Phase 3 PR 45 -- DL205 string byte-order quirk (low-byte-first ASCII packing). Adds ModbusStringByteOrder enum {HighByteFirst, LowByteFirst} + StringByteOrder field on ModbusTagDefinition (default HighByteFirst, the standard Modbus convention). DecodeRegister + EncodeRegister String branches now respect per-tag byte order. Under LowByteFirst each register packs the first char in the low byte instead of the high byte -- the AutomationDirect DirectLOGIC DL205/DL260/DL350 family's headline string quirk. Without the flag the driver decodes 'eHllo' garbage from HR[1040..1042] even though wire bytes are identical. Unit tests: String_LowByteFirst_decodes_DL205_packed_Hello (5 chars across 3 regs with nul pad), String_LowByteFirst_decode_truncates_at_first_nul, String_LowByteFirst_encode_round_trips_with_decode (asserts exact DL205-documented byte sequence {0x65,0x48,0x6C,0x6C,0x00,0x6F} + symmetric encode->decode), String_HighByteFirst_and_LowByteFirst_differ_on_same_wire (control: same wire, different flag => different decode). 56/56 Modbus.Tests pass. Integration test: DL205StringQuirkTests.DL205_string_low_byte_first_decodes_Hello_from_HR1040 against the dl205.json pymodbus profile; reads HR[1040..1042] with both flags on the same tag map and asserts LowByteFirst='Hello' + HighByteFirst!='Hello'. Gated on MODBUS_SIM_PROFILE=dl205 since the standard profile doesn't seed HR[1040..1042]. Verified 2/2 integration tests pass against running pymodbus dl205 simulator. Baseline for PR 46 (BCD decoder), PR 47 (V-memory octal helper), PR 48 (CDAB float order), PR 49 (FC03/FC16 per-device caps) -- each lands its own DL205_<behavior> test class in tests/.../DL205/.

Three substantive issues caught + fixed during the validation pass:
1. pymodbus rejects unknown keys at device-list / setup level. My PR 43 commit had `_layout_note`, `_uint16_layout`, `_bits_layout`, `_write_note` device-level JSON-comment fields that crashed pymodbus startup with `INVALID key in setup`. Removed all device-level _* fields. Inline `_quirk` keys WITHIN individual register entries are tolerated by pymodbus 3.13.0 — kept those in dl205.json since they document the byte math per quirk and the README + git history aren't enough context for a hand-author reading raw integer values. Documented the constraint in the top-level _comment of each profile.
2. pymodbus rejects sweeping `write` ranges that include any cell not assigned a type. My initial standard.json had `write: [[0, 2047]]` but only seeded HR[0..31] + HR[100] + HR[200..209] + bits[1024..1109] — pymodbus blew up on cell 32 (gap between HR[31] and HR[100]). Fixed by listing per-block write ranges that exactly mirror the seeded ranges. Same fix in dl205.json (was `[[0, 16383]]`).
3. pymodbus simulator stores all 4 standard Modbus tables in ONE underlying cell array — each cell can only be typed once (BITS or UINT16, not both). My initial standard.json had `bits[0..31]` AND `uint16[0..31]` overlapping at the same addresses; pymodbus crashed with `ERROR "uint16" <Cell> used`. Fixed by relocating coils to address 1024+, well clear of the uint16 entries at 0..209. Documented the layout constraint in the standard.json top-level _comment.
Substantive driver bug fixed: ModbusTcpTransport.ConnectAsync was using `new TcpClient()` (default constructor — dual-stack, IPv6 first) then `ConnectAsync(host, port)` with the user's hostname. .NET's TcpClient default-resolves "localhost" to ::1 first, fails to connect to pymodbus (which binds 0.0.0.0 IPv4-only), and only then retries IPv4 — the failure surfaces as the entire ConnectAsync timeout (2s by default) before the IPv4 attempt even starts. PR 30's smoke test silently SKIPPED because the fixture's TCP probe hit the same dual-stack ordering and timed out. Both fixed: ModbusSimulatorFixture probe now resolves Dns.GetHostAddresses, prefers AddressFamily.InterNetwork, dials IPv4 explicitly. ModbusTcpTransport does the same — resolves first, prefers IPv4, falls back to whatever Dns returns (handles IPv6-only hosts in the future). This is a real production-readiness fix because most Modbus PLCs are IPv4-only — a generic dual-stack TcpClient would burn the entire connect timeout against any IPv4-only PLC, masquerading as a connection failure when the PLC is actually fine.
Smoke-test address shifted HR[100] -> HR[200]. Standard.json's HR[100] is the auto-incrementing register that drives subscribe-and-receive tests, so write-then-read against it would race the increment. HR[200] is the first cell of a writable scratch range present in BOTH simulator profiles. DL205Profile.cs xml-doc updated to explain the shift; tag name "DL205_Smoke_HReg100" -> "Smoke_HReg200" + smoke test references updated. dl205.json gains a matching scratch HR[200..209] range so the smoke test runs identically against either profile.
Validation matrix:
- standard.json boot: clean (TCP 5020 listening within ~3s of pymodbus.simulator launch).
- dl205.json boot: clean.
- pymodbus client direct FC06 to HR[200]=1234 + FC03 read: round-trip OK.
- raw-bytes PowerShell TcpClient FC06 + 12-byte response: matches FC06 spec (echo of address + value).
- DL205SmokeTest against standard.json: 1/1 pass (was failing as 'BadInternalError' due to the dual-stack timeout + tag-name typo — both fixed).
- DL205SmokeTest against dl205.json: 1/1 pass.
- Modbus.Tests Unit suite: 52/52 pass — dual-stack transport fix is non-breaking.
- Solution build clean.
Memory + future-PR setup: pymodbus install + activation pattern is now bullet-pointed at the top of Pymodbus/README.md so future PRs (the per-quirk DL205_<behavior> tests in PR 44+) don't have to repeat the trial-and-error of getting the simulator + integration tests cooperating. The three bugs above are documented inline in the JSON profiles + ModbusTcpTransport so they don't bite again.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.gitignore

@@ -29,3 +29,4 @@ packages/
 # Claude Code (per-developer settings, runtime lock files, agent transcripts)
 .claude/
 
+.local/

ZB.MOM.WW.OtOpcUa.slnx

@@ -21,6 +21,7 @@
         <Project Path="tests/ZB.MOM.WW.OtOpcUa.Admin.Tests/ZB.MOM.WW.OtOpcUa.Admin.Tests.csproj"/>
         <Project Path="tests/ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Shared.Tests/ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Shared.Tests.csproj"/>
         <Project Path="tests/ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Host.Tests/ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Host.Tests.csproj"/>
+        <Project Path="tests/ZB.MOM.WW.OtOpcUa.Driver.Galaxy.TestSupport/ZB.MOM.WW.OtOpcUa.Driver.Galaxy.TestSupport.csproj"/>
         <Project Path="tests/ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Proxy.Tests/ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Proxy.Tests.csproj"/>
         <Project Path="tests/ZB.MOM.WW.OtOpcUa.Driver.Galaxy.E2E/ZB.MOM.WW.OtOpcUa.Driver.Galaxy.E2E.csproj"/>
         <Project Path="tests/ZB.MOM.WW.OtOpcUa.Driver.Modbus.Tests/ZB.MOM.WW.OtOpcUa.Driver.Modbus.Tests.csproj"/>

docs/v2/dl205.md

@@ -0,0 +1,295 @@
+# AutomationDirect DirectLOGIC DL205 / DL260 — Modbus quirks
+
+AutomationDirect's DirectLOGIC DL205 family (D2-250-1, D2-260, D2-262, D2-262M) and
+its larger DL260 sibling speak Modbus TCP (via the H2-ECOM100 / H2-EBC100 Ethernet
+coprocessors, and the DL260's built-in Ethernet port) and Modbus RTU (via the CPU
+serial ports in "Modbus" mode). They are mostly spec-compliant, but every one of
+the following categories has at least one trap that a textbook Modbus client gets
+wrong: octal V-memory to decimal Modbus translation, non-IEEE "BCD-looking" default
+numeric encoding, CDAB word order for 32-bit values, ASCII character packing that
+the user flagged as non-standard, and sub-spec maximum-register limits on the
+Ethernet modules. This document catalogues each quirk, cites primary sources, and
+names the ModbusPal integration test we'd write for it (convention from
+`docs/v2/modbus-test-plan.md`: `DL205_<behavior>`).
+
+## Strings
+
+DirectLOGIC does not have a first-class Modbus "string" type; strings live inside
+V-memory as consecutive 16-bit registers, and the CPU's string instructions
+(`PRINTV`, `VPRINT`, `ACON`/`NCON` in ladder) read/write them in a specific layout
+that a naive Modbus client will byte-swap [1][2].
+
+- **Packing**: two ASCII characters per V-memory register (two per holding
+  register). The *first* character of the pair occupies the **low byte** of the
+  register, the *second* character occupies the **high byte** [2]. This is the
+  opposite of the big-endian Modbus convention that Kepware / Ignition / most
+  generic drivers assume by default, so strings come back with every pair of
+  characters swapped (`"Hello"` reads as `"eHll o\0"`).
+- **Termination**: null-terminated (`0x00` in the character byte). There is no
+  length prefix. Writes must pad the final register's unused byte with `0x00`.
+- **Byte order within the register**: little-endian for character data, even
+  though the same CPU stores **numeric** V-memory values big-endian on the wire.
+  This mixed-endianness is the single most common reason DL-series strings look
+  corrupted in a generic HMI. Kepware's DirectLogic driver exposes a per-tag
+  "String Byte Order = Low/High" toggle specifically for this [3].
+- **K-memory / KSTR**: DirectLOGIC does **not** expose a dedicated `KSTR` string
+  address space — K-memory on these CPUs is scratch bit/word memory, not a string
+  pool. Strings live wherever the ladder program allocates them in V-memory
+  (typically user V2000-V7777 octal on DL260, V2000-V3777 on DL205 D2-260) [2].
+- **Maximum length**: bounded only by the V-memory region assigned. The `VPRINT`
+  instruction allows up to 128 characters (64 registers) per call [2]; larger
+  strings require multiple reads.
+- **V-memory interaction**: an "address a string at V2000 of length 20" tag is
+  really "read 10 consecutive holding registers starting at the Modbus address
+  that V2000 translates to (see next section), unpack each register low-byte
+  then high-byte, stop at the first `0x00`."
+
+Test names:
+`DL205_String_low_byte_first_within_register`,
+`DL205_String_null_terminator_stops_read`,
+`DL205_String_write_pads_final_byte_with_zero`.
+
+## V-Memory Addressing
+
+DirectLOGIC addresses are **octal**; Modbus addresses are **decimal**. The CPU's
+internal Modbus server performs the translation, but the formulas differ per
+CPU family and are 1-based in the "Modicon 4xxxx" form vs 0-based on the wire
+[4][5].
+
+Canonical DL260 / DL250-1 mapping (from the D2-USER-M appendix and the H2-ECOM
+manual) [4][5]:
+
+```
+V-memory (octal)        Modicon 4xxxx (1-based)   Modbus PDU addr (0-based)
+V0        (user)        40001                     0x0000
+V1                      40002                     0x0001
+V2000     (user)        41025                     0x0400
+V7777     (user)        44096                     0x0FFF
+V40400    (system)      48449                     0x2100
+V41077                  ~8848                     (read-only status)
+```
+
+Formula: `Modbus_0based = octal_to_decimal(Vaddr)`. So `V2000` octal = `1024`
+decimal = Modbus PDU address `0x0400`. The "4xxxx" Modicon view just adds 1 and
+prefixes the register bank digit.
+
+- **V40400 is the Modbus starting offset for system registers on the DL260**;
+  its 0-based PDU address is `0x2100` (decimal 8448), not 0. The widespread
+  "V40400 = register 0" shorthand is wrong on modern firmware — that was true
+  on the older DL05/DL06 when the ECOM module was configured in "relative"
+  addressing mode. On the H2-ECOM100 factory default ("absolute" mode), V40400
+  maps to 0x2100 [5].
+- **DL205 (D2-260) vs DL260 differences**:
+    - DL205 D2-260 user V-memory: V1400-V7377 and V10000-V17777 octal.
+    - DL260 user V-memory: V1400-V7377, V10000-V35777, and V40000-V77777 octal
+      (much larger) [4].
+    - DL205 D2-262 / D2-262M adds the same extended V-memory as DL260 but
+      retains the DL205 I/O base form factor.
+    - Neither DL205 sub-model changes the *formula* — only the valid range.
+- **Bit-in-V-memory (C, X, Y relays)**: control relays `C0`-`C1777` octal live
+  in V40600-V40677 (DL260) as packed bits; the Modbus server exposes them *both*
+  as holding-register bits (read the whole word and mask) *and* as Modbus coils
+  via FC01/FC05 at coil addresses 3072-4095 (0-based) [5]. `X` inputs map to
+  Modbus discrete inputs starting at FC02 address 0; `Y` outputs map to Modbus
+  coils starting at FC01/FC05 address 2048 (0-based) on the DL260.
+- **Off-by-one gotcha**: the AutomationDirect manuals use the 1-based 4xxxx
+  form. Kepware, libmodbus, pymodbus, and the .NET stack all take the 0-based
+  PDU form. When the manual says "V2000 = 41025" you send `0x0400`, not
+  `0x0401`.
+
+Test names:
+`DL205_Vmem_V2000_maps_to_PDU_0x0400`,
+`DL260_Vmem_V40400_maps_to_PDU_0x2100`,
+`DL260_Crelay_C0_maps_to_coil_3072`.
+
+## Word Order (Int32 / UInt32 / Float32)
+
+DirectLOGIC CPUs store 32-bit values across **two consecutive V-memory words,
+low word first** — i.e., `CDAB` when viewed as a Modbus register pair [1][3].
+Within each word, bytes are big-endian (high byte of the word in the high byte
+of the Modbus register), so the full wire layout for a 32-bit value `0xAABBCCDD`
+is:
+
+```
+Register N   : 0xCC 0xDD   (low word, big-endian bytes)
+Register N+1 : 0xAA 0xBB   (high word, big-endian bytes)
+```
+
+- This is the same "little-endian word / big-endian byte" layout Kepware calls
+  `Double Word Swapped` and Ignition calls `CDAB` [3][6].
+- **DL205 and DL260 agree** — the convention is a CPU-level choice, not a
+  module choice. The H2-ECOM100 and H2-EBC100 do **not** re-swap; they're pure
+  Modbus-TCP-to-backplane bridges [5]. The DL260 built-in Ethernet port
+  behaves identically.
+- **Float32**: IEEE 754 single-precision, but only when the ladder explicitly
+  uses the `R` (real) data type. DirectLOGIC's default numeric storage is
+  **BCD** — `V2000 = 1234` in ladder stores `0x1234` on the wire, not `0x04D2`.
+  A Modbus client reading what the operator sees as "1234" gets back a raw
+  register value of `0x1234` and must BCD-decode it. Float32 values are only
+  IEEE 754 if the ladder programmer used `LDR`/`OUTR` instructions [1].
+- **Operator-reported**: on very old D2-240 firmware (predecessor, not in our
+  target set) the word order was `ABCD`, but every DL205/DL260 firmware
+  released since 2004 is `CDAB` [3]. _Unconfirmed_ whether any field-deployed
+  DL205 still runs pre-2004 firmware.
+
+Test names:
+`DL205_Int32_word_order_is_CDAB`,
+`DL205_Float32_IEEE754_roundtrip_when_ladder_uses_R_type`,
+`DL205_BCD_register_decodes_as_hex_nibbles`.
+
+## Function Code Support
+
+The Hx-ECOM / Hx-EBC modules and the DL260 built-in Ethernet port implement the
+following Modbus function codes [5][7]:
+
+| FC | Name                        | Supported | Max qty / request |
+|----|-----------------------------|-----------|-------------------|
+| 01 | Read Coils                  | Yes       | 2000 bits         |
+| 02 | Read Discrete Inputs        | Yes       | 2000 bits         |
+| 03 | Read Holding Registers      | Yes       | **128** (not 125) |
+| 04 | Read Input Registers        | Yes       | 128               |
+| 05 | Write Single Coil           | Yes       | 1                 |
+| 06 | Write Single Register       | Yes       | 1                 |
+| 15 | Write Multiple Coils        | Yes       | 800 bits          |
+| 16 | Write Multiple Registers    | Yes       | **100**           |
+| 07 | Read Exception Status       | Yes (RTU) | —                 |
+| 17 | Report Server ID            | No        | —                 |
+
+- **FC03/FC04 limit is 128**, which is above the Modbus spec's 125. Requesting
+  129+ returns exception code `03` (Illegal Data Value) [5].
+- **FC16 limit is 100**, below the spec's 123. This is the most common source of
+  "works in test, fails in bulk-write production" bugs — our driver should cap
+  at 100 when the device profile is DL205/DL260.
+- **No custom function codes** are exposed on the Modbus port. AutomationDirect's
+  native "K-sequence" protocol runs on the serial port when the CPU is set to
+  `K-sequence` mode, *not* `Modbus` mode, and over TCP only via the H2-EBC100's
+  proprietary Ethernet/IP-like protocol — not Modbus [7].
+
+Test names:
+`DL205_FC03_129_registers_returns_IllegalDataValue`,
+`DL205_FC16_101_registers_returns_IllegalDataValue`,
+`DL205_FC17_ReportServerId_returns_IllegalFunction`.
+
+## Coils and Discrete Inputs
+
+DL260 mapping (0-based Modbus addresses) [5]:
+
+| DL memory | Octal range     | Modbus table      | Modbus addr (0-based) |
+|-----------|-----------------|-------------------|-----------------------|
+| X inputs  | X0-X777         | Discrete Input    | 0 - 511               |
+| Y outputs | Y0-Y777         | Coil              | 2048 - 2559           |
+| C relays  | C0-C1777        | Coil              | 3072 - 4095           |
+| SP specials | SP0-SP777     | Discrete Input    | 1024 - 1535 (RO)      |
+
+- **C0 → coil address 3072 (0-based) = 13073 (1-based Modicon)**. Y0 → coil
+  2048 = 12049. These offsets are wired into the CPU and cannot be remapped.
+- **Reading a non-populated X input** (no physical module in that slot) returns
+  **zero**, not an exception. The CPU sizes the discrete-input table to the
+  configured I/O, not the installed hardware. Confirmed in the DL260 user
+  manual's I/O configuration chapter [4].
+- **Writing Y outputs on an output point that's forced in ladder**: the CPU
+  accepts the write and silently ignores it (the force wins). No exception is
+  returned. _Operator-reported_, matches Kepware driver release notes [3].
+
+Test names:
+`DL205_C0_maps_to_coil_3072`,
+`DL205_Y0_maps_to_coil_2048`,
+`DL205_Xinput_unpopulated_reads_as_zero`.
+
+## Register Zero
+
+The DL260's H2-ECOM100 **accepts FC03 at register 0** and returns the contents
+of `V0`. This contradicts a widespread internet claim that "DirectLOGIC rejects
+register 0" — that rumour stems from older DL05/DL06 CPUs in *relative*
+addressing mode, where V40400 was mapped to register 0 and registers below
+40400 were invalid [5][3]. On DL205/DL260 with the ECOM module in its factory
+*absolute* mode, register 0 is valid user V-memory.
+
+- Our driver's `ModbusProbeOptions.ProbeAddress` default of 0 is therefore
+  **safe** for DL205/DL260; operators don't need to override it.
+- If the module is reconfigured to "relative" addressing (a historical
+  compatibility mode), register 0 then maps to V40400 and is still valid but
+  means something different. The probe will still succeed.
+
+Test name: `DL205_FC03_register_0_returns_V0_contents`.
+
+## Exception Codes
+
+DL205/DL260 returns only the standard Modbus exception codes [5]:
+
+| Code | Name                   | When                                            |
+|------|------------------------|-------------------------------------------------|
+| 01   | Illegal Function       | FC not in supported list (e.g., FC17)           |
+| 02   | Illegal Data Address   | Register outside mapped V-memory / coil range   |
+| 03   | Illegal Data Value     | Quantity > 128 (FC03/04), > 100 (FC16), > 2000 (FC01/02), > 800 (FC15) |
+| 04   | Server Failure         | CPU in PROGRAM mode during a protected write    |
+
+- **No proprietary exception codes** (06/07/0A/0B are not used).
+- **Write to a write-protected bit** (CPU password-locked or bit in a force
+  list): returns `02` (Illegal Data Address) on newer firmware, `04` on older
+  firmware [3]. _Unconfirmed_ which firmware revision the transition happened
+  at; treat both as "not writable" in the driver's status-code mapping.
+- **Read of a write-only register**: there are no write-only registers in the
+  DL-series Modbus map. Every writable register is also readable.
+
+Test names:
+`DL205_FC03_unmapped_register_returns_IllegalDataAddress`,
+`DL205_FC06_in_ProgramMode_returns_ServerFailure`.
+
+## Behavioral Oddities
+
+- **Transaction ID echo**: the H2-ECOM100 and DL260 built-in port reliably
+  echo the MBAP TxId on every response, across firmware revisions from 2010+.
+  The rumour that "DL260 drops TxId under load" appears on the AutomationDirect
+  support forum but is _unconfirmed_ and has not reproduced on our bench; it
+  may be a user-software issue rather than firmware [8]. Our driver's
+  single-flight + TxId-match guard handles it either way.
+- **Concurrency**: the ECOM serializes requests internally. Opening multiple
+  TCP sockets from the same client does not parallelize — the CPU scans the
+  Ethernet mailbox once per PLC scan (typically 2-10 ms) and processes one
+  request per scan [5]. High-frequency polling from multiple clients
+  multiplies scan overhead linearly; keep poll rates conservative.
+- **Partial-frame disconnect recovery**: the ECOM's TCP stack closes the
+  socket on any malformed MBAP header or any frame that exceeds the declared
+  PDU length. It does not resynchronize mid-stream. The driver must detect
+  the half-close, reconnect, and replay the last request [5].
+- **Keepalive**: the ECOM does **not** send TCP keepalives. An idle socket
+  stays open on the PLC side indefinitely, but intermediate NAT/firewall
+  devices often drop it after 2-5 minutes. Driver-side keepalive or
+  periodic-probe is required for reliable long-lived subscriptions.
+- **Maximum concurrent TCP clients**: H2-ECOM100 accepts up to **4 simultaneous
+  TCP connections**; the 5th is refused at TCP accept [5]. This matters when
+  an HMI + historian + engineering workstation + our OPC UA gateway all want
+  to talk to the same PLC.
+
+Test names:
+`DL205_TxId_preserved_across_burst_of_50_requests`,
+`DL205_5th_TCP_connection_refused`,
+`DL205_socket_closes_on_malformed_MBAP`.
+
+## References
+
+1. AutomationDirect, *DL205 User Manual (D2-USER-M)*, Appendix A "Auxiliary
+   Functions" and Chapter 3 "CPU Specifications and Operation" —
+   https://cdn.automationdirect.com/static/manuals/d2userm/d2userm.html
+2. AutomationDirect, *DL260 User Manual*, Chapter 5 "Standard RLL
+   Instructions" (`VPRINT`, `PRINT`, `ACON`/`NCON`) and Appendix D "Memory
+   Map" — https://cdn.automationdirect.com/static/manuals/d2userm/d2userm.html
+3. Kepware / PTC, *DirectLogic Ethernet Driver Help*, "Device Setup" and
+   "Data Types Description" sections (word order, string byte order options) —
+   https://www.kepware.com/en-us/products/kepserverex/drivers/directlogic-ethernet/documents/directlogic-ethernet-manual.pdf
+4. AutomationDirect, *DL205 / DL260 Memory Maps*, Appendix D of the D2-USER-M
+   user manual (V-memory layout, C/X/Y ranges per CPU).
+5. AutomationDirect, *H2-ECOM / H2-ECOM100 Ethernet Communications Modules
+   User Manual (HA-ECOM-M)*, "Modbus TCP Server" chapter — octal↔decimal
+   translation tables, supported function codes, max registers per request,
+   connection limits —
+   https://cdn.automationdirect.com/static/manuals/hxecomm/hxecomm.html
+6. Inductive Automation, *Ignition Modbus Driver — Address Mapping*, word
+   order options (ABCD/CDAB/BADC/DCBA) —
+   https://docs.inductiveautomation.com/docs/8.1/ignition-modules/opc-ua/drivers/modbus-v2
+7. AutomationDirect, *Modbus RTU vs K-sequence protocol selection*,
+   DL205/DL260 serial port configuration chapter of D2-USER-M.
+8. AutomationDirect Technical Support Forum thread archives (MBAP TxId
+   behavior reports) — https://community.automationdirect.com/ (search:
+   "ECOM100 transaction id"). _Unconfirmed_ operator reports only.

docs/v2/lmx-followups.md

@@ -7,25 +7,50 @@ Basic256Sha256 endpoints and alarms are observable through
 specific before the stack can fully replace the v1 deployment, in
 rough priority order.
 
-## 1. Proxy-side `IHistoryProvider` for `ReadAtTime` / `ReadEvents`
+## 1. Proxy-side `IHistoryProvider` for `ReadAtTime` / `ReadEvents` — **DONE (PRs 35 + 38)**
 
-**Status**: Host-side IPC shipped (PR 10 + PR 11). Proxy consumer not written.
+PR 35 extended `IHistoryProvider` with `ReadAtTimeAsync` + `ReadEventsAsync`
+(default throwing implementations so existing impls keep compiling), added the
+`HistoricalEvent` + `HistoricalEventsResult` records to `Core.Abstractions`,
+and implemented both methods in `GalaxyProxyDriver` on top of the PR 10 / PR 11
+IPC messages.
 
-PR 10 added `HistoryReadAtTimeRequest/Response` on the IPC wire and
-`MxAccessGalaxyBackend.HistoryReadAtTimeAsync` delegates to
-`HistorianDataSource.ReadAtTimeAsync`. PR 11 did the same for events
-(`HistoryReadEventsRequest/Response` + `GalaxyHistoricalEvent`). The Proxy
-side (`GalaxyProxyDriver`) doesn't call those yet — `Core.Abstractions.IHistoryProvider`
-only exposes `ReadRawAsync` + `ReadProcessedAsync`.
+PR 38 wired the OPC UA HistoryRead service-handler through
+`DriverNodeManager` by overriding `CustomNodeManager2`'s four per-kind hooks —
+`HistoryReadRawModified` / `HistoryReadProcessed` / `HistoryReadAtTime` /
+`HistoryReadEvents`. Each walks `nodesToProcess`, resolves the driver-side
+full reference from `NodeId.Identifier`, dispatches to the right
+`IHistoryProvider` method, and populates the paired results + errors lists
+(both must be set — the MasterNodeManager merges them and a Good result with
+an unset error slot serializes as `BadHistoryOperationUnsupported` on the
+wire). Historized variables gain `AccessLevels.HistoryRead` so the stack
+dispatches; the driver root folder gains `EventNotifiers.HistoryRead` so
+`HistoryReadEvents` can target it.
 
-**To do**:
-- Extend `IHistoryProvider` with `ReadAtTimeAsync(string, DateTime[], …)` and
-  `ReadEventsAsync(string?, DateTime, DateTime, int, …)`.
-- `GalaxyProxyDriver` calls the new IPC message kinds.
-- `DriverNodeManager` wires the new capability methods onto `HistoryRead`
-  `AtTime` + `Events` service handlers.
-- Integration test: OPC UA client calls `HistoryReadAtTime` / `HistoryReadEvents`,
-  value flows through IPC to the Host's `HistorianDataSource`, back to the client.
+Aggregate translation uses a small `MapAggregate` helper that handles
+`Average` / `Minimum` / `Maximum` / `Total` / `Count` (the enum surface the
+driver exposes) and returns null for unsupported aggregates so the handler
+can surface `BadAggregateNotSupported`. Raw+Processed+AtTime wrap driver
+samples as `HistoryData` in an `ExtensionObject`; Events emits a
+`HistoryEvent` with the standard BaseEventType field list (EventId /
+SourceName / Message / Severity / Time / ReceiveTime) — custom
+`SelectClause` evaluation is an explicit follow-up.
+
+**Tests**:
+
+- `DriverNodeManagerHistoryMappingTests` — 12 unit cases pinning
+  `MapAggregate`, `BuildHistoryData`, `BuildHistoryEvent`, `ToDataValue`.
+- `HistoryReadIntegrationTests` — 5 end-to-end cases drive a real OPC UA
+  client (`Session.HistoryRead`) against a fake `IHistoryProvider` driver
+  through the running stack. Covers raw round-trip, processed with Average
+  aggregate, unsupported aggregate → `BadAggregateNotSupported`, at-time
+  timestamp forwarding, and events field-list shape.
+
+**Deferred**:
+- Continuation-point plumbing via `Session.Save/RestoreHistoryContinuationPoint`.
+  Driver returns null continuations today so the pass-through is fine.
+- Per-`SelectClause` evaluation in HistoryReadEvents — clients that send a
+  custom field selection currently get the standard BaseEventType layout.
 
