Merge pull request (#93) - v2 release-readiness capstone

Closes out Phase 6 with the two pieces a release engineer needs before
tagging v2 GA:

1. scripts/compliance/phase-6-all.ps1 — meta-runner that invokes every
   per-phase Phase 6.N compliance script in sequence + aggregates results.
   Each sub-script runs in its own powershell.exe child process so per-script
   $ErrorActionPreference + exit semantics can't interfere with the parent.
   Exit 0 = every phase passes; exit 1 = one or more phases failed. Prints a
   PASS/FAIL summary matrix at the end.

2. docs/v2/v2-release-readiness.md — single-view dashboard of everything
   shipped + everything still deferred + release exit criteria. Called out
   explicitly:
   - Three release BLOCKERS (must close before v2 GA):
     * Phase 6.2 Stream C dispatch wiring — AuthorizationGate exists but no
       DriverNodeManager Read/Write/etc. path calls it (task #143).
     * Phase 6.1 Stream D follow-up — ResilientConfigReader + sealed-cache
       hook not yet consumed by any read path (task #136).
     * Phase 6.3 Streams A/C/F — coordinator + UA-node wiring + client
       interop still deferred (tasks #145, #147, #150).
   - Three nice-to-haves (not release-blocking) — Admin UI polish, background
     services, multi-host dispatch.
   - Release exit criteria: all 4 compliance scripts exit 0, dotnet test ≤ 1
     known flake, blockers closed or v2.1-deferred with written decision,
     Fleet Admin signoff on deployment checklist, live-Galaxy smoke test,
     OPC UA CTT pass, redundancy cutover validated with at least one
     production client.
   - Change log at the bottom so future ships of deferred follow-ups just
     append dates + close out dashboard rows.

Meta-runner verified locally:
  Phase 6.1 — PASS
  Phase 6.2 — PASS
  Phase 6.3 — PASS
  Phase 6.4 — PASS
  Aggregate: PASS (elapsed 340 s — most of that is the full solution
  `dotnet test` each phase runs).

Net counts at capstone time: 906 baseline → 1159 passing across Phase 6
(+253). 15 deferred follow-up tasks tracked with IDs (#134-137, #143-144,
#145, #147, #149-150, #153, #155-157). v2 is NOT YET release-ready —
capstone makes that explicit rather than letting the "shipped" label on
each phase imply full readiness.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.gitignore

@@ -29,3 +29,4 @@ packages/
 # Claude Code (per-developer settings, runtime lock files, agent transcripts)
 .claude/
 
+.local/

ZB.MOM.WW.OtOpcUa.slnx

@@ -9,6 +9,8 @@
         <Project Path="src/ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Host/ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Host.csproj"/>
         <Project Path="src/ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Proxy/ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Proxy.csproj"/>
         <Project Path="src/ZB.MOM.WW.OtOpcUa.Driver.Modbus/ZB.MOM.WW.OtOpcUa.Driver.Modbus.csproj"/>
+        <Project Path="src/ZB.MOM.WW.OtOpcUa.Driver.S7/ZB.MOM.WW.OtOpcUa.Driver.S7.csproj"/>
+        <Project Path="src/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.csproj"/>
         <Project Path="src/ZB.MOM.WW.OtOpcUa.Client.Shared/ZB.MOM.WW.OtOpcUa.Client.Shared.csproj"/>
         <Project Path="src/ZB.MOM.WW.OtOpcUa.Client.CLI/ZB.MOM.WW.OtOpcUa.Client.CLI.csproj"/>
         <Project Path="src/ZB.MOM.WW.OtOpcUa.Client.UI/ZB.MOM.WW.OtOpcUa.Client.UI.csproj"/>
@@ -21,10 +23,13 @@
         <Project Path="tests/ZB.MOM.WW.OtOpcUa.Admin.Tests/ZB.MOM.WW.OtOpcUa.Admin.Tests.csproj"/>
         <Project Path="tests/ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Shared.Tests/ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Shared.Tests.csproj"/>
         <Project Path="tests/ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Host.Tests/ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Host.Tests.csproj"/>
+        <Project Path="tests/ZB.MOM.WW.OtOpcUa.Driver.Galaxy.TestSupport/ZB.MOM.WW.OtOpcUa.Driver.Galaxy.TestSupport.csproj"/>
         <Project Path="tests/ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Proxy.Tests/ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Proxy.Tests.csproj"/>
         <Project Path="tests/ZB.MOM.WW.OtOpcUa.Driver.Galaxy.E2E/ZB.MOM.WW.OtOpcUa.Driver.Galaxy.E2E.csproj"/>
         <Project Path="tests/ZB.MOM.WW.OtOpcUa.Driver.Modbus.Tests/ZB.MOM.WW.OtOpcUa.Driver.Modbus.Tests.csproj"/>
         <Project Path="tests/ZB.MOM.WW.OtOpcUa.Driver.Modbus.IntegrationTests/ZB.MOM.WW.OtOpcUa.Driver.Modbus.IntegrationTests.csproj"/>
+        <Project Path="tests/ZB.MOM.WW.OtOpcUa.Driver.S7.Tests/ZB.MOM.WW.OtOpcUa.Driver.S7.Tests.csproj"/>
+        <Project Path="tests/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.Tests/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.Tests.csproj"/>
         <Project Path="tests/ZB.MOM.WW.OtOpcUa.Client.Shared.Tests/ZB.MOM.WW.OtOpcUa.Client.Shared.Tests.csproj"/>
         <Project Path="tests/ZB.MOM.WW.OtOpcUa.Client.CLI.Tests/ZB.MOM.WW.OtOpcUa.Client.CLI.Tests.csproj"/>
         <Project Path="tests/ZB.MOM.WW.OtOpcUa.Client.UI.Tests/ZB.MOM.WW.OtOpcUa.Client.UI.Tests.csproj"/>

_p54.json

@@ -0,0 +1 @@
+{"title":"Phase 3 PR 54 -- Siemens S7 Modbus TCP quirks research doc","body":"## Summary\n\nAdds `docs/v2/s7.md` (485 lines) covering Siemens SIMATIC S7 family Modbus TCP behavior. Mirrors the `docs/v2/dl205.md` template for future per-quirk implementation PRs.\n\n## Key findings for the implementation track\n\n- **No fixed memory map** — every S7 Modbus server is user-wired via `MB_SERVER`/`MODBUSCP`/`MODBUSPN` library blocks. Driver must accept per-site config, not assume a vendor layout.\n- **MB_SERVER requires non-optimized DBs** (STATUS `0x8383` if optimized). Most common field bug.\n- **Word order default = ABCD** (opposite of DL260). Driver's S7 profile default must be `ByteOrder.BigEndian`, not `WordSwap`.\n- **One port per MB_SERVER instance** — multi-client requires parallel FBs on 503/504/… Most clients assume port 502 multiplexes (wrong on S7).\n- **CP 343-1 Lean is server-only**, requires the `2XV9450-1MB00` license.\n- **FC20/21/22/23/43 all return Illegal Function** on every S7 variant — driver must not attempt FC23 bulk-read optimization for S7.\n- **STOP-mode behavior non-deterministic** across firmware bands — treat both read/write STOP-mode responses as unavailable.\n\nTwo items flagged as unconfirmed rumour (V2.0+ float byte-order claim, STOP-mode caching location).\n\nNo code, no tests — implementation lands in PRs 56+.\n\n## Test plan\n- [x] Doc renders as markdown\n- [x] 31 citations present\n- [x] Section structure matches dl205.md template","head":"phase-3-pr54-s7-research-doc","base":"v2"}

_p55.json

@@ -0,0 +1 @@
+{"title":"Phase 3 PR 55 -- Mitsubishi MELSEC Modbus TCP quirks research doc","body":"## Summary\n\nAdds `docs/v2/mitsubishi.md` (451 lines) covering MELSEC Q/L/iQ-R/iQ-F/FX3U Modbus TCP behavior. Mirrors `docs/v2/dl205.md` template for per-quirk implementation PRs.\n\n## Key findings for the implementation track\n\n- **Module naming trap** — `QJ71MB91` is SERIAL RTU, not TCP. TCP module is `QJ71MT91`. Surface clearly in driver docs.\n- **No canonical mapping** — per-site 'Modbus Device Assignment Parameter' block (up to 16 entries). Treat mapping as runtime config.\n- **X/Y hex vs octal depends on family** — Q/L/iQ-R use HEX (X20 = decimal 32); FX/iQ-F use OCTAL (X20 = decimal 16). Helper must take a family selector.\n- **Word order CDAB default** across all MELSEC families (opposite of Siemens S7). Driver Mitsubishi profile default: `ByteOrder.WordSwap`.\n- **D-registers binary by default** (opposite of DL205's BCD default). Caller opts in to `Bcd16`/`Bcd32` when ladder uses BCD.\n- **FX5U needs firmware ≥ 1.060** for Modbus TCP server — older is client-only.\n- **FX3U-ENET vs FX3U-ENET-P502 vs FX3U-ENET-ADP** — only the middle one binds port 502; the last has no Modbus at all. Common operator mis-purchase.\n- **QJ71MT91 does NOT support FC22 / FC23** — iQ-R / iQ-F do. Bulk-read optimization must gate on capability.\n- **STOP-mode writes configurable** on Q/L/iQ-R/iQ-F (default accept), always rejected on FX3U-ENET.\n\nThree unconfirmed rumours flagged separately.\n\nNo code, no tests — implementation lands in PRs 58+.\n\n## Test plan\n- [x] Doc renders as markdown\n- [x] 17 citations present\n- [x] Per-model test naming matrix included (`Mitsubishi_QJ71MT91_*`, `Mitsubishi_FX5U_*`, `Mitsubishi_FX3U_ENET_*`, shared `Mitsubishi_Common_*`)","head":"phase-3-pr55-mitsubishi-research-doc","base":"v2"}

docs/v2/V1_ARCHIVE_STATUS.md

@@ -1,56 +1,47 @@
-# V1 Archive Status (Phase 2 Stream D, 2026-04-18)
+# V1 Archive Status — CLOSED (Phase 2 Streams D + E complete)
 
-This document inventories every v1 surface that's been **functionally superseded** by v2 but
-**physically retained** in the build until the deletion PR (Phase 2 PR 3). Rationale: cascading
-references mean a single deletion is high blast-radius; archive-marking lets the v2 stack ship
-on its own merits while the v1 surface stays as parity reference.
+> **Status as of 2026-04-18: the v1 archive has been fully removed from the tree.**
+> This document is retained as historical record of the Phase 2 Stream D / E closure.
 
-## Archived projects
+## Final state
 
-| Path | Status | Replaced by | Build behavior |
-|---|---|---|---|
-| `src/ZB.MOM.WW.OtOpcUa.Host/` | Archive (executable in build) | `OtOpcUa.Server` + `Driver.Galaxy.Host` + `Driver.Galaxy.Proxy` | Builds; not deployed by v2 install scripts |
-| `src/ZB.MOM.WW.OtOpcUa.Historian.Aveva/` | Archive (plugin in build) | TODO: port into `Driver.Galaxy.Host/Backend/Historian/` (Task B.1.h follow-up) | Builds; loaded only by archived Host |
-| `tests/ZB.MOM.WW.OtOpcUa.Tests.v1Archive/` | Archive | `Driver.Galaxy.E2E` + per-component test projects | `<IsTestProject>false</IsTestProject>` — `dotnet test slnx` skips |
-| `tests/ZB.MOM.WW.OtOpcUa.IntegrationTests/` | Archive | `Driver.Galaxy.E2E` | `<IsTestProject>false</IsTestProject>` — `dotnet test slnx` skips |
+All five v1 archive directories have been deleted:
 
-## How to run the archived suites explicitly
+| Path | Deleted | Replaced by |
+|---|---|---|
+| `src/ZB.MOM.WW.OtOpcUa.Host/` | ✅ | `OtOpcUa.Server` + `Driver.Galaxy.Host` + `Driver.Galaxy.Proxy` |
+| `src/ZB.MOM.WW.OtOpcUa.Historian.Aveva/` | ✅ | `Driver.Galaxy.Host/Backend/Historian/` (ported in Phase 3 PRs 51-55) |
+| `tests/ZB.MOM.WW.OtOpcUa.Historian.Aveva.Tests/` | ✅ | `Driver.Galaxy.Host.Tests/Historian/` |
+| `tests/ZB.MOM.WW.OtOpcUa.Tests.v1Archive/` | ✅ | Per-component `*.Tests` projects + `Driver.Galaxy.E2E` |
+| `tests/ZB.MOM.WW.OtOpcUa.IntegrationTests/` | ✅ | `Driver.Galaxy.E2E` + `Driver.Modbus.IntegrationTests` |
 
-```powershell
-# v1 unit tests (494):
-dotnet test tests/ZB.MOM.WW.OtOpcUa.Tests.v1Archive
+## Closure timeline
 
-# v1 integration tests (6):
-dotnet test tests/ZB.MOM.WW.OtOpcUa.IntegrationTests
-```
+- **PR 2 (2026-04-18, phase-2-stream-d)** — archive-marked the four v1 projects with
+  `<IsTestProject>false</IsTestProject>` so solution builds and `dotnet test slnx` bypassed
+  them. Capture: `docs/v2/implementation/exit-gate-phase-2-final.md`.
+- **Phase 3 PR 18 (2026-04-18)** — deleted the archived project source trees. Leftover
+  `bin/` and `obj/` residue remained on disk from pre-deletion builds.
+- **Phase 2 PR 61 (2026-04-18, this closure PR)** — scrubbed the empty residue directories
+  and confirmed `dotnet build ZB.MOM.WW.OtOpcUa.slnx` clean with 0 errors.
 
-Both still pass on this dev box — they're the parity reference for Phase 2 PR 3's deletion
-decision.
+## Parity validation (Stream E)
 
-## Deletion plan (Phase 2 PR 3)
+The original 494 v1 tests + 6 v1 integration tests are **not** preserved in the v2 branch.
+Their parity-bar role is now filled by:
 
-Pre-conditions:
-- [ ] `Driver.Galaxy.E2E` test count covers the v1 IntegrationTests' 6 integration scenarios
-      at minimum (currently 7 tests; expand as needed)
-- [ ] `Driver.Galaxy.Host/Backend/Historian/` ports the Wonderware Historian plugin
-      so `MxAccessGalaxyBackend.HistoryReadAsync` returns real data (Task B.1.h)
-- [ ] Operator review on a separate PR — destructive change
-
-Steps:
-1. `git rm -r src/ZB.MOM.WW.OtOpcUa.Host/`
-2. `git rm -r src/ZB.MOM.WW.OtOpcUa.Historian.Aveva/`
-   (or move it under Driver.Galaxy.Host first if the lift is part of the same PR)
-3. `git rm -r tests/ZB.MOM.WW.OtOpcUa.Tests.v1Archive/`
-4. `git rm -r tests/ZB.MOM.WW.OtOpcUa.IntegrationTests/`
-5. Edit `ZB.MOM.WW.OtOpcUa.slnx` — remove the four project lines
-6. `dotnet build ZB.MOM.WW.OtOpcUa.slnx` → confirm clean
-7. `dotnet test ZB.MOM.WW.OtOpcUa.slnx` → confirm 470+ pass / 1 baseline (or whatever the
-   current count is plus any new E2E coverage)
-8. Commit: "Phase 2 Stream D — delete v1 archive (Host + Historian.Aveva + v1Tests + IntegrationTests)"
-9. PR 3 against `v2`, link this doc + exit-gate-phase-2-final.md
-10. One reviewer signoff
+- `Driver.Galaxy.E2E` — cross-FX subprocess parity (spawns the net48 x86 Galaxy.Host.exe
+  + connects via real named pipe, exercises every `IDriver` capability through the
+  supervisor). Stability-findings regression tests (4 × 2026-04-13 findings) live here.
+- Per-component `*.Tests` projects — cover the code that moved out of the monolith into
+  discrete v2 projects. Running `dotnet test ZB.MOM.WW.OtOpcUa.slnx` executes all of them
+  as one solution-level gate.
+- `Driver.Modbus.IntegrationTests` — adds Modbus TCP driver coverage that didn't exist in
+  v1 (DL205, S7-1500, Mitsubishi MELSEC via pymodbus sim profiles — PRs 30, 56-60).
+- Live-stack smoke tests (`Driver.Galaxy.E2E/LiveStack/`) — optional, gated on presence
+  of the `OtOpcUaGalaxyHost` service + Galaxy repository on the dev box (PRs 33, 36, 37).
 
