status">The CIP general-status byte value.</param>
@@ -10,7 +10,7 @@ namespace ZB.MOM.WW.OtOpcUa.Driver.AbLegacy;
 public static class AbLegacyStatusMapper
 {
    public const uint Good = 0u;
-    public const uint GoodMoreData = 0x00A60000u;
+    public const uint GoodMoreData = 0x00A70000u;
    public const uint BadInternalError = 0x80020000u;
    public const uint BadNodeIdUnknown = 0x80340000u;
    public const uint BadNotWritable = 0x803B0000u;
@@ -19,7 +19,7 @@ public static class AbLegacyStatusMapper
    public const uint BadDeviceFailure = 0x808B0000u;
    public const uint BadCommunicationError = 0x80050000u;
    public const uint BadTimeout = 0x800A0000u;
-    public const uint BadTypeMismatch = 0x80740000u;
+    public const uint BadTypeMismatch = 0x80730000u;

    /// <summary>
    ///     Map a libplctag return/status code to an OPC UA StatusCode. The integer passed here
@@ -17,7 +17,7 @@ public static class FocasStatusMapper
    public const uint BadDeviceFailure = 0x808B0000u;
    public const uint BadCommunicationError = 0x80050000u;
    public const uint BadTimeout = 0x800A0000u;
-    public const uint BadTypeMismatch = 0x80740000u;
+    public const uint BadTypeMismatch = 0x80730000u;

    /// <summary>
    ///     Map common FWLIB <c>EW_*</c> return codes. The values below match Fanuc's published
@@ -856,7 +856,7 @@ public sealed class GalaxyDriver
            {
                rejectedTcs.TrySetResult(new DataValueSnapshot(
                    Value: null,
-                    StatusCode: StatusCodeMap.Bad,
+                    StatusCode: 0x80000000u, // Bad
                    SourceTimestampUtc: null,
                    ServerTimestampUtc: DateTime.UtcNow));
            }
@@ -875,7 +875,7 @@ public sealed class GalaxyDriver
                {
                    tcs.TrySetResult(new DataValueSnapshot(
                        Value: null,
-                        StatusCode: StatusCodeMap.BadTimeout,
+                        StatusCode: 0x800B0000u, // BadTimeout
                        SourceTimestampUtc: null,
                        ServerTimestampUtc: DateTime.UtcNow));
                }
@@ -26,23 +26,14 @@ internal static class StatusCodeMap
 {
    // OPC UA Part 4 standard StatusCodes — top-byte categories are 0x00 (Good),
    // 0x40 (Uncertain), 0x80 (Bad). Specific codes layer onto the category byte.
-    //
-    // The substatus nibbles are NOT derivable from the OPC DA quality byte this mapper consumes —
-    // they are an unrelated OPC UA enumeration and have to be looked up. Five constants here were
-    // originally written as though the DA byte could be shifted into the substatus position, which
-    // produced values naming entirely different UA codes (Gitea #497): UncertainLastUsableValue held
-    // UncertainDataSubNormal's value, UncertainSubNormal held UncertainNoCommunicationLastUsableValue's,
-    // and GoodLocalOverride / UncertainSensorNotAccurate / UncertainEngineeringUnitsExceeded held values
-    // that are not OPC UA status codes at all. StatusCodeParityTests now checks every constant below
-    // against the pinned SDK's Opc.Ua.StatusCodes.

    public const uint Good                            = 0x00000000u;
-    public const uint GoodLocalOverride               = 0x00960000u;
+    public const uint GoodLocalOverride               = 0x00D80000u;
    public const uint Uncertain                       = 0x40000000u;
-    public const uint UncertainLastUsableValue        = 0x40900000u;
-    public const uint UncertainSensorNotAccurate      = 0x40930000u;
-    public const uint UncertainEngineeringUnitsExceeded = 0x40940000u;
-    public const uint UncertainSubNormal              = 0x40950000u;
+    public const uint UncertainLastUsableValue        = 0x40A40000u;
+    public const uint UncertainSensorNotAccurate      = 0x408D0000u;
+    public const uint UncertainEngineeringUnitsExceeded = 0x408E0000u;
+    public const uint UncertainSubNormal              = 0x408F0000u;
    public const uint Bad                             = 0x80000000u;
    public const uint BadConfigurationError           = 0x80890000u;
    public const uint BadNotConnected                 = 0x808A0000u;
@@ -53,14 +44,6 @@ internal static class StatusCodeMap
    public const uint BadWaitingForInitialData        = 0x80320000u;
    public const uint BadInternalError                = 0x80020000u;

-    /// <summary>
-    ///     Fills a still-pending read when the caller's token fires before the gateway answers. Named here
-    ///     rather than written inline at the call site so <c>StatusCodeParityTests</c> can reflect over it —
-    ///     an inline literal is invisible to that guard, which is exactly how this constant spent its life
-    ///     as <c>0x800B0000</c> (<c>BadServiceUnsupported</c>) under a <c>// BadTimeout</c> comment.
-    /// </summary>
-    public const uint BadTimeout                      = 0x800A0000u;
-
    /// <summary>
    ///     Map a raw OPC DA quality byte (the low byte of an OPC DA <c>OpcQuality</c> ushort,
    ///     which is what Wonderware Historian + MXAccess surface as <c>OPCITEMSTATE.qLong</c>'s
@@ -18,29 +18,29 @@ internal static class GatewayQualityMapper
    public static uint Map(byte q) => q switch
    {
        // Good family (192+)
-        192 => HistorianStatusCodes.Good,
-        216 => HistorianStatusCodes.GoodLocalOverride,
+        192 => 0x00000000u,             // Good
+        216 => 0x00D80000u,             // Good_LocalOverride

        // Uncertain family (64-191)
-        64 => HistorianStatusCodes.Uncertain,
-        68 => HistorianStatusCodes.UncertainLastUsableValue,
-        80 => HistorianStatusCodes.UncertainSensorNotAccurate,
-        84 => HistorianStatusCodes.UncertainEngineeringUnitsExceeded,
-        88 => HistorianStatusCodes.UncertainSubNormal,
+        64 => 0x40000000u,              // Uncertain
+        68 => 0x40900000u,              // Uncertain_LastUsableValue
+        80 => 0x40930000u,              // Uncertain_SensorNotAccurate
+        84 => 0x40940000u,              // Uncertain_EngineeringUnitsExceeded
+        88 => 0x40950000u,              // Uncertain_SubNormal

        // Bad family (0-63)
-        0 => HistorianStatusCodes.Bad,
-        4 => HistorianStatusCodes.BadConfigurationError,
-        8 => HistorianStatusCodes.BadNotConnected,
-        12 => HistorianStatusCodes.BadDeviceFailure,
-        16 => HistorianStatusCodes.BadSensorFailure,
-        20 => HistorianStatusCodes.BadCommunicationError,
-        24 => HistorianStatusCodes.BadOutOfService,
-        32 => HistorianStatusCodes.BadWaitingForInitialData,
+        0 => 0x80000000u,               // Bad
+        4 => 0x80890000u,               // Bad_ConfigurationError
+        8 => 0x808A0000u,               // Bad_NotConnected
+        12 => 0x808B0000u,              // Bad_DeviceFailure
+        16 => 0x808C0000u,              // Bad_SensorFailure
+        20 => 0x80050000u,              // Bad_CommunicationError
+        24 => 0x808D0000u,              // Bad_OutOfService
+        32 => 0x80320000u,              // Bad_WaitingForInitialData

        // Unknown — fall back to category bucket so callers still get something usable.
-        _ when q >= 192 => HistorianStatusCodes.Good,
-        _ when q >= 64 => HistorianStatusCodes.Uncertain,
-        _ => HistorianStatusCodes.Bad,
+        _ when q >= 192 => 0x00000000u,
+        _ when q >= 64 => 0x40000000u,
+        _ => 0x80000000u,
    };
 }
@@ -1,75 +0,0 @@
-namespace ZB.MOM.WW.OtOpcUa.Driver.Historian.Gateway.Mapping;
-
-/// <summary>
-///     The OPC UA status codes this driver publishes, as named constants.
-/// </summary>
-/// <remarks>
-///     <para>The driver layer is deliberately free of an OPC UA SDK reference, so status codes are spelled
-///     as bare <c>uint</c>s. The cost of that is a value nobody checks against the name it is written
-///     under — the defect class Gitea #497 found in six places across four drivers, one of them the
-///     <c>BadNoData</c> in <see cref="SampleMapper"/> that was really <c>BadServerHalted</c>.</para>
-///     <para><b>Named, not inline, on purpose.</b> <c>StatusCodeParityTests</c> guards these by reflecting
-///     over <c>const uint</c> fields and comparing each against <c>Opc.Ua.StatusCodes</c> in the pinned SDK.
-///     A literal written at a call site is invisible to that guard, which is exactly how
-///     <see cref="GatewayQualityMapper"/> kept an incorrect <c>Good_LocalOverride</c> through every test it
-///     had. Add a constant here rather than a literal in a <c>switch</c> arm.</para>
-/// </remarks>
-internal static class HistorianStatusCodes
-{
-    // ---- Good family ----
-
-    /// <summary>The value is good; no qualification.</summary>
-    public const uint Good = 0x00000000u;
-
-    /// <summary>The value has been overridden locally (OPC DA quality 216).</summary>
-    public const uint GoodLocalOverride = 0x00960000u;
-
-    // ---- Uncertain family ----
-
-    /// <summary>The value is uncertain; no specific reason.</summary>
-    public const uint Uncertain = 0x40000000u;
-
-    /// <summary>Communication has failed; the last known value is returned (OPC DA quality 68).</summary>
-    public const uint UncertainLastUsableValue = 0x40900000u;
-
-    /// <summary>The sensor is known not to be accurate (OPC DA quality 80).</summary>
-    public const uint UncertainSensorNotAccurate = 0x40930000u;
-
-    /// <summary>The value is outside the engineering-unit range for the sensor (OPC DA quality 84).</summary>
-    public const uint UncertainEngineeringUnitsExceeded = 0x40940000u;
-
-    /// <summary>The value is derived from fewer sources than required (OPC DA quality 88).</summary>
-    public const uint UncertainSubNormal = 0x40950000u;
-
-    // ---- Bad family ----
-
-    /// <summary>The value is bad; no specific reason.</summary>
-    public const uint Bad = 0x80000000u;
-
-    /// <summary>A configuration problem prevents the value being produced (OPC DA quality 4).</summary>
-    public const uint BadConfigurationError = 0x80890000u;
-
-    /// <summary>The source is not connected (OPC DA quality 8).</summary>
-    public const uint BadNotConnected = 0x808A0000u;
-
-    /// <summary>The device reported a failure (OPC DA quality 12).</summary>
-    public const uint BadDeviceFailure = 0x808B0000u;
-
-    /// <summary>The sensor reported a failure (OPC DA quality 16).</summary>
-    public const uint BadSensorFailure = 0x808C0000u;
-
-    /// <summary>Communication with the source failed (OPC DA quality 20).</summary>
-    public const uint BadCommunicationError = 0x80050000u;
-
-    /// <summary>The source is out of service (OPC DA quality 24).</summary>
-    public const uint BadOutOfService = 0x808D0000u;
-
-    /// <summary>No initial value has arrived from the source yet (OPC DA quality 32).</summary>
-    public const uint BadWaitingForInitialData = 0x80320000u;
-
-    /// <summary>
-    ///     The historian returned no data for the requested tag/interval. Distinct from a transport
-    ///     failure: the query succeeded and the answer was empty.
-    /// </summary>
-    public const uint BadNoData = 0x809B0000u;
-}
@@ -10,8 +10,8 @@ namespace ZB.MOM.WW.OtOpcUa.Driver.Historian.Gateway.Mapping;
 /// </summary>
 internal static class SampleMapper
 {
-    private const uint StatusGood = HistorianStatusCodes.Good;
-    private const uint StatusBadNoData = HistorianStatusCodes.BadNoData;
+    private const uint StatusGood = 0x00000000u;
+    private const uint StatusBadNoData = 0x800E0000u;

    /// <summary>OPC DA "Good" family floor — a quality byte at/above this carries usable data.</summary>
    private const byte GoodQualityFloor = 192;
@@ -130,6 +130,14 @@ public sealed class ModbusDriverOptions
    /// </summary>
    public MelsecFamily MelsecSubFamily { get; init; } = MelsecFamily.Q_L_iQR;

+    /// <summary>
+    ///     Wire transport selector. <see cref="ModbusTransportMode.Tcp"/> (default) is the
+    ///     historical Modbus TCP/MBAP framing. <see cref="ModbusTransportMode.RtuOverTcp"/>
+    ///     frames Modbus RTU PDUs (CRC16, no MBAP header) over the same TCP socket — for
+    ///     serial-to-Ethernet gateways that bridge RS-485 without re-encapsulating to MBAP.
+    /// </summary>
+    public ModbusTransportMode Transport { get; init; } = ModbusTransportMode.Tcp;
+
    /// <summary>
    ///     When <c>true</c>, the driver suppresses redundant writes: if the most recent
    ///     successful write to a tag carried value V and a new write of V arrives, the second
@@ -0,0 +1,17 @@
+namespace ZB.MOM.WW.OtOpcUa.Driver.Modbus;
+
+/// <summary>
+///     Wire transport for a Modbus driver instance. <see cref="Tcp"/> = Modbus/TCP (MBAP + TxId);
+///     <see cref="RtuOverTcp"/> = RTU framing (address + CRC-16, no MBAP) tunnelled over a socket to
+///     a serial→Ethernet gateway. Default <see cref="Tcp"/> — existing configs omit the field.
+///     A direct-serial <c>Rtu</c> member is intentionally NOT reserved here (descoped 2026-07-15);
+///     do not number-squat it.
+/// </summary>
+public enum ModbusTransportMode
+{
+    /// <summary>Modbus/TCP — 7-byte MBAP header + transaction id (the historical default).</summary>
+    Tcp,
+
+    /// <summary>RTU framing (<c>[addr][PDU][CRC-16]</c>) tunnelled over a socket to a serial→Ethernet gateway.</summary>
+    RtuOverTcp,
+}
@@ -0,0 +1,48 @@
+namespace ZB.MOM.WW.OtOpcUa.Driver.Modbus;
+
+/// <summary>
+///     CRC-16/MODBUS helper: reflected polynomial <c>0xA001</c>, initial value <c>0xFFFF</c>.
+///     On the wire the CRC is appended low byte first, high byte second — <see cref="Append"/>
+///     does that; <see cref="Compute"/> just returns the 16-bit value. Byte-stream-agnostic:
+///     no socket or framing knowledge lives here.
+/// </summary>
+public static class ModbusCrc
+{
+    /// <summary>Computes the CRC-16/MODBUS checksum over <paramref name="data"/>.</summary>
+    /// <param name="data">The bytes to checksum (e.g. the RTU frame minus the trailing CRC).</param>
+    /// <returns>The 16-bit CRC value.</returns>
+    public static ushort Compute(ReadOnlySpan<byte> data)
+    {
+        ushort crc = 0xFFFF;
+        foreach (var b in data)
+        {
+            crc ^= b;
+            for (var i = 0; i < 8; i++)
+            {
+                var carry = (crc & 0x0001) != 0;
+                crc >>= 1;
+                if (carry)
+                {
+                    crc ^= 0xA001;
+                }
+            }
+        }
+
+        return crc;
+    }
+
+    /// <summary>
+    ///     Returns <paramref name="body"/> with its CRC-16/MODBUS appended, low byte first.
+    /// </summary>
+    /// <param name="body">The frame body to checksum.</param>
+    /// <returns>A new array: <paramref name="body"/> followed by <c>[crc &amp; 0xFF, crc &gt;&gt; 8]</c>.</returns>
+    public static byte[] Append(ReadOnlySpan<byte> body)
+    {
+        var crc = Compute(body);
+        var result = new byte[body.Length + 2];
+        body.CopyTo(result);
+        result[^2] = (byte)(crc & 0xFF);
+        result[^1] = (byte)(crc >> 8);
+        return result;
+    }
+}
@@ -94,7 +94,8 @@ public sealed class ModbusDriver
    /// <summary>Initializes a new Modbus TCP driver with the specified options and transport factory.</summary>
    /// <param name="options">Driver configuration options.</param>
    /// <param name="driverInstanceId">Unique identifier for this driver instance.</param>
-    /// <param name="transportFactory">Factory to create the Modbus transport; defaults to ModbusTcpTransport.</param>
+    /// <param name="transportFactory">Factory to create the Modbus transport; defaults to
+    /// <see cref="ModbusTransportFactory.Create"/>, which honours <see cref="ModbusDriverOptions.Transport"/>.</param>
    /// <param name="logger">Logger instance; defaults to null logger if not provided.</param>
    public ModbusDriver(ModbusDriverOptions options, string driverInstanceId,
        Func<ModbusDriverOptions, IModbusTransport>? transportFactory = null,
@@ -107,11 +108,7 @@ public sealed class ModbusDriver
        _resolver = new EquipmentTagRefResolver<ModbusTagDefinition>(
            r => _tagsByRawPath.TryGetValue(r, out var t) ? t : null);
        _transportFactory = transportFactory
-            ?? (o => new ModbusTcpTransport(
-                o.Host, o.Port, o.Timeout, o.AutoReconnect,
-                keepAlive: o.KeepAlive,
-                idleDisconnect: o.IdleDisconnectTimeout,
-                reconnect: o.Reconnect));
+            ?? (o => ModbusTransportFactory.Create(o));
        _poll = new PollGroupEngine(
            reader: ReadAsync,
            onChange: (handle, tagRef, snapshot) =>
@@ -74,6 +74,8 @@ public static class ModbusDriverFactoryExtensions
                : ParseEnum<ModbusFamily>(dto.Family, "<driver-level>", driverInstanceId, "Family"),
            MelsecSubFamily = dto.MelsecSubFamily is null ? MelsecFamily.Q_L_iQR
                : ParseEnum<MelsecFamily>(dto.MelsecSubFamily, "<driver-level>", driverInstanceId, "MelsecSubFamily"),
+            Transport = dto.Transport is null ? ModbusTransportMode.Tcp
+                : ParseEnum<ModbusTransportMode>(dto.Transport, "<driver-level>", driverInstanceId, "Transport"),
            AutoProhibitReprobeInterval = dto.AutoProhibitReprobeMs is { } reprobeMs ? TimeSpan.FromMilliseconds(reprobeMs) : null,
            AutoReconnect = dto.AutoReconnect ?? true,
            // v3: the deploy artifact (Wave C) populates rawTags with the cluster's authored raw Modbus
@@ -159,6 +161,8 @@ public static class ModbusDriverFactoryExtensions
        public string? Family { get; init; }
        /// <summary>Gets or sets the Melsec subfamily.</summary>
        public string? MelsecSubFamily { get; init; }
+        /// <summary>Gets or sets the wire transport mode (Tcp / RtuOverTcp). Null defaults to Tcp.</summary>
+        public string? Transport { get; init; }
        /// <summary>Gets or sets the automatic prohibition reprobei interval in milliseconds.</summary>
        public int? AutoProhibitReprobeMs { get; init; }
        /// <summary>Gets or sets a value indicating whether automatic reconnection is enabled.</summary>
@@ -29,15 +29,19 @@ public sealed class ModbusDriverProbe : IDriverProbe
    /// <inheritdoc />
    public string DriverType => "Modbus";

-    /// <summary>The parsed probe target — host/port/unitId + the effective connection timeout, all read
-    /// from the SAME factory DTO shape (<c>ModbusDriverConfigDto</c>) the driver factory parses, so
-    /// <c>timeoutMs</c> binds identically to the factory (R2-11, 05/CONV-2; the OpcUaClient parity rule).</summary>
-    internal readonly record struct ProbeTarget(string Host, int Port, byte UnitId, TimeSpan Timeout);
+    /// <summary>The parsed probe target — host/port/unitId + the effective connection timeout + the wire
+    /// transport mode, all read from the SAME factory DTO shape (<c>ModbusDriverConfigDto</c>) the driver
+    /// factory parses, so <c>timeoutMs</c> binds identically to the factory (R2-11, 05/CONV-2; the
+    /// OpcUaClient parity rule) and an <c>RtuOverTcp</c>-authored config probes over RTU framing —
+    /// matching how the driver will actually run.</summary>
+    internal readonly record struct ProbeTarget(string Host, int Port, byte UnitId, TimeSpan Timeout, ModbusTransportMode Transport);

    /// <summary>Parse the driver config JSON into a <see cref="ProbeTarget"/> using the factory DTO shape.
    /// Returns a null target + an error message when the JSON is invalid or has no host/port. The effective
    /// timeout mirrors the factory (<c>TimeSpan.FromMilliseconds(dto.TimeoutMs ?? …)</c>); when the config
-    /// omits <c>timeoutMs</c> the caller's <paramref name="fallbackTimeout"/> is used.</summary>
+    /// omits <c>timeoutMs</c> the caller's <paramref name="fallbackTimeout"/> is used. <c>Transport</c>
+    /// mirrors the factory's null-defaults-to-Tcp convention (<see cref="ModbusDriverFactoryExtensions"/>);
+    /// an unrecognized value is reported as a probe-target error rather than silently falling back.</summary>
    /// <param name="configJson">The driver config JSON (factory DTO shape).</param>
    /// <param name="fallbackTimeout">The timeout used when the config omits <c>timeoutMs</c>.</param>
    /// <returns>The parsed target, or a null target with an error string.</returns>
@@ -52,8 +56,15 @@ public sealed class ModbusDriverProbe : IDriverProbe
        if (string.IsNullOrWhiteSpace(dto.Host) || port <= 0)
            return (null, "Config has no host/port to probe.");

+        var transportMode = ModbusTransportMode.Tcp;
+        if (dto.Transport is not null && !Enum.TryParse(dto.Transport, ignoreCase: true, out transportMode))
+        {
+            return (null, $"Config has unknown Transport '{dto.Transport}'. " +
+                $"Expected one of {string.Join(", ", Enum.GetNames<ModbusTransportMode>())}");
+        }
+
        var timeout = dto.TimeoutMs is { } ms && ms > 0 ? TimeSpan.FromMilliseconds(ms) : fallbackTimeout;
-        return (new ProbeTarget(dto.Host!, port, dto.UnitId ?? 1, timeout), null);
+        return (new ProbeTarget(dto.Host!, port, dto.UnitId ?? 1, timeout, transportMode), null);
    }

    /// <inheritdoc />
@@ -72,9 +83,17 @@ public sealed class ModbusDriverProbe : IDriverProbe
        using var cts = CancellationTokenSource.CreateLinkedTokenSource(ct);
        cts.CancelAfter(timeout);

-        // Phase 1 — TCP connect (using ModbusTcpTransport which handles IPv4 preference).
+        // Phase 1 — TCP connect, over whichever transport the config's Transport mode selects
+        // (ModbusTransportFactory is the single mapping point — same switch the live driver uses).
        // autoReconnect=false: this is a one-shot probe, no retry loops.
-        var transport = new ModbusTcpTransport(host, port, timeout, autoReconnect: false);
+        var transport = ModbusTransportFactory.Create(new ModbusDriverOptions
+        {
+            Host = host,
+            Port = port,
+            Timeout = timeout,
+            Transport = t.Transport,
+            AutoReconnect = false,
+        });
        await using (transport.ConfigureAwait(false))
        {
            try
@@ -0,0 +1,187 @@
+namespace ZB.MOM.WW.OtOpcUa.Driver.Modbus;
+
+/// <summary>
+///     Modbus RTU framing: builds a request ADU (<c>[unitId] + PDU + CRC</c>) and deframes a
+///     response back to its bare PDU. Byte-stream-agnostic — it operates on a <see cref="Stream"/>
+///     and knows nothing about sockets or serial ports, so a future serial transport can reuse it.
+/// </summary>
+/// <remarks>
+///     <para>
+///         The single genuinely-new correctness risk of the RTU path: an RTU frame carries <b>no
+///         length field</b> (unlike TCP's MBAP header), so the response size must be derived from
+///         the function code. After reading <c>addr(1)</c> + <c>fc(1)</c>, the remaining byte count
+///         is one of three shapes:
+///     </para>
+///     <list type="table">
+///         <listheader><term>Shape</term><description>Trailing bytes after <c>addr,fc</c></description></listheader>
+///         <item>
+///             <term>Exception (<c>fc &amp; 0x80</c>)</term>
+///             <description><c>excCode(1)</c> + <c>CRC(2)</c></description>
+///         </item>
+///         <item>
+///             <term>Read (FC 01/02/03/04)</term>
+///             <description><c>byteCount(1)</c> then <c>byteCount</c> data bytes + <c>CRC(2)</c></description>
+///         </item>
+///         <item>
+///             <term>Write echo (FC 05/06/15/16)</term>
+///             <description>fixed <c>4</c> bytes + <c>CRC(2)</c></description>
+///         </item>
+///     </list>
+///     <para>
+///         The trailing CRC is validated over <c>[addr, ...pdu]</c> (everything except the two CRC
+///         bytes) <b>before</b> the frame is interpreted — so a corrupt exception frame surfaces as a
+///         desync, never as a bogus <see cref="ModbusException"/>. A CRC mismatch or a short read
+///         (truncation / stream closed mid-frame) throws <see cref="ModbusTransportDesyncException"/>;
+///         a CRC-valid exception PDU throws <see cref="ModbusException"/> carrying the original
+///         function code (<c>fc &amp; 0x7F</c>) and exception code.
+///     </para>
+///     <para>
+///         Once the CRC passes, the response's address byte is validated against the addressed unit.
+///         On an RS-485 multi-drop bus a CRC-valid reply from the <b>wrong</b> slave would otherwise be
+///         silently accepted as the addressed unit's data; such a frame is a unit-mismatch
+///         <see cref="ModbusTransportDesyncException"/>. This ordering is deliberate — a corrupt frame
+///         stays a CRC/desync failure, and only a coherent-but-mis-addressed frame becomes a
+///         unit-mismatch desync.
+///     </para>
+/// </remarks>
+public static class ModbusRtuFraming
+{
+    /// <summary>
+    ///     Builds an RTU request ADU: the unit id, the PDU, and the trailing CRC-16/MODBUS
+    ///     (appended low byte first).
+    /// </summary>
+    /// <param name="unitId">The RTU slave/unit address.</param>
+    /// <param name="pdu">The bare PDU (function code + data).</param>
+    /// <returns>A new array: <c>[unitId, ...pdu, crcLo, crcHi]</c>.</returns>
+    public static byte[] BuildAdu(byte unitId, ReadOnlySpan<byte> pdu)
+    {
+        var frame = new byte[1 + pdu.Length];
+        frame[0] = unitId;
+        pdu.CopyTo(frame.AsSpan(1));
+        return ModbusCrc.Append(frame);
+    }
+
+    /// <summary>
+    ///     Reads a single RTU response frame from <paramref name="stream"/> and returns its bare PDU
+    ///     (<c>[fc, ...data]</c>), with the leading unit-id and trailing CRC stripped.
+    /// </summary>
+    /// <param name="stream">The byte stream to read the response from.</param>
+    /// <param name="expectedUnit">
+    ///     The unit id the request was addressed to. The response's address byte is validated against
+    ///     it after the CRC passes; a mismatch is a unit-mismatch desync.
+    /// </param>
+    /// <param name="ct">A token to cancel the read.</param>
+    /// <returns>The bare response PDU (function code followed by its data).</returns>
+    /// <exception cref="ModbusTransportDesyncException">
+    ///     The frame was truncated (stream closed mid-frame), its trailing CRC did not validate, or its
+    ///     address byte did not match <paramref name="expectedUnit"/>.
+    /// </exception>
+    /// <exception cref="ModbusException">
+    ///     The frame was a CRC-valid Modbus exception PDU (high bit set on the function code).
+    /// </exception>
+    public static async Task<byte[]> ReadResponsePduAsync(
+        Stream stream, byte expectedUnit, CancellationToken ct)
+    {
+        // Header: addr(1) + fc(1). The function code selects how many more bytes to read.
+        var header = new byte[2];
+        await ReadExactlyAsync(stream, header, ct).ConfigureAwait(false);
+        var fc = header[1];
+
+        int trailing; // bytes after addr+fc, up to and including the 2 CRC bytes.
+        if ((fc & 0x80) != 0)
+        {
+            // Exception frame: excCode(1) + CRC(2).
+            trailing = 1 + 2;
+        }
+        else if (fc is 0x01 or 0x02 or 0x03 or 0x04)
+        {
+            // Read response: byteCount(1) then byteCount data bytes + CRC(2).
+            var bc = new byte[1];
+            await ReadExactlyAsync(stream, bc, ct).ConfigureAwait(false);
+            var byteCount = bc[0];
+            var rest = new byte[byteCount + 2];
+            await ReadExactlyAsync(stream, rest, ct).ConfigureAwait(false);
+            return ValidateAndStrip(expectedUnit, header, bc, rest);
+        }
+        else
+        {
+            // Fixed 4-byte echo: correct for the write FCs this driver emits (05/06/0F/10). A future
+            // variable-length response FC outside 01-04 (e.g. FC23) would be mis-sized here and
+            // surface as a desync — revisit the FC-shape table if the driver starts emitting one.
+            trailing = 4 + 2;
+        }
+
+        var tail = new byte[trailing];
+        await ReadExactlyAsync(stream, tail, ct).ConfigureAwait(false);
+        return ValidateAndStrip(expectedUnit, header, ReadOnlySpan<byte>.Empty, tail);
+    }
+
+    /// <summary>
+    ///     Assembles the full frame from its pieces, validates the trailing CRC over everything
+    ///     except the CRC bytes, then validates the response address against
+    ///     <paramref name="expectedUnit"/> and strips <c>addr</c> + <c>CRC</c> to return the bare PDU.
+    ///     A CRC-valid exception PDU throws <see cref="ModbusException"/>.
+    /// </summary>
+    private static byte[] ValidateAndStrip(
+        byte expectedUnit, ReadOnlySpan<byte> header, ReadOnlySpan<byte> middle, ReadOnlySpan<byte> tail)
+    {
+        // Reassemble the whole frame: header(addr,fc) + middle(optional byteCount) + tail.
+        var frame = new byte[header.Length + middle.Length + tail.Length];
+        header.CopyTo(frame);
+        middle.CopyTo(frame.AsSpan(header.Length));
+        tail.CopyTo(frame.AsSpan(header.Length + middle.Length));
+
+        // CRC covers everything except the trailing 2 CRC bytes.
+        var body = frame.AsSpan(0, frame.Length - 2);
+        var expected = ModbusCrc.Compute(body);
+        var actual = (ushort)(frame[^2] | (frame[^1] << 8));
+        if (actual != expected)
+            throw new ModbusTransportDesyncException(
+                ModbusTransportDesyncException.DesyncReason.CrcMismatch,
+                $"Modbus RTU CRC mismatch: computed {expected:X4} got {actual:X4}");
+
+        // Unit-address validation runs only AFTER the CRC passes: a corrupt frame is a CRC/desync
+        // failure, and only a coherent-but-mis-addressed frame (a CRC-valid reply from the wrong
+        // RS-485 slave) is a unit-mismatch desync. Never silently accept another unit's data.
+        var addr = frame[0];
+        if (addr != expectedUnit)
+            throw new ModbusTransportDesyncException(
+                ModbusTransportDesyncException.DesyncReason.UnitMismatch,
+                $"Modbus RTU unit mismatch: expected {expectedUnit} got {addr}");
+
+        // Bare PDU = frame minus leading addr and trailing CRC.
+        var pdu = body[1..].ToArray();
+
+        // Exception PDU: high bit set on the function code. The CRC already validated, so this is a
+        // coherent protocol-level error — surface the ORIGINAL function code (fc & 0x7F).
+        if ((pdu[0] & 0x80) != 0)
+        {
+            var fc = (byte)(pdu[0] & 0x7F);
+            var exCode = pdu[1];
+            throw new ModbusException(fc, exCode, $"Modbus exception fc={fc} code={exCode}");
+        }
+
+        return pdu;
+    }
+
+    /// <summary>
+    ///     Fills <paramref name="buf"/> completely from <paramref name="stream"/>, throwing a
+    ///     truncation desync if the stream ends first. Mirrors
+    ///     <c>ModbusTcpTransport.ReadExactlyAsync</c>, but normalises the end-of-stream to a
+    ///     <see cref="ModbusTransportDesyncException"/> so a length-less RTU frame that arrives
+    ///     short is classified as a desync rather than a bare <see cref="EndOfStreamException"/>.
+    /// </summary>
+    private static async Task ReadExactlyAsync(Stream stream, byte[] buf, CancellationToken ct)
+    {
+        var read = 0;
+        while (read < buf.Length)
+        {
+            var n = await stream.ReadAsync(buf.AsMemory(read), ct).ConfigureAwait(false);
+            if (n == 0)
+                throw new ModbusTransportDesyncException(
+                    ModbusTransportDesyncException.DesyncReason.TruncatedFrame,
+                    $"Modbus RTU frame truncated: expected {buf.Length} bytes, got {read}");
+            read += n;
+        }
+    }
+}
@@ -0,0 +1,190 @@
+using System.Net.Sockets;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.Modbus;
+
+/// <summary>
+///     Concrete Modbus RTU-over-TCP transport. Composes <see cref="ModbusSocketLifecycle"/> for the
+///     connect / reconnect / keep-alive / idle machinery and <see cref="ModbusRtuFraming"/> for the
+///     wire layout — the same lifecycle <see cref="ModbusTcpTransport"/> uses, but with CRC framing
+///     instead of MBAP.
+/// </summary>
+/// <remarks>
+///     <para>
+///         Delta from <see cref="ModbusTcpTransport"/>: an RTU ADU is <c>[unitId][PDU][CRC]</c> with
+///         <b>no MBAP header and no transaction id</b>. Because there is no TxId to correlate
+///         interleaved responses, at most one transaction may be on the bus at a time — the
+///         <see cref="_gate"/> single-flight is therefore <b>mandatory</b>, not merely a
+///         diagnostics convenience.
+///     </para>
+///     <para>
+///         Survives mid-transaction socket drops the same way the TCP transport does: a socket-level
+///         failure (<see cref="IOException"/> / <see cref="SocketException"/> /
+///         <see cref="EndOfStreamException"/>, and the <see cref="ModbusTransportDesyncException"/>
+///         that derives from <see cref="IOException"/>) triggers a single reconnect-then-retry; a
+///         second failure bubbles up so the driver's health surface reflects the real state.
+///     </para>
+///     <para>
+///         Every transaction runs under a per-op deadline (a linked
+///         <see cref="CancellationTokenSource.CancelAfter(TimeSpan)"/>, design §7 / R2-01) so a
+///         frozen gateway can never wedge a poll: the deadline firing is normalised to a
+///         <see cref="ModbusTransportDesyncException"/> and tears the socket down so the next attempt
+///         reconnects. A <b>caller</b> cancellation is distinguished from that timeout and propagates
+///         as a plain <see cref="OperationCanceledException"/> with no teardown.
+///     </para>
+///     <para>
+///         The constructor is connection-free; all socket I/O happens in <see cref="ConnectAsync"/> /
+///         <see cref="SendAsync"/>. The <see cref="ForTest"/> seam injects a pre-connected
+///         <see cref="Stream"/> (an in-memory duplex fake) so the send/receive orchestration,
+///         single-flight, and deadline can be exercised with no socket — in that path
+///         <see cref="_life"/> is <see langword="null"/> and the idle / reconnect machinery is
+///         skipped (a raw injected stream cannot reconnect).
+///     </para>
+/// </remarks>
+public sealed class ModbusRtuOverTcpTransport : IModbusTransport
+{
+    private readonly ModbusSocketLifecycle? _life;
+    private readonly Stream? _testStream;
+    private readonly TimeSpan _timeout;
+    private readonly SemaphoreSlim _gate = new(1, 1);
+    private bool _disposed;
+
+    /// <summary>Initializes a new instance of the <see cref="ModbusRtuOverTcpTransport"/> class.</summary>
+    /// <param name="host">The host address or hostname of the Modbus gateway.</param>
+    /// <param name="port">The TCP port of the Modbus gateway.</param>
+    /// <param name="timeout">The timeout for socket operations and the per-op response deadline.</param>
+    /// <param name="autoReconnect">Whether to automatically reconnect on socket failures.</param>
+    /// <param name="keepAlive">Optional keep-alive configuration for the socket.</param>
+    /// <param name="idleDisconnect">Optional duration after which an idle socket is disconnected.</param>
+    /// <param name="reconnect">Optional reconnect backoff configuration.</param>
+    public ModbusRtuOverTcpTransport(
+        string host, int port, TimeSpan timeout, bool autoReconnect = true,
+        ModbusKeepAliveOptions? keepAlive = null,
+        TimeSpan? idleDisconnect = null,
+        ModbusReconnectOptions? reconnect = null)
+    {
+        _timeout = timeout;
+        _life = new ModbusSocketLifecycle(host, port, timeout, autoReconnect, keepAlive, idleDisconnect, reconnect);
+    }
+
+    private ModbusRtuOverTcpTransport(Stream testStream, TimeSpan timeout)
+    {
+        _timeout = timeout;
+        _testStream = testStream;
+    }
+
+    /// <summary>
+    ///     Test seam: builds a transport over a pre-connected, in-memory duplex <paramref name="stream"/>,
+    ///     bypassing <see cref="ConnectAsync"/> and the idle / reconnect machinery so the send/receive
+    ///     orchestration, single-flight, and per-op deadline can be exercised with no real socket.
+    /// </summary>
+    /// <param name="stream">A pre-connected duplex stream standing in for the socket.</param>
+    /// <param name="timeout">The per-op response deadline.</param>
+    /// <returns>A transport driving <paramref name="stream"/> directly.</returns>
+    internal static ModbusRtuOverTcpTransport ForTest(Stream stream, TimeSpan timeout) => new(stream, timeout);
+
+    /// <inheritdoc />
+    public Task ConnectAsync(CancellationToken ct) =>
+        // The ForTest seam is handed a pre-connected stream — nothing to dial.
+        _life is null ? Task.CompletedTask : _life.ConnectAsync(ct);
+
+    /// <inheritdoc />
+    public async Task<byte[]> SendAsync(byte unitId, byte[] pdu, CancellationToken ct)
+    {
+        if (_disposed) throw new ObjectDisposedException(nameof(ModbusRtuOverTcpTransport));
+        if (CurrentStream is null) throw new InvalidOperationException("Transport not connected");
+
+        // Single-flight: RTU carries no transaction id, so at most one transaction may be on the bus
+        // at a time — serialise every send/receive under the gate.
+        await _gate.WaitAsync(ct).ConfigureAwait(false);
+        try
+        {
+            // Proactive idle-disconnect (real socket only): if the socket has been quiet longer than
+            // the configured threshold, tear it down + reconnect before this PDU lands. Defends
+            // against silent NAT / firewall reaping.
+            if (_life is not null && _life.ShouldReconnectForIdle())
+            {
+                await _life.TearDownAsync().ConfigureAwait(false);
+                await _life.ConnectWithBackoffAsync(ct).ConfigureAwait(false);
+            }
+
+            try
+            {
+                var result = await SendOnceAsync(unitId, pdu, ct).ConfigureAwait(false);
+                _life?.MarkSuccess();
+                return result;
+            }
+            catch (Exception ex) when (_life is not null && _life.AutoReconnect && ModbusSocketLifecycle.IsSocketLevelFailure(ex))
+            {
+                // Mid-transaction drop: tear down the dead socket, reconnect (with backoff if
+                // configured), resend. Single retry — a second failure propagates so health/status
+                // reflect reality. Never reached in the ForTest seam (a raw injected stream has no
+                // lifecycle to reconnect).
+                await _life.TearDownAsync().ConfigureAwait(false);
+                await _life.ConnectWithBackoffAsync(ct).ConfigureAwait(false);
+                var result = await SendOnceAsync(unitId, pdu, ct).ConfigureAwait(false);
+                _life.MarkSuccess();
+                return result;
+            }
+        }
+        finally
+        {
+            _gate.Release();
+        }
+    }
+
+    /// <summary>The live stream: the lifecycle's <see cref="NetworkStream"/>, or the injected test stream.</summary>
+    private Stream? CurrentStream => _life?.Stream ?? _testStream;
+
+    /// <summary>
+    ///     Executes exactly one RTU transaction on the current stream: build the ADU, write + flush,
+    ///     read back one deframed response PDU. See the class remarks for the desync / timeout /
+    ///     caller-cancel handling.
+    /// </summary>
+    private async Task<byte[]> SendOnceAsync(byte unitId, byte[] pdu, CancellationToken ct)
+    {
+        var stream = CurrentStream;
+        if (stream is null) throw new InvalidOperationException("Transport not connected");
+
+        // RTU ADU: [unitId] + PDU + CRC — no MBAP header, no TxId.
+        var adu = ModbusRtuFraming.BuildAdu(unitId, pdu);
+
+        using var cts = CancellationTokenSource.CreateLinkedTokenSource(ct);
+        cts.CancelAfter(_timeout);
+        try
+        {
+            await stream.WriteAsync(adu.AsMemory(), cts.Token).ConfigureAwait(false);
+            await stream.FlushAsync(cts.Token).ConfigureAwait(false);
+
+            // Framing owns the length-less RTU deframe + CRC + unit-address validation. A CRC-valid
+            // exception PDU throws ModbusException (socket still coherent — propagates, no teardown);
+            // truncation / CRC / unit-mismatch throw ModbusTransportDesyncException.
+            return await ModbusRtuFraming.ReadResponsePduAsync(stream, unitId, cts.Token).ConfigureAwait(false);
+        }
+        catch (ModbusTransportDesyncException)
+        {
+            // Framing violation: the stream is desynchronized — never reuse it.
+            if (_life is not null) await _life.TearDownAsync().ConfigureAwait(false);
+            throw;
+        }
+        catch (OperationCanceledException) when (!ct.IsCancellationRequested)
+        {
+            // Per-op timeout fired (NOT the caller). The response is unknown / may still land later
+            // and corrupt the next read — tear the socket down and normalise as a desync so the
+            // reconnect retry / status mapping engages.
+            if (_life is not null) await _life.TearDownAsync().ConfigureAwait(false);
+            throw new ModbusTransportDesyncException(
+                ModbusTransportDesyncException.DesyncReason.Timeout,
+                $"Modbus per-op response timeout after {_timeout.TotalMilliseconds:0}ms");
+        }
+    }
+
+    /// <summary>Asynchronously disposes the transport and underlying socket resources.</summary>
+    /// <returns>A task that represents the asynchronous operation.</returns>
+    public async ValueTask DisposeAsync()
+    {
+        if (_disposed) return;
+        _disposed = true;
+        if (_life is not null) await _life.DisposeAsync().ConfigureAwait(false);
+        _gate.Dispose();
+    }
+}
@@ -0,0 +1,221 @@
+using System.Net.Sockets;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.Modbus;
+
+/// <summary>
+///     Owns the raw TCP socket lifecycle shared by every Modbus-over-TCP transport (MBAP and
+///     RTU-over-TCP alike): the IPv4-preference connect, OS-level keep-alive, geometric-backoff
+///     reconnect, idle-disconnect tracking, and teardown. It exposes the current
+///     <see cref="NetworkStream"/> so the composing transport can drive its own framing on top —
+///     the lifecycle knows nothing about MBAP / RTU wire layout.
+/// </summary>
+/// <remarks>
+///     <para>
+///         Extracted verbatim from <see cref="ModbusTcpTransport"/> so the connect / reconnect /
+///         keep-alive / idle behaviour is written once and composed by both transports. The
+///         constructor is connection-free — all socket I/O happens in <see cref="ConnectAsync"/> /
+///         <see cref="ConnectWithBackoffAsync"/>.
+///     </para>
+///     <para>
+///         Why keep-alive matters for DL205/DL260: the AutomationDirect H2-ECOM100 does NOT send
+///         TCP keepalives per <c>docs/v2/dl205.md</c> §behavioral-oddities, so any NAT/firewall
+///         between the gateway and PLC can silently close an idle socket after 2-5 minutes.
+///         Enabling OS-level <c>SO_KEEPALIVE</c> lets the driver's own side detect a stuck socket
+///         in reasonable time even when the application is mostly idle.
+///     </para>
+/// </remarks>
+public sealed class ModbusSocketLifecycle : IAsyncDisposable
+{
+    private readonly string _host;
+    private readonly int _port;
+    private readonly TimeSpan _timeout;
+    private readonly bool _autoReconnect;
+    private readonly ModbusKeepAliveOptions _keepAlive;
+    private readonly TimeSpan? _idleDisconnect;
+    private readonly ModbusReconnectOptions _reconnect;
+    private TcpClient? _client;
+    private NetworkStream? _stream;
+    private DateTime _lastSuccessUtc = DateTime.UtcNow;
+
+    /// <summary>Initializes a new instance of the <see cref="ModbusSocketLifecycle"/> class.</summary>
+    /// <param name="host">The host address or hostname of the Modbus server.</param>
+    /// <param name="port">The TCP port of the Modbus server.</param>
+    /// <param name="timeout">The timeout for socket operations.</param>
+    /// <param name="autoReconnect">Whether to automatically reconnect on socket failures.</param>
+    /// <param name="keepAlive">Optional keep-alive configuration for the socket.</param>
+    /// <param name="idleDisconnect">Optional duration after which an idle socket is disconnected.</param>
+    /// <param name="reconnect">Optional reconnect backoff configuration.</param>
+    public ModbusSocketLifecycle(
+        string host, int port, TimeSpan timeout, bool autoReconnect = true,
+        ModbusKeepAliveOptions? keepAlive = null,
+        TimeSpan? idleDisconnect = null,
+        ModbusReconnectOptions? reconnect = null)
+    {
+        _host = host;
+        _port = port;
+        _timeout = timeout;
+        _autoReconnect = autoReconnect;
+        _keepAlive = keepAlive ?? new ModbusKeepAliveOptions();
+        _idleDisconnect = idleDisconnect;
+        _reconnect = reconnect ?? new ModbusReconnectOptions();
+    }
+
+    /// <summary>Gets the current live <see cref="NetworkStream"/>, or <see langword="null"/> when not connected.</summary>
+    public NetworkStream? Stream => _stream;
+
+    /// <summary>Gets a value indicating whether auto-reconnect on socket failures is enabled.</summary>
+    public bool AutoReconnect => _autoReconnect;
+
+    /// <summary>Establishes a connection to the Modbus server, preferring IPv4.</summary>
+    /// <param name="ct">A cancellation token to observe for cancellation.</param>
+    /// <returns>A task representing the asynchronous connection operation.</returns>
+    public async Task ConnectAsync(CancellationToken ct)
+    {
+        // Resolve the host explicitly + prefer IPv4. .NET's TcpClient default-constructor is
+        // dual-stack (IPv6 first, fallback to IPv4) — but most Modbus TCP devices (PLCs and
+        // simulators like pymodbus) bind 0.0.0.0 only, so the IPv6 attempt times out and we
+        // burn the entire ConnectAsync budget before even trying IPv4. Resolving first +
+        // dialing the IPv4 address directly sidesteps that.
+        var addresses = await System.Net.Dns.GetHostAddressesAsync(_host, ct).ConfigureAwait(false);
+        var ipv4 = System.Linq.Enumerable.FirstOrDefault(addresses,
+            a => a.AddressFamily == System.Net.Sockets.AddressFamily.InterNetwork);
+        var target = ipv4 ?? (addresses.Length > 0 ? addresses[0] : System.Net.IPAddress.Loopback);
+
+        _client = new TcpClient(target.AddressFamily);
+        EnableKeepAlive(_client, _keepAlive);
+
+        using var cts = CancellationTokenSource.CreateLinkedTokenSource(ct);
+        cts.CancelAfter(_timeout);
+        await _client.ConnectAsync(target, _port, cts.Token).ConfigureAwait(false);
+        _stream = _client.GetStream();
+        _lastSuccessUtc = DateTime.UtcNow;
+    }
+
+    /// <summary>
+    ///     Connect attempt with the configured geometric backoff. The first attempt fires after
+    ///     <see cref="ModbusReconnectOptions.InitialDelay"/> (default zero — immediate); each
+    ///     subsequent attempt sleeps for the previous delay times <c>BackoffMultiplier</c>,
+    ///     capped at <c>MaxDelay</c>. Caller's cancellation token aborts the loop.
+    /// </summary>
+    /// <param name="ct">A cancellation token to observe for cancellation.</param>
+    /// <returns>A task representing the asynchronous reconnect operation.</returns>
+    public async Task ConnectWithBackoffAsync(CancellationToken ct)
+    {
+        var delay = _reconnect.InitialDelay;
+        var attempt = 0;
+        while (true)
+        {
+            if (delay > TimeSpan.Zero)
+                await Task.Delay(delay, ct).ConfigureAwait(false);
+            try
+            {
+                await ConnectAsync(ct).ConfigureAwait(false);
+                return;
+            }
+            catch (Exception ex) when (IsSocketLevelFailure(ex) && _autoReconnect)
+            {
+                attempt++;
+                // Geometric growth, capped. Use Math.Min on ticks so we don't overflow with
+                // pathological multipliers / long deployments.
+                var nextTicks = (long)(Math.Max(delay.Ticks, TimeSpan.FromMilliseconds(100).Ticks) * _reconnect.BackoffMultiplier);
+                delay = TimeSpan.FromTicks(Math.Min(nextTicks, _reconnect.MaxDelay.Ticks));
+                if (attempt >= 10)
+                {
+                    // Bail after 10 attempts to surface persistent failure to the caller. With
+                    // the default backoff (1s base, 2.0x mult, 30s cap) this is roughly 4 minutes
+                    // of attempts; with InitialDelay=0 it's immediate up to the same cap.
+                    throw;
+                }
+            }
+        }
+    }
+
+    /// <summary>
+    ///     Reports whether the socket has been idle longer than the configured idle-disconnect
+    ///     threshold and should be proactively torn down + reconnected before the next transaction.
+    ///     Always <see langword="false"/> when no idle-disconnect timeout is configured.
+    /// </summary>
+    /// <returns><see langword="true"/> when the idle threshold has been exceeded.</returns>
+    public bool ShouldReconnectForIdle() =>
+        _idleDisconnect.HasValue && DateTime.UtcNow - _lastSuccessUtc > _idleDisconnect.Value;
+
+    /// <summary>Records that a transaction just succeeded, resetting the idle-disconnect clock.</summary>
+    public void MarkSuccess() => _lastSuccessUtc = DateTime.UtcNow;
+
+    /// <summary>Tears down the current socket + stream, leaving the lifecycle ready to reconnect.</summary>
+    /// <returns>A task representing the asynchronous teardown operation.</returns>
+    public async Task TearDownAsync()
+    {
+        try { if (_stream is not null) await _stream.DisposeAsync().ConfigureAwait(false); }
+        catch { /* best-effort */ }
+        _stream = null;
+        try { _client?.Dispose(); } catch { }
+        _client = null;
+    }
+
+    /// <summary>
+    ///     Enable SO_KEEPALIVE with aggressive probe timing. DL205/DL260 doesn't send keepalives
+    ///     itself; having the OS probe the socket every ~30s lets the driver notice a dead PLC
+    ///     or broken NAT path long before the default 2-hour Windows idle timeout fires.
+    ///     Non-fatal if the underlying OS rejects the option (some older Linux / container
+    ///     sandboxes don't expose the fine-grained timing levers — the driver still works,
+    ///     application-level probe still detects problems).
+    /// </summary>
+    private static void EnableKeepAlive(TcpClient client, ModbusKeepAliveOptions opts)
+    {
+        if (!opts.Enabled) return;
+        try
+        {
+            client.Client.SetSocketOption(SocketOptionLevel.Socket, SocketOptionName.KeepAlive, true);
+            // A TimeSpan < 1s previously truncated to 0 via the int cast,
+            // which Windows / Linux interpret as "use the default" — silently defeating the
+            // configured keep-alive timing. Round up to at least 1 second so a sub-second
+            // configuration still produces a real keep-alive cadence. Negative values are
+            // also clamped to 1 to avoid surfacing as OS errors.
+            client.Client.SetSocketOption(SocketOptionLevel.Tcp, SocketOptionName.TcpKeepAliveTime,
+                ClampToWholeSeconds(opts.Time));
+            client.Client.SetSocketOption(SocketOptionLevel.Tcp, SocketOptionName.TcpKeepAliveInterval,
+                ClampToWholeSeconds(opts.Interval));
+            client.Client.SetSocketOption(SocketOptionLevel.Tcp, SocketOptionName.TcpKeepAliveRetryCount, opts.RetryCount);
+        }
+        catch { /* best-effort; older OSes may not expose the granular knobs */ }
+    }
+
+    /// <summary>
+    ///     Cast a <see cref="TimeSpan"/> to a whole number of seconds with a
+    ///     minimum of 1 — protects callers from the int-cast truncation that turned 500 ms
+    ///     keep-alive timing into "use the default" on most OSes.
+    /// </summary>
+    /// <param name="ts">The timespan to clamp to whole seconds.</param>
+    /// <returns>The clamped duration expressed as a whole number of seconds, never less than 1.</returns>
+    internal static int ClampToWholeSeconds(TimeSpan ts)
+    {
+        var seconds = (int)Math.Ceiling(ts.TotalSeconds);
+        return seconds < 1 ? 1 : seconds;
+    }
+
+    /// <summary>
+    ///     Distinguish socket-layer failures (eligible for reconnect-and-retry) from
+    ///     protocol-layer failures (must propagate — retrying the same PDU won't help if the
+    ///     PLC just returned exception 02 Illegal Data Address).
+    /// </summary>
+    /// <param name="ex">The exception to classify.</param>
+    /// <returns><see langword="true"/> when the exception is a socket-level failure.</returns>
+    internal static bool IsSocketLevelFailure(Exception ex) =>
+        ex is EndOfStreamException
+        || ex is IOException
+        || ex is SocketException
+        || ex is ObjectDisposedException;
+
+    /// <summary>Asynchronously disposes the underlying socket + stream resources.</summary>
+    /// <returns>A task that represents the asynchronous operation.</returns>
+    public async ValueTask DisposeAsync()
+    {
+        try
+        {
+            if (_stream is not null) await _stream.DisposeAsync().ConfigureAwait(false);
+        }
+        catch { /* best-effort */ }
+        _client?.Dispose();
+    }
+}
@@ -3,13 +3,19 @@ using System.Net.Sockets;
 namespace ZB.MOM.WW.OtOpcUa.Driver.Modbus;

 /// <summary>
-///     Concrete Modbus TCP transport. Wraps a single <see cref="TcpClient"/> and serializes
-///     requests so at most one transaction is in-flight at a time — Modbus servers typically
-///     support concurrent transactions, but the single-flight model keeps the wire trace
+///     Concrete Modbus TCP transport. Wraps a single socket (owned by <see cref="ModbusSocketLifecycle"/>)
+///     and serializes requests so at most one transaction is in-flight at a time — Modbus servers
+///     typically support concurrent transactions, but the single-flight model keeps the wire trace
 ///     easy to diagnose and avoids interleaved-response correlation bugs.
 /// </summary>
 /// <remarks>
 ///     <para>
+///         Owns the MBAP framing (<see cref="SendOnceAsync"/>: 7-byte header + transaction-id
+///         pairing) and composes <see cref="ModbusSocketLifecycle"/> for the connect / reconnect /
+///         keep-alive / idle-disconnect machinery — the same lifecycle the RTU-over-TCP transport
+///         reuses with different framing.
+///     </para>
+///     <para>
 ///         Survives mid-transaction socket drops: when a send/read fails with a socket-level
 ///         error (<see cref="IOException"/>, <see cref="SocketException"/>, <see cref="EndOfStreamException"/>)
 ///         the transport disposes the dead socket, reconnects, and retries the PDU exactly
@@ -26,19 +32,11 @@ namespace ZB.MOM.WW.OtOpcUa.Driver.Modbus;
 /// </remarks>
 public sealed class ModbusTcpTransport : IModbusTransport
 {
-    private readonly string _host;
-    private readonly int _port;
+    private readonly ModbusSocketLifecycle _life;
    private readonly TimeSpan _timeout;
-    private readonly bool _autoReconnect;
-    private readonly ModbusKeepAliveOptions _keepAlive;
-    private readonly TimeSpan? _idleDisconnect;
-    private readonly ModbusReconnectOptions _reconnect;
    private readonly SemaphoreSlim _gate = new(1, 1);
-    private TcpClient? _client;
-    private NetworkStream? _stream;
    private ushort _nextTx;
    private bool _disposed;
-    private DateTime _lastSuccessUtc = DateTime.UtcNow;

    /// <summary>Initializes a new instance of the <see cref="ModbusTcpTransport"/> class.</summary>
    /// <param name="host">The host address or hostname of the Modbus server.</param>
@@ -54,84 +52,18 @@ public sealed class ModbusTcpTransport : IModbusTransport
        TimeSpan? idleDisconnect = null,
        ModbusReconnectOptions? reconnect = null)
    {
-        _host = host;
-        _port = port;
        _timeout = timeout;
-        _autoReconnect = autoReconnect;
-        _keepAlive = keepAlive ?? new ModbusKeepAliveOptions();
-        _idleDisconnect = idleDisconnect;
-        _reconnect = reconnect ?? new ModbusReconnectOptions();
+        _life = new ModbusSocketLifecycle(host, port, timeout, autoReconnect, keepAlive, idleDisconnect, reconnect);
    }

    /// <inheritdoc />
-    public async Task ConnectAsync(CancellationToken ct)
-    {
-        // Resolve the host explicitly + prefer IPv4. .NET's TcpClient default-constructor is
-        // dual-stack (IPv6 first, fallback to IPv4) — but most Modbus TCP devices (PLCs and
-        // simulators like pymodbus) bind 0.0.0.0 only, so the IPv6 attempt times out and we
-        // burn the entire ConnectAsync budget before even trying IPv4. Resolving first +
-        // dialing the IPv4 address directly sidesteps that.
-        var addresses = await System.Net.Dns.GetHostAddressesAsync(_host, ct).ConfigureAwait(false);
-        var ipv4 = System.Linq.Enumerable.FirstOrDefault(addresses,
-            a => a.AddressFamily == System.Net.Sockets.AddressFamily.InterNetwork);
-        var target = ipv4 ?? (addresses.Length > 0 ? addresses[0] : System.Net.IPAddress.Loopback);
-
-        _client = new TcpClient(target.AddressFamily);
-        EnableKeepAlive(_client, _keepAlive);
-
-        using var cts = CancellationTokenSource.CreateLinkedTokenSource(ct);
-        cts.CancelAfter(_timeout);
-        await _client.ConnectAsync(target, _port, cts.Token).ConfigureAwait(false);
-        _stream = _client.GetStream();
-        _lastSuccessUtc = DateTime.UtcNow;
-    }
-
-    /// <summary>
-    ///     Enable SO_KEEPALIVE with aggressive probe timing. DL205/DL260 doesn't send keepalives
-    ///     itself; having the OS probe the socket every ~30s lets the driver notice a dead PLC
-    ///     or broken NAT path long before the default 2-hour Windows idle timeout fires.
-    ///     Non-fatal if the underlying OS rejects the option (some older Linux / container
-    ///     sandboxes don't expose the fine-grained timing levers — the driver still works,
-    ///     application-level probe still detects problems).
-    /// </summary>
-    private static void EnableKeepAlive(TcpClient client, ModbusKeepAliveOptions opts)
-    {
-        if (!opts.Enabled) return;
-        try
-        {
-            client.Client.SetSocketOption(SocketOptionLevel.Socket, SocketOptionName.KeepAlive, true);
-            // A TimeSpan < 1s previously truncated to 0 via the int cast,
-            // which Windows / Linux interpret as "use the default" — silently defeating the
-            // configured keep-alive timing. Round up to at least 1 second so a sub-second
-            // configuration still produces a real keep-alive cadence. Negative values are
-            // also clamped to 1 to avoid surfacing as OS errors.
-            client.Client.SetSocketOption(SocketOptionLevel.Tcp, SocketOptionName.TcpKeepAliveTime,
-                ClampToWholeSeconds(opts.Time));
-            client.Client.SetSocketOption(SocketOptionLevel.Tcp, SocketOptionName.TcpKeepAliveInterval,
-                ClampToWholeSeconds(opts.Interval));
-            client.Client.SetSocketOption(SocketOptionLevel.Tcp, SocketOptionName.TcpKeepAliveRetryCount, opts.RetryCount);
-        }
-        catch { /* best-effort; older OSes may not expose the granular knobs */ }
-    }
-
-    /// <summary>
-    ///     Cast a <see cref="TimeSpan"/> to a whole number of seconds with a
-    ///     minimum of 1 — protects callers from the int-cast truncation that turned 500 ms
-    ///     keep-alive timing into "use the default" on most OSes.
-    /// </summary>
-    /// <param name="ts">The timespan to clamp to whole seconds.</param>
-    /// <returns>The clamped duration expressed as a whole number of seconds, never less than 1.</returns>
-    internal static int ClampToWholeSeconds(TimeSpan ts)
-    {
-        var seconds = (int)Math.Ceiling(ts.TotalSeconds);
-        return seconds < 1 ? 1 : seconds;
-    }
+    public Task ConnectAsync(CancellationToken ct) => _life.ConnectAsync(ct);