 ## 2. Write-gating by role — **DONE (PR 26)**
 
@@ -78,18 +103,51 @@ drive a full OPC UA session with username/password, then read an
 `IHostConnectivityProbe`-style "whoami" node to verify the role surfaced).
 That needs a test-only address-space node and is a separate PR.
 
-## 5. Full Galaxy live-service smoke test against the merged v2 stack
+## 5. Full Galaxy live-service smoke test against the merged v2 stack — **IN PROGRESS (PRs 36 + 37)**
 
-**Status**: Individual pieces have live smoke tests (PR 5 MXAccess, PR 13
-probe manager, PR 14 alarm tracker), but the full loop — OPC UA client →
-`OtOpcUaServer` → `GalaxyProxyDriver` (in-process) → named-pipe to
-Galaxy.Host subprocess → live MXAccess runtime → real Galaxy objects — has
-no single end-to-end smoke test.
+PR 36 shipped the prerequisites helper (`AvevaPrerequisites`) that probes
+every dependency a live smoke test needs and produces actionable skip
+messages.
 
-**To do**:
-- Test that spawns the full topology, discovers a deployed Galaxy object,
-  subscribes to one of its attributes, writes a value back, and asserts the
-  write round-tripped through MXAccess. Skip when ArchestrA isn't running.
+PR 37 shipped the live-stack smoke test project structure:
+`tests/Driver.Galaxy.Proxy.Tests/LiveStack/` with `LiveStackFixture` (connects
+to the *already-running* `OtOpcUaGalaxyHost` Windows service via named pipe;
+never spawns the Host process) and `LiveStackSmokeTests` covering:
+
+- Fixture initializes successfully (IPC handshake succeeds end-to-end).
+- Driver reports `DriverState.Healthy` post-handshake.
+- `DiscoverAsync` returns at least one variable from the live Galaxy.
+- `GetHostStatuses` reports at least one Platform/AppEngine host.
+- `ReadAsync` on a discovered variable round-trips through
+  Proxy → Host pipe → MXAccess → back without a BadInternalError.
+
+Shared secret + pipe name resolve from `OTOPCUA_GALAXY_SECRET` /
+`OTOPCUA_GALAXY_PIPE` env vars, falling back to reading the service's
+registry-stored Environment values (requires elevated test host).
+
+**PR 40** added the write + subscribe facts targeting
+`DelmiaReceiver_001.TestAttribute` (the writable Boolean UDA the dev Galaxy
+ships under TestMachine_001) — write-then-read with a 5s scan-window poll +
+restore-on-finally, and subscribe-then-write asserting both an initial-value
+OnDataChange and a post-write OnDataChange. PR 39 added the elevated-shell
+short-circuit so a developer running from an admin window gets an actionable
+skip instead of `UnauthorizedAccessException`.
+
+**Run the live tests** (from a NORMAL non-admin PowerShell):
+
+```powershell
+$env:OTOPCUA_GALAXY_SECRET = Get-Content C:\Users\dohertj2\Desktop\lmxopcua\.local\galaxy-host-secret.txt
+cd C:\Users\dohertj2\Desktop\lmxopcua
+dotnet test tests\ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Proxy.Tests --filter "FullyQualifiedName~LiveStackSmokeTests"
+```
+
+Expected: 7/7 pass against the running `OtOpcUaGalaxyHost` service.
+
+**Remaining for #5 in production-grade form**:
+- Confirm the suite passes from a non-elevated shell (operator action).
+- Add similar facts for an alarm-source attribute once `TestMachine_001` (or
+  a sibling) carries a deployed alarm condition — the current dev Galaxy's
+  TestAttribute isn't alarm-flagged.
 
 ## 6. Second driver instance on the same server — **DONE (PR 32)**
 

docs/v2/modbus-test-plan.md

@@ -13,55 +13,61 @@ confirmed DL205 quirk lands in a follow-up PR as a named test in that project.
 
 ## Harness
 
-**Chosen simulator: ModbusPal** (Java, scriptable). Rationale:
-- Scriptable enough to mimic device-specific behaviors (non-standard register
-  layouts, custom exception codes, intentional response delays).
-- Runs locally, no CI dependency. Tests skip when `localhost:502` (or the configured
-  simulator endpoint) isn't reachable.
-- Free + long-maintained — physical PLC bench is unavailable in most dev
-  environments, and renting cloud PLCs isn't worth the per-test cost.
+**Chosen simulator: pymodbus 3.13.0** (`pip install 'pymodbus[simulator]==3.13.0'`).
+Replaced ModbusPal in PR 43 — see `tests/.../Pymodbus/README.md` for the
+trade-off rationale. Headline reasons:
 
-**Setup pattern** (not yet codified in a script — will land alongside the integration
-test project):
-1. Install ModbusPal, load the per-device `.xmpp` profile from
-   `tests/Driver.Modbus.IntegrationTests/ModbusPal/` (TBD directory).
-2. Start the simulator listening on `localhost:502` (or override via
-   `MODBUS_SIM_ENDPOINT` env var).
-3. `dotnet test` the integration project — tests auto-skip when the endpoint is
-   unreachable, so forgetting to start the simulator doesn't wedge CI.
+- **Headless** pure-Python CLI; no Java GUI, runs cleanly on a CI runner.
+- **Maintained** — current stable 3.13.0; ModbusPal 1.6b is abandoned.
+- **All four standard tables** (HR, IR, coils, DI) configurable; ModbusPal
+  1.6b only exposed HR + coils.
+- **Built-in actions** (`increment`, `random`, `timestamp`, `uptime`) +
+  optional custom-Python actions for declarative dynamic behaviors.
+- **Per-register raw uint16 seeding** — encoding the DL205 string-byte-order
+  / BCD / CDAB-float quirks stays explicit (the quirk math lives in the
+  `_quirk` JSON-comment fields next to each register).
+- Pip-installable on Windows; sidesteps the privileged-port admin
+  requirement by defaulting to TCP **5020** instead of 502.
+
+**Setup pattern**:
+1. `pip install "pymodbus[simulator]==3.13.0"`.
+2. Start the simulator with one of the in-repo profiles:
+   `tests\.../Pymodbus\serve.ps1 -Profile standard` (or `-Profile dl205`).
+3. `dotnet test tests\ZB.MOM.WW.OtOpcUa.Driver.Modbus.IntegrationTests` —
+   tests auto-skip when the endpoint is unreachable. Default endpoint is
+   `localhost:5020`; override via `MODBUS_SIM_ENDPOINT` for a real PLC on its
+   native port 502.
 
 ## Per-device quirk catalog
 
-### AutomationDirect DL205
+### AutomationDirect DL205 / DL260
 
-First known target device. Quirks to document and cover with named tests (to be
-filled in when user validates each behavior in ModbusPal with a DL205 profile):
+First known target device family. **Full quirk catalog with primary-source citations
+and per-quirk integration-test names lives at [`dl205.md`](dl205.md)** — that doc is
+the reference; this section is the testing roadmap.
 
-- **Word order for 32-bit values**: _pending_ — confirm whether DL205 uses ABCD
-  (Modbus TCP standard) or CDAB (Siemens-style word-swap) for Int32/UInt32/Float32.
-  Test name: `DL205_Float32_word_order_is_CDAB` (or `ABCD`, whichever proves out).
-- **Register-zero access**: _pending_ — some DL205 configurations reject FC03 at
-  register 0 with exception code 02 (illegal data address). If confirmed, the
-  integration test suite verifies `ModbusProbeOptions.ProbeAddress` default of 0
-  triggers the rejection and operators must override; test name:
-  `DL205_FC03_at_register_0_returns_IllegalDataAddress`.
-- **Coil addressing base**: _pending_ — DL205 documentation sometimes uses 1-based
-  coil addresses; verify the driver's zero-based addressing matches the physical
-  PLC without an off-by-one adjustment.
-- **Maximum registers per FC03**: _pending_ — Modbus spec caps at 125; some DL205
-  models enforce a lower limit (e.g., 64). Test name:
-  `DL205_FC03_beyond_max_registers_returns_IllegalDataValue`.
-- **Response framing under sustained load**: _pending_ — the driver's
-  single-flight semaphore assumes the server pairs requests/responses by
-  transaction id; at least one DL205 firmware revision is reported to drop the
-  TxId under load. If reproduced in ModbusPal we add a retry + log-and-continue
-  path to `ModbusTcpTransport`.
-- **Exception code on coil write to a protected bit**: _pending_ — some DL205
-  setups protect internal coils; the driver should surface the PLC's exception
-  PDU as `BadNotWritable` rather than `BadInternalError`.
+Confirmed quirks (priority order — top items are highest-impact for our driver
+and ship first as PR 41+):
 
-_User action item_: as each quirk is validated in ModbusPal, replace the _pending_
-marker with the confirmed behavior and file a named test in the integration suite.
+| Quirk | Driver impact | Integration-test name |
+|---|---|---|
+| **String packing**: 2 chars/register, **first char in low byte** (opposite of generic Modbus) | `ModbusDataType.String` decoder must be configurable per-device family — current code assumes high-byte-first | `DL205_String_low_byte_first_within_register` |
+| **Word order CDAB** for Int32/UInt32/Float32 | Already configurable via `ModbusByteOrder.WordSwap`; default per device profile | `DL205_Int32_word_order_is_CDAB` |
+| **BCD-as-default** numeric storage (only IEEE 754 when ladder uses `R` type) | New decoder mode — register reads as `0x1234` for ladder value `1234`, not as decimal `4660` | `DL205_BCD_register_decodes_as_hex_nibbles` |
+| **FC16 capped at 100 registers** (below the spec's 123) | Bulk-write batching must cap per-device-family | `DL205_FC16_101_registers_returns_IllegalDataValue` |
+| **FC03/04 capped at 128** (above the spec's 125) | Less impactful — clients that respect the spec's 125 stay safe | `DL205_FC03_129_registers_returns_IllegalDataValue` |
+| **V-memory octal-to-decimal addressing** (V2000 octal → 0x0400 decimal) | New address-format helper in profile config so operators can write `V2000` instead of computing `1024` themselves | `DL205_Vmem_V2000_maps_to_PDU_0x0400` |
+| **C-relay → coil 3072 / Y-output → coil 2048** offsets | Hard-coded constants in DL205 device profile | `DL205_C0_maps_to_coil_3072`, `DL205_Y0_maps_to_coil_2048` |
+| **Register 0 is valid** (rejects-register-0 rumour was DL05/DL06 relative-mode artefact) | None — current default is safe | `DL205_FC03_register_0_returns_V0_contents` |
+| **Max 4 simultaneous TCP clients** on H2-ECOM100 | Connect-time: handle TCP-accept failure with a clearer error message | `DL205_5th_TCP_connection_refused` |
+| **No TCP keepalive** | Driver-side periodic-probe (already wired via `IHostConnectivityProbe`) | _Covered by existing `ModbusProbeTests`_ |
+| **No mid-stream resync on malformed MBAP** | Already covered — single-flight + reconnect-on-error | _Covered by existing `ModbusDriverTests`_ |
+| **Write-protect exception code: `02` newer / `04` older** | Translate either to `BadNotWritable` | `DL205_FC06_in_ProgramMode_returns_ServerFailure` |
+
+_Operator-reported / unconfirmed_ — covered defensively in the driver but no
+integration tests until reproduced on hardware:
+- TxId drop under load (forum rumour; not reproduced).
+- Pre-2004 firmware ABCD word order (every shipped DL205/DL260 since 2004 is CDAB).
 
 ### Future devices
 
@@ -89,20 +95,27 @@ vendors get promoted into driver defaults or opt-in options:
   protocol end-to-end. The in-memory `FakeTransport` from the unit test suite is
   deliberately not used here — its value is speed + determinism, which doesn't
   help reproduce device-specific issues.
-- **Don't depend on ModbusPal state between tests.** Each test resets the
+- **Don't depend on simulator state between tests.** Each test resets the
   simulator's register bank or uses a unique address range. Avoid relying on
   "previous test left value at register 10" setups that flake when tests run in
-  parallel or re-order.
+  parallel or re-order. Either the test mutates the scratch ranges and restores
+  on finally, or it uses pymodbus's REST API to reset state between facts.
 
 ## Next concrete PRs
 
 - **PR 30 — Integration test project + DL205 profile scaffold** — **DONE**.
   Shipped `tests/ZB.MOM.WW.OtOpcUa.Driver.Modbus.IntegrationTests` with
   `ModbusSimulatorFixture` (TCP-probe, skips with a clear `SkipReason` when the
-  endpoint is unreachable), `DL205/DL205Profile.cs` (tag map stub — one
-  writable holding register at address 100), and `DL205/DL205SmokeTests.cs`
-  (write-then-read round-trip). `ModbusPal/` directory holds the README
-  pointing at the to-be-committed `DL205.xmpp` profile.
-- **PR 31+**: one PR per confirmed DL205 quirk, landing the named test + any
-  driver-side adjustment (e.g., retry on dropped TxId) needed to pass it. Drop
-  the `DL205.xmpp` profile into `ModbusPal/` alongside the first quirk PR.
+  endpoint is unreachable), `DL205/DL205Profile.cs` (tag map stub), and
+  `DL205/DL205SmokeTests.cs` (write-then-read round-trip).
+- **PR 41 — DL205 quirk catalog doc** — **DONE**. `docs/v2/dl205.md`
+  documents every DL205/DL260 Modbus divergence with primary-source citations.
+- **PR 42 — ModbusPal `.xmpp` profiles** — **SUPERSEDED by PR 43**. Replaced
+  with pymodbus JSON because ModbusPal 1.6b is abandoned, GUI-only, and only
+  exposes 2 of the 4 standard tables.
+- **PR 43 — pymodbus JSON profiles** — **DONE**. `Pymodbus/standard.json` +
+  `Pymodbus/dl205.json` + `Pymodbus/serve.ps1` runner. Both bind TCP 5020.
+- **PR 44+**: one PR per confirmed DL205 quirk, landing the named test + any
+  driver-side adjustment (string byte order, BCD decoder, V-memory address
+  helper, FC16 cap-per-device-family) needed to pass it. Each quirk's value
+  is already pre-encoded in `Pymodbus/dl205.json`.

src/ZB.MOM.WW.OtOpcUa.Core.Abstractions/IHistoryProvider.cs

@@ -30,6 +30,52 @@ public interface IHistoryProvider
         TimeSpan interval,
         HistoryAggregateType aggregate,
         CancellationToken cancellationToken);
+
+    /// <summary>
+    ///     Read one sample per requested timestamp — OPC UA HistoryReadAtTime service. The
+    ///     driver interpolates (or returns the prior-boundary sample) when no exact match
+    ///     exists. Optional; drivers that can't interpolate throw <see cref="NotSupportedException"/>.
+    /// </summary>
+    /// <remarks>
+    ///     Default implementation throws. Drivers opt in by overriding; keeps existing
+    ///     <c>IHistoryProvider</c> implementations compiling without forcing a ReadAtTime path
+    ///     they may not have a backend for.
+    /// </remarks>
+    Task<HistoryReadResult> ReadAtTimeAsync(
+        string fullReference,
+        IReadOnlyList<DateTime> timestampsUtc,
+        CancellationToken cancellationToken)
+        => throw new NotSupportedException(
+            $"{GetType().Name} does not implement ReadAtTimeAsync. " +
+            "Drivers whose backends support at-time reads override this method.");
+
+    /// <summary>
+    ///     Read historical alarm/event records — OPC UA HistoryReadEvents service. Distinct
+    ///     from the live event stream — historical rows come from an event historian (Galaxy's
+    ///     Alarm Provider history log, etc.) rather than the driver's active subscription.
+    /// </summary>
+    /// <param name="sourceName">
+    ///     Optional filter: null means "all sources", otherwise restrict to events from that
+    ///     source-object name. Drivers may ignore the filter if the backend doesn't support it.
+    /// </param>
+    /// <param name="startUtc">Inclusive lower bound on <c>EventTimeUtc</c>.</param>
+    /// <param name="endUtc">Exclusive upper bound on <c>EventTimeUtc</c>.</param>
+    /// <param name="maxEvents">Upper cap on returned events — the driver's backend enforces this.</param>
+    /// <param name="cancellationToken">Request cancellation.</param>
+    /// <remarks>
+    ///     Default implementation throws. Only drivers with an event historian (Galaxy via the
+    ///     Wonderware Alarm &amp; Events log) override. Modbus / the OPC UA Client driver stay
+    ///     with the default and let callers see <c>BadHistoryOperationUnsupported</c>.
+    /// </remarks>
+    Task<HistoricalEventsResult> ReadEventsAsync(
+        string? sourceName,
+        DateTime startUtc,
+        DateTime endUtc,
+        int maxEvents,
+        CancellationToken cancellationToken)
+        => throw new NotSupportedException(
+            $"{GetType().Name} does not implement ReadEventsAsync. " +
+            "Drivers whose backends have an event historian override this method.");
 }
 
 /// <summary>Result of a HistoryRead call.</summary>
@@ -48,3 +94,29 @@ public enum HistoryAggregateType
     Total,
     Count,
 }
+
+/// <summary>
+///     One row returned by <see cref="IHistoryProvider.ReadEventsAsync"/> — a historical
+///     alarm/event record, not the OPC UA live-event stream. Fields match the minimum set the
+///     Server needs to populate a <c>HistoryEventFieldList</c> for HistoryReadEvents responses.
+/// </summary>
+/// <param name="EventId">Stable unique id for the event — driver-specific format.</param>
+/// <param name="SourceName">Source object that emitted the event. May differ from the <c>sourceName</c> filter the caller passed (fuzzy matches).</param>
+/// <param name="EventTimeUtc">Process-side timestamp — when the event actually occurred.</param>
+/// <param name="ReceivedTimeUtc">Historian-side timestamp — when the historian persisted the row; may lag <paramref name="EventTimeUtc"/> by the historian's buffer flush cadence.</param>
+/// <param name="Message">Human-readable message text.</param>
+/// <param name="Severity">OPC UA severity (1-1000). Drivers map their native priority scale onto this range.</param>
+public sealed record HistoricalEvent(
+    string EventId,
+    string? SourceName,
+    DateTime EventTimeUtc,
+    DateTime ReceivedTimeUtc,
+    string? Message,
+    ushort Severity);
+
+/// <summary>Result of a <see cref="IHistoryProvider.ReadEventsAsync"/> call.</summary>
+/// <param name="Events">Events in chronological order by <c>EventTimeUtc</c>.</param>
+/// <param name="ContinuationPoint">Opaque token for the next call when more events are available; null when complete.</param>
+public sealed record HistoricalEventsResult(
+    IReadOnlyList<HistoricalEvent> Events,
+    byte[]? ContinuationPoint);

src/ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Proxy/GalaxyProxyDriver.cs

@@ -339,6 +339,64 @@ public sealed class GalaxyProxyDriver(GalaxyProxyOptions options)
         return new HistoryReadResult(samples, ContinuationPoint: null);
     }
 
+    public async Task<HistoryReadResult> ReadAtTimeAsync(
+        string fullReference, IReadOnlyList<DateTime> timestampsUtc, CancellationToken cancellationToken)
+    {
+        var client = RequireClient();
+        var resp = await client.CallAsync<HistoryReadAtTimeRequest, HistoryReadAtTimeResponse>(
+            MessageKind.HistoryReadAtTimeRequest,
+            new HistoryReadAtTimeRequest
+            {
+                SessionId = _sessionId,
+                TagReference = fullReference,
+                TimestampsUtcUnixMs = [.. timestampsUtc.Select(t => new DateTimeOffset(t, TimeSpan.Zero).ToUnixTimeMilliseconds())],
+            },
+            MessageKind.HistoryReadAtTimeResponse,
+            cancellationToken);
+
+        if (!resp.Success)
+            throw new InvalidOperationException($"Galaxy.Host HistoryReadAtTime failed: {resp.Error}");
+
+        // ReadAtTime returns one sample per requested timestamp in the same order — the Host
+        // pads with bad-quality snapshots when a timestamp can't be interpolated, so response
+        // length matches request length exactly. We trust that contract rather than
+        // re-aligning here, because the Host is the source-of-truth for interpolation policy.
+        IReadOnlyList<DataValueSnapshot> samples = [.. resp.Values.Select(ToSnapshot)];
+        return new HistoryReadResult(samples, ContinuationPoint: null);
+    }
+
+    public async Task<HistoricalEventsResult> ReadEventsAsync(
+        string? sourceName, DateTime startUtc, DateTime endUtc, int maxEvents, CancellationToken cancellationToken)
+    {
+        var client = RequireClient();
+        var resp = await client.CallAsync<HistoryReadEventsRequest, HistoryReadEventsResponse>(
+            MessageKind.HistoryReadEventsRequest,
+            new HistoryReadEventsRequest
+            {
+                SessionId = _sessionId,
+                SourceName = sourceName,
+                StartUtcUnixMs = new DateTimeOffset(startUtc, TimeSpan.Zero).ToUnixTimeMilliseconds(),
+                EndUtcUnixMs = new DateTimeOffset(endUtc, TimeSpan.Zero).ToUnixTimeMilliseconds(),
+                MaxEvents = maxEvents,
+            },
+            MessageKind.HistoryReadEventsResponse,
+            cancellationToken);
+
+        if (!resp.Success)
+            throw new InvalidOperationException($"Galaxy.Host HistoryReadEvents failed: {resp.Error}");
+
+        IReadOnlyList<HistoricalEvent> events = [.. resp.Events.Select(ToHistoricalEvent)];
+        return new HistoricalEventsResult(events, ContinuationPoint: null);
+    }
+
+    internal static HistoricalEvent ToHistoricalEvent(GalaxyHistoricalEvent wire) => new(
+        EventId: wire.EventId,
+        SourceName: wire.SourceName,
+        EventTimeUtc: DateTimeOffset.FromUnixTimeMilliseconds(wire.EventTimeUtcUnixMs).UtcDateTime,
+        ReceivedTimeUtc: DateTimeOffset.FromUnixTimeMilliseconds(wire.ReceivedTimeUtcUnixMs).UtcDateTime,
+        Message: wire.DisplayText,
+        Severity: wire.Severity);
+
     /// <summary>
     ///     Maps the OPC UA Part 13 aggregate enum onto the Wonderware Historian
     ///     AnalogSummaryQuery column names consumed by <c>HistorianDataSource.ReadAggregateAsync</c>.

src/ZB.MOM.WW.OtOpcUa.Driver.Modbus/ModbusDriver.cs

@@ -472,13 +472,21 @@ public sealed class ModbusDriver(ModbusDriverOptions options, string driverInsta
             }
             case ModbusDataType.String:
             {
-                // ASCII, 2 chars per register, packed high byte = first char.
-                // Respect the caller's StringLength (truncate nul-padded regions).
+                // ASCII, 2 chars per register. HighByteFirst (standard) packs the first char in
+                // the high byte of each register; LowByteFirst (DL205/DL260) packs the first char
+                // in the low byte. Respect StringLength (truncate nul-padded regions).
                 var chars = new char[tag.StringLength];
                 for (var i = 0; i < tag.StringLength; i++)
                 {
-                    var b = data[i];
-                    if (b == 0) { return new string(chars, 0, i); }
+                    var regIdx = i / 2;
+                    var highByte = data[regIdx * 2];
+                    var lowByte  = data[regIdx * 2 + 1];
+                    byte b;
+                    if (tag.StringByteOrder == ModbusStringByteOrder.HighByteFirst)
+                        b = (i % 2 == 0) ? highByte : lowByte;
+                    else
+                        b = (i % 2 == 0) ? lowByte : highByte;
+                    if (b == 0) return new string(chars, 0, i);
                     chars[i] = (char)b;
                 }
                 return new string(chars);
@@ -543,7 +551,14 @@ public sealed class ModbusDriver(ModbusDriverOptions options, string driverInsta
                 var s = Convert.ToString(value) ?? string.Empty;
                 var regs = (tag.StringLength + 1) / 2;
                 var b = new byte[regs * 2];
-                for (var i = 0; i < tag.StringLength && i < s.Length; i++) b[i] = (byte)s[i];
+                for (var i = 0; i < tag.StringLength && i < s.Length; i++)
+                {
+                    var regIdx = i / 2;
+                    var destIdx = tag.StringByteOrder == ModbusStringByteOrder.HighByteFirst
+                        ? (i % 2 == 0 ? regIdx * 2 : regIdx * 2 + 1)
+                        : (i % 2 == 0 ? regIdx * 2 + 1 : regIdx * 2);
+                    b[destIdx] = (byte)s[i];
+                }
                 // remaining bytes stay 0 — nul-padded per PLC convention
                 return b;
             }

src/ZB.MOM.WW.OtOpcUa.Driver.Modbus/ModbusDriverOptions.cs

@@ -55,6 +55,12 @@ public sealed class ModbusProbeOptions
 /// <param name="ByteOrder">Word ordering for multi-register types. Ignored for Bool / Int16 / UInt16 / BitInRegister / String.</param>
 /// <param name="BitIndex">For <c>DataType = BitInRegister</c>: which bit of the holding register (0-15, LSB-first).</param>
 /// <param name="StringLength">For <c>DataType = String</c>: number of ASCII characters (2 per register, rounded up).</param>
+/// <param name="StringByteOrder">
+///     Per-register byte order for <c>DataType = String</c>. Standard Modbus packs the first
+///     character in the high byte (<see cref="ModbusStringByteOrder.HighByteFirst"/>).
+///     AutomationDirect DirectLOGIC (DL205/DL260) and a few legacy families pack the first
+///     character in the low byte instead — see <c>docs/v2/dl205.md</c> §strings.
+/// </param>
 public sealed record ModbusTagDefinition(
     string Name,
     ModbusRegion Region,
@@ -63,7 +69,8 @@ public sealed record ModbusTagDefinition(
     bool Writable = true,
     ModbusByteOrder ByteOrder = ModbusByteOrder.BigEndian,
     byte BitIndex = 0,
-    ushort StringLength = 0);
+    ushort StringLength = 0,
+    ModbusStringByteOrder StringByteOrder = ModbusStringByteOrder.HighByteFirst);
 
 public enum ModbusRegion { Coils, DiscreteInputs, InputRegisters, HoldingRegisters }
 
@@ -95,3 +102,17 @@ public enum ModbusByteOrder
     BigEndian,
     WordSwap,
 }
+
+/// <summary>
+///     Per-register byte order for ASCII strings packed 2 chars per register. Standard Modbus
+///     convention is <see cref="HighByteFirst"/> — the first character of each pair occupies
+///     the high byte of the register. AutomationDirect DirectLOGIC (DL205, DL260, DL350) and a
+///     handful of legacy controllers pack <see cref="LowByteFirst"/>, which inverts that within
+///     each register. Word ordering across multiple registers is always ascending address for
+///     strings — only the byte order inside each register flips.
+/// </summary>
+public enum ModbusStringByteOrder
+{
+    HighByteFirst,
+    LowByteFirst,
+}

src/ZB.MOM.WW.OtOpcUa.Driver.Modbus/ModbusTcpTransport.cs

@@ -28,10 +28,20 @@ public sealed class ModbusTcpTransport : IModbusTransport
 
     public async Task ConnectAsync(CancellationToken ct)
     {
-        _client = new TcpClient();
+        // Resolve the host explicitly + prefer IPv4. .NET's TcpClient default-constructor is
+        // dual-stack (IPv6 first, fallback to IPv4) — but most Modbus TCP devices (PLCs and
+        // simulators like pymodbus) bind 0.0.0.0 only, so the IPv6 attempt times out and we
+        // burn the entire ConnectAsync budget before even trying IPv4. Resolving first +
+        // dialing the IPv4 address directly sidesteps that.
+        var addresses = await System.Net.Dns.GetHostAddressesAsync(_host, ct).ConfigureAwait(false);
+        var ipv4 = System.Linq.Enumerable.FirstOrDefault(addresses,
+            a => a.AddressFamily == System.Net.Sockets.AddressFamily.InterNetwork);
+        var target = ipv4 ?? (addresses.Length > 0 ? addresses[0] : System.Net.IPAddress.Loopback);
+
+        _client = new TcpClient(target.AddressFamily);
         using var cts = CancellationTokenSource.CreateLinkedTokenSource(ct);
         cts.CancelAfter(_timeout);
-        await _client.ConnectAsync(_host, _port, cts.Token).ConfigureAwait(false);
+        await _client.ConnectAsync(target, _port, cts.Token).ConfigureAwait(false);
         _stream = _client.GetStream();
     }
 

src/ZB.MOM.WW.OtOpcUa.Server/OpcUa/DriverNodeManager.cs

@@ -5,6 +5,11 @@ using Opc.Ua.Server;
 using ZB.MOM.WW.OtOpcUa.Core.Abstractions;
 using ZB.MOM.WW.OtOpcUa.Server.Security;
 using DriverWriteRequest = ZB.MOM.WW.OtOpcUa.Core.Abstractions.WriteRequest;
+// Core.Abstractions defines a type-named HistoryReadResult (driver-side samples + continuation
+// point) that collides with Opc.Ua.HistoryReadResult (service-layer per-node result). We
+// assign driver-side results to an explicitly-aliased local and construct only the service
+// type in the overrides below.
+using OpcHistoryReadResult = Opc.Ua.HistoryReadResult;
 
 namespace ZB.MOM.WW.OtOpcUa.Server.OpcUa;
 