 ## Rollback
 
-If Phase 2 PR 3 surfaces downstream consumer regressions, `git revert` the deletion commit
-restores the four projects intact. The v2 stack continues to ship from the v2 branch.
+`git revert` of the deletion commits restores the projects intact. The v2 stack continues
+to ship from the `v2` branch regardless.

docs/v2/dl205.md

@@ -0,0 +1,295 @@
+# AutomationDirect DirectLOGIC DL205 / DL260 — Modbus quirks
+
+AutomationDirect's DirectLOGIC DL205 family (D2-250-1, D2-260, D2-262, D2-262M) and
+its larger DL260 sibling speak Modbus TCP (via the H2-ECOM100 / H2-EBC100 Ethernet
+coprocessors, and the DL260's built-in Ethernet port) and Modbus RTU (via the CPU
+serial ports in "Modbus" mode). They are mostly spec-compliant, but every one of
+the following categories has at least one trap that a textbook Modbus client gets
+wrong: octal V-memory to decimal Modbus translation, non-IEEE "BCD-looking" default
+numeric encoding, CDAB word order for 32-bit values, ASCII character packing that
+the user flagged as non-standard, and sub-spec maximum-register limits on the
+Ethernet modules. This document catalogues each quirk, cites primary sources, and
+names the ModbusPal integration test we'd write for it (convention from
+`docs/v2/modbus-test-plan.md`: `DL205_<behavior>`).
+
+## Strings
+
+DirectLOGIC does not have a first-class Modbus "string" type; strings live inside
+V-memory as consecutive 16-bit registers, and the CPU's string instructions
+(`PRINTV`, `VPRINT`, `ACON`/`NCON` in ladder) read/write them in a specific layout
+that a naive Modbus client will byte-swap [1][2].
+
+- **Packing**: two ASCII characters per V-memory register (two per holding
+  register). The *first* character of the pair occupies the **low byte** of the
+  register, the *second* character occupies the **high byte** [2]. This is the
+  opposite of the big-endian Modbus convention that Kepware / Ignition / most
+  generic drivers assume by default, so strings come back with every pair of
+  characters swapped (`"Hello"` reads as `"eHll o\0"`).
+- **Termination**: null-terminated (`0x00` in the character byte). There is no
+  length prefix. Writes must pad the final register's unused byte with `0x00`.
+- **Byte order within the register**: little-endian for character data, even
+  though the same CPU stores **numeric** V-memory values big-endian on the wire.
+  This mixed-endianness is the single most common reason DL-series strings look
+  corrupted in a generic HMI. Kepware's DirectLogic driver exposes a per-tag
+  "String Byte Order = Low/High" toggle specifically for this [3].
+- **K-memory / KSTR**: DirectLOGIC does **not** expose a dedicated `KSTR` string
+  address space — K-memory on these CPUs is scratch bit/word memory, not a string
+  pool. Strings live wherever the ladder program allocates them in V-memory
+  (typically user V2000-V7777 octal on DL260, V2000-V3777 on DL205 D2-260) [2].
+- **Maximum length**: bounded only by the V-memory region assigned. The `VPRINT`
+  instruction allows up to 128 characters (64 registers) per call [2]; larger
+  strings require multiple reads.
+- **V-memory interaction**: an "address a string at V2000 of length 20" tag is
+  really "read 10 consecutive holding registers starting at the Modbus address
+  that V2000 translates to (see next section), unpack each register low-byte
+  then high-byte, stop at the first `0x00`."
+
+Test names:
+`DL205_String_low_byte_first_within_register`,
+`DL205_String_null_terminator_stops_read`,
+`DL205_String_write_pads_final_byte_with_zero`.
+
+## V-Memory Addressing
+
+DirectLOGIC addresses are **octal**; Modbus addresses are **decimal**. The CPU's
+internal Modbus server performs the translation, but the formulas differ per
+CPU family and are 1-based in the "Modicon 4xxxx" form vs 0-based on the wire
+[4][5].
+
+Canonical DL260 / DL250-1 mapping (from the D2-USER-M appendix and the H2-ECOM
+manual) [4][5]:
+
+```
+V-memory (octal)        Modicon 4xxxx (1-based)   Modbus PDU addr (0-based)
+V0        (user)        40001                     0x0000
+V1                      40002                     0x0001
+V2000     (user)        41025                     0x0400
+V7777     (user)        44096                     0x0FFF
+V40400    (system)      48449                     0x2100
+V41077                  ~8848                     (read-only status)
+```
+
+Formula: `Modbus_0based = octal_to_decimal(Vaddr)`. So `V2000` octal = `1024`
+decimal = Modbus PDU address `0x0400`. The "4xxxx" Modicon view just adds 1 and
+prefixes the register bank digit.
+
+- **V40400 is the Modbus starting offset for system registers on the DL260**;
+  its 0-based PDU address is `0x2100` (decimal 8448), not 0. The widespread
+  "V40400 = register 0" shorthand is wrong on modern firmware — that was true
+  on the older DL05/DL06 when the ECOM module was configured in "relative"
+  addressing mode. On the H2-ECOM100 factory default ("absolute" mode), V40400
+  maps to 0x2100 [5].
+- **DL205 (D2-260) vs DL260 differences**:
+    - DL205 D2-260 user V-memory: V1400-V7377 and V10000-V17777 octal.
+    - DL260 user V-memory: V1400-V7377, V10000-V35777, and V40000-V77777 octal
+      (much larger) [4].
+    - DL205 D2-262 / D2-262M adds the same extended V-memory as DL260 but
+      retains the DL205 I/O base form factor.
+    - Neither DL205 sub-model changes the *formula* — only the valid range.
+- **Bit-in-V-memory (C, X, Y relays)**: control relays `C0`-`C1777` octal live
+  in V40600-V40677 (DL260) as packed bits; the Modbus server exposes them *both*
+  as holding-register bits (read the whole word and mask) *and* as Modbus coils
+  via FC01/FC05 at coil addresses 3072-4095 (0-based) [5]. `X` inputs map to
+  Modbus discrete inputs starting at FC02 address 0; `Y` outputs map to Modbus
+  coils starting at FC01/FC05 address 2048 (0-based) on the DL260.
+- **Off-by-one gotcha**: the AutomationDirect manuals use the 1-based 4xxxx
+  form. Kepware, libmodbus, pymodbus, and the .NET stack all take the 0-based
+  PDU form. When the manual says "V2000 = 41025" you send `0x0400`, not
+  `0x0401`.
+
+Test names:
+`DL205_Vmem_V2000_maps_to_PDU_0x0400`,
+`DL260_Vmem_V40400_maps_to_PDU_0x2100`,
+`DL260_Crelay_C0_maps_to_coil_3072`.
+
+## Word Order (Int32 / UInt32 / Float32)
+
+DirectLOGIC CPUs store 32-bit values across **two consecutive V-memory words,
+low word first** — i.e., `CDAB` when viewed as a Modbus register pair [1][3].
+Within each word, bytes are big-endian (high byte of the word in the high byte
+of the Modbus register), so the full wire layout for a 32-bit value `0xAABBCCDD`
+is:
+
+```
+Register N   : 0xCC 0xDD   (low word, big-endian bytes)
+Register N+1 : 0xAA 0xBB   (high word, big-endian bytes)
+```
+
+- This is the same "little-endian word / big-endian byte" layout Kepware calls
+  `Double Word Swapped` and Ignition calls `CDAB` [3][6].
+- **DL205 and DL260 agree** — the convention is a CPU-level choice, not a
+  module choice. The H2-ECOM100 and H2-EBC100 do **not** re-swap; they're pure
+  Modbus-TCP-to-backplane bridges [5]. The DL260 built-in Ethernet port
+  behaves identically.
+- **Float32**: IEEE 754 single-precision, but only when the ladder explicitly
+  uses the `R` (real) data type. DirectLOGIC's default numeric storage is
+  **BCD** — `V2000 = 1234` in ladder stores `0x1234` on the wire, not `0x04D2`.
+  A Modbus client reading what the operator sees as "1234" gets back a raw
+  register value of `0x1234` and must BCD-decode it. Float32 values are only
+  IEEE 754 if the ladder programmer used `LDR`/`OUTR` instructions [1].
+- **Operator-reported**: on very old D2-240 firmware (predecessor, not in our
+  target set) the word order was `ABCD`, but every DL205/DL260 firmware
+  released since 2004 is `CDAB` [3]. _Unconfirmed_ whether any field-deployed
+  DL205 still runs pre-2004 firmware.
+
+Test names:
+`DL205_Int32_word_order_is_CDAB`,
+`DL205_Float32_IEEE754_roundtrip_when_ladder_uses_R_type`,
+`DL205_BCD_register_decodes_as_hex_nibbles`.
+
+## Function Code Support
+
+The Hx-ECOM / Hx-EBC modules and the DL260 built-in Ethernet port implement the
+following Modbus function codes [5][7]:
+
+| FC | Name                        | Supported | Max qty / request |
+|----|-----------------------------|-----------|-------------------|
+| 01 | Read Coils                  | Yes       | 2000 bits         |
+| 02 | Read Discrete Inputs        | Yes       | 2000 bits         |
+| 03 | Read Holding Registers      | Yes       | **128** (not 125) |
+| 04 | Read Input Registers        | Yes       | 128               |
+| 05 | Write Single Coil           | Yes       | 1                 |
+| 06 | Write Single Register       | Yes       | 1                 |
+| 15 | Write Multiple Coils        | Yes       | 800 bits          |
+| 16 | Write Multiple Registers    | Yes       | **100**           |
+| 07 | Read Exception Status       | Yes (RTU) | —                 |
+| 17 | Report Server ID            | No        | —                 |
+
+- **FC03/FC04 limit is 128**, which is above the Modbus spec's 125. Requesting
+  129+ returns exception code `03` (Illegal Data Value) [5].
+- **FC16 limit is 100**, below the spec's 123. This is the most common source of
+  "works in test, fails in bulk-write production" bugs — our driver should cap
+  at 100 when the device profile is DL205/DL260.
+- **No custom function codes** are exposed on the Modbus port. AutomationDirect's
+  native "K-sequence" protocol runs on the serial port when the CPU is set to
+  `K-sequence` mode, *not* `Modbus` mode, and over TCP only via the H2-EBC100's
+  proprietary Ethernet/IP-like protocol — not Modbus [7].
+
+Test names:
+`DL205_FC03_129_registers_returns_IllegalDataValue`,
+`DL205_FC16_101_registers_returns_IllegalDataValue`,
+`DL205_FC17_ReportServerId_returns_IllegalFunction`.
+
+## Coils and Discrete Inputs
+
+DL260 mapping (0-based Modbus addresses) [5]:
+
+| DL memory | Octal range     | Modbus table      | Modbus addr (0-based) |
+|-----------|-----------------|-------------------|-----------------------|
+| X inputs  | X0-X777         | Discrete Input    | 0 - 511               |
+| Y outputs | Y0-Y777         | Coil              | 2048 - 2559           |
+| C relays  | C0-C1777        | Coil              | 3072 - 4095           |
+| SP specials | SP0-SP777     | Discrete Input    | 1024 - 1535 (RO)      |
+
+- **C0 → coil address 3072 (0-based) = 13073 (1-based Modicon)**. Y0 → coil
+  2048 = 12049. These offsets are wired into the CPU and cannot be remapped.
+- **Reading a non-populated X input** (no physical module in that slot) returns
+  **zero**, not an exception. The CPU sizes the discrete-input table to the
+  configured I/O, not the installed hardware. Confirmed in the DL260 user
+  manual's I/O configuration chapter [4].
+- **Writing Y outputs on an output point that's forced in ladder**: the CPU
+  accepts the write and silently ignores it (the force wins). No exception is
+  returned. _Operator-reported_, matches Kepware driver release notes [3].
+
+Test names:
+`DL205_C0_maps_to_coil_3072`,
+`DL205_Y0_maps_to_coil_2048`,
+`DL205_Xinput_unpopulated_reads_as_zero`.
+
+## Register Zero
+
+The DL260's H2-ECOM100 **accepts FC03 at register 0** and returns the contents
+of `V0`. This contradicts a widespread internet claim that "DirectLOGIC rejects
+register 0" — that rumour stems from older DL05/DL06 CPUs in *relative*
+addressing mode, where V40400 was mapped to register 0 and registers below
+40400 were invalid [5][3]. On DL205/DL260 with the ECOM module in its factory
+*absolute* mode, register 0 is valid user V-memory.
+
+- Our driver's `ModbusProbeOptions.ProbeAddress` default of 0 is therefore
+  **safe** for DL205/DL260; operators don't need to override it.
+- If the module is reconfigured to "relative" addressing (a historical
+  compatibility mode), register 0 then maps to V40400 and is still valid but
+  means something different. The probe will still succeed.
+
+Test name: `DL205_FC03_register_0_returns_V0_contents`.
+
+## Exception Codes
+
+DL205/DL260 returns only the standard Modbus exception codes [5]:
+
+| Code | Name                   | When                                            |
+|------|------------------------|-------------------------------------------------|
+| 01   | Illegal Function       | FC not in supported list (e.g., FC17)           |
+| 02   | Illegal Data Address   | Register outside mapped V-memory / coil range   |
+| 03   | Illegal Data Value     | Quantity > 128 (FC03/04), > 100 (FC16), > 2000 (FC01/02), > 800 (FC15) |
+| 04   | Server Failure         | CPU in PROGRAM mode during a protected write    |
+
+- **No proprietary exception codes** (06/07/0A/0B are not used).
+- **Write to a write-protected bit** (CPU password-locked or bit in a force
+  list): returns `02` (Illegal Data Address) on newer firmware, `04` on older
+  firmware [3]. _Unconfirmed_ which firmware revision the transition happened
+  at; treat both as "not writable" in the driver's status-code mapping.
+- **Read of a write-only register**: there are no write-only registers in the
+  DL-series Modbus map. Every writable register is also readable.
+
+Test names:
+`DL205_FC03_unmapped_register_returns_IllegalDataAddress`,
+`DL205_FC06_in_ProgramMode_returns_ServerFailure`.
+
+## Behavioral Oddities
+
+- **Transaction ID echo**: the H2-ECOM100 and DL260 built-in port reliably
+  echo the MBAP TxId on every response, across firmware revisions from 2010+.
+  The rumour that "DL260 drops TxId under load" appears on the AutomationDirect
+  support forum but is _unconfirmed_ and has not reproduced on our bench; it
+  may be a user-software issue rather than firmware [8]. Our driver's
+  single-flight + TxId-match guard handles it either way.
+- **Concurrency**: the ECOM serializes requests internally. Opening multiple
+  TCP sockets from the same client does not parallelize — the CPU scans the
+  Ethernet mailbox once per PLC scan (typically 2-10 ms) and processes one
+  request per scan [5]. High-frequency polling from multiple clients
+  multiplies scan overhead linearly; keep poll rates conservative.
+- **Partial-frame disconnect recovery**: the ECOM's TCP stack closes the
+  socket on any malformed MBAP header or any frame that exceeds the declared
+  PDU length. It does not resynchronize mid-stream. The driver must detect
+  the half-close, reconnect, and replay the last request [5].
+- **Keepalive**: the ECOM does **not** send TCP keepalives. An idle socket
+  stays open on the PLC side indefinitely, but intermediate NAT/firewall
+  devices often drop it after 2-5 minutes. Driver-side keepalive or
+  periodic-probe is required for reliable long-lived subscriptions.
+- **Maximum concurrent TCP clients**: H2-ECOM100 accepts up to **4 simultaneous
+  TCP connections**; the 5th is refused at TCP accept [5]. This matters when
+  an HMI + historian + engineering workstation + our OPC UA gateway all want
+  to talk to the same PLC.
+
+Test names:
+`DL205_TxId_preserved_across_burst_of_50_requests`,
+`DL205_5th_TCP_connection_refused`,
+`DL205_socket_closes_on_malformed_MBAP`.
+
+## References
+
+1. AutomationDirect, *DL205 User Manual (D2-USER-M)*, Appendix A "Auxiliary
+   Functions" and Chapter 3 "CPU Specifications and Operation" —
+   https://cdn.automationdirect.com/static/manuals/d2userm/d2userm.html
+2. AutomationDirect, *DL260 User Manual*, Chapter 5 "Standard RLL
+   Instructions" (`VPRINT`, `PRINT`, `ACON`/`NCON`) and Appendix D "Memory
+   Map" — https://cdn.automationdirect.com/static/manuals/d2userm/d2userm.html
+3. Kepware / PTC, *DirectLogic Ethernet Driver Help*, "Device Setup" and
+   "Data Types Description" sections (word order, string byte order options) —
+   https://www.kepware.com/en-us/products/kepserverex/drivers/directlogic-ethernet/documents/directlogic-ethernet-manual.pdf
+4. AutomationDirect, *DL205 / DL260 Memory Maps*, Appendix D of the D2-USER-M
+   user manual (V-memory layout, C/X/Y ranges per CPU).
+5. AutomationDirect, *H2-ECOM / H2-ECOM100 Ethernet Communications Modules
+   User Manual (HA-ECOM-M)*, "Modbus TCP Server" chapter — octal↔decimal
+   translation tables, supported function codes, max registers per request,
+   connection limits —
+   https://cdn.automationdirect.com/static/manuals/hxecomm/hxecomm.html
+6. Inductive Automation, *Ignition Modbus Driver — Address Mapping*, word
+   order options (ABCD/CDAB/BADC/DCBA) —
+   https://docs.inductiveautomation.com/docs/8.1/ignition-modules/opc-ua/drivers/modbus-v2
+7. AutomationDirect, *Modbus RTU vs K-sequence protocol selection*,
+   DL205/DL260 serial port configuration chapter of D2-USER-M.
+8. AutomationDirect Technical Support Forum thread archives (MBAP TxId
+   behavior reports) — https://community.automationdirect.com/ (search:
+   "ECOM100 transaction id"). _Unconfirmed_ operator reports only.