    /// <inheritdoc />
    public async Task<byte[]> SendAsync(byte unitId, byte[] pdu, CancellationToken ct)
    {
        if (_disposed) throw new ObjectDisposedException(nameof(ModbusTcpTransport));
-        if (_stream is null) throw new InvalidOperationException("Transport not connected");
+        if (_life.Stream is null) throw new InvalidOperationException("Transport not connected");

        await _gate.WaitAsync(ct).ConfigureAwait(false);
        try
@@ -140,27 +72,27 @@ public sealed class ModbusTcpTransport : IModbusTransport
            // threshold, tear it down + reconnect before this PDU lands. Defends against silent
            // NAT / firewall reaping where the socket looks alive locally but the upstream side
            // dropped it minutes ago.
-            if (_idleDisconnect.HasValue && DateTime.UtcNow - _lastSuccessUtc > _idleDisconnect.Value)
+            if (_life.ShouldReconnectForIdle())
            {
-                await TearDownAsync().ConfigureAwait(false);
-                await ConnectWithBackoffAsync(ct).ConfigureAwait(false);
+                await _life.TearDownAsync().ConfigureAwait(false);
+                await _life.ConnectWithBackoffAsync(ct).ConfigureAwait(false);
            }

            try
            {
                var result = await SendOnceAsync(unitId, pdu, ct).ConfigureAwait(false);
-                _lastSuccessUtc = DateTime.UtcNow;
+                _life.MarkSuccess();
                return result;
            }
-            catch (Exception ex) when (_autoReconnect && IsSocketLevelFailure(ex))
+            catch (Exception ex) when (_life.AutoReconnect && ModbusSocketLifecycle.IsSocketLevelFailure(ex))
            {
                // Mid-transaction drop: tear down the dead socket, reconnect (with backoff if
                // configured), resend. Single retry — if it fails again, let it propagate so
                // health/status reflect reality.
-                await TearDownAsync().ConfigureAwait(false);
-                await ConnectWithBackoffAsync(ct).ConfigureAwait(false);
+                await _life.TearDownAsync().ConfigureAwait(false);
+                await _life.ConnectWithBackoffAsync(ct).ConfigureAwait(false);
                var result = await SendOnceAsync(unitId, pdu, ct).ConfigureAwait(false);
-                _lastSuccessUtc = DateTime.UtcNow;
+                _life.MarkSuccess();
                return result;
            }
        }
@@ -170,43 +102,6 @@ public sealed class ModbusTcpTransport : IModbusTransport
        }
    }

-    /// <summary>
-    ///     Connect attempt with the configured geometric backoff. The first attempt fires after
-    ///     <see cref="ModbusReconnectOptions.InitialDelay"/> (default zero — immediate); each
-    ///     subsequent attempt sleeps for the previous delay times <c>BackoffMultiplier</c>,
-    ///     capped at <c>MaxDelay</c>. Caller's cancellation token aborts the loop.
-    /// </summary>
-    private async Task ConnectWithBackoffAsync(CancellationToken ct)
-    {
-        var delay = _reconnect.InitialDelay;
-        var attempt = 0;
-        while (true)
-        {
-            if (delay > TimeSpan.Zero)
-                await Task.Delay(delay, ct).ConfigureAwait(false);
-            try
-            {
-                await ConnectAsync(ct).ConfigureAwait(false);
-                return;
-            }
-            catch (Exception ex) when (IsSocketLevelFailure(ex) && _autoReconnect)
-            {
-                attempt++;
-                // Geometric growth, capped. Use Math.Min on ticks so we don't overflow with
-                // pathological multipliers / long deployments.
-                var nextTicks = (long)(Math.Max(delay.Ticks, TimeSpan.FromMilliseconds(100).Ticks) * _reconnect.BackoffMultiplier);
-                delay = TimeSpan.FromTicks(Math.Min(nextTicks, _reconnect.MaxDelay.Ticks));
-                if (attempt >= 10)
-                {
-                    // Bail after 10 attempts to surface persistent failure to the caller. With
-                    // the default backoff (1s base, 2.0x mult, 30s cap) this is roughly 4 minutes
-                    // of attempts; with InitialDelay=0 it's immediate up to the same cap.
-                    throw;
-                }
-            }
-        }
-    }
-
    /// <summary>
    ///     Executes exactly one Modbus transaction on the current socket.
    /// </summary>
@@ -230,7 +125,8 @@ public sealed class ModbusTcpTransport : IModbusTransport
    /// </remarks>
    private async Task<byte[]> SendOnceAsync(byte unitId, byte[] pdu, CancellationToken ct)
    {
-        if (_stream is null) throw new InvalidOperationException("Transport not connected");
+        var stream = _life.Stream;
+        if (stream is null) throw new InvalidOperationException("Transport not connected");
        var txId = ++_nextTx;

        // MBAP: [TxId(2)][Proto=0(2)][Length(2)][UnitId(1)] + PDU
@@ -248,11 +144,11 @@ public sealed class ModbusTcpTransport : IModbusTransport
        cts.CancelAfter(_timeout);
        try
        {
-            await _stream.WriteAsync(adu.AsMemory(), cts.Token).ConfigureAwait(false);
-            await _stream.FlushAsync(cts.Token).ConfigureAwait(false);
+            await stream.WriteAsync(adu.AsMemory(), cts.Token).ConfigureAwait(false);
+            await stream.FlushAsync(cts.Token).ConfigureAwait(false);

            var header = new byte[7];
-            await ReadExactlyAsync(_stream, header, cts.Token).ConfigureAwait(false);
+            await ReadExactlyAsync(stream, header, cts.Token).ConfigureAwait(false);
            var respTxId = (ushort)((header[0] << 8) | header[1]);
            if (respTxId != txId)
                throw new ModbusTransportDesyncException(
@@ -264,7 +160,7 @@ public sealed class ModbusTcpTransport : IModbusTransport
                    ModbusTransportDesyncException.DesyncReason.TruncatedFrame,
                    $"Modbus response length too small: {respLen}");
            var respPdu = new byte[respLen - 1];
-            await ReadExactlyAsync(_stream, respPdu, cts.Token).ConfigureAwait(false);
+            await ReadExactlyAsync(stream, respPdu, cts.Token).ConfigureAwait(false);

            // Exception PDU: function code has high bit set. This is a well-formed protocol-level
            // error — the socket is still coherent, so it MUST propagate without teardown.
@@ -280,7 +176,7 @@ public sealed class ModbusTcpTransport : IModbusTransport
        catch (ModbusTransportDesyncException)
        {
            // Framing violation: the socket is desynchronized — never reuse it.
-            await TearDownAsync().ConfigureAwait(false);
+            await _life.TearDownAsync().ConfigureAwait(false);
            throw;
        }
        catch (OperationCanceledException) when (!ct.IsCancellationRequested)
@@ -288,33 +184,13 @@ public sealed class ModbusTcpTransport : IModbusTransport
            // Per-op timeout fired (NOT the caller). The response is unknown / may still land later
            // and corrupt the next read — tear the socket down and normalize as a desync so the
            // reconnect retry / status mapping engages.
-            await TearDownAsync().ConfigureAwait(false);
+            await _life.TearDownAsync().ConfigureAwait(false);
            throw new ModbusTransportDesyncException(
                ModbusTransportDesyncException.DesyncReason.Timeout,
                $"Modbus per-op response timeout after {_timeout.TotalMilliseconds:0}ms");
        }
    }

-    /// <summary>
-    ///     Distinguish socket-layer failures (eligible for reconnect-and-retry) from
-    ///     protocol-layer failures (must propagate — retrying the same PDU won't help if the
-    ///     PLC just returned exception 02 Illegal Data Address).
-    /// </summary>
-    private static bool IsSocketLevelFailure(Exception ex) =>
-        ex is EndOfStreamException
-        || ex is IOException
-        || ex is SocketException
-        || ex is ObjectDisposedException;
-
-    private async Task TearDownAsync()
-    {
-        try { if (_stream is not null) await _stream.DisposeAsync().ConfigureAwait(false); }
-        catch { /* best-effort */ }
-        _stream = null;
-        try { _client?.Dispose(); } catch { }
-        _client = null;
-    }
-
    private static async Task ReadExactlyAsync(Stream s, byte[] buf, CancellationToken ct)
    {
        var read = 0;
@@ -332,12 +208,7 @@ public sealed class ModbusTcpTransport : IModbusTransport
    {
        if (_disposed) return;
        _disposed = true;
-        try
-        {
-            if (_stream is not null) await _stream.DisposeAsync().ConfigureAwait(false);
-        }
-        catch { /* best-effort */ }
-        _client?.Dispose();
+        await _life.DisposeAsync().ConfigureAwait(false);
        _gate.Dispose();
    }
 }
@@ -1,9 +1,10 @@
 namespace ZB.MOM.WW.OtOpcUa.Driver.Modbus;

 /// <summary>
-///     Raised when a Modbus TCP transaction leaves the single-flight socket in an unknown /
+///     Raised when a Modbus transaction leaves the single-flight socket in an unknown /
 ///     desynchronized state — a per-op response timeout, or a framing violation (transaction-id
-///     mismatch or truncated MBAP length). Unlike a Modbus <em>exception PDU</em> (a well-formed
+///     mismatch, truncated frame, RTU CRC mismatch, or RTU unit-address mismatch). Unlike a Modbus
+///     <em>exception PDU</em> (a well-formed
 ///     protocol-level error where the socket is still coherent and the request must simply
 ///     propagate), a desync means bytes may still be in flight or half-read, so the socket is
 ///     unusable and MUST be torn down before this is thrown.
@@ -27,8 +28,20 @@ public sealed class ModbusTransportDesyncException : IOException
        /// <summary>The response MBAP transaction id did not match the request's.</summary>
        TxIdMismatch,

-        /// <summary>The response MBAP length field was below the mandatory minimum (truncated frame).</summary>
+        /// <summary>
+        ///     The frame ended before it was complete — the MBAP length field was below the mandatory
+        ///     minimum (TCP), or the stream closed mid-frame while reading a length-less RTU frame.
+        /// </summary>
        TruncatedFrame,
+
+        /// <summary>The RTU frame's trailing CRC-16 did not validate over the received bytes.</summary>
+        CrcMismatch,
+
+        /// <summary>
+        ///     A CRC-valid RTU frame carried a slave/unit address other than the one addressed — on an
+        ///     RS-485 multi-drop bus, a reply from the wrong slave.
+        /// </summary>
+        UnitMismatch,
    }