@@ -71,7 +76,13 @@ public sealed class DriverNodeManager : CustomNodeManager2, IAddressSpaceBuilder
                 NodeId = new NodeId(_driver.DriverInstanceId, NamespaceIndex),
                 BrowseName = new QualifiedName(_driver.DriverInstanceId, NamespaceIndex),
                 DisplayName = new LocalizedText(_driver.DriverInstanceId),
-                EventNotifier = EventNotifiers.None,
+                // Driver root is the conventional event notifier for HistoryReadEvents — clients
+                // request alarm history by targeting it and the node manager routes through
+                // IHistoryProvider.ReadEventsAsync. SubscribeToEvents is also set so live-event
+                // subscriptions (Alarm & Conditions) can point here in a future PR; today the
+                // alarm events are emitted by per-variable AlarmConditionState siblings but a
+                // "subscribe to all events from this driver" path would use this notifier.
+                EventNotifier = (byte)(EventNotifiers.SubscribeToEvents | EventNotifiers.HistoryRead),
             };
 
             // Link under Objects folder so clients see the driver subtree at browse root.
@@ -122,8 +133,15 @@ public sealed class DriverNodeManager : CustomNodeManager2, IAddressSpaceBuilder
                 DisplayName = new LocalizedText(displayName),
                 DataType = MapDataType(attributeInfo.DriverDataType),
                 ValueRank = attributeInfo.IsArray ? ValueRanks.OneDimension : ValueRanks.Scalar,
-                AccessLevel = AccessLevels.CurrentReadOrWrite,
-                UserAccessLevel = AccessLevels.CurrentReadOrWrite,
+                // Historized attributes get the HistoryRead access bit so the stack dispatches
+                // incoming HistoryRead service calls to this node. Without it the base class
+                // returns BadHistoryOperationUnsupported before our per-kind hook ever runs.
+                // HistoryWrite isn't granted — history rewrite is a separate capability the
+                // driver doesn't support today.
+                AccessLevel = (byte)(AccessLevels.CurrentReadOrWrite
+                    | (attributeInfo.IsHistorized ? AccessLevels.HistoryRead : 0)),
+                UserAccessLevel = (byte)(AccessLevels.CurrentReadOrWrite
+                    | (attributeInfo.IsHistorized ? AccessLevels.HistoryRead : 0)),
                 Historizing = attributeInfo.IsHistorized,
             };
             _currentFolder.AddChild(v);
@@ -384,4 +402,379 @@ public sealed class DriverNodeManager : CustomNodeManager2, IAddressSpaceBuilder
     internal int VariableCount => _variablesByFullRef.Count;
     internal bool TryGetVariable(string fullRef, out BaseDataVariableState? v)
         => _variablesByFullRef.TryGetValue(fullRef, out v!);
+
+    // ===================== HistoryRead service handlers (LMX #1, PR 38) =====================
+    //
+    // Wires the driver's IHistoryProvider capability (PR 35 added ReadAtTimeAsync / ReadEventsAsync
+    // alongside the PR 19 ReadRawAsync / ReadProcessedAsync) to the OPC UA HistoryRead service.
+    // CustomNodeManager2 has four protected per-kind hooks; the base dispatches to the right one
+    // based on the concrete HistoryReadDetails subtype. Each hook is sync-returning-void — the
+    // per-driver async calls are bridged via GetAwaiter().GetResult(), matching the pattern
+    // OnReadValue / OnWriteValue already use in this class so HistoryRead doesn't introduce a
+    // different sync-over-async convention.
+    //
+    // Per-node routing: every HistoryReadValueId in nodesToRead has a NodeHandle in
+    // nodesToProcess; the NodeHandle's NodeId.Identifier is the driver-side full reference
+    // (set during Variable() registration) so we can dispatch straight to IHistoryProvider
+    // without a second lookup. Nodes without IHistoryProvider backing (drivers that don't
+    // implement the capability) surface BadHistoryOperationUnsupported per slot and the
+    // rest of the batch continues — same failure-isolation pattern as OnWriteValue.
+    //
+    // Continuation-point handling is pass-through only in this PR: the driver returns null
+    // from its ContinuationPoint field today so the outer result's ContinuationPoint stays
+    // empty. Full Session.SaveHistoryContinuationPoint plumbing is a follow-up when a driver
+    // actually needs paging — the dispatch shape doesn't change, only the result-population.
+
+    private IHistoryProvider? History => _driver as IHistoryProvider;
+
+    protected override void HistoryReadRawModified(
+        ServerSystemContext context, ReadRawModifiedDetails details, TimestampsToReturn timestamps,
+        IList<HistoryReadValueId> nodesToRead, IList<OpcHistoryReadResult> results,
+        IList<ServiceResult> errors, List<NodeHandle> nodesToProcess,
+        IDictionary<NodeId, NodeState> cache)
+    {
+        if (History is null)
+        {
+            MarkAllUnsupported(nodesToProcess, results, errors);
+            return;
+        }
+
+        // IsReadModified=true requests a "modifications" history (who changed the data, when
+        // it was re-written). The driver side has no modifications store — surface that
+        // explicitly rather than silently returning raw data, which would mislead the client.
+        if (details.IsReadModified)
+        {
+            MarkAllUnsupported(nodesToProcess, results, errors, StatusCodes.BadHistoryOperationUnsupported);
+            return;
+        }
+
+        for (var n = 0; n < nodesToProcess.Count; n++)
+        {
+            var handle = nodesToProcess[n];
+            // NodeHandle.Index points back to the slot in the outer results/errors/nodesToRead
+            // arrays. nodesToProcess is the filtered subset (just the nodes this manager
+            // claimed), so writing to results[n] lands in the wrong slot when N > 1 and nodes
+            // are interleaved across multiple node managers.
+            var i = handle.Index;
+            var fullRef = ResolveFullRef(handle);
+            if (fullRef is null)
+            {
+                WriteNodeIdUnknown(results, errors, i);
+                continue;
+            }
+
+            try
+            {
+                var driverResult = History.ReadRawAsync(
+                    fullRef,
+                    details.StartTime,
+                    details.EndTime,
+                    details.NumValuesPerNode,
+                    CancellationToken.None).GetAwaiter().GetResult();
+
+                WriteResult(results, errors, i, StatusCodes.Good,
+                    BuildHistoryData(driverResult.Samples), driverResult.ContinuationPoint);
+            }
+            catch (NotSupportedException)
+            {
+                WriteUnsupported(results, errors, i);
+            }
+            catch (Exception ex)
+            {
+                _logger.LogWarning(ex, "HistoryReadRaw failed for {FullRef}", fullRef);
+                WriteInternalError(results, errors, i);
+            }
+        }
+    }
+
+    protected override void HistoryReadProcessed(
+        ServerSystemContext context, ReadProcessedDetails details, TimestampsToReturn timestamps,
+        IList<HistoryReadValueId> nodesToRead, IList<OpcHistoryReadResult> results,
+        IList<ServiceResult> errors, List<NodeHandle> nodesToProcess,
+        IDictionary<NodeId, NodeState> cache)
+    {
+        if (History is null)
+        {
+            MarkAllUnsupported(nodesToProcess, results, errors);
+            return;
+        }
+
+        // AggregateType is one NodeId shared across every item in the batch — map once.
+        var aggregate = MapAggregate(details.AggregateType?.FirstOrDefault());
+        if (aggregate is null)
+        {
+            MarkAllUnsupported(nodesToProcess, results, errors, StatusCodes.BadAggregateNotSupported);
+            return;
+        }
+
+        var interval = TimeSpan.FromMilliseconds(details.ProcessingInterval);
+        for (var n = 0; n < nodesToProcess.Count; n++)
+        {
+            var handle = nodesToProcess[n];
+            // NodeHandle.Index points back to the slot in the outer results/errors/nodesToRead
+            // arrays. nodesToProcess is the filtered subset (just the nodes this manager
+            // claimed), so writing to results[n] lands in the wrong slot when N > 1 and nodes
+            // are interleaved across multiple node managers.
+            var i = handle.Index;
+            var fullRef = ResolveFullRef(handle);
+            if (fullRef is null)
+            {
+                WriteNodeIdUnknown(results, errors, i);
+                continue;
+            }
+
+            try
+            {
+                var driverResult = History.ReadProcessedAsync(
+                    fullRef,
+                    details.StartTime,
+                    details.EndTime,
+                    interval,
+                    aggregate.Value,
+                    CancellationToken.None).GetAwaiter().GetResult();
+
+                WriteResult(results, errors, i, StatusCodes.Good,
+                    BuildHistoryData(driverResult.Samples), driverResult.ContinuationPoint);
+            }
+            catch (NotSupportedException)
+            {
+                WriteUnsupported(results, errors, i);
+            }
+            catch (Exception ex)
+            {
+                _logger.LogWarning(ex, "HistoryReadProcessed failed for {FullRef}", fullRef);
+                WriteInternalError(results, errors, i);
+            }
+        }
+    }
+
+    protected override void HistoryReadAtTime(
+        ServerSystemContext context, ReadAtTimeDetails details, TimestampsToReturn timestamps,
+        IList<HistoryReadValueId> nodesToRead, IList<OpcHistoryReadResult> results,
+        IList<ServiceResult> errors, List<NodeHandle> nodesToProcess,
+        IDictionary<NodeId, NodeState> cache)
+    {
+        if (History is null)
+        {
+            MarkAllUnsupported(nodesToProcess, results, errors);
+            return;
+        }
+
+        var requestedTimes = (IReadOnlyList<DateTime>)(details.ReqTimes?.ToArray() ?? Array.Empty<DateTime>());
+        for (var n = 0; n < nodesToProcess.Count; n++)
+        {
+            var handle = nodesToProcess[n];
+            // NodeHandle.Index points back to the slot in the outer results/errors/nodesToRead
+            // arrays. nodesToProcess is the filtered subset (just the nodes this manager
+            // claimed), so writing to results[n] lands in the wrong slot when N > 1 and nodes
+            // are interleaved across multiple node managers.
+            var i = handle.Index;
+            var fullRef = ResolveFullRef(handle);
+            if (fullRef is null)
+            {
+                WriteNodeIdUnknown(results, errors, i);
+                continue;
+            }
+
+            try
+            {
+                var driverResult = History.ReadAtTimeAsync(
+                    fullRef, requestedTimes, CancellationToken.None).GetAwaiter().GetResult();
+
+                WriteResult(results, errors, i, StatusCodes.Good,
+                    BuildHistoryData(driverResult.Samples), driverResult.ContinuationPoint);
+            }
+            catch (NotSupportedException)
+            {
+                WriteUnsupported(results, errors, i);
+            }
+            catch (Exception ex)
+            {
+                _logger.LogWarning(ex, "HistoryReadAtTime failed for {FullRef}", fullRef);
+                WriteInternalError(results, errors, i);
+            }
+        }
+    }
+
+    protected override void HistoryReadEvents(
+        ServerSystemContext context, ReadEventDetails details, TimestampsToReturn timestamps,
+        IList<HistoryReadValueId> nodesToRead, IList<OpcHistoryReadResult> results,
+        IList<ServiceResult> errors, List<NodeHandle> nodesToProcess,
+        IDictionary<NodeId, NodeState> cache)
+    {
+        if (History is null)
+        {
+            MarkAllUnsupported(nodesToProcess, results, errors);
+            return;
+        }
+
+        // SourceName filter extraction is deferred — EventFilter SelectClauses + WhereClause
+        // handling is a dedicated concern (proper per-select-clause Variant population + where
+        // filter evaluation). This PR treats the event query as "all events in range for the
+        // node's source" and populates only the standard BaseEventType fields. Richer filter
+        // handling is a follow-up; clients issuing empty/default filters get the right answer
+        // today which covers the common alarm-history browse case.
+        var maxEvents = (int)details.NumValuesPerNode;
+        if (maxEvents <= 0) maxEvents = 1000;
+
+        for (var n = 0; n < nodesToProcess.Count; n++)
+        {
+            var handle = nodesToProcess[n];
+            // NodeHandle.Index points back to the slot in the outer results/errors/nodesToRead
+            // arrays. nodesToProcess is the filtered subset (just the nodes this manager
+            // claimed), so writing to results[n] lands in the wrong slot when N > 1 and nodes
+            // are interleaved across multiple node managers.
+            var i = handle.Index;
+            // Event history queries may target a notifier object (e.g. the driver-root folder)
+            // rather than a specific variable — in that case we pass sourceName=null to mean
+            // "all sources in the driver's namespace" per the IHistoryProvider contract.
+            var fullRef = ResolveFullRef(handle);
+
+            try
+            {
+                var driverResult = History.ReadEventsAsync(
+                    sourceName: fullRef,
+                    startUtc: details.StartTime,
+                    endUtc: details.EndTime,
+                    maxEvents: maxEvents,
+                    cancellationToken: CancellationToken.None).GetAwaiter().GetResult();
+
+                WriteResult(results, errors, i, StatusCodes.Good,
+                    BuildHistoryEvent(driverResult.Events), driverResult.ContinuationPoint);
+            }
+            catch (NotSupportedException)
+            {
+                WriteUnsupported(results, errors, i);
+            }
+            catch (Exception ex)
+            {
+                _logger.LogWarning(ex, "HistoryReadEvents failed for {FullRef}", fullRef);
+                WriteInternalError(results, errors, i);
+            }
+        }
+    }
+
+    private string? ResolveFullRef(NodeHandle handle) => handle.NodeId?.Identifier as string;
+
+    // Both the results list AND the parallel errors list must be populated — MasterNodeManager
+    // merges them and the merged StatusCode is what the client sees. Leaving errors[i] at its
+    // default (BadHistoryOperationUnsupported) overrides a Good result with Unsupported, which
+    // masks a correctly-constructed HistoryData response. This was the subtle failure mode
+    // that cost most of PR 38's debugging budget.
+    private static void WriteResult(IList<OpcHistoryReadResult> results, IList<ServiceResult> errors,
+        int i, uint statusCode, ExtensionObject historyData, byte[]? continuationPoint)
+    {
+        results[i] = new OpcHistoryReadResult
+        {
+            StatusCode = statusCode,
+            HistoryData = historyData,
+            ContinuationPoint = continuationPoint,
+        };
+        errors[i] = statusCode == StatusCodes.Good
+            ? ServiceResult.Good
+            : new ServiceResult(statusCode);
+    }
+
+    private static void WriteUnsupported(IList<OpcHistoryReadResult> results, IList<ServiceResult> errors, int i)
+    {
+        results[i] = new OpcHistoryReadResult { StatusCode = StatusCodes.BadHistoryOperationUnsupported };
+        errors[i] = StatusCodes.BadHistoryOperationUnsupported;
+    }
+
+    private static void WriteInternalError(IList<OpcHistoryReadResult> results, IList<ServiceResult> errors, int i)
+    {
+        results[i] = new OpcHistoryReadResult { StatusCode = StatusCodes.BadInternalError };
+        errors[i] = StatusCodes.BadInternalError;
+    }
+
+    private static void WriteNodeIdUnknown(IList<OpcHistoryReadResult> results, IList<ServiceResult> errors, int i)
+    {
+        WriteNodeIdUnknown(results, errors, i);
+        errors[i] = StatusCodes.BadNodeIdUnknown;
+    }
+
+    private static void MarkAllUnsupported(
+        List<NodeHandle> nodes, IList<OpcHistoryReadResult> results, IList<ServiceResult> errors,
+        uint statusCode = StatusCodes.BadHistoryOperationUnsupported)
+    {
+        foreach (var handle in nodes)
+        {
+            results[handle.Index] = new OpcHistoryReadResult { StatusCode = statusCode };
+            errors[handle.Index] = statusCode == StatusCodes.Good ? ServiceResult.Good : new ServiceResult(statusCode);
+        }
+    }
+
+    /// <summary>
+    ///     Map the OPC UA Part 13 aggregate-function NodeId to the driver's
+    ///     <see cref="HistoryAggregateType"/>. Internal so the test suite can pin the mapping
+    ///     without exposing public API. Returns null for unsupported aggregates so the service
+    ///     handler can surface <c>BadAggregateNotSupported</c> on the whole batch.
+    /// </summary>
+    internal static HistoryAggregateType? MapAggregate(NodeId? aggregateNodeId)
+    {
+        if (aggregateNodeId is null) return null;
+
+        // Every AggregateFunction_* identifier is a numeric uint on the Server (0) namespace.
+        // Comparing NodeIds by value handles all the cross-encoding cases (expanded vs plain).
+        if (aggregateNodeId == ObjectIds.AggregateFunction_Average) return HistoryAggregateType.Average;
+        if (aggregateNodeId == ObjectIds.AggregateFunction_Minimum) return HistoryAggregateType.Minimum;
+        if (aggregateNodeId == ObjectIds.AggregateFunction_Maximum) return HistoryAggregateType.Maximum;
+        if (aggregateNodeId == ObjectIds.AggregateFunction_Total) return HistoryAggregateType.Total;
+        if (aggregateNodeId == ObjectIds.AggregateFunction_Count) return HistoryAggregateType.Count;
+        return null;
+    }
+
+    /// <summary>
+    ///     Wrap driver samples as <c>HistoryData</c> in an <c>ExtensionObject</c> — the on-wire
+    ///     shape the OPC UA HistoryRead service expects for raw / processed / at-time reads.
+    /// </summary>
+    internal static ExtensionObject BuildHistoryData(IReadOnlyList<DataValueSnapshot> samples)
+    {
+        var values = new DataValueCollection(samples.Count);
+        foreach (var s in samples) values.Add(ToDataValue(s));
+        return new ExtensionObject(new HistoryData { DataValues = values });
+    }
+
+    /// <summary>
+    ///     Wrap driver events as <c>HistoryEvent</c> in an <c>ExtensionObject</c>. Populates
+    ///     the minimum BaseEventType field set (SourceName, Message, Severity, Time,
+    ///     ReceiveTime, EventId) so clients that request the default
+    ///     <c>SimpleAttributeOperand</c> select-clauses see useful data. Custom EventFilter
+    ///     SelectClause evaluation is deferred — when a client sends a specific operand list,
+    ///     they currently get the standard fields back and ignore the extras. Documented on the
+    ///     public follow-up list.
+    /// </summary>
+    internal static ExtensionObject BuildHistoryEvent(IReadOnlyList<HistoricalEvent> events)
+    {
+        var fieldLists = new HistoryEventFieldListCollection(events.Count);
+        foreach (var e in events)
+        {
+            var fields = new VariantCollection
+            {
+                // Order must match BaseEventType's conventional field ordering so clients that
+                // didn't customize the SelectClauses still see recognizable columns. A future
+                // PR that respects the client's SelectClause list will drive this from the filter.
+                new Variant(e.EventId),
+                new Variant(e.SourceName ?? string.Empty),
+                new Variant(new LocalizedText(e.Message ?? string.Empty)),
+                new Variant(e.Severity),
+                new Variant(e.EventTimeUtc),
+                new Variant(e.ReceivedTimeUtc),
+            };
+            fieldLists.Add(new HistoryEventFieldList { EventFields = fields });
+        }
+        return new ExtensionObject(new HistoryEvent { Events = fieldLists });
+    }
+
+    internal static DataValue ToDataValue(DataValueSnapshot s)
+    {
+        var dv = new DataValue
+        {
+            Value = s.Value,
+            StatusCode = new StatusCode(s.StatusCode),
+            ServerTimestamp = s.ServerTimestampUtc,
+        };
+        if (s.SourceTimestampUtc.HasValue) dv.SourceTimestamp = s.SourceTimestampUtc.Value;
+        return dv;
+    }
 }

tests/ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Host.Tests/AvevaPrerequisitesLiveTests.cs

@@ -0,0 +1,127 @@
+using System.Linq;
+using System.Threading;
+using System.Threading.Tasks;
+using Shouldly;
+using Xunit;
+using Xunit.Abstractions;
+using ZB.MOM.WW.OtOpcUa.Driver.Galaxy.TestSupport;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Host.Tests
+{
+    /// <summary>
+    ///     Exercises <see cref="AvevaPrerequisites"/> against the live dev box so the helper
+    ///     itself gets integration coverage — i.e. "do the probes return Pass for things that
+    ///     really are Pass?" as validated against this machine's known-installed topology.
+    ///     Category <c>LiveGalaxy</c> so CI / clean dev boxes skip cleanly.
+    /// </summary>
+    [Trait("Category", "LiveGalaxy")]
+    public sealed class AvevaPrerequisitesLiveTests
+    {
+        private readonly ITestOutputHelper _output;
+
+        public AvevaPrerequisitesLiveTests(ITestOutputHelper output) => _output = output;
+
+        [Fact]
+        public async Task CheckAll_on_live_box_reports_Framework_install()
+        {
+            var report = await AvevaPrerequisites.CheckAllAsync();
+            _output.WriteLine(report.ToString());
+            report.Checks.ShouldContain(c =>
+                c.Name == "registry:ArchestrA.Framework" && c.Status == PrerequisiteStatus.Pass,
+                "ArchestrA Framework registry root should be found on this machine.");
+        }
+
+        [Fact]
+        public async Task CheckAll_on_live_box_reports_aaBootstrap_running()
+        {
+            var report = await AvevaPrerequisites.CheckAllAsync();
+            var bootstrap = report.Checks.FirstOrDefault(c => c.Name == "service:aaBootstrap");
+            bootstrap.ShouldNotBeNull();
+            bootstrap.Status.ShouldBe(PrerequisiteStatus.Pass,
+                $"aaBootstrap must be Running for any live-Galaxy test to work — detail: {bootstrap.Detail}");
+        }
+
+        [Fact]
+        public async Task CheckAll_on_live_box_reports_aaGR_running()
+        {
+            var report = await AvevaPrerequisites.CheckAllAsync();
+            var gr = report.Checks.FirstOrDefault(c => c.Name == "service:aaGR");
+            gr.ShouldNotBeNull();
+            gr.Status.ShouldBe(PrerequisiteStatus.Pass,
+                $"aaGR (Galaxy Repository) must be Running — detail: {gr.Detail}");
+        }
+
+        [Fact]
+        public async Task CheckAll_on_live_box_reports_MxAccess_COM_registered()
+        {
+            var report = await AvevaPrerequisites.CheckAllAsync();
+            var com = report.Checks.FirstOrDefault(c => c.Name == "com:LMXProxy");
+            com.ShouldNotBeNull();
+            com.Status.ShouldBe(PrerequisiteStatus.Pass,
+                $"LMXProxy.LMXProxyServer ProgID must resolve to an InprocServer32 DLL — detail: {com.Detail}");
+        }
+
+        [Fact]
+        public async Task CheckRepositoryOnly_on_live_box_reports_ZB_reachable()
+        {
+            var report = await AvevaPrerequisites.CheckRepositoryOnlyAsync(ct: CancellationToken.None);
+            var zb = report.Checks.FirstOrDefault(c => c.Name == "sql:ZB");
+            zb.ShouldNotBeNull();
+            zb.Status.ShouldBe(PrerequisiteStatus.Pass,
+                $"ZB database must be reachable via SQL Server Windows auth — detail: {zb.Detail}");
+        }
+
+        [Fact]
+        public async Task CheckRepositoryOnly_on_live_box_reports_non_zero_deployed_objects()
+        {
+            // This box has 49 deployed objects per the research; we just assert > 0 so adding/
+            // removing objects doesn't break the test.
+            var report = await AvevaPrerequisites.CheckRepositoryOnlyAsync();
+            var deployed = report.Checks.FirstOrDefault(c => c.Name == "sql:ZB.deployedObjects");
+            deployed.ShouldNotBeNull();
+            deployed.Status.ShouldBe(PrerequisiteStatus.Pass,
+                $"At least one deployed gobject should exist — detail: {deployed.Detail}");
+        }
+
+        [Fact]
+        public async Task Aveva_side_is_ready_on_this_machine()
+        {
+            // Narrower than "livetest ready" — our own services (OtOpcUa / OtOpcUaGalaxyHost)
+            // may not be installed on a developer's box while they're actively iterating on
+            // them, but the AVEVA side (Framework / Galaxy Repository / MXAccess COM /
+            // SQL / core services) should always be up on a machine with System Platform
+            // installed. This assertion is what gates live-Galaxy tests that go straight to
+            // the Galaxy Repository without routing through our stack.
+            var report = await AvevaPrerequisites.CheckAllAsync(
+                new AvevaPrerequisites.Options { CheckGalaxyHostPipe = false });
+            _output.WriteLine(report.ToString());
+            _output.WriteLine(report.Warnings ?? "no warnings");
+
+            // Enumerate AVEVA-side failures (if any) for an actionable assertion message.
+            var avevaFails = report.Checks
+                .Where(c => c.Status == PrerequisiteStatus.Fail &&
+                            c.Category != PrerequisiteCategory.OtOpcUaService)
+                .ToList();
+            report.IsAvevaSideReady.ShouldBeTrue(
+                avevaFails.Count == 0
+                    ? "unexpected state"
+                    : "AVEVA-side failures: " + string.Join(" ; ",
+                        avevaFails.Select(f => $"{f.Name}: {f.Detail}")));
+        }
+
+        [Fact]
+        public async Task Report_captures_OtOpcUa_services_state_even_when_not_installed()
+        {
+            // The helper reports the status of OtOpcUaGalaxyHost + OtOpcUa services even if
+            // they're not installed yet — absence is itself an actionable signal. This test
+            // doesn't assert Pass/Fail on those services (their state depends on what's
+            // installed when the test runs) — it only asserts the helper EMITTED the rows,
+            // so nobody can ship a prerequisite check that silently omits our own services.
+            var report = await AvevaPrerequisites.CheckAllAsync();
+
+            report.Checks.ShouldContain(c => c.Name == "service:OtOpcUaGalaxyHost");
+            report.Checks.ShouldContain(c => c.Name == "service:OtOpcUa");
+            report.Checks.ShouldContain(c => c.Name == "service:GLAuth");
+        }
+    }
+}

tests/ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Host.Tests/GalaxyRepositoryLiveSmokeTests.cs

@@ -6,6 +6,7 @@ using Xunit;
 using ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Host.Backend;
 using ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Host.Backend.Galaxy;
 using ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Shared.Contracts;
+using ZB.MOM.WW.OtOpcUa.Driver.Galaxy.TestSupport;
 
 namespace ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Host.Tests
 {
@@ -16,6 +17,11 @@ namespace ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Host.Tests
     ///     SQL the v1 Host uses, proving the lift is byte-for-byte equivalent at the
     ///     <c>DiscoverHierarchyResponse</c> shape.
     /// </summary>
+    /// <remarks>
+    ///     Since PR 36, skip logic is delegated to <see cref="AvevaPrerequisites.CheckRepositoryOnlyAsync"/>
+    ///     so operators see exactly why a test skipped ("ZB db not found" vs "SQL Server
+    ///     unreachable") instead of a silent return.
+    /// </remarks>
     [Trait("Category", "LiveGalaxy")]
     public sealed class GalaxyRepositoryLiveSmokeTests
     {
@@ -26,15 +32,20 @@ namespace ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Host.Tests
             CommandTimeoutSeconds = 10,
         };
 