docs/v2/implementation/phase-6-1-resilience-and-observability.md

@@ -0,0 +1,151 @@
+# Phase 6.1 — Resilience & Observability Runtime
+
+> **Status**: **SHIPPED** 2026-04-19 — Streams A/B/C/D + E data layer merged to `v2` across PRs #78-82. Final exit-gate PR #83 turns the compliance script into real checks (all pass) and records this status update. One deferred piece: Stream E.2/E.3 SignalR hub + Blazor `/hosts` column refresh lands in a visual-compliance follow-up PR on the Phase 6.4 Admin UI branch.
+>
+> Baseline: 906 solution tests → post-Phase-6.1: 1042 passing (+136 net). One pre-existing Client.CLI Subscribe flake unchanged.
+>
+> **Branch**: `v2/phase-6-1-resilience-observability`
+> **Estimated duration**: 3 weeks
+> **Predecessor**: Phase 5 (drivers) — partial; S7 + OPC UA Client shipped, AB/TwinCAT/FOCAS paused
+> **Successor**: Phase 6.2 (Authorization runtime)
+
+## Phase Objective
+
+Land the cross-cutting runtime protections + operability features that `plan.md` + `driver-stability.md` specify by decision but that no driver-phase actually wires. End-state: every driver goes through the same Polly resilience layer, health endpoints render the live driver fleet, structured logs carry per-request correlation IDs, and the config substrate survives a central DB outage via a LiteDB local cache.
+
+Closes these gaps flagged in the 2026-04-19 audit:
+
+1. Polly v8 resilience pipelines wired to every `IDriver` capability (no-op per-driver today; Galaxy has a hand-rolled `CircuitBreaker` only).
+2. Tier A/B/C enforcement at runtime — `driver-stability.md` §2–4 and decisions #63–73 define memory watchdog, bounded queues, scheduled recycle, wedge detection; `MemoryWatchdog` exists only inside `Driver.Galaxy.Host`.
+3. Health endpoints (`/healthz`, `/readyz`) on `OtOpcUa.Server`.
+4. Structured Serilog with per-request correlation IDs (driver instance, OPC UA session, IPC call).
+5. LiteDB local cache + Polly retry + fallback on central-DB outage (decision #36).
+
+## Scope — What Changes
+
+| Concern | Change |
+|---------|--------|
+| `Core` → new `Core.Resilience` sub-namespace | Shared Polly pipeline builder (`DriverResiliencePipelines`). **Pipeline key = `(DriverInstanceId, HostName)`** so one dead PLC behind a multi-device driver doesn't open the breaker for healthy siblings (decision #35 per-device isolation). **Per-capability policy** — Read / HistoryRead / Discover / Probe / Alarm get retries; **Write does NOT** unless `[WriteIdempotent]` on the tag definition (decisions #44-45). |
+| Every capability-interface consumer in the server | Wrap `IReadable.ReadAsync`, `IWritable.WriteAsync`, `ITagDiscovery.DiscoverAsync`, `ISubscribable.SubscribeAsync/UnsubscribeAsync`, `IHostConnectivityProbe` probe loop, `IAlarmSource.SubscribeAlarmsAsync/AcknowledgeAsync`, `IHistoryProvider.ReadRawAsync/ReadProcessedAsync/ReadAtTimeAsync/ReadEventsAsync`. Composition: timeout → (retry when capability supports) → circuit breaker → bulkhead. |
+| `Core.Abstractions` → new `WriteIdempotentAttribute` | Marker on `ModbusTagDefinition` / `S7TagDefinition` / `OpcUaClientDriver` tag rows; opts that tag into auto-retry on Write. Absence = no retry, per spec. |
+| `Core` → new `Core.Stability` sub-namespace — **split** | Two separate subsystems: (a) **`MemoryTracking`** runs all tiers; captures baseline (median of first 5 min `GetMemoryFootprint` samples) + applies the hybrid rule `soft = max(multiplier × baseline, baseline + floor)`; soft breach logs + surfaces to Admin; never kills. (b) **`MemoryRecycle`** (Tier C only — requires out-of-process topology) handles hard-breach recycle via the Proxy-side supervisor. Tier A/B overrun escalates to Tier C promotion ticket, not auto-kill. |
+| `ScheduledRecycleScheduler` | Tier C only per decisions #73-74. Weekly/time-of-day recycle via Proxy supervisor. Tier A/B opt-in recycle lands in a future phase together with a Tier-C-escalation workflow. |
+| `WedgeDetector` | **Demand-aware**: flips a driver to Faulted only when `(hasPendingWork AND noProgressIn > threshold)`. `hasPendingWork` derives from non-zero Polly bulkhead depth OR ≥1 active MonitoredItem OR ≥1 queued historian read. Idle + subscription-only drivers stay Healthy. |
+| `DriverTypeRegistry` | Each driver type registers its `DriverTier` {A, B, C}. Tier C drivers must advertise their out-of-process topology; the registry enforces invariants (Tier C has a `Proxy` + `Host` pair). |
+| `Driver.Galaxy.Proxy/Supervisor/` | **Retains** existing `CircuitBreaker` + `Backoff` — they guard IPC respawn (decision #68), different concern from the per-call Polly layer. Only `HeartbeatMonitor` is referenced downstream (IPC liveness). |
+| `OtOpcUa.Server` → Minimal API endpoints on `http://+:4841` | `/healthz` = process alive + (config DB reachable OR `UsingStaleConfig=true`). `/readyz` = ANDed driver health; state-machine per `DriverState`: `Unknown`/`Initializing` → 503, `Healthy` → 200, `Degraded` → 200 + `{degradedDrivers: [...]}` in body, `Faulted` → 503. JSON body always reports per-instance detail. |
+| Serilog configuration | Centralize enrichers in `OtOpcUa.Server/Observability/LogContextEnricher.cs`. Every capability call runs inside a `LogContext.PushProperty` scope with {DriverInstanceId, DriverType, CapabilityName, CorrelationId (UA RequestHandle or internal GUID)}. Sink config stays rolling-file per CLAUDE.md; JSON sink added alongside plain-text (switchable via `Serilog:WriteJson` appsetting). |
+| `Configuration` project | Add `LiteDbConfigCache` adapter. **Generation-sealed snapshots**: `sp_PublishGeneration` writes `<cache-root>/<cluster>/<generationId>.db` as a read-only sealed file. Reads serve the last-known-sealed generation; mixed-generation reads are impossible. Write path bypasses cache + fails hard on DB outage. Pipeline: timeout (2 s) → retry (3×, jittered) → fallback-to-sealed-snapshot. |
+| `DriverHostStatus` vs. `DriverInstanceResilienceStatus` | New separate entity `DriverInstanceResilienceStatus { DriverInstanceId, HostName, LastCircuitBreakerOpenUtc, ConsecutiveFailures, CurrentBulkheadDepth, LastRecycleUtc, BaselineFootprintBytes }`. `DriverHostStatus` keeps per-host connectivity only; Admin `/hosts` joins both for display. |
+
+## Scope — What Does NOT Change
+
+| Item | Reason |
+|------|--------|
+| Driver wire protocols | Resilience is a server-side wrapper; individual drivers don't see Polly. Their existing retry logic (ModbusTcpTransport reconnect, SessionReconnectHandler) stays in place as inner layers. |
+| Config DB schema | LiteDB cache is a read-only mirror; no new central tables except `DriverHostStatus` column additions. |
+| OPC UA wire behavior visible to clients | Health endpoints live on a separate HTTP port (4841 by convention); the OPC UA server on 4840 is unaffected. |
+| The four 2026-04-13 Galaxy stability findings | Already closed in Phase 2. Phase 6.1 *generalises* the pattern, doesn't re-fix Galaxy. |
+| Driver-layer SafeHandle usage | Existing Galaxy `SafeMxAccessHandle` + Modbus `TcpClient` disposal stay — they're driver-internal, not part of the cross-cutting layer. |
+
+## Entry Gate Checklist
+
+- [ ] Phases 0–5 exit gates cleared (or explicitly deferred with task reference)
+- [ ] `driver-stability.md` §2–4 re-read; decisions #63–73 + #34–36 re-skimmed
+- [ ] Polly v8 NuGet available (`Microsoft.Extensions.Resilience` + `Polly.Core`) — verify package restore before task breakdown
+- [ ] LiteDB 5.x NuGet confirmed MIT + actively maintained
+- [ ] Existing drivers catalogued: Galaxy.Proxy, Modbus, S7, OpcUaClient — confirm test counts baseline so the resilience layer doesn't regress any
+- [ ] Serilog configuration inventory: locate every `Log.ForContext` call site that will need `LogContext` rewrap
+- [ ] Admin `/hosts` page's current `DriverHostStatus` consumption reviewed so the schema extensions don't break it
+
+## Task Breakdown
+
+### Stream A — Resilience layer (1 week)
+
+1. **A.1** Add `Polly.Core` + `Microsoft.Extensions.Resilience` to `Core`. Build `DriverResiliencePipelineBuilder` — key on `(DriverInstanceId, HostName)`; composes Timeout → (Retry when the capability allows it; skipped for Write unless `[WriteIdempotent]`) → CircuitBreaker → Bulkhead. Per-capability policy map documented in `DriverResilienceOptions.CapabilityPolicies`.
+2. **A.2** `DriverResilienceOptions` record bound from `DriverInstance.ResilienceConfig` JSON column (new nullable). **Per-tier × per-capability** defaults: Tier A (OpcUaClient, S7) Read 3 retries/2 s/5-failure-breaker, Write 0 retries/2 s/5-failure-breaker; Tier B (Modbus) Read 3/4 s/5, Write 0/4 s/5; Tier C (Galaxy) Read 1 retry/10 s/no-kill, Write 0/10 s/no-kill. Idempotent writes can opt into Read-shaped retry via the attribute.
+3. **A.3** `CapabilityInvoker<TCapability, TResult>` wraps every method on the capability interfaces (`IReadable.ReadAsync`, `IWritable.WriteAsync`, `ITagDiscovery.DiscoverAsync`, `ISubscribable.SubscribeAsync/UnsubscribeAsync`, `IHostConnectivityProbe` probe loop, `IAlarmSource.SubscribeAlarmsAsync/AcknowledgeAsync`, `IHistoryProvider.ReadRawAsync/ReadProcessedAsync/ReadAtTimeAsync/ReadEventsAsync`). Existing server-side dispatch routes through it.
+4. **A.4** **Retain** `Driver.Galaxy.Proxy/Supervisor/CircuitBreaker.cs` + `Backoff.cs` — they guard IPC process respawn (decision #68), orthogonal to the per-call Polly layer. Only `HeartbeatMonitor` is consumed outside the supervisor.
+5. **A.5** Unit tests: per-policy, per-composition. Negative integration tests: (a) Modbus FlakeyTransport fails 5× on Read, succeeds 6th — invoker surfaces success; (b) Modbus FlakeyTransport fails 1× on Write with `[WriteIdempotent]=false` — invoker surfaces failure without retry (no duplicate pulse); (c) Modbus FlakeyTransport fails 1× on Write with `[WriteIdempotent]=true` — invoker retries. Bench: no-op overhead < 1%.
+6. **A.6** `WriteIdempotentAttribute` in `Core.Abstractions`. Modbus/S7/OpcUaClient tag-definition records pick it up; invoker reads via reflection once at driver init.
+
+### Stream B — Tier A/B/C stability runtime — split into MemoryTracking + MemoryRecycle (1 week)
+
+1. **B.1** `Core.Abstractions` → `DriverTier` enum {A, B, C}. Extend `DriverTypeRegistry` to require `DriverTier` at registration. Existing driver types stamped (Galaxy = C, Modbus = B, S7 = B, OpcUaClient = A).
+2. **B.2** **`MemoryTracking`** (all tiers) lifted from `Driver.Galaxy.Host/MemoryWatchdog.cs`. Captures `BaselineFootprintBytes` as the median of first 5 min of `IDriver.GetMemoryFootprint()` samples post-`InitializeAsync`. Applies **decision #70 hybrid formula**: `soft = max(multiplier × baseline, baseline + floor)`; Tier A multiplier=3, floor=50 MB; Tier B multiplier=3, floor=100 MB; Tier C multiplier=2, floor=500 MB. Soft breach → log + `DriverInstanceResilienceStatus.CurrentFootprint` tick; never kills. Hard = 2 × soft.
+3. **B.3** **`MemoryRecycle`** (Tier C only per decisions #73-74). Hard-breach on a Tier C driver triggers `ScheduledRecycleScheduler.RequestRecycleNow(driverInstanceId)`; scheduler proxies to `Driver.Galaxy.Proxy/Supervisor/` which restarts the Host process. Tier A/B hard-breach logs a promotion-to-Tier-C recommendation; **never auto-kills** the in-process driver.
+4. **B.4** **`ScheduledRecycleScheduler`** per decision #67: Tier C driver instances opt-in to a weekly recycle at a configured cron. Tier A/B scheduled recycle deferred to a later phase paired with Tier-C escalation.