    /// <summary>Gets the reason the socket was classified desynchronized.</summary>
@@ -0,0 +1,43 @@
+namespace ZB.MOM.WW.OtOpcUa.Driver.Modbus;
+
+/// <summary>
+///     Single mapping point from <see cref="ModbusDriverOptions"/> to the concrete
+///     <see cref="IModbusTransport"/> its <see cref="ModbusDriverOptions.Transport"/> selects.
+///     Consumed by both <see cref="ModbusDriver"/>'s default transport-factory closure and the
+///     AdminUI Test-Connect probe, so the <see cref="ModbusTransportMode"/> switch lives in
+///     exactly one place.
+/// </summary>
+public static class ModbusTransportFactory
+{
+    /// <summary>
+    ///     Builds the transport <paramref name="options"/>.<see cref="ModbusDriverOptions.Transport"/>
+    ///     selects, threading every shared connection setting (Host/Port/Timeout/AutoReconnect/
+    ///     KeepAlive/IdleDisconnectTimeout/Reconnect) through to whichever concrete transport is built.
+    /// </summary>
+    /// <param name="options">Driver configuration options.</param>
+    /// <returns>A <see cref="ModbusRtuOverTcpTransport"/> when <see cref="ModbusTransportMode.RtuOverTcp"/>
+    /// is selected; a <see cref="ModbusTcpTransport"/> when <see cref="ModbusTransportMode.Tcp"/> is selected.</returns>
+    /// <exception cref="ArgumentOutOfRangeException">
+    /// <paramref name="options"/>.<see cref="ModbusDriverOptions.Transport"/> is not a recognized
+    /// <see cref="ModbusTransportMode"/> member — fail loudly rather than silently falling back to TCP/MBAP.
+    /// </exception>
+    public static IModbusTransport Create(ModbusDriverOptions options)
+    {
+        ArgumentNullException.ThrowIfNull(options);
+        return options.Transport switch
+        {
+            ModbusTransportMode.RtuOverTcp => new ModbusRtuOverTcpTransport(
+                options.Host, options.Port, options.Timeout, options.AutoReconnect,
+                keepAlive: options.KeepAlive,
+                idleDisconnect: options.IdleDisconnectTimeout,
+                reconnect: options.Reconnect),
+            ModbusTransportMode.Tcp => new ModbusTcpTransport(
+                options.Host, options.Port, options.Timeout, options.AutoReconnect,
+                keepAlive: options.KeepAlive,
+                idleDisconnect: options.IdleDisconnectTimeout,
+                reconnect: options.Reconnect),
+            _ => throw new ArgumentOutOfRangeException(
+                nameof(options), options.Transport, "Unknown Modbus transport mode."),
+        };
+    }
+}
@@ -1,201 +0,0 @@
-using System.Text;
-
-namespace ZB.MOM.WW.OtOpcUa.Driver.Sql.Browser;
-
-/// <summary>Which catalog level a browse <c>NodeId</c> addresses.</summary>
-public enum SqlBrowseNodeKind
-{
-    /// <summary>A schema — the browse root level.</summary>
-    Schema,
-
-    /// <summary>A table or view inside a schema.</summary>
-    Table,
-
-    /// <summary>A column of a table or view — the terminal (leaf) level.</summary>
-    Column,
-}
-
-/// <summary>A decoded browse <c>NodeId</c>.</summary>
-/// <param name="Kind">Which catalog level this reference addresses.</param>
-/// <param name="Schema">The schema name. Always present.</param>
-/// <param name="Table">The table/view name; <c>null</c> for <see cref="SqlBrowseNodeKind.Schema"/>.</param>
-/// <param name="Column">The column name; <c>null</c> unless <see cref="SqlBrowseNodeKind.Column"/>.</param>
-public readonly record struct SqlBrowseNodeRef(
-    SqlBrowseNodeKind Kind,
-    string Schema,
-    string? Table,
-    string? Column);
-
-/// <summary>
-///     Codec for the browse <c>NodeId</c>s the SQL schema browser hands the picker, and the picker hands back
-///     on expand / attribute fetch / column commit.
-///     <para><b>Why not the design's literal <c>schema.table|column</c>.</b> That sketch assumes <c>.</c> and
-///     <c>|</c> cannot occur inside an identifier. They can: SQL Server permits essentially any character
-///     inside a quoted (bracketed) identifier, and <c>SqlServerDialect.QuoteIdentifier</c> deliberately passes
-///     both through — only <c>]</c>, control characters and Unicode format characters are special to it. So
-///     <c>main.a.b|c</c> decodes equally as schema <c>main</c> + table <c>a.b</c> and as schema <c>main.a</c>
-///     + table <c>b</c>, and a table named <c>x|y</c> loses its second half entirely. That is not a cosmetic
-///     bug: the operator clicks one column, the NodeId decodes to a different one, and the tag they author
-///     polls the wrong data forever — silently, because the wrong column usually exists and usually reads.
-///     </para>
-///     <para><b>The encoding.</b> <c>&lt;kind&gt;:&lt;part&gt;[|&lt;part&gt;…]</c>, where <c>kind</c> is one
-///     of <c>schema</c> / <c>table</c> / <c>column</c> and every part is escaped so no identifier character
-///     can be mistaken for structure: a literal <c>\</c> becomes <c>\\</c> and a literal <c>|</c> becomes
-///     <c>\|</c>. <c>.</c> needs no escape at all — it is not structural here — so the common case stays
-///     readable (<c>column:dbo|TagValues|num_value</c>). The kind prefix carries the arity, so decoding never
-///     has to guess how many parts a name "should" have; a part count that disagrees with the kind is
-///     rejected rather than truncated or padded.</para>
-///     <para><b>Public on purpose</b>, unlike the session itself: the AdminUI picker body decodes a committed
-///     column NodeId back into schema/table/column to compose the tag's <c>TagConfig</c>. Encode and decode
-///     must stay in one place — a second, hand-rolled split in the picker is exactly the defect this type
-///     exists to prevent.</para>
-/// </summary>
-public static class SqlBrowseNodeId
-{
-    private const char Separator = '|';
-    private const char Escape = '\\';
-    private const char KindTerminator = ':';
-
-    private const string SchemaKind = "schema";
-    private const string TableKind = "table";
-    private const string ColumnKind = "column";
-
-    /// <summary>Encodes a schema-level NodeId.</summary>
-    /// <param name="schema">The schema name, exactly as the catalog reports it.</param>
-    /// <returns>The encoded NodeId.</returns>
-    /// <exception cref="ArgumentException"><paramref name="schema"/> is null, empty or whitespace.</exception>
-    public static string ForSchema(string schema) => Encode(SchemaKind, schema);
-
-    /// <summary>Encodes a table-level NodeId.</summary>
-    /// <param name="schema">The schema name, exactly as the catalog reports it.</param>
-    /// <param name="table">The table or view name, exactly as the catalog reports it.</param>
-    /// <returns>The encoded NodeId.</returns>
-    /// <exception cref="ArgumentException">Either name is null, empty or whitespace.</exception>
-    public static string ForTable(string schema, string table) => Encode(TableKind, schema, table);
-
-    /// <summary>Encodes a column-level (leaf) NodeId.</summary>
-    /// <param name="schema">The schema name, exactly as the catalog reports it.</param>
-    /// <param name="table">The table or view name, exactly as the catalog reports it.</param>
-    /// <param name="column">The column name, exactly as the catalog reports it.</param>
-    /// <returns>The encoded NodeId.</returns>
-    /// <exception cref="ArgumentException">Any name is null, empty or whitespace.</exception>
-    public static string ForColumn(string schema, string table, string column) =>
-        Encode(ColumnKind, schema, table, column);
-
-    /// <summary>Attempts to decode a NodeId.</summary>
-    /// <param name="nodeId">The NodeId to decode.</param>
-    /// <param name="reference">The decoded reference on success; <c>default</c> otherwise.</param>
-    /// <returns><c>true</c> when <paramref name="nodeId"/> is a well-formed SQL browse NodeId.</returns>
-    public static bool TryParse(string? nodeId, out SqlBrowseNodeRef reference)
-    {
-        reference = default;
-        if (string.IsNullOrWhiteSpace(nodeId)) return false;
-
-        var terminator = nodeId.IndexOf(KindTerminator, StringComparison.Ordinal);
-        if (terminator <= 0) return false;
-
-        var kind = nodeId[..terminator];
-        if (!TrySplit(nodeId[(terminator + 1)..], out var parts)) return false;
-        if (parts.Exists(string.IsNullOrWhiteSpace)) return false;
-
-        switch (kind)
-        {
-            case SchemaKind when parts.Count == 1:
-                reference = new SqlBrowseNodeRef(SqlBrowseNodeKind.Schema, parts[0], null, null);
-                return true;
-            case TableKind when parts.Count == 2:
-                reference = new SqlBrowseNodeRef(SqlBrowseNodeKind.Table, parts[0], parts[1], null);
-                return true;
-            case ColumnKind when parts.Count == 3:
-                reference = new SqlBrowseNodeRef(SqlBrowseNodeKind.Column, parts[0], parts[1], parts[2]);
-                return true;
-            default:
-                return false;
-        }
-    }
-
-    /// <summary>
-    ///     Decodes a NodeId, throwing when it is malformed.
-    ///     <para>The message deliberately does <b>not</b> echo the offending value: a NodeId can carry an
-    ///     arbitrary authored identifier and this text reaches the AdminUI's inline error and the log.</para>
-    /// </summary>
-    /// <param name="nodeId">The NodeId to decode.</param>
-    /// <returns>The decoded reference.</returns>
-    /// <exception cref="ArgumentException">The value is not a well-formed SQL browse NodeId.</exception>
-    public static SqlBrowseNodeRef Parse(string? nodeId)
-    {
-        if (TryParse(nodeId, out var reference)) return reference;
-        throw new ArgumentException(
-            "Not a SQL schema-browse node. Expected 'schema:<schema>', 'table:<schema>|<table>' or " +
-            "'column:<schema>|<table>|<column>'. Re-open the browser and expand from the root.",
-            nameof(nodeId));
-    }
-
-    private static string Encode(string kind, params string[] parts)
-    {
-        var builder = new StringBuilder(kind.Length + 1 + (parts.Length * 16));
-        builder.Append(kind).Append(KindTerminator);
-        for (var i = 0; i < parts.Length; i++)
-        {
-            if (string.IsNullOrWhiteSpace(parts[i]))
-            {
-                throw new ArgumentException(
-                    "A SQL catalog name in a browse node may not be empty or whitespace.", nameof(parts));
-            }
-
-            if (i > 0) builder.Append(Separator);
-            AppendEscaped(builder, parts[i]);
-        }
-
-        return builder.ToString();
-    }
-
-    private static void AppendEscaped(StringBuilder builder, string part)
-    {
-        foreach (var ch in part)
-        {
-            if (ch is Separator or Escape) builder.Append(Escape);
-            builder.Append(ch);
-        }
-    }
-
-    /// <summary>
-    ///     Splits an encoded payload on <b>unescaped</b> separators, unescaping as it goes. Returns
-    ///     <c>false</c> on a dangling trailing escape, which cannot be produced by
-    ///     <see cref="AppendEscaped"/> and therefore means the value was hand-made or truncated.
-    /// </summary>
-    private static bool TrySplit(string payload, out List<string> parts)
-    {
-        parts = [];
-        var current = new StringBuilder(payload.Length);
-        var escaped = false;
-
-        foreach (var ch in payload)
-        {
-            if (escaped)
-            {
-                current.Append(ch);
-                escaped = false;
-                continue;
-            }
-
-            switch (ch)
-            {
-                case Escape:
-                    escaped = true;
-                    break;
-                case Separator:
-                    parts.Add(current.ToString());
-                    current.Clear();
-                    break;
-                default:
-                    current.Append(ch);
-                    break;
-            }
-        }
-
-        if (escaped) return false;
-        parts.Add(current.ToString());
-        return true;
-    }
-}
@@ -1,304 +0,0 @@
-using System.Data;
-using System.Data.Common;
-using ZB.MOM.WW.OtOpcUa.Commons.Browsing;
-
-namespace ZB.MOM.WW.OtOpcUa.Driver.Sql.Browser;
-
-/// <summary>
-///     Live, one-level-per-call walk of a relational catalog: schemas → tables/views → columns, with the
-///     column's mapped <c>DriverDataType</c> in the attribute side-panel (design §4.1, mirroring Galaxy's
-///     two-stage object-then-attribute pick). Created by <c>SqlDriverBrowser</c> on picker open and owned by
-///     the AdminUI's <c>BrowseSessionRegistry</c>, whose TTL reaper disposes idle sessions.
-///     <para><b>Every level is the dialect's catalog SQL</b> (<see cref="ISqlDialect.ListSchemasSql"/> /
-///     <see cref="ISqlDialect.ListTablesSql"/> / <see cref="ISqlDialect.ListColumnsSql"/>) — nothing here
-///     knows what <c>INFORMATION_SCHEMA</c> is, because Oracle and SQLite do not have it. The catalog SQL is
-///     read verbatim and <c>@schema</c> / <c>@table</c> are <b>bound as parameters</b>; no name from a NodeId
-///     is ever concatenated into a command text, so a hostile or merely awkward catalog name is inert here.
-///     <see cref="ISqlDialect.QuoteIdentifier"/> is deliberately <em>not</em> used on this path — the browse
-///     never needs an identifier in text.</para>
-///     <para><b>Connection ownership: this session owns the connection it is handed and closes it on
-///     <see cref="DisposeAsync"/>.</b> It does not open one, and it never re-opens a closed one. The handoff
-///     is the same as the Galaxy and OPC UA client sessions': the browser owns the connection only until
-///     construction succeeds, after which the registry-held session is the sole thing with a lifetime hook —
-///     if the session did not close it, nothing would, and every reaped picker would leak a pooled
-///     connection.</para>
-///     <para><b>No timeout of its own.</b> The AdminUI already bounds each root/expand/attributes call with a
-///     20-second linked CTS (<c>BrowserSessionService.PerCallTimeout</c>); this session's job is simply to
-///     honour the token it is handed, into the gate wait and into every ADO.NET call. Adding a second
-///     independent deadline here would only produce two competing, differently-worded failures.</para>
-/// </summary>
-internal sealed class SqlBrowseSession : IBrowseSession
-{
-    /// <summary>Column alias every dialect's <see cref="ISqlDialect.ListSchemasSql"/> projects.</summary>
-    private const string SchemaColumn = "TABLE_SCHEMA";
-
-    /// <summary>Column alias every dialect's <see cref="ISqlDialect.ListTablesSql"/> projects.</summary>
-    private const string TableNameColumn = "TABLE_NAME";
-
-    /// <summary>Column alias carrying <c>BASE TABLE</c> / <c>VIEW</c>.</summary>
-    private const string TableTypeColumn = "TABLE_TYPE";
-
-    /// <summary>Column alias every dialect's <see cref="ISqlDialect.ListColumnsSql"/> projects.</summary>
-    private const string ColumnNameColumn = "COLUMN_NAME";
-
-    /// <summary>Column alias carrying the SQL type family name.</summary>
-    private const string DataTypeColumn = "DATA_TYPE";
-
-    /// <summary>The <c>TABLE_TYPE</c> value marking a view rather than a base table.</summary>
-    private const string ViewTableType = "VIEW";
-
-    /// <summary>
-    ///     The security class every browsed column reports. The <c>Sql</c> driver is read-only in v1
-    ///     (design §4.3), so there is nothing else a picked column could be.
-    /// </summary>
-    private const string ReadOnlySecurityClass = "ViewOnly";
-
-    private readonly DbConnection _connection;
-    private readonly ISqlDialect _dialect;
-
-    /// <summary>
-    ///     Serializes catalog calls. One ADO.NET connection carries at most one active command/reader, and
-    ///     the AdminUI tree happily fires several expands at once when an operator clicks quickly.
-    /// </summary>
-    private readonly SemaphoreSlim _gate = new(1, 1);
-
-    private volatile bool _disposed;
-
-    /// <summary>Constructs a session over an already-open connection, which it takes ownership of.</summary>
-    /// <param name="connection">The open connection to browse. Closed by <see cref="DisposeAsync"/>.</param>
-    /// <param name="dialect">The dialect supplying the catalog SQL and the column-type map.</param>
-    internal SqlBrowseSession(DbConnection connection, ISqlDialect dialect)
-    {
-        _connection = connection ?? throw new ArgumentNullException(nameof(connection));
-        _dialect = dialect ?? throw new ArgumentNullException(nameof(dialect));
-    }
-
-    /// <inheritdoc />
-    public Guid Token { get; } = Guid.NewGuid();
-
-    /// <inheritdoc />
-    public DateTime LastUsedUtc { get; private set; } = DateTime.UtcNow;
-
-    /// <inheritdoc />
-    public async Task<IReadOnlyList<BrowseNode>> RootAsync(CancellationToken cancellationToken)
-    {
-        var schemas = await QueryAsync(
-            _dialect.ListSchemasSql,
-            static _ => { },
-            static reader => ReadString(reader, SchemaColumn),
-            cancellationToken).ConfigureAwait(false);
-
-        var nodes = new List<BrowseNode>(schemas.Count);
-        foreach (var schema in schemas)
-        {
-            if (string.IsNullOrWhiteSpace(schema)) continue;
-            nodes.Add(new BrowseNode(
-                NodeId: SqlBrowseNodeId.ForSchema(schema),
-                DisplayName: schema,
-                Kind: BrowseNodeKind.Folder,
-                HasChildrenHint: true));
-        }
-
-        return nodes;
-    }
-
-    /// <inheritdoc />
-    /// <exception cref="ArgumentException"><paramref name="nodeId"/> is not a SQL schema-browse node.</exception>
-    public async Task<IReadOnlyList<BrowseNode>> ExpandAsync(string nodeId, CancellationToken cancellationToken)
-    {
-        ObjectDisposedException.ThrowIf(_disposed, this);
-        var reference = SqlBrowseNodeId.Parse(nodeId);
-        switch (reference.Kind)
-        {
-            case SqlBrowseNodeKind.Schema:
-                return await ExpandSchemaAsync(reference.Schema, cancellationToken).ConfigureAwait(false);
-            case SqlBrowseNodeKind.Table:
-                return await ExpandTableAsync(reference.Schema, reference.Table!, cancellationToken)
-                    .ConfigureAwait(false);
-            default:
-                // A column is terminal. Expanding one is a UI no-op, never an error — the tree may ask before
-                // it has re-read the node's Kind.
-                LastUsedUtc = DateTime.UtcNow;
-                return Array.Empty<BrowseNode>();
-        }
-    }
-
-    /// <inheritdoc />
-    /// <exception cref="ArgumentException"><paramref name="nodeId"/> is not a SQL schema-browse node.</exception>
-    public async Task<IReadOnlyList<AttributeInfo>> AttributesAsync(
-        string nodeId, CancellationToken cancellationToken)
-    {
-        ObjectDisposedException.ThrowIf(_disposed, this);
-        var reference = SqlBrowseNodeId.Parse(nodeId);
-        if (reference.Kind != SqlBrowseNodeKind.Column)
-        {
-            // Schemas and tables have no side-panel — same shape as the OPC UA client browser, whose tree is
-            // uniform and returns empty for every node.
-            LastUsedUtc = DateTime.UtcNow;
-            return Array.Empty<AttributeInfo>();
-        }
-
-        var columns = await ReadColumnsAsync(
-            reference.Schema, reference.Table!, cancellationToken).ConfigureAwait(false);
-
-        // Ordinal: a column NodeId is only ever minted from this same catalog output, so its case is the
-        // catalog's own. A case-insensitive match would pick the wrong column on a case-sensitive collation
-        // that legitimately carries both "Value" and "value".
-        foreach (var column in columns)
-        {
-            if (!string.Equals(column.Name, reference.Column, StringComparison.Ordinal)) continue;
-            return
-            [
-                new AttributeInfo(
-                    Name: column.Name,
-                    DriverDataType: _dialect.MapColumnType(column.DataType).ToString(),
-                    IsArray: false,
-                    SecurityClass: ReadOnlySecurityClass),
-            ];
-        }
-
-        // The column is gone (dropped since the expand, or the NodeId was hand-made). An empty side-panel is
-        // the honest answer; the picker simply has nothing to prefill.
-        return Array.Empty<AttributeInfo>();
-    }
-
-    /// <summary>
-    ///     Idempotently closes the owned connection and the gate. Errors are swallowed: the registry's reaper
-    ///     may be racing a server-side disconnect, and a failed close must never surface in the AdminUI.
-    /// </summary>
-    /// <returns>A task that represents the asynchronous operation.</returns>
-    public async ValueTask DisposeAsync()
-    {
-        if (_disposed) return;
-        _disposed = true;
-
-        try { await _connection.DisposeAsync().ConfigureAwait(false); }
-        catch { /* best-effort: the connection may already be broken or closed. */ }
-
-        try { _gate.Dispose(); }
-        catch { /* best-effort: a concurrent second dispose already tore it down. */ }
-    }
-
-    private async Task<IReadOnlyList<BrowseNode>> ExpandSchemaAsync(string schema, CancellationToken ct)
-    {
-        var rows = await QueryAsync(
-            _dialect.ListTablesSql,
-            command => Bind(command, "@schema", schema),
-            static reader => (
-                Name: ReadString(reader, TableNameColumn),
-                Type: ReadOptionalString(reader, TableTypeColumn)),
-            ct).ConfigureAwait(false);
-
-        var nodes = new List<BrowseNode>(rows.Count);
-        foreach (var (name, type) in rows)
-        {
-            if (string.IsNullOrWhiteSpace(name)) continue;
-            var isView = string.Equals(type, ViewTableType, StringComparison.OrdinalIgnoreCase);
-            nodes.Add(new BrowseNode(
-                NodeId: SqlBrowseNodeId.ForTable(schema, name),
-                // The label is decorated, never the NodeId — a view and a table of the same name in the same
-                // schema cannot exist, so the suffix is presentation only.
-                DisplayName: isView ? $"{name} (view)" : name,
-                Kind: BrowseNodeKind.Folder,
-                HasChildrenHint: true));
-        }
-
-        return nodes;
-    }
-
-    private async Task<IReadOnlyList<BrowseNode>> ExpandTableAsync(
-        string schema, string table, CancellationToken ct)
-    {
-        var columns = await ReadColumnsAsync(schema, table, ct).ConfigureAwait(false);
-
-        var nodes = new List<BrowseNode>(columns.Count);
-        foreach (var column in columns)
-        {
-            if (string.IsNullOrWhiteSpace(column.Name)) continue;
-            nodes.Add(new BrowseNode(
-                NodeId: SqlBrowseNodeId.ForColumn(schema, table, column.Name),
-                DisplayName: column.Name,
-                Kind: BrowseNodeKind.Leaf,
-                HasChildrenHint: false));
-        }
-
-        return nodes;
-    }
-
-    /// <summary>
-    ///     Reads one table's columns. A table that no longer exists (or never did) yields an empty list rather
-    ///     than an error: the catalog answering "no rows" is indistinguishable from a genuinely column-less
-    ///     relation, and neither is a reason to fail an operator's click.
-    /// </summary>
-    private Task<List<(string Name, string DataType)>> ReadColumnsAsync(
-        string schema, string table, CancellationToken ct) =>
-        QueryAsync(
-            _dialect.ListColumnsSql,
-            command =>
-            {
-                Bind(command, "@schema", schema);
-                Bind(command, "@table", table);
-            },
-            static reader => (
-                Name: ReadString(reader, ColumnNameColumn),
-                DataType: ReadOptionalString(reader, DataTypeColumn) ?? string.Empty),
-            ct);
-
-    /// <summary>
-    ///     Runs one catalog query under the gate and projects every row. The disposed check happens
-    ///     <em>inside</em> the gate wait so a dispose racing an in-flight call cannot be missed, and
-    ///     <see cref="LastUsedUtc"/> only advances on a call that actually completed.
-    /// </summary>
-    private async Task<List<T>> QueryAsync<T>(
-        string sql,
-        Action<DbCommand> bind,
-        Func<DbDataReader, T> project,
-        CancellationToken cancellationToken)
-    {
-        ObjectDisposedException.ThrowIf(_disposed, this);
-        await _gate.WaitAsync(cancellationToken).ConfigureAwait(false);
-        try
-        {
-            ObjectDisposedException.ThrowIf(_disposed, this);
-
-            var results = new List<T>();
-            await using var command = _connection.CreateCommand();
-            command.CommandText = sql;
-            bind(command);
-
-            await using var reader = await command
-                .ExecuteReaderAsync(CommandBehavior.SingleResult, cancellationToken).ConfigureAwait(false);
-            while (await reader.ReadAsync(cancellationToken).ConfigureAwait(false))
-                results.Add(project(reader));
-
-            LastUsedUtc = DateTime.UtcNow;
-            return results;
-        }
-        finally
-        {
-            // A dispose that raced this call has already disposed the gate; releasing it then is harmless to
-            // ignore and must not mask the real result.
-            try { _gate.Release(); }
-            catch (ObjectDisposedException) { }
-        }
-    }
-
-    /// <summary>Binds one catalog-query parameter. The only way a name reaches the database.</summary>
-    private static void Bind(DbCommand command, string name, string value)
-    {
-        var parameter = command.CreateParameter();
-        parameter.ParameterName = name;
-        parameter.DbType = DbType.String;
-        parameter.Value = value;
-        command.Parameters.Add(parameter);
-    }
-
-    private static string ReadString(DbDataReader reader, string columnName) =>
-        ReadOptionalString(reader, columnName) ?? string.Empty;
-
-    private static string? ReadOptionalString(DbDataReader reader, string columnName)
-    {
-        var ordinal = reader.GetOrdinal(columnName);
-        return reader.IsDBNull(ordinal) ? null : reader.GetValue(ordinal)?.ToString();
-    }
-}
@@ -1,401 +0,0 @@
-using System.Data.Common;
-using System.Text.Json;
-using System.Text.Json.Serialization;
-using Microsoft.Extensions.Logging;
-using Microsoft.Extensions.Logging.Abstractions;
-using ZB.MOM.WW.OtOpcUa.Commons.Browsing;
-using ZB.MOM.WW.OtOpcUa.Driver.Sql.Contracts;
-
-namespace ZB.MOM.WW.OtOpcUa.Driver.Sql.Browser;
-
-/// <summary>
-///     Opens a <b>transient</b> database connection from form-supplied JSON for the AdminUI schema picker,
-///     and hands it to a <see cref="SqlBrowseSession"/>. The AdminUI's <c>BrowseSessionRegistry</c> (its idle
-///     TTL reaper included) owns the returned session unchanged — nothing about the SQL browse needs a
-///     registry of its own.
-///     <para><b>Two ways to name the database, and only one of them is persisted.</b>
-///     <c>connectionStringRef</c> is the deployed form: a name resolved <em>in the AdminUI process</em> from
-///     the environment as <c>Sql__ConnectionStrings__&lt;ref&gt;</c> (design §4.4), so a deployed artifact
-///     never carries credentials. <c>connectionString</c> is an ad-hoc, <b>session-only</b> literal an
-///     operator may paste to browse a database that has no ref yet; it is used for this one connection and
-///     then forgotten — there is deliberately no cached-config field on this type, and nothing writes it
-///     anywhere.</para>
-///     <para><b>Precedence: a pasted literal wins over a ref</b>, and the ref is then not even read. The
-///     literal cannot arrive from a persisted blob — <see cref="SqlDriverConfigDto"/> has no such property, so
-///     the driver factory would drop it — which makes its presence proof that an operator typed it just now.
-///     A config carrying both logs a warning (naming the shadowed <em>ref</em>, never any connection text) so
-///     the override is visible rather than silent.</para>
-///     <para><b>Credential hygiene is the point of this type.</b> A connection string is a secret. It is
-///     passed to the provider and to nothing else: it never reaches a log line, an exception message, a field,
-///     or anything persisted. Because ADO.NET providers are free to echo connection-string content in their
-///     own errors, every failure on the open path goes through <see cref="Sanitize"/> before it leaves this
-///     class.</para>
-/// </summary>
-public sealed class SqlDriverBrowser : IDriverBrowser
-{
-    /// <summary>
-    ///     Prefix of the environment variable a <c>connectionStringRef</c> resolves through — the
-    ///     double-underscore form .NET configuration uses for the <c>Sql:ConnectionStrings:&lt;ref&gt;</c>
-    ///     key path.
-    /// </summary>
-    public const string ConnectionStringEnvironmentPrefix = "Sql__ConnectionStrings__";
-
-    /// <summary>
-    ///     Hard cap on the connect phase, layered on the caller's token. The AdminUI already bounds each
-    ///     browse call at 20 s; this only stops a pathological provider-side connect from outliving the
-    ///     picker entirely.
-    /// </summary>
-    private static readonly TimeSpan ConnectBudget = TimeSpan.FromSeconds(30);
-
-    /// <summary>
-    ///     Connection-string keys whose <em>values</em> are redacted out of any provider error text. The
-    ///     whole connection string is redacted unconditionally; these are the parts that could survive as a
-    ///     fragment. Server / database names are deliberately <b>not</b> redacted — "server X was not found"
-    ///     is the diagnostic the operator needs, and a hostname is not a credential.
-    /// </summary>
-    private static readonly string[] CredentialKeys =
-    [
-        "password", "pwd", "user id", "uid", "user", "username", "accesstoken", "access token",
-    ];
-
-    /// <summary>
-    ///     Kept deliberately identical in shape to the driver factory's options (design §5.1): enum-valued
-    ///     knobs are authored as their <em>names</em>, so the browser parses a given <c>DriverConfig</c> blob
-    ///     exactly as the runtime factory does. <see cref="JsonStringEnumConverter"/> also accepts ordinals,
-    ///     so a numeric config still binds.
-    /// </summary>
-    private static readonly JsonSerializerOptions JsonOpts = new()
-    {
-        UnmappedMemberHandling = JsonUnmappedMemberHandling.Skip,
-        PropertyNameCaseInsensitive = true,
-        Converters = { new JsonStringEnumConverter() },
-    };
-
-    private readonly Func<SqlProvider, ISqlDialect?> _dialectSelector;
-    private readonly Func<string, string?> _environmentReader;
-    private readonly ILogger<SqlDriverBrowser> _logger;
-
-    /// <summary>Creates a browser. Every dependency has a production default, so DI may construct it bare.</summary>
-    /// <param name="dialectSelector">
-    ///     Maps an authored <see cref="SqlProvider"/> onto the dialect that browses it, or <see langword="null"/>
-    ///     for a provider this build does not carry. Defaults to <see cref="DefaultDialectSelector"/>
-    ///     (SqlServer only, in v1). A constructor parameter rather than a test hatch: it is also how a P2
-    ///     provider gets added without touching this class.
-    /// </param>
-    /// <param name="environmentReader">
-    ///     Reads one environment variable. Defaults to <see cref="Environment.GetEnvironmentVariable(string)"/>.
-    ///     Injectable because environment variables are process-global, and a test that sets one races every
-    ///     other test in the assembly.
-    /// </param>
-    /// <param name="logger">Optional; defaults to <see cref="NullLogger{T}"/>.</param>
-    public SqlDriverBrowser(
-        Func<SqlProvider, ISqlDialect?>? dialectSelector = null,
-        Func<string, string?>? environmentReader = null,
-        ILogger<SqlDriverBrowser>? logger = null)
-    {
-        _dialectSelector = dialectSelector ?? DefaultDialectSelector;
-        _environmentReader = environmentReader ?? Environment.GetEnvironmentVariable;
-        _logger = logger ?? NullLogger<SqlDriverBrowser>.Instance;
-    }
-
-    /// <inheritdoc />
-    /// <remarks>
-    ///     Sourced from <see cref="SqlDriver.DriverTypeName"/>, the driver's interim local constant, rather
-    ///     than from <c>DriverTypeNames</c> — the shared constant set is added by the driver-factory task,
-    ///     because adding a member there reddens <c>DriverTypeNamesGuardTests</c> until a factory is
-    ///     registered against it. Repointing that one constant repoints this too.
-    /// </remarks>
-    public string DriverType => SqlDriver.DriverTypeName;
-
-    /// <summary>The environment variable a <c>connectionStringRef</c> resolves through.</summary>
-    /// <param name="connectionStringRef">The authored reference name.</param>
-    /// <returns>The full environment-variable name, e.g. <c>Sql__ConnectionStrings__MesStaging</c>.</returns>
-    public static string EnvironmentVariableFor(string connectionStringRef) =>
-        ConnectionStringEnvironmentPrefix + connectionStringRef;
-
-    /// <summary>
-    ///     The providers this build can browse. v1 constructs SQL Server only; every other
-    ///     <see cref="SqlProvider"/> member is a reserved name, so it resolves to <see langword="null"/> and
-    ///     the caller reports it as unavailable rather than crashing on a null dialect.
-    /// </summary>
-    /// <param name="provider">The authored provider.</param>
-    /// <returns>The dialect, or <see langword="null"/> when this build does not carry the provider.</returns>
-    public static ISqlDialect? DefaultDialectSelector(SqlProvider provider) =>
-        provider == SqlProvider.SqlServer ? new SqlServerDialect() : null;
-
-    /// <inheritdoc />
-    /// <exception cref="InvalidOperationException">
-    ///     The configuration is absent / malformed, names a provider this build does not carry, names neither
-    ///     a <c>connectionStringRef</c> nor a literal, resolves a ref that is not set in the environment, or
-    ///     the connection could not be opened.
-    /// </exception>
-    public async Task<IBrowseSession> OpenAsync(string configJson, CancellationToken cancellationToken)
-    {
-        if (string.IsNullOrWhiteSpace(configJson))
-        {
-            throw new InvalidOperationException(
-                "The Sql browser requires a driver configuration; none was supplied.");
-        }
-
-        var literal = ReadPastedConnectionString(configJson);
-        var config = Deserialize(configJson, literal);
-
-        // Provider first: "this build cannot browse Postgres" is true regardless of how the database is
-        // named, and answering it before touching the environment keeps the two failures from masking.
-        var dialect = _dialectSelector(config.Provider)
-            ?? throw new InvalidOperationException(
-                $"Sql provider '{config.Provider}' is not available in this build; v1 browses "
-                + $"'{SqlProvider.SqlServer}' only.");
-
-        var reference = config.ConnectionStringRef;
-        var connectionString = ResolveConnectionString(literal, reference);
-
-        _logger.LogInformation(
-            "AdminUI Sql browse session opening (provider {Provider}, connection from {Source})",
-            config.Provider,
-            DescribeSource(literal, reference));
-
-        return await OpenSessionAsync(dialect, connectionString, cancellationToken).ConfigureAwait(false);
-    }
-
-    /// <summary>
-    ///     Opens one transient connection and hands ownership to the session. <b>The session closes the
-    ///     connection on its own disposal</b>, so the only disposal this method owns is the failure path —
-    ///     disposing on success would double-close and leave the picker with a dead session.
-    /// </summary>
-    private static async Task<IBrowseSession> OpenSessionAsync(
-        ISqlDialect dialect, string connectionString, CancellationToken cancellationToken)
-    {
-        var connection = dialect.Factory.CreateConnection()
-            ?? throw new InvalidOperationException(
-                $"The ADO.NET provider for '{dialect.Provider}' returned no connection object.");
-
-        try
-        {
-            connection.ConnectionString = connectionString;
-
-            using var connectCts = CancellationTokenSource.CreateLinkedTokenSource(cancellationToken);
-            connectCts.CancelAfter(ConnectBudget);
-            await connection.OpenAsync(connectCts.Token).ConfigureAwait(false);
-
-            return new SqlBrowseSession(connection, dialect);
-        }
-        catch (Exception ex)
-        {
-            try { await connection.DisposeAsync().ConfigureAwait(false); }
-            catch { /* best-effort: the original failure is the useful one. */ }
-
-            if (ex is OperationCanceledException) throw;
-            throw Sanitize(ex, connectionString);
-        }
-    }
-
-    /// <summary>
-    ///     Picks the connection string, literal first. A blank literal is treated as absent (an untouched
-    ///     form field), never as an empty connection string.
-    /// </summary>
-    private string ResolveConnectionString(string? literal, string? reference)
-    {
-        if (!string.IsNullOrWhiteSpace(literal))
-        {
-            if (!string.IsNullOrWhiteSpace(reference))
-            {
-                _logger.LogWarning(
-                    "Sql browse: a pasted connection string was supplied alongside connectionStringRef "
-                    + "'{Ref}'. The pasted value wins for this session only and is not persisted.",
-                    reference);
-            }
-
-            return literal;
-        }
-
-        if (string.IsNullOrWhiteSpace(reference))
-        {
-            throw new InvalidOperationException(
-                "The Sql browser needs a database to browse: set 'connectionStringRef' to a name resolved "
-                + $"from the environment as '{ConnectionStringEnvironmentPrefix}<ref>', or paste a "
-                + "connection string into 'connectionString' for an ad-hoc browse.");
-        }
-
-        var variable = EnvironmentVariableFor(reference);
-        var resolved = _environmentReader(variable);
-        if (string.IsNullOrWhiteSpace(resolved))
-        {
-            // Name the exact variable: "the ref did not resolve" is unactionable, and the operator's next
-            // move is to set this one name on the AdminUI host.
-            throw new InvalidOperationException(
-                $"connectionStringRef '{reference}' does not resolve: environment variable "
-                + $"'{variable}' is not set on the AdminUI host. Set it there (the AdminUI resolves browse "
-                + "connection strings in its own process), or paste a connection string for an ad-hoc "
-                + "browse.");
-        }
-
-        return resolved;
-    }
-
-    /// <summary>How the connection string was obtained, for the log. Carries no connection text.</summary>
-    private static string DescribeSource(string? literal, string? reference) =>
-        !string.IsNullOrWhiteSpace(literal)
-            ? "a pasted literal (session-only, not persisted)"
-            : $"connectionStringRef '{reference}'";
-
-    /// <summary>
-    ///     Pulls the ad-hoc <c>connectionString</c> literal out of the raw JSON. It is read here rather than
-    ///     off the DTO because <see cref="SqlDriverConfigDto"/> deliberately has no such property — the
-    ///     persisted contract must not be able to carry a credential — and the DTO's
-    ///     <see cref="JsonUnmappedMemberHandling.Skip"/> would silently drop it.
-    /// </summary>
-    /// <returns>The literal, or <see langword="null"/> when absent, blank, or not a JSON string.</returns>
-    private static string? ReadPastedConnectionString(string configJson)
-    {
-        using var document = ParseDocument(configJson);
-        if (document.RootElement.ValueKind != JsonValueKind.Object)
-        {
-            throw new InvalidOperationException(
-                "The Sql browser's driver configuration must be a JSON object.");
-        }
-
-        foreach (var property in document.RootElement.EnumerateObject())
-        {
-            if (!string.Equals(property.Name, "connectionString", StringComparison.OrdinalIgnoreCase))
-                continue;
-
-            if (property.Value.ValueKind != JsonValueKind.String) return null;
-            var value = property.Value.GetString();
-            return string.IsNullOrWhiteSpace(value) ? null : value;
-        }
-
-        return null;
-    }
-
-    /// <summary>
-    ///     Parses the raw configuration. The <see cref="JsonException"/> is <b>not</b> attached or echoed:
-    ///     at this point nothing has been extracted, so there is no known secret to redact against, and the
-    ///     malformed text may itself be a pasted connection string.
-    /// </summary>
-    private static JsonDocument ParseDocument(string configJson)
-    {
-        try
-        {
-            return JsonDocument.Parse(configJson);
-        }
-        catch (JsonException)
-        {
-            throw new InvalidOperationException(
-                "The Sql browser's driver configuration is not valid JSON. (The parser's message is "
-                + "withheld because the malformed text may carry a connection string.)");
-        }
-    }
-
-    /// <summary>
-    ///     Binds the typed configuration. A bind failure (e.g. an unknown <c>provider</c> name) is reported
-    ///     with the parser's own message redacted against the literal, which is known by now.
-    /// </summary>
-    private static SqlDriverConfigDto Deserialize(string configJson, string? literal)
-    {
-        try
-        {
-            return JsonSerializer.Deserialize<SqlDriverConfigDto>(configJson, JsonOpts)
-                ?? throw new InvalidOperationException(
-                    "The Sql browser's driver configuration deserialized to null.");
-        }
-        catch (JsonException ex)
-        {
-            throw new InvalidOperationException(
-                "The Sql browser's driver configuration could not be bound: "
-                + Redact(ex.Message, CollectSecrets(literal)));
-        }
-    }
-
-    /// <summary>
-    ///     Turns a provider-side open failure into an exception that cannot carry the connection string.
-    ///     <para><b>Live-probed, not assumed.</b> <c>Microsoft.Data.SqlClient</c> and
-    ///     <c>Microsoft.Data.Sqlite</c> keep connection-string <em>values</em> out of their
-    ///     <c>SqlException</c>/<c>SqliteException</c> text (a failed connect says "the server was not found",
-    ///     never what it was handed). Their connection-string <b>parser</b> is the exception: it reports an
-    ///     unrecognised keyword by quoting it, and a value carrying an unquoted <c>;</c> — legal inside a
-    ///     password, which ADO.NET expects you to quote — splits, so the tail of the password is parsed as a
-    ///     keyword and echoed verbatim. <c>Password=Sup3r;SecretTail</c> yields
-    ///     <c>Keyword not supported: 'secrettail;connect timeout'.</c> — the credential, in the message,
-    ///     lower-cased and therefore invisible to a naive ordinal search for the value.</para>
-    ///     <para>So the parser's message (an <see cref="ArgumentException"/>) is <b>never</b> surfaced. Every
-    ///     other failure is additionally passed through the substring redactor as a backstop, and when that
-    ///     fires anywhere in the exception <em>chain</em> the inner exception is dropped too — keeping it
-    ///     would re-expose through <c>ToString()</c> exactly what the message just removed.</para>
-    /// </summary>
-    private static InvalidOperationException Sanitize(Exception ex, string connectionString)
-    {
-        if (ex is ArgumentException)
-        {
-            return new InvalidOperationException(
-                "The Sql browser could not open a connection: the connection string is malformed, or "
-                + "carries a keyword this provider does not support. (The provider's own message is "
-                + "withheld because it quotes connection-string text verbatim; check for an unquoted ';' "
-                + "or '=' inside a value such as the password.)");
-        }
-
-        var secrets = CollectSecrets(connectionString);
-        var leaked = ContainsAny(ex.ToString(), secrets);
-        var reason = Redact(ex.Message, secrets);
-
-        var message = leaked
-            ? "The Sql browser could not open a connection: " + reason
-                + " (the provider's error echoed the connection string, so it was redacted and the inner "
-                + "exception withheld)"
-            : "The Sql browser could not open a connection: " + reason;
-
-        return new InvalidOperationException(message, leaked ? null : ex);
-    }
-
-    /// <summary>
-    ///     The substrings that must never leave this class: the whole connection string, and the values of
-    ///     its credential-bearing keys (which could surface on their own).
-    /// </summary>
-    private static List<string> CollectSecrets(string? connectionString)
-    {
-        var secrets = new List<string>();
-        if (string.IsNullOrWhiteSpace(connectionString)) return secrets;
-
-        secrets.Add(connectionString);
-
-        try
-        {
-            var builder = new DbConnectionStringBuilder { ConnectionString = connectionString };
-            foreach (var key in CredentialKeys)
-            {
-                if (!builder.TryGetValue(key, out var value)) continue;
-                var text = value?.ToString();
-                if (!string.IsNullOrWhiteSpace(text)) secrets.Add(text);
-            }
-        }
-        catch (ArgumentException)
-        {
-            // A malformed connection string has no parseable parts; the whole-string entry still stands.
-        }
-
-        // Longest first, so redacting a short credential value cannot chop a longer secret into
-        // unredactable halves.
-        secrets.Sort(static (left, right) => right.Length.CompareTo(left.Length));
-        return secrets;
-    }
-
-    private static bool ContainsAny(string text, List<string> secrets)
-    {
-        foreach (var secret in secrets)
-        {
-            if (text.Contains(secret, StringComparison.OrdinalIgnoreCase)) return true;
-        }
-
-        return false;
-    }
-
-    private static string Redact(string text, List<string> secrets)
-    {
-        foreach (var secret in secrets)
-        {
-            text = text.Replace(secret, "[redacted]", StringComparison.OrdinalIgnoreCase);
-        }
-
-        return text;
-    }
-}
@@ -1,27 +0,0 @@
-<Project Sdk="Microsoft.NET.Sdk">
-  <PropertyGroup>
-    <TargetFramework>net10.0</TargetFramework>
-    <Nullable>enable</Nullable>
-    <ImplicitUsings>enable</ImplicitUsings>
-    <TreatWarningsAsErrors>true</TreatWarningsAsErrors>
-    <GenerateDocumentationFile>true</GenerateDocumentationFile>
-    <NoWarn>$(NoWarn);CS1591</NoWarn>
-    <RootNamespace>ZB.MOM.WW.OtOpcUa.Driver.Sql.Browser</RootNamespace>
-  </PropertyGroup>
-  <ItemGroup>
-    <ProjectReference Include="..\..\Core\ZB.MOM.WW.OtOpcUa.Commons\ZB.MOM.WW.OtOpcUa.Commons.csproj" />
-    <ProjectReference Include="..\ZB.MOM.WW.OtOpcUa.Driver.Sql.Contracts\ZB.MOM.WW.OtOpcUa.Driver.Sql.Contracts.csproj" />
-    <!-- Deliberate deviation from the OpcUaClient.Browser house style (which refs only its
-         Contracts project and owns its own transport packages): the dialect's catalog SQL
-         (ISqlDialect / SqlServerDialect, in Driver.Sql) *is* the browse engine, so it must be
-         shared here rather than duplicated. Microsoft.Data.SqlClient comes in transitively.
-         The resulting transitive SqlClient reference on AdminUI is reviewed and accepted —
-         AdminUI already carries SqlClient for ConfigDb. See design doc §2, table row for this
-         project: docs/plans/2026-07-15-sql-poll-driver-design.md. Do not "fix" this to a
-         Contracts-only reference without reading that context first. -->
-    <ProjectReference Include="..\ZB.MOM.WW.OtOpcUa.Driver.Sql\ZB.MOM.WW.OtOpcUa.Driver.Sql.csproj" />
-  </ItemGroup>
-  <ItemGroup>
-    <InternalsVisibleTo Include="ZB.MOM.WW.OtOpcUa.Driver.Sql.Browser.Tests"/>
-  </ItemGroup>
-</Project>
@@ -1,64 +0,0 @@
-using ZB.MOM.WW.OtOpcUa.Core.Abstractions;
-
-namespace ZB.MOM.WW.OtOpcUa.Driver.Sql.Contracts;
-
-/// <summary>
-///     The <c>DriverConfig</c> blob shape for a <c>Sql</c> driver instance (design §5.1). Deserialised by the
-///     driver factory, which applies the documented defaults for every absent (null) field and maps the result
-///     onto the driver's typed options.
-///     <para><b>No connection string lives here.</b> Only <see cref="ConnectionStringRef"/> — a name resolved at
-///     Initialize from the environment / secret store (e.g. <c>Sql__ConnectionStrings__MesStaging</c>) — so a
-///     deployed artifact never carries database credentials.</para>
-///     <para>Enum-valued fields are enum-typed (not strings) so a <c>JsonStringEnumConverter</c> round-trips
-///     their <em>names</em> rather than their ordinals. The converter is applied by the factory's
-///     <c>JsonSerializerOptions</c> (Task 9), not by an attribute on this DTO — mirroring the driver
-///     enum-serialization trap that bit the AdminUI driver pages.</para>
-/// </summary>
-public sealed class SqlDriverConfigDto
-{
-    /// <summary>Which ADO.NET provider/dialect backs this instance. Defaults to <see cref="SqlProvider.SqlServer"/> — the only provider v1 constructs.</summary>
-    public SqlProvider Provider { get; init; } = SqlProvider.SqlServer;
-
-    /// <summary>
-    ///     Name of the connection string to resolve from the environment / secret store at Initialize —
-    ///     <b>never</b> the connection string itself.
-    /// </summary>
-    public string? ConnectionStringRef { get; init; }
-
-    /// <summary>Poll interval applied to groups that do not carry their own. Absent ⇒ the factory default.</summary>
-    public TimeSpan? DefaultPollInterval { get; init; }
-
-    /// <summary>
-    ///     Per-query wall-clock deadline enforced client-side (a breach surfaces <c>BadTimeout</c>). Must be
-    ///     greater than <see cref="CommandTimeout"/>, which is only the server-side backstop (design §8.3).
-    /// </summary>
-    public TimeSpan? OperationTimeout { get; init; }
-
-    /// <summary>ADO.NET <c>CommandTimeout</c> backstop (seconds granularity server-side).</summary>
-    public TimeSpan? CommandTimeout { get; init; }
-
-    /// <summary>Cap on concurrently executing group queries — the connection-pool guard.</summary>
-    public int? MaxConcurrentGroups { get; init; }
-
-    /// <summary>When <see langword="true"/>, a NULL cell publishes Bad rather than the default Uncertain.</summary>
-    public bool? NullIsBad { get; init; }
-
-    /// <summary>
-    ///     Master write kill-switch. <b>v1 is read-only and this field is inert</b> — the driver does not
-    ///     implement <c>IWritable</c>, so no value here can produce a write. The factory <em>warns</em> when it
-    ///     is authored <see langword="true"/> rather than failing the driver, since the flag cannot do harm but
-    ///     an operator who believes writes are enabled can.
-    /// </summary>
-    public bool? AllowWrites { get; init; }
-
-    /// <summary>
-    ///     The authored raw tags the deploy artifact delivers for this driver instance — RawPath identity plus
-    ///     the driver <c>TagConfig</c> blob, the same shape every other driver receives. The factory copies
-    ///     these onto the driver's options and the driver maps each through
-    ///     <see cref="SqlEquipmentTagParser.TryParse"/> at Initialize.
-    ///     <para>A SQL source has no tag-discovery protocol, so this list is the complete set of tags the
-    ///     instance serves — an absent or empty list is a driver with nothing to poll, not a driver that will
-    ///     find its tags later.</para>
-    /// </summary>
-    public List<RawTagEntry>? RawTags { get; init; }
-}
@@ -1,131 +0,0 @@
-using System.Text.Json;
-using ZB.MOM.WW.OtOpcUa.Core.Abstractions;
-
-namespace ZB.MOM.WW.OtOpcUa.Driver.Sql.Contracts;
-
-/// <summary>
-///     Pure mapper from an authored raw tag's <c>TagConfig</c> JSON (design §5.2 / §5.3) to a
-///     <see cref="SqlTagDefinition"/>, mirroring <c>ModbusTagDefinitionFactory.FromTagConfig</c>. The blob is
-///     recognised by a leading <c>{</c> plus a <c>"driver":"Sql"</c> marker or a <c>"model"</c> discriminator;
-///     the <c>model</c> and <c>type</c> enums are read with
-///     <see cref="TagConfigJson.TryReadEnumStrict{TEnum}"/>, so a present-but-invalid (typo'd) value rejects
-///     the whole tag — the driver then surfaces <c>BadNodeIdUnknown</c> instead of silently defaulting to a
-///     different model and publishing a misleading <c>Good</c> (R2-11).
-///     <para><b>No SQL is built here.</b> The parser only captures strings; the reader binds value fields as
-///     <c>DbParameter</c>s and validates + quotes identifier fields. Tag input is never concatenated into a
-///     command text, so a hostile <c>keyValue</c> is stored — and must be stored — verbatim.</para>
-/// </summary>
-public static class SqlEquipmentTagParser
-{
-    /// <summary>
-    ///     Maps an authored <c>TagConfig</c> blob to a typed definition keyed by <paramref name="rawPath"/>.
-    ///     Returns <see langword="false"/> — never throws — for anything the driver must not serve: a
-    ///     non-object / unparseable blob, a blob belonging to another driver, a typo'd <c>model</c> or
-    ///     <c>type</c> enum, a missing model-required field, or the P3-deferred
-    ///     <see cref="SqlTagModel.Query"/> model.
-    /// </summary>
-    /// <param name="reference">The authored equipment-tag TagConfig JSON.</param>
-    /// <param name="rawPath">The tag's RawPath — becomes the definition's identity (<c>Name</c>).</param>
-    /// <param name="def">The mapped definition when this returns <see langword="true"/>.</param>
-    /// <returns><see langword="true"/> when <paramref name="reference"/> is a valid Sql tag blob.</returns>
-    public static bool TryParse(string reference, string rawPath, out SqlTagDefinition def)
-    {
-        def = null!;
-        if (string.IsNullOrWhiteSpace(reference)) return false;
-        if (reference.TrimStart().FirstOrDefault() != '{') return false;
-        try
-        {
-            using var doc = JsonDocument.Parse(reference);
-            var root = doc.RootElement;
-            if (root.ValueKind != JsonValueKind.Object) return false;
-
-            // Recognition: either the explicit driver marker or the model discriminator must be present,
-            // so another driver's TagConfig blob is not mistaken for a Sql one.
-            var driver = ReadString(root, "driver");
-            var hasModel = root.TryGetProperty("model", out _);
-            if (!hasModel && !string.Equals(driver, "Sql", StringComparison.OrdinalIgnoreCase)) return false;
-
-            // Strict enum reads: absent ⇒ the fallback, present-but-invalid ⇒ reject the tag.
-            if (!TagConfigJson.TryReadEnumStrict(root, "model", SqlTagModel.KeyValue, out var model)) return false;
-            if (!TagConfigJson.TryReadEnumStrict(root, "type", default(DriverDataType), out var type)) return false;
-            DriverDataType? declaredType =
-                root.TryGetProperty("type", out var typeEl) && typeEl.ValueKind == JsonValueKind.String
-                    ? type
-                    : null;
-
-            var table = ReadString(root, "table");
-            if (string.IsNullOrWhiteSpace(table)) return false;
-            var timestampColumn = ReadString(root, "timestampColumn");
-
-            switch (model)
-            {
-                case SqlTagModel.KeyValue:
-                {
-                    var keyColumn = ReadString(root, "keyColumn");
-                    var keyValue = ReadString(root, "keyValue");
-                    var valueColumn = ReadString(root, "valueColumn");
-                    if (string.IsNullOrWhiteSpace(keyColumn)
-                        || string.IsNullOrWhiteSpace(valueColumn)
-                        || keyValue is null)
-                        return false;
-                    def = new SqlTagDefinition(
-                        Name: rawPath, Model: model, Table: table!,
-                        KeyColumn: keyColumn, KeyValue: keyValue, ValueColumn: valueColumn,
-                        TimestampColumn: timestampColumn, DeclaredType: declaredType);
-                    return true;
-                }
-
-                case SqlTagModel.WideRow:
-                {
-                    var columnName = ReadString(root, "columnName");
-                    if (string.IsNullOrWhiteSpace(columnName)) return false;
-                    string? selectorColumn = null, selectorValue = null, topByTimestamp = null;
-                    if (root.TryGetProperty("rowSelector", out var sel) && sel.ValueKind == JsonValueKind.Object)
-                    {
-                        selectorColumn = ReadString(sel, "whereColumn");
-                        selectorValue = ReadScalar(sel, "whereValue");
-                        topByTimestamp = ReadString(sel, "topByTimestamp");
-                    }
-                    // A wide-row tag must say WHICH row it reads — either a where-pair or newest-by-timestamp.
-                    var hasWherePair = !string.IsNullOrWhiteSpace(selectorColumn) && selectorValue is not null;
-                    if (!hasWherePair && string.IsNullOrWhiteSpace(topByTimestamp)) return false;
-                    def = new SqlTagDefinition(
-                        Name: rawPath, Model: model, Table: table!,
-                        TimestampColumn: timestampColumn, ColumnName: columnName,
-                        RowSelectorColumn: hasWherePair ? selectorColumn : null,
-                        RowSelectorValue: hasWherePair ? selectorValue : null,
-                        RowSelectorTopByTimestamp: hasWherePair ? null : topByTimestamp,
-                        DeclaredType: declaredType);
-                    return true;
-                }
-
-                default:
-                    // SqlTagModel.Query is design §5.4 / P3 — deferred. Reject rather than serve a model
-                    // the runtime cannot read.
-                    return false;
-            }
-        }
-        catch (JsonException) { return false; }
-        catch (FormatException) { return false; }
-    }
-
-    /// <summary>Reads a string-valued property; null when absent or not a JSON string.</summary>
-    private static string? ReadString(JsonElement o, string name)
-        => o.TryGetProperty(name, out var e) && e.ValueKind == JsonValueKind.String ? e.GetString() : null;
-
-    /// <summary>
-    ///     Reads a scalar property as its textual form — a JSON string yields its contents, a number or
-    ///     boolean yields its raw token — so an authored <c>whereValue</c> of either shape is captured
-    ///     verbatim for later parameter binding. Null when absent or not a scalar.
-    /// </summary>
-    private static string? ReadScalar(JsonElement o, string name)
-    {
-        if (!o.TryGetProperty(name, out var e)) return null;
-        return e.ValueKind switch
-        {
-            JsonValueKind.String => e.GetString(),
-            JsonValueKind.Number or JsonValueKind.True or JsonValueKind.False => e.GetRawText(),
-            _ => null,
-        };
-    }
-}
@@ -1,39 +0,0 @@
-namespace ZB.MOM.WW.OtOpcUa.Driver.Sql.Contracts;
-
-/// <summary>Which ADO.NET provider/dialect backs a Sql driver instance. v1 constructs only SqlServer.</summary>
-public enum SqlProvider
-{
-    /// <summary>Microsoft SQL Server via <c>Microsoft.Data.SqlClient</c> — the only provider v1 constructs.</summary>
-    SqlServer,
-
-    /// <summary>PostgreSQL (Npgsql) — reserved for P2; not constructed in v1.</summary>
-    Postgres,
-
-    /// <summary>MySQL / MariaDB — reserved; not constructed in v1.</summary>
-    MySql,
-
-    /// <summary>Generic ODBC — reserved for P2; not constructed in v1.</summary>
-    Odbc,
-
-    /// <summary>Oracle — reserved; not constructed in v1.</summary>
-    Oracle,
-}
-
-/// <summary>Tag→value mapping model. v1 ships KeyValue + WideRow; Query is deferred (design §5.4 / P3).</summary>
-public enum SqlTagModel
-{
-    /// <summary>
-    ///     Key-value (EAV) table: one row per tag, selected by <c>keyColumn = keyValue</c>, value read from
-    ///     <c>valueColumn</c>.
-    /// </summary>
-    KeyValue,
-
-    /// <summary>
-    ///     Wide row: one row holds many signals as columns; the tag names its <c>columnName</c> and the row is
-    ///     picked by a row selector (a <c>whereColumn</c>/<c>whereValue</c> pair, or newest-by-timestamp).
-    /// </summary>
-    WideRow,
-
-    /// <summary>Named arbitrary-SELECT query (design §5.4). <b>Deferred to P3 — not accepted by v1's parser.</b></summary>
-    Query,
-}
@@ -1,47 +0,0 @@
-using ZB.MOM.WW.OtOpcUa.Core.Abstractions;
-
-namespace ZB.MOM.WW.OtOpcUa.Driver.Sql.Contracts;
-
-/// <summary>
-///     One SQL-backed OPC UA variable — the typed form of an authored raw tag's <c>TagConfig</c> blob
-///     (design §5.2 / §5.3), produced by <see cref="SqlEquipmentTagParser.TryParse"/>.
-///     <para><b>Every string here is captured verbatim from the authored blob and is NEVER concatenated
-///     into SQL.</b> Value-bearing fields (<see cref="KeyValue"/>, <see cref="RowSelectorValue"/>) are bound
-///     as <c>DbParameter</c>s by the reader; identifier-bearing fields (<see cref="Table"/>,
-///     <see cref="KeyColumn"/>, <see cref="ValueColumn"/>, <see cref="TimestampColumn"/>,
-///     <see cref="ColumnName"/>, <see cref="RowSelectorColumn"/>,
-///     <see cref="RowSelectorTopByTimestamp"/>) must be validated against <c>INFORMATION_SCHEMA</c> and
-///     dialect-quoted by the reader before they reach a command text. Sanitising here would corrupt
-///     legitimate values, so the parser deliberately does not.</para>
-/// </summary>
-/// <param name="Name">
-///     The tag's identity — its <b>RawPath</b>, exactly as handed to the parser. The driver's forward
-///     router keys published values on this, so it must never be derived from the blob's contents.
-/// </param>
-/// <param name="Model">Which tag→value mapping this tag uses. v1 accepts KeyValue and WideRow only.</param>
-/// <param name="Table">The table or view to read (e.g. <c>dbo.TagValues</c>).</param>
-/// <param name="KeyColumn"><see cref="SqlTagModel.KeyValue"/>: the column matched against <see cref="KeyValue"/>.</param>
-/// <param name="KeyValue"><see cref="SqlTagModel.KeyValue"/>: this tag's key — <b>bound</b>, never interpolated.</param>
-/// <param name="ValueColumn"><see cref="SqlTagModel.KeyValue"/>: the column the value is read from.</param>
-/// <param name="TimestampColumn">Optional source-timestamp column; absent ⇒ the driver stamps the poll time.</param>
-/// <param name="ColumnName"><see cref="SqlTagModel.WideRow"/>: the column this tag reads from the selected row.</param>
-/// <param name="RowSelectorColumn"><see cref="SqlTagModel.WideRow"/>: the <c>whereColumn</c> that picks the row.</param>
-/// <param name="RowSelectorValue"><see cref="SqlTagModel.WideRow"/>: the <c>whereValue</c> — <b>bound</b>, never interpolated.</param>
-/// <param name="RowSelectorTopByTimestamp"><see cref="SqlTagModel.WideRow"/>: newest-row selector — the timestamp column to order by, when no where-pair is authored.</param>
-/// <param name="DeclaredType">
-///     Optional explicit type override from the blob's <c>type</c> field. <see langword="null"/> ⇒ the
-///     driver infers the type from the result set's column metadata.
-/// </param>
-public sealed record SqlTagDefinition(
-    string Name,
-    SqlTagModel Model,
-    string Table,
-    string? KeyColumn = null,
-    string? KeyValue = null,
-    string? ValueColumn = null,
-    string? TimestampColumn = null,
-    string? ColumnName = null,
-    string? RowSelectorColumn = null,
-    string? RowSelectorValue = null,
-    string? RowSelectorTopByTimestamp = null,
-    DriverDataType? DeclaredType = null);
@@ -1,14 +0,0 @@
-<Project Sdk="Microsoft.NET.Sdk">
-  <PropertyGroup>
-    <TargetFramework>net10.0</TargetFramework>
-    <Nullable>enable</Nullable>
-    <ImplicitUsings>enable</ImplicitUsings>
-    <TreatWarningsAsErrors>true</TreatWarningsAsErrors>
-    <GenerateDocumentationFile>true</GenerateDocumentationFile>
-    <NoWarn>$(NoWarn);CS1591</NoWarn>
-    <RootNamespace>ZB.MOM.WW.OtOpcUa.Driver.Sql.Contracts</RootNamespace>
-  </PropertyGroup>
-  <ItemGroup>
-    <ProjectReference Include="..\..\Core\ZB.MOM.WW.OtOpcUa.Core.Abstractions\ZB.MOM.WW.OtOpcUa.Core.Abstractions.csproj" />
-  </ItemGroup>
-</Project>
@@ -1,123 +0,0 @@
-using System.Data.Common;
-using ZB.MOM.WW.OtOpcUa.Core.Abstractions;
-using ZB.MOM.WW.OtOpcUa.Driver.Sql.Contracts;
-
-namespace ZB.MOM.WW.OtOpcUa.Driver.Sql;
-
-/// <summary>
-///     The provider seam (design §2.2). ADO.NET's <see cref="System.Data.Common"/> base types abstract
-///     connections, commands, parameters and readers; they do <b>not</b> abstract the three things that differ
-///     per backend — <b>identifier quoting</b>, the <b>metadata-catalog SQL</b>, and <b>row-limit syntax</b>.
-///     Those live here, so no dialect assumption leaks into the reader, the poll planner, or the schema browser.
-///     <para><b>This interface is the driver's SQL-injection boundary.</b> Every runtime <em>value</em> is
-///     bound as a <see cref="DbParameter"/> and never reaches a command text. Identifiers cannot be
-///     parameterized in SQL, so the few that must appear as text are emitted through
-///     <see cref="QuoteIdentifier"/>. Any code path that builds SQL by concatenating an authored tag field
-///     <em>without</em> going through <see cref="QuoteIdentifier"/> is a defect (design §8.1).</para>
-///     <para><b>Quoting is the backstop, not the only defence.</b> Design §8.1's catalog gate is
-///     implemented: <see cref="SqlCatalogGate"/> resolves every authored table/column against the live
-///     catalog at Initialize and <b>replaces it with the catalog's own spelling</b>, so an identifier
-///     reaching <see cref="QuoteIdentifier"/> on the poll path is a string this driver read back out of
-///     <see cref="ListSchemasSql"/> / <see cref="ListTablesSql"/> / <see cref="ListColumnsSql"/> — not
-///     operator input. An identifier that resolves to nothing rejects its tag (which then publishes
-///     <c>BadNodeIdUnknown</c>) rather than being quoted into a query against a nonexistent object.</para>
-///     <para>Public because <c>Driver.Sql.Browser</c> consumes it — the catalog SQL <em>is</em> the browse
-///     engine, so it is shared rather than duplicated. Implementations own their provider package;
-///     <b>no provider-specific type appears in this signature</b> (<see cref="Factory"/> is the abstract
-///     <see cref="DbProviderFactory"/>).</para>
-/// </summary>
-public interface ISqlDialect
-{
-    /// <summary>Which backend this dialect speaks. v1 constructs <see cref="SqlProvider.SqlServer"/> only.</summary>
-    SqlProvider Provider { get; }
-
-    /// <summary>
-    ///     The provider's factory singleton, used to create connections/commands/parameters. Deliberately the
-    ///     abstract base type so consumers never bind to a concrete provider package.
-    /// </summary>
-    DbProviderFactory Factory { get; }
-
-    /// <summary>
-    ///     Quotes <b>one</b> identifier part so it can be safely embedded in a command text, escaping the
-    ///     dialect's own quote character. Rejects anything that cannot be a real catalog identifier rather
-    ///     than emitting it.
-    ///     <para><b>One part only.</b> A multi-part name such as <c>dbo.TagValues</c> must be split by the
-    ///     caller and each part quoted separately; passing the dotted form yields a single (nonexistent)
-    ///     identifier — safe, but not what the caller meant.</para>
-    /// </summary>
-    /// <param name="ident">The bare, unquoted identifier — as returned by the catalog, not pre-quoted.</param>
-    /// <returns>The quoted identifier, ready to concatenate into a command text.</returns>
-    /// <exception cref="ArgumentException">The value cannot be a valid catalog identifier.</exception>
-    string QuoteIdentifier(string ident);
-
-    /// <summary>Cheapest statement that proves the connection is alive (<c>SELECT 1</c>; Oracle needs <c>FROM DUAL</c>).</summary>
-    string LivenessSql { get; }
-
-    /// <summary>
-    ///     The fragment that goes <b>immediately after <c>SELECT</c></b> to limit a statement to one row —
-    ///     T-SQL's <c>"TOP 1 "</c>. Empty for a dialect that spells the limit at the end of the statement (see
-    ///     <see cref="SingleRowLimitSuffix"/>).
-    ///     <para><b>Include the trailing space</b> when non-empty: the planner concatenates
-    ///     <c>"SELECT " + SingleRowLimitPrefix + columns</c> with no separator of its own, so an empty fragment
-    ///     must leave the statement byte-identical to an unlimited one.</para>
-    /// </summary>
-    /// <remarks>
-    ///     <para><b>Why a prefix/suffix pair rather than one <c>ApplyRowLimit(sql, n)</c> method.</b> The two
-    ///     spellings sit at opposite ends of the statement — SQL Server writes
-    ///     <c>SELECT TOP 1 … ORDER BY … DESC</c>, while SQLite/Postgres/MySQL write
-    ///     <c>SELECT … ORDER BY … DESC LIMIT 1</c>. A single method taking the SELECT list could only serve the
-    ///     prefix position; a single method taking the whole statement would move statement assembly out of the
-    ///     planner and into every dialect. Two fragments keep the planner the sole author of statement shape
-    ///     and let each dialect fill in the end it uses.</para>
-    ///     <para><b>Why "single row" rather than a row count.</b> The only limit v1 emits is the wide-row
-    ///     <c>topByTimestamp</c> selector's newest-row pick. Modelling an arbitrary <c>n</c> would be untested
-    ///     surface, and <c>FETCH FIRST</c>/<c>ROWNUM</c> dialects need more than a substituted number anyway.
-    ///     Widen this to a method when a feature actually needs <c>n &gt; 1</c>.</para>
-    /// </remarks>
-    string SingleRowLimitPrefix { get; }
-
-    /// <summary>
-    ///     The fragment appended to the <b>very end</b> of a statement to limit it to one row —
-    ///     <c>" LIMIT 1"</c> for SQLite/Postgres/MySQL. Empty for a dialect that limits after <c>SELECT</c>
-    ///     (see <see cref="SingleRowLimitPrefix"/>).
-    ///     <para><b>Include the leading space</b> when non-empty, for the same reason the prefix carries a
-    ///     trailing one: the planner appends it directly to the finished statement.</para>
-    ///     <para>Exactly one of the two fragments is non-empty in every dialect modelled so far, but the planner
-    ///     emits <b>both</b> unconditionally — a dialect needing both ends (or neither) is expressible without
-    ///     touching the call site.</para>
-    /// </summary>
-    string SingleRowLimitSuffix { get; }
-
-    /// <summary>Catalog query listing schemas — the browser's <c>RootAsync</c> level. Takes no parameters.</summary>
-    string ListSchemasSql { get; }
-
-    /// <summary>
-    ///     Scalar query returning the schema an <b>unqualified</b> object name resolves to for the connecting
-    ///     principal — T-SQL's <c>SELECT SCHEMA_NAME()</c>. Takes no parameters.
-    /// </summary>
-    /// <remarks>
-    ///     <para>Needed by <see cref="SqlCatalogGate"/>: a tag authored as <c>TagValues</c> rather than
-    ///     <c>dbo.TagValues</c> has to be looked up in <em>some</em> schema, and guessing <c>dbo</c> would be a
-    ///     silent lie on any estate that maps its service accounts to their own default schema. Asking the
-    ///     server is the only answer that matches how the poll query itself will resolve the name.</para>
-    ///     <para>It is a <em>query</em> rather than a name because the answer is per-connection, not per-dialect
-    ///     — the same dialect resolves differently for two different logins.</para>
-    /// </remarks>
-    string DefaultSchemaSql { get; }
-
-    /// <summary>Catalog query listing tables + views in one schema — the browser's schema-expand level. Bind <c>@schema</c>.</summary>
-    string ListTablesSql { get; }
-
-    /// <summary>Catalog query listing columns of one table — the browser's table-expand / attributes level. Bind <c>@schema</c> and <c>@table</c>.</summary>
-    string ListColumnsSql { get; }
-
-    /// <summary>
-    ///     Folds a catalog data-type family name (as <c>INFORMATION_SCHEMA.COLUMNS.DATA_TYPE</c> reports it —
-    ///     e.g. <c>nvarchar</c>, never <c>nvarchar(50)</c>) onto a <see cref="DriverDataType"/>.
-    ///     <para>Must <b>never throw</b>: a browse over a table holding one exotic column must still render.
-    ///     An unrecognised family falls back to <see cref="DriverDataType.String"/>.</para>
-    /// </summary>
-    /// <param name="sqlDataType">The bare SQL type family name; matched case-insensitively.</param>
-    /// <returns>The mapped driver data type, or <see cref="DriverDataType.String"/> when unrecognised.</returns>
-    DriverDataType MapColumnType(string sqlDataType);
-}
@@ -1,137 +0,0 @@
-namespace ZB.MOM.WW.OtOpcUa.Driver.Sql;
-
-/// <summary>
-///     An immutable snapshot of the parts of a database's catalog the authored tags actually name — the
-///     allow-list design §8.1 requires identifiers to come from.
-///     <para><b>This type holds catalog strings only.</b> Every name in it was read back out of
-///     <see cref="ISqlDialect.ListSchemasSql"/> / <see cref="ISqlDialect.ListTablesSql"/> /
-///     <see cref="ISqlDialect.ListColumnsSql"/>; nothing an operator typed is ever stored here. That is what
-///     lets <see cref="SqlCatalogGate"/> hand the planner catalog spellings rather than authored ones, so the
-///     identifier text in an emitted query is a string the database gave us.</para>
-///     <para><b>Deliberately partial.</b> Only the schemas/tables the authored tags name are loaded — a
-///     driver polling three tables must not enumerate a warehouse's ten thousand. A name absent from this
-///     snapshot therefore means "not found <em>when we looked</em>", which is exactly the question the gate
-///     asks.</para>
-/// </summary>
-public sealed class SqlCatalog
-{
-    private readonly IReadOnlyList<string> _schemas;
-
-    /// <summary>Canonical schema → canonical table names in it.</summary>
-    private readonly IReadOnlyDictionary<string, IReadOnlyList<string>> _tablesBySchema;
-
-    /// <summary>Canonical <c>schema.table</c> → that relation's canonical column names.</summary>
-    private readonly IReadOnlyDictionary<string, IReadOnlyList<string>> _columnsByTable;
-
-    /// <summary>Constructs a catalog snapshot.</summary>
-    /// <param name="defaultSchema">The schema an unqualified object name resolves to for this connection.</param>
-    /// <param name="schemas">Every schema the connection can see.</param>
-    /// <param name="tablesBySchema">Canonical schema → its tables/views.</param>
-    /// <param name="columnsByTable">Canonical <c>schema.table</c> → its columns.</param>
-    internal SqlCatalog(
-        string defaultSchema,
-        IReadOnlyList<string> schemas,
-        IReadOnlyDictionary<string, IReadOnlyList<string>> tablesBySchema,
-        IReadOnlyDictionary<string, IReadOnlyList<string>> columnsByTable)
-    {
-        DefaultSchema = defaultSchema;
-        _schemas = schemas;
-        _tablesBySchema = tablesBySchema;
-        _columnsByTable = columnsByTable;
-    }
-
-    /// <summary>The schema an unqualified authored object name is resolved in.</summary>
-    public string DefaultSchema { get; }
-
-    /// <summary>Resolves an authored schema name to the catalog's own spelling.</summary>
-    /// <param name="authored">The authored schema, or null/blank for the default schema.</param>
-    /// <param name="canonical">The catalog's spelling, when resolved.</param>
-    /// <returns><see langword="true"/> when the schema exists (or the default schema is used).</returns>
-    public bool TryResolveSchema(string? authored, out string canonical)
-    {
-        if (string.IsNullOrWhiteSpace(authored))
-        {
-            canonical = DefaultSchema;
-            return true;
-        }
-
-        return TryMatch(_schemas, authored, out canonical);
-    }
-
-    /// <summary>Resolves an authored table/view name within a canonical schema.</summary>
-    /// <param name="canonicalSchema">The schema, already resolved through <see cref="TryResolveSchema"/>.</param>
-    /// <param name="authored">The authored table or view name.</param>
-    /// <param name="canonical">The catalog's spelling, when resolved.</param>
-    /// <returns><see langword="true"/> when the relation exists in that schema.</returns>
-    public bool TryResolveTable(string canonicalSchema, string authored, out string canonical)
-    {
-        canonical = string.Empty;
-        return _tablesBySchema.TryGetValue(canonicalSchema, out var tables)
-               && TryMatch(tables, authored, out canonical);
-    }
-
-    /// <summary>Resolves an authored column name within a canonical relation.</summary>
-    /// <param name="canonicalSchema">The resolved schema.</param>
-    /// <param name="canonicalTable">The resolved table or view.</param>
-    /// <param name="authored">The authored column name.</param>
-    /// <param name="canonical">The catalog's spelling, when resolved.</param>
-    /// <returns><see langword="true"/> when the column exists on that relation.</returns>
-    public bool TryResolveColumn(
-        string canonicalSchema, string canonicalTable, string authored, out string canonical)
-    {
-        canonical = string.Empty;
-        return _columnsByTable.TryGetValue(QualifiedKey(canonicalSchema, canonicalTable), out var columns)
-               && TryMatch(columns, authored, out canonical);
-    }
-
-    /// <summary>The dictionary key for a canonical relation.</summary>
-    /// <param name="schema">The canonical schema.</param>
-    /// <param name="table">The canonical table.</param>
-    /// <returns>The composite key.</returns>
-    internal static string QualifiedKey(string schema, string table) => schema + "." + table;
-
-    /// <summary>
-    ///     Matches an authored name against catalog spellings: an exact (ordinal) hit wins, otherwise a
-    ///     <b>unique</b> case-insensitive hit is accepted and its catalog spelling returned.
-    /// </summary>
-    /// <remarks>
-    ///     <para><b>Why case-insensitive at all.</b> SQL Server's default collation is case-insensitive, so
-    ///     <c>num_value</c> and <c>NUM_VALUE</c> genuinely name the same column and both work today. Matching
-    ///     ordinally would reject configurations that have always been valid — a gate that breaks working
-    ///     deployments is not defence in depth.</para>
-    ///     <para><b>Why exact-first, and why ambiguity fails.</b> On a case-<em>sensitive</em> collation a
-    ///     relation may legitimately carry both <c>Value</c> and <c>value</c>. Preferring the exact match keeps
-    ///     such a config resolving to what the operator wrote, and refusing to choose between two
-    ///     case-insensitive candidates is the only safe answer — silently picking one would publish a different
-    ///     column's data under the operator's node, which is worse than rejecting the tag.</para>
-    /// </remarks>
-    /// <param name="candidates">The catalog spellings to match against.</param>
-    /// <param name="authored">The authored name.</param>
-    /// <param name="canonical">The catalog's spelling, when matched.</param>
-    /// <returns><see langword="true"/> on an unambiguous match.</returns>
-    internal static bool TryMatch(IReadOnlyList<string> candidates, string authored, out string canonical)
-    {
-        foreach (var candidate in candidates)
-        {
-            if (!string.Equals(candidate, authored, StringComparison.Ordinal)) continue;
-            canonical = candidate;
-            return true;
-        }
-
-        canonical = string.Empty;
-        var matches = 0;
-        foreach (var candidate in candidates)
-        {
-            if (!string.Equals(candidate, authored, StringComparison.OrdinalIgnoreCase)) continue;
-            if (++matches > 1)
-            {
-                canonical = string.Empty;
-                return false;
-            }
-
-            canonical = candidate;
-        }
-
-        return matches == 1;
-    }
-}
@@ -1,241 +0,0 @@
-using ZB.MOM.WW.OtOpcUa.Driver.Sql.Contracts;
-
-namespace ZB.MOM.WW.OtOpcUa.Driver.Sql;
-
-/// <summary>
-///     One tag the gate refused, and why. Carried rather than logged in place so the caller decides the log
-///     shape and the caller's tests can assert on the reason.
-/// </summary>
-/// <param name="RawPath">The rejected tag's identity — its RawPath, which is trusted structure, not blob content.</param>
-/// <param name="Field">The <see cref="SqlTagDefinition"/> field that failed (e.g. <c>ValueColumn</c>).</param>
-/// <param name="Reason">An operator-actionable explanation, safe to log.</param>
-public sealed record SqlCatalogRejection(string RawPath, string Field, string Reason);
-
-/// <summary>The outcome of applying a <see cref="SqlCatalog"/> to a set of authored tags.</summary>
-/// <param name="Accepted">
-///     The surviving definitions, <b>rewritten to catalog spellings</b>. Safe to hand to
-///     <see cref="SqlGroupPlanner"/>.
-/// </param>
-/// <param name="Rejected">Every tag the gate refused, in input order.</param>
-public sealed record SqlCatalogGateResult(
-    IReadOnlyList<SqlTagDefinition> Accepted,
-    IReadOnlyList<SqlCatalogRejection> Rejected);
-
-/// <summary>
-///     Design §8.1's identifier gate: validates every authored table/column against the live catalog
-///     <b>before</b> it can be quoted into SQL text, and replaces it with the catalog's own spelling.
-/// </summary>
-/// <remarks>
-///     <para><b>What this closes.</b> Until this existed, <see cref="ISqlDialect.QuoteIdentifier"/> was the
-///     sole defence: an identifier went from the authored <c>TagConfig</c> blob straight into a command text,
-///     bracket-quoted. The residual risk was bounded — a hostile name is quoted into one nonexistent object,
-///     the query fails after the connection opens, and the tag Bad-codes — but "bounded" is not "filtered",
-///     and the design promised a filter. With the gate in place the identifier text in an emitted query is a
-///     string this driver read back out of the catalog, so quoting is a backstop behind an allow-list rather
-///     than the whole story.</para>
-///     <para><b>Charset first, catalog second.</b> Each identifier is passed through
-///     <see cref="ISqlDialect.QuoteIdentifier"/> before it is looked up, purely for its rejection rules
-///     (control characters, Unicode format characters, over-length). That ordering is deliberate: a name that
-///     fails the charset check is rejected <em>without its value being echoed</em>, so nothing carrying a bidi
-///     override or a NUL can reach a log line through this type's rejection messages. A name that passes has
-///     been proven safe to render, which is why the catalog-miss messages can afford to name it — and they
-///     must, or an operator has no way to find the typo.</para>
-///     <para><b>Rejection is per-tag, never driver-wide.</b> A tag naming a dropped column is dropped from the
-///     driver's table, so its RawPath resolves to nothing and it publishes
-///     <see cref="SqlStatusCodes.BadNodeIdUnknown"/> — design §8.1's specified outcome — while every other tag
-///     on that database keeps polling. This mirrors the "one malformed blob must not take the whole driver
-///     down" rule the tag-table build already follows.</para>
-/// </remarks>
-public static class SqlCatalogGate
-{
-    /// <summary>
-    ///     The most name parts this gate can validate. A three-part <c>db.schema.table</c> (or a
-    ///     four-part linked-server name) addresses a catalog this connection's <c>INFORMATION_SCHEMA</c>
-    ///     cannot see, so it cannot be allow-listed.
-    /// </summary>
-    private const int MaxNameParts = 2;
-
-    /// <summary>
-    ///     Applies <paramref name="catalog"/> to <paramref name="definitions"/>, returning the accepted tags
-    ///     with catalog-spelled identifiers and the rejected ones with reasons.
-    /// </summary>
-    /// <param name="definitions">The authored definitions, as parsed from their <c>TagConfig</c> blobs.</param>
-    /// <param name="catalog">The catalog snapshot to validate against.</param>
-    /// <param name="dialect">Supplies the identifier charset rules via <see cref="ISqlDialect.QuoteIdentifier"/>.</param>
-    /// <returns>The accepted and rejected sets.</returns>
-    /// <exception cref="ArgumentNullException">A required argument is null.</exception>
-    public static SqlCatalogGateResult Apply(
-        IEnumerable<SqlTagDefinition> definitions, SqlCatalog catalog, ISqlDialect dialect)
-    {
-        ArgumentNullException.ThrowIfNull(definitions);
-        ArgumentNullException.ThrowIfNull(catalog);
-        ArgumentNullException.ThrowIfNull(dialect);
-
-        var accepted = new List<SqlTagDefinition>();
-        var rejected = new List<SqlCatalogRejection>();
-
-        foreach (var definition in definitions)
-        {
-            ArgumentNullException.ThrowIfNull(definition);
-            if (TryCanonicalize(definition, catalog, dialect, out var canonical, out var rejection))
-                accepted.Add(canonical!);
-            else
-                rejected.Add(rejection!);
-        }
-
-        return new SqlCatalogGateResult(accepted, rejected);
-    }
-
-    /// <summary>Resolves one definition's identifiers, or explains the first failure.</summary>
-    private static bool TryCanonicalize(
-        SqlTagDefinition definition,
-        SqlCatalog catalog,
-        ISqlDialect dialect,
-        out SqlTagDefinition? canonical,
-        out SqlCatalogRejection? rejection)
-    {
-        canonical = null;
-        rejection = null;
-
-        if (!TryResolveRelation(definition, catalog, dialect, out var schema, out var table, out rejection))
-            return false;
-
-        // Every identifier-bearing field, paired with its name for the rejection message. A field the tag's
-        // model does not use is null and simply skipped — the planner enforces which are required.
-        var resolved = new Dictionary<string, string?>(StringComparer.Ordinal);
-        foreach (var (field, authored) in new (string Field, string? Authored)[]
-                 {
-                     (nameof(SqlTagDefinition.KeyColumn), definition.KeyColumn),
-                     (nameof(SqlTagDefinition.ValueColumn), definition.ValueColumn),
-                     (nameof(SqlTagDefinition.TimestampColumn), definition.TimestampColumn),
-                     (nameof(SqlTagDefinition.ColumnName), definition.ColumnName),
-                     (nameof(SqlTagDefinition.RowSelectorColumn), definition.RowSelectorColumn),
-                     (nameof(SqlTagDefinition.RowSelectorTopByTimestamp), definition.RowSelectorTopByTimestamp),
-                 })
-        {
-            if (string.IsNullOrWhiteSpace(authored))
-            {
-                resolved[field] = authored;
-                continue;
-            }
-
-            if (!IsRenderableIdentifier(authored, dialect))
-            {
-                rejection = new SqlCatalogRejection(definition.Name, field,
-                    $"the authored {field} is not a usable identifier (it is over-long, or contains control " +
-                    "or Unicode format characters); the value is withheld from this message because it " +
-                    "cannot be safely rendered");
-                return false;
-            }
-
-            if (!catalog.TryResolveColumn(schema, table, authored, out var column))
-            {
-                rejection = new SqlCatalogRejection(definition.Name, field,
-                    $"column '{authored}' does not exist on '{schema}.{table}' (or matches more than one " +
-                    "column under a case-sensitive collation)");
-                return false;
-            }
-
-            resolved[field] = column;
-        }
-
-        canonical = definition with
-        {
-            Table = SqlCatalog.QualifiedKey(schema, table),
-            KeyColumn = resolved[nameof(SqlTagDefinition.KeyColumn)],
-            ValueColumn = resolved[nameof(SqlTagDefinition.ValueColumn)],
-            TimestampColumn = resolved[nameof(SqlTagDefinition.TimestampColumn)],
-            ColumnName = resolved[nameof(SqlTagDefinition.ColumnName)],
-            RowSelectorColumn = resolved[nameof(SqlTagDefinition.RowSelectorColumn)],
-            RowSelectorTopByTimestamp = resolved[nameof(SqlTagDefinition.RowSelectorTopByTimestamp)],
-        };
-        return true;
-    }
-
-    /// <summary>Splits and resolves the authored <c>table</c> to a canonical schema + relation.</summary>
-    private static bool TryResolveRelation(
-        SqlTagDefinition definition,
-        SqlCatalog catalog,
-        ISqlDialect dialect,
-        out string schema,
-        out string table,
-        out SqlCatalogRejection? rejection)
-    {
-        schema = string.Empty;
-        table = string.Empty;
-        rejection = null;
-        const string Field = nameof(SqlTagDefinition.Table);
-
-        if (string.IsNullOrWhiteSpace(definition.Table))
-        {
-            rejection = new SqlCatalogRejection(definition.Name, Field,
-                "the tag has no 'table'; author the table or view to read");
-            return false;
-        }
-
-        var parts = definition.Table.Split('.');
-        if (parts.Length > MaxNameParts)
-        {
-            rejection = new SqlCatalogRejection(definition.Name, Field,
-                $"'{definition.Table}' is a {parts.Length}-part name. Only 'table' and 'schema.table' can be " +
-                "validated against this connection's catalog, so a cross-database or linked-server name " +
-                "cannot be allow-listed; expose the data through a view in this database instead");
-            return false;
-        }
-
-        var authoredSchema = parts.Length == MaxNameParts ? parts[0] : null;
-        var authoredTable = parts[^1];
-
-        foreach (var part in parts)
-        {
-            if (IsRenderableIdentifier(part, dialect)) continue;
-            rejection = new SqlCatalogRejection(definition.Name, Field,
-                "the authored table name has a part that is not a usable identifier (empty, over-long, or " +
-                "containing control or Unicode format characters); the value is withheld from this message " +
-                "because it cannot be safely rendered");
-            return false;
-        }
-
-        if (!catalog.TryResolveSchema(authoredSchema, out schema))
-        {
-            rejection = new SqlCatalogRejection(definition.Name, Field,
-                $"schema '{authoredSchema}' does not exist (or matches more than one schema under a " +
-                "case-sensitive collation)");
-            return false;
-        }
-
-        if (!catalog.TryResolveTable(schema, authoredTable, out table))
-        {
-            rejection = new SqlCatalogRejection(definition.Name, Field,
-                $"table or view '{authoredTable}' does not exist in schema '{schema}'" +
-                (authoredSchema is null
-                    ? $" (the connection's default schema — qualify the name as 'schema.{authoredTable}' if it lives elsewhere)"
-                    : string.Empty));
-            return false;
-        }
-
-        return true;
-    }
-
-    /// <summary>
-    ///     True when the dialect's quoting rules accept <paramref name="identifier"/> — i.e. it is safe both to
-    ///     embed in SQL and to render into a log line or an AdminUI label.
-    /// </summary>
-    /// <remarks>
-    ///     Uses <see cref="ISqlDialect.QuoteIdentifier"/> as the charset authority rather than duplicating its
-    ///     rules, so the two can never disagree about what a legal identifier is. The quoted result is
-    ///     discarded: only whether it threw is interesting here.
-    /// </remarks>
-    private static bool IsRenderableIdentifier(string identifier, ISqlDialect dialect)
-    {
-        try
-        {
-            dialect.QuoteIdentifier(identifier);
-            return true;
-        }
-        catch (ArgumentException)
-        {
-            return false;
-        }
-    }
-}
@@ -1,189 +0,0 @@
-using System.Data;
-using System.Data.Common;
-
-namespace ZB.MOM.WW.OtOpcUa.Driver.Sql;
-
-/// <summary>
-///     Loads the <see cref="SqlCatalog"/> slice the authored tags need, over one connection, using only the
-///     dialect's catalog SQL (design §8.1).
-/// </summary>
-/// <remarks>
-///     <para><b>Bounded by what is authored, not by what exists.</b> One query for the schema list, one for
-///     the default schema, then one <see cref="ISqlDialect.ListTablesSql"/> per distinct authored schema and
-///     one <see cref="ISqlDialect.ListColumnsSql"/> per distinct authored relation. A driver polling three
-///     tables issues a handful of round-trips at Initialize and none thereafter; it never enumerates a
-///     warehouse.</para>
-///     <para><b>Every parameter is bound.</b> Authored names reach the catalog queries as
-///     <c>@schema</c>/<c>@table</c> parameters — the same discipline the schema browser follows — so loading
-///     the allow-list cannot itself be an injection vector. No identifier is quoted into text on this path.</para>
-///     <para><b>Failures throw; they do not degrade to an empty catalog.</b> An empty catalog would reject
-///     every tag, which is indistinguishable at the OPC UA surface from a database whose objects were all
-///     dropped. A caller that cannot read the catalog has not learned that the tags are invalid — it has
-///     learned nothing — and must fail its Initialize so the driver retries rather than serving a
-///     confidently-empty address space.</para>
-/// </remarks>
-internal static class SqlCatalogLoader
-{
-    /// <summary>Column alias <see cref="ISqlDialect.ListSchemasSql"/> projects.</summary>
-    private const string SchemaColumn = "TABLE_SCHEMA";
-
-    /// <summary>Column alias <see cref="ISqlDialect.ListTablesSql"/> projects.</summary>
-    private const string TableNameColumn = "TABLE_NAME";
-
-    /// <summary>Column alias <see cref="ISqlDialect.ListColumnsSql"/> projects.</summary>
-    private const string ColumnNameColumn = "COLUMN_NAME";
-
-    /// <summary>
-    ///     Reads the catalog slice covering <paramref name="authoredTables"/>.
-    /// </summary>
-    /// <param name="connection">An <b>already-open</b> connection. Not disposed here; the caller owns it.</param>
-    /// <param name="dialect">Supplies the catalog SQL.</param>
-    /// <param name="authoredTables">The distinct authored <c>table</c> strings, as written in the blobs.</param>
-    /// <param name="commandTimeout">Per-command server-side backstop.</param>
-    /// <param name="cancellationToken">Cancellation token for the operation.</param>
-    /// <returns>The loaded catalog.</returns>
-    /// <exception cref="InvalidOperationException">The connection can see no schemas at all.</exception>
-    internal static async Task<SqlCatalog> LoadAsync(
-        DbConnection connection,
-        ISqlDialect dialect,
-        IReadOnlyCollection<string> authoredTables,
-        TimeSpan commandTimeout,
-        CancellationToken cancellationToken)
-    {
-        var timeoutSeconds = Math.Max(1, (int)Math.Ceiling(commandTimeout.TotalSeconds));
-
-        var schemas = await QueryColumnAsync(
-            connection, dialect.ListSchemasSql, SchemaColumn,
-            static _ => { }, timeoutSeconds, cancellationToken).ConfigureAwait(false);
-
-        // Zero schemas is a permissions or visibility symptom, never a real database. Rejecting every tag on
-        // that basis would report an authoring fault for what is actually a grant problem, and would send the
-        // operator to the wrong system — the same misdiagnosis the driver's health classification avoids.
-        if (schemas.Count == 0)
-            throw new InvalidOperationException(
-                "the catalog returned no schemas at all; the connecting principal most likely cannot read " +
-                "the catalog views, which is a grant problem rather than a tag-authoring one");
-
-        var defaultSchema = await ReadDefaultSchemaAsync(
-            connection, dialect, timeoutSeconds, cancellationToken).ConfigureAwait(false);
-
-        var tablesBySchema = new Dictionary<string, IReadOnlyList<string>>(StringComparer.Ordinal);
-        var columnsByTable = new Dictionary<string, IReadOnlyList<string>>(StringComparer.Ordinal);
-
-        // Resolving here goes through SqlCatalog.TryMatch — the SAME matcher the gate will use — so the
-        // loader and the gate can never disagree about which relation an authored name resolved to. Loading
-        // one table and validating against another would be a silent wrong-column defect.
-        foreach (var authored in authoredTables)
-        {
-            if (string.IsNullOrWhiteSpace(authored)) continue;
-
-            var parts = authored.Split('.');
-            if (parts.Length > 2) continue;   // the gate rejects these by name; nothing to load.
-
-            var authoredTable = parts[^1];
-            string schema;
-            if (parts.Length == 2)
-            {
-                if (!SqlCatalog.TryMatch(schemas, parts[0], out schema)) continue;
-            }
-            else
-            {
-                schema = defaultSchema;
-            }
-
-            if (!tablesBySchema.TryGetValue(schema, out var tables))
-            {
-                tables = await QueryColumnAsync(
-                    connection, dialect.ListTablesSql, TableNameColumn,
-                    command => Bind(command, "@schema", schema),
-                    timeoutSeconds, cancellationToken).ConfigureAwait(false);
-                tablesBySchema[schema] = tables;
-            }
-
-            if (!SqlCatalog.TryMatch(tables, authoredTable, out var table)) continue;
-
-            var key = SqlCatalog.QualifiedKey(schema, table);
-            if (columnsByTable.ContainsKey(key)) continue;
-
-            columnsByTable[key] = await QueryColumnAsync(
-                connection, dialect.ListColumnsSql, ColumnNameColumn,
-                command =>
-                {
-                    Bind(command, "@schema", schema);
-                    Bind(command, "@table", table);
-                },
-                timeoutSeconds, cancellationToken).ConfigureAwait(false);
-        }
-
-        return new SqlCatalog(defaultSchema, schemas, tablesBySchema, columnsByTable);
-    }
-
-    /// <summary>
-    ///     Reads the connection's default schema, falling back to the sole visible schema when the dialect's
-    ///     query answers null/blank.
-    /// </summary>
-    /// <remarks>
-    ///     A null answer is possible (a login with no default schema mapped). Falling back to the single
-    ///     visible schema keeps the common one-schema database working; with several visible schemas there is
-    ///     no defensible guess, so unqualified names simply will not resolve and the gate says so by name.
-    /// </remarks>
-    private static async Task<string> ReadDefaultSchemaAsync(
-        DbConnection connection, ISqlDialect dialect, int timeoutSeconds, CancellationToken cancellationToken)
-    {
-        var command = connection.CreateCommand();
-        await using (command.ConfigureAwait(false))
-        {
-            command.CommandText = dialect.DefaultSchemaSql;
-            command.CommandTimeout = timeoutSeconds;
-            var value = await command.ExecuteScalarAsync(cancellationToken).ConfigureAwait(false);
-            var schema = value is null or DBNull ? null : value.ToString();
-            return string.IsNullOrWhiteSpace(schema) ? string.Empty : schema;
-        }
-    }
-
-    /// <summary>Runs one catalog query and projects a single string column from every row.</summary>
-    private static async Task<IReadOnlyList<string>> QueryColumnAsync(
-        DbConnection connection,
-        string sql,
-        string columnName,
-        Action<DbCommand> bind,
-        int timeoutSeconds,
-        CancellationToken cancellationToken)
-    {
-        var results = new List<string>();
-
-        var command = connection.CreateCommand();
-        await using (command.ConfigureAwait(false))
-        {
-            command.CommandText = sql;
-            command.CommandTimeout = timeoutSeconds;
-            bind(command);
-
-            var reader = await command
-                .ExecuteReaderAsync(CommandBehavior.SingleResult, cancellationToken).ConfigureAwait(false);
-            await using (reader.ConfigureAwait(false))
-            {
-                var ordinal = -1;
-                while (await reader.ReadAsync(cancellationToken).ConfigureAwait(false))
-                {
-                    if (ordinal < 0) ordinal = reader.GetOrdinal(columnName);
-                    if (reader.IsDBNull(ordinal)) continue;
-                    var value = reader.GetValue(ordinal)?.ToString();
-                    if (!string.IsNullOrWhiteSpace(value)) results.Add(value);
-                }
-            }
-        }
-
-        return results;
-    }
-
-    /// <summary>Binds one catalog-query parameter — the only way an authored name reaches the database here.</summary>
-    private static void Bind(DbCommand command, string name, string value)
-    {
-        var parameter = command.CreateParameter();
-        parameter.ParameterName = name;
-        parameter.DbType = DbType.String;
-        parameter.Value = value;
-        command.Parameters.Add(parameter);
-    }
-}
@@ -1,62 +0,0 @@
-namespace ZB.MOM.WW.OtOpcUa.Driver.Sql;
-
-/// <summary>
-///     Resolves a <c>Sql</c> driver config's <c>connectionStringRef</c> — a NAME — into the connection string
-///     it stands for (design §8.2). The deployed artifact carries only the name, so database credentials never
-///     ride in a config blob, never land in the central config DB, and never appear in a deployment diff.
-///     <para><b>The environment is read directly, on purpose.</b> A driver factory is invoked through
-///     <c>DriverFactoryRegistry</c>'s <c>(driverInstanceId, driverConfigJson)</c> closure — there is no
-///     <c>IConfiguration</c>, no <c>IServiceProvider</c> and no ambient scope at that seam, and widening the
-///     registry's signature for one driver would change every driver in the tree. The
-///     <c>Sql__ConnectionStrings__&lt;ref&gt;</c> spelling is exactly the key .NET's environment-variable
-///     configuration provider would bind to <c>Sql:ConnectionStrings:&lt;ref&gt;</c>, so an operator can set it
-///     the same way they set every other secret and a later move onto <c>IConfiguration</c> needs no
-///     re-provisioning.</para>
-///     <para><b>Nothing here ever emits the resolved value.</b> Messages name the environment
-///     <em>variable</em>, which is not a secret and is the operator's next action; the value itself is returned
-///     to exactly one caller and is otherwise unmentioned.</para>
-/// </summary>
-public static class SqlConnectionStringResolver
-{
-    /// <summary>
-    ///     The environment-variable prefix a <c>connectionStringRef</c> is appended to. The double underscore
-    ///     is .NET's configuration hierarchy separator, so this is the environment spelling of
-    ///     <c>Sql:ConnectionStrings:&lt;ref&gt;</c>.
-    /// </summary>
-    public const string EnvironmentVariablePrefix = "Sql__ConnectionStrings__";
-
-    /// <summary>The environment variable a given <c>connectionStringRef</c> is read from.</summary>
-    /// <param name="connectionStringRef">The authored reference name.</param>
-    /// <returns>The full environment-variable name.</returns>
-    /// <exception cref="ArgumentException"><paramref name="connectionStringRef"/> is null, empty or whitespace.</exception>
-    public static string EnvironmentVariableFor(string connectionStringRef)
-    {
-        ArgumentException.ThrowIfNullOrWhiteSpace(connectionStringRef);
-        return string.Concat(EnvironmentVariablePrefix, connectionStringRef);
-    }
-
-    /// <summary>
-    ///     Resolves <paramref name="connectionStringRef"/> to its connection string.
-    ///     <para>An absent <b>or blank</b> variable is a half-provisioned deployment and throws: handing an
-    ///     empty string to the provider would surface as an unintelligible ADO.NET error at the first poll,
-    ///     far from the missing secret that actually caused it.</para>
-    /// </summary>
-    /// <param name="connectionStringRef">The authored reference name.</param>
-    /// <returns>The resolved connection string. <b>Treat as a secret</b> — never log it.</returns>
-    /// <exception cref="ArgumentException"><paramref name="connectionStringRef"/> is null, empty or whitespace.</exception>
-    /// <exception cref="InvalidOperationException">The environment variable is absent or blank.</exception>
-    public static string Resolve(string connectionStringRef)
-    {
-        var variable = EnvironmentVariableFor(connectionStringRef);
-        var value = Environment.GetEnvironmentVariable(variable);
-        if (string.IsNullOrWhiteSpace(value))
-        {
-            throw new InvalidOperationException(
-                $"Sql connection string '{connectionStringRef}' is not provisioned: set the environment " +
-                $"variable '{variable}' on every node that runs this driver. The connection string is " +
-                $"deliberately not carried in the deployed configuration.");
-        }
-
-        return value;
-    }
-}
@@ -1,937 +0,0 @@
-using System.Data.Common;
-using Microsoft.Extensions.Logging;
-using Microsoft.Extensions.Logging.Abstractions;
-using ZB.MOM.WW.OtOpcUa.Core.Abstractions;
-using ZB.MOM.WW.OtOpcUa.Driver.Sql.Contracts;
-
-namespace ZB.MOM.WW.OtOpcUa.Driver.Sql;
-
-/// <summary>
-///     The <c>Sql</c> driver instance: a <b>read-only</b> Equipment-kind driver that polls SQL tables/views
-///     and publishes selected cells as OPC UA variables. Structurally the SQL analogue of
-///     <c>ModbusDriver</c> — this type owns lifecycle, the authored RawPath table, health, host
-///     connectivity, and the <see cref="PollGroupEngine"/> subscription overlay, while
-///     <see cref="SqlPollReader"/> owns the read path.
-///     <para><b>Read-only is structural, not configured.</b> <see cref="IWritable"/> is deliberately not
-///     implemented, so no amount of config (and no <c>WriteOperate</c> role) can produce a write; every
-///     discovered variable is <see cref="SecurityClassification.ViewOnly"/>. A future write feature is a
-///     new capability, not a flag flip.</para>
-///     <para><b>Health is classified here, because nothing below does it.</b> The reader honours
-///     <see cref="IReadable"/> literally: it throws only when the database cannot be reached, and turns
-///     every other failure — including a frozen database — into Bad-coded snapshots. Those return
-///     <em>successfully</em>, so <see cref="PollGroupEngine"/> sees a clean tick, does not back off, and does
-///     not call <see cref="HandlePollError"/>. Without <see cref="ObservePollOutcome"/> below, a driver whose
-///     every value is <see cref="SqlStatusCodes.BadTimeout"/> would keep reporting
-///     <see cref="DriverState.Healthy"/>. See that method for the exact rule and for why it does not
-///     manufacture an exception to force backoff.</para>
-/// </summary>
-public sealed class SqlDriver
-    : IDriver, ITagDiscovery, IReadable, ISubscribable, IHostConnectivityProbe, IAsyncDisposable
-{
-    /// <summary>
-    ///     The driver-type string this driver registers under — <see cref="DriverTypeNames.Sql"/>, the single
-    ///     source of truth the deploy pipeline stores in <c>DriverInstance.DriverType</c> and every dispatch
-    ///     map keys by. Chained off the shared constant (Task 11 wired the factory + probe, so
-    ///     <c>DriverTypeNamesGuardTests</c>' bidirectional-parity check is satisfied).
-    /// </summary>
-    public const string DriverTypeName = DriverTypeNames.Sql;
-
-    /// <summary>Shown for a connection string that names no recognisable server.</summary>
-    private const string UnknownEndpoint = "(unknown sql endpoint)";
-
-    /// <summary>Upper bound on the poll-loop failure backoff — the S7-proven 30 s cap adopted fleet-wide (05/STAB-8).</summary>
-    private static readonly TimeSpan PollBackoffCap = TimeSpan.FromSeconds(30);
-
-    /// <summary>Connection-string keys that name the server, in the order they are consulted.</summary>
-    private static readonly string[] ServerKeys =
-        ["server", "data source", "datasource", "host", "address", "addr", "network address"];
-
-    /// <summary>Connection-string keys that name the database.</summary>
-    private static readonly string[] DatabaseKeys = ["database", "initial catalog"];
-
-    // ---- instance fields (grouped at top for auditability) ----
-
-    private readonly SqlDriverOptions _options;
-    private readonly string _driverInstanceId;
-    private readonly ISqlDialect _dialect;
-    private readonly DbProviderFactory _factory;
-
-    /// <summary>
-    ///     The resolved connection string — a <b>secret</b>. It is passed to the provider and to nothing
-    ///     else: every log line, health message and host status carries <see cref="Endpoint"/> instead.
-    /// </summary>
-    private readonly string _connectionString;
-
-    private readonly ILogger<SqlDriver> _logger;
-
-    /// <summary>
-    ///     The authored RawPath → definition table, held as an <b>immutable snapshot swapped atomically</b>
-    ///     rather than as a mutated dictionary (the shape <c>ModbusDriver</c> uses).
-    ///     <see cref="ReinitializeAsync"/> rebuilds this table while poll loops are reading it; clearing and
-    ///     refilling a shared <see cref="Dictionary{TKey,TValue}"/> under that concurrency is a torn read at
-    ///     best and an <see cref="InvalidOperationException"/> inside a poll at worst.
-    /// </summary>
-    private IReadOnlyDictionary<string, SqlTagDefinition> _tagsByRawPath =
-        new Dictionary<string, SqlTagDefinition>(StringComparer.Ordinal);
-
-    /// <summary>
-    ///     The subset of <see cref="_tagsByRawPath"/> that survived the design §8.1 catalog gate, with every
-    ///     identifier rewritten to the catalog's own spelling. <b>This — not the authored table — is what a
-    ///     read or a poll resolves against</b>, so an identifier that never appeared in the catalog can never
-    ///     reach a query.
-    ///     <para><b>Why the two tables are separate.</b> A tag the gate rejected must still <em>exist</em> as a
-    ///     node: §8.1's specified outcome is that it publishes
-    ///     <see cref="SqlStatusCodes.BadNodeIdUnknown"/>, and a status code can only be published by a node
-    ///     that is there. Dropping rejected tags from the authored table too would delete the node instead,
-    ///     turning a diagnosable Bad quality into a silently missing address-space entry — a strictly worse
-    ///     failure for the operator trying to find their typo.</para>
-    ///     <para>Swapped atomically, for the same reason the authored table is.</para>
-    /// </summary>
-    private IReadOnlyDictionary<string, SqlTagDefinition> _polledByRawPath =
-        new Dictionary<string, SqlTagDefinition>(StringComparer.Ordinal);
-
-    /// <summary>Resolves a read/subscribe RawPath to its <b>catalog-validated</b> definition, or a miss.</summary>
-    private readonly EquipmentTagRefResolver<SqlTagDefinition> _resolver;
-
-    /// <summary>
-    ///     The read path. Built once, in the constructor, and <b>not</b> injected: its <c>resolve</c>
-    ///     delegate must read this driver's live authored table, which does not exist before the driver does.
-    /// </summary>
-    private readonly SqlPollReader _reader;
-
-    /// <summary>Polled subscriptions. The driver supplies the reader + change bridge; the engine owns the loop.</summary>
-    private readonly PollGroupEngine _poll;
-
-    // Single logical host: one driver instance dials one connection string. HostName is the endpoint
-    // description (server[/database]) so the Admin UI shows operators where to look.
-    private readonly object _probeLock = new();
-    private HostState _hostState = HostState.Unknown;
-    private DateTime _hostStateChangedUtc = DateTime.UtcNow;
-
-    private DriverHealth _health = new(DriverState.Unknown, null, null);
-
-    /// <summary>Occurs when a subscribed tag's value or quality changes.</summary>
-    public event EventHandler<DataChangeEventArgs>? OnDataChange;
-
-    /// <summary>Occurs when the database endpoint transitions between reachable and unreachable.</summary>
-    public event EventHandler<HostStatusChangedEventArgs>? OnHostStatusChanged;
-
-    // ---- ctor + identity ----
-
-    /// <summary>Initializes a new <c>Sql</c> driver instance.</summary>
-    /// <param name="options">The driver's typed configuration (the factory applies the documented defaults).</param>
-    /// <param name="driverInstanceId">The central config DB's identity for this driver instance.</param>
-    /// <param name="dialect">
-    ///     The provider seam — identifier quoting, liveness SQL, row-limit syntax and column-type mapping.
-    /// </param>
-    /// <param name="connectionString">
-    ///     The <b>already-resolved</b> connection string. The driver never resolves a
-    ///     <c>connectionStringRef</c> itself and never logs this value.
-    /// </param>
-    /// <param name="factory">
-    ///     Creates the provider's connections. Defaults to <paramref name="dialect"/>'s factory; passed
-    ///     explicitly by tests that need to observe or delay connection creation.
-    /// </param>
-    /// <param name="logger">Optional; defaults to a no-op logger.</param>
-    /// <exception cref="ArgumentNullException">A required reference argument is null.</exception>
-    /// <exception cref="ArgumentException"><paramref name="driverInstanceId"/> or <paramref name="connectionString"/> is blank.</exception>
-    public SqlDriver(
-        SqlDriverOptions options,
-        string driverInstanceId,
-        ISqlDialect dialect,
-        string connectionString,
-        DbProviderFactory? factory = null,
-        ILogger<SqlDriver>? logger = null)
-    {
-        ArgumentNullException.ThrowIfNull(options);
-        ArgumentNullException.ThrowIfNull(dialect);
-        ArgumentException.ThrowIfNullOrWhiteSpace(driverInstanceId);
-        if (string.IsNullOrWhiteSpace(connectionString))
-            throw new ArgumentException("A Sql driver needs a resolved connection string.", nameof(connectionString));
-
-        _options = options;
-        _driverInstanceId = driverInstanceId;
-        _dialect = dialect;
-        _factory = factory ?? dialect.Factory;
-        _connectionString = connectionString;
-        _logger = logger ?? NullLogger<SqlDriver>.Instance;
-        Endpoint = DescribeEndpoint(connectionString);
-
-        _resolver = new EquipmentTagRefResolver<SqlTagDefinition>(Lookup);
-        _reader = new SqlPollReader(
-            _factory,
-            connectionString,
-            dialect,
-            commandTimeout: options.CommandTimeout,
-            operationTimeout: options.OperationTimeout,
-            maxConcurrentGroups: options.MaxConcurrentGroups,
-            nullIsBad: options.NullIsBad,
-            resolve: rawPath => _resolver.TryResolve(rawPath, out var definition) ? definition : null,
-            logger: _logger);
-        _poll = new PollGroupEngine(
-            reader: ReadAsync,
-            onChange: (handle, tagRef, snapshot) =>
-                OnDataChange?.Invoke(this, new DataChangeEventArgs(handle, tagRef, snapshot)),
-            onError: HandlePollError,
-            backoffCap: PollBackoffCap);
-    }
-
-    /// <inheritdoc />
-    public string DriverInstanceId => _driverInstanceId;
-
-    /// <inheritdoc />
-    public string DriverType => DriverTypeName;
-
-    /// <summary>
-    ///     The credential-free description of the database this instance polls — <c>server/database</c> where
-    ///     the connection string names both. This is the only rendering of the connection string that may
-    ///     appear in a log, a health message, or the Admin UI.
-    /// </summary>
-    public string Endpoint { get; }
-
-    /// <summary>Host identifier surfaced through <see cref="IHostConnectivityProbe"/> — the endpoint description.</summary>
-    public string HostName => Endpoint;
-
-    /// <summary>Active polled-subscription count. Diagnostics + disposal assertions.</summary>
-    internal int ActiveSubscriptionCount => _poll.ActiveSubscriptionCount;
-
-    /// <summary>The current authored-tag snapshot. Read through a barrier — <see cref="BuildTagTable"/> swaps it.</summary>
-    private IReadOnlyDictionary<string, SqlTagDefinition> Tags => Volatile.Read(ref _tagsByRawPath);
-
-    /// <summary>
-    ///     The catalog-validated snapshot. Read through a barrier — <see cref="ApplyCatalogGateAsync"/> swaps it.
-    /// </summary>
-    private IReadOnlyDictionary<string, SqlTagDefinition> PolledTags => Volatile.Read(ref _polledByRawPath);
-
-    /// <summary>
-    ///     The resolver's lookup: RawPath → <b>catalog-validated</b> definition, or null on a miss.
-    ///     <para>Deliberately reads <see cref="PolledTags"/> rather than <see cref="Tags"/>: a tag the gate
-    ///     rejected must miss here so the reader publishes
-    ///     <see cref="SqlStatusCodes.BadNodeIdUnknown"/>, exactly as design §8.1 specifies.</para>
-    /// </summary>
-    private SqlTagDefinition? Lookup(string rawPath) => PolledTags.GetValueOrDefault(rawPath);
-
-    // ---- IDriver lifecycle ----
-
-    /// <summary>
-    ///     Builds the authored RawPath table and proves the database is reachable.
-    ///     <para><paramref name="driverConfigJson"/> is <b>not</b> re-parsed here: the driver serves the
-    ///     typed <see cref="SqlDriverOptions"/> it was constructed with, exactly as <c>ModbusDriver</c> does
-    ///     (config parsing belongs to the factory, which builds a fresh instance).</para>
-    ///     <para>The table is built first because it is pure and cannot fail; the liveness check is the only
-    ///     I/O, and on failure this method records <see cref="DriverState.Faulted"/> <b>and rethrows</b> —
-    ///     <c>DriverInstanceActor</c> reads a throw as InitializeFailed and lands in Reconnecting with its
-    ///     retry timer running, which is exactly the recovery a database that is merely down needs.</para>
-    ///     <para>The liveness check is then followed by the design §8.1 <b>catalog gate</b>
-    ///     (<see cref="ApplyCatalogGateAsync"/>), which is the second and last piece of I/O. It runs after
-    ///     liveness because it needs a working connection, and before the driver reports Healthy because the
-    ///     tag table it publishes must be the validated one — a poll must never see an unvalidated
-    ///     identifier.</para>
-    /// </summary>
-    /// <param name="driverConfigJson">The driver configuration JSON (unused; see remarks).</param>
-    /// <param name="cancellationToken">Cancellation token for the operation.</param>
-    /// <returns>A task that represents the asynchronous operation.</returns>
-    /// <exception cref="InvalidOperationException">The database could not be reached, or its catalog could not be read.</exception>
-    public async Task InitializeAsync(string driverConfigJson, CancellationToken cancellationToken)
-    {
-        WriteHealth(new DriverHealth(DriverState.Initializing, null, null));
-        BuildTagTable();
-
-        try
-        {
-            await VerifyLivenessAsync(cancellationToken).ConfigureAwait(false);
-        }
-        catch (OperationCanceledException) when (cancellationToken.IsCancellationRequested)
-        {
-            // The caller tore the initialization down; not a database verdict.
-            WriteHealth(new DriverHealth(DriverState.Unknown, null, null));
-            throw;
-        }
-        catch (Exception ex)
-        {
-            // Never interpolate _connectionString OR ex.Message onto the operator surface. The driver is
-            // dialect-agnostic over an arbitrary DbProviderFactory, so it cannot rely on any one provider's
-            // message discipline — Microsoft.Data.SqlClient's connection-string parser, for one, echoes an
-            // unrecognised keyword lower-cased, which a value-based password redactor misses entirely. Only
-            // the exception TYPE reaches LastError/host status; the full exception object goes to the log
-            // SINK via the structured logger's exception parameter (below), never into a rendered string.
-            var message =
-                $"Sql driver '{_driverInstanceId}' could not reach {Endpoint}: {ex.GetType().Name}. " +
-                $"Check the database is reachable and the connection string is valid.";
-            _logger.LogError(ex, "Sql driver {DriverInstanceId} liveness check against {Endpoint} failed.",
-                _driverInstanceId, Endpoint);
-            WriteHealth(new DriverHealth(DriverState.Faulted, null, message));
-            TransitionHostTo(HostState.Stopped);
-            throw new InvalidOperationException(message, ex);
-        }
-
-        // Separate try from liveness so the operator surface names the stage that actually failed: "could
-        // not reach the database" and "reached it but could not read its catalog" send an operator to
-        // different places, and the second is usually a GRANT rather than an outage.
-        try
-        {
-            await ApplyCatalogGateAsync(cancellationToken).ConfigureAwait(false);
-        }
-        catch (OperationCanceledException) when (cancellationToken.IsCancellationRequested)
-        {
-            WriteHealth(new DriverHealth(DriverState.Unknown, null, null));
-            throw;
-        }
-        catch (Exception ex)
-        {
-            // Same discipline as above: exception TYPE only on the operator surface, full exception to the
-            // log sink. A catalog read that fails is NOT evidence the tags are wrong — it is the absence of
-            // evidence — so this faults the driver (and retries) rather than rejecting every tag and serving
-            // a confidently-empty address space.
-            var message =
-                $"Sql driver '{_driverInstanceId}' reached {Endpoint} but could not read its catalog to " +
-                $"validate authored tables/columns: {ex.GetType().Name}. Check that the connecting principal " +
-                "can read the catalog views.";
-            _logger.LogError(ex,
-                "Sql driver {DriverInstanceId} catalog validation against {Endpoint} failed.",
-                _driverInstanceId, Endpoint);
-            WriteHealth(new DriverHealth(DriverState.Faulted, null, message));
-            TransitionHostTo(HostState.Stopped);
-            throw new InvalidOperationException(message, ex);
-        }
-
-        WriteHealth(new DriverHealth(DriverState.Healthy, DateTime.UtcNow, null));
-        TransitionHostTo(HostState.Running);
-        _logger.LogInformation(
-            "Sql driver {DriverInstanceId} initialized against {Endpoint} with {TagCount} authored tag(s).",
-            _driverInstanceId, Endpoint, Tags.Count);
-    }
-
-    /// <inheritdoc />
-    public async Task ReinitializeAsync(string driverConfigJson, CancellationToken cancellationToken)
-    {
-        await ShutdownAsync(cancellationToken).ConfigureAwait(false);
-        await InitializeAsync(driverConfigJson, cancellationToken).ConfigureAwait(false);
-    }
-
-    /// <inheritdoc />
-    public async Task ShutdownAsync(CancellationToken cancellationToken)
-    {
-        var lastRead = ReadHealth().LastSuccessfulRead;
-        await TeardownAsync().ConfigureAwait(false);
-        WriteHealth(new DriverHealth(DriverState.Unknown, lastRead, null));
-    }
-
-    /// <inheritdoc />
-    public DriverHealth GetHealth() => ReadHealth();
-
-    /// <summary>No caches, no symbol table, no connection between polls — the footprint is the tag table.</summary>
-    /// <returns>Always zero.</returns>
-    public long GetMemoryFootprint() => 0;
-
-    /// <summary>Nothing optional to flush: the authored table is required for correctness.</summary>
-    /// <param name="cancellationToken">Cancellation token for the operation.</param>
-    /// <returns>A completed task.</returns>
-    public Task FlushOptionalCachesAsync(CancellationToken cancellationToken) => Task.CompletedTask;
-
-    // ---- ITagDiscovery ----
-
-    /// <summary>
-    ///     Exactly one pass: the tag set is the authored one, fixed at Initialize, so re-running discovery
-    ///     could only produce the same nodes.
-    /// </summary>
-    public DiscoveryRediscoverPolicy RediscoverPolicy => DiscoveryRediscoverPolicy.Once;
-
-    /// <summary>
-    ///     False — <see cref="DiscoverAsync"/> replays authored tags rather than enumerating the backend, so
-    ///     the universal discovery browser must not treat this driver as browsable. (Live schema browsing is
-    ///     a separate surface: <c>Driver.Sql.Browser</c>.)
-    /// </summary>
-    public bool SupportsOnlineDiscovery => false;
-
-    /// <summary>
-    ///     Streams the authored tags as read-only variables.
-    ///     <para>An undeclared tag materialises as <see cref="DriverDataType.String"/> — the same fallback
-    ///     <see cref="ISqlDialect.MapColumnType"/> uses for an unrecognised column type — because a column's
-    ///     real type is only known once a poll has returned result-set metadata, which has not happened at
-    ///     discovery time. Author <c>"type"</c> on a numeric tag.</para>
-    /// </summary>
-    /// <param name="builder">The address-space builder to stream discovered nodes into.</param>
-    /// <param name="cancellationToken">Cancellation token for the operation.</param>
-    /// <returns>A completed task — discovery is synchronous over the authored table.</returns>
-    public Task DiscoverAsync(IAddressSpaceBuilder builder, CancellationToken cancellationToken)
-    {
-        ArgumentNullException.ThrowIfNull(builder);
-        var folder = builder.Folder(DriverTypeName, DriverTypeName);
-        foreach (var tag in Tags.Values)
-        {
-            if (tag.DeclaredType is null)
-            {
-                // Discovery cannot infer a column's real type — that needs live result-set metadata, which
-                // only a poll returns — so an omitted-type tag materialises as String (the same fallback
-                // ISqlDialect.MapColumnType uses) while the reader coerces and publishes the column's actual,
-                // possibly numeric, CLR value against that String node. Nothing else signals the operator to
-                // this declared-vs-published mismatch, so warn and point them at the fix.
-                _logger.LogWarning(
-                    "Sql tag '{Tag}' has no authored \"type\" and is discovered as String; a numeric column " +
-                    "will then publish numeric values against a String node. Author an explicit \"type\" on " +
-                    "numeric tags. Driver={DriverInstanceId}",
-                    tag.Name, _driverInstanceId);
-            }
-
-            folder.Variable(tag.Name, tag.Name, new DriverAttributeInfo(
-                FullName: tag.Name,
-                DriverDataType: tag.DeclaredType ?? DriverDataType.String,
-                IsArray: false,
-                ArrayDim: null,
-                // v1 is read-only: no tag, and no configuration, can widen this.
-                SecurityClass: SecurityClassification.ViewOnly,
-                IsHistorized: false,
-                IsAlarm: false,
-                WriteIdempotent: false));
-        }
-
-        return Task.CompletedTask;
-    }
-
-    // ---- IReadable ----
-
-    /// <summary>
-    ///     Reads a batch, delegating to <see cref="SqlPollReader"/> and classifying what came back
-    ///     (<see cref="ObservePollOutcome"/>).
-    /// </summary>
-    /// <param name="fullReferences">The RawPaths to read.</param>
-    /// <param name="cancellationToken">Cancellation token for the operation.</param>
-    /// <returns>One snapshot per reference, at the same index.</returns>
-    /// <exception cref="DbException">The database could not be reached — the engine backs off on this.</exception>
-    public async Task<IReadOnlyList<DataValueSnapshot>> ReadAsync(
-        IReadOnlyList<string> fullReferences, CancellationToken cancellationToken)
-    {
-        // Guarded here rather than inside the try, so a caller's bug cannot be misread as "the database is
-        // unreachable" and degrade a perfectly healthy driver.
-        ArgumentNullException.ThrowIfNull(fullReferences);
-
-        try
-        {
-            var snapshots = await _reader.ReadAsync(fullReferences, cancellationToken).ConfigureAwait(false);
-            ObservePollOutcome(snapshots);
-            return snapshots;
-        }
-        catch (OperationCanceledException)
-        {
-            // Teardown, not a database verdict — leave health and host state exactly as they were.
-            throw;
-        }
-        catch (Exception ex)
-        {
-            // The reader throws for one reason only: opening a connection failed (IReadable's contract).
-            _logger.LogWarning(ex, "Sql driver {DriverInstanceId} could not reach {Endpoint} during a read.",
-                _driverInstanceId, Endpoint);
-            // Type name only — never ex.Message (see InitializeAsync for why); the full exception is already
-            // on the log sink via the LogWarning exception parameter above.