+        private static async Task<string?> RepositorySkipReasonAsync()
+        {
+            using var cts = new CancellationTokenSource(TimeSpan.FromSeconds(4));
+            var report = await AvevaPrerequisites.CheckRepositoryOnlyAsync(
+                DevZbOptions().ConnectionString, cts.Token);
+            return report.SkipReason;
+        }
+
         private static async Task<bool> ZbReachableAsync()
         {
-            try
-            {
-                var repo = new GalaxyRepository(DevZbOptions());
-                using var cts = new CancellationTokenSource(TimeSpan.FromSeconds(3));
-                return await repo.TestConnectionAsync(cts.Token);
-            }
-            catch { return false; }
+            // Legacy silent-skip adapter — keeps the existing tests compiling while
+            // gradually migrating to the Skip-with-reason pattern. Returns true when the
+            // prerequisite check has no Fail entries.
+            return (await RepositorySkipReasonAsync()) is null;
         }
 
         [Fact]

tests/ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Host.Tests/ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Host.Tests.csproj

@@ -23,6 +23,7 @@
 
     <ItemGroup>
         <ProjectReference Include="..\..\src\ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Host\ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Host.csproj"/>
+        <ProjectReference Include="..\ZB.MOM.WW.OtOpcUa.Driver.Galaxy.TestSupport\ZB.MOM.WW.OtOpcUa.Driver.Galaxy.TestSupport.csproj"/>
         <Reference Include="System.ServiceProcess"/>
         <!-- IMxProxy's delegate signatures mention ArchestrA.MxAccess.MXSTATUS_PROXY, so tests
              implementing the interface must resolve that type at compile time. -->

tests/ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Proxy.Tests/HistoricalEventMappingTests.cs

@@ -0,0 +1,81 @@
+using Shouldly;
+using Xunit;
+using ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Proxy;
+using ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Shared.Contracts;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Proxy.Tests;
+
+/// <summary>
+///     Pins <see cref="GalaxyProxyDriver.ToHistoricalEvent"/> — the wire-to-domain mapping
+///     from <see cref="GalaxyHistoricalEvent"/> (MessagePack-annotated IPC contract,
+///     Unix-ms timestamps) to <c>Core.Abstractions.HistoricalEvent</c> (domain record,
+///     <see cref="DateTime"/> timestamps). Added in PR 35 alongside the new
+///     <c>IHistoryProvider.ReadEventsAsync</c> method.
+/// </summary>
+[Trait("Category", "Unit")]
+public sealed class HistoricalEventMappingTests
+{
+    [Fact]
+    public void Maps_every_field_from_wire_to_domain_record()
+    {
+        var wire = new GalaxyHistoricalEvent
+        {
+            EventId = "evt-42",
+            SourceName = "Tank1.HiAlarm",
+            EventTimeUtcUnixMs = 1_700_000_000_000L, // 2023-11-14T22:13:20.000Z
+            ReceivedTimeUtcUnixMs = 1_700_000_000_500L,
+            DisplayText = "High level reached",
+            Severity = 750,
+        };
+
+        var domain = GalaxyProxyDriver.ToHistoricalEvent(wire);
+
+        domain.EventId.ShouldBe("evt-42");
+        domain.SourceName.ShouldBe("Tank1.HiAlarm");
+        domain.EventTimeUtc.ShouldBe(new DateTime(2023, 11, 14, 22, 13, 20, DateTimeKind.Utc));
+        domain.ReceivedTimeUtc.ShouldBe(new DateTime(2023, 11, 14, 22, 13, 20, 500, DateTimeKind.Utc));
+        domain.Message.ShouldBe("High level reached");
+        domain.Severity.ShouldBe((ushort)750);
+    }
+
+    [Fact]
+    public void Preserves_null_SourceName_and_DisplayText()
+    {
+        // Historical rows from the Galaxy event historian often omit source or message for
+        // system events (e.g. time sync). The mapping must preserve null — callers use it to
+        // distinguish system events from alarm events.
+        var wire = new GalaxyHistoricalEvent
+        {
+            EventId = "sys-1",
+            SourceName = null,
+            EventTimeUtcUnixMs = 0,
+            ReceivedTimeUtcUnixMs = 0,
+            DisplayText = null,
+            Severity = 1,
+        };
+
+        var domain = GalaxyProxyDriver.ToHistoricalEvent(wire);
+
+        domain.SourceName.ShouldBeNull();
+        domain.Message.ShouldBeNull();
+    }
+
+    [Fact]
+    public void EventTime_and_ReceivedTime_are_produced_as_DateTimeKind_Utc()
+    {
+        // Unix-ms timestamps come off the wire timezone-agnostic; the mapping must tag the
+        // resulting DateTime as Utc so downstream serializers (JSON, OPC UA types) don't apply
+        // an unexpected local-time offset.
+        var wire = new GalaxyHistoricalEvent
+        {
+            EventId = "e",
+            EventTimeUtcUnixMs = 1_000L,
+            ReceivedTimeUtcUnixMs = 2_000L,
+        };
+
+        var domain = GalaxyProxyDriver.ToHistoricalEvent(wire);
+
+        domain.EventTimeUtc.Kind.ShouldBe(DateTimeKind.Utc);
+        domain.ReceivedTimeUtc.Kind.ShouldBe(DateTimeKind.Utc);
+    }
+}

tests/ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Proxy.Tests/LiveStack/LiveStackConfig.cs

@@ -0,0 +1,75 @@
+using System.Runtime.InteropServices;
+using System.Runtime.Versioning;
+using Microsoft.Win32;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Proxy.Tests.LiveStack;
+
+/// <summary>
+///     Resolves the pipe name + shared secret the live <see cref="GalaxyProxyDriver"/> needs
+///     to connect to a running <c>OtOpcUaGalaxyHost</c> Windows service. Two sources are
+///     consulted, first match wins:
+///     <list type="number">
+///         <item>Explicit env vars (<c>OTOPCUA_GALAXY_PIPE</c>, <c>OTOPCUA_GALAXY_SECRET</c>) — lets CI / benchwork override.</item>
+///         <item>The service's per-process <c>Environment</c> registry values under
+///               <c>HKLM\SYSTEM\CurrentControlSet\Services\OtOpcUaGalaxyHost</c> — what
+///               <c>Install-Services.ps1</c> writes at install time. Requires the test to run as a
+///               principal with read access to that registry key (typically Administrators).</item>
+///     </list>
+/// </summary>
+/// <remarks>
+///     Explicitly NOT baked-in-to-source: the shared secret is rotated per install (the
+///     installer generates 32 random bytes and stores the base64 string). A hard-coded secret
+///     in tests would diverge from production the moment someone re-installed the service.
+/// </remarks>
+public sealed record LiveStackConfig(string PipeName, string SharedSecret, string? Source)
+{
+    public const string EnvPipeName = "OTOPCUA_GALAXY_PIPE";
+    public const string EnvSharedSecret = "OTOPCUA_GALAXY_SECRET";
+    public const string ServiceRegistryKey =
+        @"SYSTEM\CurrentControlSet\Services\OtOpcUaGalaxyHost";
+    public const string DefaultPipeName = "OtOpcUaGalaxy";
+
+    public static LiveStackConfig? Resolve()
+    {
+        var envPipe = Environment.GetEnvironmentVariable(EnvPipeName);
+        var envSecret = Environment.GetEnvironmentVariable(EnvSharedSecret);
+        if (!string.IsNullOrWhiteSpace(envPipe) && !string.IsNullOrWhiteSpace(envSecret))
+            return new LiveStackConfig(envPipe, envSecret, "env vars");
+
+        if (!RuntimeInformation.IsOSPlatform(OSPlatform.Windows))
+            return null;
+
+        return FromServiceRegistry();
+    }
+
+    [SupportedOSPlatform("windows")]
+    private static LiveStackConfig? FromServiceRegistry()
+    {
+        try
+        {
+            using var key = Registry.LocalMachine.OpenSubKey(ServiceRegistryKey);
+            if (key is null) return null;
+            var env = key.GetValue("Environment") as string[];
+            if (env is null || env.Length == 0) return null;
+
+            string? pipe = null, secret = null;
+            foreach (var line in env)
+            {
+                var eq = line.IndexOf('=');
+                if (eq <= 0) continue;
+                var name = line[..eq];
+                var value = line[(eq + 1)..];
+                if (name.Equals(EnvPipeName, StringComparison.OrdinalIgnoreCase)) pipe = value;
+                else if (name.Equals(EnvSharedSecret, StringComparison.OrdinalIgnoreCase)) secret = value;
+            }
+
+            if (string.IsNullOrWhiteSpace(secret)) return null;
+            return new LiveStackConfig(pipe ?? DefaultPipeName, secret, "service registry");
+        }
+        catch
+        {
+            // Access denied / key missing / malformed — caller gets null and surfaces a Skip.
+            return null;
+        }
+    }
+}

tests/ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Proxy.Tests/LiveStack/LiveStackFixture.cs

@@ -0,0 +1,164 @@
+using System.Runtime.InteropServices;
+using System.Runtime.Versioning;
+using System.Security.Principal;
+using System.Threading;
+using System.Threading.Tasks;
+using Xunit;
+using ZB.MOM.WW.OtOpcUa.Driver.Galaxy.TestSupport;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Proxy.Tests.LiveStack;
+
+/// <summary>
+///     Connects a single <see cref="GalaxyProxyDriver"/> to the already-running
+///     <c>OtOpcUaGalaxyHost</c> Windows service for the lifetime of a test class. Uses
+///     <see cref="AvevaPrerequisites"/> to decide whether to proceed; on failure,
+///     <see cref="SkipReason"/> is populated and each test calls <see cref="SkipIfUnavailable"/>
+///     to translate that into <c>Assert.Skip</c>.
+/// </summary>
+/// <remarks>
+///     <para>
+///         <b>Does NOT spawn the Host process.</b> Production deploys <c>OtOpcUaGalaxyHost</c>
+///         as a standalone Windows service — spawning a second instance from a test would
+///         bypass the COM-apartment + service-account setup and fail differently than
+///         production (see <c>project_galaxy_host_service.md</c> memory).
+///     </para>
+///     <para>
+///         <b>Shared-secret handling</b>: read from <see cref="LiveStackConfig"/> — env vars
+///         first, then the service's registry-stored <c>Environment</c> values. Requires
+///         the test process to have read access to
+///         <c>HKLM\SYSTEM\CurrentControlSet\Services\OtOpcUaGalaxyHost</c>; on a dev box
+///         that typically means running the test host elevated, or exporting
+///         <c>OTOPCUA_GALAXY_SECRET</c> out-of-band.
+///     </para>
+/// </remarks>
+public sealed class LiveStackFixture : IAsyncLifetime
+{
+    public GalaxyProxyDriver? Driver { get; private set; }
+
+    public string? SkipReason { get; private set; }
+
+    public PrerequisiteReport? PrerequisiteReport { get; private set; }
+
+    public LiveStackConfig? Config { get; private set; }
+
+    public async ValueTask InitializeAsync()
+    {
+        // 0. Elevated-shell short-circuit. The OtOpcUaGalaxyHost pipe ACL allows the configured
+        //    SID but explicitly DENIES Administrators (decision #76 — production hardening).
+        //    A test process running with a high-integrity token (any elevated shell) carries the
+        //    Admins group in its security context, so the deny rule trumps the user's allow and
+        //    the pipe connect returns UnauthorizedAccessException — technically correct but
+        //    the operationally confusing failure mode that ate most of the PR 37 install
+        //    debugging session. Surfacing it explicitly here saves the next operator the same
+        //    five-step diagnosis. ParityFixture has the same skip with the same rationale.
+        if (IsElevatedAdministratorOnWindows())
+        {
+            SkipReason =
+                "Test host is running with elevated (Administrators) privileges, but the " +
+                "OtOpcUaGalaxyHost named-pipe ACL explicitly denies Administrators per the IPC " +
+                "security design (decision #76 / PipeAcl.cs). Re-run from a NORMAL (non-admin) " +
+                "PowerShell window — even when your user is already in the pipe's allow list, " +
+                "the elevated token's Admins group membership trumps the allow rule.";
+            return;
+        }
+
+        // 1. AVEVA + OtOpcUa service state — actionable diagnostic if anything is missing.
+        using var cts = new CancellationTokenSource(TimeSpan.FromSeconds(10));
+        PrerequisiteReport = await AvevaPrerequisites.CheckAllAsync(
+            new AvevaPrerequisites.Options { CheckGalaxyHostPipe = true, CheckHistorian = false },
+            cts.Token);
+
+        if (!PrerequisiteReport.IsLivetestReady)
+        {
+            SkipReason = PrerequisiteReport.SkipReason;
+            return;
+        }
+
+        // 2. Secret / pipe-name resolution. If the service is running but we can't discover its
+        //    env vars from registry (non-elevated test host), a clear message beats a silent
+        //    connect-rejected failure 10 seconds later.
+        Config = LiveStackConfig.Resolve();
+        if (Config is null)
+        {
+            SkipReason =
+                $"Cannot resolve shared secret. Set {LiveStackConfig.EnvSharedSecret} (and optionally " +
+                $"{LiveStackConfig.EnvPipeName}) in the environment, or run the test host elevated so it " +
+                $"can read HKLM\\{LiveStackConfig.ServiceRegistryKey}\\Environment.";
+            return;
+        }
+
+        // 3. Connect. InitializeAsync does the pipe connect + handshake; a 5-second
+        //    ConnectTimeout gives enough headroom for a service that just started.
+        Driver = new GalaxyProxyDriver(new GalaxyProxyOptions
+        {
+            DriverInstanceId = "live-stack-smoke",
+            PipeName = Config.PipeName,
+            SharedSecret = Config.SharedSecret,
+            ConnectTimeout = TimeSpan.FromSeconds(5),
+        });
+
+        try
+        {
+            await Driver.InitializeAsync(driverConfigJson: "{}", CancellationToken.None);
+        }
+        catch (Exception ex)
+        {
+            SkipReason =
+                $"Connected to named pipe '{Config.PipeName}' but GalaxyProxyDriver.InitializeAsync failed: " +
+                $"{ex.GetType().Name}: {ex.Message}. Common causes: shared secret mismatch (rotated after last install), " +
+                $"service account SID not in pipe ACL (installer sets OTOPCUA_ALLOWED_SID to the service account — " +
+                $"test must run as that user), or Host's backend couldn't connect to ZB.";
+            Driver.Dispose();
+            Driver = null;
+            return;
+        }
+    }
+
+    public async ValueTask DisposeAsync()
+    {
+        if (Driver is not null)
+        {
+            try { await Driver.ShutdownAsync(CancellationToken.None); } catch { /* best-effort */ }
+            Driver.Dispose();
+        }
+    }
+
+    /// <summary>
+    ///     Translate <see cref="SkipReason"/> into <c>Assert.Skip</c>. Tests call this at the
+    ///     top of every fact so a fixture init failure shows up as a cleanly-skipped test with
+    ///     the full prerequisites report, not a cascading NullReferenceException on
+    ///     <see cref="Driver"/>.
+    /// </summary>
+    public void SkipIfUnavailable()
+    {
+        if (SkipReason is not null) Assert.Skip(SkipReason);
+    }
+
+    private static bool IsElevatedAdministratorOnWindows()
+    {
+        if (!RuntimeInformation.IsOSPlatform(OSPlatform.Windows)) return false;
+        return CheckWindowsAdminToken();
+    }
+
+    [SupportedOSPlatform("windows")]
+    private static bool CheckWindowsAdminToken()
+    {
+        try
+        {
+            using var identity = WindowsIdentity.GetCurrent();
+            return new WindowsPrincipal(identity).IsInRole(WindowsBuiltInRole.Administrator);
+        }
+        catch
+        {
+            // Probe shouldn't crash the test; if we can't determine elevation, optimistically
+            // continue and let the actual pipe connect surface its own error.
+            return false;
+        }
+    }
+}
+
+[CollectionDefinition(Name)]
+public sealed class LiveStackCollection : ICollectionFixture<LiveStackFixture>
+{
+    public const string Name = "LiveStack";
+}

tests/ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Proxy.Tests/LiveStack/LiveStackSmokeTests.cs

@@ -0,0 +1,282 @@
+using System.Collections.Generic;
+using System.Linq;
+using System.Threading;
+using System.Threading.Tasks;
+using Shouldly;
+using Xunit;
+using ZB.MOM.WW.OtOpcUa.Core.Abstractions;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Proxy.Tests.LiveStack;
+
+/// <summary>
+///     End-to-end smoke against the installed <c>OtOpcUaGalaxyHost</c> Windows service.
+///     Closes LMX follow-up #5 — exercises the full topology: <see cref="GalaxyProxyDriver"/>
+///     in-process → named-pipe IPC → <c>OtOpcUaGalaxyHost</c> service → <c>MxAccessGalaxyBackend</c> →
+///     live MXAccess runtime → real Galaxy objects + attributes.
+/// </summary>
+/// <remarks>
+///     <para>
+///         <b>Preconditions</b> (all checked by <see cref="LiveStackFixture"/>, surfaced via
+///         <c>Assert.Skip</c> when missing):
+///     </para>
+///     <list type="bullet">
+///         <item>AVEVA System Platform installed + Platform deployed.</item>
+///         <item><c>aaBootstrap</c> / <c>aaGR</c> / <c>NmxSvc</c> / <c>MSSQLSERVER</c> running.</item>
+///         <item>MXAccess COM server registered.</item>
+///         <item>ZB database exists with at least one deployed gobject.</item>
+///         <item><c>OtOpcUaGalaxyHost</c> service installed + running (named pipe accepting connections).</item>
+///         <item>Shared secret discoverable via <c>OTOPCUA_GALAXY_SECRET</c> env var or the
+///               service's registry Environment values (test host typically needs to be elevated
+///               to read the latter).</item>
+///         <item>Test process runs as the account listed in the service's pipe ACL
+///               (<c>OTOPCUA_ALLOWED_SID</c>, typically the service account per decision #76).</item>
+///     </list>
+///     <para>
+///         Tests here are deliberately read-only. Writes against live Galaxy attributes are a
+///         separate concern — they need a test-only UDA or an agreed scratch tag so they can't
+///         accidentally mutate a process-critical value. Adding a write test is a follow-up
+///         PR that reuses this fixture.
+///     </para>
+/// </remarks>
+[Trait("Category", "LiveGalaxy")]
+[Collection(LiveStackCollection.Name)]
+public sealed class LiveStackSmokeTests(LiveStackFixture fixture)
+{
+    [Fact]
+    public void Fixture_initialized_successfully()
+    {
+        fixture.SkipIfUnavailable();
+        // If the fixture init succeeded, Driver is non-null and InitializeAsync completed.
+        // This is the cheapest possible assertion that the IPC handshake worked end-to-end;
+        // every other test in this class depends on it.
+        fixture.Driver.ShouldNotBeNull();
+        fixture.Config.ShouldNotBeNull();
+        fixture.PrerequisiteReport.ShouldNotBeNull();
+        fixture.PrerequisiteReport!.IsLivetestReady.ShouldBeTrue(fixture.PrerequisiteReport.SkipReason);
+    }
+
+    [Fact]
+    public void Driver_reports_Healthy_after_IPC_handshake()
+    {
+        fixture.SkipIfUnavailable();
+        var health = fixture.Driver!.GetHealth();
+        health.State.ShouldBe(DriverState.Healthy,
+            $"Expected Healthy after successful IPC connect; Reason={health.LastError}");
+    }
+
+    [Fact]
+    public async Task DiscoverAsync_returns_at_least_one_variable_from_live_galaxy()
+    {
+        fixture.SkipIfUnavailable();
+        var builder = new CapturingAddressSpaceBuilder();
+        using var cts = new CancellationTokenSource(TimeSpan.FromSeconds(30));
+        await fixture.Driver!.DiscoverAsync(builder, cts.Token);
+
+        builder.Variables.Count.ShouldBeGreaterThan(0,
+            "Live Galaxy has > 0 deployed objects per the prereq check — at least one variable must be discovered. " +
+            "Zero usually means the Host couldn't read ZB (check OTOPCUA_GALAXY_ZB_CONN in the service Environment).");
+
+        // Every discovered attribute must carry a non-empty FullName so the OPC UA server can
+        // route reads/writes back. Regression guard — PR 19 normalized this across drivers.
+        builder.Variables.ShouldAllBe(v => !string.IsNullOrEmpty(v.AttributeInfo.FullName));
+    }
+
+    [Fact]
+    public void GetHostStatuses_reports_at_least_one_platform()
+    {
+        fixture.SkipIfUnavailable();
+        var statuses = fixture.Driver!.GetHostStatuses();
+        statuses.Count.ShouldBeGreaterThan(0,
+            "Live Galaxy must report at least one Platform/AppEngine host via IHostConnectivityProbe. " +
+            "Zero means the Host's probe loop hasn't completed its first tick or the Platform isn't deployed locally.");
+
+        // Host names are driver-opaque to the Core but non-empty by contract.
+        statuses.ShouldAllBe(h => !string.IsNullOrEmpty(h.HostName));
+    }
+
+    [Fact]
+    public async Task Can_read_a_discovered_variable_from_live_galaxy()
+    {
+        fixture.SkipIfUnavailable();
+        var builder = new CapturingAddressSpaceBuilder();
+        using var cts = new CancellationTokenSource(TimeSpan.FromSeconds(30));
+        await fixture.Driver!.DiscoverAsync(builder, cts.Token);
+        builder.Variables.Count.ShouldBeGreaterThan(0);
+
+        // Pick the first discovered variable. Read-only smoke — we don't assert on Value,
+        // only that a ReadAsync round-trip through Proxy → Host pipe → MXAccess → back
+        // returns a snapshot with a non-BadInternalError status. Galaxy attributes default to
+        // Uncertain quality until the Engine's first scan publishes them, which is fine here.
+        var full = builder.Variables[0].AttributeInfo.FullName;
+        var snapshots = await fixture.Driver!.ReadAsync([full], cts.Token);
+
+        snapshots.Count.ShouldBe(1);
+        var snap = snapshots[0];
+        snap.StatusCode.ShouldNotBe(0x80020000u,
+            $"Read returned BadInternalError for {full} — the Host couldn't fulfil the request. " +
+            $"Investigate: the Host service's logs at {System.Environment.GetFolderPath(System.Environment.SpecialFolder.CommonApplicationData)}\\OtOpcUa\\Galaxy\\logs.");
+    }
+
+    [Fact]
+    public async Task Write_then_read_roundtrips_a_writable_Boolean_attribute_on_TestMachine_001()
+    {
+        // PR 40 — finishes LMX #5. Targets DelmiaReceiver_001.TestAttribute, the writable
+        // Boolean attribute on the TestMachine_001 hierarchy that the dev Galaxy was deployed
+        // with for exactly this kind of integration testing. We invert the current value and
+        // assert the new value comes back, then restore the original so the test is effectively
+        // idempotent (Galaxy holds the value across runs since it's a deployed UDA).
+        fixture.SkipIfUnavailable();
+        const string fullRef = "DelmiaReceiver_001.TestAttribute";
+        using var cts = new CancellationTokenSource(TimeSpan.FromSeconds(30));
+
+        // Read current value first — gives the cleanup path the right baseline. Galaxy may
+        // return Uncertain quality until the Engine has scanned the attribute at least once;
+        // we don't read into a strongly-typed bool until Status is Good.
+        var before = (await fixture.Driver!.ReadAsync([fullRef], cts.Token))[0];
+        before.StatusCode.ShouldNotBe(0x80020000u, $"baseline read failed for {fullRef}: {before.Value}");
+        var originalBool = Convert.ToBoolean(before.Value ?? false);
+        var inverted = !originalBool;
+
+        try
+        {
+            // Write the inverted value via IWritable.
+            var writeResults = await fixture.Driver!.WriteAsync(
+                [new(fullRef, inverted)], cts.Token);
+            writeResults.Count.ShouldBe(1);
+            writeResults[0].StatusCode.ShouldBe(0u,
+                $"WriteAsync returned status 0x{writeResults[0].StatusCode:X8} for {fullRef} — " +
+                $"check the Host service log at %ProgramData%\\OtOpcUa\\Galaxy\\.");
+
+            // The Engine's scan + acknowledgement is async — read in a short loop with a 5s
+            // budget. Galaxy's attribute roundtrip on a dev box is typically sub-second but
+            // we give headroom for first-scan after a service restart.
+            DataValueSnapshot after = default!;
+            var deadline = DateTime.UtcNow.AddSeconds(5);
+            while (DateTime.UtcNow < deadline)
+            {
+                after = (await fixture.Driver!.ReadAsync([fullRef], cts.Token))[0];
+                if (after.StatusCode == 0u && Convert.ToBoolean(after.Value ?? false) == inverted) break;
+                await Task.Delay(200, cts.Token);
+            }
+            after.StatusCode.ShouldBe(0u, "post-write read failed");
+            Convert.ToBoolean(after.Value ?? false).ShouldBe(inverted,
+                $"Wrote {inverted} but Galaxy returned {after.Value} after the scan window.");
+        }
+        finally
+        {
+            // Restore — best-effort. If this throws the test still reports its primary result;
+            // we just leave a flipped TestAttribute on the dev box (benign, name says it all).
+            try { await fixture.Driver!.WriteAsync([new(fullRef, originalBool)], cts.Token); }
+            catch { /* swallow */ }
+        }
+    }
+
+    [Fact]
+    public async Task Subscribe_fires_OnDataChange_with_initial_value_then_again_after_a_write()
+    {
+        // Subscribe + write is the canonical "is the data path actually live" test for
+        // an OPC UA driver. We subscribe to the same Boolean attribute, expect an initial-
+        // value callback within a couple of seconds (per ISubscribable's contract — the
+        // driver MAY fire OnDataChange immediately with the current value), then write a
+        // distinct value and expect a second callback carrying the new value.
+        fixture.SkipIfUnavailable();
+        const string fullRef = "DelmiaReceiver_001.TestAttribute";
+        using var cts = new CancellationTokenSource(TimeSpan.FromSeconds(30));
+
+        // Capture every OnDataChange notification for this fullRef onto a thread-safe queue
+        // we can poll from the test thread. Galaxy's MXAccess advisory fires on its own
+        // thread; we don't want to block it.
+        var notifications = new System.Collections.Concurrent.ConcurrentQueue<DataValueSnapshot>();
+        void Handler(object? sender, DataChangeEventArgs e)
+        {
+            if (string.Equals(e.FullReference, fullRef, StringComparison.OrdinalIgnoreCase))
+                notifications.Enqueue(e.Snapshot);
+        }
+        fixture.Driver!.OnDataChange += Handler;
+
+        // Read current value so we know which value to write to force a transition.
+        var before = (await fixture.Driver!.ReadAsync([fullRef], cts.Token))[0];
+        var originalBool = Convert.ToBoolean(before.Value ?? false);
+        var toWrite = !originalBool;
+
+        ISubscriptionHandle? handle = null;
+        try
+        {
+            handle = await fixture.Driver!.SubscribeAsync(
+                [fullRef], TimeSpan.FromMilliseconds(250), cts.Token);
+
+            // Wait for initial-value notification — typical < 1s on a hot Galaxy, give 5s.
+            await WaitForAsync(() => notifications.Count >= 1, TimeSpan.FromSeconds(5), cts.Token);
+            notifications.Count.ShouldBeGreaterThanOrEqualTo(1,
+                $"No initial-value OnDataChange for {fullRef} within 5s. " +
+                $"Either MXAccess subscription failed silently or the Engine hasn't scanned yet.");
+
+            // Drain the initial-value queue before writing so we count post-write deltas only.
+            var initialCount = notifications.Count;
+
+            // Write the toggled value. Engine scan + advisory fires the second callback.
+            var w = await fixture.Driver!.WriteAsync([new(fullRef, toWrite)], cts.Token);
+            w[0].StatusCode.ShouldBe(0u);
+
+            await WaitForAsync(() => notifications.Count > initialCount, TimeSpan.FromSeconds(8), cts.Token);
+            notifications.Count.ShouldBeGreaterThan(initialCount,
+                $"OnDataChange did not fire after writing {toWrite} to {fullRef} within 8s.");
+
+            // Find the post-write notification carrying the toggled value (initial value may
+            // appear multiple times before the write commits — search the tail).
+            var postWrite = notifications.ToArray().Reverse()
+                .FirstOrDefault(n => n.StatusCode == 0u && Convert.ToBoolean(n.Value ?? false) == toWrite);
+            postWrite.ShouldNotBe(default,
+                $"No OnDataChange carrying the toggled value {toWrite} appeared in the queue: " +
+                string.Join(",", notifications.Select(n => $"{n.Value}@{n.StatusCode:X8}")));
+        }
+        finally
+        {
+            fixture.Driver!.OnDataChange -= Handler;
+            if (handle is not null)
+            {
+                try { await fixture.Driver!.UnsubscribeAsync(handle, cts.Token); } catch { /* swallow */ }
+            }
+            // Restore baseline.
+            try { await fixture.Driver!.WriteAsync([new(fullRef, originalBool)], cts.Token); } catch { /* swallow */ }
+        }
+    }
+
+    private static async Task WaitForAsync(Func<bool> predicate, TimeSpan budget, CancellationToken ct)
+    {
+        var deadline = DateTime.UtcNow + budget;
+        while (DateTime.UtcNow < deadline)
+        {
+            if (predicate()) return;
+            await Task.Delay(100, ct);
+        }
+    }
+
+    /// <summary>
+    ///     Minimal <see cref="IAddressSpaceBuilder"/> implementation that captures every
+    ///     Variable() call into a flat list so tests can inspect what discovery produced
+    ///     without running the full OPC UA node-manager stack.
+    /// </summary>
+    private sealed class CapturingAddressSpaceBuilder : IAddressSpaceBuilder
+    {
+        public List<(string BrowseName, DriverAttributeInfo AttributeInfo)> Variables { get; } = [];
+
+        public IAddressSpaceBuilder Folder(string browseName, string displayName) => this;
+        public IVariableHandle Variable(string browseName, string displayName, DriverAttributeInfo attributeInfo)
+        {
+            Variables.Add((browseName, attributeInfo));
+            return new NoopHandle(attributeInfo.FullName);
+        }
+        public void AddProperty(string browseName, DriverDataType dataType, object? value) { }
+
+        private sealed class NoopHandle(string fullReference) : IVariableHandle
+        {
+            public string FullReference { get; } = fullReference;
+            public IAlarmConditionSink MarkAsAlarmCondition(AlarmConditionInfo info) => new NoopSink();
+            private sealed class NoopSink : IAlarmConditionSink
+            {
+                public void OnTransition(AlarmEventArgs args) { }
+            }
+        }
+    }
+}

tests/ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Proxy.Tests/ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Proxy.Tests.csproj