+5. **B.5** **`WedgeDetector`** demand-aware: `if (state==Healthy && hasPendingWork && noProgressIn > WedgeThreshold) → force ReinitializeAsync`. `hasPendingWork` = (bulkhead depth > 0) OR (active monitored items > 0) OR (queued historian-read count > 0). `WedgeThreshold` default 5 × PublishingInterval, min 60 s. Idle driver stays Healthy.
+6. **B.6** Tests: tracking unit tests drive synthetic allocation against a fake `GetMemoryFootprint`; recycle tests use a mock supervisor; wedge tests include the false-fault cases — idle subscriber, slow historian backfill, write-only burst.
+
+### Stream C — Health endpoints + structured logging (4 days)
+
+1. **C.1** `OtOpcUa.Server/Observability/HealthEndpoints.cs` — Minimal API on a second Kestrel binding (default `http://+:4841`). `/healthz` reports process uptime + config-DB reachability (or cache-warm). `/readyz` enumerates `DriverInstance` rows + reports each driver's `DriverHealth.State`; returns 503 if ANY driver is Faulted. JSON body per `docs/v2/acl-design.md` §"Operator Dashboards" shape.
+2. **C.2** `LogContextEnricher` installed at Serilog config time. Every driver-capability call site wraps its body in `using (LogContext.PushProperty("DriverInstanceId", id)) using (LogContext.PushProperty("CorrelationId", correlationId))`. Correlation IDs: reuse OPC UA `RequestHeader.RequestHandle` when in-flight; otherwise generate `Guid.NewGuid().ToString("N")[..12]`.
+3. **C.3** Add JSON-formatted Serilog sink alongside the existing rolling-file plain-text sink so SIEMs (Splunk, Datadog) can ingest without a regex parser. Sink switchable via `Serilog:WriteJson` appsetting.
+4. **C.4** Integration test: boot server, issue Modbus read, assert log line contains `DriverInstanceId` + `CorrelationId` structured fields.
+
+### Stream D — Config DB LiteDB fallback — generation-sealed snapshots (1 week)
+
+1. **D.1** `LiteDbConfigCache` adapter backed by **sealed generation snapshots**: each successful `sp_PublishGeneration` writes `<cache-root>/<clusterId>/<generationId>.db` as read-only after commit. The adapter maintains a `CurrentSealedGenerationId` pointer updated atomically on successful publish. Mixed-generation reads are **impossible** — every read served from the cache serves one coherent sealed generation.
+2. **D.2** Write-path queries (draft save, publish) bypass the cache entirely and fail hard on DB outage. Read-path queries (DriverInstance enumeration, LdapGroupRoleMapping, cluster + namespace metadata) go through the pipeline: timeout 2 s → retry 3× jittered → fallback to the current sealed snapshot.
+3. **D.3** `UsingStaleConfig` flag flips true when a read fell back to the sealed snapshot; cleared on the next successful DB round-trip. Surfaced on `/healthz` body and Admin `/hosts`.
+4. **D.4** Tests: (a) SQL-container kill mid-operation — read returns sealed snapshot, `UsingStaleConfig=true`, driver stays Healthy; (b) mixed-generation guard — attempt to serve partial generation by corrupting a snapshot file mid-read → adapter fails closed rather than serving mixed data; (c) first-boot-no-snapshot case — adapter refuses to start, driver fails `InitializeAsync` with a clear config-DB-required error.
+
+### Stream E — Admin `/hosts` page refresh (3 days)
+
+1. **E.1** Extend `DriverHostStatus` schema with Stream A resilience columns. Generate EF migration.
+2. **E.2** `Admin/FleetStatusHub` SignalR hub pushes `LastCircuitBreakerOpenUtc` + `CurrentBulkheadDepth` + `LastRecycleUtc` on change.
+3. **E.3** `/hosts` Blazor page renders new columns; red badge if `ConsecutiveFailures > breakerThreshold / 2`.
+
+## Compliance Checks (run at exit gate)
+
+- [ ] **Invoker coverage**: every method on `IReadable` / `IWritable` / `ITagDiscovery` / `ISubscribable` / `IHostConnectivityProbe` / `IAlarmSource` / `IHistoryProvider` in the server dispatch layer routes through `CapabilityInvoker`. Enforce via a Roslyn analyzer (error-level; warning-first is rejected — the compliance check is the gate).
+- [ ] **Write-retry guard**: writes without `[WriteIdempotent]` never get retried. Unit-test the invoker path asserts zero retry attempts.
+- [ ] **Pipeline isolation**: pipeline key is `(DriverInstanceId, HostName)`. Integration test with two Modbus hosts under one instance — failing host A does not open the breaker for host B.
+- [ ] **Tier registry**: every driver type registered in `DriverTypeRegistry` has a non-null `Tier`. Unit test walks the registry + asserts no gaps. Tier C registrations must declare their out-of-process topology.
+- [ ] **MemoryTracking never kills**: soft/hard breach tests on a Tier A/B driver log + surface without terminating the process.
+- [ ] **MemoryRecycle Tier C only**: hard breach on a Tier A driver never invokes the supervisor; on Tier C it does.
+- [ ] **Wedge demand-aware**: test suite includes idle-subscription-only, slow-historian-backfill, and write-only-burst cases — driver stays Healthy.
+- [ ] **Galaxy supervisor preserved**: `Driver.Galaxy.Proxy/Supervisor/CircuitBreaker.cs` + `Backoff.cs` still present + still invoked on Host crash.
+- [ ] **Health state machine**: `/healthz` + `/readyz` respond within 500 ms for every `DriverState`; state-machine table in this doc drives the test matrix.
+- [ ] **Structured log**: CI grep asserts at least one log line per capability call has `"DriverInstanceId"` + `"CorrelationId"` JSON fields.
+- [ ] **Generation-sealed cache**: integration tests cover (a) SQL-kill mid-operation serves last-sealed snapshot; (b) mixed-generation corruption fails closed; (c) first-boot no-snapshot + DB-down → `InitializeAsync` fails with clear error.
+- [ ] No regression in existing test suites — `dotnet test ZB.MOM.WW.OtOpcUa.slnx` count equal-or-greater than pre-Phase-6.1 baseline.
+
+## Risks and Mitigations
+
+| Risk | Likelihood | Impact | Mitigation |
+|------|:----------:|:------:|------------|
+| Polly pipeline adds per-request latency on hot path | Medium | Medium | Benchmark Stream A.5 before merging; 1 % overhead budget; inline hot path short-circuits when retry count = 0 |
+| LiteDB cache diverges from central DB | Medium | High | Stale-data banner in Admin UI; `UsingStaleConfig` flag surfaced on `/readyz`; cache refresh on every successful DB round-trip; 24-hour synthetic warning |
+| Tier watchdog false-positive-kills a legitimate batch load | Low | High | Soft/hard threshold split; soft only logs; hard triggers recycle; thresholds configurable per-instance |
+| Wedge detector races with slow-but-healthy drivers | Medium | High | Minimum 60 s threshold; detector only activates if driver claims `Healthy`; add circuit-breaker feedback so rapid oscillation trips instead of thrashing |
+| Roslyn analyzer breaks external driver authors | Low | Medium | Release analyzer as warning-level initially; upgrade to error in Phase 6.1+1 after one release cycle |
+
+## Completion Checklist
+
+- [ ] Stream A: Polly shared pipeline + per-tier defaults + driver-capability invoker + tests
+- [ ] Stream B: Tier registry + generalised watchdog + scheduled recycle + wedge detector
+- [ ] Stream C: `/healthz` + `/readyz` + structured logging + JSON Serilog sink
+- [ ] Stream D: LiteDB cache + Polly fallback in Configuration
+- [ ] Stream E: Admin `/hosts` page refresh
+- [ ] Cross-cutting: `phase-6-1-compliance.ps1` exits 0; full solution `dotnet test` passes; exit-gate doc recorded
+
+## Adversarial Review — 2026-04-19 (Codex, thread `019da489-e317-7aa1-ab1f-6335e0be2447`)
+
+Plan substantially rewritten before implementation to address these findings. Each entry: severity · verdict · adjustment.
+
+1. **Crit · ACCEPT** — Auto-retry collides with decisions #44/#45 (no auto-write-retry; opt-in via `WriteIdempotent` + CAS). Pipeline now **capability-specific**: Read/HistoryRead/Discover/Probe/Alarm-subscribe all get retries; **Write does not** unless the tag metadata carries `WriteIdempotent=true`. New `WriteIdempotentAttribute` surfaces on `ModbusTagDefinition` / `S7TagDefinition` / etc.
+2. **Crit · ACCEPT** — "One pipeline per driver instance" breaks decision #35's per-device isolation. **Change**: pipeline key is `(DriverInstanceId, HostName)` not just `DriverInstanceId`. One dead PLC behind a multi-device Modbus driver no longer opens the breaker for healthy siblings.
+3. **Crit · ACCEPT** — Memory watchdog + scheduled recycle at Tier A/B breaches decisions #73/#74 (process-kill protections are Tier-C-only). **Change**: Stream B splits into two — `MemoryTracking` (all tiers, soft/hard thresholds log + surface to Admin `/hosts`; never kills) and `MemoryRecycle` (Tier C only, requires out-of-process topology). Tier A/B overrun paths escalate to Tier C via a future PR, not auto-kill.
+4. **High · ACCEPT** — Removing Galaxy's hand-rolled `CircuitBreaker` drops decision #68 host-supervision crash-loop protection. **Change**: keep `Driver.Galaxy.Proxy/Supervisor/CircuitBreaker.cs` + `Backoff.cs` — they guard the IPC *process* re-spawn, not the per-call data path. Data-path Polly is an orthogonal layer.
+5. **High · ACCEPT** — Roslyn analyzer targeting `IDriver` misses the hot paths (`IReadable.ReadAsync`, `IWritable.WriteAsync`, `ISubscribable.SubscribeAsync` etc.). **Change**: analyzer rule now matches every method on the capability interfaces; compliance doc enumerates the full call-site list.
+6. **High · ACCEPT** — `/healthz` + `/readyz` under-specified for degraded-running. **Change**: add a state-matrix sub-section explicitly covering `Unknown` (pre-init: `/readyz` 503), `Initializing` (503), `Healthy` (200), `Degraded` (200 with JSON body flagging the degraded driver; `/readyz` is OR across drivers), `Faulted` (503), plus cached-config-serving (`/healthz` returns 200 + `UsingStaleConfig: true` in JSON body).
+7. **High · ACCEPT** — `WedgeDetector` based on "no successful Read" false-fires on write-only subscriptions + idle systems. **Change**: wedge criteria now `(hasPendingWork AND noProgressIn > threshold)` where `hasPendingWork` comes from the Polly bulkhead depth + active MonitoredItem count. Idle driver stays Healthy.
+8. **High · ACCEPT** — LiteDB cache serving mixed-generation reads breaks publish atomicity. **Change**: cache is snapshot-per-generation. Each published generation writes a sealed snapshot into `<cache-root>/<cluster>/<generationId>.db`; reads serve the last-known-sealed generation and never mix. Central DB outage during a *publish* means that publish fails (write path doesn't use cache); reads continue from the prior sealed snapshot.
+9. **Med · ACCEPT** — `DriverHostStatus` schema conflates per-host connectivity with per-driver-instance resilience counters. **Change**: new `DriverInstanceResilienceStatus` table separate from `DriverHostStatus`. Admin `/hosts` joins both for display.
+10. **Med · ACCEPT** — Compliance says analyzer-error; risks say analyzer-warning. **Change**: phase 6.1 ships at **error** level (this phase is the gate); warning-mode option removed.
+11. **Med · ACCEPT** — Hardcoded per-tier MB bands ignore decision #70's `max(multiplier × baseline, baseline + floor)` formula with observed-baseline capture. **Change**: watchdog captures baseline at post-init plateau (median of first 5 min GetMemoryFootprint samples) + applies the hybrid formula. Tier constants now encode the multiplier + floor, not raw MB.
+12. **Med · ACCEPT** — Tests mostly cover happy path. **Change**: Stream A.5 adds negative tests for duplicate-write-replay-under-timeout; Stream B.5 adds false-wedge-on-idle-subscription + false-wedge-on-slow-historic-backfill; Stream D.4 adds mixed-generation cache test + corrupt-first-boot cache test.
+