-            Degrade($"Sql driver '{_driverInstanceId}' could not reach {Endpoint}: {ex.GetType().Name}.");
-            TransitionHostTo(HostState.Stopped);
-            throw;
-        }
-    }
-
-    // ---- ISubscribable (polling overlay via the shared engine) ----
-
-    /// <summary>
-    ///     Registers a polled subscription.
-    ///     <para>A non-positive <paramref name="publishingInterval"/> falls back to the configured
-    ///     <see cref="SqlDriverOptions.DefaultPollInterval"/>; anything faster than
-    ///     <see cref="PollGroupEngine.DefaultMinInterval"/> is floored by the engine.</para>
-    /// </summary>
-    /// <param name="fullReferences">The RawPaths to poll.</param>
-    /// <param name="publishingInterval">The requested publishing interval.</param>
-    /// <param name="cancellationToken">Cancellation token for the operation.</param>
-    /// <returns>The subscription handle.</returns>
-    public Task<ISubscriptionHandle> SubscribeAsync(
-        IReadOnlyList<string> fullReferences, TimeSpan publishingInterval, CancellationToken cancellationToken)
-    {
-        var interval = publishingInterval > TimeSpan.Zero ? publishingInterval : _options.DefaultPollInterval;
-        return Task.FromResult(_poll.Subscribe(fullReferences, interval));
-    }
-
-    /// <inheritdoc />
-    public Task UnsubscribeAsync(ISubscriptionHandle handle, CancellationToken cancellationToken)
-    {
-        _poll.Unsubscribe(handle);
-        return Task.CompletedTask;
-    }
-
-    // ---- IHostConnectivityProbe ----
-
-    /// <summary>
-    ///     The single logical host this instance dials. There is no background probe loop: the state is a
-    ///     by-product of the Initialize-time liveness check and of every poll, so the report is always a
-    ///     statement about traffic that actually happened rather than about a synthetic ping.
-    /// </summary>
-    /// <returns>A one-element list describing the configured database endpoint.</returns>
-    public IReadOnlyList<HostConnectivityStatus> GetHostStatuses()
-    {
-        lock (_probeLock)
-            return [new HostConnectivityStatus(HostName, _hostState, _hostStateChangedUtc)];
-    }
-
-    // ---- health + host-state classification ----
-
-    /// <summary>
-    ///     Classifies one poll's snapshots into a health verdict and a host state.
-    ///     <list type="bullet">
-    ///         <item>Any Good snapshot ⇒ the database answered: <c>LastSuccessfulRead</c> advances and the
-    ///         host is Running.</item>
-    ///         <item>Any <b>connection-class</b> Bad snapshot (<see cref="SqlStatusCodes.BadTimeout"/> /
-    ///         <see cref="SqlStatusCodes.BadCommunicationError"/>) ⇒ Degraded; when nothing at all was Good,
-    ///         the host is Stopped.</item>
-    ///         <item>Bad codes that are <b>authoring</b> facts — an unresolvable RawPath, an absent row, a
-    ///         type mismatch, a rejected definition — change nothing. A tag typo must never report the
-    ///         database as down and send an operator to the wrong system.</item>
-    ///     </list>
-    ///     <para><b>Why this does not throw to force poll-engine backoff.</b> Backoff would require turning
-    ///     an all-<c>BadTimeout</c> batch into an exception, and the engine's exception path publishes
-    ///     nothing — clients would lose the very BadTimeout quality the reader went out of its way to
-    ///     produce, and would sit on stale Good values instead. Nor is hammering a real risk: each group is
-    ///     already bounded by <c>operationTimeout</c> and the reader never holds more than
-    ///     <c>maxConcurrentGroups</c> connections however long the database stays frozen. So a frozen
-    ///     database is reported (Degraded + host Stopped + Bad-quality values) at the configured poll
-    ///     cadence rather than backed off from.</para>
-    /// </summary>
-    /// <param name="snapshots">The snapshots the reader returned for one poll.</param>
-    internal void ObservePollOutcome(IReadOnlyList<DataValueSnapshot> snapshots)
-    {
-        if (snapshots.Count == 0) return;
-
-        var good = 0;
-        var unreachable = 0;
-        foreach (var snapshot in snapshots)
-        {
-            if (SqlStatusCodes.IsGood(snapshot.StatusCode)) good++;
-            else if (IsConnectionClass(snapshot.StatusCode)) unreachable++;
-        }
-
-        if (unreachable > 0)
-        {
-            Degrade(
-                $"{unreachable} of {snapshots.Count} Sql tag(s) timed out or failed communication against " +
-                $"{Endpoint} on the last poll.");
-            if (good > 0)
-            {
-                // Partial: something answered, so the endpoint is up — but the driver is not healthy.
-                TouchLastSuccessfulRead();
-                TransitionHostTo(HostState.Running);
-            }
-            else
-            {
-                TransitionHostTo(HostState.Stopped);
-            }
-
-            return;
-        }
-
-        if (good == 0) return;   // authoring-class Bad only — not a statement about the database.
-
-        // Route through the Faulted guard, not a raw WriteHealth: a poll still in flight when a concurrent
-        // ReinitializeAsync has recorded Faulted (the engine's ~5 s teardown wait is shorter than the 15 s
-        // default operationTimeout, so a stale poll can still complete afterwards) must not flip Faulted back
-        // to Healthy with no real recovery. Only a successful (re)initialize clears Faulted.
-        SetHealthUnlessFaulted(new DriverHealth(DriverState.Healthy, DateTime.UtcNow, null));
-        TransitionHostTo(HostState.Running);
-    }
-
-    /// <summary>True for the status codes that mean "the database did not answer", as opposed to "the data is not there".</summary>
-    private static bool IsConnectionClass(uint statusCode)
-        => statusCode is SqlStatusCodes.BadTimeout or SqlStatusCodes.BadCommunicationError;
-
-    /// <summary>
-    ///     Routes a poll-loop reader failure to the health surface (05/STAB-9). Deliberately does <b>not</b>
-    ///     touch host state: the engine also reports its own contract violations here, which say nothing
-    ///     about connectivity — the unreachable-database transition is raised by <see cref="ReadAsync"/>,
-    ///     which knows the exception came from the reader.
-    /// </summary>
-    /// <param name="ex">The exception the poll engine caught.</param>
-    internal void HandlePollError(Exception ex)
-    {
-        // A subscribed-read outage surfaces as a DbException the reader threw, which ReadAsync has ALREADY
-        // classified — good, endpoint-bearing LastError + host Stopped — before rethrowing. The poll engine
-        // then routes that same exception here. Re-degrading would overwrite the good LastError with a worse,
-        // guidance-free one and log the outage a second time, so skip the connection class ReadAsync owns.
-        if (ex is DbException) return;
-
-        // Whatever reaches here — an engine contract-violation, or a non-DbException the provider raised
-        // (e.g. an ArgumentException from a malformed connection string, which the parser echoes with
-        // credential fragments) — the operator surface carries only the exception TYPE, never ex.Message.
-        // The full exception, with its text, still reaches the log SINK via the exception parameter. This is
-        // the same unconditional rule InitializeAsync/ReadAsync follow; do not weaken it to a type check.
-        _logger.LogWarning(ex, "Sql poll failed. Driver={DriverInstanceId} Endpoint={Endpoint}",
-            _driverInstanceId, Endpoint);
-        Degrade($"Sql driver '{_driverInstanceId}' poll failed: {ex.GetType().Name}.");
-    }
-
-    /// <summary>
-    ///     Degrades health, preserving <c>LastSuccessfulRead</c> and never downgrading
-    ///     <see cref="DriverState.Faulted"/> — a config-level verdict that only a successful read or an
-    ///     operator reinitialize may clear.
-    /// </summary>
-    /// <param name="reason">The operator-facing reason, which must never carry the connection string.</param>
-    private void Degrade(string reason)
-    {
-        var current = ReadHealth();
-        SetHealthUnlessFaulted(new DriverHealth(DriverState.Degraded, current.LastSuccessfulRead, reason));
-    }
-
-    /// <summary>
-    ///     Publishes <paramref name="value"/> unless the driver is already <see cref="DriverState.Faulted"/>
-    ///     — a liveness/config verdict that only a successful (re)initialize may clear. Every non-Initialize
-    ///     health write routes through here: <see cref="Degrade"/> and the poll's Healthy verdict in
-    ///     <see cref="ObservePollOutcome"/>, so a late in-flight poll cannot un-fault a driver a concurrent
-    ///     <see cref="ReinitializeAsync"/> just faulted.
-    /// </summary>
-    /// <param name="value">The health snapshot to publish when the driver is not Faulted.</param>
-    private void SetHealthUnlessFaulted(DriverHealth value)
-    {
-        if (ReadHealth().State == DriverState.Faulted) return;
-        WriteHealth(value);
-    }
-
-    /// <summary>Advances <c>LastSuccessfulRead</c> without changing the current state or error.</summary>
-    private void TouchLastSuccessfulRead()
-    {
-        var current = ReadHealth();
-        WriteHealth(current with { LastSuccessfulRead = DateTime.UtcNow });
-    }
-
-    /// <summary>Barrier-protected read of the multi-threaded health field.</summary>
-    private DriverHealth ReadHealth() => Volatile.Read(ref _health);
-
-    /// <summary>Barrier-protected publish of a new health snapshot.</summary>
-    private void WriteHealth(DriverHealth value) => Volatile.Write(ref _health, value);
-
-    /// <summary>Records a host-state change and raises <see cref="OnHostStatusChanged"/> — on transitions only.</summary>
-    private void TransitionHostTo(HostState newState)
-    {
-        HostState old;
-        lock (_probeLock)
-        {
-            old = _hostState;
-            if (old == newState) return;
-            _hostState = newState;
-            _hostStateChangedUtc = DateTime.UtcNow;
-        }
-
-        OnHostStatusChanged?.Invoke(this, new HostStatusChangedEventArgs(HostName, old, newState));
-    }
-
-    // ---- authored tag table ----
-
-    /// <summary>
-    ///     Maps every authored <see cref="RawTagEntry"/> through <see cref="SqlEquipmentTagParser.TryParse"/>
-    ///     and publishes the result as one atomic snapshot. A blob that does not map is <b>logged and
-    ///     skipped</b>, never thrown: one malformed tag must not take the whole driver — and therefore every
-    ///     other tag on that database — down with it. The skipped RawPath then resolves to nothing, so it
-    ///     publishes <see cref="SqlStatusCodes.BadNodeIdUnknown"/> rather than someone else's row.
-    /// </summary>
-    private void BuildTagTable()
-    {
-        var table = new Dictionary<string, SqlTagDefinition>(_options.RawTags.Count, StringComparer.Ordinal);
-        foreach (var entry in _options.RawTags)
-        {
-            try
-            {
-                if (SqlEquipmentTagParser.TryParse(entry.TagConfig, entry.RawPath, out var definition))
-                    table[entry.RawPath] = definition;
-                else
-                    _logger.LogWarning(
-                        "Sql tag config did not map to a definition; skipping. Driver={DriverInstanceId} RawPath={RawPath}",
-                        _driverInstanceId, entry.RawPath);
-            }
-            catch (Exception ex)
-            {
-                // TryParse is contracted never to throw, but BuildTagTable runs BEFORE InitializeAsync's
-                // try/catch, so a stray throw here (a parser bug on one blob) would escape Initialize and
-                // strand health at Initializing across every DriverInstanceActor retry. Skip the offending
-                // tag — the same "one bad tag must not take the whole driver down" rule the malformed-blob
-                // branch above follows — rather than fault the driver over a single entry.
-                _logger.LogError(
-                    ex, "Sql tag config threw while parsing; skipping. Driver={DriverInstanceId} RawPath={RawPath}",
-                    _driverInstanceId, entry.RawPath);
-            }
-        }
-
-        Volatile.Write(ref _tagsByRawPath, table);
-
-        // Nothing is pollable until the catalog gate has validated it. Clearing here (rather than leaving a
-        // previous generation's validated table in place) means a Reinitialize whose gate then fails cannot
-        // keep polling the OLD identifiers against a database whose schema may be exactly what changed.
-        Volatile.Write(ref _polledByRawPath, new Dictionary<string, SqlTagDefinition>(StringComparer.Ordinal));
-    }
-
-    // ---- catalog gate (design §8.1) ----
-
-    /// <summary>
-    ///     Validates every authored identifier against the live catalog and republishes the tag table with
-    ///     catalog spellings, dropping the tags that do not resolve (design §8.1).
-    /// </summary>
-    /// <remarks>
-    ///     <para><b>Why this must run before the driver reports Healthy.</b> The table this swaps in is what
-    ///     every poll resolves against. Running it later — or in the background — would leave a window in
-    ///     which an unvalidated identifier could be quoted into a query, which is the entire hole the gate
-    ///     exists to close.</para>
-    ///     <para><b>A dropped tag is not a driver fault.</b> It disappears from the table, so its RawPath
-    ///     resolves to nothing and it publishes <see cref="SqlStatusCodes.BadNodeIdUnknown"/> — one operator
-    ///     typo must not stop the other tags on that database, the same rule
-    ///     <see cref="BuildTagTable"/> follows for a malformed blob. Each drop is logged at Warning with the
-    ///     tag, the field and the reason, because a node that silently goes Bad with nothing in the log is
-    ///     unsupportable.</para>
-    ///     <para><b>No tags ⇒ no I/O.</b> A driver with nothing authored has nothing to validate, and issuing
-    ///     catalog queries to prove that would be a round-trip that can only fail.</para>
-    ///     <para>Bounded by the same wall-clock discipline as the liveness check (R2-01 / STAB-14): the work
-    ///     runs on the thread pool so a provider implementing the async path synchronously blocks a pool
-    ///     thread rather than wedging Initialize forever with no retry.</para>
-    /// </remarks>
-    /// <param name="cancellationToken">The caller's token.</param>
-    /// <returns>A task that completes when the tag table has been validated and republished.</returns>
-    private async Task ApplyCatalogGateAsync(CancellationToken cancellationToken)
-    {
-        var authored = Tags;
-        if (authored.Count == 0) return;
-
-        var tables = authored.Values
-            .Select(definition => definition.Table)
-            .Where(table => !string.IsNullOrWhiteSpace(table))
-            .Distinct(StringComparer.OrdinalIgnoreCase)
-            .ToArray();
-
-        var catalog = await RunBoundedAsync(
-            token => LoadCatalogAsync(tables, token),
-            _options.OperationTimeout,
-            "the catalog queries did not return",
-            cancellationToken).ConfigureAwait(false);
-
-        var result = SqlCatalogGate.Apply(authored.Values, catalog, _dialect);
-
-        foreach (var rejection in result.Rejected)
-        {
-            _logger.LogWarning(
-                "Sql tag '{Tag}' rejected by the catalog gate: {Field} — {Reason}. It will publish "
-                + "BadNodeIdUnknown until the tag or the database is corrected. Driver={DriverInstanceId}",
-                rejection.RawPath, rejection.Field, rejection.Reason, _driverInstanceId);
-        }
-
-        var validated = new Dictionary<string, SqlTagDefinition>(result.Accepted.Count, StringComparer.Ordinal);
-        foreach (var definition in result.Accepted) validated[definition.Name] = definition;
-
-        // Only the POLLED table is replaced. The authored table is left intact so every authored tag keeps
-        // its node and a rejected one publishes BadNodeIdUnknown rather than vanishing (see _polledByRawPath).
-        Volatile.Write(ref _polledByRawPath, validated);
-
-        _logger.LogInformation(
-            "Sql driver {DriverInstanceId} catalog gate accepted {Accepted} of {Total} authored tag(s) "
-            + "across {Tables} table(s) on {Endpoint}.",
-            _driverInstanceId, result.Accepted.Count, authored.Count, tables.Length, Endpoint);
-    }
-
-    /// <summary>Opens one connection and reads the catalog slice the authored tables need.</summary>
-    private async Task<SqlCatalog> LoadCatalogAsync(
-        IReadOnlyCollection<string> authoredTables, CancellationToken cancellationToken)
-    {
-        var connection = _factory.CreateConnection()
-                         ?? throw new InvalidOperationException(
-                             $"the {_dialect.Provider} provider factory returned no connection.");
-
-        await using (connection.ConfigureAwait(false))
-        {
-            connection.ConnectionString = _connectionString;
-            await connection.OpenAsync(cancellationToken).ConfigureAwait(false);
-            return await SqlCatalogLoader
-                .LoadAsync(connection, _dialect, authoredTables, _options.CommandTimeout, cancellationToken)
-                .ConfigureAwait(false);
-        }
-    }
-
-    // ---- liveness ----
-
-    /// <summary>
-    ///     Opens ONE connection, runs the dialect's liveness statement, and disposes it. No connection is
-    ///     held between this check and the first poll — the reader opens, uses and disposes per poll, so a
-    ///     long-lived connection here would only be a second thing to keep alive.
-    ///     <para><b>Bounded by wall-clock, not only by the token</b> (the R2-01 / STAB-14 lesson): some ADO.NET
-    ///     providers implement the async path synchronously, and a wedged socket can hang inside the
-    ///     provider's own cancellation handshake. If Initialize hung there, <c>DriverInstanceActor</c>'s init
-    ///     task would never complete and the driver would sit in Connecting forever with no retry. The work
-    ///     runs on the thread pool so a synchronous provider blocks a pool thread rather than the caller, and
-    ///     an abandoned attempt still owns and disposes its own connection.</para>
-    /// </summary>
-    /// <param name="cancellationToken">The caller's token.</param>
-    /// <returns>A task that completes when the database has answered.</returns>
-    private Task VerifyLivenessAsync(CancellationToken cancellationToken) =>
-        RunBoundedAsync(
-            async token => { await PingAsync(token).ConfigureAwait(false); return true; },
-            _options.CommandTimeout,
-            "the liveness statement did not return",
-            cancellationToken);
-
-    /// <summary>
-    ///     Runs <paramref name="work"/> under a hard wall-clock <paramref name="budget"/>, on the thread pool,
-    ///     converting a breach into a <see cref="TimeoutException"/> worded from <paramref name="what"/>.
-    /// </summary>
-    /// <remarks>
-    ///     <para>The R2-01 / STAB-14 shape, shared by the two pieces of I/O Initialize performs. It exists
-    ///     because a token is not a deadline: some ADO.NET providers implement the async path synchronously,
-    ///     and a wedged socket can hang <em>inside</em> the provider's own cancellation handshake. Without an
-    ///     independent wall clock, <c>DriverInstanceActor</c>'s init task would never complete and the driver
-    ///     would sit in Connecting forever with no retry — the exact frozen-peer wedge the S7 driver shipped.</para>
-    ///     <para>Both the linked CTS deadline and an outer <see cref="TaskExtensions"/> wait are used, because
-    ///     each covers a case the other does not: the CTS handles a provider that <em>does</em> honour
-    ///     cancellation, and the outer wait handles one that does not. An abandoned attempt keeps ownership of
-    ///     its own connection and disposes it; <see cref="Detach"/> observes its eventual fault.</para>
-    /// </remarks>
-    /// <typeparam name="T">The work's result type.</typeparam>
-    /// <param name="work">The operation to bound. Receives the deadline-linked token.</param>
-    /// <param name="budget">The wall-clock allowance.</param>
-    /// <param name="what">Sentence fragment naming the operation, e.g. "the catalog queries did not return".</param>
-    /// <param name="cancellationToken">The caller's token.</param>
-    /// <returns>The work's result.</returns>
-    /// <exception cref="TimeoutException">The budget elapsed first.</exception>
-    private static async Task<T> RunBoundedAsync<T>(
-        Func<CancellationToken, Task<T>> work,
-        TimeSpan budget,
-        string what,
-        CancellationToken cancellationToken)
-    {
-        var deadline = CancellationTokenSource.CreateLinkedTokenSource(cancellationToken);
-        Task<T> running;
-        try
-        {
-            deadline.CancelAfter(budget);
-            running = Task.Run(
-                async () =>
-                {
-                    try { return await work(deadline.Token).ConfigureAwait(false); }
-                    finally { deadline.Dispose(); }
-                },
-                CancellationToken.None);
-        }
-        catch
-        {
-            // Ownership of the CTS transfers to the work task; release it only if that task never started.
-            deadline.Dispose();
-            throw;
-        }
-
-        try
-        {
-            return await running.WaitAsync(budget, cancellationToken).ConfigureAwait(false);
-        }
-        catch (TimeoutException)
-        {
-            Detach(running);
-            throw new TimeoutException($"{what} within {(int)budget.TotalMilliseconds} ms.");
-        }
-        catch (OperationCanceledException) when (!cancellationToken.IsCancellationRequested)
-        {
-            // Our deadline fired and the provider DID honour the linked token.
-            Detach(running);
-            throw new TimeoutException($"{what} within {(int)budget.TotalMilliseconds} ms.");
-        }
-    }
-
-    /// <summary>Opens a connection and executes the dialect's cheapest proof-of-life statement.</summary>
-    private async Task PingAsync(CancellationToken cancellationToken)
-    {
-        var connection = _factory.CreateConnection()
-                         ?? throw new InvalidOperationException(
-                             $"the {_dialect.Provider} provider factory returned no connection.");
-
-        await using (connection.ConfigureAwait(false))
-        {
-            connection.ConnectionString = _connectionString;
-            await connection.OpenAsync(cancellationToken).ConfigureAwait(false);
-
-            var command = connection.CreateCommand();
-            await using (command.ConfigureAwait(false))
-            {
-                command.CommandText = _dialect.LivenessSql;
-                // ADO.NET reads CommandTimeout = 0 as "wait forever" — the one value it must never become.
-                command.CommandTimeout = Math.Max(1, (int)Math.Ceiling(_options.CommandTimeout.TotalSeconds));
-                await command.ExecuteScalarAsync(cancellationToken).ConfigureAwait(false);
-            }
-        }
-    }
-
-    /// <summary>
-    ///     Observes an abandoned liveness attempt's eventual fault so it never surfaces as an unobserved
-    ///     task exception. The task still owns — and disposes — its own connection.
-    ///     <para>TODO(M2): a verbatim duplicate of <c>SqlPollReader.Detach</c>; both live in Driver.Sql and
-    ///     could hoist to one internal helper. Left in place here to keep this change off the reader.</para>
-    /// </summary>
-    private static void Detach(Task work)
-        => _ = work.ContinueWith(
-            static t => _ = t.Exception,
-            CancellationToken.None,
-            TaskContinuationOptions.OnlyOnFaulted | TaskContinuationOptions.ExecuteSynchronously,
-            TaskScheduler.Default);
-
-    // ---- endpoint description ----
-
-    /// <summary>
-    ///     Renders a connection string as <c>server/database</c>, reading only those two keys.
-    ///     <para>This is the <b>only</b> function permitted to look at the connection string outside the
-    ///     provider call, and it exists so that no other code is ever tempted to log the string itself:
-    ///     credentials live in <c>User ID</c> / <c>Password</c> / <c>Authentication</c>, which are never
-    ///     read here. A string that cannot be parsed yields <see cref="UnknownEndpoint"/> — an unusable
-    ///     description must not become a crash at construction.</para>
-    /// </summary>
-    /// <param name="connectionString">The resolved connection string.</param>
-    /// <returns>A credential-free description safe to log and display.</returns>
-    private static string DescribeEndpoint(string connectionString)
-    {
-        try
-        {
-            var builder = new DbConnectionStringBuilder { ConnectionString = connectionString };
-            var server = FirstValue(builder, ServerKeys);
-            if (string.IsNullOrWhiteSpace(server)) return UnknownEndpoint;
-            var database = FirstValue(builder, DatabaseKeys);
-            return string.IsNullOrWhiteSpace(database) ? server : $"{server}/{database}";
-        }
-        catch (ArgumentException)
-        {
-            return UnknownEndpoint;
-        }
-    }
-
-    /// <summary>Reads the first of <paramref name="keys"/> the builder carries; null when it carries none.</summary>
-    private static string? FirstValue(DbConnectionStringBuilder builder, string[] keys)
-    {
-        foreach (var key in keys)
-        {
-            // DbConnectionStringBuilder's key comparison is case-insensitive.
-            if (builder.TryGetValue(key, out var value) && value is not null)
-            {
-                var text = value.ToString();
-                if (!string.IsNullOrWhiteSpace(text)) return text;
-            }
-        }
-
-        return null;
-    }
-
-    // ---- teardown ----
-
-    /// <summary>
-    ///     Performs the same teardown as <see cref="ShutdownAsync"/>, so a caller that only uses
-    ///     <c>await using</c> does not leak the poll loops.
-    /// </summary>
-    /// <returns>A task that represents the asynchronous operation.</returns>
-    public async ValueTask DisposeAsync() => await TeardownAsync().ConfigureAwait(false);
-
-    /// <summary>
-    ///     Shared teardown: stops every polled subscription and drops the authored table. Idempotent — safe
-    ///     to call any number of times, in any order, which is what makes
-    ///     <c>ShutdownAsync</c>-then-<c>DisposeAsync</c> (and <see cref="ReinitializeAsync"/>) safe.
-    ///     <para>There is no connection to close: the reader opens and disposes one per poll.</para>
-    /// </summary>
-    private async Task TeardownAsync()
-    {
-        await _poll.DisposeAsync().ConfigureAwait(false);
-        Volatile.Write(ref _tagsByRawPath, new Dictionary<string, SqlTagDefinition>(StringComparer.Ordinal));
-        Volatile.Write(ref _polledByRawPath, new Dictionary<string, SqlTagDefinition>(StringComparer.Ordinal));
-        _resolver.Clear();   // no-op in v3 (the resolver reads the live table by closure); kept for symmetry
-    }
-}
@@ -1,252 +0,0 @@
-using System.Text.Json;
-using System.Text.Json.Serialization;
-using Microsoft.Extensions.Logging;
-using Microsoft.Extensions.Logging.Abstractions;
-using ZB.MOM.WW.OtOpcUa.Core.Hosting;
-using ZB.MOM.WW.OtOpcUa.Driver.Sql.Contracts;
-
-namespace ZB.MOM.WW.OtOpcUa.Driver.Sql;
-
-/// <summary>
-///     Static factory registration helper for <see cref="SqlDriver"/> — the seam between a deployed
-///     <c>DriverConfig</c> blob and a live driver instance. The Server's composition root calls
-///     <see cref="Register"/> once at startup; the bootstrapper then materialises <c>Sql</c> DriverInstance
-///     rows into driver instances. Mirrors <c>ModbusDriverFactoryExtensions</c>.
-///     <para><b>This type owns the config validation the layers below deliberately skip.</b>
-///     <see cref="SqlPollReader"/> and <see cref="SqlDriver"/> stay usable with an inverted
-///     <c>operationTimeout</c>/<c>commandTimeout</c> pair on purpose (the frozen-database tests need that
-///     shape), so the factory is the only place a deployment can be stopped before it silently loses one of
-///     its two independent deadlines. Every knob is checked here, once, at construction.</para>
-///     <para><b>Enum fields are read leniently and written as names.</b> <see cref="JsonOptions"/> carries a
-///     <see cref="JsonStringEnumConverter"/>, so a <c>provider</c> authored as an ordinal still parses and a
-///     round-trip emits <c>"SqlServer"</c> — the systemic AdminUI defect where a page serialised an enum
-///     numerically while the consuming DTO was string-typed, faulting the driver at deploy time.</para>
-///     <para><b>The resolved connection string is a secret and never leaves this method except into the
-///     driver.</b> Every log line and every exception message here names the <c>connectionStringRef</c>, the
-///     environment variable, or <see cref="SqlDriver.Endpoint"/>'s credential-free <c>server/database</c>
-///     rendering — never the string itself.</para>
-/// </summary>
-public static class SqlDriverFactoryExtensions
-{
-    /// <summary>
-    ///     The driver-type string this factory registers under — chained off
-    ///     <see cref="SqlDriver.DriverTypeName"/>, which is
-    ///     <see cref="ZB.MOM.WW.OtOpcUa.Core.Abstractions.DriverTypeNames.Sql"/>.
-    /// </summary>
-    public const string DriverTypeName = SqlDriver.DriverTypeName;
-
-    /// <summary>
-    ///     How a <c>Sql</c> config blob is read.
-    ///     <list type="bullet">
-    ///         <item><see cref="JsonStringEnumConverter"/> — accepts an enum written as a name OR as an
-    ///         ordinal, and always writes the name (the enum-serialization guard).</item>
-    ///         <item><see cref="JsonUnmappedMemberHandling.Skip"/> — a blob authored against a different
-    ///         schema version must not brick the driver.</item>
-    ///         <item><see cref="JsonNamingPolicy.CamelCase"/> — the authored spelling
-    ///         (<c>connectionStringRef</c>, <c>rawTags</c>). Reads are case-insensitive anyway; the policy is
-    ///         what makes a <em>write</em> round-trip to the authored shape.</item>
-    ///     </list>
-    /// </summary>
-    internal static readonly JsonSerializerOptions JsonOptions = new()
-    {
-        PropertyNameCaseInsensitive = true,
-        PropertyNamingPolicy = JsonNamingPolicy.CamelCase,
-        ReadCommentHandling = JsonCommentHandling.Skip,
-        AllowTrailingCommas = true,
-        UnmappedMemberHandling = JsonUnmappedMemberHandling.Skip,
-        Converters = { new JsonStringEnumConverter() },
-    };
-
-    /// <summary>The serializer options, exposed so tests can assert the enum guard on a real round-trip.</summary>
-    internal static JsonSerializerOptions JsonOptionsForTest => JsonOptions;
-
-    /// <summary>
-    ///     Registers the <c>Sql</c> factory with the driver registry. The optional
-    ///     <paramref name="loggerFactory"/> is captured at registration time and used to build a logger per
-    ///     driver instance; without it the driver runs with the null logger.
-    /// </summary>
-    /// <param name="registry">The driver factory registry to register with.</param>
-    /// <param name="loggerFactory">Optional logger factory for creating loggers per driver instance.</param>
-    /// <exception cref="ArgumentNullException"><paramref name="registry"/> is null.</exception>
-    public static void Register(DriverFactoryRegistry registry, ILoggerFactory? loggerFactory = null)
-    {
-        ArgumentNullException.ThrowIfNull(registry);
-        registry.Register(DriverTypeName, (id, json) => CreateInstance(id, json, loggerFactory));
-    }
-
-    /// <summary>Builds one driver instance from its config blob. For the Server bootstrapper and tests.</summary>
-    /// <param name="driverInstanceId">The central config DB's identity for this driver instance.</param>
-    /// <param name="driverConfigJson">The instance's <c>DriverConfig</c> JSON blob.</param>
-    /// <returns>The constructed <see cref="SqlDriver"/>.</returns>
-    public static SqlDriver CreateInstance(string driverInstanceId, string driverConfigJson)
-        => CreateInstance(driverInstanceId, driverConfigJson, loggerFactory: null);
-
-    /// <summary>
-    ///     Logger-aware overload — used by <see cref="Register"/>'s closure when wired through DI.
-    ///     <para>Constructs the driver only: the driver builds its own <see cref="SqlPollReader"/>, because
-    ///     the reader's <c>resolve</c> delegate must read the driver's live authored-tag table, which does not
-    ///     exist until the driver does.</para>
-    ///     <para>No I/O happens here. The database is first contacted by
-    ///     <see cref="SqlDriver.InitializeAsync"/>, so a database that is merely down yields a driver in
-    ///     Reconnecting rather than a deployment that cannot be constructed.</para>
-    /// </summary>
-    /// <param name="driverInstanceId">The central config DB's identity for this driver instance.</param>
-    /// <param name="driverConfigJson">The instance's <c>DriverConfig</c> JSON blob.</param>
-    /// <param name="loggerFactory">Optional logger factory for creating loggers per driver instance.</param>
-    /// <returns>The constructed <see cref="SqlDriver"/>.</returns>
-    /// <exception cref="ArgumentException">An argument is null, empty or whitespace.</exception>
-    /// <exception cref="InvalidOperationException">
-    ///     The blob is not valid JSON, omits <c>connectionStringRef</c>, names a provider this build cannot
-    ///     construct, carries an invalid knob, or the referenced connection string is not provisioned.
-    /// </exception>
-    public static SqlDriver CreateInstance(
-        string driverInstanceId, string driverConfigJson, ILoggerFactory? loggerFactory)
-    {
-        ArgumentException.ThrowIfNullOrWhiteSpace(driverInstanceId);
-        ArgumentException.ThrowIfNullOrWhiteSpace(driverConfigJson);
-
-        var dto = Deserialize(driverInstanceId, driverConfigJson);
-
-        if (string.IsNullOrWhiteSpace(dto.ConnectionStringRef))
-        {
-            throw new InvalidOperationException(
-                $"Sql driver config for '{driverInstanceId}' is missing the required connectionStringRef. " +
-                $"Author the NAME of a connection string (the value itself is supplied out-of-band through " +
-                $"the '{SqlConnectionStringResolver.EnvironmentVariablePrefix}<ref>' environment variable).");
-        }
-
-        var dialect = CreateDialect(dto.Provider, driverInstanceId);
-
-        // Resolved BEFORE the knob validation below, so that every subsequent throw is a path that HAS the
-        // secret in hand — which is exactly where a careless interpolation would leak it.
-        var connectionString = SqlConnectionStringResolver.Resolve(dto.ConnectionStringRef!);
-        var options = BuildOptions(dto, driverInstanceId);
-
-        var logger = (ILogger?)loggerFactory?.CreateLogger(typeof(SqlDriverFactoryExtensions).FullName!)
-                     ?? NullLogger.Instance;
-
-        if (dto.AllowWrites is true)
-        {
-            // Inert by construction (SqlDriver does not implement IWritable), so failing the driver over it
-            // would brick a deployment for a flag that cannot do harm. The operator who believes writes are
-            // on, however, can — so this is loud.
-            logger.LogWarning(
-                "Sql driver {DriverInstanceId} authored allowWrites=true, which this build ignores: the Sql " +
-                "driver is read-only (it implements no write capability), so no configuration can enable a " +
-                "write. Remove the flag, or expect reads only.",
-                driverInstanceId);
-        }
-
-        var driver = new SqlDriver(
-            options,
-            driverInstanceId,
-            dialect,
-            connectionString,
-            factory: null,
-            logger: loggerFactory?.CreateLogger<SqlDriver>());
-
-        // Endpoint is the credential-free server/database rendering — the ONLY form of the connection string
-        // permitted outside the provider call.
-        logger.LogInformation(
-            "Sql driver {DriverInstanceId} configured for {Provider} at {Endpoint} with {TagCount} " +
-            "authored tag(s), poll {PollInterval}, operation timeout {OperationTimeout}.",
-            driverInstanceId, dto.Provider, driver.Endpoint, options.RawTags.Count,
-            options.DefaultPollInterval, options.OperationTimeout);
-
-        return driver;
-    }
-
-    /// <summary>Deserialises the blob, turning a malformed one into an actionable, instance-named failure.</summary>
-    private static SqlDriverConfigDto Deserialize(string driverInstanceId, string driverConfigJson)
-    {
-        try
-        {
-            return JsonSerializer.Deserialize<SqlDriverConfigDto>(driverConfigJson, JsonOptions)
-                   ?? throw new InvalidOperationException(
-                       $"Sql driver config for '{driverInstanceId}' deserialised to null");
-        }
-        catch (JsonException ex)
-        {
-            throw new InvalidOperationException(
-                $"Sql driver config for '{driverInstanceId}' is not valid JSON: {ex.Message}", ex);
-        }
-    }
-
-    /// <summary>
-    ///     Selects the provider seam.
-    ///     <para>v1 constructs <see cref="SqlProvider.SqlServer"/> only. The other members exist on the shipped
-    ///     enum as reserved names; authoring one is a config mistake that must fail at construction with a
-    ///     message that says so, rather than silently degrading to T-SQL against a non-SQL-Server database.</para>
-    /// </summary>
-    private static ISqlDialect CreateDialect(SqlProvider provider, string driverInstanceId)
-        => provider switch
-        {
-            SqlProvider.SqlServer => new SqlServerDialect(),
-            _ => throw new InvalidOperationException(
-                $"Sql driver config for '{driverInstanceId}' names provider '{provider}', which is not " +
-                $"available in this build. Only '{nameof(SqlProvider.SqlServer)}' is supported."),
-        };
-
-    /// <summary>
-    ///     Applies the documented defaults and validates every knob (design §5.1 / §8.3).
-    ///     <para>Internal so the defaults and the rejections can be asserted directly, without a database or a
-    ///     provisioned connection string standing between the test and the rule.</para>
-    /// </summary>
-    /// <param name="dto">The deserialised config blob.</param>
-    /// <param name="driverInstanceId">Named in every rejection message, so a fleet-wide log identifies the row.</param>
-    /// <returns>The typed options the driver is constructed with.</returns>
-    /// <exception cref="InvalidOperationException">A knob is out of range, or the two deadlines are inverted.</exception>
-    internal static SqlDriverOptions BuildOptions(SqlDriverConfigDto dto, string driverInstanceId)
-    {
-        ArgumentNullException.ThrowIfNull(dto);
-
-        var defaultPollInterval = dto.DefaultPollInterval ?? TimeSpan.FromSeconds(5);
-        var operationTimeout = dto.OperationTimeout ?? TimeSpan.FromSeconds(15);
-        var commandTimeout = dto.CommandTimeout ?? TimeSpan.FromSeconds(10);
-        var maxConcurrentGroups = dto.MaxConcurrentGroups ?? 4;
-
-        RequirePositive(defaultPollInterval, "defaultPollInterval", driverInstanceId);
-        RequirePositive(operationTimeout, "operationTimeout", driverInstanceId);
-        RequirePositive(commandTimeout, "commandTimeout", driverInstanceId);
-        if (maxConcurrentGroups < 1)
-        {
-            throw new InvalidOperationException(
-                $"Sql driver config for '{driverInstanceId}' has maxConcurrentGroups {maxConcurrentGroups}; " +
-                $"it must be at least 1.");
-        }
-
-        // Design §8.3. The two deadlines are independent and BOTH are required: commandTimeout is the
-        // server-side backstop, operationTimeout the client-side wall-clock bound that alone survives a
-        // wedged socket (the R2-01/STAB-14 lesson). Inverted — or equal — the client-side abort always fires
-        // first and the backstop can never be reached, so a deployment quietly runs on one bound instead of
-        // two. Nothing downstream enforces this: the reader stays deliberately usable with it inverted.
-        if (operationTimeout <= commandTimeout)
-        {
-            throw new InvalidOperationException(
-                $"Sql driver config for '{driverInstanceId}' has operationTimeout {operationTimeout} which " +
-                $"is not greater than commandTimeout {commandTimeout}. The client-side operationTimeout must " +
-                $"be strictly greater than the server-side commandTimeout backstop, or the backstop can " +
-                $"never fire.");
-        }
-
-        return new SqlDriverOptions
-        {
-            RawTags = dto.RawTags is { Count: > 0 } rawTags ? [.. rawTags] : [],
-            DefaultPollInterval = defaultPollInterval,
-            OperationTimeout = operationTimeout,
-            CommandTimeout = commandTimeout,
-            MaxConcurrentGroups = maxConcurrentGroups,
-            NullIsBad = dto.NullIsBad ?? false,
-        };
-    }
-
-    /// <summary>Rejects a non-positive duration, naming the authored field.</summary>
-    private static void RequirePositive(TimeSpan value, string field, string driverInstanceId)
-    {
-        if (value <= TimeSpan.Zero)
-        {
-            throw new InvalidOperationException(
-                $"Sql driver config for '{driverInstanceId}' has {field} {value}; it must be greater than zero.");
-        }
-    }
-}
@@ -1,56 +0,0 @@
-using ZB.MOM.WW.OtOpcUa.Core.Abstractions;
-using ZB.MOM.WW.OtOpcUa.Driver.Sql.Contracts;
-
-namespace ZB.MOM.WW.OtOpcUa.Driver.Sql;
-
-/// <summary>
-///     The typed form of a <c>Sql</c> driver instance's configuration — what
-///     <see cref="SqlDriverConfigDto"/> becomes once the factory has applied its defaults (design §5.1).
-///     Mirrors <c>ModbusDriverOptions</c>: the driver instance is constructed with these, and its
-///     <see cref="SqlDriver.InitializeAsync"/> serves them rather than re-parsing the config JSON.
-///     <para><b>No connection string here.</b> The resolved connection string is a separate constructor
-///     argument, because it is a secret and these options are safe to log, diff and hold in a snapshot.</para>
-/// </summary>
-public sealed class SqlDriverOptions
-{
-    /// <summary>
-    ///     The authored raw tags this driver serves. The deploy artifact hands each authored raw <c>Tag</c>
-    ///     as a <see cref="RawTagEntry"/> (RawPath identity + driver <c>TagConfig</c> blob); the driver maps
-    ///     each through <see cref="SqlEquipmentTagParser.TryParse"/> into its RawPath → definition table.
-    ///     A SQL source has no tag-discovery protocol — the driver serves exactly these.
-    /// </summary>
-    public IReadOnlyList<RawTagEntry> RawTags { get; init; } = [];
-
-    /// <summary>
-    ///     Poll interval used when a subscriber does not ask for one (design §4: <c>defaultPollInterval</c>,
-    ///     default 5 s). A subscriber that names an interval gets that interval, floored by
-    ///     <see cref="PollGroupEngine.DefaultMinInterval"/>.
-    /// </summary>
-    public TimeSpan DefaultPollInterval { get; init; } = TimeSpan.FromSeconds(5);
-
-    /// <summary>
-    ///     The client-side wall-clock ceiling on one group query (design §8.3, default 15 s). A breach
-    ///     publishes <see cref="SqlStatusCodes.BadTimeout"/> for that group's tags.
-    /// </summary>
-    public TimeSpan OperationTimeout { get; init; } = TimeSpan.FromSeconds(15);
-
-    /// <summary>
-    ///     The ADO.NET <c>CommandTimeout</c> server-side backstop (default 10 s), also the bound on the
-    ///     Initialize-time liveness check.
-    ///     <para>Authoring must keep <see cref="OperationTimeout"/> strictly greater than this (design §8.3);
-    ///     inverted, the client-side abort always fires first and masks the backstop. <b>That rule is
-    ///     enforced by config validation in the factory, not here</b> — the reader deliberately stays usable
-    ///     with the order inverted so the frozen-database tests can prove the client-side bound fires.</para>
-    /// </summary>
-    public TimeSpan CommandTimeout { get; init; } = TimeSpan.FromSeconds(10);
-
-    /// <summary>Cap on concurrently executing group queries — and therefore on concurrently open connections.</summary>
-    public int MaxConcurrentGroups { get; init; } = 4;
-
-    /// <summary>
-    ///     When <see langword="true"/>, a present row whose value cell is NULL publishes
-    ///     <see cref="SqlStatusCodes.Bad"/> instead of the default <see cref="SqlStatusCodes.Uncertain"/>.
-    ///     It never governs an absent row, which is always <see cref="SqlStatusCodes.BadNoData"/>.
-    /// </summary>
-    public bool NullIsBad { get; init; }
-}
@@ -1,171 +0,0 @@
-using System.Data.Common;
-using System.Diagnostics;
-using ZB.MOM.WW.OtOpcUa.Core.Abstractions;
-using ZB.MOM.WW.OtOpcUa.Driver.Sql.Contracts;
-
-namespace ZB.MOM.WW.OtOpcUa.Driver.Sql;
-
-/// <summary>
-///     The AdminUI "Test Connect" liveness check for the <c>Sql</c> driver: open a connection, run the
-///     dialect's <c>SELECT 1</c> (<see cref="ISqlDialect.LivenessSql"/>) under a bounded deadline, and report
-///     green with latency or red with a reason. Mirrors <c>ModbusDriverProbe</c>.
-///     <para><b>Parses the SAME factory DTO with the SAME converter as
-///     <see cref="SqlDriverFactoryExtensions"/></b> (R2-11, 05/CONV-2 — the OpcUaClient parity rule), so a
-///     config the operator Test-Connects is byte-for-byte the config that Deploys: a numerically serialised
-///     <c>provider</c> parses here exactly as it does at the factory, and the same
-///     <c>connectionStringRef</c> resolves the same way.</para>
-///     <para><b>Never throws</b> (the <see cref="IDriverProbe"/> contract). Every failure — malformed JSON, a
-///     missing <c>connectionStringRef</c>, an unprovisioned connection string, a provider open failure, a
-///     timeout, a cancellation — becomes a red <see cref="DriverProbeResult"/>, so the AdminUI has nothing to
-///     catch.</para>
-///     <para><b>The resolved connection string never reaches the result message.</b> A red result names the
-///     failure class, never the string — the same credential discipline the factory and the driver keep.</para>
-/// </summary>
-public sealed class SqlDriverProbe : IDriverProbe
-{
-    /// <summary>
-    ///     Selects the provider seam by <see cref="SqlProvider"/>. In production this constructs the real
-    ///     <see cref="SqlServerDialect"/>; <see cref="ForTest"/> injects a test dialect (and factory) so the
-    ///     probe can run against the SQLite fixture with no SQL Server and no network.
-    /// </summary>
-    private readonly Func<SqlProvider, ISqlDialect> _dialectFor;
-
-    /// <summary>
-    ///     Overrides the dialect's own <see cref="ISqlDialect.Factory"/> when non-null — the injection point
-    ///     the SQLite tests use to hand in <c>SqliteFactory</c> while keeping the test dialect's
-    ///     catalog SQL. Null in production: the dialect's own factory is used.
-    /// </summary>
-    private readonly DbProviderFactory? _factoryOverride;
-
-    /// <summary>Initializes a new <see cref="SqlDriverProbe"/> that constructs the real SQL Server dialect.</summary>
-    public SqlDriverProbe()
-        : this(DefaultDialectFor, factoryOverride: null)
-    {
-    }
-
-    private SqlDriverProbe(Func<SqlProvider, ISqlDialect> dialectFor, DbProviderFactory? factoryOverride)
-    {
-        _dialectFor = dialectFor;
-        _factoryOverride = factoryOverride;
-    }
-
-    /// <summary>
-    ///     Test seam: a probe that always uses <paramref name="dialect"/> and opens connections from
-    ///     <paramref name="factory"/>, so the SQLite fixture's create → open → <c>SELECT 1</c> → close cycle
-    ///     runs unmodified.
-    /// </summary>
-    /// <param name="factory">The provider factory the probe opens connections from.</param>
-    /// <param name="dialect">The dialect whose <see cref="ISqlDialect.LivenessSql"/> the probe runs.</param>
-    /// <returns>A probe wired to the supplied factory + dialect.</returns>
-    /// <exception cref="ArgumentNullException">A required argument is null.</exception>
-    internal static SqlDriverProbe ForTest(DbProviderFactory factory, ISqlDialect dialect)
-    {
-        ArgumentNullException.ThrowIfNull(factory);
-        ArgumentNullException.ThrowIfNull(dialect);
-        return new SqlDriverProbe(_ => dialect, factory);
-    }
-
-    /// <inheritdoc />
-    public string DriverType => SqlDriver.DriverTypeName;
-
-    /// <inheritdoc />
-    public async Task<DriverProbeResult> ProbeAsync(string configJson, TimeSpan timeout, CancellationToken ct)
-    {
-        // Parse + resolve first: a config that cannot even be read is a red result, not a connection attempt.
-        SqlDriverConfigDto? dto;
-        try
-        {
-            dto = System.Text.Json.JsonSerializer.Deserialize<SqlDriverConfigDto>(
-                configJson, SqlDriverFactoryExtensions.JsonOptions);
-        }
-        catch (Exception ex) when (ex is System.Text.Json.JsonException or ArgumentNullException)
-        {
-            return new DriverProbeResult(false, $"Config JSON is invalid: {ex.Message}", null);
-        }
-
-        if (dto is null)
-            return new DriverProbeResult(false, "Config JSON deserialized to null.", null);
-        if (string.IsNullOrWhiteSpace(dto.ConnectionStringRef))
-            return new DriverProbeResult(false, "Config has no connectionStringRef to resolve.", null);
-
-        ISqlDialect dialect;
-        string connectionString;
-        try
-        {
-            dialect = _dialectFor(dto.Provider);
-            connectionString = SqlConnectionStringResolver.Resolve(dto.ConnectionStringRef!);
-        }
-        catch (InvalidOperationException ex)
-        {
-            // Resolve throws with only the ref + env-var name — no secret in the message, so surfacing it is
-            // safe and actionable (it names the environment variable the operator must set).
-            return new DriverProbeResult(
-                false, $"Could not run the SQL liveness check ({ex.GetType().Name}).", null);
-        }
-
-        var factory = _factoryOverride ?? dialect.Factory;
-        return await RunLivenessAsync(factory, dialect, connectionString, timeout, ct).ConfigureAwait(false);
-    }
-
-    /// <summary>
-    ///     Opens one connection under a linked CTS bounded by <paramref name="timeout"/>, runs the dialect's
-    ///     liveness statement, and returns green with latency. Any failure becomes a red result whose message
-    ///     names the failure class — <b>never the connection string</b> (a provider exception can embed the
-    ///     data source, so its <c>.Message</c> is deliberately not surfaced).
-    /// </summary>
-    private static async Task<DriverProbeResult> RunLivenessAsync(
-        DbProviderFactory factory, ISqlDialect dialect, string connectionString, TimeSpan timeout,
-        CancellationToken ct)
-    {
-        var stopwatch = Stopwatch.StartNew();
-        using var cts = CancellationTokenSource.CreateLinkedTokenSource(ct);
-        if (timeout > TimeSpan.Zero) cts.CancelAfter(timeout);
-
-        try
-        {
-            var connection = factory.CreateConnection()
-                             ?? throw new InvalidOperationException(
-                                 $"the {dialect.Provider} provider factory returned no connection.");
-            await using (connection.ConfigureAwait(false))
-            {
-                connection.ConnectionString = connectionString;
-                await connection.OpenAsync(cts.Token).ConfigureAwait(false);
-
-                var command = connection.CreateCommand();
-                await using (command.ConfigureAwait(false))
-                {
-                    command.CommandText = dialect.LivenessSql;
-                    await command.ExecuteScalarAsync(cts.Token).ConfigureAwait(false);
-                }
-            }
-
-            stopwatch.Stop();
-            return new DriverProbeResult(true, "SQL SELECT 1 OK", stopwatch.Elapsed);
-        }
-        catch (OperationCanceledException) when (ct.IsCancellationRequested)
-        {
-            return new DriverProbeResult(false, "Probe cancelled.", null);
-        }
-        catch (OperationCanceledException)
-        {
-            return new DriverProbeResult(
-                false, $"Probe timed out after {timeout.TotalSeconds:F0}s.", null);
-        }
-        catch (Exception ex)
-        {
-            // The provider's own message can carry the data source (host/database), which is not a secret but
-            // is more than the operator needs — and keeping the message to a fixed class is what guarantees no
-            // credential-bearing connection string can ever slip through. Name the exception TYPE only.
-            return new DriverProbeResult(
-                false, $"Could not run the SQL liveness check ({ex.GetType().Name}).", null);
-        }
-    }
-
-    /// <summary>Constructs the production dialect for a provider; v1 supports SQL Server only.</summary>
-    private static ISqlDialect DefaultDialectFor(SqlProvider provider) => provider switch
-    {
-        SqlProvider.SqlServer => new SqlServerDialect(),
-        _ => throw new InvalidOperationException(
-            $"provider '{provider}' is not available in this build (only SqlServer is supported)."),
-    };
-}
@@ -1,250 +0,0 @@
-using System.Globalization;
-using System.Text;
-using ZB.MOM.WW.OtOpcUa.Driver.Sql.Contracts;
-
-namespace ZB.MOM.WW.OtOpcUa.Driver.Sql;
-
-/// <summary>
-///     Folds a set of <see cref="SqlTagDefinition"/>s into the minimum number of parameterized queries
-///     (design §3.6) — the driver's batching core. Pure and side-effect free: no connection, no I/O, no clock.
-///     <para><b>The GroupKey is the correctness contract.</b> Two tags share a query <em>only</em> when every
-///     field that shapes the result set is identical. Too coarse and a tag silently reads a neighbour's cell;
-///     too fine and batching degenerates to one round-trip per tag. Both directions are pinned by
-///     <c>SqlGroupPlannerTests</c>.</para>
-///     <para><b>Injection boundary (design §8.1).</b> Identifiers reach the command text through
-///     <see cref="ISqlDialect.QuoteIdentifier"/> and nothing else; every authored value becomes a
-///     <c>@k0</c>/<c>@w</c> marker with the value carried in <see cref="SqlQueryPlan.Parameters"/>. There is no
-///     interpolation of tag content into SQL anywhere in this type.</para>
-/// </summary>
-public static class SqlGroupPlanner
-{
-    /// <summary>The parameter-marker prefix for a key-value model's <c>IN</c> list.</summary>
-    private const string KeyMarkerPrefix = "@k";
-
-    /// <summary>The single parameter marker for a wide-row model's row selector.</summary>
-    private const string RowSelectorMarker = "@w";
-
-    /// <summary>
-    ///     Groups <paramref name="tags"/> by source and emits one <see cref="SqlQueryPlan"/> per group.
-    ///     <para>Deterministic: groups appear in the input order of their first member, members keep their input
-    ///     order within a group, and parameters keep the first-appearance order of their distinct values — so a
-    ///     given tag list always yields byte-identical SQL.</para>
-    /// </summary>
-    /// <param name="tags">The tags to plan. An empty sequence yields no plans.</param>
-    /// <param name="dialect">Supplies identifier quoting and the provider's row-limit syntax.</param>
-    /// <returns>One plan per distinct group key.</returns>
-    /// <exception cref="ArgumentNullException"><paramref name="tags"/> or <paramref name="dialect"/> is null.</exception>
-    /// <exception cref="ArgumentException">
-    ///     A definition is missing a field its model requires (e.g. a wide-row tag with no row selector), or an
-    ///     identifier cannot be quoted (an empty table-name part, a control character — see
-    ///     <see cref="ISqlDialect.QuoteIdentifier"/>). <see cref="SqlEquipmentTagParser"/> rejects all of these
-    ///     up front, so reaching one here means a caller built a definition by hand with a broken invariant.
-    /// </exception>
-    /// <exception cref="NotSupportedException">
-    ///     A tag carries <see cref="SqlTagModel.Query"/> (design §5.4, deferred to P3).
-    ///     <b>Deliberately loud rather than skipped:</b> silently dropping a tag would leave an authored node
-    ///     permanently unfed with nothing in the log, and the parser makes this branch unreachable in practice.
-    /// </exception>
-    public static IReadOnlyList<SqlQueryPlan> Plan(IEnumerable<SqlTagDefinition> tags, ISqlDialect dialect)
-    {
-        ArgumentNullException.ThrowIfNull(tags);
-        ArgumentNullException.ThrowIfNull(dialect);
-
-        // Ordered grouping: the dictionary decides membership, the list decides emission order.
-        var order = new List<object>();
-        var groups = new Dictionary<object, List<SqlTagDefinition>>();
-
-        foreach (var tag in tags)
-        {
-            ArgumentNullException.ThrowIfNull(tag);
-            var key = BuildGroupKey(tag);
-            if (!groups.TryGetValue(key, out var members))
-            {
-                members = [];
-                groups.Add(key, members);
-                order.Add(key);
-            }
-
-            members.Add(tag);
-        }
-
-        var plans = new List<SqlQueryPlan>(order.Count);
-        foreach (var key in order)
-        {
-            var members = groups[key];
-            plans.Add(members[0].Model switch
-            {
-                SqlTagModel.KeyValue => BuildKeyValuePlan(key, members, dialect),
-                SqlTagModel.WideRow => BuildWideRowPlan(key, members, dialect),
-                _ => throw UnsupportedModel(members[0]),
-            });
-        }
-
-        return plans;
-    }
-
-    /// <summary>
-    ///     Composes the equality key that decides which tags share a query. Both models produce a 5-tuple whose
-    ///     first element is the model, so a key-value key can never compare equal to a wide-row key.
-    ///     <list type="bullet">
-    ///         <item>
-    ///             <see cref="SqlTagModel.KeyValue"/> → <c>(model, table, keyColumn, valueColumn, timestampColumn)</c>.
-    ///             Every one of those shapes the emitted SELECT: sharing a plan across two <c>valueColumn</c>s
-    ///             would make one tag publish the other's column.
-    ///         </item>
-    ///         <item>
-    ///             <see cref="SqlTagModel.WideRow"/> → <c>(model, table, whereColumn, whereValue, topByTimestamp)</c>
-    ///             — i.e. the table plus the whole row selector, exactly design §5.3's
-    ///             <c>(table, rowSelector)</c>. The members' own <c>columnName</c>/<c>timestampColumn</c> are
-    ///             deliberately <b>not</b> in the key: differing there is the point of the model (many columns,
-    ///             one row), and they are added to the SELECT list instead.
-    ///         </item>
-    ///     </list>
-    ///     <para>String comparison is <b>ordinal</b>. SQL Server object names are usually case-insensitive, so
-    ///     two tags authored <c>dbo.T</c> and <c>DBO.T</c> plan as two groups. That costs one extra round-trip
-    ///     and is never wrong; guessing the server's collation here could fold two genuinely different sources.</para>
-    /// </summary>
-    private static object BuildGroupKey(SqlTagDefinition tag) => tag.Model switch
-    {
-        SqlTagModel.KeyValue => (tag.Model, tag.Table, tag.KeyColumn, tag.ValueColumn, tag.TimestampColumn),
-        SqlTagModel.WideRow => (tag.Model, tag.Table, tag.RowSelectorColumn, tag.RowSelectorValue,
-            tag.RowSelectorTopByTimestamp),
-        _ => throw UnsupportedModel(tag),
-    };
-
-    /// <summary>
-    ///     Emits <c>SELECT &lt;key&gt;, &lt;value&gt;[, &lt;ts&gt;] FROM &lt;table&gt; WHERE &lt;key&gt; IN (@k0..@kN)</c>.
-    ///     The key column is selected because the reader indexes rows by it to slice values back per member.
-    ///     <para>Keys are de-duplicated (ordinal) before binding: two tags authored against the same
-    ///     <c>keyValue</c> bind one parameter but stay two members, so both nodes are fed from the one row.</para>
-    /// </summary>
-    private static SqlQueryPlan BuildKeyValuePlan(
-        object groupKey, List<SqlTagDefinition> members, ISqlDialect dialect)
-    {
-        var first = members[0];
-        var keyColumn = RequireIdentifier(first.KeyColumn, nameof(SqlTagDefinition.KeyColumn), first);
-        var valueColumn = RequireIdentifier(first.ValueColumn, nameof(SqlTagDefinition.ValueColumn), first);
-        var timestampColumn = Blank(first.TimestampColumn) ? null : first.TimestampColumn;
-
-        var selected = new List<string>(3);
-        AddDistinct(selected, keyColumn);
-        AddDistinct(selected, valueColumn);
-        if (timestampColumn is not null) AddDistinct(selected, timestampColumn);
-
-        // A keyValue may legitimately be the empty string, so only null is a broken invariant.
-        var names = new List<string>(members.Count);
-        var values = new List<object?>(members.Count);
-        var seen = new HashSet<string>(StringComparer.Ordinal);
-        foreach (var member in members)
-        {
-            var keyValue = member.KeyValue
-                           ?? throw MissingField(nameof(SqlTagDefinition.KeyValue), member);
-            if (!seen.Add(keyValue)) continue;
-            names.Add(KeyMarkerPrefix + values.Count.ToString(CultureInfo.InvariantCulture));
-            values.Add(keyValue);
-        }
-
-        var sql = new StringBuilder("SELECT ")
-            .Append(QuoteList(selected, dialect))
-            .Append(" FROM ").Append(QuoteQualifiedName(first.Table, dialect))
-            .Append(" WHERE ").Append(dialect.QuoteIdentifier(keyColumn))
-            .Append(" IN (").AppendJoin(", ", names).Append(')')
-            .ToString();
-
-        return new SqlQueryPlan(SqlTagModel.KeyValue, groupKey, sql, names, values, members, selected);
-    }
-
-    /// <summary>
-    ///     Emits <c>SELECT &lt;cols&gt; FROM &lt;table&gt; WHERE &lt;whereColumn&gt; = @w</c>, or — for a
-    ///     <c>topByTimestamp</c> selector — the single-row form
-    ///     <c>SELECT &lt;limit&gt; &lt;cols&gt; FROM &lt;table&gt; ORDER BY &lt;ts&gt; DESC &lt;limit&gt;</c>, whose
-    ///     row limit comes from <see cref="ISqlDialect.SingleRowLimitPrefix"/> /
-    ///     <see cref="ISqlDialect.SingleRowLimitSuffix"/> (T-SQL fills the prefix: <c>SELECT TOP 1 …</c>).
-    ///     <para>The SELECT list is each member's <c>columnName</c> (distinct, in first-appearance order),
-    ///     followed by each distinct member <c>timestampColumn</c> — so members of one row may carry different
-    ///     timestamp columns without splitting the group. The where-column itself is <b>not</b> selected: every
-    ///     row in the result already matches the bound value, so reading it back adds nothing.</para>
-    /// </summary>
-    private static SqlQueryPlan BuildWideRowPlan(
-        object groupKey, List<SqlTagDefinition> members, ISqlDialect dialect)
-    {
-        var first = members[0];
-
-        var selected = new List<string>(members.Count + 1);
-        foreach (var member in members)
-            AddDistinct(selected, RequireIdentifier(member.ColumnName, nameof(SqlTagDefinition.ColumnName), member));
-        foreach (var member in members)
-            if (!Blank(member.TimestampColumn))
-                AddDistinct(selected, member.TimestampColumn!);
-
-        var table = QuoteQualifiedName(first.Table, dialect);
-        var columns = QuoteList(selected, dialect);
-
-        // A where-pair wins over topByTimestamp; the parser already guarantees exactly one is populated.
-        if (!Blank(first.RowSelectorColumn) && first.RowSelectorValue is not null)
-        {
-            var sql = string.Concat(
-                "SELECT ", columns, " FROM ", table,
-                " WHERE ", dialect.QuoteIdentifier(first.RowSelectorColumn!), " = ", RowSelectorMarker);
-            return new SqlQueryPlan(
-                SqlTagModel.WideRow, groupKey, sql,
-                [RowSelectorMarker], [first.RowSelectorValue], members, selected);
-        }
-
-        if (!Blank(first.RowSelectorTopByTimestamp))
-        {
-            // The row limit is dialect syntax and sits at opposite ends of the statement per provider
-            // (T-SQL "SELECT TOP 1 …", SQLite/Postgres/MySQL "… LIMIT 1"), so both ends are emitted
-            // unconditionally and the dialect decides which one it fills. See ISqlDialect.SingleRowLimitPrefix.
-            var sql = string.Concat(
-                "SELECT ", dialect.SingleRowLimitPrefix, columns, " FROM ", table,
-                " ORDER BY ", dialect.QuoteIdentifier(first.RowSelectorTopByTimestamp!), " DESC",
-                dialect.SingleRowLimitSuffix);
-            return new SqlQueryPlan(SqlTagModel.WideRow, groupKey, sql, [], [], members, selected);
-        }
-
-        throw new ArgumentException(
-            $"Wide-row tag '{first.Name}' has no row selector: author either a rowSelector.whereColumn/" +
-            "whereValue pair or a rowSelector.topByTimestamp column.", nameof(members));
-    }
-
-    /// <summary>
-    ///     Quotes a possibly multi-part object name by splitting on <c>.</c> and quoting each part —
-    ///     <c>dbo.TagValues</c> becomes <c>[dbo].[TagValues]</c>.
-    ///     <para><see cref="ISqlDialect.QuoteIdentifier"/> quotes exactly <b>one</b> part; handing it the dotted
-    ///     form would yield <c>[dbo.TagValues]</c>, which is safe but names an object that does not exist. An
-    ///     empty part (<c>dbo..T</c>) is rejected by the dialect rather than emitted. As a consequence an object
-    ///     whose real name contains a literal <c>.</c> cannot be authored — an accepted v1 limitation.</para>
-    /// </summary>
-    private static string QuoteQualifiedName(string name, ISqlDialect dialect)
-    {
-        if (Blank(name))
-            throw new ArgumentException("A Sql tag's 'table' must be a non-empty object name.", nameof(name));
-
-        return string.Join('.', name.Split('.').Select(dialect.QuoteIdentifier));
-    }
-
-    /// <summary>Quotes each already-de-duplicated column name and joins them into a SELECT list.</summary>
-    private static string QuoteList(IReadOnlyList<string> columns, ISqlDialect dialect)
-        => string.Join(", ", columns.Select(dialect.QuoteIdentifier));
-
-    /// <summary>Appends <paramref name="value"/> unless an ordinal-equal entry is already present.</summary>
-    private static void AddDistinct(List<string> target, string value)
-    {
-        if (!target.Contains(value, StringComparer.Ordinal)) target.Add(value);
-    }
-
-    /// <summary>True when the string is null, empty, or all whitespace — i.e. cannot be an identifier.</summary>
-    private static bool Blank(string? value) => string.IsNullOrWhiteSpace(value);
-
-    /// <summary>Returns a required identifier field, or throws naming both the tag and the field.</summary>
-    private static string RequireIdentifier(string? value, string field, SqlTagDefinition tag)
-        => Blank(value) ? throw MissingField(field, tag) : value!;
-
-    private static ArgumentException MissingField(string field, SqlTagDefinition tag)
-        => new($"Sql tag '{tag.Name}' ({tag.Model}) is missing the required '{field}'.");
-
-    private static NotSupportedException UnsupportedModel(SqlTagDefinition tag)
-        => new($"Sql tag '{tag.Name}' uses the {tag.Model} model, which the poll planner does not support. " +
-               "v1 plans KeyValue and WideRow only; the named-query model is deferred (design §5.4).");
-}
@@ -1,839 +0,0 @@
-using System.Data.Common;
-using System.Diagnostics;
-using System.Globalization;
-using Microsoft.Extensions.Logging;
-using Microsoft.Extensions.Logging.Abstractions;
-using ZB.MOM.WW.OtOpcUa.Core.Abstractions;
-using ZB.MOM.WW.OtOpcUa.Driver.Sql.Contracts;
-
-namespace ZB.MOM.WW.OtOpcUa.Driver.Sql;
-
-/// <summary>
-///     Executes one poll pass: resolves each requested reference to a <see cref="SqlTagDefinition"/>, folds
-///     the definitions into the minimum number of queries via <see cref="SqlGroupPlanner"/>, runs one
-///     command per group under a bounded deadline, and slices each result set back to per-tag
-///     <see cref="DataValueSnapshot"/>s — <b>positionally aligned with the caller's reference list</b>
-///     (design §3.2). Structurally the SQL analogue of <c>ModbusDriver.ReadCoalescedAsync</c>: group → one
-///     round-trip → slice back.
-///     <para><b>N in, N out, in order.</b> The returned list always has exactly one entry per requested
-///     reference, at the same index, whatever happened. Per-tag failures are Bad-coded snapshots, never
-///     exceptions (the <see cref="IReadable"/> contract) — see <see cref="SqlStatusCodes"/> for which code
-///     means what. This matters more here than in a point-to-point driver: one result set feeds many tags,
-///     so a slicing defect does not fail loudly — it publishes <em>one tag's value onto another tag's
-///     node</em>.</para>
-///     <para><b>The whole call throws only when the database is unreachable</b> — that is, when opening a
-///     connection fails. That surfaces to <see cref="PollGroupEngine"/> as a poll failure and earns the
-///     capped-exponential backoff; the driver's <c>IHostConnectivityProbe</c> is what scopes Bad quality
-///     across the subtree during an outage, so nothing is lost by not manufacturing per-tag snapshots for
-///     an outage. A query that fails <em>after</em> the connection opened is the group's problem, not the
-///     server's, and Bad-codes that group only.</para>
-///     <para><b>Deadlines (design §8.3, the R2-01 frozen-peer lesson).</b> Two independent mechanisms, both
-///     required. <c>CommandTimeout</c> is the <em>server-side</em> backstop and bounds nothing on a wedged
-///     socket. The wall-clock bound is client-side and is what actually guarantees this method returns: see
-///     <see cref="RunGroupAsync"/>. A frozen database yields <see cref="SqlStatusCodes.BadTimeout"/>
-///     snapshots — it must never wedge the poll thread.</para>
-///     <para><b>Not a driver.</b> This type owns the read path only; it deliberately holds no health state,
-///     no subscription state and no connection between polls, so the driver shell can wrap it in
-///     <see cref="PollGroupEngine"/> and own those concerns.</para>
-/// </summary>
-public sealed class SqlPollReader
-{
-    /// <summary>Minimum spacing between "your source violates the query contract" warnings, per reader.</summary>
-    private static readonly TimeSpan ContractWarningInterval = TimeSpan.FromMinutes(1);
-
-    private readonly DbProviderFactory _factory;
-    private readonly string _connectionString;
-    private readonly ISqlDialect _dialect;
-    private readonly TimeSpan _operationTimeout;
-    private readonly int _commandTimeoutSeconds;
-    private readonly bool _nullIsBad;
-    private readonly Func<string, SqlTagDefinition?> _resolve;
-    private readonly ILogger _logger;
-
-    /// <summary>
-    ///     Caps concurrently executing group queries — and therefore concurrently held connections
-    ///     (design §8.4). Never disposed: a <see cref="SemaphoreSlim"/> only needs disposal once its
-    ///     <c>AvailableWaitHandle</c> has been touched, and not disposing it also removes the hazard of a
-    ///     timed-out-but-still-running group releasing into a disposed semaphore.
-    /// </summary>
-    private readonly SemaphoreSlim _gate;
-
-    private long _lastContractWarningTicks;
-
-    /// <summary>Initializes a new instance of the <see cref="SqlPollReader"/> class.</summary>
-    /// <param name="factory">
-    ///     Creates the provider's connections. Passed explicitly rather than taken from
-    ///     <paramref name="dialect"/> so the driver can hand in an instrumented or pre-configured factory.
-    /// </param>
-    /// <param name="connectionString">
-    ///     The resolved connection string (never the authored <c>connectionStringRef</c> — secrets are
-    ///     resolved by the driver at Initialize, design §8.2).
-    /// </param>
-    /// <param name="dialect">Supplies identifier quoting, row-limit syntax, and column-type mapping.</param>
-    /// <param name="commandTimeout">
-    ///     The ADO.NET <c>CommandTimeout</c> backstop. Rounded <b>up</b> to whole seconds and floored at 1,
-    ///     because ADO.NET reads <c>CommandTimeout = 0</c> as "wait forever" — the one value this option
-    ///     must never silently become.
-    /// </param>
-    /// <param name="operationTimeout">
-    ///     The wall-clock ceiling on one group's whole operation — waiting for a concurrency slot, opening
-    ///     the connection, and running the query. A breach Bad-codes that group with
-    ///     <see cref="SqlStatusCodes.BadTimeout"/>.
-    ///     <para>Authoring should keep this strictly greater than <paramref name="commandTimeout"/>
-    ///     (design §8.3): inverted, the client-side abort always fires first and masks the server-side
-    ///     backstop. That rule is <b>not</b> enforced here — it belongs to config validation, and this type
-    ///     stays usable for the tests that must deliberately invert it.</para>
-    /// </param>
-    /// <param name="maxConcurrentGroups">
-    ///     Maximum group queries — and connections — in flight at once. A timed-out group keeps its slot
-    ///     until it truly finishes, so this is a hard ceiling on connections even against a frozen database.
-    ///     See <see cref="RunGroupAsync"/> for why a high value is safe under
-    ///     <c>Microsoft.Data.SqlClient</c> but wants sizing against thread-pool headroom under a provider
-    ///     that blocks synchronously.
-    /// </param>
-    /// <param name="nullIsBad">
-    ///     <see langword="true"/> publishes <see cref="SqlStatusCodes.Bad"/> for a NULL value cell instead
-    ///     of the default <see cref="SqlStatusCodes.Uncertain"/>. It governs a <em>present</em> row with a
-    ///     NULL cell only — an absent row is always <see cref="SqlStatusCodes.BadNoData"/>.
-    /// </param>
-    /// <param name="resolve">
-    ///     RawPath → tag definition; <see langword="null"/> on a miss. Shaped to match
-    ///     <see cref="EquipmentTagRefResolver{TDef}"/>'s lookup so the driver can pass its authored table
-    ///     straight through.
-    /// </param>
-    /// <param name="logger">Optional; defaults to a no-op logger.</param>
-    /// <exception cref="ArgumentNullException">A required reference argument is null.</exception>
-    /// <exception cref="ArgumentException"><paramref name="connectionString"/> is blank.</exception>
-    /// <exception cref="ArgumentOutOfRangeException">A timeout is non-positive, or the cap is below 1.</exception>
-    public SqlPollReader(
-        DbProviderFactory factory,
-        string connectionString,
-        ISqlDialect dialect,
-        TimeSpan commandTimeout,
-        TimeSpan operationTimeout,
-        int maxConcurrentGroups,
-        bool nullIsBad,
-        Func<string, SqlTagDefinition?> resolve,
-        ILogger? logger = null)
-    {
-        ArgumentNullException.ThrowIfNull(factory);
-        ArgumentNullException.ThrowIfNull(dialect);
-        ArgumentNullException.ThrowIfNull(resolve);
-        if (string.IsNullOrWhiteSpace(connectionString))
-            throw new ArgumentException("A Sql poll reader needs a connection string.", nameof(connectionString));
-        ArgumentOutOfRangeException.ThrowIfLessThanOrEqual(commandTimeout, TimeSpan.Zero);
-        ArgumentOutOfRangeException.ThrowIfLessThanOrEqual(operationTimeout, TimeSpan.Zero);
-        ArgumentOutOfRangeException.ThrowIfLessThan(maxConcurrentGroups, 1);
-
-        _factory = factory;
-        _connectionString = connectionString;
-        _dialect = dialect;
-        _operationTimeout = operationTimeout;
-        _commandTimeoutSeconds = Math.Max(1, (int)Math.Ceiling(commandTimeout.TotalSeconds));
-        _nullIsBad = nullIsBad;
-        _resolve = resolve;
-        _logger = logger ?? NullLogger.Instance;
-        _gate = new SemaphoreSlim(maxConcurrentGroups, maxConcurrentGroups);
-    }
-
-    /// <summary>
-    ///     Reads every reference in one poll pass. Matches <see cref="IReadable.ReadAsync"/>'s shape so the
-    ///     driver shell can delegate to it directly.
-    /// </summary>
-    /// <param name="fullReferences">The RawPaths to read. Empty yields an empty result and touches no connection.</param>
-    /// <param name="cancellationToken">
-    ///     The caller's token. Its cancellation <b>propagates</b> as an
-    ///     <see cref="OperationCanceledException"/> — the engine asked the poll to stop, and nobody is
-    ///     waiting for the snapshots. This is deliberately asymmetric with an <c>operationTimeout</c>
-    ///     breach, which is a data-quality fact clients must see and so becomes
-    ///     <see cref="SqlStatusCodes.BadTimeout"/> snapshots.
-    /// </param>
-    /// <returns>One snapshot per reference, at the same index.</returns>
-    /// <exception cref="ArgumentNullException"><paramref name="fullReferences"/> is null.</exception>
-    /// <exception cref="OperationCanceledException"><paramref name="cancellationToken"/> was cancelled.</exception>
-    /// <exception cref="DbException">The database could not be reached (opening a connection failed).</exception>
-    public async Task<IReadOnlyList<DataValueSnapshot>> ReadAsync(
-        IReadOnlyList<string> fullReferences, CancellationToken cancellationToken)
-    {
-        ArgumentNullException.ThrowIfNull(fullReferences);
-
-        var results = new DataValueSnapshot[fullReferences.Count];
-        if (results.Length == 0) return results;
-
-        var readAt = DateTime.UtcNow;
-
-        // Resolve first. A miss is this tag's own problem (BadNodeIdUnknown) and must not reach the planner,
-        // whose members are the sole thing the slice-back walks.
-        var definitions = new List<SqlTagDefinition>(fullReferences.Count);
-        var slots = new Dictionary<SqlTagDefinition, List<int>>();
-        for (var i = 0; i < fullReferences.Count; i++)
-        {
-            var definition = fullReferences[i] is { } reference ? _resolve(reference) : null;
-            if (definition is null)
-            {
-                results[i] = new DataValueSnapshot(null, SqlStatusCodes.BadNodeIdUnknown, null, readAt);
-                continue;
-            }
-
-            definitions.Add(definition);
-            if (!slots.TryGetValue(definition, out var positions))
-                slots[definition] = positions = [];
-            positions.Add(i);
-        }
-
-        if (definitions.Count > 0)
-            await ReadGroupsAsync(definitions, slots, results, readAt, cancellationToken).ConfigureAwait(false);
-
-        // Fail-safe. Nothing above should leave a hole, but "N in, N out" is a contract the caller indexes
-        // blind — a null here would be a NullReferenceException in the publish fan-out, far from its cause.
-        for (var i = 0; i < results.Length; i++)
-            results[i] ??= new DataValueSnapshot(null, SqlStatusCodes.BadInternalError, null, readAt);
-
-        return results;
-    }
-
-    /// <summary>Plans the resolved definitions, runs every group concurrently, and slices the results back.</summary>
-    private async Task ReadGroupsAsync(
-        List<SqlTagDefinition> definitions,
-        Dictionary<SqlTagDefinition, List<int>> slots,
-        DataValueSnapshot[] results,
-        DateTime readAt,
-        CancellationToken cancellationToken)
-    {
-        IReadOnlyList<SqlQueryPlan> plans;
-        try
-        {
-            plans = SqlGroupPlanner.Plan(definitions, _dialect);
-        }
-        catch (Exception ex) when (ex is ArgumentException or NotSupportedException)
-        {
-            // A definition with a broken invariant — SqlEquipmentTagParser rejects all of these up front, so
-            // reaching here means a definition was built past the parser. It is an authoring fault, not a
-            // database fault: Bad-code the planned tags rather than throwing and triggering connection backoff.
-            _logger.LogError(ex, "Sql poll planning failed for {Count} tag(s); publishing BadConfigurationError.",
-                definitions.Count);
-            foreach (var definition in definitions)
-            {
-                if (!slots.TryGetValue(definition, out var positions)) continue;
-                var snapshot = new DataValueSnapshot(null, SqlStatusCodes.BadConfigurationError, null, readAt);
-                foreach (var position in positions) results[position] = snapshot;
-            }
-
-            return;
-        }
-
-        // Groups run concurrently; _gate — not the task count — is what bounds open connections. Each group
-        // carries its own deadline, so the whole call is bounded by ~operationTimeout rather than by
-        // plans.Count × operationTimeout.
-        var groups = new Task<GroupResult>[plans.Count];
-        for (var g = 0; g < plans.Count; g++)
-            groups[g] = RunGroupAsync(plans[g], cancellationToken);
-
-        // WhenAll waits for every group before surfacing a fault, so a thrown "database unreachable" never
-        // leaves a sibling group running against a connection nobody is watching.
-        var outcomes = await Task.WhenAll(groups).ConfigureAwait(false);
-
-        for (var g = 0; g < plans.Count; g++)
-            Slice(plans[g], outcomes[g], slots, results, readAt);
-    }
-
-    /// <summary>
-    ///     Runs one group's query under a hard wall-clock ceiling.
-    ///     <para><b>Why the ceiling is <c>Task.WaitAsync</c> and not just a linked
-    ///     <c>CancelAfter</c>.</b> A linked token only bounds a
-    ///     provider that <em>honours</em> it. The S7 R2-01 finding was exactly a provider whose async path
-    ///     ignored its deadline, and ADO.NET has the same shape: some providers implement
-    ///     <c>ExecuteReaderAsync</c> synchronously, and even a genuinely async one can hang inside its own
-    ///     cancellation handshake against a frozen socket. Both are used here: the linked token so a
-    ///     well-behaved provider unwinds cleanly and releases its connection, and <c>WaitAsync</c> so
-    ///     control returns at the deadline regardless.</para>
-    ///     <para>The work is started on the thread pool so a provider that blocks synchronously blocks a
-    ///     pool thread rather than the caller — without that, a synchronous provider never yields the task
-    ///     there would be to bound.</para>
-    ///     <para><b>Thread-pool scheduling and what a BadTimeout therefore means.</b> The group's clock
-    ///     starts before <c>Task.Run</c>, so in principle a group could burn budget queueing for a pool
-    ///     thread rather than waiting on the database. <c>TaskCreationOptions.LongRunning</c> (a dedicated
-    ///     OS thread) was considered and <b>rejected</b>: it would create and tear down one thread per group
-    ///     per poll, forever, on a driver whose whole job is to poll on a short cadence — a permanent cost
-    ///     paid against a hazard that cannot arise with the provider this driver actually ships.
-    ///     <c>Microsoft.Data.SqlClient</c>'s async path is genuinely asynchronous: the delegate reaches its
-    ///     first real await within microseconds and returns the pool thread, so a frozen SQL Server parks
-    ///     <em>zero</em> pool threads however long it stays frozen, and the driver cannot starve itself no
-    ///     matter how high <c>maxConcurrentGroups</c> goes. The queueing scenario needs a provider that
-    ///     degrades to synchronous blocking — which is exactly what the SQLite test rig exploits on purpose,
-    ///     and is not a shipped configuration. <b>Consequence for outage diagnosis (e.g. blackhole-testing a
-    ///     paused SQL Server):</b> under <c>Microsoft.Data.SqlClient</c> a
-    ///     <see cref="SqlStatusCodes.BadTimeout"/> means the database did not answer inside
-    ///     <c>operationTimeout</c> — it cannot be an artefact of this driver's own pool pressure. Under a
-    ///     synchronously-blocking provider it may also include queueing delay, so size
-    ///     <c>maxConcurrentGroups</c> below the process's readily-available worker count there.</para>
-    ///     <para><b>The concurrency slot is released by the work, not by the waiter.</b> A timed-out group
-    ///     keeps its slot until it truly finishes, so a frozen database can never accumulate more than
-    ///     <c>maxConcurrentGroups</c> connections however long it stays frozen. The slot wait is itself
-    ///     inside the deadline, so a poll behind a wedged group still returns on time — as BadTimeout.</para>
-    /// </summary>
-    private async Task<GroupResult> RunGroupAsync(SqlQueryPlan plan, CancellationToken cancellationToken)
-    {
-        var clock = Stopwatch.StartNew();
-
-        if (!await _gate.WaitAsync(Remaining(clock), cancellationToken).ConfigureAwait(false))
-            return GroupResult.TimedOut;
-
-        var handedOff = false;
-        var deadline = CancellationTokenSource.CreateLinkedTokenSource(cancellationToken);
-        Task<GroupResult> work;
-        try
-        {
-            var budget = Remaining(clock);
-            if (budget <= TimeSpan.Zero) return GroupResult.TimedOut;
-            deadline.CancelAfter(budget);
-
-            work = Task.Run(
-                async () =>
-                {
-                    try
-                    {
-                        return await QueryAsync(plan, deadline.Token).ConfigureAwait(false);
-                    }
-                    finally
-                    {
-                        _gate.Release();
-                        deadline.Dispose();
-                    }
-                },
-                CancellationToken.None);
-            handedOff = true;
-        }
-        finally
-        {
-            // Ownership of both the slot and the CTS transfers to the work task; release them here only on
-            // the paths where that task was never created.
-            if (!handedOff)
-            {
-                _gate.Release();
-                deadline.Dispose();
-            }
-        }
-
-        try
-        {
-            return await work.WaitAsync(Remaining(clock), cancellationToken).ConfigureAwait(false);
-        }
-        catch (TimeoutException)
-        {
-            // Our wall-clock bound fired while the provider was still inside the call.
-            return TimedOut(plan, work);
-        }
-        catch (OperationCanceledException)
-        {
-            // Either the caller pulled the plug, or our deadline fired and the provider DID honour the
-            // linked token. Both leave the work running with nobody to observe its fault.
-            if (!cancellationToken.IsCancellationRequested) return TimedOut(plan, work);
-            Detach(work);
-            throw;
-        }
-    }
-
-    /// <summary>How much of this group's <c>operationTimeout</c> budget is left; never negative.</summary>
-    private TimeSpan Remaining(Stopwatch clock)
-    {
-        var remaining = _operationTimeout - clock.Elapsed;
-        return remaining > TimeSpan.Zero ? remaining : TimeSpan.Zero;
-    }
-
-    /// <summary>Records the deadline breach and detaches the abandoned work.</summary>
-    private GroupResult TimedOut(SqlQueryPlan plan, Task work)
-    {
-        // The table is named for the same reason the contract warnings name it: under a partial outage this
-        // line repeats every poll, and "which source is frozen" is the only question the operator has.
-        _logger.LogWarning(
-            "Sql poll group ({Model}, '{Table}', {Members} tag(s)) exceeded the {Timeout} ms operation " +
-            "timeout; publishing BadTimeout.",
-            plan.Model, plan.Members[0].Table, plan.Members.Count,
-            (int)_operationTimeout.TotalMilliseconds);
-
-        Detach(work);
-        return GroupResult.TimedOut;
-    }
-
-    /// <summary>
-    ///     Observes an abandoned group's eventual fault so it never surfaces as an unobserved task
-    ///     exception. The task still owns its connection and still releases the concurrency slot when it
-    ///     finally completes — that is what keeps a frozen database from accumulating connections.
-    /// </summary>
-    private static void Detach(Task work)
-        => _ = work.ContinueWith(
-            static t => _ = t.Exception,
-            CancellationToken.None,
-            TaskContinuationOptions.OnlyOnFaulted | TaskContinuationOptions.ExecuteSynchronously,
-            TaskScheduler.Default);
-
-    /// <summary>
-    ///     Opens a connection, executes the plan's single command, and materialises the result set.
-    ///     <para>The rows are read into memory <b>before</b> the reader is disposed — the slice-back needs
-    ///     random access across members, and holding a reader (and therefore a connection) open across that
-    ///     work is exactly how a poll loop exhausts a pool.</para>
-    /// </summary>
-    private async Task<GroupResult> QueryAsync(SqlQueryPlan plan, CancellationToken cancellationToken)
-    {
-        var connection = _factory.CreateConnection()
-                         ?? throw new InvalidOperationException(
-                             $"The {_dialect.Provider} provider factory returned no connection.");
-
-        await using (connection.ConfigureAwait(false))
-        {
-            connection.ConnectionString = _connectionString;
-
-            // Deliberately OUTSIDE the catch below: a failed open means the database is unreachable, which
-            // is the one condition IReadable says the whole call may throw on (→ PollGroupEngine backoff).
-            await connection.OpenAsync(cancellationToken).ConfigureAwait(false);
-
-            try
-            {
-                var command = connection.CreateCommand();
-                await using (command.ConfigureAwait(false))
-                {
-                    command.CommandText = plan.SqlText;
-                    command.CommandTimeout = _commandTimeoutSeconds;
-                    for (var i = 0; i < plan.ParameterNames.Count; i++)
-                    {
-                        var parameter = command.CreateParameter();
-                        // Bound by the plan's own index pairing — never by re-deriving the marker convention.
-                        parameter.ParameterName = plan.ParameterNames[i];
-                        parameter.Value = plan.Parameters[i] ?? DBNull.Value;
-                        command.Parameters.Add(parameter);
-                    }
-
-                    var reader = await command.ExecuteReaderAsync(cancellationToken).ConfigureAwait(false);
-                    await using (reader.ConfigureAwait(false))
-                    {
-                        return await MaterialiseAsync(plan, reader, cancellationToken).ConfigureAwait(false);
-                    }
-                }
-            }
-            catch (OperationCanceledException)
-            {
-                throw;
-            }
-            catch (Exception ex)
-            {
-                // The connection opened, so the server is up — this query is what failed (an identifier that
-                // is not in the catalog, a lock, a permission). That is this group's problem alone.
-                _logger.LogWarning(
-                    ex, "Sql poll group ({Model}, {Members} tag(s)) failed: {Sql}",
-                    plan.Model, plan.Members.Count, plan.SqlText);
-                return GroupResult.Failed;
-            }
-        }
-    }
-
-    /// <summary>
-    ///     Reads every row into memory, projected onto <see cref="SqlQueryPlan.SelectedColumns"/>. Row
-    ///     fetching stays on the async path so a result set that streams slowly still honours the deadline
-    ///     token mid-read, rather than only at the ExecuteReader boundary.
-    /// </summary>
-    private async Task<GroupResult> MaterialiseAsync(
-        SqlQueryPlan plan, DbDataReader reader, CancellationToken cancellationToken)
-    {
-        var selected = plan.SelectedColumns;
-        var ordinals = new int[selected.Count];
-        var typeNames = new string[selected.Count];
-        var columnIndex = new Dictionary<string, int>(selected.Count, StringComparer.Ordinal);
-        for (var c = 0; c < selected.Count; c++)
-        {
-            // GetOrdinal rather than the position in SelectedColumns: the list is documented to be in
-            // ordinal order, but resolving it against the live result set is what makes a wrong slice
-            // impossible rather than merely unlikely.
-            ordinals[c] = reader.GetOrdinal(selected[c]);
-            typeNames[c] = SafeTypeName(reader, ordinals[c]);
-            columnIndex[selected[c]] = c;
-        }
-
-        var rows = new List<object?[]>();
-        while (await reader.ReadAsync(cancellationToken).ConfigureAwait(false))
-        {
-            var row = new object?[selected.Count];
-            for (var c = 0; c < selected.Count; c++)
-                row[c] = reader.IsDBNull(ordinals[c]) ? null : reader.GetValue(ordinals[c]);
-            rows.Add(row);
-        }
-
-        return GroupResult.Ok(rows, columnIndex, typeNames);
-    }
-
-    /// <summary>Reads a column's provider type name, falling back to the dialect's unknown-type default.</summary>
-    private static string SafeTypeName(DbDataReader reader, int ordinal)
-    {
-        try
-        {
-            return reader.GetDataTypeName(ordinal) ?? string.Empty;
-        }
-        catch (Exception ex) when (ex is NotSupportedException or InvalidOperationException
-                                       or IndexOutOfRangeException)
-        {
-            // A provider that declines to report a type name must not fail the poll — the tag's declared
-            // type (or the dialect's String fallback) covers it.
-            return string.Empty;
-        }
-    }
-
-    /// <summary>Maps one group's outcome onto every slot its members occupy in the caller's list.</summary>
-    private void Slice(
-        SqlQueryPlan plan,
-        GroupResult outcome,
-        Dictionary<SqlTagDefinition, List<int>> slots,
-        DataValueSnapshot[] results,
-        DateTime readAt)
-    {
-        // KeyValue indexes rows by the key column; WideRow's members all read the one selected row, so the
-        // where-column is not even in the result set (design §5.3). Both selections happen ONCE per group —
-        // they are group-wide facts, and doing them per member would report a contract violation N times.
-        var byKey = outcome.Succeeded && plan.Model == SqlTagModel.KeyValue
-            ? IndexByKey(plan, outcome)
-            : null;
-        var wideRow = outcome.Succeeded && plan.Model == SqlTagModel.WideRow
-            ? SelectWideRow(plan, outcome)
-            : null;
-
-        foreach (var member in plan.Members)
-        {
-            // Members may repeat (two tags on one keyValue, or the same ref twice) — every occurrence is fed.
-            if (!slots.TryGetValue(member, out var positions)) continue;
-
-            var snapshot = outcome.Succeeded
-                ? MapMember(plan, member, outcome, byKey, wideRow, readAt)
-                : new DataValueSnapshot(null, outcome.FailureStatus, null, readAt);
-
-            foreach (var position in positions) results[position] = snapshot;
-        }
-    }
-
-    /// <summary>
-    ///     Builds the key → row index a key-value plan slices through. Later rows win, so a source that
-    ///     breaks the one-row-per-key contract (design §3.6) still yields a deterministic value; the
-    ///     violation is reported through a rate-limited warning rather than silently.
-    /// </summary>
-    private Dictionary<string, object?[]> IndexByKey(SqlQueryPlan plan, GroupResult outcome)
-    {
-        var index = new Dictionary<string, object?[]>(StringComparer.Ordinal);
-        if (plan.KeyColumn is null || !outcome.ColumnIndex.TryGetValue(plan.KeyColumn, out var keyAt))
-            return index;
-
-        var duplicated = 0;
-        foreach (var row in outcome.Rows)
-        {
-            // A NULL key cell indexes nothing: Convert.ToString would fold it to "", which would then be
-            // matched by a tag whose keyValue is legitimately the empty string.
-            if (row[keyAt] is not { } keyCell) continue;
-
-            // Stringified because the bound keyValue is authored text while the column may be any type
-            // (an INTEGER station id, say) — the provider coerces on the way in, so match on the way out.
-            var key = Convert.ToString(keyCell, CultureInfo.InvariantCulture);
-            if (key is null) continue;
-            if (!index.TryAdd(key, row))
-            {
-                index[key] = row;
-                duplicated++;
-            }
-        }
-
-        if (duplicated > 0 && ShouldWarnAboutContract())
-        {
-            _logger.LogWarning(
-                "Sql poll source '{Table}' returned more than one row for {Count} key(s) in one poll; the " +
-                "last row wins. The key-value model requires one row per key — point the tag at a " +
-                "current-values table or an operator-authored latest-per-key view.",
-                plan.Members[0].Table, duplicated);
-        }
-
-        return index;
-    }
-
-    /// <summary>
-    ///     Picks the single row every member of a wide-row plan reads, and reports an ambiguous selector.
-    ///     <para><b>Last row wins</b> — the same tie-break <see cref="IndexByKey"/> applies, so both models
-    ///     degrade the same way. It is deterministic only <em>within one result set</em>: the where-pair form
-    ///     emits no <c>ORDER BY</c>, so across polls the "last" row is whatever the server returned last,
-    ///     i.e. storage order. That is why more than one row is a reported contract violation and not merely
-    ///     a tie to break — the model's premise (design §5.3) is that the selector identifies one row.</para>
-    ///     <para><b>Why the where-pair form is deliberately NOT given the dialect's single-row limit.</b> A
-    ///     <c>TOP 1</c> with no <c>ORDER BY</c> is not deterministic either — it returns whichever row the
-    ///     plan happens to produce first, so it would trade one arbitrary row for a differently arbitrary
-    ///     one. Worse, it would destroy the only evidence this method has that the selector is ambiguous
-    ///     (<c>Rows.Count &gt; 1</c>), converting a loud misconfiguration into a permanently silent one —
-    ///     precisely the failure mode this class's summary calls its top risk. The <c>topByTimestamp</c>
-    ///     form keeps its row limit because there the <c>ORDER BY</c> makes "the first row" a defined
-    ///     answer. The accepted cost is that an ambiguous selector materialises every matching row for one
-    ///     poll; the warning is what gets it fixed.</para>
-    /// </summary>
-    private object?[]? SelectWideRow(SqlQueryPlan plan, GroupResult outcome)
-    {
-        if (outcome.Rows.Count == 0) return null;
-        if (outcome.Rows.Count > 1 && ShouldWarnAboutContract())
-        {
-            var first = plan.Members[0];
-            var selector = string.IsNullOrWhiteSpace(first.RowSelectorColumn)
-                ? string.Concat("topByTimestamp ", first.RowSelectorTopByTimestamp)
-                : string.Concat(first.RowSelectorColumn, " = ", first.RowSelectorValue);
-            _logger.LogWarning(
-                "Sql poll source '{Table}' returned {Rows} rows for the wide-row selector '{Selector}' in " +
-                "one poll; the last row read wins, and the query carries no ORDER BY, so which row that is " +
-                "depends on storage order. The wide-row model requires a selector matching exactly one row " +
-                "— narrow the whereColumn/whereValue pair, or point the tag at a latest-row view.",
-                first.Table, outcome.Rows.Count, selector);
-        }
-
-        return outcome.Rows[^1];
-    }
-
-    /// <summary>Maps one member's cell to a snapshot: value, quality, and source timestamp.</summary>
-    private DataValueSnapshot MapMember(
-        SqlQueryPlan plan,
-        SqlTagDefinition member,
-        GroupResult outcome,
-        Dictionary<string, object?[]>? byKey,
-        object?[]? wideRow,
-        DateTime readAt)
-    {
-        object?[]? row;
-        string? valueColumn;
-        string? timestampColumn;
-        if (plan.Model == SqlTagModel.KeyValue)
-        {
-            valueColumn = plan.ValueColumn;
-            timestampColumn = plan.TimestampColumn;
-            row = member.KeyValue is { } key && byKey is not null ? byKey.GetValueOrDefault(key) : null;
-        }
-        else
-        {
-            valueColumn = member.ColumnName;
-            // A wide-row plan's members may legitimately carry DIFFERENT timestamp columns (all of them are
-            // selected), which is why the plan-level TimestampColumn is null for this model by design.
-            timestampColumn = member.TimestampColumn;
-            row = wideRow;
-        }
-
-        // No row: the key was deleted, or the row selector matched nothing. Distinct from a NULL cell.
-        if (row is null) return new DataValueSnapshot(null, SqlStatusCodes.BadNoData, null, readAt);
-
-        // A timestamp that will not parse falls back to the poll clock rather than poisoning a good value.
-        var sourceTimestamp = ReadTimestamp(outcome, row, timestampColumn) ?? readAt;
-
-        if (valueColumn is null || !outcome.ColumnIndex.TryGetValue(valueColumn, out var valueAt))
-        {
-            // The planner selects every member's value column, so this is unreachable short of plan/result
-            // drift — loud rather than silently publishing someone else's cell.
-            _logger.LogError(
-                "Sql tag '{Tag}' reads column '{Column}', which the executed plan did not select.",
-                member.Name, valueColumn);
-            return new DataValueSnapshot(null, SqlStatusCodes.BadInternalError, sourceTimestamp, readAt);
-        }
-
-        var cell = row[valueAt];
-        if (cell is null)
-        {
-            return new DataValueSnapshot(
-                null, _nullIsBad ? SqlStatusCodes.Bad : SqlStatusCodes.Uncertain, sourceTimestamp, readAt);
-        }
-
-        var target = member.DeclaredType ?? _dialect.MapColumnType(outcome.TypeNames[valueAt]);
-        if (!TryCoerce(cell, target, out var value))
-        {
-            _logger.LogWarning(
-                "Sql tag '{Tag}' could not coerce a {Actual} cell to its {Declared} type.",
-                member.Name, cell.GetType().Name, target);
-            return new DataValueSnapshot(null, SqlStatusCodes.BadTypeMismatch, sourceTimestamp, readAt);
-        }
-
-        return new DataValueSnapshot(value, SqlStatusCodes.Good, sourceTimestamp, readAt);
-    }
-
-    /// <summary>Reads a row's source timestamp, or null when there is no column, no value, or no parse.</summary>
-    private static DateTime? ReadTimestamp(GroupResult outcome, object?[] row, string? timestampColumn)
-    {
-        if (string.IsNullOrWhiteSpace(timestampColumn)) return null;
-        if (!outcome.ColumnIndex.TryGetValue(timestampColumn, out var at)) return null;
-        if (row[at] is not { } cell) return null;
-        return TryCoerce(cell, DriverDataType.DateTime, out var value) ? (DateTime?)value : null;
-    }
-
-    /// <summary>
-    ///     Coerces a provider cell to the tag's effective <see cref="DriverDataType"/>, so the published CLR
-    ///     type matches the type the address space declared for the node. Never throws.
-    /// </summary>
-    private static bool TryCoerce(object cell, DriverDataType target, out object? value)
-    {
-        try
-        {
-            value = target switch
-            {
-                DriverDataType.Boolean => Convert.ToBoolean(cell, CultureInfo.InvariantCulture),
-                DriverDataType.Int16 => Convert.ToInt16(cell, CultureInfo.InvariantCulture),
-                DriverDataType.Int32 => Convert.ToInt32(cell, CultureInfo.InvariantCulture),
-                DriverDataType.Int64 => Convert.ToInt64(cell, CultureInfo.InvariantCulture),
-                DriverDataType.UInt16 => Convert.ToUInt16(cell, CultureInfo.InvariantCulture),
-                DriverDataType.UInt32 => Convert.ToUInt32(cell, CultureInfo.InvariantCulture),
-                DriverDataType.UInt64 => Convert.ToUInt64(cell, CultureInfo.InvariantCulture),
-                DriverDataType.Float32 => Convert.ToSingle(cell, CultureInfo.InvariantCulture),
-                // decimal/numeric collapse here, with the documented precision caveat (design §8.6).
-                DriverDataType.Float64 => Convert.ToDouble(cell, CultureInfo.InvariantCulture),
-                DriverDataType.DateTime => ToUtc(cell),
-                _ => Convert.ToString(cell, CultureInfo.InvariantCulture) ?? string.Empty,
-            };
-            return true;
-        }
-        catch (Exception ex) when (ex is InvalidCastException or FormatException
-                                       or OverflowException or ArgumentException)
-        {
-            value = null;
-            return false;
-        }
-    }
-
-    /// <summary>
-    ///     Normalises a timestamp cell to UTC. A naive <c>datetime</c> (no offset — the common SQL Server
-    ///     shape) is <b>assumed</b> to already be UTC rather than reinterpreted through the server's local
-    ///     zone, which would silently shift every source timestamp by the host's offset.
-    /// </summary>
-    private static DateTime ToUtc(object cell) => cell switch
-    {
-        DateTime { Kind: DateTimeKind.Utc } utc => utc,
-        DateTime { Kind: DateTimeKind.Local } local => local.ToUniversalTime(),
-        DateTime unspecified => DateTime.SpecifyKind(unspecified, DateTimeKind.Utc),
-        DateTimeOffset offset => offset.UtcDateTime,
-        string text => DateTime.Parse(
-            text, CultureInfo.InvariantCulture,
-            DateTimeStyles.AssumeUniversal | DateTimeStyles.AdjustToUniversal),
-        _ => DateTime.SpecifyKind(
-            Convert.ToDateTime(cell, CultureInfo.InvariantCulture), DateTimeKind.Utc),
-    };
-
-    /// <summary>Rate-limits the source-contract warning so a misconfigured table cannot flood the log.</summary>
-    private bool ShouldWarnAboutContract()
-    {
-        var now = Stopwatch.GetTimestamp();
-        var last = Interlocked.Read(ref _lastContractWarningTicks);
-        if (last != 0 && Stopwatch.GetElapsedTime(last, now) < ContractWarningInterval) return false;
-        return Interlocked.CompareExchange(ref _lastContractWarningTicks, now, last) == last;
-    }
-
-    /// <summary>One group's outcome: either a materialised result set, or the status its members inherit.</summary>
-    private sealed class GroupResult
-    {
-        private static readonly IReadOnlyList<object?[]> NoRows = [];
-        private static readonly IReadOnlyDictionary<string, int> NoColumns =
-            new Dictionary<string, int>(StringComparer.Ordinal);
-
-        private GroupResult(
-            uint failureStatus,
-            IReadOnlyList<object?[]> rows,
-            IReadOnlyDictionary<string, int> columnIndex,
-            IReadOnlyList<string> typeNames)
-        {
-            FailureStatus = failureStatus;
-            Rows = rows;
-            ColumnIndex = columnIndex;
-            TypeNames = typeNames;
-        }
-
-        /// <summary>The group exceeded its wall-clock deadline (design §8.3).</summary>
-        public static GroupResult TimedOut { get; } =
-            new(SqlStatusCodes.BadTimeout, NoRows, NoColumns, []);
-
-        /// <summary>The connection was fine but the query was not.</summary>
-        public static GroupResult Failed { get; } =
-            new(SqlStatusCodes.BadCommunicationError, NoRows, NoColumns, []);
-
-        /// <summary>The status every member inherits when <see cref="Succeeded"/> is false.</summary>
-        public uint FailureStatus { get; }
-
-        /// <summary>The materialised rows, projected onto the plan's selected columns.</summary>
-        public IReadOnlyList<object?[]> Rows { get; }
-
-        /// <summary>Selected column name → its position within each row array.</summary>
-        public IReadOnlyDictionary<string, int> ColumnIndex { get; }
-
-        /// <summary>Each selected column's provider type name, for dialect type inference.</summary>
-        public IReadOnlyList<string> TypeNames { get; }
-
-        /// <summary>True when the query ran; a zero-row result set is still a success.</summary>
-        public bool Succeeded => FailureStatus == SqlStatusCodes.Good;
-
-        /// <summary>A completed result set.</summary>
-        /// <param name="rows">The materialised rows.</param>
-        /// <param name="columnIndex">Selected column name → row-array position.</param>
-        /// <param name="typeNames">Each selected column's provider type name.</param>
-        /// <returns>A successful outcome.</returns>
-        public static GroupResult Ok(
-            IReadOnlyList<object?[]> rows,
-            IReadOnlyDictionary<string, int> columnIndex,
-            IReadOnlyList<string> typeNames)
-            => new(SqlStatusCodes.Good, rows, columnIndex, typeNames);
-    }
-}
-
-/// <summary>
-///     The OPC UA status codes the Sql driver publishes, and the quality-class predicates its tests read
-///     them back with.
-///     <para><b>Why a driver-local table rather than a shared one.</b> Every driver in this tree carries its
-///     own (<c>TwinCATStatusMapper</c>, <c>AbCipStatusMapper</c>, <c>FocasStatusMapper</c>,
-///     <c>AbLegacyStatusMapper</c>, Galaxy's <c>StatusCodeMap</c>) — there is no shared helper in
-///     <c>Core.Abstractions</c>, because drivers deliberately do not reference the OPC UA SDK and
-///     <see cref="DataValueSnapshot.StatusCode"/> is a bare <see cref="uint"/>. The values below were read
-///     off <c>Opc.Ua.StatusCodes</c> rather than copied from a sibling driver, since two of those tables
-///     carry transcription errors.</para>
-/// </summary>
-public static class SqlStatusCodes
-{
-    /// <summary>The value is good. (<c>Good</c>)</summary>
-    public const uint Good = 0x00000000u;
-
-    /// <summary>Quality is uncertain with no more specific reason — a NULL cell under <c>nullIsBad=false</c>.</summary>
-    public const uint Uncertain = 0x40000000u;
-
-    /// <summary>Quality is bad with no more specific reason — a NULL cell under <c>nullIsBad=true</c>.</summary>
-    public const uint Bad = 0x80000000u;
-
-    /// <summary>
-    ///     No row was returned for this tag — the key is absent from the result set, or the wide-row
-    ///     selector matched nothing. <b>Deliberately distinct from a NULL cell:</b> the row is gone, versus
-    ///     the row is there and the value is not.
-    /// </summary>
-    public const uint BadNoData = 0x809B0000u;
-
-    /// <summary>The group exceeded its client-side wall-clock deadline (design §8.3).</summary>
-    public const uint BadTimeout = 0x800A0000u;
-
-    /// <summary>The reference resolves to no authored tag.</summary>
-    public const uint BadNodeIdUnknown = 0x80340000u;
-
-    /// <summary>The query failed after the connection opened.</summary>
-    public const uint BadCommunicationError = 0x80050000u;
-
-    /// <summary>The cell could not be coerced to the tag's effective data type.</summary>
-    public const uint BadTypeMismatch = 0x80740000u;
-
-    /// <summary>A tag definition the planner rejected — an authoring fault, not a database fault.</summary>
-    public const uint BadConfigurationError = 0x80890000u;
-
-    /// <summary>A defect in the reader itself; never expected in the field.</summary>
-    public const uint BadInternalError = 0x80020000u;
-
-    /// <summary>The quality-class mask — the top two bits of an OPC UA status code.</summary>
-    private const uint SeverityMask = 0xC0000000u;
-
-    /// <summary>True when <paramref name="statusCode"/> is in the Good quality class.</summary>
-    /// <param name="statusCode">The status code to classify.</param>
-    /// <returns>True when the code's severity bits are Good.</returns>
-    public static bool IsGood(uint statusCode) => (statusCode & SeverityMask) == 0u;
-
-    /// <summary>True when <paramref name="statusCode"/> is in the Uncertain quality class.</summary>
-    /// <param name="statusCode">The status code to classify.</param>
-    /// <returns>True when the code's severity bits are Uncertain.</returns>
-    public static bool IsUncertain(uint statusCode) => (statusCode & SeverityMask) == Uncertain;
-
-    /// <summary>True when <paramref name="statusCode"/> is in the Bad quality class.</summary>
-    /// <param name="statusCode">The status code to classify.</param>
-    /// <returns>True when the code's severity bits are Bad.</returns>
-    public static bool IsBad(uint statusCode) => (statusCode & SeverityMask) >= Bad;
-}
@@ -1,90 +0,0 @@
-using System.Data.Common;
-using ZB.MOM.WW.OtOpcUa.Driver.Sql.Contracts;
-
-namespace ZB.MOM.WW.OtOpcUa.Driver.Sql;
-
-/// <summary>
-///     One compiled poll query and the tags it feeds (design §3.6, "group execution shape"). Every tag that
-///     shares a <see cref="GroupKey"/> reads from the <b>same</b> result set, so a poll pass executes one plan
-///     per group rather than one query per tag.
-///     <para><b>Injection boundary.</b> <see cref="SqlText"/> is built from dialect-quoted identifiers only;
-///     every authored <em>value</em> lives in <see cref="Parameters"/> and is bound as a
-///     <see cref="DbParameter"/> named by the positionally-aligned <see cref="ParameterNames"/>. There is no
-///     path by which a tag's <c>keyValue</c> or <c>whereValue</c> reaches the command text.</para>
-///     <para>Produced only by <see cref="SqlGroupPlanner.Plan"/>; consumed by the poll reader, which executes
-///     <see cref="SqlText"/> once and slices the rows back to per-member snapshots.</para>
-/// </summary>
-/// <param name="Model">
-///     The tag→value mapping model every member shares. Determines how the reader slices the result set:
-///     <see cref="SqlTagModel.KeyValue"/> indexes rows by <see cref="KeyColumn"/> and matches each member's
-///     <see cref="SqlTagDefinition.KeyValue"/>; <see cref="SqlTagModel.WideRow"/> takes the single row and
-///     reads each member's <see cref="SqlTagDefinition.ColumnName"/>.
-/// </param>
-/// <param name="GroupKey">
-///     The opaque equality key that decided this grouping — a value tuple, so two plans compare equal exactly
-///     when they would have folded together. Exposed for diagnostics and plan caching, never for parsing.
-/// </param>
-/// <param name="SqlText">The single parameterized statement to execute for this group.</param>
-/// <param name="ParameterNames">
-///     The parameter markers appearing in <see cref="SqlText"/>, in the order they appear, aligned index-for-index
-///     with <see cref="Parameters"/>. Carried explicitly so the reader never has to re-derive the naming
-///     convention.
-/// </param>
-/// <param name="Parameters">
-///     The values to bind, aligned with <see cref="ParameterNames"/>. Captured verbatim from the authored tags
-///     — a hostile value is inert here because it is data, not text.
-/// </param>
-/// <param name="Members">
-///     The tags this plan feeds, in the planner's input order. Never empty. Duplicates are preserved: two tags
-///     may legitimately read the same cell, and both must receive a value.
-/// </param>
-/// <param name="SelectedColumns">
-///     The bare (unquoted) column names in <see cref="SqlText"/>'s SELECT list, in order and distinct — the
-///     reader's map from result-set ordinal to source column.
-/// </param>
-public sealed record SqlQueryPlan(
-    SqlTagModel Model,
-    object GroupKey,
-    string SqlText,
-    IReadOnlyList<string> ParameterNames,
-    IReadOnlyList<object?> Parameters,
-    IReadOnlyList<SqlTagDefinition> Members,
-    IReadOnlyList<string> SelectedColumns)
-{
-    // A plan is documented as safe to cache and reuse across polls, so it must not stay aliased to the
-    // planner's mutable working lists — an IReadOnlyList<T> holding a List<T> is downcastable, and a
-    // mutation would silently corrupt every later poll that reuses the plan. Snapshot at the boundary.
-    /// <summary>The parameter markers in <see cref="SqlText"/>, aligned with <see cref="Parameters"/>.</summary>
-    public IReadOnlyList<string> ParameterNames { get; } = [.. ParameterNames];
-
-    /// <summary>The values to bind, aligned with <see cref="ParameterNames"/>.</summary>
-    public IReadOnlyList<object?> Parameters { get; } = [.. Parameters];
-
-    /// <summary>The tags this plan feeds, in input order; duplicates preserved.</summary>
-    public IReadOnlyList<SqlTagDefinition> Members { get; } = [.. Members];
-
-    /// <summary>The bare SELECT-list column names, in result-set ordinal order.</summary>
-    public IReadOnlyList<string> SelectedColumns { get; } = [.. SelectedColumns];
-
-    /// <summary>
-    ///     The key column all members are matched on — <see langword="null"/> for any model but
-    ///     <see cref="SqlTagModel.KeyValue"/>. Uniform across <see cref="Members"/> by the group-key invariant,
-    ///     so <c>Members[0]</c> is authoritative.
-    /// </summary>
-    public string? KeyColumn => Model == SqlTagModel.KeyValue ? Members[0].KeyColumn : null;
-
-    /// <summary>
-    ///     The column every member's value is read from — <see langword="null"/> for any model but
-    ///     <see cref="SqlTagModel.KeyValue"/>. Uniform across <see cref="Members"/> by the group-key invariant.
-    /// </summary>
-    public string? ValueColumn => Model == SqlTagModel.KeyValue ? Members[0].ValueColumn : null;
-
-    /// <summary>
-    ///     The shared source-timestamp column, or <see langword="null"/> when the group has none (the reader
-    ///     then stamps the poll time). <see cref="SqlTagModel.KeyValue"/> only — it is part of that model's
-    ///     group key, so it is uniform. A <see cref="SqlTagModel.WideRow"/> plan deliberately allows members to
-    ///     carry <em>different</em> timestamp columns (all of them are selected), so the reader must read
-    ///     <see cref="SqlTagDefinition.TimestampColumn"/> per member there.
-    /// </summary>
-    public string? TimestampColumn => Model == SqlTagModel.KeyValue ? Members[0].TimestampColumn : null;
-}
@@ -1,159 +0,0 @@
-using System.Data.Common;
-using System.Globalization;
-using Microsoft.Data.SqlClient;
-using ZB.MOM.WW.OtOpcUa.Core.Abstractions;
-using ZB.MOM.WW.OtOpcUa.Driver.Sql.Contracts;
-
-namespace ZB.MOM.WW.OtOpcUa.Driver.Sql;
-
-/// <summary>
-///     Microsoft SQL Server dialect (design §2.2) — the only provider v1 constructs. Bracket quoting,
-///     <c>INFORMATION_SCHEMA</c> catalog SQL, and the design §3.7 type-family map.
-///     <para>Stateless and immutable, so a single instance is safely shared by the driver's poll reader and
-///     the AdminUI browse session.</para>
-/// </summary>
-public sealed class SqlServerDialect : ISqlDialect
-{
-    /// <summary>
-    ///     T-SQL's regular-identifier ceiling (<c>sysname</c> = <c>nvarchar(128)</c>). Enforced because a
-    ///     longer string cannot name a real catalog object — it is either a config mistake or padding, and
-    ///     rejecting it keeps the quoted output bounded.
-    /// </summary>
-    internal const int MaxIdentifierLength = 128;
-
-    /// <inheritdoc/>
-    public SqlProvider Provider => SqlProvider.SqlServer;
-
-    /// <inheritdoc/>
-    public DbProviderFactory Factory => SqlClientFactory.Instance;
-
-    /// <inheritdoc/>
-    public string LivenessSql => "SELECT 1";
-
-    /// <summary>
-    ///     T-SQL limits after the <c>SELECT</c> keyword, so the whole limit lives in the prefix —
-    ///     <c>"TOP 1 "</c>, trailing space included so <c>SELECT TOP 1 [col]</c> composes with no extra
-    ///     separator at the call site.
-    /// </summary>
-    public string SingleRowLimitPrefix => "TOP 1 ";
-
-    /// <summary>Empty — T-SQL has no trailing row-limit clause (<c>OFFSET/FETCH</c> is a paging construct, not this).</summary>
-    public string SingleRowLimitSuffix => string.Empty;
-
-    /// <inheritdoc/>
-    public string ListSchemasSql =>
-        "SELECT DISTINCT TABLE_SCHEMA FROM INFORMATION_SCHEMA.TABLES ORDER BY TABLE_SCHEMA";
-
-    /// <summary>
-    ///     <c>SCHEMA_NAME()</c> with no argument returns the calling principal's default schema — the one an
-    ///     unqualified object name resolves in, which is precisely the question the catalog gate asks.
-    /// </summary>
-    public string DefaultSchemaSql => "SELECT SCHEMA_NAME()";
-
-    /// <inheritdoc/>
-    public string ListTablesSql =>
-        "SELECT TABLE_NAME, TABLE_TYPE FROM INFORMATION_SCHEMA.TABLES " +
-        "WHERE TABLE_SCHEMA = @schema ORDER BY TABLE_NAME";
-
-    /// <inheritdoc/>
-    public string ListColumnsSql =>
-        "SELECT COLUMN_NAME, DATA_TYPE, IS_NULLABLE FROM INFORMATION_SCHEMA.COLUMNS " +
-        "WHERE TABLE_SCHEMA = @schema AND TABLE_NAME = @table ORDER BY ORDINAL_POSITION";
-
-    /// <summary>
-    ///     Brackets one identifier part, doubling any embedded <c>]</c> — the T-SQL escape rule, and the only
-    ///     metacharacter that could terminate a bracketed identifier early. <c>[</c>, quotes, semicolons and
-    ///     comment markers are inert inside brackets and are therefore passed through unchanged.
-    /// </summary>
-    /// <remarks>
-    ///     <para><b>Rejects</b> (all as <see cref="ArgumentException"/>): null / empty / all-whitespace; longer
-    ///     than <see cref="MaxIdentifierLength"/>; any control character (which covers embedded NUL, and the
-    ///     C0/C1 ranges that can truncate or corrupt a logged/audited statement); and any Unicode
-    ///     <see cref="System.Globalization.UnicodeCategory.Format"/> character — bidi overrides, zero-width
-    ///     spaces, soft hyphen, BOM. Those last cannot escape the brackets, but they spoof the <em>rendered</em>
-    ///     text of a log line or an AdminUI label while comparing byte-different from the real catalog name
-    ///     (the Trojan-Source class, CVE-2021-42574) — the same log/audit-integrity concern that motivates the
-    ///     control-character rule.</para>
-    ///     <para>The rejection messages deliberately do <b>not</b> echo the offending value — it is untrusted
-    ///     input and this exception's text reaches the driver log.</para>
-    ///     <para><b>This is a backstop, not the only defence.</b> Design §8.1's catalog gate
-    ///     (<see cref="SqlCatalogGate"/>) resolves an authored table/column against the live catalog at
-    ///     Initialize and substitutes the catalog's own spelling, so on the poll path the value arriving here
-    ///     is a string read back out of the catalog. The rules below still run — the gate uses them as its own
-    ///     charset filter, and they must hold for any future caller that has no catalog to check against.</para>
-    /// </remarks>
-    /// <param name="ident">The bare, unquoted identifier part.</param>
-    /// <returns>The bracket-quoted identifier.</returns>
-    /// <exception cref="ArgumentException">The value cannot be a valid SQL Server identifier.</exception>
-    public string QuoteIdentifier(string ident)
-    {
-        if (string.IsNullOrWhiteSpace(ident))
-            throw new ArgumentException(
-                "A SQL identifier must be a non-empty, non-whitespace name.", nameof(ident));
-
-        if (ident.Length > MaxIdentifierLength)
-            throw new ArgumentException(
-                $"A SQL Server identifier may not exceed {MaxIdentifierLength} characters (got {ident.Length}).",
-                nameof(ident));
-
-        foreach (var ch in ident)
-        {
-            if (char.IsControl(ch))
-                throw new ArgumentException(
-                    "A SQL identifier may not contain control characters (including NUL).", nameof(ident));
-
-            // Cf is a *separate* category from Cc, so char.IsControl misses every bidi override and
-            // zero-width character. They are inert inside brackets but spoof rendered log/UI text.
-            if (CharUnicodeInfo.GetUnicodeCategory(ch) == UnicodeCategory.Format)
-                throw new ArgumentException(
-                    "A SQL identifier may not contain Unicode format characters "
-                    + "(bidi overrides, zero-width spaces, soft hyphen, BOM).", nameof(ident));
-        }
-
-        return string.Concat("[", ident.Replace("]", "]]", StringComparison.Ordinal), "]");
-    }
-
-    /// <summary>
-    ///     Folds an <c>INFORMATION_SCHEMA.COLUMNS.DATA_TYPE</c> family name onto a
-    ///     <see cref="DriverDataType"/> per design §3.7.
-    /// </summary>
-    /// <remarks>
-    ///     <para><b>Precision caveat:</b> <c>decimal</c> / <c>numeric</c> / <c>money</c> / <c>smallmoney</c>
-    ///     collapse to <see cref="DriverDataType.Float64"/> in v1. A .NET <c>decimal</c> carries more
-    ///     significant digits than a <c>double</c>, so a high-precision column (e.g. <c>decimal(38,10)</c>)
-    ///     loses low-order digits. Authoring an explicit <c>"type": "String"</c> on the tag preserves the exact
-    ///     textual value when that matters.</para>
-    ///     <para><b>Fallback:</b> an unrecognised family maps to <see cref="DriverDataType.String"/> and never
-    ///     throws — a schema browse must render a table containing an exotic column (<c>xml</c>,
-    ///     <c>geography</c>, <c>hierarchyid</c>, <c>sql_variant</c>, a CLR UDT, <c>varbinary</c>) rather than
-    ///     crash on it. Null/blank input takes the same fallback.</para>
-    ///     <para><b>Deliberate non-mappings:</b> SQL Server's <c>timestamp</c>/<c>rowversion</c> is an opaque
-    ///     8-byte row version, <em>not</em> a date — it falls back to <see cref="DriverDataType.String"/>
-    ///     rather than being mistaken for a <see cref="DriverDataType.DateTime"/>. <c>time</c> is a
-    ///     time-of-day span, likewise not a point in time, and takes the same fallback.</para>
-    ///     <para><c>tinyint</c> widens to <see cref="DriverDataType.Int16"/> (it is unsigned 0–255 in T-SQL, so
-    ///     a signed 8-bit type would not hold it, and the driver type set has no <c>Byte</c>).</para>
-    /// </remarks>
-    /// <param name="sqlDataType">The bare SQL type family name; matched case-insensitively.</param>
-    /// <returns>The mapped driver data type, or <see cref="DriverDataType.String"/> when unrecognised.</returns>
-    public DriverDataType MapColumnType(string sqlDataType)
-    {
-        if (string.IsNullOrWhiteSpace(sqlDataType)) return DriverDataType.String;
-
-        return sqlDataType.Trim().ToLowerInvariant() switch
-        {
-            "bit" or "boolean" => DriverDataType.Boolean,
-            "tinyint" or "smallint" => DriverDataType.Int16,
-            "int" or "integer" => DriverDataType.Int32,
-            "bigint" => DriverDataType.Int64,
-            "real" => DriverDataType.Float32,
-            "float" or "double" or "double precision"
-                or "decimal" or "numeric" or "money" or "smallmoney" => DriverDataType.Float64,
-            "char" or "nchar" or "varchar" or "nvarchar" or "text" or "ntext"
-                or "uniqueidentifier" => DriverDataType.String,
-            "date" or "datetime" or "datetime2" or "smalldatetime"
-                or "datetimeoffset" => DriverDataType.DateTime,
-            _ => DriverDataType.String,
-        };
-    }
-}
@@ -1,24 +0,0 @@
-<Project Sdk="Microsoft.NET.Sdk">
-  <PropertyGroup>
-    <TargetFramework>net10.0</TargetFramework>
-    <Nullable>enable</Nullable>
-    <ImplicitUsings>enable</ImplicitUsings>
-    <LangVersion>latest</LangVersion>
-    <TreatWarningsAsErrors>true</TreatWarningsAsErrors>
-    <GenerateDocumentationFile>true</GenerateDocumentationFile>
-    <NoWarn>$(NoWarn);CS1591</NoWarn>
-    <RootNamespace>ZB.MOM.WW.OtOpcUa.Driver.Sql</RootNamespace>
-  </PropertyGroup>
-  <ItemGroup>
-    <ProjectReference Include="..\..\Core\ZB.MOM.WW.OtOpcUa.Core.Abstractions\ZB.MOM.WW.OtOpcUa.Core.Abstractions.csproj"/>
-    <ProjectReference Include="..\..\Core\ZB.MOM.WW.OtOpcUa.Core\ZB.MOM.WW.OtOpcUa.Core.csproj"/>
-    <ProjectReference Include="..\ZB.MOM.WW.OtOpcUa.Driver.Sql.Contracts\ZB.MOM.WW.OtOpcUa.Driver.Sql.Contracts.csproj"/>
-  </ItemGroup>
-  <ItemGroup>
-    <PackageReference Include="Microsoft.Data.SqlClient" />
-    <PackageReference Include="Microsoft.Extensions.Logging.Abstractions" />
-  </ItemGroup>
-  <ItemGroup>
-    <InternalsVisibleTo Include="ZB.MOM.WW.OtOpcUa.Driver.Sql.Tests"/>
-  </ItemGroup>
-</Project>
@@ -19,9 +19,9 @@ public static class TwinCATStatusMapper
    public const uint BadDeviceFailure      = 0x808B0000u;
    public const uint BadCommunicationError = 0x80050000u;
    public const uint BadTimeout            = 0x800A0000u;
-    public const uint BadTypeMismatch       = 0x80740000u;
-    public const uint BadOutOfService       = 0x808D0000u;
-    public const uint BadInvalidState       = 0x80AF0000u;
+    public const uint BadTypeMismatch       = 0x80730000u;
+    public const uint BadOutOfService       = 0x80BE0000u;
+    public const uint BadInvalidState       = 0x80350000u;