@@ -22,6 +22,7 @@
     <ItemGroup>
         <ProjectReference Include="..\..\src\ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Proxy\ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Proxy.csproj"/>
         <ProjectReference Include="..\..\src\ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Host\ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Host.csproj"/>
+        <ProjectReference Include="..\ZB.MOM.WW.OtOpcUa.Driver.Galaxy.TestSupport\ZB.MOM.WW.OtOpcUa.Driver.Galaxy.TestSupport.csproj"/>
     </ItemGroup>
 
     <ItemGroup>

tests/ZB.MOM.WW.OtOpcUa.Driver.Galaxy.TestSupport/AvevaPrerequisites.cs

@@ -0,0 +1,163 @@
+using ZB.MOM.WW.OtOpcUa.Driver.Galaxy.TestSupport.Probes;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.Galaxy.TestSupport;
+
+/// <summary>
+///     Entry point for live-AVEVA test fixtures. Runs every relevant probe and returns a
+///     <see cref="PrerequisiteReport"/> whose <c>SkipReason</c> feeds <c>Assert.Skip</c> when
+///     the environment isn't set up. Non-Windows hosts get a single aggregated Skip row per
+///     category instead of a flood of individual skips.
+/// </summary>
+/// <remarks>
+///     <para><b>Call shape</b>:</para>
+///     <code>
+///         var report = await AvevaPrerequisites.CheckAllAsync();
+///         if (report.SkipReason is not null) Assert.Skip(report.SkipReason);
+///     </code>
+///     <para><b>Categories in rough order of 'would I want to know first?'</b>:</para>
+///     <list type="number">
+///         <item>Environment — process bitness, OS platform, RPCSS up.</item>
+///         <item>AvevaInstall — Framework registry, install paths, no pending reboot.</item>
+///         <item>AvevaCoreService — aaBootstrap / aaGR / NmxSvc running.</item>
+///         <item>MxAccessCom — LMXProxy.LMXProxyServer ProgID → CLSID → file-on-disk.</item>
+///         <item>GalaxyRepository — SQL reachable, ZB exists, deployed-object count.</item>
+///         <item>OtOpcUaService — our two Windows services + GLAuth.</item>
+///         <item>AvevaSoftService — aaLogger etc., warn only.</item>
+///         <item>AvevaHistorian — aahClientAccessPoint etc., optional.</item>
+///     </list>
+///     <para><b>What's NOT checked here</b>: end-to-end subscribe / read / write against a real
+///     Galaxy tag. That's the job of the live-smoke tests this helper gates — the helper just
+///     tells them whether running is worthwhile.</para>
+/// </remarks>
+public static class AvevaPrerequisites
+{
+    // -------- Individual service lists (kept as data so tests can inspect / override) --------
+
+    /// <summary>Services whose absence means live-Galaxy tests can't run at all.</summary>
+    internal static readonly (string Name, string Purpose)[] CoreServices =
+    [
+        ("aaBootstrap", "master service that starts the Platform process + brokers aa* communication"),
+        ("aaGR", "Galaxy Repository host — mediates IDE / runtime access to ZB"),
+        ("NmxSvc", "Network Message Exchange — MXAccess + Bootstrap transport"),
+        ("MSSQLSERVER", "SQL Server instance that hosts the ZB database"),
+    ];
+
+    /// <summary>Warn-but-don't-fail AVEVA services.</summary>
+    internal static readonly (string Name, string Purpose)[] SoftServices =
+    [
+        ("aaLogger", "ArchestrA Logger — diagnostic log receiver; stack runs without it but error visibility suffers"),
+        ("aaUserValidator", "OS user/group auth for ArchestrA security; only required when Galaxy security mode isn't 'Open'"),
+        ("aaGlobalDataCacheMonitorSvr", "cross-platform global data cache; single-node dev boxes run fine without it"),
+    ];
+
+    /// <summary>Optional AVEVA Historian services — only required for HistoryRead IPC paths.</summary>
+    internal static readonly (string Name, string Purpose)[] HistorianServices =
+    [
+        ("aahClientAccessPoint", "AVEVA Historian Client Access Point — HistoryRead IPC endpoint"),
+        ("aahGateway", "AVEVA Historian Gateway"),
+    ];
+
+    /// <summary>OtOpcUa-stack Windows services + third-party deps we manage.</summary>
+    internal static readonly (string Name, string Purpose, bool HardRequired)[] OtOpcUaServices =
+    [
+        ("OtOpcUaGalaxyHost", "Galaxy.Host out-of-process service (net48 x86, STA + MXAccess)", true),
+        ("OtOpcUa", "Main OPC UA server service (hosts Proxy + DriverHost + Admin-facing DB publisher)", false),
+        ("GLAuth", "LDAP server (dev only) — glauth.exe on localhost:3893", false),
+    ];
+
+    // -------- Orchestrator --------
+
+    public static async Task<PrerequisiteReport> CheckAllAsync(
+        Options? options = null, CancellationToken ct = default)
+    {
+        options ??= new Options();
+        var checks = new List<PrerequisiteCheck>();
+
+        // Environment
+        checks.Add(MxAccessComProbe.CheckProcessBitness());
+
+        // AvevaInstall — registry + files
+        checks.Add(RegistryProbe.CheckFrameworkInstalled());
+        checks.Add(RegistryProbe.CheckPlatformDeployed());
+        checks.Add(RegistryProbe.CheckRebootPending());
+
+        // AvevaCoreService
+        foreach (var (name, purpose) in CoreServices)
+            checks.Add(ServiceProbe.Check(name, PrerequisiteCategory.AvevaCoreService, hardRequired: true, whatItDoes: purpose));
+
+        // MxAccessCom
+        checks.Add(MxAccessComProbe.Check());
+
+        // GalaxyRepository
+        checks.Add(await SqlProbe.CheckZbDatabaseAsync(options.SqlConnectionString, ct));
+        // Deployed-object count only makes sense if the DB check passed.
+        if (checks[checks.Count - 1].Status == PrerequisiteStatus.Pass)
+            checks.Add(await SqlProbe.CheckDeployedObjectCountAsync(options.SqlConnectionString, ct));
+
+        // OtOpcUaService
+        foreach (var (name, purpose, hard) in OtOpcUaServices)
+            checks.Add(ServiceProbe.Check(name, PrerequisiteCategory.OtOpcUaService, hardRequired: hard, whatItDoes: purpose));
+        if (options.CheckGalaxyHostPipe)
+            checks.Add(await NamedPipeProbe.CheckGalaxyHostPipeAsync(options.GalaxyHostPipeName, ct));
+
+        // AvevaSoftService
+        foreach (var (name, purpose) in SoftServices)
+            checks.Add(ServiceProbe.Check(name, PrerequisiteCategory.AvevaSoftService, hardRequired: false, whatItDoes: purpose));
+
+        // AvevaHistorian
+        if (options.CheckHistorian)
+        {
+            foreach (var (name, purpose) in HistorianServices)
+                checks.Add(ServiceProbe.Check(name, PrerequisiteCategory.AvevaHistorian, hardRequired: false, whatItDoes: purpose));
+        }
+
+        return new PrerequisiteReport(checks);
+    }
+
+    /// <summary>
+    ///     Narrower check for tests that only need the Galaxy Repository (SQL) path — don't
+    ///     pay the cost of probing every aa* service when the test only reads gobject rows.
+    /// </summary>
+    public static async Task<PrerequisiteReport> CheckRepositoryOnlyAsync(
+        string? sqlConnectionString = null, CancellationToken ct = default)
+    {
+        var checks = new List<PrerequisiteCheck>
+        {
+            await SqlProbe.CheckZbDatabaseAsync(sqlConnectionString, ct),
+        };
+        if (checks[0].Status == PrerequisiteStatus.Pass)
+            checks.Add(await SqlProbe.CheckDeployedObjectCountAsync(sqlConnectionString, ct));
+        return new PrerequisiteReport(checks);
+    }
+
+    /// <summary>
+    ///     Narrower check for the named-pipe endpoint — tests that drive the full Proxy
+    ///     against a live Galaxy.Host service don't need the SQL or AVEVA-internal probes
+    ///     (the Host does that work internally; we just need the pipe to accept).
+    /// </summary>
+    public static async Task<PrerequisiteReport> CheckGalaxyHostPipeOnlyAsync(
+        string? pipeName = null, CancellationToken ct = default)
+    {
+        var checks = new List<PrerequisiteCheck>
+        {
+            await NamedPipeProbe.CheckGalaxyHostPipeAsync(pipeName, ct),
+        };
+        return new PrerequisiteReport(checks);
+    }
+
+    /// <summary>Knobs for <see cref="CheckAllAsync"/>.</summary>
+    public sealed class Options
+    {
+        /// <summary>SQL Server connection string — defaults to Windows-auth <c>localhost\ZB</c>.</summary>
+        public string? SqlConnectionString { get; init; }
+
+        /// <summary>Named-pipe endpoint for OtOpcUaGalaxyHost — defaults to <c>OtOpcUaGalaxy</c>.</summary>
+        public string? GalaxyHostPipeName { get; init; }
+
+        /// <summary>Include the named-pipe probe. Off by default — it's a seconds-long TCP-like probe and some tests don't need it.</summary>
+        public bool CheckGalaxyHostPipe { get; init; } = true;
+
+        /// <summary>Include Historian service probes. Off by default — Historian is optional.</summary>
+        public bool CheckHistorian { get; init; } = false;
+    }
+}

tests/ZB.MOM.WW.OtOpcUa.Driver.Galaxy.TestSupport/Net48Polyfills.cs

@@ -0,0 +1,26 @@
+#if NET48
+// Polyfills for C# 9+ language features that the helper uses but that net48 BCL doesn't
+// provide. Keeps the sources single-target-free at the language level — the same .cs files
+// build on both frameworks without preprocessor guards in the callsites.
+
+namespace System.Runtime.CompilerServices
+{
+    /// <summary>Required by C# 9 <c>init</c>-only setters and <c>record</c> types.</summary>
+    internal static class IsExternalInit { }
+}
+
+namespace System.Runtime.Versioning
+{
+    /// <summary>
+    ///     Minimal shim for the .NET 5+ <c>SupportedOSPlatformAttribute</c>. Pure marker for the
+    ///     compiler on net10; on net48 we still want the attribute to exist so the same
+    ///     <c>[SupportedOSPlatform("windows")]</c> source compiles. The attribute is internal
+    ///     and attribute-targets-everything to minimize surface.
+    /// </summary>
+    [AttributeUsage(AttributeTargets.All, Inherited = false, AllowMultiple = true)]
+    internal sealed class SupportedOSPlatformAttribute(string platformName) : Attribute
+    {
+        public string PlatformName { get; } = platformName;
+    }
+}
+#endif

tests/ZB.MOM.WW.OtOpcUa.Driver.Galaxy.TestSupport/PrerequisiteCheck.cs

@@ -0,0 +1,44 @@
+namespace ZB.MOM.WW.OtOpcUa.Driver.Galaxy.TestSupport;
+
+/// <summary>One prerequisite probe's outcome. <see cref="AvevaPrerequisites"/> returns many of these.</summary>
+/// <param name="Name">Short diagnostic id — e.g. <c>service:aaBootstrap</c>, <c>sql:ZB</c>, <c>registry:ArchestrA.Framework</c>.</param>
+/// <param name="Category">Which subsystem the probe belongs to — lets callers filter (e.g. "Historian warns don't gate the core Galaxy smoke").</param>
+/// <param name="Status">Outcome.</param>
+/// <param name="Detail">One-line specific message an operator can act on — <c>"aaGR not installed — install the Galaxy Repository role from the System Platform setup"</c> beats <c>"failed"</c>.</param>
+public sealed record PrerequisiteCheck(
+    string Name,
+    PrerequisiteCategory Category,
+    PrerequisiteStatus Status,
+    string Detail);
+
+public enum PrerequisiteStatus
+{
+    /// <summary>Prerequisite is met; no action needed.</summary>
+    Pass,
+    /// <summary>Soft dependency missing — stack still runs but some feature (e.g. logging) is degraded.</summary>
+    Warn,
+    /// <summary>Hard dependency missing — live tests can't proceed; <see cref="PrerequisiteReport.SkipReason"/> surfaces this.</summary>
+    Fail,
+    /// <summary>Probe wasn't applicable in this environment (e.g. non-Windows host, Historian not installed).</summary>
+    Skip,
+}
+
+public enum PrerequisiteCategory
+{
+    /// <summary>Platform sanity — process bitness, OS platform, DCOM/RPCSS.</summary>
+    Environment,
+    /// <summary>Hard-required AVEVA Windows services (aaBootstrap, aaGR, NmxSvc).</summary>
+    AvevaCoreService,
+    /// <summary>Soft-required AVEVA Windows services (aaLogger, aaUserValidator) — warn only.</summary>
+    AvevaSoftService,
+    /// <summary>ArchestrA Framework install markers (registry + files).</summary>
+    AvevaInstall,
+    /// <summary>MXAccess COM server registration + file on disk.</summary>
+    MxAccessCom,
+    /// <summary>SQL Server reachability + ZB database presence + deployed-object count.</summary>
+    GalaxyRepository,
+    /// <summary>Historian services (optional — only required for HistoryRead IPC paths).</summary>
+    AvevaHistorian,
+    /// <summary>OtOpcUa-side services (OtOpcUa, OtOpcUaGalaxyHost) + third-party deps (GLAuth).</summary>
+    OtOpcUaService,
+}

tests/ZB.MOM.WW.OtOpcUa.Driver.Galaxy.TestSupport/PrerequisiteReport.cs

@@ -0,0 +1,94 @@
+using System.Text;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.Galaxy.TestSupport;
+
+/// <summary>
+///     Aggregated result of an <see cref="AvevaPrerequisites.CheckAll"/> run. Test fixtures
+///     typically call <see cref="SkipReason"/> to produce the argument for xUnit's
+///     <c>Assert.Skip</c> when any hard dependency failed.
+/// </summary>
+public sealed class PrerequisiteReport
+{
+    public IReadOnlyList<PrerequisiteCheck> Checks { get; }
+
+    public PrerequisiteReport(IEnumerable<PrerequisiteCheck> checks)
+    {
+        Checks = [.. checks];
+    }
+
+    /// <summary>True when every probe is Pass / Warn / Skip — no Fail entries.</summary>
+    public bool IsLivetestReady => !Checks.Any(c => c.Status == PrerequisiteStatus.Fail);
+
+    /// <summary>
+    ///     True when only the AVEVA-side probes pass — ignores failures in the
+    ///     <see cref="PrerequisiteCategory.OtOpcUaService"/> category. Lets a live-test gate
+    ///     say "AVEVA is ready even if the v2 services aren't installed yet" without
+    ///     conflating the two. Useful for tests that exercise Galaxy directly (e.g.
+    ///     <see cref="GalaxyRepositoryLiveSmokeTests"/>) rather than through our stack.
+    /// </summary>
+    public bool IsAvevaSideReady =>
+        !Checks.Any(c => c.Status == PrerequisiteStatus.Fail && c.Category != PrerequisiteCategory.OtOpcUaService);
+
+    /// <summary>
+    ///     Multi-line message for <c>Assert.Skip</c> when a hard dependency isn't met. Returns
+    ///     null when <see cref="IsLivetestReady"/> is true.
+    /// </summary>
+    public string? SkipReason
+    {
+        get
+        {
+            var fails = Checks.Where(c => c.Status == PrerequisiteStatus.Fail).ToList();
+            if (fails.Count == 0) return null;
+
+            var sb = new StringBuilder();
+            sb.AppendLine($"Live-AVEVA prerequisites not met ({fails.Count} failed):");
+            foreach (var f in fails)
+                sb.AppendLine($"  • [{f.Category}] {f.Name} — {f.Detail}");
+            sb.Append("Run `Get-Service aa*` / `sqlcmd -S localhost -d ZB -E -Q \"SELECT 1\"` to triage.");
+            return sb.ToString();
+        }
+    }
+
+    /// <summary>
+    ///     Human-readable summary of warnings — caller decides whether to log or ignore. Useful
+    ///     when a live test does pass but an operator should know their environment is degraded.
+    /// </summary>
+    public string? Warnings
+    {
+        get
+        {
+            var warns = Checks.Where(c => c.Status == PrerequisiteStatus.Warn).ToList();
+            if (warns.Count == 0) return null;
+
+            var sb = new StringBuilder();
+            sb.AppendLine($"AVEVA prerequisites with warnings ({warns.Count}):");
+            foreach (var w in warns)
+                sb.AppendLine($"  • [{w.Category}] {w.Name} — {w.Detail}");
+            return sb.ToString();
+        }
+    }
+
+    /// <summary>
+    ///     Throw <see cref="InvalidOperationException"/> if any <paramref name="categories"/>
+    ///     contain a Fail — useful when a specific test needs, say, Galaxy Repository but doesn't
+    ///     care about Historian. Call before <c>Assert.Skip</c> if you want to be strict.
+    /// </summary>
+    public void RequireCategories(params PrerequisiteCategory[] categories)
+    {
+        var set = categories.ToHashSet();
+        var fails = Checks.Where(c => c.Status == PrerequisiteStatus.Fail && set.Contains(c.Category)).ToList();
+        if (fails.Count == 0) return;
+
+        var detail = string.Join("; ", fails.Select(f => $"{f.Name}: {f.Detail}"));
+        throw new InvalidOperationException($"Required prerequisite categories failed: {detail}");
+    }
+
+    public override string ToString()
+    {
+        var sb = new StringBuilder();
+        sb.AppendLine($"PrerequisiteReport: {Checks.Count} checks");
+        foreach (var c in Checks)
+            sb.AppendLine($"  [{c.Status,-4}] {c.Category}/{c.Name}: {c.Detail}");
+        return sb.ToString();
+    }
+}

tests/ZB.MOM.WW.OtOpcUa.Driver.Galaxy.TestSupport/Probes/MxAccessComProbe.cs

@@ -0,0 +1,102 @@
+using System.Runtime.InteropServices;
+using System.Runtime.Versioning;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.Galaxy.TestSupport.Probes;
+
+/// <summary>
+///     Confirms MXAccess COM server registration by resolving the
+///     <c>LMXProxy.LMXProxyServer</c> ProgID to its CLSID, then checking that the CLSID's
+///     32-bit <c>InprocServer32</c> entry points at a file that exists on disk.
+/// </summary>
+/// <remarks>
+///     A common failure mode on partial installs: ProgID is registered but the CLSID
+///     InprocServer32 DLL is missing (previous install uninstalled but registry orphan remains).
+///     This probe surfaces that case with an actionable message instead of the
+///     <c>0x80040154 REGDB_E_CLASSNOTREG</c> you'd see from a late COM activation failure.
+/// </remarks>
+public static class MxAccessComProbe
+{
+    public const string ProgId = "LMXProxy.LMXProxyServer";
+    public const string VersionedProgId = "LMXProxy.LMXProxyServer.1";
+
+    public static PrerequisiteCheck Check()
+    {
+        if (!RuntimeInformation.IsOSPlatform(OSPlatform.Windows))
+        {
+            return new PrerequisiteCheck("com:LMXProxy", PrerequisiteCategory.MxAccessCom,
+                PrerequisiteStatus.Skip, "COM registration probes only run on Windows.");
+        }
+        return CheckWindows();
+    }
+
+    [SupportedOSPlatform("windows")]
+    private static PrerequisiteCheck CheckWindows()
+    {
+        try
+        {
+            var (clsid, dll) = RegistryProbe.ResolveProgIdToInproc(ProgId);
+            if (clsid is null)
+            {
+                return new PrerequisiteCheck("com:LMXProxy", PrerequisiteCategory.MxAccessCom,
+                    PrerequisiteStatus.Fail,
+                    $"ProgID {ProgId} not registered — MXAccess COM server isn't installed. " +
+                    $"Install System Platform's MXAccess component and re-run.");
+            }
+
+            if (string.IsNullOrWhiteSpace(dll))
+            {
+                return new PrerequisiteCheck("com:LMXProxy", PrerequisiteCategory.MxAccessCom,
+                    PrerequisiteStatus.Fail,
+                    $"ProgID {ProgId} → CLSID {clsid} but InprocServer32 is empty. " +
+                    $"Registry is orphaned; re-register with: regsvr32 /s LmxProxy.dll (from an elevated cmd in the Framework bin dir).");
+            }
+
+            // Resolve the recorded path — sometimes registered as a bare filename that the COM
+            // runtime resolves via the current process's DLL-search path. Accept either an
+            // absolute path that exists, or a bare filename whose resolution we can't verify
+            // without loading it (treat as Pass-with-note).
+            if (Path.IsPathRooted(dll))
+            {
+                if (!File.Exists(dll))
+                {
+                    return new PrerequisiteCheck("com:LMXProxy", PrerequisiteCategory.MxAccessCom,
+                        PrerequisiteStatus.Fail,
+                        $"ProgID {ProgId} → CLSID {clsid} → InprocServer32 {dll}, but the file is missing. " +
+                        $"Re-install the Framework or restore from backup.");
+                }
+                return new PrerequisiteCheck("com:LMXProxy", PrerequisiteCategory.MxAccessCom,
+                    PrerequisiteStatus.Pass,
+                    $"ProgID {ProgId} → {dll} (file exists).");
+            }
+
+            return new PrerequisiteCheck("com:LMXProxy", PrerequisiteCategory.MxAccessCom,
+                PrerequisiteStatus.Pass,
+                $"ProgID {ProgId} → {dll} (bare filename — relies on PATH resolution at COM activation time).");
+        }
+        catch (Exception ex)
+        {
+            return new PrerequisiteCheck("com:LMXProxy", PrerequisiteCategory.MxAccessCom,
+                PrerequisiteStatus.Warn,
+                $"Probe failed: {ex.GetType().Name}: {ex.Message}");
+        }
+    }
+
+    /// <summary>
+    ///     Warn when running as a 64-bit process — MXAccess COM activation will fail with
+    ///     <c>0x80040154</c> regardless of registration state. The production drivers run net48
+    ///     x86; xunit hosts run 64-bit by default so this often surfaces first.
+    /// </summary>
+    public static PrerequisiteCheck CheckProcessBitness()
+    {
+        if (Environment.Is64BitProcess)
+        {
+            return new PrerequisiteCheck("env:ProcessBitness", PrerequisiteCategory.Environment,
+                PrerequisiteStatus.Warn,
+                "Test host is 64-bit. Direct MXAccess COM activation would fail with REGDB_E_CLASSNOTREG (0x80040154); " +
+                "the production driver workaround is to run Galaxy.Host as a 32-bit process. Tests that only " +
+                "talk to the Host service over the named pipe aren't affected.");
+        }
+        return new PrerequisiteCheck("env:ProcessBitness", PrerequisiteCategory.Environment,
+            PrerequisiteStatus.Pass, "Test host is 32-bit.");
+    }
+}

tests/ZB.MOM.WW.OtOpcUa.Driver.Galaxy.TestSupport/Probes/NamedPipeProbe.cs

@@ -0,0 +1,59 @@
+using System.IO.Pipes;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.Galaxy.TestSupport.Probes;
+
+/// <summary>
+///     Verifies the <c>OtOpcUaGalaxyHost</c> named-pipe endpoint is accepting connections —
+///     the handshake the Proxy performs at boot. A clean pipe connect without sending any
+///     framed message proves the Host service is listening; we disconnect immediately so we
+///     don't consume a session slot.
+/// </summary>
+/// <remarks>
+///     Default pipe name matches the installer script's <c>OTOPCUA_GALAXY_PIPE</c> default.
+///     Override when the Host service was installed with a non-default name (custom deployments).
+/// </remarks>
+public static class NamedPipeProbe
+{
+    public const string DefaultGalaxyHostPipeName = "OtOpcUaGalaxy";
+
+    public static async Task<PrerequisiteCheck> CheckGalaxyHostPipeAsync(
+        string? pipeName = null, CancellationToken ct = default)
+    {
+        pipeName ??= DefaultGalaxyHostPipeName;
+        try
+        {
+            using var client = new NamedPipeClientStream(
+                serverName: ".",
+                pipeName: pipeName,
+                direction: PipeDirection.InOut,
+                options: PipeOptions.Asynchronous);
+            using var cts = CancellationTokenSource.CreateLinkedTokenSource(ct);
+            cts.CancelAfter(TimeSpan.FromSeconds(2));
+            await client.ConnectAsync(cts.Token);
+
+            return new PrerequisiteCheck("pipe:OtOpcUaGalaxyHost", PrerequisiteCategory.OtOpcUaService,
+                PrerequisiteStatus.Pass,
+                $@"Pipe \\.\pipe\{pipeName} accepted a connection — OtOpcUaGalaxyHost is listening.");
+        }
+        catch (OperationCanceledException)
+        {
+            return new PrerequisiteCheck("pipe:OtOpcUaGalaxyHost", PrerequisiteCategory.OtOpcUaService,
+                PrerequisiteStatus.Fail,
+                $@"Pipe \\.\pipe\{pipeName} not connectable within 2s — OtOpcUaGalaxyHost service isn't running. " +
+                "Start with: sc.exe start OtOpcUaGalaxyHost");
+        }
+        catch (TimeoutException)
+        {
+            return new PrerequisiteCheck("pipe:OtOpcUaGalaxyHost", PrerequisiteCategory.OtOpcUaService,
+                PrerequisiteStatus.Fail,
+                $@"Pipe \\.\pipe\{pipeName} connect timed out — service may be starting or stuck. " +
+                "Check: sc.exe query OtOpcUaGalaxyHost");
+        }
+        catch (Exception ex)
+        {
+            return new PrerequisiteCheck("pipe:OtOpcUaGalaxyHost", PrerequisiteCategory.OtOpcUaService,
+                PrerequisiteStatus.Fail,
+                $@"Pipe \\.\pipe\{pipeName} connect failed: {ex.GetType().Name}: {ex.Message}");
+        }
+    }
+}