docs/v2/implementation/phase-6-2-authorization-runtime.md

@@ -0,0 +1,153 @@
+# Phase 6.2 — Authorization Runtime (ACL + LDAP grants)
+
+> **Status**: **SHIPPED (core)** 2026-04-19 — Streams A, B, C (foundation), D (data layer) merged to `v2` across PRs #84-87. Final exit-gate PR #88 turns the compliance stub into real checks (all pass, 2 deferred surfaces tracked).
+>
+> Deferred follow-ups (tracked separately):
+> - Stream C dispatch wiring on the 11 OPC UA operation surfaces (task #143).
+> - Stream D Admin UI — RoleGrantsTab, AclsTab Probe-this-permission, SignalR invalidation, draft-diff ACL section + visual-compliance reviewer signoff (task #144).
+>
+> Baseline pre-Phase-6.2: 1042 solution tests → post-Phase-6.2 core: 1097 passing (+55 net). One pre-existing Client.CLI Subscribe flake unchanged.
+>
+> **Branch**: `v2/phase-6-2-authorization-runtime`
+> **Estimated duration**: 2.5 weeks
+> **Predecessor**: Phase 6.1 (Resilience & Observability) — reuses the Polly pipeline for ACL-cache refresh retries
+> **Successor**: Phase 6.3 (Redundancy)
+
+## Phase Objective
+
+Wire ACL enforcement on every OPC UA Read / Write / Subscribe / Call path + LDAP group → admin role grants that the v2 plan specified but never ran. End-state: a user's effective permissions resolve through a per-session permission-trie over the 6-level `Cluster / Namespace / UnsArea / UnsLine / Equipment / Tag` hierarchy, cached per session, invalidated on generation-apply + LDAP group expiry.
+
+Closes these gaps:
+
+1. **Data-path ACL enforcement** — `NodeAcl` table + `NodePermissions` flags shipped; `NodeAclService.cs` present as a CRUD surface; no code consults ACLs at `Read`/`Write` time. OPC UA server answers everything to everyone.
+2. **`LdapGroupRoleMapping` for cluster-scoped admin grants** — decision #105 shipped as the *design*; admin roles are hardcoded (`FleetAdmin` / `ConfigEditor` / `ReadOnly`) with no cluster-scoping and no LDAP-to-grant table. Decision #105 explicitly lifts this from v2.1 into v2.0.
+3. **Explicit Deny pathway** — deferred to v2.1 (decision #129 note). Phase 6.2 ships *grants only*; `Deny` stays out.
+4. **Admin UI ACL grant editor** — `AclsTab.razor` exists but edits the now-unused `NodeAcl` table; needs to wire to the runtime evaluator + the new `LdapGroupRoleMapping` table.
+
+## Scope — What Changes
+
+**Architectural separation** (critical for correctness): `LdapGroupRoleMapping` is **control-plane only** — it maps LDAP groups to Admin UI roles (`FleetAdmin` / `ConfigEditor` / `ReadOnly`) and cluster scopes for Admin access. **It is NOT consulted by the OPC UA data-path evaluator.** The data-path evaluator reads `NodeAcl` rows joined directly against the session's **resolved LDAP group memberships**. The two concerns share zero runtime code path.
+
+| Concern | Change |
+|---------|--------|
+| `Configuration` project | New entity `LdapGroupRoleMapping { Id, LdapGroup, Role, ClusterId? (nullable = system-wide), IsSystemWide, GeneratedAtUtc }`. **Consumed only by Admin UI role routing.** Migration. Admin CRUD. |
+| `Core` → new `Core.Authorization` sub-namespace | `IPermissionEvaluator.Authorize(IEnumerable<Claim> identity, OpcUaOperation op, NodeId nodeId) → AuthorizationDecision`. `op` covers every OPC UA surface: Browse, Read, Write, HistoryRead, HistoryUpdate, CreateMonitoredItems, TransferSubscriptions, Call, Acknowledge, Confirm, Shelve. Result is tri-state (internal model distinguishes `Allow` / `NotGranted` / `Denied` + carries matched-grant provenance). Phase 6.2 only produces `Allow` + `NotGranted`; v2.1 Deny lands without API break. |
+| `PermissionTrieBuilder` | Builds trie from `NodeAcl` rows joined against **resolved LDAP group memberships**, keyed on 6-level scope hierarchy for Equipment namespaces. **SystemPlatform namespaces (Galaxy)** use a `FolderSegment` scope level between Namespace and Tag, populated from `Tag.FolderPath` segments, so folder subtree authorization works on Galaxy trees the same way UNS works on Equipment trees. Trie node carries `ScopeKind` enum. |
+| `PermissionTrieCache` + freshness | One trie per `(ClusterId, GenerationId)`. Invalidated on `sp_PublishGeneration` via in-process event bus AND generation-ID check on hot path — every authz call looks up `CurrentGenerationId` (Polly-wrapped, sub-second cache); a Backup that cached a stale generation detects the mismatch + forces re-load. **Redundancy-safe**. |
+| `UserAuthorizationState` freshness | Cached per session BUT bounded by `MembershipFreshnessInterval` (default **15 min**). Past that, the next hot-path authz call re-resolves LDAP group memberships via `LdapGroupService`. Failure to re-resolve (LDAP unreachable) → **fail-closed**: evaluator returns `NotGranted` for every call until memberships refresh successfully. Decoupled from Phase 6.1's availability-oriented 24h cache. |
+| `AuthCacheMaxStaleness` | Separate from Phase 6.1's `UsingStaleConfig` window. Default 5 min — beyond that, authz fails closed regardless of Phase 6.1 cache warmth. |
+| OPC UA server dispatch — all enforcement surfaces | `DriverNodeManager` wires evaluator on: **Browse + TranslateBrowsePathsToNodeIds** (ancestors implicitly visible if any descendant has a grant; denied ancestors filter from results), **Read** (per-attribute StatusCode `BadUserAccessDenied` in mixed-authorization batches; batch never poisons), **Write** (uses `NodePermissions.WriteOperate/Tune/Configure` based on driver `SecurityClassification`), **HistoryRead** (uses `NodePermissions.HistoryRead` — **distinct** flag, not Read), **HistoryUpdate** (`NodePermissions.HistoryUpdate`), **CreateMonitoredItems** (per-`MonitoredItemCreateResult` denial), **TransferSubscriptions** (re-evaluates items on transfer), **Call** (`NodePermissions.MethodCall`), **Acknowledge/Confirm/Shelve** (per-alarm flags). |
+| Subscription re-authorization | Each `MonitoredItem` is stamped with `(AuthGenerationId, MembershipVersion)` at create time. On every Publish, items with a stamp mismatching the session's current `(AuthGenerationId, MembershipVersion)` get re-evaluated; revoked items drop to `BadUserAccessDenied` within one publish cycle. Unchanged items stay fast-path. |
+| `LdapAuthService` | On cookie-auth success: resolves LDAP group memberships; loads matching `LdapGroupRoleMapping` rows → role claims + cluster-scope claims (control plane); stores `UserAuthorizationState.LdapGroups` on the session for the data-plane evaluator. |
+| `ValidatedNodeAclAuthoringService` | Replaces CRUD-only `NodeAclService` for authoring. Validates (LDAP group exists, scope exists in current or target draft, grant shape is valid, no duplicate `(LdapGroup, Scope)` pair). Admin UI writes only through it. |
+| Admin UI `AclsTab.razor` | Writes via `ValidatedNodeAclAuthoringService`. Adds Probe-This-Permission row that runs the real evaluator against a chosen `(LDAP group, node, operation)` and shows `Allow` / `NotGranted` + matched-grant provenance. |
+| Admin UI new tab `RoleGrantsTab.razor` | CRUD over `LdapGroupRoleMapping`. Per-cluster + system-wide grants. FleetAdmin only. **Documentation explicit** that this only affects Admin UI access, not OPC UA data plane. |
+| Audit log | Every Grant/Revoke/Publish on `LdapGroupRoleMapping` or `NodeAcl` writes an `AuditLog` row with old/new state + user. |
+
+## Scope — What Does NOT Change
+
+| Item | Reason |
+|------|--------|
+| OPC UA authn | Already done (PR 19 LDAP user identity + Basic256Sha256 profile). Phase 6.2 is authorization only. |
+| Explicit `Deny` grants | Decision #129 note explicitly defers to v2.1. Default-deny + additive grants only. |
+| Driver-side `SecurityClassification` metadata | Drivers keep reporting `Operate` / `ViewOnly` / etc. — the evaluator uses them as *part* of the decision but doesn't replace them. |
+| Galaxy namespace (SystemPlatform kind) | UNS levels don't apply; evaluator treats Galaxy nodes as `Cluster → Namespace → Tag` (skip UnsArea/UnsLine/Equipment). |
+
+## Entry Gate Checklist
+
+- [ ] Phase 6.1 merged (reuse `Core.Resilience` Polly pipeline for the ACL cache-refresh retries)
+- [ ] `acl-design.md` re-read in full
+- [ ] Decision log #105, #129, corrections-doc B1 re-skimmed
+- [ ] Existing `NodeAcl` + `NodePermissions` flag enum audited; confirm bitmask flags match `acl-design.md` table
+- [ ] Existing `LdapAuthService` group-resolution code path traced end-to-end — confirm it already queries group memberships (we only need the caller to consume the result)
+- [ ] Test DB scenarios catalogued: two clusters, three LDAP groups per cluster, mixed grant shapes; captured as seed-data fixtures
+
+## Task Breakdown
+
+### Stream A — `LdapGroupRoleMapping` table + migration (3 days)
+
+1. **A.1** Entity + EF Core migration. Columns per §Scope table. Unique constraint on `(LdapGroup, ClusterId)` with null-tolerant comparer for the system-wide case. Index on `LdapGroup` for the hot-path lookup on auth.
+2. **A.2** `ILdapGroupRoleMappingService` CRUD. Wrap in the Phase 6.1 Polly pipeline (timeout → retry → fallback-to-cache).
+3. **A.3** Seed-data migration: preserve the current hardcoded `FleetAdmin` / `ConfigEditor` / `ReadOnly` mappings by seeding rows for the existing LDAP groups the dev box uses (`cn=fleet-admin,…`, `cn=config-editor,…`, `cn=read-only,…`). Op no-op migration for existing deployments.
+
+### Stream B — Permission-trie evaluator (1 week)
+
+1. **B.1** `IPermissionEvaluator.Authorize(IEnumerable<Claim> identity, NodeId nodeId, NodePermissions needed)` — returns `bool`. Phase 6.2 returns only `true` / `false`; v2.1 can widen to `Allow`/`Deny`/`Indeterminate` if Deny lands.
+2. **B.2** `PermissionTrieBuilder` builds the trie from `NodeAcl` + `LdapGroupRoleMapping` joined to the current generation's `UnsArea` + `UnsLine` + `Equipment` + `Tag` tables. One trie per `(ClusterId, GenerationId)` so rollback doesn't smear permissions across generations.
+3. **B.3** Trie node structure: `{ Level: enum, ScopeId: Guid, AllowedPermissions: NodePermissions, ChildrenByLevel: Dictionary<Guid, TrieNode> }`. Evaluation walks from Cluster → Namespace → UnsArea → UnsLine → Equipment → Tag, ORing allowed permissions at each level. Additive semantics: a grant at Cluster level cascades to every descendant tag.
+4. **B.4** `PermissionTrieCache` service scoped as singleton; exposes `GetTrieAsync(ClusterId, ct)` that returns the current-generation trie. Invalidated on `sp_PublishGeneration` via an in-process event bus; also on TTL expiry (24 h safety net).
+5. **B.5** Per-session cached evaluator: OPC UA Session authentication produces `UserAuthorizationState { ClusterId, LdapGroups[], Trie }`; cached on the session until session close or generation-apply.
+6. **B.6** Unit tests: trie-walk theory covering (a) Cluster-level grant cascades to tags, (b) Equipment-level grant doesn't leak to sibling Equipment, (c) multi-group union, (d) no-grant → deny, (e) Galaxy nodes skip UnsArea/UnsLine levels.
+
+### Stream C — OPC UA server dispatch wiring (6 days, widened)
+
+1. **C.1** `DriverNodeManager.Read` — evaluator consulted per `ReadValueId` with `OpcUaOperation.Read`. Denied attributes get `BadUserAccessDenied` per-item; batch never poisons. Integration test covers mixed-authorization batch (3 authorized + 2 denied → 3 Good values + 2 Bad StatusCodes, request completes).
+2. **C.2** `DriverNodeManager.Write` — evaluator chooses `NodePermissions.WriteOperate` / `WriteTune` / `WriteConfigure` based on the driver-reported `SecurityClassification`.
+3. **C.3** `DriverNodeManager.HistoryRead` — **uses `NodePermissions.HistoryRead`**, which is a **distinct flag** from Read. Test: user with Read but not HistoryRead can read live values but gets `BadUserAccessDenied` on `HistoryRead`.
+4. **C.4** `DriverNodeManager.HistoryUpdate` — uses `NodePermissions.HistoryUpdate`.
+5. **C.5** `DriverNodeManager.CreateMonitoredItems` — per-`MonitoredItemCreateResult` denial in mixed-authorization batch; partial success path per OPC UA Part 4. Each created item stamped `(AuthGenerationId, MembershipVersion)`.
+6. **C.6** `DriverNodeManager.TransferSubscriptions` — on reconnect, re-evaluate every transferred `MonitoredItem` against the session's current auth state. Stale-stamp items drop to `BadUserAccessDenied`.
+7. **C.7** **Browse + TranslateBrowsePathsToNodeIds** — evaluator called with `OpcUaOperation.Browse`. Ancestor visibility implied when any descendant has a grant (per `acl-design.md` §Browse). Denied ancestors filter from browse results — the UA browser sees a hierarchy truncated at the denied ancestor rather than an inconsistent child-without-parent view.
+8. **C.8** `DriverNodeManager.Call` — `NodePermissions.MethodCall`.
+9. **C.9** Alarm actions (Acknowledge / Confirm / Shelve) — per-alarm `NodePermissions.AlarmAck` / `AlarmConfirm` / `AlarmShelve`.
+10. **C.10** Publish path — for each `MonitoredItem` with a mismatched `(AuthGenerationId, MembershipVersion)` stamp, re-evaluate. Unchanged items stay fast-path; changes happen at next publish cycle.
+11. **C.11** Integration tests: three-user seed with different memberships; matrix covers every operation in §Scope. Mixed-batch tests for Read + CreateMonitoredItems.
+
+### Stream D — Admin UI refresh (4 days)
+
+1. **D.1** `RoleGrantsTab.razor` — FleetAdmin-gated CRUD on `LdapGroupRoleMapping`. Per-cluster dropdown + system-wide checkbox. Validation: LDAP group must exist in the dev LDAP (GLAuth) before saving — best-effort probe with graceful degradation.
+2. **D.2** `AclsTab.razor` rewrites its edit path to write through the new `NodeAclService`. Adds a "Probe this permission" row: choose `(LDAP group, node, action)` → shows Allow / Deny + the reason (which grant matched).
+3. **D.3** Draft-generation diff viewer now includes an ACL section: "X grants added, Y grants removed, Z grants changed."
+4. **D.4** SignalR notification: `PermissionTrieCache` invalidation on `sp_PublishGeneration` pushes to Admin UI so operators see "this clusters permissions were just updated" within 2 s.
+
+## Compliance Checks (run at exit gate)
+
+- [ ] **Control/data-plane separation**: `LdapGroupRoleMapping` consumed only by Admin UI; the data-path evaluator has zero references to it. Enforced via a project-reference audit (Admin project references the mapping service; `Core.Authorization` does not).
+- [ ] **Every operation wired**: Browse, Read, Write, HistoryRead, HistoryUpdate, CreateMonitoredItems, TransferSubscriptions, Call, Acknowledge, Confirm, Shelve all consult the evaluator. Integration test matrix covers every operation × allow/deny.
+- [ ] **HistoryRead uses its own flag**: test "user with Read + no HistoryRead gets `BadUserAccessDenied` on HistoryRead".
+- [ ] **Mixed-batch semantics**: Read of 5 nodes (3 allowed + 2 denied) returns 3 Good + 2 `BadUserAccessDenied` per-`ReadValueId`; CreateMonitoredItems equivalent.
+- [ ] **Browse ancestor visibility**: user with a grant only on a deep equipment node can browse the path to it (ancestors implied); denied ancestors filter from browse results otherwise.
+- [ ] **Galaxy FolderSegment coverage**: a grant on a Galaxy folder subtree cascades to its tags; sibling folders are unaffected. Trie test covers this.
+- [ ] **Subscription re-authorization**: integration test — create item, revoke grant via draft+publish, next publish cycle the item returns `BadUserAccessDenied` (not silently still-notifying).
+- [ ] **Membership freshness**: test — 15 min MembershipFreshnessInterval elapses on a long-lived session + LDAP now unreachable → authz fails closed on the next request until LDAP recovers.
+- [ ] **Auth cache fail-closed**: test — Phase 6.1 cache serves stale config for 6 min; authz evaluator refuses all calls after 5 min regardless.
+- [ ] **Trie invariants**: `PermissionTrieBuilder` is idempotent (build twice with identical inputs → equal tries).
+- [ ] **Additive grants + cluster isolation**: cluster-grant cascades; cross-cluster leakage impossible.
+- [ ] **Redundancy-safe invalidation**: integration test — two nodes, a publish on one, authorize a request on the other before in-process event propagates → generation-mismatch forces re-load, no stale decision.
+- [ ] **Authoring validation**: `AclsTab` cannot save a `(LdapGroup, Scope)` pair that already exists in the draft; operator sees the validation error pre-save.
+- [ ] **AuthorizationDecision shape stability**: API surface exposes `Allow` + `NotGranted` only; `Denied` variant exists in the type but is never produced; v2.1 can add Deny without API break.
+- [ ] No regression in driver test counts.
+
+## Risks and Mitigations
+
+| Risk | Likelihood | Impact | Mitigation |
+|------|:----------:|:------:|------------|
+| ACL evaluator latency on per-read hot path | Medium | High | Trie lookup is O(depth) = O(6); session-cached UserAuthorizationState avoids per-Read trie rebuild; benchmark in Stream B.6 |
+| Trie cache stale after a rollback | Medium | High | `sp_PublishGeneration` + `sp_RollbackGeneration` both emit the invalidation event; trie keyed on `(ClusterId, GenerationId)` so rollback fetches the prior trie cleanly |
+| `BadUserAccessDenied` returns expose sensitive browse-name metadata | Low | Medium | Server returns only the status code + NodeId; no message leak per OPC UA Part 4 §7.34 guidance |
+| LdapGroupRoleMapping migration breaks existing deployments | Low | High | Seed-migration preserves the hardcoded groups' effective grants verbatim; smoke test exercises the post-migration fleet admin login |
+| Deny semantics accidentally ship (would break `acl-design.md` defer) | Low | Medium | `IPermissionEvaluator.Authorize` returns `bool` (not tri-state) through Phase 6.2; widening to `Allow`/`Deny`/`Indeterminate` is a v2.1 ticket |
+
+## Completion Checklist
+
+- [ ] Stream A: `LdapGroupRoleMapping` entity + migration + CRUD + seed
+- [ ] Stream B: evaluator + trie builder + cache + per-session state + unit tests
+- [ ] Stream C: OPC UA dispatch wiring on Read/Write/HistoryRead/Subscribe/Alarm paths
+- [ ] Stream D: Admin UI `RoleGrantsTab` + `AclsTab` refresh + SignalR invalidation
+- [ ] `phase-6-2-compliance.ps1` exits 0; exit-gate doc recorded
+
+## Adversarial Review — 2026-04-19 (Codex, thread `019da48d-0d2b-7171-aed2-fc05f1f39ca3`)
+
+1. **Crit · ACCEPT** — Trie must not conflate `LdapGroupRoleMapping` (control-plane admin claims per decision #105) with data-plane ACLs (decision #129). **Change**: `LdapGroupRoleMapping` is consumed only by the Admin UI role router. Data-plane trie reads `NodeAcl` rows joined against the session's **resolved LDAP groups**, never admin roles. Stream B.2 updated.
+2. **Crit · ACCEPT** — Cached `UserAuthorizationState` survives LDAP group changes because memberships only refresh at cookie-auth. Change: add `MembershipFreshnessInterval` (default 15 min); past that, next hot-path authz call forces group re-resolution (fail-closed if LDAP unreachable). Session-close-wins on config-rollback.
+3. **High · ACCEPT** — Node-local invalidation doesn't extend across redundant pair. **Change**: trie keyed on `(ClusterId, GenerationId)`; hot-path authz looks up `CurrentGenerationId` from the shared config DB (Polly-wrapped + sub-second cache). A Backup that read stale generation gets a mismatched trie → forces re-load. Implementation note added to Stream B.4.
+4. **High · ACCEPT** — Browse enforcement missing. **Change**: new Stream C.7 (`Browse + TranslateBrowsePathsToNodeIds` enforcement). Ancestor visibility implied when any descendant has a grant; denied ancestors filter from browse results per `acl-design.md` §Browse.
+5. **High · ACCEPT** — `HistoryRead` should use `NodePermissions.HistoryRead` bit, not `Read`. **Change**: Stream C.3 revised; separate unit test asserts `Read+no-HistoryRead` denies HistoryRead while allowing current-value reads.
+6. **High · ACCEPT** — Galaxy shallow-path (Cluster→Namespace→Tag) loses folder hierarchy authorization. **Change**: SystemPlatform namespaces use a `FolderSegment` scope-level between Namespace and Tag, populated from `Tag.FolderPath`; UNS-kind namespaces keep the 6-level hierarchy. Trie supports both via `ScopeKind` on each node.
+7. **High · ACCEPT** — Subscription re-authorization policy unresolved between create-time-only (fast, wrong on revoke) and per-publish (slow). **Change**: stamp each `MonitoredItem` with `(AuthGenerationId, MembershipVersion)`; re-evaluate on Publish only when either version changed. Revoked items drop to `BadUserAccessDenied` within one publish cycle.
+8. **Med · ACCEPT** — Mixed-authorization batch `Read` / `CreateMonitoredItems` service-result semantics underspecified. **Change**: Stream C.6 explicitly tests per-`ReadValueId` + per-`MonitoredItemCreateResult` denial in mixed batches; batch never collapses to a coarse failure.
+9. **Med · ACCEPT** — Missing surfaces: `Method.Call`, `HistoryUpdate`, event filter on subscriptions, subscription-transfer on reconnect, alarm-ack. **Change**: scope expanded — every OPC UA authorization surface enumerated in Stream C: Read, Write, HistoryRead, HistoryUpdate, CreateMonitoredItems, TransferSubscriptions, Call, Acknowledge/Confirm/Shelve, Browse, TranslateBrowsePathsToNodeIds.
+10. **Med · ACCEPT** — `bool` evaluator bakes in grant-only semantics; collides with v2.1 Deny. **Change**: internal model uses `AuthorizationDecision { Allow | NotGranted | Denied, IReadOnlyList<MatchedGrant> Provenance }`. Phase 6.2 maps `Denied` → never produced; UI + audit log use the full record so v2.1 Deny lands without API break.
+11. **Med · ACCEPT** — 6.1 cache fallback is availability-oriented; applying it to auth is correctness-dangerous. **Change**: auth-specific staleness budget `AuthCacheMaxStaleness` (default 5 min, not 24 h). Past that, hot-path evaluator fails closed on cached reads; all authorization calls return `NotGranted` until fresh data lands. Documented in risks + compliance.
+12. **Low · ACCEPT** — Existing `NodeAclService` is raw CRUD. **Change**: new `ValidatedNodeAclAuthoringService` enforces scope-uniqueness + draft/publish invariants + rejects invalid (LDAP group, scope) pairs; Admin UI writes through it only. Stream D.2 adjusted.
+