    // ---- AdsErrorCode numeric values (confirmed from Beckhoff.TwinCAT.Ads 7.0.172) ----

@@ -81,7 +81,7 @@ else
                                <tr>
                                    <td><span class="mono small">@c.Subject</span></td>
                                    <td><span class="mono small">@c.Issuer</span></td>
-                                    <td><span class="mono small">@DisplayText.Abbreviate(c.Thumbprint, 16)</span></td>
+                                    <td><span class="mono small">@c.Thumbprint[..16]…</span></td>
                                    <td>@c.NotBefore.ToString("u")</td>
                                    <td>@c.NotAfter.ToString("u")</td>
                                    @if (store.Kind is StoreKind.Trusted or StoreKind.Rejected)
@@ -58,7 +58,7 @@ else
            }
            else
            {
-                <div class="kv"><span class="k">Revision</span><span class="v mono">@DisplayText.Abbreviate(_lastDeployment.RevisionHash, 16)</span></div>
+                <div class="kv"><span class="k">Revision</span><span class="v mono">@_lastDeployment.RevisionHash[..16]…</span></div>
                <div class="kv"><span class="k">Status</span><span class="v">@_lastDeployment.Status</span></div>
                <div class="kv"><span class="k">Created</span><span class="v">@_lastDeployment.CreatedAtUtc.ToString("u")</span></div>
                @if (_lastDeployment.SealedAtUtc is not null)
@@ -55,7 +55,7 @@
        {
            <tr>
                <td><code>@Short(d.DeploymentId)</code></td>
-                <td><code>@DisplayText.Abbreviate(d.RevisionHash, 12)</code></td>
+                <td><code>@d.RevisionHash[..12]…</code></td>
                <td>@d.Status</td>
                <td>@d.CreatedBy</td>
                <td>@d.CreatedAtUtc.ToString("u")</td>
@@ -113,7 +113,7 @@
            _lastSuccess = result.Outcome == StartDeploymentOutcome.Accepted;
            _lastMessage = result.Outcome switch
            {
-                StartDeploymentOutcome.Accepted => $"Deployment {Short(result.DeploymentId!.Value.Value)} dispatched (rev {DisplayText.Abbreviate(result.RevisionHash!.Value.Value, 12)}).",
+                StartDeploymentOutcome.Accepted => $"Deployment {Short(result.DeploymentId!.Value.Value)} dispatched (rev {result.RevisionHash!.Value.Value[..12]}…).",
                StartDeploymentOutcome.AnotherDeploymentInFlight => result.Message ?? "Another deployment is already in flight.",
                StartDeploymentOutcome.NoChanges => "No changes detected since the last sealed deployment.",
                _ => result.Message ?? "Deployment rejected.",
@@ -38,7 +38,7 @@ else
                        <span class="mono">@s.ScriptId</span>
                        &middot; <span>@s.Name</span>
                        &middot; <span class="chip chip-idle ms-1">@s.Language</span>
-                        <span class="text-muted small ms-2 mono">hash=@DisplayText.Abbreviate(s.SourceHash, 12)</span>
+                        <span class="text-muted small ms-2 mono">hash=@s.SourceHash[..12]…</span>
                    </summary>
                    <div style="padding:0 1rem 1rem">
                        <div class="d-flex mb-2">
@@ -1,45 +0,0 @@
-namespace ZB.MOM.WW.OtOpcUa.AdminUI.Components.Shared;
-
-/// <summary>
-///     Rendering helpers for operator-facing text that comes out of the database.
-/// </summary>
-/// <remarks>
-///     <para>
-///         <b>Why this exists (#504).</b> Several pages abbreviated a hash / thumbprint with the range
-///         operator — <c>@s.SourceHash[..12]…</c> — which throws
-///         <see cref="ArgumentOutOfRangeException"/> the moment the value is shorter than the slice.
-///         In Blazor that escapes <c>BuildRenderTree</c> unhandled and takes the <b>whole page</b> to an
-///         HTTP 500, not just the offending row. Nothing enforces a minimum length at the schema, the
-///         entity, or the render layer, so any hand-written / seeded / migrated row is a live page-kill.
-///         The docker-dev seed proved it: its placeholder <c>SourceHash</c> values (<c>h1</c>,
-///         <c>h-abs-hr200</c>) made <c>/scripts</c> a hard 500 on every stock bring-up.
-///     </para>
-///     <para>
-///         Use <see cref="Abbreviate"/> for <b>every</b> such prefix. It never throws, and it appends the
-///         ellipsis only when it actually truncated — a 2-character hash renders as <c>h1</c>, not
-///         <c>h1…</c>, so the display never implies more text than exists.
-///     </para>
-/// </remarks>
-public static class DisplayText
-{
-    /// <summary>Placeholder rendered for a null / blank value. Matches the em-dash convention the
-    /// Admin UI already uses for "nothing to show" cells.</summary>
-    public const string Empty = "—";
-
-    /// <summary>
-    ///     The first <paramref name="maxLength"/> characters of <paramref name="value"/>, followed by an
-    ///     ellipsis when (and only when) characters were dropped.
-    /// </summary>
-    /// <param name="value">The value to abbreviate. May be null, blank, or shorter than
-    /// <paramref name="maxLength"/> — none of which throw.</param>
-    /// <param name="maxLength">Maximum number of characters to keep. Values below 1 are treated as 1,
-    /// so a caller cannot turn a display bug into a crash.</param>
-    /// <returns><see cref="Empty"/> for a null/blank value; the value verbatim when it already fits;
-    /// otherwise the truncated prefix plus an ellipsis.</returns>
-    public static string Abbreviate(string? value, int maxLength)
-    {
-        if (string.IsNullOrWhiteSpace(value)) return Empty;
-        if (maxLength < 1) maxLength = 1;
-        return value.Length <= maxLength ? value : string.Concat(value.AsSpan(0, maxLength), "…");
-    }
-}
@@ -57,9 +57,6 @@
                            case DriverTypeNames.Galaxy:
                                <GalaxyDriverForm @bind-DriverConfigJson="_driverConfigJson" @bind-ResilienceConfig="_resilienceConfig" />
                                break;
-                            case DriverTypeNames.Sql:
-                                <SqlDriverForm @bind-DriverConfigJson="_driverConfigJson" @bind-ResilienceConfig="_resilienceConfig" />
-                                break;
                            default:
                                <div class="alert alert-warning">No typed config form for driver type <span class="mono">@_driverType</span>.</div>
                                break;
@@ -36,7 +36,6 @@
                        <option value="Focas">Focas</option>
                        <option value="OpcUaClient">OpcUaClient</option>
                        <option value="GalaxyMxGateway">Galaxy</option>
-                        <option value="Sql">Sql</option>
                    </InputSelect>
                    <div class="form-text">Cannot be changed after creation — drives the actor type that owns this instance.</div>
                </div>
@@ -27,6 +27,16 @@
                    }
                </InputSelect>
            </div>
+            <div class="col-md-3">
+                <label class="form-label">Transport</label>
+                <InputSelect @bind-Value="_form.Transport" @bind-Value:after="EmitAsync" class="form-select form-select-sm">
+                    @foreach (var e in Enum.GetValues<ModbusTransportMode>())
+                    {
+                        <option value="@e">@e</option>
+                    }
+                </InputSelect>
+                <div class="form-text">RtuOverTcp = talk raw RTU frames to a serial→Ethernet gateway; must match the gateway's mode.</div>
+            </div>
            <div class="col-md-3">
                <label class="form-label">MELSEC sub-family</label>
                <InputSelect @bind-Value="_form.MelsecSubFamily" @bind-Value:after="EmitAsync" class="form-select form-select-sm">
@@ -290,6 +300,9 @@
        public ModbusFamily Family { get; set; } = ModbusFamily.Generic;
        public MelsecFamily MelsecSubFamily { get; set; } = MelsecFamily.Q_L_iQR;