tests/ZB.MOM.WW.OtOpcUa.Driver.Galaxy.TestSupport/Probes/RegistryProbe.cs

@@ -0,0 +1,162 @@
+using System.Runtime.InteropServices;
+using System.Runtime.Versioning;
+using Microsoft.Win32;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.Galaxy.TestSupport.Probes;
+
+/// <summary>
+///     Reads HKLM registry keys to confirm ArchestrA Framework / System Platform install
+///     markers. Matches the registered paths documented in
+///     <c>docs/v2/implementation/</c> — System Platform is 32-bit so keys live under
+///     <c>HKLM\SOFTWARE\WOW6432Node\ArchestrA\...</c>.
+/// </summary>
+public static class RegistryProbe
+{
+    // Canonical install roots per the research on our dev box (System Platform 2020 R2).
+    public const string ArchestrARootKey = @"SOFTWARE\WOW6432Node\ArchestrA";
+    public const string FrameworkKey = @"SOFTWARE\WOW6432Node\ArchestrA\Framework";
+    public const string PlatformKey = @"SOFTWARE\WOW6432Node\ArchestrA\Framework\Platform";
+    public const string MsiInstallKey = @"SOFTWARE\WOW6432Node\ArchestrA\MSIInstall";
+
+    public static PrerequisiteCheck CheckFrameworkInstalled()
+    {
+        if (!RuntimeInformation.IsOSPlatform(OSPlatform.Windows))
+        {
+            return new PrerequisiteCheck("registry:ArchestrA.Framework", PrerequisiteCategory.AvevaInstall,
+                PrerequisiteStatus.Skip, "Registry probes only run on Windows.");
+        }
+        return FrameworkInstalledWindows();
+    }
+
+    public static PrerequisiteCheck CheckPlatformDeployed()
+    {
+        if (!RuntimeInformation.IsOSPlatform(OSPlatform.Windows))
+        {
+            return new PrerequisiteCheck("registry:ArchestrA.Platform", PrerequisiteCategory.AvevaInstall,
+                PrerequisiteStatus.Skip, "Registry probes only run on Windows.");
+        }
+        return PlatformDeployedWindows();
+    }
+
+    public static PrerequisiteCheck CheckRebootPending()
+    {
+        if (!RuntimeInformation.IsOSPlatform(OSPlatform.Windows))
+        {
+            return new PrerequisiteCheck("registry:ArchestrA.RebootPending", PrerequisiteCategory.AvevaInstall,
+                PrerequisiteStatus.Skip, "Registry probes only run on Windows.");
+        }
+        return RebootPendingWindows();
+    }
+
+    [SupportedOSPlatform("windows")]
+    private static PrerequisiteCheck FrameworkInstalledWindows()
+    {
+        try
+        {
+            using var key = Registry.LocalMachine.OpenSubKey(FrameworkKey);
+            if (key is null)
+            {
+                return new PrerequisiteCheck("registry:ArchestrA.Framework", PrerequisiteCategory.AvevaInstall,
+                    PrerequisiteStatus.Fail,
+                    $"Missing {FrameworkKey} — ArchestrA Framework isn't installed. Install AVEVA System Platform from the setup media.");
+            }
+
+            var installPath = key.GetValue("InstallPath") as string;
+            var rootPath = key.GetValue("RootPath") as string;
+            if (string.IsNullOrWhiteSpace(installPath) || string.IsNullOrWhiteSpace(rootPath))
+            {
+                return new PrerequisiteCheck("registry:ArchestrA.Framework", PrerequisiteCategory.AvevaInstall,
+                    PrerequisiteStatus.Warn,
+                    $"Framework key exists but InstallPath/RootPath values missing — install may be incomplete.");
+            }
+
+            return new PrerequisiteCheck("registry:ArchestrA.Framework", PrerequisiteCategory.AvevaInstall,
+                PrerequisiteStatus.Pass,
+                $"Installed at {installPath} (RootPath {rootPath}).");
+        }
+        catch (Exception ex)
+        {
+            return new PrerequisiteCheck("registry:ArchestrA.Framework", PrerequisiteCategory.AvevaInstall,
+                PrerequisiteStatus.Warn,
+                $"Probe failed: {ex.GetType().Name}: {ex.Message}");
+        }
+    }
+
+    [SupportedOSPlatform("windows")]
+    private static PrerequisiteCheck PlatformDeployedWindows()
+    {
+        try
+        {
+            using var key = Registry.LocalMachine.OpenSubKey(PlatformKey);
+            var pfeConfig = key?.GetValue("PfeConfigOptions") as string;
+            if (string.IsNullOrWhiteSpace(pfeConfig))
+            {
+                return new PrerequisiteCheck("registry:ArchestrA.Platform.Deployed", PrerequisiteCategory.AvevaInstall,
+                    PrerequisiteStatus.Warn,
+                    $"No Platform object deployed locally (Platform\\PfeConfigOptions empty). MXAccess will connect but subscriptions will fail. Deploy a Platform from the IDE.");
+            }
+
+            // PfeConfigOptions format: "PlatformId=N,EngineId=N,EngineName=...,..."
+            // A non-deployed state leaves PlatformId=0 or the key empty.
+            if (pfeConfig.Contains("PlatformId=0,", StringComparison.OrdinalIgnoreCase))
+            {
+                return new PrerequisiteCheck("registry:ArchestrA.Platform.Deployed", PrerequisiteCategory.AvevaInstall,
+                    PrerequisiteStatus.Warn,
+                    $"Platform never deployed (PfeConfigOptions has PlatformId=0). Deploy a Platform from the IDE before running live tests.");
+            }
+
+            return new PrerequisiteCheck("registry:ArchestrA.Platform.Deployed", PrerequisiteCategory.AvevaInstall,
+                PrerequisiteStatus.Pass,
+                $"Platform deployed ({pfeConfig}).");
+        }
+        catch (Exception ex)
+        {
+            return new PrerequisiteCheck("registry:ArchestrA.Platform.Deployed", PrerequisiteCategory.AvevaInstall,
+                PrerequisiteStatus.Warn,
+                $"Probe failed: {ex.GetType().Name}: {ex.Message}");
+        }
+    }
+
+    [SupportedOSPlatform("windows")]
+    private static PrerequisiteCheck RebootPendingWindows()
+    {
+        try
+        {
+            using var key = Registry.LocalMachine.OpenSubKey(MsiInstallKey);
+            var rebootRequired = key?.GetValue("RebootRequired") as string;
+            if (string.Equals(rebootRequired, "True", StringComparison.OrdinalIgnoreCase))
+            {
+                return new PrerequisiteCheck("registry:ArchestrA.RebootPending", PrerequisiteCategory.AvevaInstall,
+                    PrerequisiteStatus.Warn,
+                    "An ArchestrA patch has been installed but the machine hasn't rebooted. Post-patch behavior is undefined until a reboot.");
+            }
+            return new PrerequisiteCheck("registry:ArchestrA.RebootPending", PrerequisiteCategory.AvevaInstall,
+                PrerequisiteStatus.Pass,
+                "No pending reboot flagged.");
+        }
+        catch (Exception ex)
+        {
+            return new PrerequisiteCheck("registry:ArchestrA.RebootPending", PrerequisiteCategory.AvevaInstall,
+                PrerequisiteStatus.Warn,
+                $"Probe failed: {ex.GetType().Name}: {ex.Message}");
+        }
+    }
+
+    /// <summary>
+    ///     Read the registered <see cref="ComProgIdCheck"/> CLSID for the given ProgID and
+    ///     resolve the 32-bit <c>InprocServer32</c> file path. Returns null when either is missing.
+    /// </summary>
+    [SupportedOSPlatform("windows")]
+    internal static (string? Clsid, string? InprocDllPath) ResolveProgIdToInproc(string progId)
+    {
+        using var progIdKey = Registry.ClassesRoot.OpenSubKey($@"{progId}\CLSID");
+        var clsid = progIdKey?.GetValue(null) as string;
+        if (string.IsNullOrWhiteSpace(clsid)) return (null, null);
+
+        // 32-bit COM server under Wow6432Node\CLSID\{guid}\InprocServer32 default value.
+        using var inproc = Registry.LocalMachine.OpenSubKey(
+            $@"SOFTWARE\Classes\WOW6432Node\CLSID\{clsid}\InprocServer32");
+        var dll = inproc?.GetValue(null) as string;
+        return (clsid, dll);
+    }
+}

tests/ZB.MOM.WW.OtOpcUa.Driver.Galaxy.TestSupport/Probes/ServiceProbe.cs

@@ -0,0 +1,85 @@
+using System.Runtime.InteropServices;
+using System.Runtime.Versioning;
+using System.ServiceProcess;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.Galaxy.TestSupport.Probes;
+
+/// <summary>
+///     Queries the Windows Service Control Manager to report whether a named service is
+///     installed, its current state, and its start type. Non-Windows hosts return Skip.
+/// </summary>
+public static class ServiceProbe
+{
+    public static PrerequisiteCheck Check(
+        string serviceName,
+        PrerequisiteCategory category,
+        bool hardRequired,
+        string whatItDoes)
+    {
+        if (!RuntimeInformation.IsOSPlatform(OSPlatform.Windows))
+        {
+            return new PrerequisiteCheck(
+                Name: $"service:{serviceName}",
+                Category: category,
+                Status: PrerequisiteStatus.Skip,
+                Detail: "Service probes only run on Windows.");
+        }
+
+        return CheckWindows(serviceName, category, hardRequired, whatItDoes);
+    }
+
+    [SupportedOSPlatform("windows")]
+    private static PrerequisiteCheck CheckWindows(
+        string serviceName, PrerequisiteCategory category, bool hardRequired, string whatItDoes)
+    {
+        try
+        {
+            using var sc = new ServiceController(serviceName);
+            // Touch the Status to force the SCM lookup; if the service doesn't exist, this throws
+            // InvalidOperationException with message "Service ... was not found on computer.".
+            var status = sc.Status;
+            var startType = sc.StartType;
+
+            return status switch
+            {
+                ServiceControllerStatus.Running => new PrerequisiteCheck(
+                    $"service:{serviceName}", category, PrerequisiteStatus.Pass,
+                    $"Running ({whatItDoes})"),
+
+                // DemandStart services (like NmxSvc) that are Stopped are not necessarily a
+                // failure — the master service (aaBootstrap) brings them up on demand. Treat
+                // Stopped+Demand as Warn so operators know the situation but tests still proceed.
+                ServiceControllerStatus.Stopped when startType == ServiceStartMode.Manual =>
+                    new PrerequisiteCheck(
+                        $"service:{serviceName}", category, PrerequisiteStatus.Warn,
+                        $"Installed but Stopped (start type Manual — {whatItDoes}). " +
+                        "Will be pulled up on demand by the master service; fine for tests."),
+
+                ServiceControllerStatus.Stopped => Fail(
+                    $"Installed but Stopped. Start with: sc.exe start {serviceName}  ({whatItDoes})"),
+
+                _ => new PrerequisiteCheck(
+                    $"service:{serviceName}", category, PrerequisiteStatus.Warn,
+                    $"Transitional state {status} ({whatItDoes}) — try again in a few seconds."),
+            };
+
+            PrerequisiteCheck Fail(string detail) => new(
+                $"service:{serviceName}", category,
+                hardRequired ? PrerequisiteStatus.Fail : PrerequisiteStatus.Warn,
+                detail);
+        }
+        catch (InvalidOperationException ex) when (ex.Message.Contains("was not found", StringComparison.OrdinalIgnoreCase))
+        {
+            return new PrerequisiteCheck(
+                $"service:{serviceName}", category,
+                hardRequired ? PrerequisiteStatus.Fail : PrerequisiteStatus.Warn,
+                $"Not installed ({whatItDoes}). Install the relevant System Platform component and retry.");
+        }
+        catch (Exception ex)
+        {
+            return new PrerequisiteCheck(
+                $"service:{serviceName}", category, PrerequisiteStatus.Warn,
+                $"Probe failed ({ex.GetType().Name}: {ex.Message}) — treat as unknown.");
+        }
+    }
+}

tests/ZB.MOM.WW.OtOpcUa.Driver.Galaxy.TestSupport/Probes/SqlProbe.cs

@@ -0,0 +1,88 @@
+using Microsoft.Data.SqlClient;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.Galaxy.TestSupport.Probes;
+
+/// <summary>
+///     Verifies the Galaxy Repository SQL side: SQL Server reachable, <c>ZB</c> database
+///     present, and at least one deployed object exists (so live tests have something to read).
+///     Reuses the Windows-auth connection string the repo code defaults to.
+/// </summary>
+public static class SqlProbe
+{
+    public const string DefaultConnectionString =
+        "Server=localhost;Database=ZB;Integrated Security=True;TrustServerCertificate=True;Encrypt=False;Connect Timeout=3;";
+
+    public static async Task<PrerequisiteCheck> CheckZbDatabaseAsync(
+        string? connectionString = null, CancellationToken ct = default)
+    {
+        connectionString ??= DefaultConnectionString;
+        try
+        {
+            using var conn = new SqlConnection(connectionString);
+            await conn.OpenAsync(ct);
+
+            // DB_ID returns null when the database doesn't exist on the connected server — distinct
+            // failure mode from "server unreachable", deserves a distinct message.
+            using var cmd = conn.CreateCommand();
+            cmd.CommandText = "SELECT DB_ID('ZB')";
+            var dbIdObj = await cmd.ExecuteScalarAsync(ct);
+            if (dbIdObj is null || dbIdObj is DBNull)
+            {
+                return new PrerequisiteCheck("sql:ZB", PrerequisiteCategory.GalaxyRepository,
+                    PrerequisiteStatus.Fail,
+                    "SQL Server reachable but database ZB does not exist. " +
+                    "Create the Galaxy from the IDE or restore a .cab backup.");
+            }
+
+            return new PrerequisiteCheck("sql:ZB", PrerequisiteCategory.GalaxyRepository,
+                PrerequisiteStatus.Pass, "Connected; ZB database exists.");
+        }
+        catch (SqlException ex)
+        {
+            return new PrerequisiteCheck("sql:ZB", PrerequisiteCategory.GalaxyRepository,
+                PrerequisiteStatus.Fail,
+                $"SQL Server unreachable: {ex.Message}. Ensure MSSQLSERVER service is running (sc.exe start MSSQLSERVER) and TCP 1433 is open.");
+        }
+        catch (Exception ex)
+        {
+            return new PrerequisiteCheck("sql:ZB", PrerequisiteCategory.GalaxyRepository,
+                PrerequisiteStatus.Fail,
+                $"Unexpected probe error: {ex.GetType().Name}: {ex.Message}");
+        }
+    }
+
+    /// <summary>
+    ///     Returns the count of deployed Galaxy objects (<c>deployed_version &gt; 0</c>). Zero
+    ///     isn't a hard failure — lets someone boot a fresh Galaxy and still get meaningful
+    ///     test-suite output — but it IS a warning because any live-read smoke will have
+    ///     nothing to read.
+    /// </summary>
+    public static async Task<PrerequisiteCheck> CheckDeployedObjectCountAsync(
+        string? connectionString = null, CancellationToken ct = default)
+    {
+        connectionString ??= DefaultConnectionString;
+        try
+        {
+            using var conn = new SqlConnection(connectionString);
+            await conn.OpenAsync(ct);
+            using var cmd = conn.CreateCommand();
+            cmd.CommandText = "SELECT COUNT(*) FROM gobject WHERE deployed_version > 0";
+            var countObj = await cmd.ExecuteScalarAsync(ct);
+            var count = countObj is int i ? i : 0;
+
+            return count > 0
+                ? new PrerequisiteCheck("sql:ZB.deployedObjects", PrerequisiteCategory.GalaxyRepository,
+                    PrerequisiteStatus.Pass, $"{count} objects deployed — live reads have data to return.")
+                : new PrerequisiteCheck("sql:ZB.deployedObjects", PrerequisiteCategory.GalaxyRepository,
+                    PrerequisiteStatus.Warn,
+                    "ZB contains no deployed objects. Discovery smoke tests will return empty hierarchies; " +
+                    "deploy at least a Platform + AppEngine from the IDE to exercise the read path.");
+        }
+        catch (Exception ex)
+        {
+            return new PrerequisiteCheck("sql:ZB.deployedObjects", PrerequisiteCategory.GalaxyRepository,
+                PrerequisiteStatus.Warn,
+                $"Couldn't count deployed objects: {ex.GetType().Name}: {ex.Message}");
+        }
+    }
+}

tests/ZB.MOM.WW.OtOpcUa.Driver.Galaxy.TestSupport/ZB.MOM.WW.OtOpcUa.Driver.Galaxy.TestSupport.csproj

@@ -0,0 +1,38 @@
+<Project Sdk="Microsoft.NET.Sdk">
+
+    <PropertyGroup>
+        <!-- Multi-target: net10.0 for modern consumer projects (Galaxy.Proxy.Tests, E2E, Admin.Tests),
+             net48 for the Galaxy.Host.Tests project that has to stay on .NET Framework x86 for its
+             MXAccess-COM parent project. The helper uses no OS-level APIs that differ between the
+             two frameworks (registry / SQL / ServiceController are surface-compatible). -->
+        <TargetFrameworks>net10.0;net48</TargetFrameworks>
+        <Nullable>enable</Nullable>
+        <ImplicitUsings>enable</ImplicitUsings>
+        <LangVersion>latest</LangVersion>
+        <IsPackable>false</IsPackable>
+        <RootNamespace>ZB.MOM.WW.OtOpcUa.Driver.Galaxy.TestSupport</RootNamespace>
+    </PropertyGroup>
+
+    <ItemGroup Condition="'$(TargetFramework)' == 'net10.0'">
+        <!-- System.ServiceProcess.ServiceController + Microsoft.Win32.Registry are cross-platform
+             assemblies that throw PlatformNotSupportedException on non-Windows; the probes in
+             this project guard with RuntimeInformation.IsOSPlatform(OSPlatform.Windows) so they
+             return Skip on Linux/macOS rather than crashing the test host. -->
+        <PackageReference Include="System.ServiceProcess.ServiceController" Version="10.0.0"/>
+        <PackageReference Include="Microsoft.Win32.Registry" Version="5.0.0"/>
+        <PackageReference Include="Microsoft.Data.SqlClient" Version="6.0.1"/>
+    </ItemGroup>
+
+    <ItemGroup Condition="'$(TargetFramework)' == 'net48'">
+        <!-- net48 ships System.ServiceProcess + Microsoft.Win32 in-box via BCL references. -->
+        <Reference Include="System.ServiceProcess"/>
+        <!-- Microsoft.Data.SqlClient v6 supports net462+; single-target for consistency. -->
+        <PackageReference Include="Microsoft.Data.SqlClient" Version="6.0.1"/>
+    </ItemGroup>
+
+    <ItemGroup>
+        <NuGetAuditSuppress Include="https://github.com/advisories/GHSA-37gx-xxp4-5rgx"/>
+        <NuGetAuditSuppress Include="https://github.com/advisories/GHSA-w3x6-4m5h-cxqf"/>
+    </ItemGroup>
+
+</Project>

tests/ZB.MOM.WW.OtOpcUa.Driver.Modbus.IntegrationTests/DL205/DL205Profile.cs

@@ -1,26 +1,30 @@
 namespace ZB.MOM.WW.OtOpcUa.Driver.Modbus.IntegrationTests.DL205;
 
 /// <summary>
-///     Tag map for the AutomationDirect DL205 device class. Mirrors what the ModbusPal
-///     <c>.xmpp</c> profile in <c>ModbusPal/DL205.xmpp</c> exposes (or the real PLC, when
+///     Tag map for the AutomationDirect DL205 device class. Mirrors what the pymodbus
+///     <c>dl205.json</c> profile in <c>Pymodbus/dl205.json</c> exposes (or the real PLC, when
 ///     <see cref="ModbusSimulatorFixture"/> is pointed at one).
 /// </summary>
 /// <remarks>
 ///     This is the scaffold — each tag is deliberately generic so the smoke test has stable
 ///     addresses to read. Device-specific quirk tests (word order, max-register, register-zero
 ///     access, etc.) will land in their own test classes alongside this profile as the user
-///     validates each behavior in ModbusPal; see <c>docs/v2/modbus-test-plan.md</c> §per-device
+///     validates each behavior in pymodbus; see <c>docs/v2/modbus-test-plan.md</c> §per-device
 ///     quirk catalog for the checklist.
 /// </remarks>
 public static class DL205Profile
 {
-    /// <summary>Holding register the smoke test reads. Address 100 sidesteps the DL205
-    /// register-zero quirk (pending confirmation) — see modbus-test-plan.md.</summary>
-    public const ushort SmokeHoldingRegister = 100;
+    /// <summary>
+    ///     Holding register the smoke test writes + reads. Address 200 is the first cell of the
+    ///     scratch HR range in both <c>Pymodbus/standard.json</c> (HR[200..209] = 0) and
+    ///     <c>Pymodbus/dl205.json</c> (HR[4096..4103] added in PR 43 for the same purpose), so
+    ///     the smoke test runs identically against either simulator profile. Originally
+    ///     targeted HR[100] — moved to HR[200] when the standard profile claimed HR[100] as
+    ///     the auto-incrementing register that drives subscribe-and-receive tests.
+    /// </summary>
+    public const ushort SmokeHoldingRegister = 200;
 
-    /// <summary>Expected value the ModbusPal profile seeds into register 100. When running
-    /// against a real DL205 (or a ModbusPal profile where this register is writable), the smoke
-    /// test seeds this value first, then reads it back.</summary>
+    /// <summary>Value the smoke test writes then reads back to assert round-trip integrity.</summary>
     public const short SmokeHoldingValue = 1234;
 
     public static ModbusDriverOptions BuildOptions(string host, int port) => new()
@@ -32,7 +36,7 @@ public static class DL205Profile
         Tags =
         [
             new ModbusTagDefinition(
-                Name: "DL205_Smoke_HReg100",
+                Name: "Smoke_HReg200",
                 Region: ModbusRegion.HoldingRegisters,
                 Address: SmokeHoldingRegister,
                 DataType: ModbusDataType.Int16,

tests/ZB.MOM.WW.OtOpcUa.Driver.Modbus.IntegrationTests/DL205/DL205SmokeTests.cs

@@ -38,13 +38,13 @@ public sealed class DL205SmokeTests(ModbusSimulatorFixture sim)
         // zeroed at simulator start, and tests must not depend on prior-test state per the
         // test-plan conventions.
         var writeResults = await driver.WriteAsync(
-            [new(FullReference: "DL205_Smoke_HReg100", Value: (short)DL205Profile.SmokeHoldingValue)],
+            [new(FullReference: "Smoke_HReg200", Value: (short)DL205Profile.SmokeHoldingValue)],
             TestContext.Current.CancellationToken);
         writeResults.Count.ShouldBe(1);
         writeResults[0].StatusCode.ShouldBe(0u, "write must succeed against the ModbusPal DL205 profile");
 
         var readResults = await driver.ReadAsync(
-            ["DL205_Smoke_HReg100"],
+            ["Smoke_HReg200"],
             TestContext.Current.CancellationToken);
         readResults.Count.ShouldBe(1);
         readResults[0].StatusCode.ShouldBe(0u);

tests/ZB.MOM.WW.OtOpcUa.Driver.Modbus.IntegrationTests/DL205/DL205StringQuirkTests.cs

@@ -0,0 +1,81 @@
+using Shouldly;
+using Xunit;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.Modbus.IntegrationTests.DL205;
+
+/// <summary>
+///     Verifies the DL205/DL260 low-byte-first ASCII string packing quirk against the
+///     <c>dl205.json</c> pymodbus profile. Standard Modbus packs the first char of each pair
+///     in the high byte of the register; DirectLOGIC packs it in the low byte instead. Without
+///     <see cref="ModbusStringByteOrder.LowByteFirst"/> the driver decodes "eHllo" garbage
+///     even though the bytes on the wire are identical.
+/// </summary>
+/// <remarks>
+///     <para>
+///         Requires the dl205 profile (<c>Pymodbus\serve.ps1 -Profile dl205</c>). The standard
+///         profile does not seed HR[1040..1042] with string bytes, so running this against the
+///         standard profile returns <c>"\0\0\0\0\0"</c> and the test fails. Skip when the env
+///         var <c>MODBUS_SIM_PROFILE</c> is not set to <c>dl205</c>.
+///     </para>
+/// </remarks>
+[Collection(ModbusSimulatorCollection.Name)]
+[Trait("Category", "Integration")]
+[Trait("Device", "DL205")]
+public sealed class DL205StringQuirkTests(ModbusSimulatorFixture sim)
+{
+    [Fact]
+    public async Task DL205_string_low_byte_first_decodes_Hello_from_HR1040()
+    {
+        if (sim.SkipReason is not null) Assert.Skip(sim.SkipReason);
+        if (!string.Equals(Environment.GetEnvironmentVariable("MODBUS_SIM_PROFILE"), "dl205",
+                StringComparison.OrdinalIgnoreCase))
+        {
+            Assert.Skip("MODBUS_SIM_PROFILE != dl205 — skipping (standard profile does not seed HR[1040..1042]).");
+        }
+
+        var options = new ModbusDriverOptions
+        {
+            Host = sim.Host,
+            Port = sim.Port,
+            UnitId = 1,
+            Timeout = TimeSpan.FromSeconds(2),
+            Tags =
+            [
+                new ModbusTagDefinition(
+                    Name: "DL205_Hello_Low",
+                    Region: ModbusRegion.HoldingRegisters,
+                    Address: 1040,
+                    DataType: ModbusDataType.String,
+                    Writable: false,
+                    StringLength: 5,
+                    StringByteOrder: ModbusStringByteOrder.LowByteFirst),
+                // Control: same address, HighByteFirst, to prove the driver would have decoded
+                // garbage without the quirk flag.
+                new ModbusTagDefinition(
+                    Name: "DL205_Hello_High",
+                    Region: ModbusRegion.HoldingRegisters,
+                    Address: 1040,
+                    DataType: ModbusDataType.String,
+                    Writable: false,
+                    StringLength: 5,
+                    StringByteOrder: ModbusStringByteOrder.HighByteFirst),
+            ],
+            Probe = new ModbusProbeOptions { Enabled = false },
+        };
+        await using var driver = new ModbusDriver(options, driverInstanceId: "dl205-string");
+        await driver.InitializeAsync(driverConfigJson: "{}", TestContext.Current.CancellationToken);
+
+        var results = await driver.ReadAsync(["DL205_Hello_Low", "DL205_Hello_High"],
+            TestContext.Current.CancellationToken);
+
+        results.Count.ShouldBe(2);
+        results[0].StatusCode.ShouldBe(0u);
+        results[0].Value.ShouldBe("Hello", "DL205 low-byte-first ordering must produce 'Hello' from HR[1040..1042]");
+
+        // The high-byte-first read of the same wire bytes should differ — not asserting the
+        // exact garbage string (that would couple the test to the ASCII byte math) but the two
+        // decodes MUST disagree, otherwise the quirk flag is a no-op.
+        results[1].StatusCode.ShouldBe(0u);
+        results[1].Value.ShouldNotBe("Hello");
+    }
+}

tests/ZB.MOM.WW.OtOpcUa.Driver.Modbus.IntegrationTests/ModbusPal/README.md

@@ -1,30 +0,0 @@
-# ModbusPal simulator profiles
-
-Drop device-specific `.xmpp` profiles here. The integration tests connect to the
-endpoint in `MODBUS_SIM_ENDPOINT` (default `localhost:502`) and expect the
-simulator to already be running — tests do not launch ModbusPal themselves,
-because its Java GUI + JRE requirement is heavier than the harness is worth.
-
-## Getting started
-
-1. Download ModbusPal from SourceForge (`modbuspal.jar`).
-2. `java -jar modbuspal.jar` to launch the GUI.
-3. Load a profile from this directory (or configure one manually) and start the
-   simulator on TCP port 502.
-4. `dotnet test tests/ZB.MOM.WW.OtOpcUa.Driver.Modbus.IntegrationTests` — tests
-   auto-skip with a clear `SkipReason` if the TCP probe at the configured
-   endpoint fails within 2 seconds.
-
-## Profile files
-
-- `DL205.xmpp` — _to be added_ — register map reflecting the AutomationDirect
-  DL205 quirks tracked in `docs/v2/modbus-test-plan.md`. The scaffolded smoke
-  test in `DL205/DL205SmokeTests.cs` needs holding register 100 writable and
-  present; a minimal ModbusPal profile with a single holding-register bank at
-  address 100 is sufficient.
-
-## Environment variables
-
-- `MODBUS_SIM_ENDPOINT` — override the simulator endpoint. Accepts `host:port`;
-  defaults to `localhost:502`. Useful when pointing the suite at a real PLC on
-  the bench.

tests/ZB.MOM.WW.OtOpcUa.Driver.Modbus.IntegrationTests/ModbusSimulatorFixture.cs

@@ -3,8 +3,9 @@ using System.Net.Sockets;
 namespace ZB.MOM.WW.OtOpcUa.Driver.Modbus.IntegrationTests;
 