docs/v2/implementation/phase-6-3-redundancy-runtime.md

@@ -0,0 +1,159 @@
+# Phase 6.3 — Redundancy Runtime
+
+> **Status**: **SHIPPED (core)** 2026-04-19 — Streams B (ServiceLevelCalculator + RecoveryStateManager) and D core (ApplyLeaseRegistry) merged to `v2` in PR #89. Exit gate in PR #90.
+>
+> Deferred follow-ups (tracked separately):
+> - Stream A — RedundancyCoordinator cluster-topology loader (task #145).
+> - Stream C — OPC UA node wiring: ServiceLevel + ServerUriArray + RedundancySupport (task #147).
+> - Stream E — Admin UI RedundancyTab + OpenTelemetry metrics + SignalR (task #149).
+> - Stream F — client interop matrix + Galaxy MXAccess failover test (task #150).
+> - sp_PublishGeneration pre-publish validator rejecting unsupported RedundancyMode values (task #148 part 2 — SQL-side).
+>
+> Baseline pre-Phase-6.3: 1097 solution tests → post-Phase-6.3 core: 1137 passing (+40 net).
+>
+> **Branch**: `v2/phase-6-3-redundancy-runtime`
+> **Estimated duration**: 2 weeks
+> **Predecessor**: Phase 6.2 (Authorization) — reuses the Phase 6.1 health endpoints for cluster-peer probing
+> **Successor**: Phase 6.4 (Admin UI completion)
+
+## Phase Objective
+
+Land the non-transparent redundancy protocol end-to-end: two `OtOpcUa.Server` instances in a `ServerCluster` each expose a live `ServiceLevel` node whose value reflects that instance's suitability to serve traffic, advertise each other via `ServerUriArray`, and transition role (Primary ↔ Backup) based on health + operator intent.
+
+Closes these gaps:
+
+1. **Dynamic `ServiceLevel`** — OPC UA Part 5 §6.3.34 specifies a Byte (0..255) that clients poll to pick the healthiest server. Our server publishes it as a static value today.
+2. **`ServerUriArray` broadcast** — Part 4 specifies that every node in a redundant pair should advertise its peers' ApplicationUris. Currently advertises only its own.
+3. **Primary / Backup role coordination** — entities carry `RedundancyRole` but the runtime doesn't read it; no peer health probing; no role-transfer on primary failure.
+4. **Mid-apply dip** — decision-level expectation that a server mid-generation-apply should report a *lower* ServiceLevel so clients cut over to the peer during the apply window. Not implemented.
+
+## Scope — What Changes
+
+| Concern | Change |
+|---------|--------|
+| `OtOpcUa.Server` → new `Server.Redundancy` sub-namespace | `RedundancyCoordinator` singleton. Resolves the current node's `ClusterNode` row at startup, loads peers, runs **two-layer peer health probe**: (a) `/healthz` every 2 s as the fast-fail (inherits Phase 6.1 semantics — HTTP + DB/cache healthy); (b) `UaHealthProbe` every 10 s — opens a lightweight OPC UA client session to the peer + reads its `ServiceLevel` node + verifies endpoint serves data. Authority decisions use UaHealthProbe; `/healthz` is used only to avoid wasting UA probes when peer is obviously down. |
+| Publish-generation fencing | Topology + role decisions are stamped with a monotonic `ConfigGenerationId` from the shared config DB. Coordinator re-reads topology via CAS on `(ClusterId, ExpectedGeneration)` → new row; peers reject state propagated from a lower generation. Prevents split-publish races. |
+| `InvalidTopology` runtime state | If both nodes detect >1 Primary AFTER startup (config-DB drift during a publish), both self-demote to ServiceLevel 2 until convergence. Neither node serves authoritatively; clients pick the healthier alternative or reconnect later. |
+| OPC UA server root | `ServiceLevel` variable node becomes a `BaseDataVariable` whose value updates on `RedundancyCoordinator` state change. `ServerUriArray` array variable includes **self + peers** in stable deterministic ordering (decision per OPC UA Part 4 §6.6.2.2). `RedundancySupport` stays static (set from `RedundancyMode` at startup); `Transparent` mode validated pre-publish, not rejected at startup. |
+| `RedundancyCoordinator` computation | **8-state ServiceLevel matrix** — avoids OPC UA Part 5 §6.3.34 collision (`0=Maintenance`, `1=NoData`). Operator-declared maintenance only = **0**. Unreachable / Faulted = **1**. In-range operational states occupy **2..255**: Authoritative-Primary = **255**; Isolated-Primary (peer unreachable, self serving) = **230**; Primary-Mid-Apply = **200**; Recovering-Primary (post-fault, dwell not met) = **180**; Authoritative-Backup = **100**; Isolated-Backup (primary unreachable, "take over if asked") = **80**; Backup-Mid-Apply = **50**; Recovering-Backup = **30**; `InvalidTopology` (runtime detects >1 Primary) = **2** (detected-inconsistency band — below normal operation). Full matrix documented in `docs/Redundancy.md` update. |
+| Role transition | Split-brain avoidance: role is *declared* in the shared config DB (`ClusterNode.RedundancyRole`), not elected at runtime. An operator flips the row (or a failover script does). Coordinator only reads; never writes. |
+| `sp_PublishGeneration` hook | Uses named **apply leases** keyed to `(ConfigGenerationId, PublishRequestId)`. `await using var lease = coordinator.BeginApplyLease(...)`. Disposal on any exit path (success, exception, cancellation) decrements. Watchdog auto-closes any lease older than `ApplyMaxDuration` (default 10 min) → ServiceLevel can't stick at mid-apply. Pre-publish validator rejects unsupported `RedundancyMode` (e.g. `Transparent`) with a clear error so runtime never sees an invalid state. |
+| Admin UI `/cluster/{id}` page | New `RedundancyTab.razor` — shows current node's role + ServiceLevel + peer reachability. FleetAdmin can trigger a role-swap by editing `ClusterNode.RedundancyRole` + publishing a draft. |
+| Metrics | New OpenTelemetry metrics: `ot_opcua_service_level{cluster,node}`, `ot_opcua_peer_reachable{cluster,node,peer}`, `ot_opcua_apply_in_progress{cluster,node}`. Sink via Phase 6.1 observability layer. |
+
+## Scope — What Does NOT Change
+
+| Item | Reason |
+|------|--------|
+| OPC UA authn / authz | Phases 6.2 + prior. Redundancy is orthogonal. |
+| Driver layer | Drivers aren't redundancy-aware; they run on each node independently against the same equipment. The server layer handles the ServiceLevel story. |
+| Automatic failover / election | Explicitly out of scope. Non-transparent = client picks which server to use via ServiceLevel + ServerUriArray. We do NOT ship consensus, leader election, or automatic promotion. Operator-driven failover is the v2.0 model per decision #79–85. |
+| Transparent redundancy (`RedundancySupport=Transparent`) | Not supported. If the operator asks for it the server fails startup with a clear error. |
+| Historian redundancy | Galaxy Historian's own redundancy (two historians on two CPUs) is out of scope. The Galaxy driver talks to whichever historian is reachable from its node. |
+
+## Entry Gate Checklist
+
+- [ ] Phase 6.1 merged (uses `/healthz` for peer probing)
+- [ ] `CLAUDE.md` §Redundancy + `docs/Redundancy.md` re-read
+- [ ] Decisions #79–85 re-skimmed
+- [ ] `ServerCluster`/`ClusterNode`/`RedundancyRole`/`RedundancyMode` entities + existing migration reviewed
+- [ ] OPC UA Part 4 §Redundancy + Part 5 §6.3.34 (ServiceLevel) re-skimmed
+- [ ] Dev box has two OtOpcUa.Server instances configured against the same cluster — one designated Primary, one Backup — for integration testing
+
+## Task Breakdown
+
+### Stream A — Cluster topology loader (3 days)
+
+1. **A.1** `RedundancyCoordinator` startup path: reads `ClusterNode` row for the current node (identified by `appsettings.json` `Cluster:NodeId`), reads the cluster's peer list, validates invariants (no duplicate `ApplicationUri`, at most one `Primary` per cluster if `RedundancyMode.WarmActive`, at most two nodes total in v2.0 per decision #83).
+2. **A.2** Topology subscription — coordinator re-reads on `sp_PublishGeneration` confirmation so an operator role-swap takes effect after publish (no process restart needed).
+3. **A.3** Tests: two-node cluster seed, one-node cluster seed (degenerate), duplicate-uri rejection.
+
+### Stream B — Peer health probing + ServiceLevel computation (6 days, widened)
+
+1. **B.1** `PeerHttpProbeLoop` per peer at 2 s — calls peer's `/healthz`, 1 s timeout, exponential backoff on sustained failure. Used as fast-fail.
+2. **B.2** `PeerUaProbeLoop` per peer at 10 s — opens an OPC UA client session to the peer (reuses Phase 5 `Driver.OpcUaClient` stack), reads peer's `ServiceLevel` node + verifies endpoint serves data. Short-circuit: if HTTP probe is failing, skip UA probe (no wasted sessions).
+3. **B.3** `ServiceLevelCalculator.Compute(role, selfHealth, peerHttpHealthy, peerUaHealthy, applyInProgress, recoveryDwellMet, topologyValid) → byte`. 8-state matrix per §Scope. `topologyValid=false` forces InvalidTopology = 2 regardless of other inputs.
+4. **B.4** `RecoveryStateManager`: after a `Faulted → Healthy` transition, hold driver in `Recovering` band (180 Primary / 30 Backup) for `RecoveryDwellTime` (default 60 s) AND require one positive publish witness (successful `Read` on a reference node) before entering Authoritative band.
+5. **B.5** Calculator reacts to inputs via `IObserver` so changes immediately push to the OPC UA `ServiceLevel` node.
+6. **B.6** Tests: **64-case matrix** covering role × self-health × peer-http × peer-ua × apply × recovery × topology. Specific cases flagged: Primary-with-unreachable-peer-serves-at-230 (authority retained); Backup-with-unreachable-primary-escalates-to-80 (not auto-promote); InvalidTopology demotes both nodes; Recovering dwell + publish-witness blocks premature return to 255.
+
+### Stream C — OPC UA node wiring (3 days)
+
+1. **C.1** `ServiceLevel` variable node created under `ServerStatus` at server startup. Type `Byte`, AccessLevel = CurrentRead only. Subscribe to `ServiceLevelCalculator` observable; push updates via `DataChangeNotification`.
+2. **C.2** `ServerUriArray` variable node under `ServerCapabilities`. Array of `String`, **includes self + peers** with deterministic ordering (self first). Updates on topology change. Compliance test asserts local-plus-peer membership.
+3. **C.3** `RedundancySupport` variable — static at startup from `RedundancyMode`. Values: `None`, `Cold`, `Warm`, `WarmActive`, `Hot`. Unsupported values (`Transparent`, `HotAndMirrored`) are rejected **pre-publish** by validator — runtime never sees them.
+4. **C.4** Client.CLI cutover test: connect to primary, read `ServiceLevel` → 255; pause primary apply → 200; unreachable peer while apply in progress → 200 (apply dominates peer-unreachable per matrix); client sees peer via `ServerUriArray`; fail primary → client reconnects to peer at 80 (isolated-backup band).
+
+### Stream D — Apply-window integration (3 days)
+
+1. **D.1** `sp_PublishGeneration` caller wraps the apply in `await using var lease = coordinator.BeginApplyLease(generationId, publishRequestId)`. Lease keyed to `(ConfigGenerationId, PublishRequestId)` so concurrent publishes stay isolated. Disposal decrements on every exit path.
+2. **D.2** `ApplyLeaseWatchdog` auto-closes leases older than `ApplyMaxDuration` (default 10 min) so a crashed publisher can't pin the node at mid-apply.
+3. **D.3** Pre-publish validator in `sp_PublishGeneration` rejects unsupported `RedundancyMode` values (`Transparent`, `HotAndMirrored`) with a clear error message — runtime never sees an invalid mode.
+4. **D.4** Tests: (a) mid-apply client subscribes → sees ServiceLevel drop → sees restore; (b) lease leak via `ThreadAbort` / cancellation → watchdog closes; (c) publish rejected for `Transparent` → operator-actionable error.
+
+### Stream E — Admin UI + metrics (3 days)
+
+1. **E.1** `RedundancyTab.razor` under `/cluster/{id}/redundancy`. Shows each node's role, current ServiceLevel (with band label per 8-state matrix), peer reachability (HTTP + UA probe separately), last apply timestamp. Role-swap button posts a draft edit on `ClusterNode.RedundancyRole`; publish applies.
+2. **E.2** OpenTelemetry meter export: `ot_opcua_service_level{cluster,node}` gauge + `ot_opcua_peer_reachable{cluster,node,peer,kind=http|ua}` + `ot_opcua_apply_in_progress{cluster,node}` + `ot_opcua_topology_valid{cluster}`. Sink via Phase 6.1 observability.
+3. **E.3** SignalR push: `FleetStatusHub` broadcasts ServiceLevel changes so the Admin UI updates within ~1 s of the coordinator observing a peer flip.
+
+### Stream F — Client-interoperability matrix (3 days, new)
+
+1. **F.1** Validate ServiceLevel-driven cutover against **Ignition 8.1 + 8.3**, **Kepware KEPServerEX 6.x**, **Aveva OI Gateway 2020R2 + 2023R1**. For each: configure the client with both endpoints, verify it honors `ServiceLevel` + `ServerUriArray` during primary failover.
+2. **F.2** Clients that don't honour the standards (doc field — may include Kepware and OI Gateway per Codex review) get an explicit compatibility-matrix entry: "requires manual backup-endpoint config / vendor-specific redundancy primitives". Documented in `docs/Redundancy.md`.
+3. **F.3** Galaxy MXAccess failover test — boot Galaxy.Proxy on both nodes, kill Primary, assert Galaxy consumer reconnects to Backup within `(SessionTimeout + KeepAliveInterval × 3)`. Document required session-timeout config in `docs/Redundancy.md`.
+
+## Compliance Checks (run at exit gate)
+
+- [ ] **OPC UA band compliance**: `0=Maintenance` reserved, `1=NoData` reserved. Operational states in 2..255 per 8-state matrix.
+- [ ] **Authoritative-Primary** ServiceLevel = 255.
+- [ ] **Isolated-Primary** (peer unreachable, self serving) = 230 — Primary retains authority.
+- [ ] **Primary-Mid-Apply** = 200.
+- [ ] **Recovering-Primary** = 180 with dwell + publish witness enforced.
+- [ ] **Authoritative-Backup** = 100.
+- [ ] **Isolated-Backup** (primary unreachable) = 80 — does NOT auto-promote.
+- [ ] **InvalidTopology** = 2 — both nodes self-demote when >1 Primary detected runtime.
+- [ ] **ServerUriArray** returns self + peer URIs, self first.
+- [ ] **UaHealthProbe authority**: integration test — peer returns HTTP 200 but OPC UA endpoint unreachable → coordinator treats peer as UA-unhealthy; peer is not a valid authority source.
+- [ ] **Apply-lease disposal**: leases close on exception, cancellation, and watchdog timeout; ServiceLevel never sticks at mid-apply band.
+- [ ] **Transparent-mode rejection**: attempting to publish `RedundancyMode=Transparent` is blocked at `sp_PublishGeneration`; runtime never sees an invalid mode.
+- [ ] **Role transition via operator publish**: FleetAdmin swaps `RedundancyRole` in a draft, publishes; both nodes re-read topology on publish confirmation + flip ServiceLevel — no restart.
+- [ ] **Client.CLI cutover**: with primary halted, Client.CLI that was connected to primary sees primary drop + reconnects to backup via `ServerUriArray`.
+- [ ] **Client interoperability matrix** (Stream F): Ignition 8.1 + 8.3 honour ServiceLevel; Kepware + Aveva OI Gateway findings documented.
+- [ ] **Galaxy MXAccess failover**: end-to-end test — primary kill → Galaxy consumer reconnects to backup within session-timeout budget.
+- [ ] No regression in existing driver test suites; no regression in `/healthz` reachability under redundancy load.
+
+## Risks and Mitigations
+
+| Risk | Likelihood | Impact | Mitigation |
+|------|:----------:|:------:|------------|
+| Split-brain from operator race (both nodes marked Primary) | Low | High | Coordinator rejects startup if its cluster has >1 Primary row; logs + fails fast. Document as a publish-time validation in `sp_PublishGeneration`. |
+| ServiceLevel thrashing on flaky peer | Medium | Medium | 2 s probe interval + 3-sample smoothing window; only declares a peer unreachable after 3 consecutive failed probes |
+| Client ignores ServiceLevel and stays on broken primary | Medium | Medium | Documented in `docs/Redundancy.md` — non-transparent redundancy requires client cooperation; most SCADA clients (Ignition, Kepware, Aveva OI Gateway) honor it. Unit-test the advertised values; field behavior is client-responsibility |
+| Apply-window counter leaks on exception | Low | High | `BeginApplyWindow` returns `IDisposable`; `using` syntax enforces paired decrement; unit test for exception-in-apply path |
+| `HttpClient` probe leaks sockets | Low | Medium | Single shared `HttpClient` per coordinator (not per-probe); timeouts tight to avoid keeping connections open during peer downtime |
+
+## Completion Checklist
+
+- [ ] Stream A: topology loader + tests
+- [ ] Stream B: peer probe + ServiceLevel calculator + 32-case matrix tests
+- [ ] Stream C: ServiceLevel / ServerUriArray / RedundancySupport node wiring + Client.CLI smoke test
+- [ ] Stream D: apply-window integration + nested-apply counter
+- [ ] Stream E: Admin `RedundancyTab` + OpenTelemetry metrics + SignalR push
+- [ ] `phase-6-3-compliance.ps1` exits 0; exit-gate doc; `docs/Redundancy.md` updated with the ServiceLevel matrix
+
+## Adversarial Review — 2026-04-19 (Codex, thread `019da490-3fa0-7340-98b8-cceeca802550`)
+
+1. **Crit · ACCEPT** — No publish-generation fencing enables split-publish advertising both as authoritative. **Change**: coordinator CAS on a monotonic `ConfigGenerationId`; every topology decision is generation-stamped; peers reject state propagated from a lower generation.
+2. **Crit · ACCEPT** — `>1 Primary` at startup covered but runtime containment missing when invalid topology appears later (mid-apply race). **Change**: add runtime `InvalidTopology` state — both nodes self-demote to ServiceLevel 2 (the "detected inconsistency" band, below normal operation) until convergence.
+3. **High · ACCEPT** — `0 = Faulted` collides with OPC UA Part 5 §6.3.34 semantics where 0 means **Maintenance** and 1 means NoData. **Change**: reserve **0** for operator-declared maintenance-mode only; Faulted/unreachable uses **1** (NoData); in-range degraded states occupy 2..199.
+4. **High · ACCEPT** — Matrix collapses distinct operational states onto the same value. **Change**: matrix expanded to Authoritative-Primary=255, Isolated-Primary=230 (peer unreachable — still serving), Primary-Mid-Apply=200, Recovering-Primary=180, Authoritative-Backup=100, Isolated-Backup=80 (primary unreachable — "take over if asked"), Backup-Mid-Apply=50, Recovering-Backup=30.
+5. **High · ACCEPT** — `/healthz` from 6.1 is HTTP-healthy but doesn't guarantee OPC UA data plane. **Change**: add a redundancy-specific probe `UaHealthProbe` — issues a `ReadAsync(ServiceLevel)` against the peer's OPC UA endpoint via a lightweight client session. `/healthz` remains the fast-fail; the UA probe is the authority signal.
+6. **High · ACCEPT** — `ServerUriArray` must include self + peers, not peers only. **Change**: array contains `[self.ApplicationUri, peer.ApplicationUri]` in stable deterministic ordering; compliance test asserts local-plus-peer membership.
+7. **Med · ACCEPT** — No `Faulted → Recovering → Healthy` path. **Change**: add `Recovering` state with min dwell time (60 s default) + positive publish witness (one successful Read on a reference node) before returning to Healthy. Thrash-prevention.
+8. **Med · ACCEPT** — Topology change during in-flight probe undefined. **Change**: every probe task tagged with `ConfigGenerationId` at dispatch; obsolete results discarded; in-flight probes cancelled on topology reload.
+9. **Med · ACCEPT** — Apply-window counter race on exception/cancellation/async ownership. **Change**: apply-window is a named lease keyed to `(ConfigGenerationId, PublishRequestId)` with disposal enforced via `await using`; watchdog detects leased-but-abandoned and force-closes after `ApplyMaxDuration` (default 10 min).
+10. **High · ACCEPT** — Ignition + Kepware + Aveva OI Gateway `ServiceLevel` compliance is unverified. **Change**: risk elevated to High; add Stream F (new) — build an interop matrix: validate against Ignition 8.1/8.3, Kepware KEPServerEX 6.x, Aveva OI Gateway 2020R2 + 2023R1. Document per-client cutover behaviour. Field deployments get a documented compatibility table; clients that ignore ServiceLevel documented as requiring explicit backup-endpoint config.
+11. **Med · ACCEPT** — Galaxy MXAccess re-session on Primary death not in acceptance. **Change**: Stream F adds an end-to-end failover smoke test that boots Galaxy.Proxy on both nodes, kills Primary, asserts Galaxy consumer reconnects to Backup within `(SessionTimeout + KeepAliveInterval × 3)` budget. `docs/Redundancy.md` updated with required session timeouts.
+12. **Med · ACCEPT** — Transparent-mode startup rejection is outage-prone. **Change**: `sp_PublishGeneration` validates `RedundancyMode` pre-publish — unsupported values reject the publish attempt with a clear validation error; runtime never sees an unsupported mode. Last-good config stays active.
+