+        // Wire transport (Tcp = Modbus/TCP MBAP; RtuOverTcp = RTU framing over a serial→Ethernet gateway)
+        public ModbusTransportMode Transport { get; set; } = ModbusTransportMode.Tcp;
+
        // Transport flags
        public bool AutoReconnect { get; set; } = true;
        public int IdleDisconnectTimeoutSeconds { get; set; } = 0;
@@ -337,6 +350,7 @@
            TimeoutSeconds = (int)o.Timeout.TotalSeconds,
            Family = o.Family,
            MelsecSubFamily = o.MelsecSubFamily,
+            Transport = o.Transport,
            AutoReconnect = o.AutoReconnect,
            IdleDisconnectTimeoutSeconds = o.IdleDisconnectTimeout.HasValue ? (int)o.IdleDisconnectTimeout.Value.TotalSeconds : 0,
            MaxRegistersPerRead = o.MaxRegistersPerRead,
@@ -387,6 +401,7 @@
            MaxReadGap = (ushort)Math.Clamp(MaxReadGap, 0, 65535),
            Family = Family,
            MelsecSubFamily = MelsecSubFamily,
+            Transport = Transport,
            WriteOnChangeOnly = WriteOnChangeOnly,
            AutoReconnect = AutoReconnect,
            KeepAlive = new ModbusKeepAliveOptions
@@ -1,198 +0,0 @@
-@* Embeddable read-only Sql driver (connection/dialect) config form body. There is NO per-device
-   endpoint — the whole database connection is named indirectly by ConnectionStringRef (an env-var name,
-   resolved at Initialize), so no connection string is ever authored into the config. Hosted by
-   DriverConfigModal. Exposes GetConfigJson() for the parent to pull at save time and fires
-   DriverConfigJsonChanged for @bind support. Enums serialize by NAME (JsonStringEnumConverter) so the
-   factory's string-typed deserialize accepts them. *@
-@using System.Text.Json
-@using System.Text.Json.Nodes
-@using System.Text.Json.Serialization
-@using ZB.MOM.WW.OtOpcUa.AdminUI.Components.Shared.Drivers
-@using ZB.MOM.WW.OtOpcUa.Driver.Sql.Contracts
-
-@* Connection *@
-<section class="panel rise mt-3" style="animation-delay:.06s">
-    <div class="panel-head">Database connection</div>
-    <div style="padding:1rem">
-        <div class="row g-3">
-            <div class="col-md-4">
-                <label class="form-label">Provider</label>
-                <InputSelect @bind-Value="_form.Provider" @bind-Value:after="EmitAsync" class="form-select form-select-sm">
-                    @* v1 constructs only SqlServer; the other SqlProvider members are reserved (P2). *@
-                    <option value="@SqlProvider.SqlServer">@SqlProvider.SqlServer</option>
-                </InputSelect>
-                <div class="form-text">Only Microsoft SQL Server is supported in v1.</div>
-            </div>
-            <div class="col-md-8">
-                <label class="form-label">Connection string ref <span class="text-danger">*</span></label>
-                <InputText @bind-Value="_form.ConnectionStringRef" @bind-Value:after="EmitAsync" class="form-control form-control-sm mono"
-                           placeholder="MesStaging" />
-                <div class="form-text">
-                    Name of the <code>Sql__ConnectionStrings__&lt;ref&gt;</code> env var set on the driver + AdminUI hosts —
-                    <strong>not</strong> a connection string. The credential is resolved at startup and never stored in the config.
-                </div>
-                @if (string.IsNullOrWhiteSpace(_form.ConnectionStringRef))
-                {
-                    <div class="text-danger small mt-1">Connection string ref is required.</div>
-                }
-            </div>
-        </div>
-    </div>
-</section>
-
-@* Polling / timeouts *@
-<section class="panel rise mt-3" style="animation-delay:.08s">
-    <div class="panel-head">Polling &amp; timeouts</div>
-    <div style="padding:1rem">
-        <div class="row g-3">
-            <div class="col-md-3">
-                <label class="form-label">Default poll interval (s)</label>
-                <InputNumber @bind-Value="_form.DefaultPollIntervalSeconds" @bind-Value:after="EmitAsync" class="form-control form-control-sm" />
-                <div class="form-text">Blank = factory default. Applied to groups without their own interval.</div>
-            </div>
-            <div class="col-md-3">
-                <label class="form-label">Operation timeout (s)</label>
-                <InputNumber @bind-Value="_form.OperationTimeoutSeconds" @bind-Value:after="EmitAsync" class="form-control form-control-sm" />
-                <div class="form-text">Client-side per-query deadline. Should exceed the command timeout.</div>
-            </div>
-            <div class="col-md-3">
-                <label class="form-label">Command timeout (s)</label>
-                <InputNumber @bind-Value="_form.CommandTimeoutSeconds" @bind-Value:after="EmitAsync" class="form-control form-control-sm" />
-                <div class="form-text">ADO.NET server-side CommandTimeout backstop.</div>
-            </div>
-            <div class="col-md-3">
-                <label class="form-label">Max concurrent groups</label>
-                <InputNumber @bind-Value="_form.MaxConcurrentGroups" @bind-Value:after="EmitAsync" class="form-control form-control-sm" />
-                <div class="form-text">Blank = factory default. Caps concurrent group queries (pool guard).</div>
-            </div>
-        </div>
-    </div>
-</section>
-
-@* Value handling *@
-<section class="panel rise mt-3" style="animation-delay:.10s">
-    <div class="panel-head">Value handling</div>
-    <div style="padding:1rem">
-        <div class="row g-3">
-            <div class="col-md-4">
-                <div class="form-check form-switch mt-2">
-                    <InputCheckbox @bind-Value="_form.NullIsBad" @bind-Value:after="EmitAsync" class="form-check-input" id="sqlNullIsBad" />
-                    <label class="form-check-label" for="sqlNullIsBad">NULL cell publishes Bad</label>
-                </div>
-                <div class="form-text mt-0">Unchecked = factory default (a NULL cell publishes Uncertain).</div>
-            </div>
-            <div class="col-md-4">
-                <div class="form-check form-switch mt-2">
-                    <input type="checkbox" class="form-check-input" id="sqlAllowWrites" disabled checked="false" />
-                    <label class="form-check-label" for="sqlAllowWrites">Allow writes</label>
-                </div>
-                <div class="form-text mt-0">
-                    <span class="badge bg-secondary">Read-only</span> v1 does not implement writes — this flag is inert and is not authored.
-                </div>
-            </div>
-        </div>
-    </div>
-</section>
-
-<DriverResilienceSection ResilienceConfig="@ResilienceConfig" ResilienceConfigChanged="OnResilienceChanged" />
-
-@code {
-    /// <summary>The driver-level DriverConfig JSON (connection/dialect; there is no device endpoint).</summary>
-    [Parameter] public string DriverConfigJson { get; set; } = "{}";
-    /// <summary>Fired (camelCase-serialized) whenever a field changes — enables @bind-DriverConfigJson.</summary>
-    [Parameter] public EventCallback<string> DriverConfigJsonChanged { get; set; }
-    /// <summary>The per-instance resilience-pipeline overrides JSON, or null.</summary>
-    [Parameter] public string? ResilienceConfig { get; set; }
-    /// <summary>Fired when the resilience overrides change.</summary>
-    [Parameter] public EventCallback<string?> ResilienceConfigChanged { get; set; }
-
-    // camelCase + string enums + omit-nulls, matching the factory's JsonStringEnumConverter deserialize.
-    // WhenWritingNull keeps absent optionals out of the blob (absent ⇒ the factory applies its default) and
-    // drops the composer-owned rawTags (never authored here).
-    private static readonly JsonSerializerOptions _jsonOpts = new()
-    {
-        PropertyNamingPolicy = JsonNamingPolicy.CamelCase,
-        UnmappedMemberHandling = JsonUnmappedMemberHandling.Skip,
-        DefaultIgnoreCondition = JsonIgnoreCondition.WhenWritingNull,
-        WriteIndented = false,
-        Converters = { new JsonStringEnumConverter() },
-    };
-
-    private FormModel _form = new();
-    private string? _lastParsed;
-
-    protected override void OnParametersSet()
-    {
-        // Re-parse only when the inbound value actually changed (don't clobber in-progress edits).
-        if (!string.Equals(_lastParsed, DriverConfigJson, StringComparison.Ordinal))
-        {
-            var dto = TryDeserialize(DriverConfigJson) ?? new SqlDriverConfigDto();
-            _form = FormModel.FromDto(dto);
-            _lastParsed = DriverConfigJson;
-        }
-    }
-
-    /// <summary>Serializes the current connection/dialect config to camelCase JSON with enums as NAME strings.
-    /// rawTags is never emitted (the composer adds it at deploy); allowWrites is never emitted (v1 read-only).</summary>
-    public string GetConfigJson() => JsonSerializer.Serialize(_form.ToDto(), _jsonOpts);
-
-    private async Task EmitAsync()
-    {
-        var json = GetConfigJson();
-        _lastParsed = json;
-        await DriverConfigJsonChanged.InvokeAsync(json);
-    }
-
-    private async Task OnResilienceChanged(string? r)
-    {
-        ResilienceConfig = r;
-        await ResilienceConfigChanged.InvokeAsync(r);
-    }
-
-    private static SqlDriverConfigDto? TryDeserialize(string json)
-    {
-        try { return JsonSerializer.Deserialize<SqlDriverConfigDto>(json, _jsonOpts); }
-        catch { return null; }
-    }
-
-    /// <summary>Flat mutable mirror of the driver-level fields of <see cref="SqlDriverConfigDto"/>. TimeSpans are
-    /// edited as nullable whole-second ints (blank ⇒ null ⇒ the factory default). rawTags + allowWrites are not
-    /// mirrored — the composer owns rawTags and v1 is read-only.</summary>
-    public sealed class FormModel
-    {
-        public SqlProvider Provider { get; set; } = SqlProvider.SqlServer;
-        public string? ConnectionStringRef { get; set; }
-        public int? DefaultPollIntervalSeconds { get; set; }
-        public int? OperationTimeoutSeconds { get; set; }
-        public int? CommandTimeoutSeconds { get; set; }
-        public int? MaxConcurrentGroups { get; set; }
-        public bool NullIsBad { get; set; }
-
-        public static FormModel FromDto(SqlDriverConfigDto d) => new()
-        {
-            Provider = d.Provider,
-            ConnectionStringRef = d.ConnectionStringRef,
-            DefaultPollIntervalSeconds = ToSeconds(d.DefaultPollInterval),
-            OperationTimeoutSeconds = ToSeconds(d.OperationTimeout),
-            CommandTimeoutSeconds = ToSeconds(d.CommandTimeout),
-            MaxConcurrentGroups = d.MaxConcurrentGroups,
-            NullIsBad = d.NullIsBad ?? false,
-        };
-
-        public SqlDriverConfigDto ToDto() => new()
-        {
-            Provider = Provider,
-            ConnectionStringRef = string.IsNullOrWhiteSpace(ConnectionStringRef) ? null : ConnectionStringRef.Trim(),
-            DefaultPollInterval = ToTimeSpan(DefaultPollIntervalSeconds),
-            OperationTimeout = ToTimeSpan(OperationTimeoutSeconds),
-            CommandTimeout = ToTimeSpan(CommandTimeoutSeconds),
-            MaxConcurrentGroups = MaxConcurrentGroups,
-            // Emit nullIsBad only when true; unchecked ⇒ null ⇒ the factory default (Uncertain). allowWrites
-            // and rawTags are deliberately left null so they are omitted from the authored blob.
-            NullIsBad = NullIsBad ? true : null,
-        };
-
-        private static int? ToSeconds(TimeSpan? ts) => ts.HasValue ? (int)ts.Value.TotalSeconds : null;
-        private static TimeSpan? ToTimeSpan(int? secs) => secs.HasValue ? TimeSpan.FromSeconds(secs.Value) : null;
-    }
-}
@@ -1,441 +0,0 @@
-@* Sql address picker (read-only v1):
-     1. Manual entry (ALWAYS available): pick the model (KeyValue / WideRow), then fill the
-        table + key/row-selector fields by hand. An operator without DriverOperator, or browsing a
-        server the AdminUI can't reach, authors a tag entirely from these fields.
-     2. (DriverOperator-gated) Live schema browse: schema → table → column tree on the left, the
-        picked column's type in the attribute side-panel on the right. Clicking a column leaf prefills
-        `table`, the value/column field, and the inferred `type`.
-
-   The picker's OUTPUT (CurrentAddress) is the composed per-tag `TagConfig` JSON blob — exactly the
-   shape SqlEquipmentTagParser.TryParse reads (design §5.2 / §5.3). Field names + the string `model`/
-   `type` enums are matched to the parser precisely; a mismatch would author fine and never read.
-
-   Credential hygiene: the optional ad-hoc connection string is SESSION-ONLY. It is merged into the
-   JSON handed to BrowserService.OpenAsync for THIS browse only and is NEVER written into the composed
-   TagConfig blob nor back into the driver config — there is no code path here that persists it. *@
-@implements IAsyncDisposable
-@using System.Text.Json.Nodes
-@using ZB.MOM.WW.OtOpcUa.AdminUI.Browsing
-@using ZB.MOM.WW.OtOpcUa.Commons.Browsing
-@using ZB.MOM.WW.OtOpcUa.Core.Abstractions
-@using ZB.MOM.WW.OtOpcUa.Driver.Sql
-@using ZB.MOM.WW.OtOpcUa.Driver.Sql.Browser
-@inject IBrowserSessionService BrowserService
-@inject AuthenticationStateProvider AuthState
-@inject IAuthorizationService AuthorizationService
-
-<div class="row g-3">
-    <div class="col-md-4">
-        <label class="form-label">Model</label>
-        <select class="form-select form-select-sm" @bind="_model" @bind:after="OnManualChangedAsync">
-            <option value="KeyValue">KeyValue</option>
-            <option value="WideRow">WideRow</option>
-        </select>
-        <div class="form-text">
-            KeyValue: one row per key. WideRow: many columns of one selected row.
-        </div>
-    </div>
-    <div class="col-md-5">
-        <label class="form-label">Table or view</label>
-        <input type="text" class="form-control form-control-sm mono" placeholder="dbo.TagValues"
-               @bind="_table" @bind:after="OnManualChangedAsync" />
-        <div class="form-text">Schema-qualified, e.g. <code>dbo.TagValues</code>.</div>
-    </div>
-    <div class="col-md-3">
-        <label class="form-label">Type</label>
-        <select class="form-select form-select-sm" @bind="_type" @bind:after="OnManualChangedAsync">
-            <option value="">(infer)</option>
-            @foreach (var t in Enum.GetValues<DriverDataType>())
-            {
-                <option value="@t">@t</option>
-            }
-        </select>
-        <div class="form-text">Blank ⇒ inferred from the column.</div>
-    </div>
-</div>
-
-@if (_model == "KeyValue")
-{
-    <div class="row g-3 mt-1">
-        <div class="col-md-4">
-            <label class="form-label">Key column</label>
-            <input type="text" class="form-control form-control-sm mono" placeholder="tag_name"
-                   @bind="_keyColumn" @bind:after="OnManualChangedAsync" />
-        </div>
-        <div class="col-md-4">
-            <label class="form-label">Key value</label>
-            <input type="text" class="form-control form-control-sm mono" placeholder="Line1.Speed"
-                   @bind="_keyValue" @bind:after="OnManualChangedAsync" />
-            <div class="form-text">Bound as a parameter — never interpolated.</div>
-        </div>
-        <div class="col-md-4">
-            <label class="form-label">Value column</label>
-            <input type="text" class="form-control form-control-sm mono" placeholder="num_value"
-                   @bind="_valueColumn" @bind:after="OnManualChangedAsync" />
-        </div>
-    </div>
-}
-else
-{
-    <div class="row g-3 mt-1">
-        <div class="col-md-4">
-            <label class="form-label">Value column</label>
-            <input type="text" class="form-control form-control-sm mono" placeholder="oven_temp"
-                   @bind="_columnName" @bind:after="OnManualChangedAsync" />
-            <div class="form-text">The column this tag reads from the selected row.</div>
-        </div>
-        <div class="col-md-4">
-            <label class="form-label">Row selector</label>
-            <select class="form-select form-select-sm" @bind="_selectorMode" @bind:after="OnManualChangedAsync">
-                <option value="Where">Where column = value</option>
-                <option value="Newest">Newest by timestamp</option>
-            </select>
-        </div>
-        @if (_selectorMode == "Where")
-        {
-            <div class="col-md-2">
-                <label class="form-label">Where column</label>
-                <input type="text" class="form-control form-control-sm mono" placeholder="station_id"
-                       @bind="_whereColumn" @bind:after="OnManualChangedAsync" />
-            </div>
-            <div class="col-md-2">
-                <label class="form-label">Where value</label>
-                <input type="text" class="form-control form-control-sm mono" placeholder="7"
-                       @bind="_whereValue" @bind:after="OnManualChangedAsync" />
-            </div>
-        }
-        else
-        {
-            <div class="col-md-4">
-                <label class="form-label">Order-by (timestamp) column</label>
-                <input type="text" class="form-control form-control-sm mono" placeholder="sample_ts"
-                       @bind="_topByTimestamp" @bind:after="OnManualChangedAsync" />
-            </div>
-        }
-    </div>
-}
-
-<div class="row g-3 mt-1">
-    <div class="col-md-6">
-        <label class="form-label">Timestamp column <span class="text-muted small">(optional)</span></label>
-        <input type="text" class="form-control form-control-sm mono" placeholder="sample_ts"
-               @bind="_timestampColumn" @bind:after="OnManualChangedAsync" />
-        <div class="form-text">Source-timestamp column; blank ⇒ the driver stamps the poll time.</div>
-    </div>
-</div>
-
-@if (_canOperate)
-{
-    <hr class="my-3" />
-    <div class="row g-3">
-        <div class="col-md-12">
-            <label class="form-label small">Ad-hoc connection string <span class="text-muted">(session-only, never saved)</span></label>
-            <input type="password" class="form-control form-control-sm mono" autocomplete="off"
-                   placeholder="Server=…;Database=…;User Id=…;Password=…"
-                   @bind="_adhocConnectionString" />
-            <div class="form-text">
-                Leave blank to browse via the driver's <code>connectionStringRef</code> (resolved from
-                the AdminUI host's <code>Sql__ConnectionStrings__&lt;ref&gt;</code> env var). Paste a
-                literal only for a one-off browse — it is used for this session and never persisted.
-            </div>
-        </div>
-    </div>
-
-    <div class="mt-2 d-flex align-items-center gap-2">
-        @if (_token == Guid.Empty)
-        {
-            <button type="button" class="btn btn-outline-primary btn-sm" disabled="@_opening"
-                    @onclick="OpenBrowseAsync">
-                @if (_opening) { <span class="spinner-border spinner-border-sm me-1"></span> }
-                Browse database
-            </button>
-        }
-        else
-        {
-            <span class="chip chip-ok">Browser open</span>
-            <button type="button" class="btn btn-outline-secondary btn-sm" @onclick="CloseBrowseAsync">Close</button>
-        }
-    </div>
-    @if (_openError is not null)
-    {
-        <div class="text-danger small mt-2">@_openError</div>
-    }
-
-    @if (_token != Guid.Empty)
-    {
-        <div class="row g-3 mt-1">
-            <div class="col-md-7">
-                <label class="form-label small">Schemas → tables → columns</label>
-                <DriverBrowseTree SessionToken="_token" OnNodeSelected="OnTreeSelectAsync"
-                                  SelectedNodeId="@_selectedColumnNodeId" />
-            </div>
-            <div class="col-md-5">
-                <label class="form-label small">Picked column</label>
-                <div class="border rounded p-2" style="max-height:420px; overflow:auto; min-height:240px">
-                    @if (_attrsLoading)
-                    {
-                        <span class="spinner-border spinner-border-sm me-1"></span>
-                    }
-                    else if (_attrsError is not null)
-                    {
-                        <span class="text-danger small">@_attrsError</span>
-                    }
-                    else if (_attrs is null)
-                    {
-                        <span class="text-muted small">Pick a column leaf.</span>
-                    }
-                    else if (_attrs.Count == 0)
-                    {
-                        <span class="text-muted small">Column no longer present.</span>
-                    }
-                    else
-                    {
-                        @foreach (var a in _attrs)
-                        {
-                            <div class="d-flex justify-content-between align-items-center py-1"
-                                 style="cursor:pointer" @onclick="@(() => ApplyAttributeAsync(a))">
-                                <span class="mono small">@a.Name</span>
-                                <span class="text-muted small">@a.DriverDataType · @a.SecurityClass</span>
-                            </div>
-                        }
-                    }
-                </div>
-            </div>
-        </div>
-    }
-}
-
-<div class="mt-3">
-    <span class="text-muted small">TagConfig:</span>
-    <code class="mono ms-2">@(_built.Length == 0 ? "—" : _built)</code>
-</div>
-
-@code {
-    [Parameter] public string CurrentAddress { get; set; } = "";
-    [Parameter] public EventCallback<string> CurrentAddressChanged { get; set; }
-
-    /// <summary>Live accessor for the selected driver's <c>DriverConfig</c> JSON (carries
-    /// <c>connectionStringRef</c> + <c>provider</c>). Fed to <c>BrowserService.OpenAsync("Sql", …)</c>.</summary>
-    [Parameter, EditorRequired] public Func<string> GetConfigJson { get; set; } = () => "{}";
-
-    /// <summary>Fires with the picker's suggested tag display name (<c>table.column</c>) whenever a
-    /// column is picked from the tree, so a host editor may default the raw tag's name. Optional —
-    /// the composed TagConfig blob itself carries no display name (it is not a parser field).</summary>
-    [Parameter] public EventCallback<string> SuggestedDisplayNameChanged { get; set; }
-
-    // Manual/composed tag fields (all editable by hand; browse only prefills a subset).
-    private string _model = "KeyValue";
-    private string _table = "";
-    private string _keyColumn = "";
-    private string _keyValue = "";
-    private string _valueColumn = "";
-    private string _columnName = "";
-    private string _selectorMode = "Where";
-    private string _whereColumn = "";
-    private string _whereValue = "";
-    private string _topByTimestamp = "";
-    private string _timestampColumn = "";
-    private string _type = "";
-
-    // Browse-only, session-scoped state.
-    private string _adhocConnectionString = "";
-    private string _built = "";
-    private string _selectedColumnNodeId = "";
-    private Guid _token = Guid.Empty;
-    private bool _opening;
-    private bool _canOperate;
-    private string? _openError;
-    private bool _attrsLoading;
-    private string? _attrsError;
-    private IReadOnlyList<AttributeInfo>? _attrs;
-
-    protected override async Task OnInitializedAsync()
-    {
-        var auth = await AuthState.GetAuthenticationStateAsync();
-        var authResult = await AuthorizationService.AuthorizeAsync(auth.User, null, AdminUiPolicies.DriverOperator);
-        _canOperate = authResult.Succeeded;
-        _built = Build();
-        await CurrentAddressChanged.InvokeAsync(_built);
-    }
-
-    private async Task OpenBrowseAsync()
-    {
-        _opening = true;
-        _openError = null;
-        StateHasChanged();
-        try
-        {
-            // Merge the ad-hoc literal into the OpenAsync config for THIS session only. The literal is
-            // never written to the composed TagConfig blob nor back to the driver config — this is the
-            // sole place it is read, and it dies with the local variable.
-            var json = BuildBrowseConfig();
-            var result = await BrowserService.OpenAsync(SqlDriver.DriverTypeName, json, default);
-            if (result.Ok) { _token = result.Token; }
-            else { _openError = result.Message; }
-        }
-        finally { _opening = false; StateHasChanged(); }
-    }
-
-    /// <summary>
-    ///     Builds the JSON handed to the browser: the driver config plus, when the operator pasted one,
-    ///     a top-level <c>connectionString</c> literal. The literal wins over any <c>connectionStringRef</c>
-    ///     server-side (SqlDriverBrowser precedence) and is session-only.
-    /// </summary>
-    private string BuildBrowseConfig()
-    {
-        var baseJson = GetConfigJson() ?? "{}";
-        if (string.IsNullOrWhiteSpace(_adhocConnectionString)) { return baseJson; }
-
-        JsonObject o;
-        try { o = JsonNode.Parse(baseJson) as JsonObject ?? new JsonObject(); }
-        catch (System.Text.Json.JsonException) { o = new JsonObject(); }
-        o["connectionString"] = _adhocConnectionString;
-        return o.ToJsonString();
-    }
-
-    private async Task CloseBrowseAsync()
-    {
-        var t = _token;
-        _token = Guid.Empty;
-        _attrs = null;
-        _selectedColumnNodeId = "";
-        StateHasChanged();
-        if (t != Guid.Empty) { await BrowserService.CloseAsync(t); }
-    }
-
-    /// <summary>
-    ///     Handles a tree click. Only a COLUMN leaf commits a prefill; schema/table folder clicks are
-    ///     navigation, not selection. The NodeId is decoded with <see cref="SqlBrowseNodeId.TryParse"/>
-    ///     — never split by hand, because SQL identifiers may contain '.' and '|'.
-    /// </summary>
-    private async Task OnTreeSelectAsync(BrowseNode node)
-    {
-        if (!SqlBrowseNodeId.TryParse(node.NodeId, out var reference)
-            || reference.Kind != SqlBrowseNodeKind.Column)
-        {
-            return;
-        }
-
-        _selectedColumnNodeId = node.NodeId;
-        _table = $"{reference.Schema}.{reference.Table}";
-        if (_model == "WideRow") { _columnName = reference.Column!; }
-        else { _valueColumn = reference.Column!; }
-
-        // Suggested display name uses the BARE table name (the blob's `table` stays schema-qualified).
-        await SuggestedDisplayNameChanged.InvokeAsync($"{reference.Table}.{reference.Column}");
-
-        _attrs = null;
-        _attrsLoading = true;
-        _attrsError = null;
-        StateHasChanged();
-        try
-        {
-            _attrs = await BrowserService.AttributesAsync(_token, node.NodeId, default);
-            var picked = _attrs.Count > 0 ? _attrs[0] : null;
-            if (picked is not null) { PrefillType(picked); }
-        }
-        catch (Exception ex) { _attrsError = ex.Message; }
-        finally
-        {
-            _attrsLoading = false;
-            await OnChangedAsync();
-        }
-    }
-
-    /// <summary>Re-applies the side-panel column's inferred type (and value-column) on click.</summary>
-    private async Task ApplyAttributeAsync(AttributeInfo a)
-    {
-        if (_model == "WideRow") { _columnName = a.Name; }
-        else { _valueColumn = a.Name; }
-        PrefillType(a);
-        await OnChangedAsync();
-    }
-
-    /// <summary>Prefills the type dropdown from the browsed column's mapped DriverDataType, if it maps.</summary>
-    private void PrefillType(AttributeInfo a)
-    {
-        if (Enum.TryParse<DriverDataType>(a.DriverDataType, out _)) { _type = a.DriverDataType; }
-    }
-
-    private async Task OnManualChangedAsync() => await OnChangedAsync();
-
-    private async Task OnChangedAsync()
-    {
-        _built = Build();
-        await CurrentAddressChanged.InvokeAsync(_built);
-    }
-
-    /// <summary>
-    ///     Composes the per-tag TagConfig blob (design §5.2 / §5.3), matched field-for-field to
-    ///     <c>SqlEquipmentTagParser</c>. Returns "" until the selected model's required fields are all
-    ///     present, so the "Use this address" button never commits a half-blob the parser would reject.
-    ///     <c>model</c> and <c>type</c> are written as NAME strings (the parser reads them strictly).
-    /// </summary>
-    private string Build()
-    {
-        var table = _table.Trim();
-        if (table.Length == 0) { return ""; }
-
-        var o = new JsonObject
-        {
-            ["driver"] = "Sql",
-            ["model"] = _model,
-            ["table"] = table,
-        };
-
-        if (_model == "KeyValue")
-        {
-            var keyColumn = _keyColumn.Trim();
-            var valueColumn = _valueColumn.Trim();
-            var keyValue = _keyValue.Trim();
-            if (keyColumn.Length == 0 || valueColumn.Length == 0 || keyValue.Length == 0) { return ""; }
-            o["keyColumn"] = keyColumn;
-            o["keyValue"] = keyValue;
-            o["valueColumn"] = valueColumn;
-        }
-        else // WideRow
-        {
-            var columnName = _columnName.Trim();
-            if (columnName.Length == 0) { return ""; }
-            o["columnName"] = columnName;
-
-            var rowSelector = new JsonObject();
-            if (_selectorMode == "Where")
-            {
-                var whereColumn = _whereColumn.Trim();
-                var whereValue = _whereValue.Trim();
-                if (whereColumn.Length == 0 || whereValue.Length == 0) { return ""; }
-                rowSelector["whereColumn"] = whereColumn;
-                rowSelector["whereValue"] = whereValue;
-            }
-            else // Newest
-            {
-                var topByTimestamp = _topByTimestamp.Trim();
-                if (topByTimestamp.Length == 0) { return ""; }
-                rowSelector["topByTimestamp"] = topByTimestamp;
-            }
-
-            o["rowSelector"] = rowSelector;
-        }
-
-        var timestampColumn = _timestampColumn.Trim();
-        if (timestampColumn.Length > 0) { o["timestampColumn"] = timestampColumn; }
-
-        if (_type.Length > 0) { o["type"] = _type; }
-
-        // v1 is read-only; every SQL tag is non-writable (SecurityClass = ViewOnly server-side).
-        o["writable"] = false;
-
-        return o.ToJsonString();
-    }
-
-    public ValueTask DisposeAsync()
-    {
-        if (_token != Guid.Empty)
-        {
-            // Fire-and-forget — don't block circuit teardown on a slow database.
-            _ = BrowserService.CloseAsync(_token);
-        }
-        return ValueTask.CompletedTask;
-    }
-}
@@ -68,7 +68,6 @@
        ("FOCAS", DriverTypeNames.FOCAS),
        ("OpcUaClient", DriverTypeNames.OpcUaClient),
        ("Galaxy", DriverTypeNames.Galaxy),
-        ("Sql", DriverTypeNames.Sql),
        ("Calculation", "Calculation"),
    ];