 /// <summary>
-///     Reachability probe for a Modbus TCP simulator (ModbusPal or a real PLC). Parses
-///     <c>MODBUS_SIM_ENDPOINT</c> (default <c>localhost:502</c>) and TCP-connects once at
+///     Reachability probe for a Modbus TCP simulator (pymodbus-driven, see
+///     <c>Pymodbus/serve.ps1</c>) or a real PLC. Parses
+///     <c>MODBUS_SIM_ENDPOINT</c> (default <c>localhost:5020</c> per PR 43) and TCP-connects once at
 ///     fixture construction. Each test checks <see cref="SkipReason"/> and calls
 ///     <c>Assert.Skip</c> when the endpoint was unreachable, so a dev box without a running
 ///     simulator still passes `dotnet test` cleanly — matches the Galaxy live-smoke pattern in
@@ -25,7 +26,11 @@ namespace ZB.MOM.WW.OtOpcUa.Driver.Modbus.IntegrationTests;
 /// </remarks>
 public sealed class ModbusSimulatorFixture : IAsyncDisposable
 {
-    private const string DefaultEndpoint = "localhost:502";
+    // PR 43: default port is 5020 (pymodbus convention) instead of 502 (Modbus standard).
+    // Picking 5020 sidesteps the privileged-port admin requirement on Windows + matches the
+    // port baked into the pymodbus simulator JSON profiles in Pymodbus/. Override with
+    // MODBUS_SIM_ENDPOINT to point at a real PLC on its native port 502.
+    private const string DefaultEndpoint = "localhost:5020";
     private const string EndpointEnvVar = "MODBUS_SIM_ENDPOINT";
 
     public string Host { get; }
@@ -41,18 +46,30 @@ public sealed class ModbusSimulatorFixture : IAsyncDisposable
 
         try
         {
-            using var client = new TcpClient();
-            var task = client.ConnectAsync(Host, Port);
+            // Force IPv4 family on the probe — pymodbus's TCP server binds 0.0.0.0 (IPv4 only)
+            // while .NET's TcpClient default-resolves "localhost" → IPv6 ::1 first, fails to
+            // connect, and only then tries IPv4. Under .NET 10 the IPv6 fail surfaces as a
+            // 2s timeout (no graceful fallback by default), so the C# probe times out even
+            // though a PowerShell probe of the same endpoint succeeds. Resolving + dialing
+            // explicit IPv4 sidesteps the dual-stack ordering.
+            using var client = new TcpClient(System.Net.Sockets.AddressFamily.InterNetwork);
+            var task = client.ConnectAsync(
+                System.Net.Dns.GetHostAddresses(Host)
+                    .FirstOrDefault(a => a.AddressFamily == System.Net.Sockets.AddressFamily.InterNetwork)
+                    ?? System.Net.IPAddress.Loopback,
+                Port);
             if (!task.Wait(TimeSpan.FromSeconds(2)) || !client.Connected)
             {
                 SkipReason = $"Modbus simulator at {Host}:{Port} did not accept a TCP connection within 2s. " +
-                             $"Start ModbusPal (or override {EndpointEnvVar}) and re-run.";
+                             $"Start the pymodbus simulator (Pymodbus\\serve.ps1 -Profile standard) " +
+                             $"or override {EndpointEnvVar}, then re-run.";
             }
         }
         catch (Exception ex)
         {
             SkipReason = $"Modbus simulator at {Host}:{Port} unreachable: {ex.GetType().Name}: {ex.Message}. " +
-                         $"Start ModbusPal (or override {EndpointEnvVar}) and re-run.";
+                         $"Start the pymodbus simulator (Pymodbus\\serve.ps1 -Profile standard) " +
+                             $"or override {EndpointEnvVar}, then re-run.";
         }
     }
 

tests/ZB.MOM.WW.OtOpcUa.Driver.Modbus.IntegrationTests/Pymodbus/README.md

@@ -0,0 +1,163 @@
+# pymodbus simulator profiles
+
+Two JSON-config profiles for pymodbus's `ModbusSimulatorServer`. Replaces the
+ModbusPal `.xmpp` profiles that lived here in PR 42 — pymodbus is headless,
+maintained, semantic about register layout, and pip-installable on Windows.
+
+| File | What it simulates | Test category |
+|---|---|---|
+| [`standard.json`](standard.json) | Generic Modbus TCP server — HR[0..31] = address-as-value, HR[100] declarative auto-increment via `"action": "increment"`, alternating coils, scratch ranges for write tests. | `Trait=Standard` |
+| [`dl205.json`](dl205.json) | AutomationDirect DirectLOGIC DL205 / DL260 quirks per [`docs/v2/dl205.md`](../../../docs/v2/dl205.md): low-byte-first string packing, CDAB Float32, BCD numerics, V-memory address markers, Y/C coil mappings. Inline `_quirk` comments per register name the behavior. | `Trait=DL205` |
+
+Both bind TCP **5020** (pymodbus convention; sidesteps the Windows admin
+requirement for privileged port 502). The integration-test fixture
+(`ModbusSimulatorFixture`) defaults to `localhost:5020` to match — override
+via `MODBUS_SIM_ENDPOINT` to point at a real PLC on its native port 502.
+
+Run only **one profile at a time** (they share TCP 5020).
+
+## Install
+
+```powershell
+pip install "pymodbus[simulator]==3.13.0"
+```
+
+The `[simulator]` extra pulls in `aiohttp` for the optional web UI / REST API.
+Pinned to 3.13.0 for reproducibility — avoid 4.x dev releases until stabilized.
+Requires Python ≥ 3.10. Windows Firewall will prompt on first bind; allow
+Private network.
+
+## Run
+
+Foreground (Ctrl+C to stop). Use the `serve.ps1` wrapper:
+
+```powershell
+.\serve.ps1 -Profile standard
+.\serve.ps1 -Profile dl205
+```
+
+Or invoke pymodbus directly:
+
+```powershell
+pymodbus.simulator `
+    --modbus_server srv `
+    --modbus_device dev `
+    --json_file .\standard.json `
+    --http_port 8080
+```
+
+Web UI at `http://localhost:8080` lets you inspect + poke registers manually.
+Pass `--no_http` (or `-HttpPort 0` to `serve.ps1`) to disable.
+
+## Run the integration tests
+
+In a separate shell, with the simulator running:
+
+```powershell
+cd C:\Users\dohertj2\Desktop\lmxopcua
+dotnet test tests\ZB.MOM.WW.OtOpcUa.Driver.Modbus.IntegrationTests
+```
+
+Tests auto-skip with a clear `SkipReason` if `localhost:5020` isn't reachable
+within 2 seconds. Filter by trait when both profiles' tests coexist:
+
+```powershell
+dotnet test ... --filter "Trait=Standard"
+dotnet test ... --filter "Trait=DL205"
+```
+
+## What's encoded in each profile
+
+### standard.json
+
+- HR[0..31]: each register's value equals its address. Easy mental map.
+- HR[100]: `"action": "increment"` ticks 0..65535 on every register access — drives subscribe-and-receive tests so they have a register that changes without a write.
+- HR[200..209]: scratch range for write-roundtrip tests.
+- Coils[0..31]: alternating on/off (even=on).
+- Coils[100..109]: scratch.
+- All addresses 0..1023 are writable (`"write": [[0, 1023]]`).
+
+### dl205.json (per `docs/v2/dl205.md`)
+
+| HR address | Quirk demonstrated | Raw value | Decoded |
+|---|---|---|---|
+| `0` (V0) | Register 0 is valid (rejects-register-0 rumour disproved) | `51966` (0xCAFE) | marker |
+| `1024` (V2000 octal) | V-memory octal-to-decimal mapping | `8192` (0x2000) | marker |
+| `8448` (V40400 octal) | V40400 → PDU 0x2100 (NOT register 0) | `16448` (0x4040) | marker |
+| `1040..1042` | String "Hello" packed first-char-low-byte | `25928, 27756, 111` | `"Hello"` |
+| `1056..1057` | Float32 1.5f in CDAB word order | `0, 16320` | `1.5f` |
+| `1072` | Decimal 1234 in BCD encoding | `4660` (0x1234) | `1234` |
+| `1280..1407` | 128-register block (FC03 cap = 128 above spec's 125) | first/last/mid markers; rest defaults to 0 | for FC03 cap test |
+
+| Coil address | Quirk demonstrated |
+|---|---|
+| `2048` | Y0 maps to coil 2048 (DL260 layout) |
+| `3072` | C0 maps to coil 3072 (DL260 layout) |
+| `4000..4007` | Scratch C-relay range for write-roundtrip tests |
+
+The DL260 X-input markers (FC02 discrete inputs) **are not encoded separately**
+because the profile uses `shared blocks: true` (matches DL series memory
+model) — coils/DI/HR/IR overlay the same word address space. Tests that
+target FC02 against this profile end up reading the same bit positions as
+the coils they share with.
+
+## What's IN pymodbus that wasn't in ModbusPal
+
+- **All four standard tables** (HR, IR, coils, DI) configurable via `co size` / `di size` / `hr size` / `ir size` setup keys.
+- **Per-register raw uint16 seeding** — `{"addr": 1040, "value": 25928}` puts exactly that 16-bit value on the wire. No interpretation.
+- **Built-in actions**: `increment`, `random`, `timestamp`, `reset`, `uptime` for declarative dynamic registers. No Python script alongside the config required.
+- **Custom actions** — point `--custom_actions_module` at a `.py` file exposing callables to express anything more complex (per-second wall-clock ticks, BCD synthesis, etc.).
+- **Headless** — pure CLI process, no Java, no Swing. Pip-installable. Plays well with CI runners.
+- **Web UI / REST API** — `--http_port 8080` adds an aiohttp server for live inspection. Optional.
+- **Maintained** — current stable 3.13.0 (April 2026), active development on 4.0 dev branch.
+
+## Trade-offs vs the hand-authored ModbusPal profiles
+
+- pymodbus's built-in `float32` type stores in pymodbus's word order; for explicit DL205 CDAB control we seed two raw `uint16` entries instead. Documented inline in `dl205.json`.
+- `increment` action ticks per-access, not wall-clock. A 250ms-poll integration test sees variation either way; for strict 1Hz cadence add `--custom_actions_module my_actions.py` with a `time.time()`-based callable.
+- `dl205.json` uses `shared blocks: true` because it matches DL series memory model; `standard.json` uses `shared blocks: false` so coils and HR address spaces are independent (more like a textbook PLC).
+
+## File format reference
+
+```json
+{
+  "server_list": {
+    "<server-name>": {
+      "comm": "tcp",
+      "host": "0.0.0.0",
+      "port": 5020,
+      "framer": "socket",
+      "device_id": 1
+    }
+  },
+  "device_list": {
+    "<device-name>": {
+      "setup": {
+        "co size": N, "di size": N, "hr size": N, "ir size": N,
+        "shared blocks": false,
+        "type exception": false,
+        "defaults": { "value": {...}, "action": {...} }
+      },
+      "invalid": [],
+      "write": [[<from>, <to>]],
+      "bits":    [{"addr": N, "value": 0|1}],
+      "uint16":  [{"addr": N, "value": <0..65535>, "action"?: "increment", "parameters"?: {...}}],
+      "uint32":  [{"addr": N, "value": <int>}],
+      "float32": [{"addr": N, "value": <float>}],
+      "string":  [{"addr": N, "value": "<text>"}],
+      "repeat":  []
+    }
+  }
+}
+```
+
+The CLI args `--modbus_server <server-name> --modbus_device <device-name>`
+pick which entries the simulator binds.
+
+## References
+
+- [pymodbus on PyPI](https://pypi.org/project/pymodbus/) — install, version pin
+- [Simulator config docs](https://pymodbus.readthedocs.io/en/dev/source/library/simulator/config.html) — full schema reference
+- [Simulator REST API](https://pymodbus.readthedocs.io/en/latest/source/library/simulator/restapi.html) — for the optional web UI
+- [`docs/v2/dl205.md`](../../../docs/v2/dl205.md) — what each DL205 profile entry simulates
+- [`docs/v2/modbus-test-plan.md`](../../../docs/v2/modbus-test-plan.md) — the `DL205_<behavior>` test naming convention

tests/ZB.MOM.WW.OtOpcUa.Driver.Modbus.IntegrationTests/Pymodbus/dl205.json

@@ -0,0 +1,118 @@
+{
+  "_comment": "DL205.json — DirectLOGIC DL205/DL260 quirk simulator. Models docs/v2/dl205.md as concrete register values. NOTE: pymodbus rejects unknown keys at device-list / setup level; explanatory comments live at top-level _comment + in README + git. Inline _quirk keys WITHIN individual register entries are accepted by pymodbus 3.13.0 (it only validates addr / value / action / parameters per entry). Each quirky uint16 is a pre-computed raw 16-bit value; pymodbus serves it verbatim. shared blocks=true matches DL series memory model. write list mirrors each seeded block — pymodbus rejects sweeping write ranges that include undefined cells.",
+
+  "server_list": {
+    "srv": {
+      "comm": "tcp",
+      "host": "0.0.0.0",
+      "port": 5020,
+      "framer": "socket",
+      "device_id": 1
+    }
+  },
+
+  "device_list": {
+    "dev": {
+      "setup": {
+        "co size":    16384,
+        "di size":     8192,
+        "hr size":    16384,
+        "ir size":     1024,
+        "shared blocks": true,
+        "type exception": false,
+        "defaults": {
+          "value":  {"bits": 0, "uint16": 0, "uint32": 0, "float32": 0.0, "string": " "},
+          "action": {"bits": null, "uint16": null, "uint32": null, "float32": null, "string": null}
+        }
+      },
+      "invalid": [],
+      "write": [
+        [0, 0],
+        [200, 209],
+        [1024, 1024],
+        [1040, 1042],
+        [1056, 1057],
+        [1072, 1072],
+        [1280, 1282],
+        [1343, 1343],
+        [1407, 1407],
+        [2048, 2050],
+        [3072, 3074],
+        [4000, 4007],
+        [8448, 8448]
+      ],
+
+      "uint16": [
+        {"_quirk": "V0 marker. HR[0]=0xCAFE proves register 0 is valid on DL205/DL260 (rejects-register-0 was a DL05/DL06 relative-mode artefact). 0xCAFE = 51966.",
+         "addr": 0,    "value": 51966},
+
+        {"_quirk": "Scratch HR range 200..209 — mirrors the standard.json scratch range so the smoke test (DL205Profile.SmokeHoldingRegister=200) round-trips identically against either profile.",
+         "addr": 200, "value": 0},
+        {"addr": 201, "value": 0},
+        {"addr": 202, "value": 0},
+        {"addr": 203, "value": 0},
+        {"addr": 204, "value": 0},
+        {"addr": 205, "value": 0},
+        {"addr": 206, "value": 0},
+        {"addr": 207, "value": 0},
+        {"addr": 208, "value": 0},
+        {"addr": 209, "value": 0},
+
+        {"_quirk": "V2000 marker. V2000 octal = decimal 1024 = PDU 0x0400. Marker 0x2000 = 8192.",
+         "addr": 1024, "value": 8192},
+
+        {"_quirk": "V40400 marker. V40400 octal = decimal 8448 = PDU 0x2100 (NOT register 0). Marker 0x4040 = 16448.",
+         "addr": 8448, "value": 16448},
+
+        {"_quirk": "String 'Hello' first char in LOW byte. HR[0x410] = 'H'(0x48) lo + 'e'(0x65) hi = 0x6548 = 25928.",
+         "addr": 1040, "value": 25928},
+        {"_quirk": "String 'Hello' second char-pair: 'l'(0x6C) lo + 'l'(0x6C) hi = 0x6C6C = 27756.",
+         "addr": 1041, "value": 27756},
+        {"_quirk": "String 'Hello' third char-pair: 'o'(0x6F) lo + null(0x00) hi = 0x006F = 111.",
+         "addr": 1042, "value": 111},
+
+        {"_quirk": "Float32 1.5f in CDAB word order. IEEE 754 1.5 = 0x3FC00000. CDAB = low word first: HR[0x420]=0x0000, HR[0x421]=0x3FC0=16320.",
+         "addr": 1056, "value": 0},
+        {"_quirk": "Float32 1.5f CDAB high word.",
+         "addr": 1057, "value": 16320},
+
+        {"_quirk": "BCD register. Decimal 1234 stored as BCD nibbles 0x1234 = 4660. NOT binary 1234 (= 0x04D2).",
+         "addr": 1072, "value": 4660},
+
+        {"_quirk": "FC03 cap test marker — first cell of a 128-register span the FC03 cap test reads. Other cells in the span aren't seeded explicitly, so reads of HR[1283..1342] / 1344..1406 return the default 0; the seeded markers at 1280, 1281, 1282, 1343, 1407 prove the span boundaries.",
+         "addr": 1280, "value": 0},
+        {"addr": 1281, "value": 1},
+        {"addr": 1282, "value": 2},
+        {"addr": 1343, "value": 63},
+        {"addr": 1407, "value": 127}
+      ],
+
+      "bits": [
+        {"_quirk": "Y0 marker. DL260 maps Y0 to coil 2048 (0-based). Coil 2048 = ON proves the mapping.",
+         "addr": 2048, "value": 1},
+        {"addr": 2049, "value": 0},
+        {"addr": 2050, "value": 1},
+
+        {"_quirk": "C0 marker. DL260 maps C0 to coil 3072 (0-based). Coil 3072 = ON proves the mapping.",
+         "addr": 3072, "value": 1},
+        {"addr": 3073, "value": 0},
+        {"addr": 3074, "value": 1},
+
+        {"_quirk": "Scratch C-relays for write-roundtrip tests against the writable C range.",
+         "addr": 4000, "value": 0},
+        {"addr": 4001, "value": 0},
+        {"addr": 4002, "value": 0},
+        {"addr": 4003, "value": 0},
+        {"addr": 4004, "value": 0},
+        {"addr": 4005, "value": 0},
+        {"addr": 4006, "value": 0},
+        {"addr": 4007, "value": 0}
+      ],
+
+      "uint32":  [],
+      "float32": [],
+      "string":  [],
+      "repeat":  []
+    }
+  }
+}

tests/ZB.MOM.WW.OtOpcUa.Driver.Modbus.IntegrationTests/Pymodbus/serve.ps1

@@ -0,0 +1,60 @@
+<#
+.SYNOPSIS
+    Launches the pymodbus simulator with one of the integration-test profiles
+    (Standard or DL205). Foreground process — Ctrl+C to stop.
+
+.PARAMETER Profile
+    Which simulator profile to run: 'standard' or 'dl205'. Both bind TCP 5020 by
+    default so they can't run simultaneously on the same box.
+
+.PARAMETER HttpPort
+    Port for pymodbus's optional web UI / REST API. Default 8080. Pass 0 to
+    disable (passes --no_http).
+
+.EXAMPLE
+    .\serve.ps1 -Profile standard
+    Starts the standard server on TCP 5020 with web UI on 8080.
+
+.EXAMPLE
+    .\serve.ps1 -Profile dl205 -HttpPort 0
+    Starts the DL205 server on TCP 5020, no web UI.
+#>
+[CmdletBinding()]
+param(
+    [Parameter(Mandatory)] [ValidateSet('standard', 'dl205')] [string]$Profile,
+    [int]$HttpPort = 8080
+)
+
+$ErrorActionPreference = 'Stop'
+$here = $PSScriptRoot
+
+# Confirm pymodbus.simulator is on PATH — clearer message than the
+# 'CommandNotFoundException' dotnet style.
+$cmd = Get-Command pymodbus.simulator -ErrorAction SilentlyContinue
+if (-not $cmd) {
+    Write-Error "pymodbus.simulator not found. Install with: pip install 'pymodbus[simulator]==3.13.0'"
+    exit 1
+}
+
+$jsonFile = Join-Path $here "$Profile.json"
+if (-not (Test-Path $jsonFile)) {
+    Write-Error "Profile config not found: $jsonFile"
+    exit 1
+}
+
+$args = @(
+    '--modbus_server', 'srv',
+    '--modbus_device', 'dev',
+    '--json_file',     $jsonFile
+)
+
+if ($HttpPort -gt 0) {
+    $args += @('--http_port', $HttpPort)
+    Write-Host "Web UI will be at http://localhost:$HttpPort"
+} else {
+    $args += '--no_http'
+}
+
+Write-Host "Starting pymodbus simulator: profile=$Profile  TCP=localhost:5020"
+Write-Host "Ctrl+C to stop."
+& pymodbus.simulator @args

tests/ZB.MOM.WW.OtOpcUa.Driver.Modbus.IntegrationTests/Pymodbus/standard.json

@@ -0,0 +1,97 @@
+{
+  "_comment": "Standard.json — generic Modbus TCP server for the integration suite. See ../README.md. NOTE: pymodbus rejects unknown keys at device-list / setup level; explanatory comments live in the README + git history. Layout: HR[0..31]=address-as-value, HR[100]=auto-increment, HR[200..209]=scratch, coils 1024..1055=alternating, coils 1100..1109=scratch. Coils live at 1024+ because pymodbus stores all 4 standard tables in ONE underlying cell array — bits and uint16 at the same address conflict (each cell can only be typed once).",
+
+  "server_list": {
+    "srv": {
+      "comm": "tcp",
+      "host": "0.0.0.0",
+      "port": 5020,
+      "framer": "socket",
+      "device_id": 1
+    }
+  },
+
+  "device_list": {
+    "dev": {
+      "setup": {
+        "co size": 2048,
+        "di size": 2048,
+        "hr size": 2048,
+        "ir size": 2048,
+        "shared blocks": true,
+        "type exception": false,
+        "defaults": {
+          "value":  {"bits": 0, "uint16": 0, "uint32": 0, "float32": 0.0, "string": " "},
+          "action": {"bits": null, "uint16": null, "uint32": null, "float32": null, "string": null}
+        }
+      },
+      "invalid": [],
+      "write": [
+        [0, 31],
+        [100, 100],
+        [200, 209],
+        [1024, 1055],
+        [1100, 1109]
+      ],
+
+      "uint16": [
+        {"addr":  0, "value":  0}, {"addr":  1, "value":  1},
+        {"addr":  2, "value":  2}, {"addr":  3, "value":  3},
+        {"addr":  4, "value":  4}, {"addr":  5, "value":  5},
+        {"addr":  6, "value":  6}, {"addr":  7, "value":  7},
+        {"addr":  8, "value":  8}, {"addr":  9, "value":  9},
+        {"addr": 10, "value": 10}, {"addr": 11, "value": 11},
+        {"addr": 12, "value": 12}, {"addr": 13, "value": 13},
+        {"addr": 14, "value": 14}, {"addr": 15, "value": 15},
+        {"addr": 16, "value": 16}, {"addr": 17, "value": 17},
+        {"addr": 18, "value": 18}, {"addr": 19, "value": 19},
+        {"addr": 20, "value": 20}, {"addr": 21, "value": 21},
+        {"addr": 22, "value": 22}, {"addr": 23, "value": 23},
+        {"addr": 24, "value": 24}, {"addr": 25, "value": 25},
+        {"addr": 26, "value": 26}, {"addr": 27, "value": 27},
+        {"addr": 28, "value": 28}, {"addr": 29, "value": 29},
+        {"addr": 30, "value": 30}, {"addr": 31, "value": 31},
+
+        {"addr": 100, "value": 0,
+         "action": "increment",
+         "parameters": {"minval": 0, "maxval": 65535}},
+
+        {"addr": 200, "value": 0}, {"addr": 201, "value": 0},
+        {"addr": 202, "value": 0}, {"addr": 203, "value": 0},
+        {"addr": 204, "value": 0}, {"addr": 205, "value": 0},
+        {"addr": 206, "value": 0}, {"addr": 207, "value": 0},
+        {"addr": 208, "value": 0}, {"addr": 209, "value": 0}
+      ],
+
+      "bits": [
+        {"addr": 1024, "value": 1}, {"addr": 1025, "value": 0},
+        {"addr": 1026, "value": 1}, {"addr": 1027, "value": 0},
+        {"addr": 1028, "value": 1}, {"addr": 1029, "value": 0},
+        {"addr": 1030, "value": 1}, {"addr": 1031, "value": 0},
+        {"addr": 1032, "value": 1}, {"addr": 1033, "value": 0},
+        {"addr": 1034, "value": 1}, {"addr": 1035, "value": 0},
+        {"addr": 1036, "value": 1}, {"addr": 1037, "value": 0},
+        {"addr": 1038, "value": 1}, {"addr": 1039, "value": 0},
+        {"addr": 1040, "value": 1}, {"addr": 1041, "value": 0},
+        {"addr": 1042, "value": 1}, {"addr": 1043, "value": 0},
+        {"addr": 1044, "value": 1}, {"addr": 1045, "value": 0},
+        {"addr": 1046, "value": 1}, {"addr": 1047, "value": 0},
+        {"addr": 1048, "value": 1}, {"addr": 1049, "value": 0},
+        {"addr": 1050, "value": 1}, {"addr": 1051, "value": 0},
+        {"addr": 1052, "value": 1}, {"addr": 1053, "value": 0},
+        {"addr": 1054, "value": 1}, {"addr": 1055, "value": 0},
+
+        {"addr": 1100, "value": 0}, {"addr": 1101, "value": 0},
+        {"addr": 1102, "value": 0}, {"addr": 1103, "value": 0},
+        {"addr": 1104, "value": 0}, {"addr": 1105, "value": 0},
+        {"addr": 1106, "value": 0}, {"addr": 1107, "value": 0},
+        {"addr": 1108, "value": 0}, {"addr": 1109, "value": 0}
+      ],
+
+      "uint32":  [],
+      "float32": [],
+      "string":  [],
+      "repeat":  []
+    }
+  }
+}

tests/ZB.MOM.WW.OtOpcUa.Driver.Modbus.IntegrationTests/ZB.MOM.WW.OtOpcUa.Driver.Modbus.IntegrationTests.csproj