docs/v2/implementation/phase-6-4-admin-ui-completion.md

@@ -0,0 +1,142 @@
+# Phase 6.4 — Admin UI Completion
+
+> **Status**: **SHIPPED (data layer)** 2026-04-19 — Stream A.2 (UnsImpactAnalyzer + DraftRevisionToken) and Stream B.1 (EquipmentCsvImporter parser) merged to `v2` in PR #91. Exit gate in PR #92.
+>
+> Deferred follow-ups (Blazor UI + staging tables + address-space wiring):
+> - Stream A UI — UnsTab MudBlazor drag/drop + 409 concurrent-edit modal + Playwright smoke (task #153).
+> - Stream B follow-up — EquipmentImportBatch staging + FinaliseImportBatch transaction + CSV import UI (task #155).
+> - Stream C — DiffViewer refactor into base + 6 section plugins + 1000-row cap + SignalR paging (task #156).
+> - Stream D — IdentificationFields.razor + DriverNodeManager OPC 40010 sub-folder exposure (task #157).
+>
+> Baseline pre-Phase-6.4: 1137 solution tests → post-Phase-6.4 data layer: 1159 passing (+22).
+>
+> **Branch**: `v2/phase-6-4-admin-ui-completion`
+> **Estimated duration**: 2 weeks
+> **Predecessor**: Phase 6.3 (Redundancy runtime) — reuses the `/cluster/{id}` page layout for the new tabs
+> **Successor**: v2 release-readiness capstone (Task #121)
+
+## Phase Objective
+
+Close the Admin UI feature-completeness checklist that Phase 1 Stream E exit gate left open. Each item below is an existing `phase-1-configuration-and-admin-scaffold.md` completion-checklist entry that is currently unchecked.
+
+Gaps to close:
+
+1. **UNS Structure tab drag/move with impact preview** — decision #115 + `admin-ui.md` §"UNS". Current state: list-only render; no drag reorder; no "X lines / Y equipment impacted" preview.
+2. **Equipment CSV import + 5-identifier search** — decision #95 + #117. Current state: basic form; no CSV parser; search indexes only ZTag.
+3. **Draft-generation diff viewer** — enhance existing `DiffViewer.razor` to show generation-diff not just staged-edit diff; highlight ACL grant changes (lands after Phase 6.2).
+4. **`_base` equipment-class Identification fields exposure** — decision #138–139. Columns exist on `Equipment`; no Admin UI field group; no address-space exposure of the OPC 40010 sub-folder.
+
+## Scope — What Changes
+
+| Concern | Change |
+|---------|--------|
+| `Admin/Pages/UnsTab.razor` | Tree component with drag-drop using **`MudBlazor.TreeView` + `MudBlazor.DropTarget`** (existing transitive dep — no new third-party package). Native HTML5 DnD rejected because virtualization + DnD on 500+ nodes doesn't combine reliably. Each drag fires a "Compute Impact" call carrying a `DraftRevisionToken`; modal preview ("Moving Line 'Oven-2' from 'Packaging' to 'Assembly' will re-home 14 equipment + re-parent 237 tags"). **Confirm step re-checks the token** and rejects with a `409 Conflict / refresh-required` modal if the draft advanced between preview and commit. |
+| `Admin/Services/UnsImpactAnalyzer.cs` | New service. Given a move-operation (line move, area rename, line merge), computes cascade counts + `DraftRevisionToken` at preview time. Pure-function shape; testable in isolation. |
+| `Admin/Pages/EquipmentTab.razor` | Add CSV-import button → modal with file picker + dry-run preview. **Identifier search** uses the canonical decision #117 set: `ZTag / MachineCode / SAPID / EquipmentId / EquipmentUuid`. Typeahead probes each column with a ranking query (exact match score 100 → prefix 50 → opt-in LIKE 20; published > draft tie-break). Result row shows which field matched via trailing badge. |
+| `Admin/Services/EquipmentCsvImporter.cs` | New service. CSV header row must start with `# OtOpcUaCsv v1` (version marker — future shape changes bump the version). Columns: `ZTag, MachineCode, SAPID, EquipmentId, EquipmentUuid, Name, UnsAreaName, UnsLineName, Manufacturer, Model, SerialNumber, HardwareRevision, SoftwareRevision, YearOfConstruction, AssetLocation, ManufacturerUri, DeviceManualUri`. Parser rejects unknown columns + blank required fields + duplicate ZTags + missing UnsLines. |
+| **Staged-import table** `EquipmentImportBatch` | New entity `{ Id, CreatedAtUtc, CreatedBy, RowsStaged, RowsAccepted, RowsRejected, FinalisedAtUtc? }` + child `EquipmentImportRow` records. Import writes rows in chunks to the staging table (not to `Equipment`). `FinaliseImportBatch` is the atomic finalize step that applies all accepted rows to `Equipment` + `ExternalIdReservation` in one transaction — short + bounded regardless of input size. Rollback = drop the batch row; `Equipment` never partially mutates. |
+| `Admin/Pages/DraftEditor.razor` + `DiffViewer.razor` | Diff viewer refactored into a base component + section plugins: `StructuralDiffSection`, `EquipmentDiffSection`, `TagDiffSection`, `AclDiffSection` (Phase 6.2), `RedundancyDiffSection` (Phase 6.3), `IdentificationDiffSection`. Each section has a **1000-row hard cap**; over-cap renders an aggregate summary + "Load full diff" button streaming 500-row pages via SignalR. Subtree-rename diffs (decision #115 bulk restructure) surface as summary only by default. |
+| `Admin/Components/IdentificationFields.razor` | New component. Renders the OPC 40010 field set **per decision #139**: `Manufacturer, Model, SerialNumber, HardwareRevision, SoftwareRevision, YearOfConstruction, AssetLocation, ManufacturerUri, DeviceManualUri`. `ProductInstanceUri / DeviceRevision / MonthOfConstruction` dropped from this phase — they need a separate decision-log widening. |
+| `OtOpcUa.Server/OpcUa/DriverNodeManager` — Equipment folder build | When an `Equipment` row has non-null Identification fields, the server adds an `Identification` sub-folder under the Equipment node containing one variable per non-null field. **ACL binding**: the sub-folder + variables inherit the `Equipment` scope's grants from Phase 6.2's trie — no new scope level added. Documented in `acl-design.md` cross-reference update. |
+
+## Scope — What Does NOT Change
+
+| Item | Reason |
+|------|--------|
+| Admin UI visual language | Bootstrap 5 / cookie auth / sidebar layout unchanged — consistency with ScadaLink design reference. |
+| LDAP auth flow | Already shipped in Phase 1. Phase 6.4 is additive UI only. |
+| Core abstractions / driver layer | Admin UI changes don't touch drivers. |
+| Equipment-class *template schema validation* | Still deferred (decision #112 — schemas repo not landed). We expose the Identification fields but don't validate against a template hierarchy. |
+| Drag/move to *other clusters* | Out of scope — equipment is cluster-scoped per decision #82. Cross-cluster migration is a different workflow. |
+
+## Entry Gate Checklist
+
+- [ ] Phase 6.2 merged (ACL grants are part of the new diff viewer sections)
+- [ ] Phase 6.3 merged (redundancy-role changes are part of the diff viewer)
+- [ ] `phase-1-configuration-and-admin-scaffold.md` §Stream E completion checklist re-read — confirm these are the remaining items
+- [ ] `admin-ui.md` re-skimmed for screen layouts
+- [ ] Existing `EquipmentTab.razor` / `UnsTab.razor` / `DraftEditor.razor` diff'd against what ships today so the edits are additive not destructive
+- [ ] Dev Galaxy available for OPC 40010 exposure smoke testing
+
+## Task Breakdown
+
+### Stream A — UNS drag/reorder + impact preview (5 days)
+
+1. **A.1** 1000-node synthetic seed fixture. Drag-latency bench against `MudBlazor.TreeView` + `MudBlazor.DropTarget` — commit to the component if latency budget (100 ms drag-enter feedback) holds; fall back to flat-list reorder UI (Area/Line dropdowns) with loss of visual drag affordance otherwise.
+2. **A.2** `UnsImpactAnalyzer` service. Inputs: `(DraftGenerationId, MoveOperation, DraftRevisionToken)`. Outputs: `ImpactPreview { AffectedEquipmentCount, AffectedTagCount, CascadeWarnings[], DraftRevisionToken }`. Pure-function shape; testable in isolation.
+3. **A.3** Modal preview wired to `UnsImpactAnalyzer`. **Confirm** re-reads the current draft revision + compares against the preview's token; if the draft advanced (another operator saved a different edit), show a `409 Conflict / refresh-required` modal rather than silently overwriting.
+4. **A.4** Cross-cluster drop attempts: target disabled + toast "Equipment is cluster-scoped (decision #82). To move across clusters, use Export → Import on the Cluster detail page." Plus help link.
+5. **A.5** Playwright (or equivalent) smoke test: drag a line across areas, assert modal shows right counts, assert draft row reflects the move; concurrent-edit test runs two sessions + asserts the later Confirm hits the 409.
+
+### Stream B — Equipment CSV import + 5-identifier search (5 days)
+
+1. **B.1** `EquipmentCsvImporter`. Strict RFC 4180 parser (per decision #95). Header row validation: first line must match `# OtOpcUaCsv v1` — future versions fork parser versions. Required columns: `ZTag, MachineCode, SAPID, EquipmentId, EquipmentUuid, Name, UnsAreaName, UnsLineName`. Optional: `Manufacturer, Model, SerialNumber, HardwareRevision, SoftwareRevision, YearOfConstruction, AssetLocation, ManufacturerUri, DeviceManualUri`. Parser rejects unknown columns + blank required fields + duplicate ZTags.
+2. **B.2** `EquipmentImportBatch` + `EquipmentImportRow` staging tables (migration). Import writes preview rows to staging via chunked inserts; staging never blocks `Equipment` or `ExternalIdReservation`. Preview query reads staging + validates each row against the current `Equipment` state + `ExternalIdReservation` freshness.
+3. **B.3** `ImportPreview` UI — per-row accept/reject table. Reject reasons: "ZTag already exists in draft", "ExternalIdReservation conflict with Cluster X", "UnsLineName not found in draft UNS tree", etc. Operator reviews + clicks "Commit".
+4. **B.4** `FinaliseImportBatch` — atomic finalize. One EF transaction applies accepted rows to `Equipment` + `ExternalIdReservation`; duration bounded regardless of input size (the atomic step is a bulk-insert, not per-row row-by-row). Rollback = drop batch row via `DropImportBatch`; `Equipment` never partially mutates.
+5. **B.5** Five-identifier search. Rank SQL: exact match any identifier = score 100, prefix match = 50, LIKE-fuzzy (opt-in via `?fuzzy=true`) = 20; tie-break `published > draft` then `RowVersion DESC`. Typeahead shows which field matched via trailing badge.
+6. **B.6** Smoke tests: 100-row CSV with 10 conflicts (5 ZTag dupes, 3 reservation clashes, 2 missing UnsLines); 10k-row perf test asserting finalize txn < 30 s; concurrent import + external `ExternalIdReservation` insert test asserts retryable-conflict handling.
+
+### Stream C — Diff viewer enhancements (4 days)
+
+1. **C.1** Refactor `DiffViewer.razor` into a base component + section plugins. Plugins: `StructuralDiffSection` (UNS tree), `EquipmentDiffSection`, `TagDiffSection`, `AclDiffSection` (Phase 6.2), `RedundancyDiffSection` (Phase 6.3), `IdentificationDiffSection`.
+2. **C.2** Each section renders collapsed by default; counts + top-line summary always visible. **1000-row hard cap** per section — over-cap sections render aggregate summary (e.g. "237 equipment re-parented from Packaging to Assembly") with a "Load full diff" button that streams 500-row pages via SignalR.
+3. **C.3** Subtree-rename diffs (decision #115 bulk restructure) surface as summary only by default regardless of row count.
+4. **C.4** Tests: seed two generations with deliberate diffs; assert every section reports the right counts + top-line summary + hard-cap behavior.
+
+### Stream D — OPC 40010 Identification exposure (3 days)
+
+1. **D.1** `IdentificationFields.razor` component. Renders the **9 decision #139 fields**: `Manufacturer, Model, SerialNumber, HardwareRevision, SoftwareRevision, YearOfConstruction, AssetLocation, ManufacturerUri, DeviceManualUri`. Labelled inputs; nullable columns show empty input; required-field validation on commit only.
+2. **D.2** `DriverNodeManager` equipment-folder builder — after building the equipment node, inspect the 9 Identification columns; if any non-null, add an `Identification` sub-folder with variable-per-non-null-field. ACL binding: sub-folder + variables inherit the **same `ScopeId` as the Equipment node** (Phase 6.2's trie treats them as part of the Equipment scope — no new scope level).
+3. **D.3** Address-space smoke test via Client.CLI: browse an equipment node, assert `Identification` sub-folder present when columns are set, absent when all null, variables match the field values.
+4. **D.4** ACL integration test: a user with Equipment-level grant reads the `Identification` variables without needing a separate grant; a user without the Equipment grant gets `BadUserAccessDenied` on both the Equipment node + its Identification variables.
+
+## Compliance Checks (run at exit gate)
+
+- [ ] **UNS drag/move**: drag a line across areas; modal preview shows correct impacted-equipment + impacted-tag counts.
+- [ ] **Concurrent-edit safety**: two-session test — session B saves a draft edit after session A opened the preview; session A's Confirm returns `409 Conflict / refresh-required` instead of overwriting.
+- [ ] **Cross-cluster drop**: dropping equipment across cluster boundaries is disabled + shows actionable toast pointing to Export/Import workflow.
+- [ ] **1000-node tree**: drag operations on a 1000-node seed maintain < 100 ms drag-enter feedback.
+- [ ] **CSV header version**: file missing `# OtOpcUaCsv v1` first line is rejected pre-parse.
+- [ ] **CSV canonical identifier set**: columns match decision #117 (ZTag / MachineCode / SAPID / EquipmentId / EquipmentUuid); drift from the earlier draft surfaces as a test failure.
+- [ ] **Staged-import atomicity**: `FinaliseImportBatch` transaction bounded < 30 s for a 10k-row import; pre-finalize stagings visible only to the importing user; rollback via `DropImportBatch`.
+- [ ] **Concurrent import + external reservation**: concurrent test — third party inserts to `ExternalIdReservation` mid-finalize; finalize retries with conflict handling; no corruption.
+- [ ] **5-identifier search ranking**: exact matches outrank prefix matches; published outranks draft for equal scores.
+- [ ] **Diff viewer section caps**: 2000-row subtree-rename diff renders as summary only; "Load full diff" streams in pages.
+- [ ] **OPC 40010 field list match**: rendered field group matches decision #139 exactly; no extra fields.
+- [ ] **OPC 40010 exposure**: Client.CLI browse shows `Identification` sub-folder when equipment has non-null columns; absent when all null.
+- [ ] **ACL inheritance for Identification**: integration test — Equipment-grant user reads Identification; no-grant user gets `BadUserAccessDenied` on both.
+- [ ] **Visual parity reviewer**: named role (`FleetAdmin` user, not the implementation lead) compares side-by-side against `admin-ui.md` §Visual-Design reference panels; signoff artefact is a checked-in screenshot set under `docs/v2/visual-compliance/phase-6-4/`.
+
+## Risks and Mitigations
+
+| Risk | Likelihood | Impact | Mitigation |
+|------|:----------:|:------:|------------|
+| UNS drag-drop janky on large trees (>500 nodes) | Medium | Medium | Virtualize the tree component; default-collapse nested areas; test with a synthetic 1000-equipment seed |
+| CSV import performance on 10k-row imports | Medium | Medium | Stream-parse rather than load-into-memory; preview renders in batches of 100; commit is chunked-EF-insert with progress bar |
+| Diff viewer becomes unwieldy with many sections | Low | Medium | Each section collapsed by default; top-line summary row always shown; Phase 6.4 caps at 6 sections |
+| OPC 40010 sub-folder accidentally exposes NULL/empty identification columns as empty-string variables | Low | Low | Column null-check in the builder; drop variables whose DB value is null |
+| 5-identifier search pulls full table | Medium | Medium | Indexes on each of ZTag/SAPID/UniqueId/Alias1/Alias2; search query uses a UNION of 5 indexed lookups; falls back to LIKE only on explicit operator opt-in |
+
+## Completion Checklist
+
+- [ ] Stream A: `UnsImpactAnalyzer` + drag-drop tree + modal preview + Playwright smoke
+- [ ] Stream B: `EquipmentCsvImporter` + preview modal + 5-identifier search + conflict-rollback test
+- [ ] Stream C: `DiffViewer` refactor + 6 section plugins + 2-generation diff test
+- [ ] Stream D: `IdentificationFields.razor` + address-space builder change + Client.CLI browse test
+- [ ] Visual-compliance reviewer signoff
+- [ ] Full solution `dotnet test` passes; `phase-6-4-compliance.ps1` exits 0; exit-gate doc
+
+## Adversarial Review — 2026-04-19 (Codex, via `codex-rescue` subagent)
+
+1. **Crit · ACCEPT** — Stale UNS impact preview can overwrite concurrent draft edits. **Change**: each preview carries a `DraftRevisionToken`; `Confirm` compares against the current draft + rejects with a `409 Conflict / refresh-required` modal if any draft edit landed since the preview was generated. Stream A.3 updated.
+2. **High · ACCEPT** — CSV import atomicity is internally contradictory (single EF transaction vs. chunked inserts). **Change**: one explicit model — staged-import table (`EquipmentImportBatch { Id, CreatedAtUtc, RowsStaged, RowsAccepted, RowsRejected }`) receives rows in chunks; final `FinaliseImportBatch` is atomic over `Equipment` + `ExternalIdReservation`. Rollback is "drop the batch row" — the real Equipment table is never partially mutated.
+3. **Crit · ACCEPT** — Identifier contract rewrite mis-cites decisions. **Change**: revert to the `admin-ui.md` + decision #117 canonical set — `ZTag / MachineCode / SAPID / EquipmentId / EquipmentUuid`. CSV header follows that set verbatim. Introduce a separate decision entry for versioned CSV header shape before adding any new column; CSV header row must start with `# OtOpcUaCsv v1` so future shape changes are unambiguous.
+4. **Med · ACCEPT** — Search ordering undefined. **Change**: rank SQL — exact match on any identifier scores 100; prefix match 50; LIKE-fuzzy 20; published > draft tie-breaker; `ORDER BY score DESC, RowVersion DESC`. Typeahead shows which field matched via trailing badge.
+5. **High · ACCEPT** — HTML5 DnD on virtualized tree is aspirational. **Change**: Stream A.2 rewritten — commits to **`MudBlazor.TreeView` + `MudBlazor.DropTarget`** (already a transitive dep via the existing Admin UI). Build a 1000-node synthetic seed in A.1 + validate drag-latency budget before implementing impact preview. If MudBlazor can't hit the budget, fall back to a flat-list reorder UI with Area/Line dropdowns (loss of visual drag affordance but unblocks the feature).
+6. **Med · ACCEPT** — Collapsed-by-default doesn't handle generation-sized diffs. **Change**: each diff section has a hard row cap (1000 by default). Over-cap sections render an aggregate summary + "Load full diff" button that streams via SignalR in 500-row pages. Decision #115 subtree renames surface as a "N equipment re-parented under X → Y" summary instead of row-by-row.
+7. **High · ACCEPT** — OPC 40010 field list doesn't match decision #139. **Change**: field group realigned to `Manufacturer, Model, SerialNumber, HardwareRevision, SoftwareRevision, YearOfConstruction, AssetLocation, ManufacturerUri, DeviceManualUri`. `ProductInstanceUri / DeviceRevision / MonthOfConstruction` dropped from Phase 6.4 — they belong to a future OPC 40010 widening decision.
+8. **High · ACCEPT** — `Identification` subtree unreconciled with ACL hierarchy (Phase 6.2 6-level scope). **Change**: address-space builder creates the Identification sub-folder under the Equipment node **with the same ScopeId as Equipment** — no new scope level. ACL evaluator treats `…/Equipment/Identification/X` as inheriting the `Equipment` scope's grants. Documented in Phase 6.2's `acl-design.md` cross-reference update.
+9. **Low · ACCEPT** — Visual-review gate names nonexistent reviewer role. **Change**: rubric defined — a named "Admin UX reviewer" (role `FleetAdmin` user, not the implementation lead) compares side-by-side screenshots against the `admin-ui.md` §Visual-Design reference panels; signoff artefact is a checked-in screenshot set under `docs/v2/visual-compliance/phase-6-4/`.
+10. **Med · ACCEPT** — Cross-cluster drag/drop lacks loud failure path. **Change**: on drop across cluster boundary, disable the drop target + show a toast "Equipment is cluster-scoped (decision #82). To move across clusters, use the Export → Import workflow on the Cluster detail page." Plus a help link. Tested in Stream A.4.
+