@@ -1,211 +0,0 @@
-@* Typed TagConfig editor for the read-only Sql driver. Thin shell over SqlTagConfigModel: every field edit
-   goes model → ToJson → ConfigJsonChanged (the model is the single source of the blob shape + enum-name
-   serialisation; never hand-composed here). The Model dropdown (KeyValue/WideRow) shows the matching field
-   group; the "Build address" picker is the ASSISTED path — every field is also hand-editable. Dispatched
-   from the TagModal via TagConfigEditorMap with the same (ConfigJson/ConfigJsonChanged/DriverType/
-   GetDriverConfigJson) parameter shape every typed editor takes; validation is surfaced centrally by
-   TagConfigValidator (save-gate), exactly as the sibling editors do — no inline validation here. *@
-@using ZB.MOM.WW.OtOpcUa.AdminUI.Uns.TagEditors
-@using ZB.MOM.WW.OtOpcUa.Core.Abstractions
-@using ZB.MOM.WW.OtOpcUa.Driver.Sql.Contracts
-@using ZB.MOM.WW.OtOpcUa.AdminUI.Components.Shared.Drivers
-@using ZB.MOM.WW.OtOpcUa.AdminUI.Components.Shared.Drivers.Pickers
-
-<div class="row g-2">
-    <div class="col-md-4"><label class="form-label">Model</label>
-        <select class="form-select form-select-sm" value="@_m.Model" @onchange="@(e => Update(() => _m.Model = ParseEnum(e.Value, SqlTagModel.KeyValue)))">
-            @* Query is deferred (P3) and rejected by the parser/validator — only offer the two v1 models. *@
-            <option value="@SqlTagModel.KeyValue">KeyValue</option>
-            <option value="@SqlTagModel.WideRow">WideRow</option>
-        </select></div>
-    <div class="col-md-5"><label class="form-label">Table or view</label>
-        <input class="form-control form-control-sm mono" value="@_m.Table" placeholder="dbo.TagValues" @onchange="@(e => Update(() => _m.Table = NullIfBlank(e.Value)))" /></div>
-    <div class="col-md-3"><label class="form-label">Type override</label>
-        <select class="form-select form-select-sm" value="@(_m.Type?.ToString() ?? "")" @onchange="@(e => Update(() => _m.Type = ParseNullableEnum<DriverDataType>(e.Value)))">
-            <option value="">(infer from column)</option>
-            @foreach (var v in Enum.GetValues<DriverDataType>()) { <option value="@v">@v</option> }
-        </select></div>
-</div>
-
-@if (_m.Model == SqlTagModel.KeyValue)
-{
-    <div class="row g-2 mt-1">
-        <div class="col-md-4"><label class="form-label">Key column</label>
-            <input class="form-control form-control-sm mono" value="@_m.KeyColumn" placeholder="tag_name" @onchange="@(e => Update(() => _m.KeyColumn = NullIfBlank(e.Value)))" /></div>
-        <div class="col-md-4"><label class="form-label">Key value</label>
-            <input class="form-control form-control-sm mono" value="@_m.KeyValue" placeholder="Line1.Speed" @onchange="@(e => Update(() => _m.KeyValue = e.Value?.ToString()))" />
-            <div class="form-text">Bound as a parameter — never interpolated.</div></div>
-        <div class="col-md-4"><label class="form-label">Value column</label>
-            <input class="form-control form-control-sm mono" value="@_m.ValueColumn" placeholder="num_value" @onchange="@(e => Update(() => _m.ValueColumn = NullIfBlank(e.Value)))" /></div>
-    </div>
-}
-else
-{
-    <div class="row g-2 mt-1">
-        <div class="col-md-4"><label class="form-label">Value column</label>
-            <input class="form-control form-control-sm mono" value="@_m.ColumnName" placeholder="oven_temp" @onchange="@(e => Update(() => _m.ColumnName = NullIfBlank(e.Value)))" />
-            <div class="form-text">The column this tag reads from the selected row.</div></div>
-        <div class="col-md-4"><label class="form-label">Row selector</label>
-            <select class="form-select form-select-sm" value="@_selectorMode" @onchange="@(e => OnSelectorModeChanged(e.Value?.ToString()))">
-                <option value="Where">Where column = value</option>
-                <option value="Newest">Newest by timestamp</option>
-            </select></div>
-        @if (_selectorMode == "Where")
-        {
-            <div class="col-md-2"><label class="form-label">Where column</label>
-                <input class="form-control form-control-sm mono" value="@_m.RowSelector.WhereColumn" placeholder="station_id" @onchange="@(e => Update(() => _m.RowSelector.WhereColumn = NullIfBlank(e.Value)))" /></div>
-            <div class="col-md-2"><label class="form-label">Where value</label>
-                <input class="form-control form-control-sm mono" value="@_m.RowSelector.WhereValue" placeholder="7" @onchange="@(e => Update(() => _m.RowSelector.WhereValue = e.Value?.ToString()))" /></div>
-        }
-        else
-        {
-            <div class="col-md-4"><label class="form-label">Order-by (timestamp) column</label>
-                <input class="form-control form-control-sm mono" value="@_m.RowSelector.TopByTimestamp" placeholder="sample_ts" @onchange="@(e => Update(() => _m.RowSelector.TopByTimestamp = NullIfBlank(e.Value)))" /></div>
-        }
-    </div>
-}
-
-<div class="row g-2 mt-1">
-    <div class="col-md-6"><label class="form-label">Timestamp column <span class="text-muted small">(optional)</span></label>
-        <input class="form-control form-control-sm mono" value="@_m.TimestampColumn" placeholder="sample_ts" @onchange="@(e => Update(() => _m.TimestampColumn = NullIfBlank(e.Value)))" />
-        <div class="form-text">Source-timestamp column; blank ⇒ the driver stamps the poll time.</div></div>
-    <div class="col-12 mt-1">
-        <button type="button" class="btn btn-sm btn-outline-secondary" @onclick="@(() => _showPicker = true)">Build address</button>
-    </div>
-</div>
-
-@if (_showPicker)
-{
-    <DriverTagPicker @bind-Visible="_showPicker"
-                     Title="Sql tag builder"
-                     CurrentAddress="@_pickerAddress"
-                     OnPickAddress="@OnAddressPicked">
-        <SqlAddressPickerBody CurrentAddress="@_pickerAddress"
-                              CurrentAddressChanged="@((s) => _pickerAddress = s)"
-                              GetConfigJson="@GetDriverConfigJson" />
-    </DriverTagPicker>
-}
-
-@code {
-    /// <summary>The tag's current TagConfig JSON.</summary>
-    [Parameter] public string? ConfigJson { get; set; }
-
-    /// <summary>Raised with the updated TagConfig JSON when the model changes.</summary>
-    [Parameter] public EventCallback<string> ConfigJsonChanged { get; set; }
-
-    /// <summary>DriverType of the selected driver — accepted for dispatch uniformity.</summary>
-    [Parameter] public string DriverType { get; set; } = "";
-
-    /// <summary>Live accessor for the selected driver's DriverConfig JSON (browse connect config).</summary>
-    [Parameter] public Func<string> GetDriverConfigJson { get; set; } = () => "{}";
-
-    private SqlTagConfigModel _m = new();
-    private string? _lastConfigJson;
-    private bool _showPicker;
-    private string _pickerAddress = "";
-
-    // Local UI discriminator for the WideRow row selector (where-pair vs newest-by-timestamp). The model
-    // carries no explicit selector "mode" — it is inferred from which selector fields are populated. Kept in
-    // the editor (not the model) because an operator mid-edit may have BOTH selector fields blank, a state
-    // the mode can't be re-derived from; DeriveSelectorMode only overrides it when the model unambiguously
-    // says otherwise, so switching to "Newest" then round-tripping doesn't snap back to "Where".
-    private string _selectorMode = "Where";
-
-    // Re-parse only when the incoming JSON actually changes, so an unrelated parent re-render (Blazor Server
-    // live-status pushes do this) can't reset the user's in-progress edits (mirrors the other typed editors).
-    protected override void OnParametersSet()
-    {
-        if (ConfigJson == _lastConfigJson) { return; }
-        _lastConfigJson = ConfigJson;
-        _m = SqlTagConfigModel.FromJson(ConfigJson);
-        DeriveSelectorMode();
-    }
-
-    // Sets the row-selector mode from the model ONLY when the populated fields make it unambiguous; leaves
-    // the operator's current choice untouched when both selector fields are blank (an in-progress edit).
-    private void DeriveSelectorMode()
-    {
-        if (!string.IsNullOrWhiteSpace(_m.RowSelector.TopByTimestamp) && string.IsNullOrWhiteSpace(_m.RowSelector.WhereColumn))
-        {
-            _selectorMode = "Newest";
-        }
-        else if (!string.IsNullOrWhiteSpace(_m.RowSelector.WhereColumn))
-        {
-            _selectorMode = "Where";
-        }
-    }
-
-    // TryParse so a bad/empty change value can never throw into the Blazor circuit — it falls back. Reads by
-    // NAME (never an ordinal cast), matching the model's strict name-string serialisation.
-    private static TEnum ParseEnum<TEnum>(object? v, TEnum fallback) where TEnum : struct, Enum
-        => Enum.TryParse<TEnum>(v?.ToString(), out var r) ? r : fallback;
-
-    // "" (the "(infer)" option) ⇒ null; a parseable NAME ⇒ that type; anything else ⇒ null. Enum round-trip
-    // is by name — never an ordinal cast — so the model re-serialises `type` as its strict name string.
-    private static TEnum? ParseNullableEnum<TEnum>(object? v) where TEnum : struct, Enum
-    {
-        var s = v?.ToString();
-        if (string.IsNullOrEmpty(s)) { return null; }
-        return Enum.TryParse<TEnum>(s, out var r) ? r : null;
-    }
-
-    // Identifier fields (table/column names): a blank input means "absent" — store null so ToJson omits the
-    // key. (KeyValue/WhereValue are deliberately NOT run through this: the model treats an empty-string value
-    // as present-and-empty, distinct from absent, so those keep e.Value verbatim.)
-    private static string? NullIfBlank(object? v)
-    {
-        var s = v?.ToString();
-        return string.IsNullOrWhiteSpace(s) ? null : s;
-    }
-
-    private async Task Update(Action apply)
-    {
-        apply();
-        await ConfigJsonChanged.InvokeAsync(_m.ToJson());
-    }
-
-    // The WideRow selector is either a where-pair OR newest-by-timestamp — never both. Clear the fields of
-    // the mode being left so the composed blob carries exactly one selector (a stale where-pair would win
-    // over topByTimestamp at read time, silently overriding the operator's choice).
-    private async Task OnSelectorModeChanged(string? mode)
-    {
-        _selectorMode = mode == "Newest" ? "Newest" : "Where";
-        await Update(() =>
-        {
-            if (_selectorMode == "Newest")
-            {
-                _m.RowSelector.WhereColumn = null;
-                _m.RowSelector.WhereValue = null;
-            }
-            else
-            {
-                _m.RowSelector.TopByTimestamp = null;
-            }
-        });
-    }
-
-    // The Sql picker emits a COMPLETE parser-shaped TagConfig blob (not a single address token like the
-    // other drivers' pickers). Parse it through the model and adopt its mapping fields onto the working
-    // model — mutating _m in place preserves any platform keys already on the tag (e.g. isHistorized) that
-    // the picker never authors.
-    private async Task OnAddressPicked(string blob)
-    {
-        if (string.IsNullOrWhiteSpace(blob)) { return; }
-        var picked = SqlTagConfigModel.FromJson(blob);
-        await Update(() =>
-        {
-            _m.Model = picked.Model;
-            _m.Table = picked.Table;
-            _m.KeyColumn = picked.KeyColumn;
-            _m.KeyValue = picked.KeyValue;
-            _m.ValueColumn = picked.ValueColumn;
-            _m.ColumnName = picked.ColumnName;
-            _m.TimestampColumn = picked.TimestampColumn;
-            _m.Type = picked.Type;
-            _m.RowSelector.WhereColumn = picked.RowSelector.WhereColumn;
-            _m.RowSelector.WhereValue = picked.RowSelector.WhereValue;
-            _m.RowSelector.TopByTimestamp = picked.RowSelector.TopByTimestamp;
-        });
-        DeriveSelectorMode();
-    }
-}
@@ -11,7 +11,6 @@ using ZB.MOM.WW.OtOpcUa.Commons.Browsing;
 using ZB.MOM.WW.OtOpcUa.Core.Abstractions;
 using ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Browser;
 using ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.Browser;
-using ZB.MOM.WW.OtOpcUa.Driver.Sql.Browser;
 using ZB.MOM.WW.Secrets.Ui;

 namespace ZB.MOM.WW.OtOpcUa.AdminUI;
@@ -75,11 +74,6 @@ public static class EndpointRouteBuilderExtensions
        services.AddScoped<RawTagCsvExportReader>();
        services.AddSingleton<IDriverBrowser, OpcUaClientDriverBrowser>();
        services.AddSingleton<IDriverBrowser, GalaxyDriverBrowser>();
-        // Bespoke Sql schema browser (server → schema → table → column). Constructible bare — every
-        // ctor param has a production default. The universal-browser DI line is deliberately NOT added
-        // for Sql: SqlDriver.CanBrowse is false, and this bespoke IDriverBrowser wins by construction
-        // (BrowserSessionService indexes bespoke browsers by DriverType before falling back to universal).
-        services.AddSingleton<IDriverBrowser, SqlDriverBrowser>();
        // Universal Discover-backed fallback browser (Wave 0). IDriverFactory is bound by the
        // fused Host's DriverFactoryBootstrap; a standalone AdminUI has none → NullDriverFactory
        // → CanBrowse false → pickers gracefully stay manual-entry (design §6).
@@ -1,212 +0,0 @@
-using System.Text.Json.Nodes;
-using ZB.MOM.WW.OtOpcUa.Core.Abstractions;
-using ZB.MOM.WW.OtOpcUa.Driver.Sql.Contracts;
-
-namespace ZB.MOM.WW.OtOpcUa.AdminUI.Uns.TagEditors;
-
-/// <summary>
-/// Typed working model for a read-only Sql tag's TagConfig JSON (the driver-specific table/column
-/// mapping; name/writable live on the Tag entity). Mirrors — byte-for-byte on the fields it owns — the
-/// authoritative runtime reader <see cref="SqlEquipmentTagParser.TryParse"/>: the <c>model</c> and
-/// <c>type</c> enums are written as their NAME strings (never numbers), and <see cref="Validate"/>
-/// enforces the same required-field/selector shape the parser accepts. Preserves unrecognised JSON keys
-/// (top-level and inside <c>rowSelector</c>) across a load→save so a future field survives an edit.
-/// </summary>
-public sealed class SqlTagConfigModel
-{
-    /// <summary>Tag→value mapping model. v1 accepts <see cref="SqlTagModel.KeyValue"/> and
-    /// <see cref="SqlTagModel.WideRow"/>; <see cref="SqlTagModel.Query"/> is deferred and rejected.</summary>
-    public SqlTagModel Model { get; set; } = SqlTagModel.KeyValue;
-
-    /// <summary>The table or view to read (e.g. <c>dbo.TagValues</c>). Required for every model.</summary>
-    public string? Table { get; set; }
-
-    /// <summary><see cref="SqlTagModel.KeyValue"/>: the column matched against <see cref="KeyValue"/>.</summary>
-    public string? KeyColumn { get; set; }
-
-    /// <summary><see cref="SqlTagModel.KeyValue"/>: this tag's key value (bound as a parameter at read time).</summary>
-    public string? KeyValue { get; set; }
-
-    /// <summary><see cref="SqlTagModel.KeyValue"/>: the column the value is read from.</summary>
-    public string? ValueColumn { get; set; }
-
-    /// <summary>Optional source-timestamp column; absent ⇒ the driver stamps the poll time. Both models.</summary>
-    public string? TimestampColumn { get; set; }
-
-    /// <summary><see cref="SqlTagModel.WideRow"/>: the column this tag reads from the selected row.</summary>
-    public string? ColumnName { get; set; }
-
-    /// <summary><see cref="SqlTagModel.WideRow"/>: which row to read — a where-pair or newest-by-timestamp.</summary>
-    public SqlRowSelectorModel RowSelector { get; set; } = new();
-
-    /// <summary>Optional explicit OPC UA data type override (the blob's <c>type</c> field). <c>null</c> ⇒ the
-    /// driver infers the type from the result-set column metadata.</summary>
-    public DriverDataType? Type { get; set; }
-
-    private JsonObject _bag = new();
-
-    // The raw offending string when "model"/"type" is present-but-invalid (a typo). Mirrors the parser's
-    // strict-enum reject: absent OR present-non-string ⇒ null (nothing to validate).
-    private string? _invalidModelRaw;
-    private string? _invalidTypeRaw;
-
-    /// <summary>Loads a model from a TagConfig JSON string, defaulting any absent field and retaining every
-    /// original key (so fields this editor doesn't expose survive a load→save).</summary>
-    /// <param name="json">The raw TagConfig JSON string, or <c>null</c> for a new/empty config.</param>
-    /// <returns>The populated <see cref="SqlTagConfigModel"/>.</returns>
-    public static SqlTagConfigModel FromJson(string? json)
-    {
-        var o = TagConfigJson.ParseOrNew(json);
-        var (model, invalidModel) = ReadEnumStrict<SqlTagModel>(o, "model");
-        var (type, invalidType) = ReadEnumStrict<DriverDataType>(o, "type");
-
-        var selectorObj = o.TryGetPropertyValue("rowSelector", out var sn) && sn is JsonObject so ? so : null;
-
-        return new SqlTagConfigModel
-        {
-            Model = model ?? SqlTagModel.KeyValue,
-            Table = TagConfigJson.GetString(o, "table"),
-            KeyColumn = TagConfigJson.GetString(o, "keyColumn"),
-            KeyValue = TagConfigJson.GetString(o, "keyValue"),
-            ValueColumn = TagConfigJson.GetString(o, "valueColumn"),
-            TimestampColumn = TagConfigJson.GetString(o, "timestampColumn"),
-            ColumnName = TagConfigJson.GetString(o, "columnName"),
-            RowSelector = SqlRowSelectorModel.FromJson(selectorObj),
-            Type = type,
-            _bag = o,
-            _invalidModelRaw = invalidModel,
-            _invalidTypeRaw = invalidType,
-        };
-    }
-
-    /// <summary>Serialises this model back to a TagConfig JSON string, writing the exposed fields (enums as
-    /// their name strings) over the preserved key bag. The nested <c>rowSelector</c> object is rebuilt from
-    /// <see cref="RowSelector"/> (preserving its own unknown keys) and omitted entirely when empty.</summary>
-    /// <returns>The serialised TagConfig JSON string.</returns>
-    public string ToJson()
-    {
-        TagConfigJson.Set(_bag, "model", Model);
-        TagConfigJson.Set(_bag, "table", Table);
-        TagConfigJson.Set(_bag, "keyColumn", KeyColumn);
-        TagConfigJson.Set(_bag, "keyValue", KeyValue);
-        TagConfigJson.Set(_bag, "valueColumn", ValueColumn);
-        TagConfigJson.Set(_bag, "timestampColumn", TimestampColumn);
-        TagConfigJson.Set(_bag, "columnName", ColumnName);
-        TagConfigJson.Set(_bag, "type", Type);
-
-        var selector = RowSelector.ToJsonObject();
-        if (selector is null) { _bag.Remove("rowSelector"); }
-        else { _bag["rowSelector"] = selector; }
-
-        return TagConfigJson.Serialize(_bag);
-    }
-
-    /// <summary>Validates the model against the exact accept/reject boundary of
-    /// <see cref="SqlEquipmentTagParser.TryParse"/>. Returns an error message, or <c>null</c> when valid.</summary>
-    /// <returns>An error message describing the validation failure, or <c>null</c> when the model is valid.</returns>
-    public string? Validate()
-    {
-        // Strict enums (mirrors the parser's TryReadEnumStrict): a present-but-invalid string rejects the tag.
-        if (_invalidModelRaw is not null) { return $"model: '{_invalidModelRaw}' is not a valid Sql tag model."; }
-        if (_invalidTypeRaw is not null) { return $"type: '{_invalidTypeRaw}' is not a valid data type."; }
-
-        // Query is design §5.4 / P3 — the parser rejects it; the editor must too.
-        if (Model == SqlTagModel.Query) { return "model 'Query' is deferred (P3) and not supported."; }
-
-        if (string.IsNullOrWhiteSpace(Table)) { return "table is required."; }
-
-        switch (Model)
-        {
-            case SqlTagModel.KeyValue:
-                if (string.IsNullOrWhiteSpace(KeyColumn)) { return "keyColumn is required for a KeyValue tag."; }
-                if (string.IsNullOrWhiteSpace(ValueColumn)) { return "valueColumn is required for a KeyValue tag."; }
-                if (KeyValue is null) { return "keyValue is required for a KeyValue tag."; }
-                return null;
-
-            case SqlTagModel.WideRow:
-                if (string.IsNullOrWhiteSpace(ColumnName)) { return "columnName is required for a WideRow tag."; }
-                // A where-pair needs BOTH whereColumn and whereValue (whereValue may be an empty string, but
-                // must be present) — mirrors the parser's `!blank(whereColumn) && whereValue is not null`.
-                var hasWherePair = !string.IsNullOrWhiteSpace(RowSelector.WhereColumn) && RowSelector.WhereValue is not null;
-                if (!hasWherePair && string.IsNullOrWhiteSpace(RowSelector.TopByTimestamp))
-                {
-                    return "a WideRow tag needs a row selector: a whereColumn/whereValue pair, or topByTimestamp.";
-                }
-                return null;
-
-            default:
-                return "model is not a supported Sql tag model.";
-        }
-    }
-
-    // Reads an enum-valued string field the way the parser's TryReadEnumStrict does: absent OR present-but-
-    // non-string ⇒ (null, null) — nothing to validate; a present string that parses ⇒ (value, null); a
-    // present string that does NOT parse ⇒ (null, offendingString) so Validate can reject it.
-    private static (TEnum? value, string? invalidRaw) ReadEnumStrict<TEnum>(JsonObject o, string name)
-        where TEnum : struct, Enum
-    {
-        if (!o.TryGetPropertyValue(name, out var n) || n is not JsonValue v || !v.TryGetValue<string>(out var s))
-        {
-            return (null, null);
-        }
-        return Enum.TryParse<TEnum>(s, ignoreCase: true, out var parsed) ? (parsed, null) : (null, s);
-    }
-}
-
-/// <summary>
-/// Typed working model for a <see cref="SqlTagModel.WideRow"/> tag's nested <c>rowSelector</c> object.
-/// Holds a where-pair (<see cref="WhereColumn"/>/<see cref="WhereValue"/>) or a newest-by-timestamp
-/// selector (<see cref="TopByTimestamp"/>). Preserves unknown keys inside the selector across load→save.
-/// </summary>
-public sealed class SqlRowSelectorModel
-{
-    /// <summary>The column that picks the row (matched against <see cref="WhereValue"/>).</summary>
-    public string? WhereColumn { get; set; }
-
-    /// <summary>The value <see cref="WhereColumn"/> is matched against (bound as a parameter at read time).
-    /// Captured as text whether the blob authored it as a JSON string or a JSON number/boolean, mirroring
-    /// the parser's scalar read.</summary>
-    public string? WhereValue { get; set; }
-
-    /// <summary>Newest-row selector: the timestamp column to order by (used when no where-pair is authored).</summary>
-    public string? TopByTimestamp { get; set; }
-
-    private JsonObject _bag = new();
-
-    /// <summary>Loads a selector model from the nested <c>rowSelector</c> JSON object (or a fresh empty model
-    /// when the object is absent), retaining any unknown keys.</summary>
-    /// <param name="o">The nested <c>rowSelector</c> object, or <c>null</c> when absent.</param>
-    /// <returns>The populated <see cref="SqlRowSelectorModel"/>.</returns>
-    public static SqlRowSelectorModel FromJson(JsonObject? o)
-    {
-        // Deep-clone so the selector owns an independent node tree (safe to re-attach on ToJson).
-        var bag = o?.DeepClone().AsObject() ?? new JsonObject();
-        return new SqlRowSelectorModel
-        {
-            WhereColumn = TagConfigJson.GetString(bag, "whereColumn"),
-            WhereValue = ReadScalarText(bag, "whereValue"),
-            TopByTimestamp = TagConfigJson.GetString(bag, "topByTimestamp"),
-            _bag = bag,
-        };
-    }
-
-    /// <summary>Rebuilds the nested <c>rowSelector</c> JSON object from the exposed fields over the preserved
-    /// key bag, or returns <c>null</c> when the selector carries nothing (so the parent omits the key).</summary>
-    /// <returns>The <c>rowSelector</c> <see cref="JsonObject"/>, or <c>null</c> when empty.</returns>
-    public JsonObject? ToJsonObject()
-    {
-        var o = _bag.DeepClone().AsObject();
-        TagConfigJson.Set(o, "whereColumn", WhereColumn);
-        TagConfigJson.Set(o, "whereValue", WhereValue);
-        TagConfigJson.Set(o, "topByTimestamp", TopByTimestamp);
-        return o.Count == 0 ? null : o;
-    }
-
-    // Reads a scalar as its textual form: a JSON string yields its contents, a number/boolean yields its raw
-    // token — so an authored whereValue of either shape is captured verbatim (mirrors the parser's ReadScalar).
-    private static string? ReadScalarText(JsonObject o, string name)
-    {
-        if (!o.TryGetPropertyValue(name, out var n) || n is not JsonValue v) { return null; }
-        return v.TryGetValue<string>(out var s) ? s : v.ToJsonString();
-    }
-}
@@ -1,5 +1,4 @@
 using ZB.MOM.WW.OtOpcUa.Core.Abstractions;
-using ZB.MOM.WW.OtOpcUa.Driver.Sql;

 namespace ZB.MOM.WW.OtOpcUa.AdminUI.Uns.TagEditors;

@@ -22,10 +21,6 @@ public static class TagConfigEditorMap
            [DriverTypeNames.FOCAS]       = typeof(Components.Shared.Uns.TagEditors.FocasTagConfigEditor),
            [DriverTypeNames.OpcUaClient] = typeof(Components.Shared.Uns.TagEditors.OpcUaClientTagConfigEditor),
            [DriverTypeNames.Calculation] = typeof(Components.Shared.Uns.TagEditors.CalculationTagConfigEditor),
-            // Keyed off SqlDriver.DriverTypeName (= "Sql") rather than DriverTypeNames.Sql: that shared
-            // constant is deliberately absent until Task 11 wires the factory (DriverTypeNamesGuardTests
-            // asserts bidirectional parity). Task 11 repoints all Sql keys onto DriverTypeNames.Sql.
-            [SqlDriver.DriverTypeName]     = typeof(Components.Shared.Uns.TagEditors.SqlTagConfigEditor),
        };

    /// <summary>Returns the editor component type for a driver type, or null if none is registered.</summary>
@@ -1,5 +1,4 @@
 using ZB.MOM.WW.OtOpcUa.Core.Abstractions;
-using ZB.MOM.WW.OtOpcUa.Driver.Sql;

 namespace ZB.MOM.WW.OtOpcUa.AdminUI.Uns.TagEditors;

@@ -24,8 +23,6 @@ public static class TagConfigValidator
            [DriverTypeNames.FOCAS]       = j => FocasTagConfigModel.FromJson(j).Validate(),
            [DriverTypeNames.OpcUaClient] = j => OpcUaClientTagConfigModel.FromJson(j).Validate(),
            [DriverTypeNames.Calculation] = j => CalculationTagConfigModel.FromJson(j).Validate(),
-            // Keyed off SqlDriver.DriverTypeName (= "Sql") — see the note in TagConfigEditorMap.
-            [SqlDriver.DriverTypeName]     = j => SqlTagConfigModel.FromJson(j).Validate(),
        };

    /// <summary>
@@ -39,10 +39,6 @@
        <ProjectReference Include="..\..\Drivers\ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Contracts\ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Contracts.csproj"/>
        <ProjectReference Include="..\..\Drivers\ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.Browser\ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.Browser.csproj"/>
        <ProjectReference Include="..\..\Drivers\ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Browser\ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Browser.csproj"/>
-        <!-- Sql schema-browse (IDriverBrowser, SqlBrowseNodeId codec, SqlEquipmentTagParser). Pulls
-             Driver.Sql + .Contracts + Microsoft.Data.SqlClient transitively — reviewed/accepted, see
-             the Browser project's own csproj comment (AdminUI already carries SqlClient for ConfigDb). -->
-        <ProjectReference Include="..\..\Drivers\ZB.MOM.WW.OtOpcUa.Driver.Sql.Browser\ZB.MOM.WW.OtOpcUa.Driver.Sql.Browser.csproj"/>
    </ItemGroup>

 </Project>
@@ -18,7 +18,6 @@ using FocasProbe     = Driver.FOCAS.FocasDriverProbe;
 using OpcUaProbe     = Driver.OpcUaClient.OpcUaClientDriverProbe;
 using GalaxyProbe    = Driver.Galaxy.GalaxyDriverProbe;
 using CalculationProbe = Driver.Calculation.CalculationDriverProbe;
-using SqlProbe       = Driver.Sql.SqlDriverProbe;

 /// <summary>
 ///     Wires every cross-platform driver assembly's <c>Register(registry, loggerFactory)</c>
@@ -123,7 +122,6 @@ public static class DriverFactoryBootstrap
        services.TryAddEnumerable(ServiceDescriptor.Singleton<IDriverProbe, OpcUaProbe>());
        services.TryAddEnumerable(ServiceDescriptor.Singleton<IDriverProbe, GalaxyProbe>());
        services.TryAddEnumerable(ServiceDescriptor.Singleton<IDriverProbe, CalculationProbe>());
-        services.TryAddEnumerable(ServiceDescriptor.Singleton<IDriverProbe, SqlProbe>());

        return services;
    }
@@ -148,7 +146,6 @@ public static class DriverFactoryBootstrap
        Driver.Modbus.ModbusDriverFactoryExtensions.Register(registry, loggerFactory);
        Driver.OpcUaClient.OpcUaClientDriverFactoryExtensions.Register(registry, loggerFactory, secretResolver);
        Driver.S7.S7DriverFactoryExtensions.Register(registry);
-        Driver.Sql.SqlDriverFactoryExtensions.Register(registry, loggerFactory);
        Driver.TwinCAT.TwinCATDriverFactoryExtensions.Register(registry);
    }
 }
@@ -76,7 +76,6 @@
        <ProjectReference Include="..\..\Drivers\ZB.MOM.WW.OtOpcUa.Driver.Modbus\ZB.MOM.WW.OtOpcUa.Driver.Modbus.csproj"/>
        <ProjectReference Include="..\..\Drivers\ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient\ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.csproj"/>
        <ProjectReference Include="..\..\Drivers\ZB.MOM.WW.OtOpcUa.Driver.S7\ZB.MOM.WW.OtOpcUa.Driver.S7.csproj"/>
-        <ProjectReference Include="..\..\Drivers\ZB.MOM.WW.OtOpcUa.Driver.Sql\ZB.MOM.WW.OtOpcUa.Driver.Sql.csproj"/>
        <ProjectReference Include="..\..\Drivers\ZB.MOM.WW.OtOpcUa.Driver.TwinCAT\ZB.MOM.WW.OtOpcUa.Driver.TwinCAT.csproj"/>
    </ItemGroup>

@@ -288,101 +288,8 @@ public sealed class ScriptedAlarmHostActor : ReceiveActor
        // so a re-Apply with a fresh union simply supersedes the old one — no explicit unregister needed.
        _mux?.Tell(new DependencyMuxActor.RegisterInterest(msg.DepRefs, Self));
        _log.Debug("ScriptedAlarmHost: loaded; registered mux interest for {Count} dep refs", msg.DepRefs.Count);
-
-        ReassertConditionNodes();
    }

-    /// <summary>
-    ///     #487 — re-project every loaded alarm that is NOT in the Part 9 "no-event" position back onto
-    ///     its condition node, right after a (re)load.
-    ///
-    ///     <para>
-    ///         <b>The bug this closes.</b> A deploy that triggers a FULL address-space rebuild clears
-    ///         <c>_alarmConditions</c> and re-materialises every condition node fresh — inactive, acked,
-    ///         confirmed, unshelved. The engine, meanwhile, restores each alarm's persisted state and
-    ///         re-derives Active from the predicate, so a still-active alarm ends the reload
-    ///         <i>correctly Active in the engine</i> but produces <see cref="EmissionKind.None"/> (there
-    ///         is no transition to report) — and <see cref="OnEngineEmission"/> drops None. Nothing then
-    ///         writes the node, so an active alarm with static dependencies reads NORMAL to every OPC UA
-    ///         client until its next real transition, which may never come. Same shape as the VirtualTag
-    ///         redeploy-reset the <c>ReassertValue</c> fix closed.
-    ///     </para>
-    ///
-    ///     <para>
-    ///         <b>Node-only, by construction.</b> This sends <see cref="OpcUaPublishActor.AlarmStateUpdate"/>
-    ///         and nothing else — it never publishes to the <c>alerts</c> topic and never touches the
-    ///         telemetry hub. That is the whole reason it reads <see cref="ScriptedAlarmEngine.GetProjections"/>
-    ///         (a plain read returning <see cref="ScriptedAlarmProjection"/>) rather than re-emitting: an
-    ///         <c>alerts</c> row per alarm per deploy would append a duplicate historian / AVEVA record
-    ///         every time anyone deploys — the alarm analogue of the VirtualTag M1 historian issue.
-    ///     </para>
-    ///
-    ///     <para>
-    ///         <b>Ordering.</b> <c>DriverHostActor</c> Tells <c>RebuildAddressSpace</c> to the publish
-    ///         actor BEFORE it Tells <see cref="ApplyScriptedAlarms"/> here, and this runs later still —
-    ///         after an <c>await</c>ed <see cref="ScriptedAlarmEngine.LoadAsync"/> pipes back. Both Tells
-    ///         enqueue synchronously into the publish actor's local mailbox, so the re-materialise is
-    ///         already queued ahead of these writes: the node exists by the time they are handled.
-    ///     </para>
-    ///
-    ///     <para>
-    ///         <b>Why only non-normal alarms.</b> An alarm sitting in the no-event position already
-    ///         matches what the materialise just built, so writing it would be a pure no-op on state —
-    ///         but it would still overwrite the node's Message (the materialise seeds it with the alarm's
-    ///         display name; a projection carries the resolved template). Skipping them keeps a
-    ///         never-fired alarm byte-identical to a deploy without this pass, and keeps the write count
-    ///         at zero on the overwhelmingly common all-normal deploy.
-    ///     </para>
-    ///
-    ///     <para>
-    ///         <b>Duplicate events.</b> None. <c>WriteAlarmCondition</c>'s delta-gate compares the
-    ///         incoming snapshot against the node's CURRENT state, so a re-assert onto a freshly
-    ///         materialised (normal) node is a genuine delta and fires one Part 9 event — correct, since
-    ///         the rebuild reset what clients see — while a re-assert onto a surgically-preserved node
-    ///         that already holds the same state is suppressed. This write is ungated by redundancy role,
-    ///         like every other node write here: the Secondary keeps its address space warm for failover.
-    ///     </para>
-    /// </summary>
-    private void ReassertConditionNodes()
-    {
-        var reasserted = 0;
-        foreach (var projection in _engine.GetProjections())
-        {
-            if (IsInNoEventPosition(projection.Condition))
-            {
-                continue;
-            }
-
-            _publishActor.Tell(new OpcUaPublishActor.AlarmStateUpdate(
-                AlarmNodeId: projection.AlarmId,
-                State: ToSnapshot(projection),
-                // The instant the state we are re-asserting actually came about — NOT the deploy time.
-                // A client reading Time/ReceiveTime after a rebuild should still see when the alarm went
-                // active, not when the address space happened to be rebuilt.
-                TimestampUtc: projection.Condition.LastTransitionUtc,
-                Realm: AddressSpaceRealm.Uns));
-            reasserted++;
-        }
-
-        if (reasserted > 0)
-        {
-            _log.Info("ScriptedAlarmHost: re-asserted {Count} non-normal condition node(s) after (re)load", reasserted);
-        }
-    }
-
-    /// <summary>Whether <paramref name="condition"/> sits in the Part 9 "no-event" position — exactly the
-    /// state <see cref="AlarmConditionState.Fresh"/> produces and a freshly materialised condition node
-    /// already carries. Anything else (active, unacknowledged, unconfirmed, disabled, or shelved) is state
-    /// a rebuild would silently lose, so it is what <see cref="ReassertConditionNodes"/> re-projects.</summary>
-    /// <param name="condition">The engine's current condition state.</param>
-    /// <returns><c>true</c> when the condition carries nothing a rebuild could lose.</returns>
-    private static bool IsInNoEventPosition(AlarmConditionState condition)
-        => condition.Enabled == AlarmEnabledState.Enabled
-           && condition.Active == AlarmActiveState.Inactive
-           && condition.Acked == AlarmAckedState.Acknowledged
-           && condition.Confirmed == AlarmConfirmedState.Confirmed
-           && condition.Shelving.Kind == ShelvingKind.Unshelved;
-
    private void OnDependencyChanged(VirtualTagActor.DependencyValueChanged msg)
    {
        // Feed the live value into the upstream the engine subscribes from. #478 — carry the source
@@ -687,38 +594,18 @@ public sealed class ScriptedAlarmHostActor : ReceiveActor
    /// Severity is the OPC UA 1..1000 value <see cref="SeverityToInt"/> derives from the coarse engine
    /// bucket, cast to the <c>ushort</c> the SDK <c>SetSeverity</c> expects. Shelving's 3-way Core kind
    /// maps 1:1 onto the Commons <see cref="AlarmShelvingKind"/>.</summary>
-    private static AlarmConditionSnapshot ToSnapshot(ScriptedAlarmEvent e)
-        => ToSnapshot(e.Condition, e.Severity, e.Message, e.WorstInputStatusCode);
-
-    /// <summary>#487 — the same projection for a <see cref="ScriptedAlarmProjection"/>: a state READ used
-    /// to restore a condition node after a rebuild, never an emission. Shares
-    /// <see cref="ToSnapshot(AlarmConditionState, AlarmSeverity, string, uint)"/> with the transition path
-    /// so a re-asserted node is byte-identical to what the alarm's own transition would have written.</summary>
-    /// <param name="p">The engine projection to map.</param>
-    /// <returns>The Commons snapshot the SDK sink projects onto the condition node.</returns>
-    private static AlarmConditionSnapshot ToSnapshot(ScriptedAlarmProjection p)
-        => ToSnapshot(p.Condition, p.Severity, p.Message, p.WorstInputStatusCode);
-
-    /// <summary>The single Core → Commons condition projection, shared by the emission and re-assert
-    /// paths.</summary>
-    /// <param name="condition">The Part 9 condition state.</param>
-    /// <param name="severity">The engine's coarse severity bucket.</param>
-    /// <param name="message">The resolved condition message.</param>
-    /// <param name="worstInputStatusCode">The worst OPC UA StatusCode across the script's input tags.</param>
-    /// <returns>The Commons snapshot the SDK sink projects onto the condition node.</returns>
-    private static AlarmConditionSnapshot ToSnapshot(
-        AlarmConditionState condition, AlarmSeverity severity, string message, uint worstInputStatusCode) => new(
-        Active: condition.Active == AlarmActiveState.Active,
-        Acknowledged: condition.Acked == AlarmAckedState.Acknowledged,
-        Confirmed: condition.Confirmed == AlarmConfirmedState.Confirmed,
-        Enabled: condition.Enabled == AlarmEnabledState.Enabled,
-        Shelving: MapShelving(condition.Shelving.Kind),
-        Severity: (ushort)SeverityToInt(severity),
-        Message: message,
+    private static AlarmConditionSnapshot ToSnapshot(ScriptedAlarmEvent e) => new(
+        Active: e.Condition.Active == AlarmActiveState.Active,
+        Acknowledged: e.Condition.Acked == AlarmAckedState.Acknowledged,
+        Confirmed: e.Condition.Confirmed == AlarmConfirmedState.Confirmed,
+        Enabled: e.Condition.Enabled == AlarmEnabledState.Enabled,
+        Shelving: MapShelving(e.Condition.Shelving.Kind),
+        Severity: (ushort)SeverityToInt(e.Severity),
+        Message: e.Message,
        // #478 — the condition's Quality is the worst quality across the script's input tags at evaluation
        // time (carried on the event by the engine). A transition fired while an input is Uncertain projects
        // Uncertain here so the full-snapshot write doesn't clobber quality back to Good.
-        Quality: QualityFromStatus(worstInputStatusCode));
+        Quality: QualityFromStatus(e.WorstInputStatusCode));

    /// <summary>Maps the Core <see cref="ShelvingKind"/> onto the Commons <see cref="AlarmShelvingKind"/>
    /// mirror (the Commons assembly can't see the Core enum).</summary>
@@ -1,173 +0,0 @@
-using Shouldly;
-using Xunit;
-using ZB.MOM.WW.OtOpcUa.Configuration.Entities;
-using ZB.MOM.WW.OtOpcUa.Configuration.Validation;
-
-namespace ZB.MOM.WW.OtOpcUa.Configuration.Tests;
-
-/// <summary>
-///     The Gitea #498 deploy gate: a <c>Sql</c> driver's persisted config may never carry a literal
-///     <c>connectionString</c>. The typed DTO already drops the key on <em>read</em>; these pin the
-///     <em>write</em> side, which is where a credential would actually land in the config database.
-/// </summary>
-[Trait("Category", "Unit")]
-public sealed class DraftValidatorSqlSecretTests
-{
-    private const string Code = "SqlConnectionStringPersisted";
-
-    /// <summary>A realistic leak: the literal an operator would paste into a raw-JSON config textarea.</summary>
-    private const string LeakedConfig =
-        """{"provider":"SqlServer","connectionString":"Server=sql,1433;Database=Mes;User ID=sa;Password=hunter2"}""";
-
-    private static DriverInstance SqlDriver(string config) => new()
-    {
-        DriverInstanceId = "di-sql", ClusterId = "c", Name = "line3-sql",
-        DriverType = "Sql", DriverConfig = config,
-    };
-
-    private static Device Device(string driverInstanceId, string config) => new()
-    {
-        DeviceId = "dev-1", DriverInstanceId = driverInstanceId, Name = "Device1", DeviceConfig = config,
-    };
-
-    private static DraftSnapshot Draft(DriverInstance driver, Device? device = null) => new()
-    {
-        GenerationId = 1,
-        ClusterId = "c",
-        DriverInstances = [driver],
-        Devices = device is null ? [] : [device],
-    };
-
-    [Fact]
-    public void Literal_connectionString_in_DriverConfig_is_a_deploy_error()
-    {
-        var errors = DraftValidator.Validate(Draft(SqlDriver(LeakedConfig)));
-
-        errors.ShouldContain(e => e.Code == Code && e.Context == "di-sql");
-    }
-
-    /// <summary>
-    ///     The error text reaches the AdminUI, the deploy log and the audit trail, so it must describe the
-    ///     problem without repeating the credential it is refusing to store.
-    /// </summary>
-    [Fact]
-    public void Error_message_does_not_echo_the_credential()
-    {
-        var error = DraftValidator.Validate(Draft(SqlDriver(LeakedConfig))).First(e => e.Code == Code);
-
-        error.Message.ShouldNotContain("hunter2");
-        error.Message.ShouldNotContain("Server=sql,1433");
-        error.Message.ShouldContain("connectionStringRef");
-    }
-
-    /// <summary>
-    ///     System.Text.Json binds <c>ConnectionString</c> to a <c>connectionString</c> property by default, so
-    ///     a case variant is the same key — matching it ordinally would leave the obvious bypass wide open.
-    /// </summary>
-    [Theory]
-    [InlineData("ConnectionString")]
-    [InlineData("CONNECTIONSTRING")]
-    [InlineData("connectionstring")]
-    public void Key_match_is_case_insensitive(string key)
-    {
-        var config = $$"""{"provider":"SqlServer","{{key}}":"Server=s;Password=p"}""";
-
-        DraftValidator.Validate(Draft(SqlDriver(config)))
-            .ShouldContain(e => e.Code == Code && e.Context == "di-sql");
-    }
-
-    /// <summary>
-    ///     DeviceConfig is merged onto DriverConfig before the driver's DTO sees it, so a credential pasted
-    ///     there is the identical leak and must fail the same way.
-    /// </summary>
-    [Fact]
-    public void Literal_connectionString_in_a_Sql_devices_DeviceConfig_is_a_deploy_error()
-    {
-        var draft = Draft(SqlDriver("""{"connectionStringRef":"DevSql"}"""), Device("di-sql", LeakedConfig));
-
-        DraftValidator.Validate(draft).ShouldContain(e => e.Code == Code && e.Context == "dev-1");
-    }
-
-    [Fact]
-    public void A_properly_authored_connectionStringRef_passes()
-    {
-        var draft = Draft(
-            SqlDriver("""{"provider":"SqlServer","connectionStringRef":"DevSql","nullIsBad":true}"""),
-            Device("di-sql", """{"pollIntervalMs":1000}"""));
-
-        DraftValidator.Validate(draft).ShouldNotContain(e => e.Code == Code);
-    }
-
-    /// <summary>
-    ///     The rule is scoped to the Sql driver type. A non-Sql driver is not in its remit — widening the gate
-    ///     to every driver is a separate decision, and silently failing an unrelated driver's deploy here would
-    ///     be a regression, not defence in depth.
-    /// </summary>
-    [Fact]
-    public void A_non_Sql_driver_carrying_the_key_is_not_flagged_by_this_rule()
-    {
-        var modbus = new DriverInstance
-        {
-            DriverInstanceId = "di-mb", ClusterId = "c", Name = "mb",
-            DriverType = "Modbus", DriverConfig = LeakedConfig,
-        };
-
-        DraftValidator.Validate(Draft(modbus)).ShouldNotContain(e => e.Code == Code);
-    }
-
-    /// <summary>
-    ///     A device under a <em>different</em> driver must not be attributed to the Sql instance — the device
-    ///     scan keys off DriverInstanceId, and getting that wrong would flag innocent devices.
-    /// </summary>
-    [Fact]
-    public void A_device_under_a_non_Sql_driver_is_not_flagged()
-    {
-        var draft = new DraftSnapshot
-        {
-            GenerationId = 1,
-            ClusterId = "c",
-            DriverInstances =
-            [
-                SqlDriver("""{"connectionStringRef":"DevSql"}"""),
-                new DriverInstance
-                {
-                    DriverInstanceId = "di-mb", ClusterId = "c", Name = "mb",
-                    DriverType = "Modbus", DriverConfig = "{}",
-                },
-            ],
-            Devices = [Device("di-mb", LeakedConfig)],
-        };
-
-        DraftValidator.Validate(draft).ShouldNotContain(e => e.Code == Code);
-    }
-
-    /// <summary>
-    ///     Malformed or non-object config must not throw out of the validator: shaping the JSON is another
-    ///     rule's job, and a parse failure here would take down every other check in the same pass.
-    /// </summary>
-    [Theory]
-    [InlineData("")]
-    [InlineData("   ")]
-    [InlineData("not json at all")]
-    [InlineData("[1,2,3]")]
-    [InlineData("\"connectionString\"")]
-    [InlineData("{\"provider\":\"SqlServer\"")]
-    public void Malformed_config_neither_throws_nor_flags(string config)
-    {
-        Should.NotThrow(() => DraftValidator.Validate(Draft(SqlDriver(config))))
-            .ShouldNotContain(e => e.Code == Code);
-    }
-
-    /// <summary>
-    ///     Only the top level is scanned. The DTO is flat, so a nested occurrence cannot bind to anything and
-    ///     is not the credential-shaped mistake this rule exists to catch; flagging it would be a false
-    ///     positive on, say, a tag blob that happens to describe a connection string.
-    /// </summary>
-    [Fact]
-    public void A_nested_connectionString_is_not_flagged()
-    {
-        var config = """{"connectionStringRef":"DevSql","notes":{"connectionString":"documented elsewhere"}}""";
-
-        DraftValidator.Validate(Draft(SqlDriver(config))).ShouldNotContain(e => e.Code == Code);
-    }
-}
@@ -1,160 +0,0 @@
-using System.Reflection;
-using Shouldly;
-using Xunit;
-
-namespace ZB.MOM.WW.OtOpcUa.Core.Abstractions.Tests;
-
-/// <summary>
-///     Guards every driver's hard-coded OPC UA status-code constant against
-///     <see cref="Opc.Ua.StatusCodes"/> — the pinned SDK is the oracle, and a constant whose
-///     <em>name</em> disagrees with its <em>value</em> fails here.
-///     <para><b>Why the drivers hard-code these at all.</b> The driver layer is deliberately SDK-free: a
-///     driver assembly must not drag in the OPC UA stack just to spell a status code, so each one declares
-///     the handful it needs as bare <c>uint</c> literals. That is a sound layering decision with one
-///     failure mode — nothing checks the literal against the name — and it is exactly the failure mode
-///     Gitea #497 found in six places across four drivers.</para>
-///     <para><b>Discovery is reflection-driven, not a hand-copied list</b> (the same convention
-///     <see cref="DriverTypeNamesGuardTests"/> uses): the test scans every
-///     <c>ZB.MOM.WW.OtOpcUa.Driver.*.dll</c> deployed to its output directory for <c>const uint</c> fields
-///     whose name reads as a status code, so a brand-new driver assembly referenced by this project is
-///     covered automatically, with no edit here.</para>
-///     <para><b>An inline literal is invisible to this guard.</b> Reflection can only see a <em>named</em>
-///     constant, so <c>StatusCode: 0x800B0000u, // BadTimeout</c> written at a call site is unguarded —
-///     which is how <c>GalaxyDriver</c> shipped <c>BadServiceUnsupported</c> under a <c>BadTimeout</c>
-///     comment. Hoist a status literal into a named constant rather than writing it at the call site.</para>
-/// </summary>
-public sealed class StatusCodeParityTests
-{
-    /// <summary>
-    ///     Name prefixes that mark a <c>uint</c> constant as an OPC UA status code. These are the three
-    ///     Part 4 severity categories, so they cover the whole space by construction — a status constant
-    ///     that does not start with one of them is not a status constant.
-    /// </summary>
-    private static readonly string[] StatusPrefixes = ["Good", "Uncertain", "Bad"];
-
-    /// <summary>
-    ///     Field-name prefixes stripped before the name is looked up on <see cref="Opc.Ua.StatusCodes"/>.
-    ///     Drivers vary the spelling (<c>SampleMapper.StatusBadNoData</c> vs
-    ///     <c>SqlStatusCodes.BadTimeout</c>); the SDK member is <c>BadNoData</c> either way.
-    /// </summary>
-    private static readonly string[] NamePrefixesToStrip = ["Status"];
-
-    /// <summary>Every <c>Opc.Ua.StatusCodes</c> member, by name — the oracle this test checks against.</summary>
-    private static readonly IReadOnlyDictionary<string, uint> SdkStatusCodes =
-        typeof(Opc.Ua.StatusCodes)
-            .GetFields(BindingFlags.Public | BindingFlags.Static)
-            .Where(f => f.IsLiteral && f.FieldType == typeof(uint))
-            .ToDictionary(f => f.Name, f => (uint)f.GetRawConstantValue()!, StringComparer.Ordinal);
-
-    /// <summary>
-    ///     Every status-shaped <c>const uint</c> declared anywhere in the deployed driver assemblies, as
-    ///     <c>(assembly, declaring type, field name, SDK member name, declared value)</c>.
-    /// </summary>
-    /// <remarks>
-    ///     Non-public types and fields are included on purpose — <c>SampleMapper.StatusBadNoData</c> is a
-    ///     <c>private const</c> on an <c>internal</c> class, and it carried one of the #497 defects. Access
-    ///     modifiers say nothing about whether a value reaches an OPC UA client.
-    /// </remarks>
-    public static TheoryData<string, string, string, string, uint> DeclaredStatusConstants()
-    {
-        var data = new TheoryData<string, string, string, string, uint>();
-
-        var binDir = Path.GetDirectoryName(typeof(StatusCodeParityTests).Assembly.Location)!;
-        foreach (var dll in Directory.GetFiles(binDir, "ZB.MOM.WW.OtOpcUa.Driver.*.dll").OrderBy(p => p, StringComparer.Ordinal))
-        {
-            Assembly asm;
-            try { asm = Assembly.LoadFrom(dll); }
-            catch { continue; }
-
-            Type?[] types;
-            try { types = asm.GetTypes(); }
-            catch (ReflectionTypeLoadException ex) { types = ex.Types; }
-
-            foreach (var type in types)
-            {
-                if (type is null) continue;
-
-                var fields = type.GetFields(
-                    BindingFlags.Public | BindingFlags.NonPublic | BindingFlags.Static | BindingFlags.DeclaredOnly);
-
-                foreach (var field in fields)
-                {
-                    if (!field.IsLiteral || field.IsInitOnly || field.FieldType != typeof(uint)) continue;
-
-                    var sdkName = StripKnownPrefix(field.Name);
-                    if (!StatusPrefixes.Any(p => sdkName.StartsWith(p, StringComparison.Ordinal))) continue;
-
-                    data.Add(
-                        asm.GetName().Name!,
-                        type.FullName ?? type.Name,
-                        field.Name,
-                        sdkName,
-                        (uint)field.GetRawConstantValue()!);
-                }
-            }
-        }
-
-        return data;
-    }
-
-    /// <summary>Removes a leading <c>Status</c>-style prefix so the remainder can be looked up on the SDK type.</summary>
-    private static string StripKnownPrefix(string fieldName)
-    {
-        foreach (var prefix in NamePrefixesToStrip)
-        {
-            if (fieldName.Length > prefix.Length && fieldName.StartsWith(prefix, StringComparison.Ordinal))
-                return fieldName[prefix.Length..];
-        }
-
-        return fieldName;
-    }
-
-    /// <summary>
-    ///     A driver's status constant must carry the value the SDK gives the code it is named after.
-    /// </summary>
-    /// <param name="assembly">The declaring driver assembly (failure-message context).</param>
-    /// <param name="type">The declaring type's full name (failure-message context).</param>
-    /// <param name="field">The constant's name as declared.</param>
-    /// <param name="sdkName">The <see cref="Opc.Ua.StatusCodes"/> member the name resolves to.</param>
-    /// <param name="declared">The value the driver declares.</param>
-    [Theory]
-    [MemberData(nameof(DeclaredStatusConstants))]
-    public void Driver_status_constant_matches_the_pinned_SDK(
-        string assembly, string type, string field, string sdkName, uint declared)
-    {
-        SdkStatusCodes.ShouldContainKey(sdkName,
-            $"{type}.{field} (in {assembly}) reads as an OPC UA status code, but '{sdkName}' is not a member " +
-            "of Opc.Ua.StatusCodes. Either the constant is misnamed, or it is not a status code and should " +
-            "not start with Good/Uncertain/Bad.");
-
-        var expected = SdkStatusCodes[sdkName];
-        declared.ShouldBe(expected,
-            $"{type}.{field} (in {assembly}) is declared 0x{declared:X8}, but Opc.Ua.StatusCodes.{sdkName} " +
-            $"is 0x{expected:X8}" +
-            (SdkStatusCodes.FirstOrDefault(kv => kv.Value == declared) is { Key: { } actual } && actual.Length > 0
-                ? $" — 0x{declared:X8} is actually {actual}, which is what OPC UA clients would branch on."
-                : ". The declared value is not any OPC UA status code."));
-    }
-
-    /// <summary>
-    ///     Discovery must find constants in more than one driver assembly. A zero (or near-zero) here means
-    ///     the bin scan broke or the drivers stopped declaring these by convention — either way the theory
-    ///     above would pass vacuously, which is the one outcome a guard test must never do quietly.
-    /// </summary>
-    [Fact]
-    public void Discovery_finds_status_constants_across_multiple_driver_assemblies()
-    {
-        var found = DeclaredStatusConstants();
-        found.Count.ShouldBeGreaterThan(20,
-            "the driver bin scan found almost no status constants — the assemblies did not deploy to bin, " +
-            "or the naming convention changed");
-
-        var assemblies = found
-            .Select(row => row.Data.Item1)
-            .Distinct(StringComparer.Ordinal)
-            .ToArray();
-
-        assemblies.Length.ShouldBeGreaterThan(3,
-            "status constants were found in fewer than four driver assemblies: " + string.Join(", ", assemblies));
-    }
-}
@@ -12,8 +12,6 @@
    <ItemGroup>
        <PackageReference Include="xunit.v3"/>
        <PackageReference Include="Shouldly"/>
-        <!-- StatusCodeParityTests only; supplies Opc.Ua.StatusCodes as the oracle. -->
-        <PackageReference Include="OPCFoundation.NetStandard.Opc.Ua.Core"/>
        <PackageReference Include="Microsoft.NET.Test.Sdk"/>
        <PackageReference Include="xunit.runner.visualstudio">
            <PrivateAssets>all</PrivateAssets>
@@ -36,11 +34,6 @@
        <ProjectReference Include="..\..\..\src\Drivers\ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient\ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.csproj"/>
        <ProjectReference Include="..\..\..\src\Drivers\ZB.MOM.WW.OtOpcUa.Driver.Galaxy\ZB.MOM.WW.OtOpcUa.Driver.Galaxy.csproj"/>
        <ProjectReference Include="..\..\..\src\Drivers\ZB.MOM.WW.OtOpcUa.Driver.Calculation\ZB.MOM.WW.OtOpcUa.Driver.Calculation.csproj"/>
-        <ProjectReference Include="..\..\..\src\Drivers\ZB.MOM.WW.OtOpcUa.Driver.Sql\ZB.MOM.WW.OtOpcUa.Driver.Sql.csproj"/>
-        <!-- Ships no driver factory (it is a historian backend, not an Equipment driver), so the
-             DriverTypeNames guard skips it — but it does hard-code OPC UA status constants, which
-             puts it in StatusCodeParityTests' scope. -->
-        <ProjectReference Include="..\..\..\src\Drivers\ZB.MOM.WW.OtOpcUa.Driver.Historian.Gateway\ZB.MOM.WW.OtOpcUa.Driver.Historian.Gateway.csproj"/>
    </ItemGroup>

 </Project>
@@ -1,180 +0,0 @@
-using Serilog;
-using Shouldly;
-using Xunit;
-using ZB.MOM.WW.OtOpcUa.Core.Abstractions;
-using ZB.MOM.WW.OtOpcUa.Core.ScriptedAlarms;
-using ZB.MOM.WW.OtOpcUa.Core.Scripting;
-
-namespace ZB.MOM.WW.OtOpcUa.Core.ScriptedAlarms.Tests;
-
-/// <summary>
-///     #487 — <see cref="ScriptedAlarmEngine.GetProjections"/>: the read that lets a caller restore an
-///     alarm's condition node after a full address-space rebuild, without waiting for the alarm's next
-///     transition (which for a still-active alarm with static dependencies may never come).
-/// </summary>
-/// <remarks>
-///     The load that motivates this is deliberately the one that emits NOTHING: an alarm whose persisted
-///     state is already Active and whose predicate is still true produces <see cref="EmissionKind.None"/>,
-///     so the transition stream cannot carry its state. These tests pin both halves — the projection does
-///     report the state, and reading it does not fire an emission.
-/// </remarks>
-[Trait("Category", "Unit")]
-public sealed class ScriptedAlarmProjectionTests
-{
-    private static ScriptedAlarmDefinition Alarm(
-        string id = "HighTemp",
-        string predicate = """return (int)ctx.GetTag("Temp").Value > 100;""",
-        string msg = "Temp is {Temp}",
-        AlarmSeverity sev = AlarmSeverity.High) =>
-        new(AlarmId: id,
-            EquipmentPath: "Plant/Line1/Reactor",
-            AlarmName: id,
-            Kind: AlarmKind.AlarmCondition,
-            Severity: sev,
-            MessageTemplate: msg,
-            PredicateScriptSource: predicate);
-
-    /// <summary>An already-Active persisted state, as a store would hold it across a restart/redeploy.</summary>
-    private static AlarmConditionState PersistedActive(
-        string alarmId = "HighTemp",
-        AlarmAckedState acked = AlarmAckedState.Unacknowledged,
-        DateTime? lastTransitionUtc = null) =>
-        new(alarmId,
-            AlarmEnabledState.Enabled,
-            AlarmActiveState.Active,
-            acked,
-            AlarmConfirmedState.Confirmed,
-            ShelvingState.Unshelved,
-            lastTransitionUtc ?? DateTime.UtcNow,
-            LastActiveUtc: lastTransitionUtc ?? DateTime.UtcNow,
-            LastClearedUtc: null,
-            LastAckUtc: null, LastAckUser: null, LastAckComment: null,
-            LastConfirmUtc: null, LastConfirmUser: null, LastConfirmComment: null,
-            Comments: []);
-
-    private static ScriptedAlarmEngine Build(FakeUpstream up, IAlarmStateStore store)
-    {
-        var logger = new LoggerConfiguration().CreateLogger();
-        return new ScriptedAlarmEngine(up, store, new ScriptLoggerFactory(logger), logger);
-    }
-
-    /// <summary>The core of #487: a reload of a still-active alarm emits NOTHING, yet the projection
-    /// reports it Active — so a caller has a way to restore the node the rebuild reset.</summary>
-    [Fact]
-    public async Task A_still_active_alarm_emits_nothing_on_reload_but_projects_Active()
-    {
-        var up = new FakeUpstream();
-        up.Set("Temp", 150); // predicate still true — no transition to report
-        var store = new InMemoryAlarmStateStore();
-        await store.SaveAsync(PersistedActive(), TestContext.Current.CancellationToken);
-
-        using var eng = Build(up, store);
-        var emissions = new List<ScriptedAlarmEvent>();
-        eng.OnEvent += (_, e) => { lock (emissions) emissions.Add(e); }; // subscribe BEFORE the load
-
-        await eng.LoadAsync([Alarm()], TestContext.Current.CancellationToken);
-
-        // The premise. If this ever starts emitting, the bug's shape has changed and the re-assert
-        // in ScriptedAlarmHostActor may have become a duplicate rather than the only source of truth.
-        lock (emissions)
-        {
-            emissions.ShouldBeEmpty("a still-active alarm has no transition to report on reload");
-        }
-
-        var projection = eng.GetProjections().ShouldHaveSingleItem();
-        projection.AlarmId.ShouldBe("HighTemp");
-        projection.Condition.Active.ShouldBe(AlarmActiveState.Active);
-        projection.Condition.Acked.ShouldBe(AlarmAckedState.Unacknowledged);
-    }
-
-    /// <summary>The projection carries the definition's severity and the message template resolved against
-    /// the live value cache — so a re-asserted node is indistinguishable from one a real transition wrote.</summary>
-    [Fact]
-    public async Task Projection_carries_definition_severity_and_a_resolved_message()
-    {
-        var up = new FakeUpstream();
-        up.Set("Temp", 150);
-        var store = new InMemoryAlarmStateStore();
-        await store.SaveAsync(PersistedActive(), TestContext.Current.CancellationToken);
-
-        using var eng = Build(up, store);
-        await eng.LoadAsync([Alarm(sev: AlarmSeverity.Critical)], TestContext.Current.CancellationToken);
-
-        var projection = eng.GetProjections().ShouldHaveSingleItem();
-        projection.Severity.ShouldBe(AlarmSeverity.Critical);
-        projection.Message.ShouldBe("Temp is 150", "the template resolves against the current value cache");
-    }
-
-    /// <summary>Reading projections is a pure read — it must never raise <see cref="ScriptedAlarmEngine.OnEvent"/>,
-    /// or every deploy would append a duplicate historian / alerts row.</summary>
-    [Fact]
-    public async Task Reading_projections_never_fires_an_emission()
-    {
-        var up = new FakeUpstream();
-        up.Set("Temp", 150);
-        var store = new InMemoryAlarmStateStore();
-        await store.SaveAsync(PersistedActive(), TestContext.Current.CancellationToken);
-
-        using var eng = Build(up, store);
-        await eng.LoadAsync([Alarm()], TestContext.Current.CancellationToken);
-
-        var emissions = 0;
-        eng.OnEvent += (_, _) => Interlocked.Increment(ref emissions);
-
-        for (var i = 0; i < 5; i++) eng.GetProjections().ShouldNotBeEmpty();
-
-        Volatile.Read(ref emissions).ShouldBe(0);
-    }
-
-    /// <summary>An alarm that is genuinely normal projects the no-event position, so a caller can tell
-    /// "nothing to restore" from "restore this".</summary>
-    [Fact]
-    public async Task A_normal_alarm_projects_the_no_event_position()
-    {
-        var up = new FakeUpstream();
-        up.Set("Temp", 50); // predicate false
-        using var eng = Build(up, new InMemoryAlarmStateStore());
-
-        await eng.LoadAsync([Alarm()], TestContext.Current.CancellationToken);
-
-        var projection = eng.GetProjections().ShouldHaveSingleItem();
-        projection.Condition.Active.ShouldBe(AlarmActiveState.Inactive);
-        projection.Condition.Acked.ShouldBe(AlarmAckedState.Acknowledged);
-        projection.Condition.Enabled.ShouldBe(AlarmEnabledState.Enabled);
-        projection.Condition.Shelving.Kind.ShouldBe(ShelvingKind.Unshelved);
-    }
-
-    /// <summary>The worst-input quality rides the projection, so restoring a node whose script inputs are
-    /// Bad does not clobber its Quality back to Good (#478's invariant, on the re-assert path).</summary>
-    [Fact]
-    public async Task Projection_carries_the_last_observed_worst_input_quality()
-    {
-        var up = new FakeUpstream();
-        up.Set("Temp", 150);
-        var store = new InMemoryAlarmStateStore();
-        await store.SaveAsync(PersistedActive(), TestContext.Current.CancellationToken);
-
-        using var eng = Build(up, store);
-        await eng.LoadAsync([Alarm()], TestContext.Current.CancellationToken);
-        eng.GetProjections().ShouldHaveSingleItem().WorstInputStatusCode.ShouldBe(0u, "inputs start Good");
-
-        up.Push("Temp", 150, 0x80000000u); // input goes Bad — condition freezes, quality is annotated
-
-        // The push re-evaluates on a background worker; poll for the tracked bucket to move.
-        var deadline = DateTime.UtcNow.AddSeconds(10);
-        while (eng.GetProjections()[0].WorstInputStatusCode == 0u && DateTime.UtcNow < deadline)
-        {
-            await Task.Delay(20, TestContext.Current.CancellationToken);
-        }
-
-        (eng.GetProjections()[0].WorstInputStatusCode >> 30).ShouldBe(2u, "a Bad input projects Bad quality");
-    }
-
-    /// <summary>Before the first load there is nothing to project — the read is safe, not a throw.</summary>
-    [Fact]
-    public void Projections_are_empty_before_the_first_load()
-    {
-        using var eng = Build(new FakeUpstream(), new InMemoryAlarmStateStore());
-        eng.GetProjections().ShouldBeEmpty();
-    }
-}
@@ -19,12 +19,12 @@ public sealed class StatusCodeMapTests
    /// <param name="expected">The expected OPC UA status code.</param>
    [Theory]
    [InlineData((byte)192, 0x00000000u)]   // Good
-    [InlineData((byte)216, 0x00960000u)]   // Good_LocalOverride
+    [InlineData((byte)216, 0x00D80000u)]   // Good_LocalOverride
    [InlineData((byte)64,  0x40000000u)]   // Uncertain
-    [InlineData((byte)68,  0x40900000u)]   // Uncertain_LastUsableValue
-    [InlineData((byte)80,  0x40930000u)]   // Uncertain_SensorNotAccurate
-    [InlineData((byte)84,  0x40940000u)]   // Uncertain_EngineeringUnitsExceeded
-    [InlineData((byte)88,  0x40950000u)]   // Uncertain_SubNormal
+    [InlineData((byte)68,  0x40A40000u)]   // Uncertain_LastUsableValue
+    [InlineData((byte)80,  0x408D0000u)]   // Uncertain_SensorNotAccurate
+    [InlineData((byte)84,  0x408E0000u)]   // Uncertain_EngineeringUnitsExceeded
+    [InlineData((byte)88,  0x408F0000u)]   // Uncertain_SubNormal
    [InlineData((byte)0,   0x80000000u)]   // Bad
    [InlineData((byte)4,   0x80890000u)]   // Bad_ConfigurationError
    [InlineData((byte)8,   0x808A0000u)]   // Bad_NotConnected
@@ -132,9 +132,9 @@ public sealed class StatusCodeMapTests
    /// <param name="expected">The expected OPC DA category byte.</param>
    [Theory]
    [InlineData(0x00000000u, (byte)192)]  // Good
-    [InlineData(0x00960000u, (byte)192)]  // GoodLocalOverride — still Good category
+    [InlineData(0x00D80000u, (byte)192)]  // GoodLocalOverride — still Good category
    [InlineData(0x40000000u, (byte)64)]   // Uncertain
-    [InlineData(0x40950000u, (byte)64)]   // UncertainSubNormal — still Uncertain category
+    [InlineData(0x408F0000u, (byte)64)]   // UncertainSubNormal — still Uncertain category
    [InlineData(0x80000000u, (byte)0)]    // Bad
    [InlineData(0x808A0000u, (byte)0)]    // BadNotConnected — still Bad category
    [InlineData(0x80020000u, (byte)0)]    // BadInternalError — still Bad category
@@ -7,7 +7,7 @@ public sealed class GatewayQualityMapperTests
 {
    [Theory]
    [InlineData(192, 0x00000000u)] // Good
-    [InlineData(216, 0x00960000u)] // Good_LocalOverride
+    [InlineData(216, 0x00D80000u)] // Good_LocalOverride
    [InlineData(64,  0x40000000u)] // Uncertain
    [InlineData(0,   0x80000000u)] // Bad
    [InlineData(8,   0x808A0000u)] // Bad_NotConnected
@@ -37,7 +37,7 @@ public sealed class SampleMapperTests
    {
        var a = new HistorianAggregateSample { Tag = "T", /* Value unset, no Good quality */ EndTime = Ts(2026, 1, 1, 0, 0, 0) };
        var snap = SampleMapper.ToAggregateSnapshot(a);
-        Assert.Equal(0x809B0000u, snap.StatusCode); // BadNoData
+        Assert.Equal(0x800E0000u, snap.StatusCode); // BadNoData
        Assert.Null(snap.Value);
    }