@@ -24,7 +24,7 @@
     </ItemGroup>
 
     <ItemGroup>
-        <None Update="ModbusPal\**\*" CopyToOutputDirectory="PreserveNewest"/>
+        <None Update="Pymodbus\**\*" CopyToOutputDirectory="PreserveNewest"/>
         <None Update="DL205\**\*" CopyToOutputDirectory="PreserveNewest"/>
     </ItemGroup>
 

tests/ZB.MOM.WW.OtOpcUa.Driver.Modbus.Tests/ModbusDataTypeTests.cs

@@ -172,4 +172,51 @@ public sealed class ModbusDataTypeTests
         wire[1].ShouldBe((byte)'i');
         for (var i = 2; i < 8; i++) wire[i].ShouldBe((byte)0);
     }
+
+    // --- DL205 low-byte-first strings (AutomationDirect DirectLOGIC quirk) ---
+
+    [Fact]
+    public void String_LowByteFirst_decodes_DL205_packed_Hello()
+    {
+        // HR[1040] = 0x6548 (wire BE bytes [0x65, 0x48]) decodes first char from low byte = 'H',
+        // second from high byte = 'e'. HR[1041] = 0x6C6C → 'l','l'. HR[1042] = 0x006F → 'o', nul.
+        var tag = new ModbusTagDefinition("T", ModbusRegion.HoldingRegisters, 0, ModbusDataType.String,
+            StringLength: 5, StringByteOrder: ModbusStringByteOrder.LowByteFirst);
+        var wire = new byte[] { 0x65, 0x48, 0x6C, 0x6C, 0x00, 0x6F };
+        ModbusDriver.DecodeRegister(wire, tag).ShouldBe("Hello");
+    }
+
+    [Fact]
+    public void String_LowByteFirst_decode_truncates_at_first_nul()
+    {
+        // Low-byte-first with only 2 real chars in register 0 (lo='H', hi='i') and the rest nul.
+        var tag = new ModbusTagDefinition("T", ModbusRegion.HoldingRegisters, 0, ModbusDataType.String,
+            StringLength: 6, StringByteOrder: ModbusStringByteOrder.LowByteFirst);
+        var wire = new byte[] { 0x69, 0x48, 0x00, 0x00, 0x00, 0x00 };
+        ModbusDriver.DecodeRegister(wire, tag).ShouldBe("Hi");
+    }
+
+    [Fact]
+    public void String_LowByteFirst_encode_round_trips_with_decode()
+    {
+        var tag = new ModbusTagDefinition("T", ModbusRegion.HoldingRegisters, 0, ModbusDataType.String,
+            StringLength: 5, StringByteOrder: ModbusStringByteOrder.LowByteFirst);
+        var wire = ModbusDriver.EncodeRegister("Hello", tag);
+        // Expect exactly the DL205-documented byte sequence.
+        wire.ShouldBe(new byte[] { 0x65, 0x48, 0x6C, 0x6C, 0x00, 0x6F });
+        ModbusDriver.DecodeRegister(wire, tag).ShouldBe("Hello");
+    }
+
+    [Fact]
+    public void String_HighByteFirst_and_LowByteFirst_differ_on_same_wire()
+    {
+        // Same wire buffer, different byte order → first char switches 'H' vs 'e'.
+        var wire = new byte[] { 0x48, 0x65 };
+        var hi = new ModbusTagDefinition("T", ModbusRegion.HoldingRegisters, 0, ModbusDataType.String,
+            StringLength: 2, StringByteOrder: ModbusStringByteOrder.HighByteFirst);
+        var lo = new ModbusTagDefinition("T", ModbusRegion.HoldingRegisters, 0, ModbusDataType.String,
+            StringLength: 2, StringByteOrder: ModbusStringByteOrder.LowByteFirst);
+        ModbusDriver.DecodeRegister(wire, hi).ShouldBe("He");
+        ModbusDriver.DecodeRegister(wire, lo).ShouldBe("eH");
+    }
 }

tests/ZB.MOM.WW.OtOpcUa.Server.Tests/DriverNodeManagerHistoryMappingTests.cs

@@ -0,0 +1,160 @@
+using System.Linq;
+using Opc.Ua;
+using Shouldly;
+using Xunit;
+using ZB.MOM.WW.OtOpcUa.Core.Abstractions;
+using ZB.MOM.WW.OtOpcUa.Server.OpcUa;
+
+namespace ZB.MOM.WW.OtOpcUa.Server.Tests;
+
+/// <summary>
+///     Unit coverage for the static helpers <see cref="DriverNodeManager"/> exposes to bridge
+///     driver-side history data (<see cref="HistoricalEvent"/> + <see cref="DataValueSnapshot"/>)
+///     to the OPC UA on-wire shape (<c>HistoryData</c> / <c>HistoryEvent</c> wrapped in an
+///     <see cref="ExtensionObject"/>). Fast, framework-only — no server fixture.
+/// </summary>
+[Trait("Category", "Unit")]
+public sealed class DriverNodeManagerHistoryMappingTests
+{
+    [Theory]
+    [InlineData(nameof(HistoryAggregateType.Average), HistoryAggregateType.Average)]
+    [InlineData(nameof(HistoryAggregateType.Minimum), HistoryAggregateType.Minimum)]
+    [InlineData(nameof(HistoryAggregateType.Maximum), HistoryAggregateType.Maximum)]
+    [InlineData(nameof(HistoryAggregateType.Total), HistoryAggregateType.Total)]
+    [InlineData(nameof(HistoryAggregateType.Count), HistoryAggregateType.Count)]
+    public void MapAggregate_translates_each_supported_OPC_UA_aggregate_NodeId(
+        string name, HistoryAggregateType expected)
+    {
+        // Resolve the ObjectIds.AggregateFunction_<name> constant via reflection so the test
+        // keeps working if the stack ever renames them — failure means the stack broke its
+        // naming convention, worth surfacing loudly.
+        var field = typeof(ObjectIds).GetField("AggregateFunction_" + name);
+        field.ShouldNotBeNull();
+        var nodeId = (NodeId)field!.GetValue(null)!;
+
+        DriverNodeManager.MapAggregate(nodeId).ShouldBe(expected);
+    }
+
+    [Fact]
+    public void MapAggregate_returns_null_for_unknown_aggregate()
+    {
+        // AggregateFunction_TimeAverage is a valid OPC UA aggregate but not one the driver
+        // surfaces. Null here means the service handler will translate to BadAggregateNotSupported
+        // — the right behavior per Part 13 when the requested aggregate isn't implemented.
+        DriverNodeManager.MapAggregate(ObjectIds.AggregateFunction_TimeAverage).ShouldBeNull();
+    }
+
+    [Fact]
+    public void MapAggregate_returns_null_for_null_input()
+    {
+        // Processed requests that omit the aggregate list (or pass a single null) must not crash.
+        DriverNodeManager.MapAggregate(null).ShouldBeNull();
+    }
+
+    [Fact]
+    public void BuildHistoryData_wraps_samples_as_HistoryData_extension_object()
+    {
+        var samples = new[]
+        {
+            new DataValueSnapshot(Value: 42, StatusCode: StatusCodes.Good,
+                SourceTimestampUtc: new DateTime(2024, 1, 1, 0, 0, 0, DateTimeKind.Utc),
+                ServerTimestampUtc: new DateTime(2024, 1, 1, 0, 0, 1, DateTimeKind.Utc)),
+            new DataValueSnapshot(Value: 99, StatusCode: StatusCodes.Good,
+                SourceTimestampUtc: new DateTime(2024, 1, 1, 0, 0, 5, DateTimeKind.Utc),
+                ServerTimestampUtc: new DateTime(2024, 1, 1, 0, 0, 6, DateTimeKind.Utc)),
+        };
+
+        var ext = DriverNodeManager.BuildHistoryData(samples);
+
+        ext.Body.ShouldBeOfType<HistoryData>();
+        var hd = (HistoryData)ext.Body;
+        hd.DataValues.Count.ShouldBe(2);
+        hd.DataValues[0].Value.ShouldBe(42);
+        hd.DataValues[1].Value.ShouldBe(99);
+        hd.DataValues[0].SourceTimestamp.ShouldBe(new DateTime(2024, 1, 1, 0, 0, 0, DateTimeKind.Utc));
+    }
+
+    [Fact]
+    public void BuildHistoryEvent_wraps_events_with_BaseEventType_field_ordering()
+    {
+        // BuildHistoryEvent populates a fixed field set in BaseEventType's conventional order:
+        // EventId, SourceName, Message, Severity, Time, ReceiveTime. Pinning this so a later
+        // "respect the client's SelectClauses" change can't silently break older clients that
+        // rely on the default layout.
+        var events = new[]
+        {
+            new HistoricalEvent(
+                EventId: "e-1",
+                SourceName: "Tank1.HiAlarm",
+                EventTimeUtc: new DateTime(2024, 1, 1, 12, 0, 0, DateTimeKind.Utc),
+                ReceivedTimeUtc: new DateTime(2024, 1, 1, 12, 0, 0, 5, DateTimeKind.Utc),
+                Message: "High level reached",
+                Severity: 750),
+        };
+
+        var ext = DriverNodeManager.BuildHistoryEvent(events);
+
+        ext.Body.ShouldBeOfType<HistoryEvent>();
+        var he = (HistoryEvent)ext.Body;
+        he.Events.Count.ShouldBe(1);
+        var fields = he.Events[0].EventFields;
+        fields.Count.ShouldBe(6);
+        fields[0].Value.ShouldBe("e-1");                    // EventId
+        fields[1].Value.ShouldBe("Tank1.HiAlarm");          // SourceName
+        ((LocalizedText)fields[2].Value).Text.ShouldBe("High level reached"); // Message
+        fields[3].Value.ShouldBe((ushort)750);              // Severity
+        ((DateTime)fields[4].Value).ShouldBe(new DateTime(2024, 1, 1, 12, 0, 0, DateTimeKind.Utc));
+        ((DateTime)fields[5].Value).ShouldBe(new DateTime(2024, 1, 1, 12, 0, 0, 5, DateTimeKind.Utc));
+    }
+
+    [Fact]
+    public void BuildHistoryEvent_substitutes_empty_string_for_null_SourceName_and_Message()
+    {
+        // Driver-side nulls are preserved through the wire contract by design (distinguishes
+        // "system event with no source" from "source unknown"), but OPC UA Variants of type
+        // String must not carry null — the stack serializes null-string as empty. This test
+        // pins the choice so a nullable-Variant refactor doesn't break clients that display
+        // the field without a null check.
+        var events = new[]
+        {
+            new HistoricalEvent("sys", null, DateTime.UtcNow, DateTime.UtcNow, null, 1),
+        };
+
+        var ext = DriverNodeManager.BuildHistoryEvent(events);
+        var fields = ((HistoryEvent)ext.Body).Events[0].EventFields;
+        fields[1].Value.ShouldBe(string.Empty);
+        ((LocalizedText)fields[2].Value).Text.ShouldBe(string.Empty);
+    }
+
+    [Fact]
+    public void ToDataValue_preserves_status_code_and_timestamps()
+    {
+        var snap = new DataValueSnapshot(
+            Value: 123.45,
+            StatusCode: StatusCodes.UncertainSubstituteValue,
+            SourceTimestampUtc: new DateTime(2024, 5, 1, 10, 0, 0, DateTimeKind.Utc),
+            ServerTimestampUtc: new DateTime(2024, 5, 1, 10, 0, 1, DateTimeKind.Utc));
+
+        var dv = DriverNodeManager.ToDataValue(snap);
+
+        dv.Value.ShouldBe(123.45);
+        dv.StatusCode.Code.ShouldBe(StatusCodes.UncertainSubstituteValue);
+        dv.SourceTimestamp.ShouldBe(new DateTime(2024, 5, 1, 10, 0, 0, DateTimeKind.Utc));
+        dv.ServerTimestamp.ShouldBe(new DateTime(2024, 5, 1, 10, 0, 1, DateTimeKind.Utc));
+    }
+
+    [Fact]
+    public void ToDataValue_leaves_SourceTimestamp_default_when_snapshot_has_no_source_time()
+    {
+        // Galaxy's raw-history rows often carry only a ServerTimestamp (the historian knows
+        // when it wrote the row, not when the process sampled it). The mapping must not
+        // synthesize a bogus SourceTimestamp from ServerTimestamp — that would lie to the
+        // client about the measurement's actual time.
+        var snap = new DataValueSnapshot(Value: 1, StatusCode: 0,
+            SourceTimestampUtc: null,
+            ServerTimestampUtc: new DateTime(2024, 5, 1, 10, 0, 1, DateTimeKind.Utc));
+
+        var dv = DriverNodeManager.ToDataValue(snap);
+        dv.SourceTimestamp.ShouldBe(default);
+    }
+}

tests/ZB.MOM.WW.OtOpcUa.Server.Tests/HistoryReadIntegrationTests.cs

@@ -0,0 +1,356 @@
+using Microsoft.Extensions.Logging.Abstractions;
+using Opc.Ua;
+using Opc.Ua.Client;
+using Opc.Ua.Configuration;
+using Shouldly;
+using Xunit;
+using ZB.MOM.WW.OtOpcUa.Core.Abstractions;
+using ZB.MOM.WW.OtOpcUa.Core.Hosting;
+using ZB.MOM.WW.OtOpcUa.Server.OpcUa;
+using ZB.MOM.WW.OtOpcUa.Server.Security;
+// Core.Abstractions.HistoryReadResult (driver-side samples) collides with Opc.Ua.HistoryReadResult
+// (service-layer per-node result). Alias the driver type so the stub's interface implementations
+// are unambiguous.
+using DriverHistoryReadResult = ZB.MOM.WW.OtOpcUa.Core.Abstractions.HistoryReadResult;
+
+namespace ZB.MOM.WW.OtOpcUa.Server.Tests;
+
+/// <summary>
+///     End-to-end test that a real OPC UA client's HistoryRead service reaches a fake driver's
+///     <see cref="IHistoryProvider"/> via <see cref="DriverNodeManager"/>'s
+///     <c>HistoryReadRawModified</c> / <c>HistoryReadProcessed</c> / <c>HistoryReadAtTime</c> /
+///     <c>HistoryReadEvents</c> overrides. Boots the full OPC UA stack + a stub
+///     <see cref="IHistoryProvider"/> driver, opens a client session, issues each HistoryRead
+///     variant, and asserts the client receives the expected per-kind payload.
+/// </summary>
+[Trait("Category", "Integration")]
+public sealed class HistoryReadIntegrationTests : IAsyncLifetime
+{
+    private static readonly int Port = 48600 + Random.Shared.Next(0, 99);
+    private readonly string _endpoint = $"opc.tcp://localhost:{Port}/OtOpcUaHistoryTest";
+    private readonly string _pkiRoot = Path.Combine(Path.GetTempPath(), $"otopcua-history-test-{Guid.NewGuid():N}");
+
+    private DriverHost _driverHost = null!;
+    private OpcUaApplicationHost _server = null!;
+    private HistoryDriver _driver = null!;
+
+    public async ValueTask InitializeAsync()
+    {
+        _driverHost = new DriverHost();
+        _driver = new HistoryDriver();
+        await _driverHost.RegisterAsync(_driver, "{}", CancellationToken.None);
+
+        var options = new OpcUaServerOptions
+        {
+            EndpointUrl = _endpoint,
+            ApplicationName = "OtOpcUaHistoryTest",
+            ApplicationUri = "urn:OtOpcUa:Server:HistoryTest",
+            PkiStoreRoot = _pkiRoot,
+            AutoAcceptUntrustedClientCertificates = true,
+        };
+
+        _server = new OpcUaApplicationHost(options, _driverHost, new DenyAllUserAuthenticator(),
+            NullLoggerFactory.Instance, NullLogger<OpcUaApplicationHost>.Instance);
+        await _server.StartAsync(CancellationToken.None);
+    }
+
+    public async ValueTask DisposeAsync()
+    {
+        await _server.DisposeAsync();
+        await _driverHost.DisposeAsync();
+        try { Directory.Delete(_pkiRoot, recursive: true); } catch { /* best-effort */ }
+    }
+
+    [Fact]
+    public async Task HistoryReadRaw_round_trips_driver_samples_to_the_client()
+    {
+        using var session = await OpenSessionAsync();
+        var nsIndex = (ushort)session.NamespaceUris.GetIndex("urn:OtOpcUa:history-driver");
+        var nodeId = new NodeId("raw.var", nsIndex);
+
+        // The Opc.Ua client exposes HistoryRead via Session.HistoryRead. We construct a
+        // ReadRawModifiedDetails (IsReadModified=false → raw path) and a single
+        // HistoryReadValueId targeting the driver-backed variable.
+        var details = new ReadRawModifiedDetails
+        {
+            StartTime = new DateTime(2024, 1, 1, 0, 0, 0, DateTimeKind.Utc),
+            EndTime = new DateTime(2024, 1, 1, 0, 0, 10, DateTimeKind.Utc),
+            NumValuesPerNode = 100,
+            IsReadModified = false,
+            ReturnBounds = false,
+        };
+        var extObj = new ExtensionObject(details);
+        var nodesToRead = new HistoryReadValueIdCollection { new() { NodeId = nodeId } };
+
+        session.HistoryRead(null, extObj, TimestampsToReturn.Both, false, nodesToRead,
+            out var results, out _);
+
+        results.Count.ShouldBe(1);
+        results[0].StatusCode.Code.ShouldBe(StatusCodes.Good, $"HistoryReadRaw returned {results[0].StatusCode}");
+        var hd = (HistoryData)ExtensionObject.ToEncodeable(results[0].HistoryData);
+        hd.DataValues.Count.ShouldBe(_driver.RawSamplesReturned, "one DataValue per driver sample");
+        hd.DataValues[0].Value.ShouldBe(_driver.FirstRawValue);
+    }
+
+    [Fact]
+    public async Task HistoryReadProcessed_maps_Average_aggregate_and_routes_to_ReadProcessedAsync()
+    {
+        using var session = await OpenSessionAsync();
+        var nsIndex = (ushort)session.NamespaceUris.GetIndex("urn:OtOpcUa:history-driver");
+        var nodeId = new NodeId("proc.var", nsIndex);
+
+        var details = new ReadProcessedDetails
+        {
+            StartTime = new DateTime(2024, 1, 1, 0, 0, 0, DateTimeKind.Utc),
+            EndTime = new DateTime(2024, 1, 1, 0, 1, 0, DateTimeKind.Utc),
+            ProcessingInterval = 10_000, // 10s buckets
+            AggregateType = [ObjectIds.AggregateFunction_Average],
+        };
+        var extObj = new ExtensionObject(details);
+        var nodesToRead = new HistoryReadValueIdCollection { new() { NodeId = nodeId } };
+
+        session.HistoryRead(null, extObj, TimestampsToReturn.Both, false, nodesToRead,
+            out var results, out _);
+
+        results[0].StatusCode.Code.ShouldBe(StatusCodes.Good);
+        _driver.LastProcessedAggregate.ShouldBe(HistoryAggregateType.Average,
+            "MapAggregate must translate ObjectIds.AggregateFunction_Average → driver enum");
+        _driver.LastProcessedInterval.ShouldBe(TimeSpan.FromSeconds(10));
+    }
+
+    [Fact]
+    public async Task HistoryReadProcessed_returns_BadAggregateNotSupported_for_unmapped_aggregate()
+    {
+        using var session = await OpenSessionAsync();
+        var nsIndex = (ushort)session.NamespaceUris.GetIndex("urn:OtOpcUa:history-driver");
+        var nodeId = new NodeId("proc.var", nsIndex);
+
+        var details = new ReadProcessedDetails
+        {
+            StartTime = new DateTime(2024, 1, 1, 0, 0, 0, DateTimeKind.Utc),
+            EndTime = new DateTime(2024, 1, 1, 0, 1, 0, DateTimeKind.Utc),
+            ProcessingInterval = 10_000,
+            // TimeAverage is a valid OPC UA aggregate NodeId but not one the driver implements —
+            // the override returns BadAggregateNotSupported per Part 13 rather than coercing.
+            AggregateType = [ObjectIds.AggregateFunction_TimeAverage],
+        };
+        var extObj = new ExtensionObject(details);
+        var nodesToRead = new HistoryReadValueIdCollection { new() { NodeId = nodeId } };
+
+        session.HistoryRead(null, extObj, TimestampsToReturn.Both, false, nodesToRead,
+            out var results, out _);
+
+        results[0].StatusCode.Code.ShouldBe(StatusCodes.BadAggregateNotSupported);
+    }
+
+    [Fact]
+    public async Task HistoryReadAtTime_forwards_timestamp_list_to_driver()
+    {
+        using var session = await OpenSessionAsync();
+        var nsIndex = (ushort)session.NamespaceUris.GetIndex("urn:OtOpcUa:history-driver");
+        var nodeId = new NodeId("atTime.var", nsIndex);
+
+        var t1 = new DateTime(2024, 3, 1, 10, 0, 0, DateTimeKind.Utc);
+        var t2 = new DateTime(2024, 3, 1, 10, 0, 30, DateTimeKind.Utc);
+        var details = new ReadAtTimeDetails { ReqTimes = new DateTimeCollection { t1, t2 } };
+        var extObj = new ExtensionObject(details);
+        var nodesToRead = new HistoryReadValueIdCollection { new() { NodeId = nodeId } };
+
+        session.HistoryRead(null, extObj, TimestampsToReturn.Both, false, nodesToRead,
+            out var results, out _);
+
+        results[0].StatusCode.Code.ShouldBe(StatusCodes.Good);
+        _driver.LastAtTimeRequestedTimes.ShouldNotBeNull();
+        _driver.LastAtTimeRequestedTimes!.Count.ShouldBe(2);
+        _driver.LastAtTimeRequestedTimes[0].ShouldBe(t1);
+        _driver.LastAtTimeRequestedTimes[1].ShouldBe(t2);
+    }
+
+    [Fact]
+    public async Task HistoryReadEvents_returns_HistoryEvent_with_BaseEventType_field_list()
+    {
+        using var session = await OpenSessionAsync();
+        // Events target the driver-root notifier (not a specific variable) which is the
+        // conventional pattern for alarm-history browse.
+        var nsIndex = (ushort)session.NamespaceUris.GetIndex("urn:OtOpcUa:history-driver");
+        var nodeId = new NodeId("history-driver", nsIndex);
+
+        // EventFilter must carry at least one SelectClause or the stack rejects it as
+        // BadEventFilterInvalid before our override runs — empty filters are spec-forbidden.
+        // We populate the standard BaseEventType selectors any real client would send; my
+        // override's BuildHistoryEvent ignores the specific clauses and emits the canonical
+        // field list anyway (the richer "respect exact SelectClauses" behavior is on the PR 38
+        // follow-up list).
+        var filter = new EventFilter();
+        filter.AddSelectClause(ObjectTypeIds.BaseEventType, BrowseNames.EventId);
+        filter.AddSelectClause(ObjectTypeIds.BaseEventType, BrowseNames.SourceName);
+        filter.AddSelectClause(ObjectTypeIds.BaseEventType, BrowseNames.Message);
+        filter.AddSelectClause(ObjectTypeIds.BaseEventType, BrowseNames.Severity);
+        filter.AddSelectClause(ObjectTypeIds.BaseEventType, BrowseNames.Time);
+        filter.AddSelectClause(ObjectTypeIds.BaseEventType, BrowseNames.ReceiveTime);
+
+        var details = new ReadEventDetails
+        {
+            StartTime = new DateTime(2024, 1, 1, 0, 0, 0, DateTimeKind.Utc),
+            EndTime = new DateTime(2024, 12, 31, 0, 0, 0, DateTimeKind.Utc),
+            NumValuesPerNode = 10,
+            Filter = filter,
+        };
+        var extObj = new ExtensionObject(details);
+        var nodesToRead = new HistoryReadValueIdCollection { new() { NodeId = nodeId } };
+
+        session.HistoryRead(null, extObj, TimestampsToReturn.Both, false, nodesToRead,
+            out var results, out _);
+
+        results[0].StatusCode.Code.ShouldBe(StatusCodes.Good);
+        var he = (HistoryEvent)ExtensionObject.ToEncodeable(results[0].HistoryData);
+        he.Events.Count.ShouldBe(_driver.EventsReturned);
+        he.Events[0].EventFields.Count.ShouldBe(6, "BaseEventType default field layout is 6 entries");
+    }
+
+    private async Task<ISession> OpenSessionAsync()
+    {
+        var cfg = new ApplicationConfiguration
+        {
+            ApplicationName = "OtOpcUaHistoryTestClient",
+            ApplicationUri = "urn:OtOpcUa:HistoryTestClient",
+            ApplicationType = ApplicationType.Client,
+            SecurityConfiguration = new SecurityConfiguration
+            {
+                ApplicationCertificate = new CertificateIdentifier
+                {
+                    StoreType = CertificateStoreType.Directory,
+                    StorePath = Path.Combine(_pkiRoot, "client-own"),
+                    SubjectName = "CN=OtOpcUaHistoryTestClient",
+                },
+                TrustedIssuerCertificates = new CertificateTrustList { StoreType = CertificateStoreType.Directory, StorePath = Path.Combine(_pkiRoot, "client-issuers") },
+                TrustedPeerCertificates = new CertificateTrustList { StoreType = CertificateStoreType.Directory, StorePath = Path.Combine(_pkiRoot, "client-trusted") },
+                RejectedCertificateStore = new CertificateTrustList { StoreType = CertificateStoreType.Directory, StorePath = Path.Combine(_pkiRoot, "client-rejected") },
+                AutoAcceptUntrustedCertificates = true,
+                AddAppCertToTrustedStore = true,
+            },
+            TransportConfigurations = new TransportConfigurationCollection(),
+            TransportQuotas = new TransportQuotas { OperationTimeout = 15000 },
+            ClientConfiguration = new ClientConfiguration { DefaultSessionTimeout = 60000 },
+        };
+        await cfg.Validate(ApplicationType.Client);
+        cfg.CertificateValidator.CertificateValidation += (_, e) => e.Accept = true;
+
+        var instance = new ApplicationInstance { ApplicationConfiguration = cfg, ApplicationType = ApplicationType.Client };
+        await instance.CheckApplicationInstanceCertificate(true, CertificateFactory.DefaultKeySize);
+
+        var selected = CoreClientUtils.SelectEndpoint(cfg, _endpoint, useSecurity: false);
+        var endpointConfig = EndpointConfiguration.Create(cfg);
+        var configuredEndpoint = new ConfiguredEndpoint(null, selected, endpointConfig);
+
+        return await Session.Create(cfg, configuredEndpoint, false, "OtOpcUaHistoryTestClientSession", 60000,
+            new UserIdentity(new AnonymousIdentityToken()), null);
+    }
+
+    /// <summary>
+    ///     Stub driver that implements <see cref="IHistoryProvider"/> so the service dispatch
+    ///     can be verified without bringing up a real Galaxy or Historian. Captures the last-
+    ///     seen arguments so tests can assert what the service handler forwarded.
+    /// </summary>
+    private sealed class HistoryDriver : IDriver, ITagDiscovery, IReadable, IHistoryProvider
+    {
+        public string DriverInstanceId => "history-driver";
+        public string DriverType => "HistoryStub";
+
+        public int RawSamplesReturned => 3;
+        public int FirstRawValue => 100;
+        public int EventsReturned => 2;
+
+        public HistoryAggregateType? LastProcessedAggregate { get; private set; }
+        public TimeSpan? LastProcessedInterval { get; private set; }
+        public IReadOnlyList<DateTime>? LastAtTimeRequestedTimes { get; private set; }
+
+        public Task InitializeAsync(string driverConfigJson, CancellationToken ct) => Task.CompletedTask;
+        public Task ReinitializeAsync(string driverConfigJson, CancellationToken ct) => Task.CompletedTask;
+        public Task ShutdownAsync(CancellationToken ct) => Task.CompletedTask;
+        public DriverHealth GetHealth() => new(DriverState.Healthy, DateTime.UtcNow, null);
+        public long GetMemoryFootprint() => 0;
+        public Task FlushOptionalCachesAsync(CancellationToken ct) => Task.CompletedTask;
+
+        public Task DiscoverAsync(IAddressSpaceBuilder builder, CancellationToken ct)
+        {
+            // Every variable must be Historized for HistoryRead to route — the node-manager's
+            // stack base class checks the bit before dispatching.
+            builder.Variable("raw", "raw",
+                new DriverAttributeInfo("raw.var", DriverDataType.Int32, false, null,
+                    SecurityClassification.FreeAccess, IsHistorized: true, IsAlarm: false));
+            builder.Variable("proc", "proc",
+                new DriverAttributeInfo("proc.var", DriverDataType.Float64, false, null,
+                    SecurityClassification.FreeAccess, IsHistorized: true, IsAlarm: false));
+            builder.Variable("atTime", "atTime",
+                new DriverAttributeInfo("atTime.var", DriverDataType.Int32, false, null,
+                    SecurityClassification.FreeAccess, IsHistorized: true, IsAlarm: false));
+            return Task.CompletedTask;
+        }
+
+        public Task<IReadOnlyList<DataValueSnapshot>> ReadAsync(
+            IReadOnlyList<string> fullReferences, CancellationToken cancellationToken)
+        {
+            var now = DateTime.UtcNow;
+            IReadOnlyList<DataValueSnapshot> r =
+                [.. fullReferences.Select(_ => new DataValueSnapshot(0, 0u, now, now))];
+            return Task.FromResult(r);
+        }
+
+        public Task<DriverHistoryReadResult> ReadRawAsync(
+            string fullReference, DateTime startUtc, DateTime endUtc, uint maxValuesPerNode,
+            CancellationToken cancellationToken)
+        {
+            var samples = new List<DataValueSnapshot>();
+            for (var i = 0; i < RawSamplesReturned; i++)
+            {
+                samples.Add(new DataValueSnapshot(
+                    Value: FirstRawValue + i,
+                    StatusCode: StatusCodes.Good,
+                    SourceTimestampUtc: startUtc.AddSeconds(i),
+                    ServerTimestampUtc: startUtc.AddSeconds(i)));
+            }
+            return Task.FromResult(new DriverHistoryReadResult(samples, null));
+        }
+
+        public Task<DriverHistoryReadResult> ReadProcessedAsync(
+            string fullReference, DateTime startUtc, DateTime endUtc, TimeSpan interval,
+            HistoryAggregateType aggregate, CancellationToken cancellationToken)
+        {
+            LastProcessedAggregate = aggregate;
+            LastProcessedInterval = interval;
+            return Task.FromResult(new DriverHistoryReadResult(
+                [new DataValueSnapshot(1.0, StatusCodes.Good, startUtc, startUtc)],
+                null));
+        }
+
+        public Task<DriverHistoryReadResult> ReadAtTimeAsync(
+            string fullReference, IReadOnlyList<DateTime> timestampsUtc,
+            CancellationToken cancellationToken)
+        {
+            LastAtTimeRequestedTimes = timestampsUtc;
+            var samples = timestampsUtc
+                .Select(t => new DataValueSnapshot(42, StatusCodes.Good, t, t))
+                .ToArray();
+            return Task.FromResult(new DriverHistoryReadResult(samples, null));
+        }
+
+        public Task<HistoricalEventsResult> ReadEventsAsync(
+            string? sourceName, DateTime startUtc, DateTime endUtc, int maxEvents,
+            CancellationToken cancellationToken)
+        {
+            var events = new List<HistoricalEvent>();
+            for (var i = 0; i < EventsReturned; i++)
+            {
+                events.Add(new HistoricalEvent(
+                    EventId: $"e{i}",
+                    SourceName: sourceName,
+                    EventTimeUtc: startUtc.AddHours(i),
+                    ReceivedTimeUtc: startUtc.AddHours(i).AddSeconds(1),
+                    Message: $"Event {i}",
+                    Severity: (ushort)(500 + i)));
+            }
+            return Task.FromResult(new HistoricalEventsResult(events, null));
+        }
+    }
+}