@@ -21,7 +21,10 @@ COPY profiles/ /fixtures/
 # compose profile. See Docker/README.md §exception injection.
 COPY exception_injector.py /fixtures/

-EXPOSE 5020
+# 5020 = the shared port for the standard/dl205/mitsubishi/s7_1500/exception_injection
+# profiles (only one binds it at a time); 5021 = the rtu_over_tcp profile, which co-runs
+# with standard. Image-metadata honesty only — compose's ports: mapping doesn't need EXPOSE.
+EXPOSE 5020 5021

 # Default to the standard profile; docker-compose.yml overrides per service.
 # --http_port intentionally omitted; pymodbus 3.13's web UI binds on a
@@ -2,15 +2,16 @@

 The Modbus driver's integration tests talk to a
 [`pymodbus`](https://pymodbus.readthedocs.io/) simulator running as a
-pinned Docker container. One image, per-profile service in compose, same
-port binding (`5020`) regardless of which profile is live. Docker is the
-only supported launch path — a fresh clone needs Docker Desktop and
-nothing else.
+pinned Docker container. One image, per-profile service in compose. Most
+profiles bind `:5020`, so only one of *those* runs at a time; the
+`rtu_over_tcp` profile binds `:5021` and is designed to co-run alongside
+`standard`. Docker is the only supported launch path — a fresh clone needs
+Docker Desktop and nothing else.

 | File | Purpose |
 |---|---|
 | [`Dockerfile`](Dockerfile) | `python:3.12-slim-bookworm` + `pymodbus[simulator]==3.13.0` + every profile JSON + `exception_injector.py` |
-| [`docker-compose.yml`](docker-compose.yml) | One service per profile (`standard` / `dl205` / `mitsubishi` / `s7_1500` / `exception_injection`); all bind `:5020` so only one runs at a time |
+| [`docker-compose.yml`](docker-compose.yml) | One service per profile (`standard` / `dl205` / `mitsubishi` / `s7_1500` / `exception_injection` bind `:5020`, so only one of those runs at a time; `rtu_over_tcp` binds `:5021` and can run alongside `standard`) |
 | [`profiles/*.json`](profiles/) | Same seed-register definitions the native launcher uses — canonical source |
 | [`exception_injector.py`](exception_injector.py) | Pure-stdlib Modbus/TCP server that emits arbitrary exception codes per rule — used by the `exception_injection` profile |

@@ -43,10 +44,11 @@ docker compose -f tests\...\Docker\docker-compose.yml --profile dl205 up -d
 docker compose -f tests\...\Docker\docker-compose.yml --profile dl205 down
 ```

-Only one profile binds `:5020` at a time; switch by stopping the current
-service + starting another. The integration tests discriminate by a
-separate `MODBUS_SIM_PROFILE` env var so they skip correctly when the
-wrong profile is live.
+Only one of the `:5020` profiles binds at a time; switch by stopping the
+current service + starting another. (`rtu_over_tcp` is the exception — it
+binds `:5021` and co-runs with `standard`.) The integration tests
+discriminate by a separate `MODBUS_SIM_PROFILE` env var so they skip
+correctly when the wrong profile is live.

 > **⚠️ Profile-cycling gotcha (bit us in the 2026-07 sweep — see
 > `archreview/plans/INTEGRATION-SWEEP-STATUS.md`).** Each profile is a
@@ -78,6 +78,30 @@ services:
      "--json_file",      "/fixtures/s7_1500.json"
    ]

+  # RTU-over-TCP profile. Same pymodbus simulator, but the server is framed
+  # RTU (framer=rtu) instead of socket/MBAP — this is what a serial→Ethernet
+  # gateway presents. Binds :5021 (NOT the shared :5020) so it co-runs with
+  # the `standard` profile: two families, two ports, no conflict. Serves
+  # rtu_over_tcp.json (byte-for-byte standard.json + framer/port swap).
+  rtu_over_tcp:
+    profiles: ["rtu_over_tcp"]
+    image: otopcua-pymodbus:3.13.0
+    build:
+      context: .
+      dockerfile: Dockerfile
+    container_name: otopcua-pymodbus-rtu_over_tcp
+    labels:
+      project: lmxopcua
+    restart: "no"
+    ports:
+      - "5021:5021"
+    command: [
+      "pymodbus.simulator",
+      "--modbus_server", "srv",
+      "--modbus_device",  "dev",
+      "--json_file",      "/fixtures/rtu_over_tcp.json"
+    ]
+
  # Exception-injection profile. Runs the standalone pure-stdlib Modbus/TCP
  # server shipped as exception_injector.py instead of the pymodbus
  # simulator — pymodbus naturally emits only exception codes 02 + 03, and
@@ -0,0 +1,97 @@
+{
+  "_comment": "rtu_over_tcp.json — RTU-over-TCP Modbus server for the integration suite (RTU framing tunnelled over a socket, as a serial→Ethernet gateway presents it). Byte-for-byte standard.json EXCEPT the server block: framer=\"rtu\" (not \"socket\") + port 5021 (not 5020), so it co-runs with the standard profile on :5020. pymodbus 3.13's simulator honors framer=rtu on a TCP server — confirmed on the wire (controller spike, 2026-07-24): raw RTU FC03 read of HR[5] returned `01 03 02 00 05 78 47`, a pure RTU frame with no MBAP header. Layout is identical to standard.json: HR[0..31]=address-as-value, HR[100]=auto-increment, HR[200..209]=scratch, coils 1024..1055=alternating, coils 1100..1109=scratch. NOTE: pymodbus rejects unknown keys at device-list / setup level; explanatory comments live in the README + git history.",
+
+  "server_list": {
+    "srv": {
+      "comm": "tcp",
+      "host": "0.0.0.0",
+      "port": 5021,
+      "framer": "rtu",
+      "device_id": 1
+    }
+  },
+
+  "device_list": {
+    "dev": {
+      "setup": {
+        "co size": 2048,
+        "di size": 2048,
+        "hr size": 2048,
+        "ir size": 2048,
+        "shared blocks": true,
+        "type exception": false,
+        "defaults": {
+          "value":  {"bits": 0, "uint16": 0, "uint32": 0, "float32": 0.0, "string": " "},
+          "action": {"bits": null, "uint16": null, "uint32": null, "float32": null, "string": null}
+        }
+      },
+      "invalid": [],
+      "write": [
+        [0, 31],
+        [100, 100],
+        [200, 209],
+        [1024, 1055],
+        [1100, 1109]
+      ],
+
+      "uint16": [
+        {"addr":  0, "value":  0}, {"addr":  1, "value":  1},
+        {"addr":  2, "value":  2}, {"addr":  3, "value":  3},
+        {"addr":  4, "value":  4}, {"addr":  5, "value":  5},
+        {"addr":  6, "value":  6}, {"addr":  7, "value":  7},
+        {"addr":  8, "value":  8}, {"addr":  9, "value":  9},
+        {"addr": 10, "value": 10}, {"addr": 11, "value": 11},
+        {"addr": 12, "value": 12}, {"addr": 13, "value": 13},
+        {"addr": 14, "value": 14}, {"addr": 15, "value": 15},
+        {"addr": 16, "value": 16}, {"addr": 17, "value": 17},
+        {"addr": 18, "value": 18}, {"addr": 19, "value": 19},
+        {"addr": 20, "value": 20}, {"addr": 21, "value": 21},
+        {"addr": 22, "value": 22}, {"addr": 23, "value": 23},
+        {"addr": 24, "value": 24}, {"addr": 25, "value": 25},
+        {"addr": 26, "value": 26}, {"addr": 27, "value": 27},
+        {"addr": 28, "value": 28}, {"addr": 29, "value": 29},
+        {"addr": 30, "value": 30}, {"addr": 31, "value": 31},
+
+        {"addr": 100, "value": 0,
+         "action": "increment",
+         "parameters": {"minval": 0, "maxval": 65535}},
+
+        {"addr": 200, "value": 0}, {"addr": 201, "value": 0},
+        {"addr": 202, "value": 0}, {"addr": 203, "value": 0},
+        {"addr": 204, "value": 0}, {"addr": 205, "value": 0},
+        {"addr": 206, "value": 0}, {"addr": 207, "value": 0},
+        {"addr": 208, "value": 0}, {"addr": 209, "value": 0}
+      ],
+
+      "bits": [
+        {"addr": 1024, "value": 1}, {"addr": 1025, "value": 0},
+        {"addr": 1026, "value": 1}, {"addr": 1027, "value": 0},
+        {"addr": 1028, "value": 1}, {"addr": 1029, "value": 0},
+        {"addr": 1030, "value": 1}, {"addr": 1031, "value": 0},
+        {"addr": 1032, "value": 1}, {"addr": 1033, "value": 0},
+        {"addr": 1034, "value": 1}, {"addr": 1035, "value": 0},
+        {"addr": 1036, "value": 1}, {"addr": 1037, "value": 0},
+        {"addr": 1038, "value": 1}, {"addr": 1039, "value": 0},
+        {"addr": 1040, "value": 1}, {"addr": 1041, "value": 0},
+        {"addr": 1042, "value": 1}, {"addr": 1043, "value": 0},
+        {"addr": 1044, "value": 1}, {"addr": 1045, "value": 0},
+        {"addr": 1046, "value": 1}, {"addr": 1047, "value": 0},
+        {"addr": 1048, "value": 1}, {"addr": 1049, "value": 0},
+        {"addr": 1050, "value": 1}, {"addr": 1051, "value": 0},
+        {"addr": 1052, "value": 1}, {"addr": 1053, "value": 0},
+        {"addr": 1054, "value": 1}, {"addr": 1055, "value": 0},
+
+        {"addr": 1100, "value": 0}, {"addr": 1101, "value": 0},
+        {"addr": 1102, "value": 0}, {"addr": 1103, "value": 0},
+        {"addr": 1104, "value": 0}, {"addr": 1105, "value": 0},
+        {"addr": 1106, "value": 0}, {"addr": 1107, "value": 0},
+        {"addr": 1108, "value": 0}, {"addr": 1109, "value": 0}
+      ],
+
+      "uint32":  [],
+      "float32": [],
+      "string":  [],
+      "repeat":  []
+    }
+  }
+}
@@ -0,0 +1,82 @@
+using System.Net.Sockets;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.Modbus.IntegrationTests;
+
+/// <summary>
+///     Reachability probe for the RTU-over-TCP Modbus simulator (pymodbus in Docker with
+///     <c>framer=rtu</c>, see <c>Docker/docker-compose.yml</c> profile <c>rtu_over_tcp</c>) or a
+///     real serial→Ethernet Modbus gateway. Mirrors <see cref="ModbusSimulatorFixture"/> but reads
+///     <c>MODBUS_RTU_SIM_ENDPOINT</c> (default <c>10.100.0.35:5021</c> — the shared Docker host, a
+///     distinct port from the standard profile's <c>:5020</c> so the two fixtures co-run). TCP-connects
+///     once at fixture construction; each test checks <see cref="SkipReason"/> and calls
+///     <c>Assert.Skip</c> when the endpoint was unreachable, so a dev box without a running simulator
+///     still passes `dotnet test` cleanly.
+/// </summary>
+/// <remarks>
+///     Same one-shot-probe discipline as <see cref="ModbusSimulatorFixture"/>: the probe socket is
+///     not held for the life of the fixture (tests open their own <see cref="ModbusRtuOverTcpTransport"/>
+///     against the same endpoint), and the fixture is a collection fixture so the probe runs once per
+///     session rather than per test.
+/// </remarks>
+public sealed class ModbusRtuOverTcpFixture : IAsyncDisposable
+{
+    // :5021 (not the standard profile's :5020) so the rtu_over_tcp container can co-run with the
+    // standard container on the shared Docker host. 10.100.0.35 = the shared Docker host (see
+    // CLAUDE.md "Docker Workflow"). Override with MODBUS_RTU_SIM_ENDPOINT to point at a real
+    // serial→Ethernet Modbus gateway, or a locally-running container.
+    private const string DefaultEndpoint = "10.100.0.35:5021";
+    private const string EndpointEnvVar = "MODBUS_RTU_SIM_ENDPOINT";
+
+    /// <summary>Gets the host address of the RTU-over-TCP Modbus simulator.</summary>
+    public string Host { get; }
+
+    /// <summary>Gets the port of the RTU-over-TCP Modbus simulator.</summary>
+    public int Port { get; }
+
+    /// <summary>Gets the skip reason if the simulator is unreachable; otherwise null.</summary>
+    public string? SkipReason { get; }
+
+    /// <summary>Initializes a new instance of the <see cref="ModbusRtuOverTcpFixture"/> class.</summary>
+    public ModbusRtuOverTcpFixture()
+    {
+        var raw = Environment.GetEnvironmentVariable(EndpointEnvVar) ?? DefaultEndpoint;
+        var parts = raw.Split(':', 2);
+        Host = parts[0];
+        Port = parts.Length == 2 && int.TryParse(parts[1], out var p) ? p : 502;
+
+        try
+        {
+            // Force IPv4 on the probe — pymodbus binds 0.0.0.0 (IPv4 only) while .NET default-resolves
+            // "localhost" → IPv6 ::1 first and only then tries IPv4, surfacing as a 2s timeout under
+            // .NET 10. Resolving + dialing explicit IPv4 sidesteps the dual-stack ordering. (Same
+            // rationale as ModbusSimulatorFixture.)
+            using var client = new TcpClient(System.Net.Sockets.AddressFamily.InterNetwork);
+            var task = client.ConnectAsync(
+                System.Net.Dns.GetHostAddresses(Host)
+                    .FirstOrDefault(a => a.AddressFamily == System.Net.Sockets.AddressFamily.InterNetwork)
+                    ?? System.Net.IPAddress.Loopback,
+                Port);
+            if (!task.Wait(TimeSpan.FromSeconds(2)) || !client.Connected)
+            {
+                SkipReason = $"RTU-over-TCP Modbus simulator at {Host}:{Port} did not accept a TCP connection within 2s. " +
+                             $"Start the pymodbus Docker container (docker compose -f Docker/docker-compose.yml --profile rtu_over_tcp up -d --build) " +
+                             $"or override {EndpointEnvVar}, then re-run.";
+            }
+        }
+        catch (Exception ex)
+        {
+            SkipReason = $"RTU-over-TCP Modbus simulator at {Host}:{Port} unreachable: {ex.GetType().Name}: {ex.Message}. " +
+                         $"Start the pymodbus Docker container (docker compose -f Docker/docker-compose.yml --profile rtu_over_tcp up -d --build) " +
+                         $"or override {EndpointEnvVar}, then re-run.";
+        }
+    }
+
+    /// <inheritdoc />
+    public ValueTask DisposeAsync() => ValueTask.CompletedTask;
+}
+
+[Xunit.CollectionDefinition(Name)]
+public sealed class ModbusRtuOverTcpCollection : Xunit.ICollectionFixture<ModbusRtuOverTcpFixture>
+{
+    public const string Name = "ModbusRtuOverTcp";
+}
@@ -0,0 +1,94 @@
+using Shouldly;
+using Xunit;
+using ZB.MOM.WW.OtOpcUa.Core.Abstractions;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.Modbus.IntegrationTests;
+
+/// <summary>
+///     End-to-end round-trip against the <c>rtu_over_tcp.json</c> pymodbus profile (or a real
+///     serial→Ethernet Modbus gateway when <c>MODBUS_RTU_SIM_ENDPOINT</c> points at one), driving the
+///     full <see cref="ModbusDriver"/> + real <see cref="ModbusRtuOverTcpTransport"/> stack with
+///     <see cref="ModbusTransportMode.RtuOverTcp"/>. Proves the driver reads a seeded holding register
+///     and writes+reads-back a scratch register when the wire carries RTU framing
+///     (<c>[addr][PDU][CRC-16]</c>, no MBAP header) rather than Modbus/TCP.
+/// </summary>
+/// <remarks>
+///     pymodbus 3.13's simulator honors <c>framer=rtu</c> on a TCP server — confirmed on the wire
+///     (controller spike, 2026-07-24): a raw RTU FC03 read of HR[5] returned
+///     <c>01 03 02 00 05 78 47</c>, a pure RTU frame with no MBAP header (data 0x0005 = 5). So the
+///     fixture is the plain pymodbus simulator with framer/port swapped — no stdlib fallback server.
+/// </remarks>
+[Collection(ModbusRtuOverTcpCollection.Name)]
+[Trait("Category", "Integration")]
+[Trait("Device", "RtuOverTcp")]
+public sealed class ModbusRtuOverTcpTests(ModbusRtuOverTcpFixture sim)
+{
+    /// <summary>Reads a seeded holding register (HR[5]=5) over RTU-over-TCP framing.</summary>
+    [Fact]
+    public async Task Reads_a_seeded_holding_register_over_rtu_framing()
+    {
+        if (sim.SkipReason is not null) Assert.Skip(sim.SkipReason);
+        var opts = new ModbusDriverOptions
+        {
+            Host = sim.Host,
+            Port = sim.Port,
+            UnitId = 1,
+            Transport = ModbusTransportMode.RtuOverTcp,
+            Timeout = TimeSpan.FromSeconds(2),
+            Probe = new ModbusProbeOptions { Enabled = false },
+            RawTags = ModbusRawTags.Entries([
+                new ModbusTagDefinition(
+                    Name: "HR5",
+                    Region: ModbusRegion.HoldingRegisters,
+                    Address: 5,
+                    DataType: ModbusDataType.UInt16,
+                    Writable: false),
+            ]),
+        };
+        await using var driver = new ModbusDriver(opts, driverInstanceId: "modbus-rtu-int");
+        await driver.InitializeAsync(driverConfigJson: "{}", TestContext.Current.CancellationToken);
+
+        var results = await driver.ReadAsync(["HR5"], TestContext.Current.CancellationToken);
+
+        results.Count.ShouldBe(1);
+        results[0].StatusCode.ShouldBe(0u);       // Good
+        results[0].Value.ShouldBe((ushort)5);     // HR[5] seeded = address-as-value
+    }
+
+    /// <summary>Writes then reads back a scratch holding register (HR[200]) over RTU-over-TCP framing.</summary>
+    [Fact]
+    public async Task Writes_and_reads_back_a_holding_register_over_rtu_framing()
+    {
+        if (sim.SkipReason is not null) Assert.Skip(sim.SkipReason);
+        var opts = new ModbusDriverOptions
+        {
+            Host = sim.Host,
+            Port = sim.Port,
+            UnitId = 1,
+            Transport = ModbusTransportMode.RtuOverTcp,
+            Timeout = TimeSpan.FromSeconds(2),
+            Probe = new ModbusProbeOptions { Enabled = false },
+            RawTags = ModbusRawTags.Entries([
+                new ModbusTagDefinition(
+                    Name: "HR200",
+                    Region: ModbusRegion.HoldingRegisters,
+                    Address: 200,
+                    DataType: ModbusDataType.UInt16,
+                    Writable: true),
+            ]),
+        };
+        await using var driver = new ModbusDriver(opts, driverInstanceId: "modbus-rtu-int-w");
+        await driver.InitializeAsync(driverConfigJson: "{}", TestContext.Current.CancellationToken);
+
+        var writes = await driver.WriteAsync(
+            [new WriteRequest("HR200", (ushort)4242)],
+            TestContext.Current.CancellationToken);
+        writes.Count.ShouldBe(1);
+        writes[0].StatusCode.ShouldBe(0u);
+
+        var back = await driver.ReadAsync(["HR200"], TestContext.Current.CancellationToken);
+        back.Count.ShouldBe(1);
+        back[0].StatusCode.ShouldBe(0u);
+        back[0].Value.ShouldBe((ushort)4242);
+    }
+}
@@ -0,0 +1,27 @@
+using Shouldly;
+using Xunit;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.Modbus.Tests;
+
+public sealed class ModbusCrcTests
+{
+    // Known CRC-16/MODBUS vectors (init 0xFFFF, poly 0xA001). CRC returned as ushort;
+    // on the wire it is appended low-byte-first.
+    [Theory]
+    // FC03 read HR: unit 1, addr 0, qty 1  -> CRC 0x0A84  (bytes 84 0A on the wire)
+    [InlineData(new byte[] { 0x01, 0x03, 0x00, 0x00, 0x00, 0x01 }, (ushort)0x0A84)]
+    // "123456789" canonical check value for CRC-16/MODBUS = 0x4B37
+    [InlineData(new byte[] { 0x31,0x32,0x33,0x34,0x35,0x36,0x37,0x38,0x39 }, (ushort)0x4B37)]
+    public void Compute_matches_known_vectors(byte[] frame, ushort expected)
+        => ModbusCrc.Compute(frame).ShouldBe(expected);
+
+    [Fact]
+    public void AppendLowByteFirst_writes_lo_then_hi()
+    {
+        var body = new byte[] { 0x01, 0x03, 0x00, 0x00, 0x00, 0x01 };
+        var withCrc = ModbusCrc.Append(body);
+        withCrc.Length.ShouldBe(body.Length + 2);
+        withCrc[^2].ShouldBe((byte)0x84); // CRC low byte
+        withCrc[^1].ShouldBe((byte)0x0A); // CRC high byte
+    }
+}
@@ -14,7 +14,7 @@ namespace ZB.MOM.WW.OtOpcUa.Driver.Modbus.Tests;
 ///     (2) Sub-second <see cref="TimeSpan"/> values on <c>ModbusKeepAliveOptions.Time</c> /
 ///     <c>Interval</c> — the int-cast in <c>EnableKeepAlive</c> truncated <c>500&#160;ms</c> to
 ///     <c>0</c>, which most OSes interpret as "use the default", silently defeating the
-///     configured timing. <c>ModbusTcpTransport.ClampToWholeSeconds</c> rounds up to a minimum
+///     configured timing. <c>ModbusSocketLifecycle.ClampToWholeSeconds</c> rounds up to a minimum
 ///     of 1&#160;second.
 /// </summary>
 [Trait("Category", "Unit")]
@@ -70,7 +70,7 @@ public sealed class ModbusEdgeCaseValidationTests
    [InlineData(60_000, 60)]
    public void ClampToWholeSeconds_rounds_up_to_at_least_one_second(int ms, int expected)
    {
-        ModbusTcpTransport.ClampToWholeSeconds(TimeSpan.FromMilliseconds(ms)).ShouldBe(expected);
+        ModbusSocketLifecycle.ClampToWholeSeconds(TimeSpan.FromMilliseconds(ms)).ShouldBe(expected);
    }

    /// <summary>Verifies that negative time spans are treated as one second.</summary>
@@ -80,6 +80,6 @@ public sealed class ModbusEdgeCaseValidationTests
        // Defensive — operators occasionally configure a negative TimeSpan thinking it disables
        // the feature. The OS would reject the negative int — clamping to 1 keeps the socket
        // valid until the operator fixes the config.
-        ModbusTcpTransport.ClampToWholeSeconds(TimeSpan.FromSeconds(-5)).ShouldBe(1);
+        ModbusSocketLifecycle.ClampToWholeSeconds(TimeSpan.FromSeconds(-5)).ShouldBe(1);
    }
 }
@@ -0,0 +1,134 @@
+using Shouldly;
+using Xunit;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.Modbus.Tests;
+
+public sealed class ModbusRtuFramingTests
+{
+    private static MemoryStream Canned(params byte[] frame) => new(frame);
+
+    [Fact]
+    public void BuildAdu_prefixes_unit_and_appends_crc()
+    {
+        var adu = ModbusRtuFraming.BuildAdu(0x01, new byte[] { 0x03, 0x00, 0x00, 0x00, 0x01 });
+        adu.ShouldBe(new byte[] { 0x01, 0x03, 0x00, 0x00, 0x00, 0x01, 0x84, 0x0A });
+    }
+
+    [Fact]
+    public async Task ReadResponse_FC03_returns_bare_pdu()
+    {
+        // addr=01 fc=03 byteCount=02 data=00 0A  + CRC(lo,hi)
+        var body = new byte[] { 0x01, 0x03, 0x02, 0x00, 0x0A };
+        var frame = ModbusCrc.Append(body);
+        await using var s = Canned(frame);
+        var pdu = await ModbusRtuFraming.ReadResponsePduAsync(s, 0x01, TestContext.Current.CancellationToken);
+        pdu.ShouldBe(new byte[] { 0x03, 0x02, 0x00, 0x0A }); // fc + byteCount + data, no addr/CRC
+    }
+
+    [Fact]
+    public async Task ReadResponse_exception_frame_throws_ModbusException()
+    {
+        // addr=01 fc=0x83 exc=0x02 + CRC
+        var frame = ModbusCrc.Append(new byte[] { 0x01, 0x83, 0x02 });
+        await using var s = Canned(frame);
+        var ex = await Should.ThrowAsync<ModbusException>(
+            ModbusRtuFraming.ReadResponsePduAsync(s, 0x01, TestContext.Current.CancellationToken));
+        ex.FunctionCode.ShouldBe((byte)0x03);
+        ex.ExceptionCode.ShouldBe((byte)0x02);
+    }
+
+    [Fact]
+    public async Task ReadResponse_bad_crc_throws_desync()
+    {
+        var frame = ModbusCrc.Append(new byte[] { 0x01, 0x03, 0x02, 0x00, 0x0A });
+        frame[^1] ^= 0xFF; // corrupt CRC high byte
+        await using var s = Canned(frame);
+        var ex = await Should.ThrowAsync<ModbusTransportDesyncException>(
+            ModbusRtuFraming.ReadResponsePduAsync(s, 0x01, TestContext.Current.CancellationToken));
+        ex.Reason.ShouldBe(ModbusTransportDesyncException.DesyncReason.CrcMismatch);
+    }
+
+    [Fact]
+    public async Task ReadResponse_FC06_write_echo_returns_four_byte_pdu()
+    {
+        // addr=01 fc=06 addr=00 07 value=00 2A + CRC  -> PDU = 06 00 07 00 2A
+        var frame = ModbusCrc.Append(new byte[] { 0x01, 0x06, 0x00, 0x07, 0x00, 0x2A });
+        await using var s = Canned(frame);
+        var pdu = await ModbusRtuFraming.ReadResponsePduAsync(s, 0x01, TestContext.Current.CancellationToken);
+        pdu.ShouldBe(new byte[] { 0x06, 0x00, 0x07, 0x00, 0x2A });
+    }
+
+    [Fact]
+    public async Task ReadResponse_wrong_unit_address_throws_desync()
+    {
+        // CRC-valid FC03 frame addressed to unit 0x02, but we asked for 0x01 -> unit-mismatch desync.
+        var frame = ModbusCrc.Append(new byte[] { 0x02, 0x03, 0x02, 0x00, 0x0A });
+        await using var s = Canned(frame);
+        var ex = await Should.ThrowAsync<ModbusTransportDesyncException>(
+            ModbusRtuFraming.ReadResponsePduAsync(s, 0x01, TestContext.Current.CancellationToken));
+        ex.Reason.ShouldBe(ModbusTransportDesyncException.DesyncReason.UnitMismatch);
+    }
+
+    [Fact]
+    public async Task ReadResponse_FC03_deframes_correctly_when_delivered_in_dribbles()
+    {
+        // Same valid FC03 frame, but the stream hands back only 1-2 bytes per ReadAsync — proves
+        // the ReadExactlyAsync accumulation loop reassembles a length-less frame across many reads.
+        var frame = ModbusCrc.Append(new byte[] { 0x01, 0x03, 0x02, 0x00, 0x0A });
+        await using var s = new DribbleStream(frame, chunk: 2);
+        var pdu = await ModbusRtuFraming.ReadResponsePduAsync(s, 0x01, TestContext.Current.CancellationToken);
+        pdu.ShouldBe(new byte[] { 0x03, 0x02, 0x00, 0x0A });
+    }
+
+    [Fact]
+    public async Task ReadResponse_stream_ends_early_throws_desync()
+    {
+        // Only the first 4 bytes of a 7-byte FC03 frame are available, then EOF (ReadAsync returns 0)
+        // -> the truncation path in ReadExactlyAsync must surface a desync, not hang or mis-parse.
+        var frame = ModbusCrc.Append(new byte[] { 0x01, 0x03, 0x02, 0x00, 0x0A });
+        var truncated = frame[..4];
+        await using var s = new DribbleStream(truncated, chunk: 2);
+        var ex = await Should.ThrowAsync<ModbusTransportDesyncException>(
+            ModbusRtuFraming.ReadResponsePduAsync(s, 0x01, TestContext.Current.CancellationToken));
+        ex.Reason.ShouldBe(ModbusTransportDesyncException.DesyncReason.TruncatedFrame);
+    }
+
+    /// <summary>
+    ///     A read-only test double that dribbles its backing bytes out at most <c>chunk</c> at a time
+    ///     per <see cref="ReadAsync(Memory{byte}, CancellationToken)"/> call, then returns 0 (EOF)
+    ///     once exhausted. Exercises the partial-read accumulation loop and the truncation → desync
+    ///     path that a single-shot <see cref="MemoryStream"/> never reaches.
+    /// </summary>
+    private sealed class DribbleStream(byte[] data, int chunk) : Stream
+    {
+        private int _pos;
+
+        public override int Read(byte[] buffer, int offset, int count)
+        {
+            var n = Math.Min(Math.Min(chunk, count), data.Length - _pos);
+            if (n <= 0) return 0;
+            Array.Copy(data, _pos, buffer, offset, n);
+            _pos += n;
+            return n;
+        }
+
+        public override ValueTask<int> ReadAsync(Memory<byte> buffer, CancellationToken cancellationToken = default)
+        {
+            var n = Math.Min(Math.Min(chunk, buffer.Length), data.Length - _pos);
+            if (n <= 0) return ValueTask.FromResult(0);
+            data.AsSpan(_pos, n).CopyTo(buffer.Span);
+            _pos += n;
+            return ValueTask.FromResult(n);
+        }
+
+        public override bool CanRead => true;
+        public override bool CanSeek => false;
+        public override bool CanWrite => false;
+        public override long Length => data.Length;
+        public override long Position { get => _pos; set => throw new NotSupportedException(); }
+        public override void Flush() { }
+        public override long Seek(long offset, SeekOrigin origin) => throw new NotSupportedException();
+        public override void SetLength(long value) => throw new NotSupportedException();
+        public override void Write(byte[] buffer, int offset, int count) => throw new NotSupportedException();
+    }
+}
@@ -0,0 +1,110 @@
+using Shouldly;
+using Xunit;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.Modbus.Tests;
+
+/// <summary>
+///     Exercises <see cref="ModbusRtuOverTcpTransport"/>'s send/receive orchestration, single-flight,
+///     and per-op deadline against an in-memory duplex fake injected through the <c>ForTest</c> seam —
+///     no real socket. The fake records the request ADU the transport writes and replays a canned RTU
+///     response on read, or blocks forever (honouring cancellation) when <c>stall</c> is set.
+/// </summary>
+[Trait("Category", "Unit")]
+public sealed class ModbusRtuOverTcpTransportTests
+{
+    [Fact]
+    public async Task SendAsync_writes_rtu_adu_and_returns_deframed_pdu()
+    {
+        // Response the fake gateway will emit: FC03, 1 reg = 0x000A.
+        var response = ModbusCrc.Append(new byte[] { 0x01, 0x03, 0x02, 0x00, 0x0A });
+        var fake = new CapturingDuplexStream(response);
+
+        await using var transport = ModbusRtuOverTcpTransport.ForTest(fake, TimeSpan.FromSeconds(2));
+        var pdu = await transport.SendAsync(0x01, new byte[] { 0x03, 0x00, 0x00, 0x00, 0x01 },
+            TestContext.Current.CancellationToken);
+
+        pdu.ShouldBe(new byte[] { 0x03, 0x02, 0x00, 0x0A });
+        // The request went out as an RTU ADU: unit + pdu + CRC, NO MBAP header.
+        fake.Written.ShouldBe(new byte[] { 0x01, 0x03, 0x00, 0x00, 0x00, 0x01, 0x84, 0x0A });
+    }
+
+    [Fact]
+    public async Task SendAsync_exception_pdu_surfaces_ModbusException()
+    {
+        var response = ModbusCrc.Append(new byte[] { 0x01, 0x83, 0x02 });
+        var fake = new CapturingDuplexStream(response);
+        await using var transport = ModbusRtuOverTcpTransport.ForTest(fake, TimeSpan.FromSeconds(2));
+        await Should.ThrowAsync<ModbusException>(
+            transport.SendAsync(0x01, new byte[] { 0x03, 0x00, 0x00, 0x00, 0x01 },
+                TestContext.Current.CancellationToken));
+    }
+
+    [Fact]
+    public async Task SendAsync_stalled_gateway_hits_per_op_deadline()
+    {
+        var fake = new CapturingDuplexStream(respondBytes: Array.Empty<byte>(), stall: true);
+        await using var transport = ModbusRtuOverTcpTransport.ForTest(fake, TimeSpan.FromMilliseconds(200));
+        await Should.ThrowAsync<ModbusTransportDesyncException>(
+            transport.SendAsync(0x01, new byte[] { 0x03, 0x00, 0x00, 0x00, 0x01 },
+                TestContext.Current.CancellationToken));
+    }
+
+    /// <summary>
+    ///     In-memory duplex <see cref="Stream"/> test double: records everything written and replays
+    ///     <c>respondBytes</c> on read. When <c>stall</c> is set the read blocks until its cancellation
+    ///     token fires (simulating a frozen gateway) so the transport's per-op deadline is exercised.
+    /// </summary>
+    private sealed class CapturingDuplexStream : Stream
+    {
+        private readonly byte[] _response;
+        private readonly bool _stall;
+        private readonly MemoryStream _written = new();
+        private int _readPos;
+
+        public CapturingDuplexStream(byte[] respondBytes, bool stall = false)
+        {
+            _response = respondBytes;
+            _stall = stall;
+        }
+
+        /// <summary>Gets the bytes the transport wrote to this stream (the request ADU).</summary>
+        public byte[] Written => _written.ToArray();
+
+        public override bool CanRead => true;
+        public override bool CanSeek => false;
+        public override bool CanWrite => true;
+        public override long Length => throw new NotSupportedException();
+        public override long Position { get => throw new NotSupportedException(); set => throw new NotSupportedException(); }
+
+        public override async ValueTask<int> ReadAsync(Memory<byte> buffer, CancellationToken ct = default)
+        {
+            if (_stall)
+            {
+                // Frozen gateway: never answer. Block until the per-op deadline (or caller) cancels.
+                var tcs = new TaskCompletionSource();
+                await using (ct.Register(() => tcs.TrySetCanceled(ct)))
+                    await tcs.Task.ConfigureAwait(false);
+                return 0; // unreachable — the await above always throws when cancelled
+            }
+
+            var remaining = _response.Length - _readPos;
+            if (remaining <= 0) return 0;
+            var n = Math.Min(remaining, buffer.Length);
+            _response.AsSpan(_readPos, n).CopyTo(buffer.Span);
+            _readPos += n;
+            return n;
+        }
+
+        public override async ValueTask WriteAsync(ReadOnlyMemory<byte> buffer, CancellationToken ct = default)
+        {
+            await _written.WriteAsync(buffer, ct).ConfigureAwait(false);
+        }
+
+        public override Task FlushAsync(CancellationToken ct) => Task.CompletedTask;
+        public override void Flush() { }
+        public override int Read(byte[] buffer, int offset, int count) => throw new NotSupportedException();
+        public override void Write(byte[] buffer, int offset, int count) => throw new NotSupportedException();
+        public override long Seek(long offset, SeekOrigin origin) => throw new NotSupportedException();
+        public override void SetLength(long value) => throw new NotSupportedException();
+    }
+}
@@ -0,0 +1,33 @@
+using Shouldly;
+using Xunit;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.Modbus.Tests;
+
+/// <summary>
+///     Pins the socket-lifecycle surface extracted from <see cref="ModbusTcpTransport"/> into the
+///     reusable <see cref="ModbusSocketLifecycle"/> (Task 3). The clamp helper moved with it, and a
+///     connect to a dead port must still surface the underlying socket failure.
+/// </summary>
+[Trait("Category", "Unit")]
+public sealed class ModbusSocketLifecycleTests
+{
+    /// <summary>Verifies the whole-seconds clamp rounds sub-second/negative durations up to a minimum of one.</summary>
+    /// <param name="seconds">The input duration in seconds.</param>
+    /// <param name="expected">The expected clamped value in whole seconds.</param>
+    [Theory]
+    [InlineData(0.4, 1)]   // sub-second rounds up to 1 (the int-cast truncation guard)
+    [InlineData(2.0, 2)]
+    [InlineData(-5.0, 1)]  // negative clamps to 1
+    public void ClampToWholeSeconds_rounds_up_min_one(double seconds, int expected)
+        => ModbusSocketLifecycle.ClampToWholeSeconds(TimeSpan.FromSeconds(seconds)).ShouldBe(expected);
+
+    /// <summary>Verifies a connect to a dead port surfaces the underlying socket failure.</summary>
+    [Fact]
+    public async Task Connect_to_dead_port_surfaces_socket_failure()
+    {
+        var life = new ModbusSocketLifecycle("127.0.0.1", 1, TimeSpan.FromMilliseconds(300),
+            autoReconnect: false);
+        await Should.ThrowAsync<System.Net.Sockets.SocketException>(
+            life.ConnectAsync(TestContext.Current.CancellationToken));
+    }
+}
@@ -0,0 +1,47 @@
+using System.Text.Json;
+using System.Text.Json.Serialization;
+using Shouldly;
+using Xunit;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.Modbus.Tests;
+
+public sealed class ModbusTransportConfigRoundTripTests
+{
+    // Mirrors the AdminUI ModbusDriverForm serializer: camelCase + string enums.
+    private static readonly JsonSerializerOptions _adminOpts = new()
+    {
+        PropertyNamingPolicy = JsonNamingPolicy.CamelCase,
+        Converters = { new JsonStringEnumConverter() },
+    };
+
+    [Fact]
+    public void Transport_serializes_as_a_string_not_a_number()
+    {
+        var opts = new ModbusDriverOptions { Host = "10.20.0.50", Port = 4001, Transport = ModbusTransportMode.RtuOverTcp };
+        var json = JsonSerializer.Serialize(opts, _adminOpts);
+        json.ShouldContain("\"transport\":\"RtuOverTcp\"");
+        json.ShouldNotContain("\"transport\":1", Case.Sensitive);
+    }
+
+    [Fact]
+    public void Factory_binds_RtuOverTcp_from_string_config()
+    {
+        const string json = """{ "host": "10.20.0.50", "port": 4001, "transport": "RtuOverTcp" }""";
+        using var driver = ModbusDriverFactoryExtensions.CreateInstance("mb-rtu", json);
+        var opts = (ModbusDriverOptions)typeof(ModbusDriver)
+            .GetField("_options", System.Reflection.BindingFlags.NonPublic | System.Reflection.BindingFlags.Instance)!
+            .GetValue(driver)!;
+        opts.Transport.ShouldBe(ModbusTransportMode.RtuOverTcp);
+    }
+
+    [Fact]
+    public void Factory_defaults_Transport_to_Tcp_when_omitted()
+    {
+        const string json = """{ "host": "10.0.0.10" }""";
+        using var driver = ModbusDriverFactoryExtensions.CreateInstance("mb-tcp", json);
+        var opts = (ModbusDriverOptions)typeof(ModbusDriver)
+            .GetField("_options", System.Reflection.BindingFlags.NonPublic | System.Reflection.BindingFlags.Instance)!
+            .GetValue(driver)!;
+        opts.Transport.ShouldBe(ModbusTransportMode.Tcp);
+    }
+}
@@ -0,0 +1,27 @@
+using Shouldly;
+using Xunit;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.Modbus.Tests;
+
+public sealed class ModbusTransportFactoryTests
+{
+    [Fact]
+    public void Tcp_mode_builds_tcp_transport()
+        => ModbusTransportFactory.Create(new ModbusDriverOptions { Transport = ModbusTransportMode.Tcp })
+            .ShouldBeOfType<ModbusTcpTransport>();
+
+    [Fact]
+    public void RtuOverTcp_mode_builds_rtu_transport()
+        => ModbusTransportFactory.Create(new ModbusDriverOptions { Transport = ModbusTransportMode.RtuOverTcp })
+            .ShouldBeOfType<ModbusRtuOverTcpTransport>();
+
+    [Fact]
+    public void Default_options_build_tcp_transport()
+        => ModbusTransportFactory.Create(new ModbusDriverOptions())
+            .ShouldBeOfType<ModbusTcpTransport>();
+
+    [Fact]
+    public void Unknown_transport_mode_throws()
+        => Should.Throw<ArgumentOutOfRangeException>(
+            () => ModbusTransportFactory.Create(new ModbusDriverOptions { Transport = (ModbusTransportMode)999 }));
+}
@@ -0,0 +1,15 @@
+using Shouldly;
+using Xunit;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.Modbus.Tests;
+
+public sealed class ModbusTransportModeTests
+{
+    [Fact]
+    public void Tcp_is_the_default_zero_member()
+        => ((ModbusTransportMode)0).ShouldBe(ModbusTransportMode.Tcp);
+
+    [Fact]
+    public void Exactly_two_members_ship_in_v1()
+        => Enum.GetNames<ModbusTransportMode>().ShouldBe(["Tcp", "RtuOverTcp"]);
+}
@@ -0,0 +1,33 @@
+using Shouldly;
+using Xunit;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.Modbus.Tests;
+
+/// <summary>
+///     Confirms the driver's default transport-factory closure — and, by extension, the
+///     probe's transport construction — routes through <see cref="ModbusTransportFactory"/>
+///     instead of hardcoding <see cref="ModbusTcpTransport"/>, so an <c>RtuOverTcp</c>-authored
+///     config actually gets RTU framing rather than silently running as TCP/MBAP.
+/// </summary>
+[Trait("Category", "Unit")]
+public sealed class ModbusTransportWiringTests
+{
+    private static IModbusTransport BuildDefaultTransport(ModbusDriverOptions opts)
+    {
+        using var driver = new ModbusDriver(opts, "wire-test");
+        var factory = (Func<ModbusDriverOptions, IModbusTransport>)typeof(ModbusDriver)
+            .GetField("_transportFactory", System.Reflection.BindingFlags.NonPublic | System.Reflection.BindingFlags.Instance)!
+            .GetValue(driver)!;
+        return factory(opts);
+    }
+
+    [Fact]
+    public void Default_closure_builds_rtu_transport_for_RtuOverTcp()
+        => BuildDefaultTransport(new ModbusDriverOptions { Transport = ModbusTransportMode.RtuOverTcp })
+            .ShouldBeOfType<ModbusRtuOverTcpTransport>();
+
+    [Fact]
+    public void Default_closure_builds_tcp_transport_for_Tcp()
+        => BuildDefaultTransport(new ModbusDriverOptions())
+            .ShouldBeOfType<ModbusTcpTransport>();
+}
@@ -1,204 +0,0 @@
-using System.Data;
-using System.Data.Common;
-
-namespace ZB.MOM.WW.OtOpcUa.Driver.Sql.Browser.Tests;
-
-/// <summary>
-///     Records how many command executions are ever in flight at once, and how long each one is artificially
-///     held open. Shared by <see cref="ConcurrencyProbingDbConnection"/> and the commands it creates.
-/// </summary>
-/// <remarks>
-///     This exists because "the session serializes on a gate" is otherwise unfalsifiable from the outside:
-///     against a real SQLite connection, overlapping calls mostly still *work*, so a test that only asserted
-///     correct results would pass with the gate deleted. Measuring the overlap directly is what makes the
-///     gate's removal visible.
-/// </remarks>
-public sealed class ConcurrencyProbe
-{
-    private int _inFlight;
-    private int _peak;
-
-    /// <summary>How long each command execution is held before it reaches the real provider.</summary>
-    public TimeSpan Delay { get; init; } = TimeSpan.FromMilliseconds(120);
-
-    /// <summary>The greatest number of executions observed in flight simultaneously.</summary>
-    public int Peak => Volatile.Read(ref _peak);
-
-    /// <summary>Marks the start of one command execution.</summary>
-    public void Enter()
-    {
-        var current = Interlocked.Increment(ref _inFlight);
-        int observed;
-        while (current > (observed = Volatile.Read(ref _peak)))
-        {
-            if (Interlocked.CompareExchange(ref _peak, current, observed) == observed) break;
-        }
-    }
-
-    /// <summary>Marks the end of one command execution.</summary>
-    public void Exit() => Interlocked.Decrement(ref _inFlight);
-}
-
-/// <summary>
-///     A pass-through <see cref="DbConnection"/> that hands out commands instrumented with a
-///     <see cref="ConcurrencyProbe"/>. Everything else delegates to the wrapped connection, so the code under
-///     test runs against a real SQLite catalog.
-/// </summary>
-/// <param name="inner">The real connection to delegate to. Not owned — the caller disposes it.</param>
-/// <param name="probe">The probe that observes command overlap.</param>
-public sealed class ConcurrencyProbingDbConnection(DbConnection inner, ConcurrencyProbe probe) : DbConnection
-{
-    /// <inheritdoc />
-    [System.Diagnostics.CodeAnalysis.AllowNull]
-    public override string ConnectionString
-    {
-        get => inner.ConnectionString;
-        set => inner.ConnectionString = value!;
-    }
-
-    /// <inheritdoc />
-    public override string Database => inner.Database;
-
-    /// <inheritdoc />
-    public override string DataSource => inner.DataSource;
-
-    /// <inheritdoc />
-    public override string ServerVersion => inner.ServerVersion;
-
-    /// <inheritdoc />
-    public override ConnectionState State => inner.State;
-
-    /// <inheritdoc />
-    public override void ChangeDatabase(string databaseName) => inner.ChangeDatabase(databaseName);
-
-    /// <inheritdoc />
-    public override void Close() => inner.Close();
-
-    /// <inheritdoc />
-    public override void Open() => inner.Open();
-
-    /// <inheritdoc />
-    protected override DbTransaction BeginDbTransaction(IsolationLevel isolationLevel) =>
-        inner.BeginTransaction(isolationLevel);
-
-    /// <inheritdoc />
-    protected override DbCommand CreateDbCommand() =>
-        new ConcurrencyProbingDbCommand(inner.CreateCommand(), this, probe);
-}
-
-/// <summary>
-///     A pass-through <see cref="DbCommand"/> that reports every execution to a <see cref="ConcurrencyProbe"/>
-///     and holds it open for the probe's delay, so overlapping executions are observable.
-/// </summary>
-/// <param name="inner">The real command to delegate to.</param>
-/// <param name="owner">The connection that created this command.</param>
-/// <param name="probe">The probe that observes command overlap.</param>
-public sealed class ConcurrencyProbingDbCommand(DbCommand inner, DbConnection owner, ConcurrencyProbe probe)
-    : DbCommand
-{
-    /// <inheritdoc />
-    [System.Diagnostics.CodeAnalysis.AllowNull]
-    public override string CommandText
-    {
-        get => inner.CommandText;
-        set => inner.CommandText = value!;
-    }
-
-    /// <inheritdoc />
-    public override int CommandTimeout
-    {
-        get => inner.CommandTimeout;
-        set => inner.CommandTimeout = value;
-    }
-
-    /// <inheritdoc />
-    public override CommandType CommandType
-    {
-        get => inner.CommandType;
-        set => inner.CommandType = value;
-    }
-
-    /// <inheritdoc />
-    public override bool DesignTimeVisible
-    {
-        get => inner.DesignTimeVisible;
-        set => inner.DesignTimeVisible = value;
-    }
-
-    /// <inheritdoc />
-    public override UpdateRowSource UpdatedRowSource
-    {
-        get => inner.UpdatedRowSource;
-        set => inner.UpdatedRowSource = value;
-    }
-
-    /// <inheritdoc />
-    protected override DbConnection? DbConnection
-    {
-        get => owner;
-        set { /* The session never reassigns the connection; the wrapped command keeps its own. */ }
-    }
-
-    /// <inheritdoc />
-    protected override DbParameterCollection DbParameterCollection => inner.Parameters;
-
-    /// <inheritdoc />
-    protected override DbTransaction? DbTransaction
-    {
-        get => inner.Transaction;
-        set => inner.Transaction = value;
-    }
-
-    /// <inheritdoc />
-    public override void Cancel() => inner.Cancel();
-
-    /// <inheritdoc />
-    public override int ExecuteNonQuery() => inner.ExecuteNonQuery();
-
-    /// <inheritdoc />
-    public override object? ExecuteScalar() => inner.ExecuteScalar();
-
-    /// <inheritdoc />
-    public override void Prepare() => inner.Prepare();
-
-    /// <inheritdoc />
-    protected override DbParameter CreateDbParameter() => inner.CreateParameter();
-
-    /// <inheritdoc />
-    protected override DbDataReader ExecuteDbDataReader(CommandBehavior behavior)
-    {
-        probe.Enter();
-        try
-        {
-            Thread.Sleep(probe.Delay);
-            return inner.ExecuteReader(behavior);
-        }
-        finally
-        {
-            probe.Exit();
-        }
-    }
-
-    /// <inheritdoc />
-    protected override async Task<DbDataReader> ExecuteDbDataReaderAsync(
-        CommandBehavior behavior, CancellationToken cancellationToken)
-    {
-        probe.Enter();
-        try
-        {
-            await Task.Delay(probe.Delay, cancellationToken).ConfigureAwait(false);
-            return await inner.ExecuteReaderAsync(behavior, cancellationToken).ConfigureAwait(false);
-        }
-        finally
-        {
-            probe.Exit();
-        }
-    }
-
-    /// <inheritdoc />
-    protected override void Dispose(bool disposing)
-    {
-        if (disposing) inner.Dispose();
-        base.Dispose(disposing);
-    }
-}
@@ -1,128 +0,0 @@
-using Shouldly;
-using Xunit;
-
-namespace ZB.MOM.WW.OtOpcUa.Driver.Sql.Browser.Tests;
-
-/// <summary>
-///     Pins the browse NodeId encoding. This codec is the load-bearing detail of the whole picker: a NodeId
-///     that mis-parses sends the operator to a different column than the one they clicked, and the resulting
-///     tag polls the wrong data forever with no error anywhere. SQL Server identifiers may legally contain
-///     <c>.</c> and <c>|</c> (inside a quoted identifier), so the round-trip has to hold for those too.
-/// </summary>
-public sealed class SqlBrowseNodeIdTests
-{
-    [Fact]
-    public void ForSchema_roundTrips()
-    {
-        var reference = SqlBrowseNodeId.Parse(SqlBrowseNodeId.ForSchema("dbo"));
-
-        reference.Kind.ShouldBe(SqlBrowseNodeKind.Schema);
-        reference.Schema.ShouldBe("dbo");
-        reference.Table.ShouldBeNull();
-        reference.Column.ShouldBeNull();
-    }
-
-    [Fact]
-    public void ForTable_roundTrips()
-    {
-        var reference = SqlBrowseNodeId.Parse(SqlBrowseNodeId.ForTable("dbo", "TagValues"));
-
-        reference.Kind.ShouldBe(SqlBrowseNodeKind.Table);
-        reference.Schema.ShouldBe("dbo");
-        reference.Table.ShouldBe("TagValues");
-        reference.Column.ShouldBeNull();
-    }
-
-    [Fact]
-    public void ForColumn_roundTrips()
-    {
-        var reference = SqlBrowseNodeId.Parse(SqlBrowseNodeId.ForColumn("dbo", "TagValues", "num_value"));
-
-        reference.Kind.ShouldBe(SqlBrowseNodeKind.Column);
-        reference.Schema.ShouldBe("dbo");
-        reference.Table.ShouldBe("TagValues");
-        reference.Column.ShouldBe("num_value");
-    }
-
-    /// <summary>
-    ///     The exact case the plan's <c>schema.table|column</c> sketch cannot express: <c>main.a.b|c</c> reads
-    ///     equally as schema <c>main</c> + table <c>a.b</c> and as schema <c>main.a</c> + table <c>b</c>.
-    /// </summary>
-    [Theory]
-    [InlineData("a.b", "c", "d")]
-    [InlineData("a", "b.c", "d")]
-    [InlineData("a", "b", "c.d")]
-    [InlineData("a|b", "c", "d")]
-    [InlineData("a", "b|c", "d")]
-    [InlineData("a", "b", "c|d")]
-    [InlineData(@"a\b", "c", "d")]
-    [InlineData("a", @"b\|c", "d")]
-    [InlineData("a", "b", @"c\\d")]
-    [InlineData("a.b|c", "d.e|f", "g.h|i")]
-    [InlineData("schema", "table", "column")]
-    [InlineData("x:y", "z:w", "q:r")]
-    public void AwkwardIdentifiers_roundTripExactly(string schema, string table, string column)
-    {
-        var reference = SqlBrowseNodeId.Parse(SqlBrowseNodeId.ForColumn(schema, table, column));
-
-        reference.Kind.ShouldBe(SqlBrowseNodeKind.Column);
-        reference.Schema.ShouldBe(schema);
-        reference.Table.ShouldBe(table);
-        reference.Column.ShouldBe(column);
-    }
-
-    /// <summary>
-    ///     Two genuinely different columns must never collide on one NodeId. Under the plan's literal
-    ///     <c>schema.table|column</c> sketch both of these render as <c>a.b|c</c>.
-    /// </summary>
-    [Fact]
-    public void DistinctReferences_neverCollide()
-    {
-        var nested = SqlBrowseNodeId.ForColumn("a.b", "t", "c");
-        var flat = SqlBrowseNodeId.ForColumn("a", "b.t", "c");
-
-        nested.ShouldNotBe(flat);
-        SqlBrowseNodeId.Parse(nested).Schema.ShouldBe("a.b");
-        SqlBrowseNodeId.Parse(flat).Schema.ShouldBe("a");
-    }
-
-    /// <summary>A table NodeId and a schema NodeId are never confusable, whatever the names contain.</summary>
-    [Fact]
-    public void KindsAreDistinguishable()
-    {
-        SqlBrowseNodeId.Parse(SqlBrowseNodeId.ForSchema("a|b")).Kind.ShouldBe(SqlBrowseNodeKind.Schema);
-        SqlBrowseNodeId.Parse(SqlBrowseNodeId.ForTable("a", "b")).Kind.ShouldBe(SqlBrowseNodeKind.Table);
-        SqlBrowseNodeId.ForSchema("a|b").ShouldNotBe(SqlBrowseNodeId.ForTable("a", "b"));
-    }
-
-    [Theory]
-    [InlineData(null)]
-    [InlineData("")]
-    [InlineData("   ")]
-    [InlineData("main")]                 // no kind prefix
-    [InlineData("bogus:main")]           // unknown kind
-    [InlineData("table:main")]           // table kind with only one part
-    [InlineData("schema:main|extra")]    // schema kind with two parts
-    [InlineData("column:a|b")]           // column kind with two parts
-    [InlineData("column:a|b|c|d")]       // column kind with four parts
-    [InlineData("schema:")]              // empty part
-    [InlineData("table:main|")]          // empty trailing part
-    [InlineData(@"schema:main\")]        // dangling escape
-    [InlineData(":main")]                // empty kind
-    public void MalformedNodeIds_areRejected(string? nodeId)
-    {
-        SqlBrowseNodeId.TryParse(nodeId, out _).ShouldBeFalse();
-        Should.Throw<ArgumentException>(() => SqlBrowseNodeId.Parse(nodeId));
-    }
-
-    [Theory]
-    [InlineData(null)]
-    [InlineData("")]
-    [InlineData("  ")]
-    public void EmptyIdentifiers_areRejectedAtEncode(string? identifier)
-    {
-        Should.Throw<ArgumentException>(() => SqlBrowseNodeId.ForSchema(identifier!));
-        Should.Throw<ArgumentException>(() => SqlBrowseNodeId.ForTable("main", identifier!));
-        Should.Throw<ArgumentException>(() => SqlBrowseNodeId.ForColumn("main", "t", identifier!));
-    }
-}
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Joseph Doherty	ee12568cab	refactor(modbus-rtu): distinct CrcMismatch/UnitMismatch desync reasons v2-ci / build (pull_request) Successful in 4m1s Details v2-ci / unit-tests (pull_request) Failing after 13m33s Details The RTU framer overloaded DesyncReason.TruncatedFrame for three distinct failures — a genuine short read, a CRC-16 validation failure, and a CRC-valid reply from the wrong RS-485 slave. Split the latter two into dedicated CrcMismatch / UnitMismatch enum members so a future .Reason consumer (metrics, operator diagnostics) can tell a wiring/EMI CRC fault apart from a mis-addressed multi-drop reply. Behaviour is unchanged — all three still throw ModbusTransportDesyncException and tear the socket down. Framing tests now assert the specific Reason on each path. Follow-up #12 from the Modbus RTU-over-TCP plan. Claude-Session: https://claude.ai/code/session_01GASWkNEi68FSCtvr6rLoEW	2026-07-25 15:13:48 -04:00
Joseph Doherty	e27eb77187	docs(modbus-rtu): record Wave-1 RTU-over-TCP live /run gate result (PASSED) v2-ci / build (pull_request) Successful in 3m45s Details v2-ci / unit-tests (pull_request) Failing after 13m54s Details Claude-Session: https://claude.ai/code/session_01GASWkNEi68FSCtvr6rLoEW	2026-07-24 15:50:10 -04:00
Joseph Doherty	fcc7ed698e	harden(modbus-rtu): factory throws on unknown transport + document RTU FC-shape assumption Claude-Session: https://claude.ai/code/session_01GASWkNEi68FSCtvr6rLoEW	2026-07-24 15:33:49 -04:00
Joseph Doherty	4a8c9badce	docs(modbus-rtu): note the co-running :5021 rtu_over_tcp fixture in Docker README + Dockerfile Claude-Session: https://claude.ai/code/session_01GASWkNEi68FSCtvr6rLoEW	2026-07-24 14:36:00 -04:00
Joseph Doherty	650e27075f	test(modbus-rtu): add rtu_over_tcp pymodbus fixture + RTU-over-TCP integration tests Claude-Session: https://claude.ai/code/session_01GASWkNEi68FSCtvr6rLoEW	2026-07-24 14:29:10 -04:00
Joseph Doherty	132e7b63f6	feat(modbus-rtu): add Transport selector to the AdminUI Modbus driver form Claude-Session: https://claude.ai/code/session_01GASWkNEi68FSCtvr6rLoEW	2026-07-24 14:19:15 -04:00
Joseph Doherty	13bd9820b0	feat(modbus-rtu): route driver + probe transports through ModbusTransportFactory Claude-Session: https://claude.ai/code/session_01GASWkNEi68FSCtvr6rLoEW	2026-07-24 14:12:12 -04:00
Joseph Doherty	1d90bf3611	feat(modbus-rtu): add ModbusTransportFactory switch on Transport mode Claude-Session: https://claude.ai/code/session_01GASWkNEi68FSCtvr6rLoEW	2026-07-24 14:08:10 -04:00
Joseph Doherty	20be5416b9	feat(modbus-rtu): bind Transport mode on options/DTO/factory (string-enum guard) Claude-Session: https://claude.ai/code/session_01GASWkNEi68FSCtvr6rLoEW	2026-07-24 14:04:34 -04:00
Joseph Doherty	47e9cd56ef	feat(modbus-rtu): add ModbusRtuOverTcpTransport (RTU framing over socket lifecycle) Claude-Session: https://claude.ai/code/session_01GASWkNEi68FSCtvr6rLoEW	2026-07-24 13:56:19 -04:00
Joseph Doherty	2f38b5b285	refactor(modbus): extract ModbusSocketLifecycle from ModbusTcpTransport (behaviour-preserving) Claude-Session: https://claude.ai/code/session_01GASWkNEi68FSCtvr6rLoEW	2026-07-24 13:47:18 -04:00
Joseph Doherty	20100c36ad	feat(modbus-rtu): validate response unit + cover partial-read/truncation in ModbusRtuFraming Claude-Session: https://claude.ai/code/session_01GASWkNEi68FSCtvr6rLoEW	2026-07-24 13:42:25 -04:00
Joseph Doherty	eed6617784	feat(modbus-rtu): add ModbusRtuFraming (ADU build + FC-aware length-less deframe) Claude-Session: https://claude.ai/code/session_01GASWkNEi68FSCtvr6rLoEW	2026-07-24 13:33:59 -04:00
Joseph Doherty	8d0f60ec51	feat(modbus-rtu): add ModbusCrc CRC-16/MODBUS helper + golden vectors Claude-Session: https://claude.ai/code/session_01GASWkNEi68FSCtvr6rLoEW	2026-07-24 13:30:05 -04:00
Joseph Doherty	e787aa572b	feat(modbus-rtu): add ModbusTransportMode enum (Tcp \| RtuOverTcp) Claude-Session: https://claude.ai/code/session_01GASWkNEi68FSCtvr6rLoEW	2026-07-24 13:28:30 -04:00