docs/v2/lmx-followups.md

@@ -7,24 +7,50 @@ Basic256Sha256 endpoints and alarms are observable through
 specific before the stack can fully replace the v1 deployment, in
 rough priority order.
 
-## 1. Proxy-side `IHistoryProvider` for `ReadAtTime` / `ReadEvents`
-
-**Status**: Capability surface complete (PR 35). OPC UA HistoryRead service-handler
-wiring in `DriverNodeManager` remains as the next step; integration-test still
-pending.
+## 1. Proxy-side `IHistoryProvider` for `ReadAtTime` / `ReadEvents` — **DONE (PRs 35 + 38)**
 
 PR 35 extended `IHistoryProvider` with `ReadAtTimeAsync` + `ReadEventsAsync`
 (default throwing implementations so existing impls keep compiling), added the
-`HistoricalEvent` + `HistoricalEventsResult` records to
-`Core.Abstractions`, and implemented both methods in `GalaxyProxyDriver` on top
-of the PR 10 / PR 11 IPC messages. Wire-to-domain mapping (`ToHistoricalEvent`)
-is unit-tested for field fidelity, null-preservation, and `DateTimeKind.Utc`.
+`HistoricalEvent` + `HistoricalEventsResult` records to `Core.Abstractions`,
+and implemented both methods in `GalaxyProxyDriver` on top of the PR 10 / PR 11
+IPC messages.
 
-**Remaining**:
-- `DriverNodeManager` wires the new capability methods onto `HistoryRead`
-  `AtTime` + `Events` service handlers.
-- Integration test: OPC UA client calls `HistoryReadAtTime` / `HistoryReadEvents`,
-  value flows through IPC to the Host's `HistorianDataSource`, back to the client.
+PR 38 wired the OPC UA HistoryRead service-handler through
+`DriverNodeManager` by overriding `CustomNodeManager2`'s four per-kind hooks —
+`HistoryReadRawModified` / `HistoryReadProcessed` / `HistoryReadAtTime` /
+`HistoryReadEvents`. Each walks `nodesToProcess`, resolves the driver-side
+full reference from `NodeId.Identifier`, dispatches to the right
+`IHistoryProvider` method, and populates the paired results + errors lists
+(both must be set — the MasterNodeManager merges them and a Good result with
+an unset error slot serializes as `BadHistoryOperationUnsupported` on the
+wire). Historized variables gain `AccessLevels.HistoryRead` so the stack
+dispatches; the driver root folder gains `EventNotifiers.HistoryRead` so
+`HistoryReadEvents` can target it.
+
+Aggregate translation uses a small `MapAggregate` helper that handles
+`Average` / `Minimum` / `Maximum` / `Total` / `Count` (the enum surface the
+driver exposes) and returns null for unsupported aggregates so the handler
+can surface `BadAggregateNotSupported`. Raw+Processed+AtTime wrap driver
+samples as `HistoryData` in an `ExtensionObject`; Events emits a
+`HistoryEvent` with the standard BaseEventType field list (EventId /
+SourceName / Message / Severity / Time / ReceiveTime) — custom
+`SelectClause` evaluation is an explicit follow-up.
+
+**Tests**:
+
+- `DriverNodeManagerHistoryMappingTests` — 12 unit cases pinning
+  `MapAggregate`, `BuildHistoryData`, `BuildHistoryEvent`, `ToDataValue`.
+- `HistoryReadIntegrationTests` — 5 end-to-end cases drive a real OPC UA
+  client (`Session.HistoryRead`) against a fake `IHistoryProvider` driver
+  through the running stack. Covers raw round-trip, processed with Average
+  aggregate, unsupported aggregate → `BadAggregateNotSupported`, at-time
+  timestamp forwarding, and events field-list shape.
+
+**Deferred**:
+- Continuation-point plumbing via `Session.Save/RestoreHistoryContinuationPoint`.
+  Driver returns null continuations today so the pass-through is fine.
+- Per-`SelectClause` evaluation in HistoryReadEvents — clients that send a
+  custom field selection currently get the standard BaseEventType layout.
 
 ## 2. Write-gating by role — **DONE (PR 26)**
 
@@ -77,18 +103,51 @@ drive a full OPC UA session with username/password, then read an
 `IHostConnectivityProbe`-style "whoami" node to verify the role surfaced).
 That needs a test-only address-space node and is a separate PR.
 
-## 5. Full Galaxy live-service smoke test against the merged v2 stack
+## 5. Full Galaxy live-service smoke test against the merged v2 stack — **IN PROGRESS (PRs 36 + 37)**
 
-**Status**: Individual pieces have live smoke tests (PR 5 MXAccess, PR 13
-probe manager, PR 14 alarm tracker), but the full loop — OPC UA client →
-`OtOpcUaServer` → `GalaxyProxyDriver` (in-process) → named-pipe to
-Galaxy.Host subprocess → live MXAccess runtime → real Galaxy objects — has
-no single end-to-end smoke test.
+PR 36 shipped the prerequisites helper (`AvevaPrerequisites`) that probes
+every dependency a live smoke test needs and produces actionable skip
+messages.
 
-**To do**:
-- Test that spawns the full topology, discovers a deployed Galaxy object,
-  subscribes to one of its attributes, writes a value back, and asserts the
-  write round-tripped through MXAccess. Skip when ArchestrA isn't running.
+PR 37 shipped the live-stack smoke test project structure:
+`tests/Driver.Galaxy.Proxy.Tests/LiveStack/` with `LiveStackFixture` (connects
+to the *already-running* `OtOpcUaGalaxyHost` Windows service via named pipe;
+never spawns the Host process) and `LiveStackSmokeTests` covering:
+
+- Fixture initializes successfully (IPC handshake succeeds end-to-end).
+- Driver reports `DriverState.Healthy` post-handshake.
+- `DiscoverAsync` returns at least one variable from the live Galaxy.
+- `GetHostStatuses` reports at least one Platform/AppEngine host.
+- `ReadAsync` on a discovered variable round-trips through
+  Proxy → Host pipe → MXAccess → back without a BadInternalError.
+
+Shared secret + pipe name resolve from `OTOPCUA_GALAXY_SECRET` /
+`OTOPCUA_GALAXY_PIPE` env vars, falling back to reading the service's
+registry-stored Environment values (requires elevated test host).
+
+**PR 40** added the write + subscribe facts targeting
+`DelmiaReceiver_001.TestAttribute` (the writable Boolean UDA the dev Galaxy
+ships under TestMachine_001) — write-then-read with a 5s scan-window poll +
+restore-on-finally, and subscribe-then-write asserting both an initial-value
+OnDataChange and a post-write OnDataChange. PR 39 added the elevated-shell
+short-circuit so a developer running from an admin window gets an actionable
+skip instead of `UnauthorizedAccessException`.
+
+**Run the live tests** (from a NORMAL non-admin PowerShell):
+
+```powershell
+$env:OTOPCUA_GALAXY_SECRET = Get-Content C:\Users\dohertj2\Desktop\lmxopcua\.local\galaxy-host-secret.txt
+cd C:\Users\dohertj2\Desktop\lmxopcua
+dotnet test tests\ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Proxy.Tests --filter "FullyQualifiedName~LiveStackSmokeTests"
+```
+
+Expected: 7/7 pass against the running `OtOpcUaGalaxyHost` service.
+
+**Remaining for #5 in production-grade form**:
+- Confirm the suite passes from a non-elevated shell (operator action).
+- Add similar facts for an alarm-source attribute once `TestMachine_001` (or
+  a sibling) carries a deployed alarm condition — the current dev Galaxy's
+  TestAttribute isn't alarm-flagged.
 
 ## 6. Second driver instance on the same server — **DONE (PR 32)**
 

docs/v2/mitsubishi.md

@@ -0,0 +1,451 @@
+# Mitsubishi Electric MELSEC — Modbus TCP quirks
+
+Mitsubishi's MELSEC family speaks Modbus TCP through a patchwork of add-on modules
+and built-in Ethernet ports, not a single unified stack. The module names are
+confusingly similar (`QJ71MB91` is *serial* RTU, `QJ71MT91` is the TCP/IP module
+[9]; `LJ71MT91` is the L-series equivalent; `RJ71EN71` is the iQ-R Ethernet module
+with a MODBUS/TCP *slave* mode bolted on [8]; `FX3U-ENET`, `FX3U-ENET-P502`,
+`FX3U-ENET-ADP`, `FX3GE` built-in, and `FX5U` built-in are all different code
+paths) — and every one of the categories below has at least one trap a textbook
+Modbus client gets wrong: hex-numbered X/Y devices colliding with decimal Modbus
+addresses, a user-defined "device assignment" parameter block that means *no two
+sites are identical*, CDAB-vs-ABCD word order driven by how the ladder built the
+32-bit value, sub-spec FC16 caps on the older QJ71MT91, and an FX3U port-502
+licensing split that makes `FX3U-ENET` and `FX3U-ENET-P502` different SKUs.
+This document catalogues each quirk, cites primary sources, and names the
+ModbusPal integration test we'd write for it (convention from
+`docs/v2/modbus-test-plan.md`: `Mitsubishi_<model>_<behavior>`).
+
+## Models and server/client capability
+
+| Model                  | Family   | Modbus TCP server | Modbus TCP client | Source |
+|------------------------|----------|-------------------|-------------------|--------|
+| `QJ71MT91`             | MELSEC-Q | Yes (slave)       | Yes (master)      | [9]    |
+| `QJ71MB91`             | MELSEC-Q | **Serial only** — RS-232/422/485 RTU, *not TCP* | — | [1][3] |
+| `LJ71MT91`             | MELSEC-L | Yes (slave)       | Yes (master)      | [10]   |
+| `RJ71EN71` / `RnENCPU` | MELSEC iQ-R | Yes (slave)    | Yes (master)      | [8]    |
+| `RJ71C24` / `RJ71C24-R2` | MELSEC iQ-R | RTU (serial)  | RTU (serial)      | [13]   |
+| iQ-R built-in Ethernet | CPU      | Yes (slave)       | Yes (master)      | [7]    |
+| iQ-F `FX5U` built-in Ethernet | CPU | Yes, firmware ≥ 1.060 [11] | Yes | [7][11][12] |
+| `FX3U-ENET`            | FX3U bolt-on | Yes (slave), but **not on port 502** [5] | Yes | [4][5] |
+| `FX3U-ENET-P502`       | FX3U bolt-on | Yes (slave), port 502 enabled | Yes | [5] |
+| `FX3U-ENET-ADP`        | FX3U adapter | **No MODBUS** [5] | No MODBUS     | [5]    |
+| `FX3GE` built-in       | FX3GE CPU | No MODBUS (needs ENET module) [6] | No | [6] |
+| `FX3G` + `FX3U-ENET`   | FX3G | Yes via ENET module | Yes | [6] |
+
+- A common integration mistake is to buy `FX3U-ENET-ADP` expecting MODBUS —
+  that adapter speaks only MC protocol / SLMP. Our driver should surface a clear
+  capability error, not "connection refused", when the operator's device tag
+  says `FX3U-ENET-ADP` [5].
+- Older forum threads assert the FX5U is "client only" [12] — that was true on
+  firmware ≤ 1.040. Firmware 1.060 and later ship the parameter-driven MODBUS
+  TCP server built-in and need no function blocks [11].
+
+## Modbus device assignment (the parameter block)
+
+Unlike a DL260 where the CPU exposes a *fixed* V-memory-to-Modbus mapping, every
+MELSEC MODBUS-TCP module exposes a **Modbus Device Assignment Parameter** block
+that the engineer configures in GX Works2 / GX Configurator-MB / GX Works3.
+Each of the four Modbus tables (Coil, Input, Input Register, Holding Register)
+can be split into up to 16 independent "assignment" entries, each binding a
+contiguous Modbus address range to a MELSEC device head (`M0`, `D0`, `X0`,
+`Y0`, `B0`, `W0`, `SM0`, `SD0`, `R0`, etc.) and a point count [3][7][8][9].
+
+- **There is no canonical "MELSEC Modbus mapping"**. Two sites running the same
+  QJ71MT91 module can expose completely different Modbus layouts. Our driver
+  must treat the mapping as site-data (config-file-driven), not as a device
+  profile constant.
+- **Default values do exist** — both GX Configurator-MB (for Q/L series) and
+  GX Works3 (for iQ-R / iQ-F / FX5) ship a "dedicated pattern" default that is
+  applied when the engineer does not override the assignment. Per the FX5
+  MODBUS Communication manual (JY997D56101) and the QJ71MT91 manual, the FX5
+  dedicated default is [3][7][11]:
+
+  | Modbus table       | Modbus range (0-based) | MELSEC device | Head |
+  |--------------------|------------------------|---------------|------|
+  | Coil (FC01/05/15)  | 0 – 7679               | M             | M0   |
+  | Coil               | 8192 – 8959            | Y             | Y0   |
+  | Input (FC02)       | 0 – 7679               | M             | M0   |
+  | Input              | 8192 – 8959            | X             | X0   |
+  | Input Register (FC04) | 0 – 6143            | D             | D0   |
+  | Holding Register (FC03/06/16) | 0 – 6143    | D             | D0   |
+
+  This matches the widely circulated "FC03 @ 0 = D0" convention that shows up
+  in Ubidots / Ignition / AdvancedHMI integration guides [6][12].
+
+- **X/Y in the default mapping occupy a second, non-zero Modbus range** (8192+
+  on FX5; similar on Q/L/iQ-R). Driver users who expect "X0 = coil 0" will be
+  reading M0 instead. Document this clearly.
+- **Assignment-range collisions silently disable the slave.** The QJ71MT91
+  manual states explicitly that if any two of assignments 1-16 duplicate the
+  head Modbus device number, the slave function is inactive with no clear
+  error — the module just won't respond [9]. The driver probe will look like a
+  simple timeout; the site engineer has to open GX Configurator-MB to diagnose.
+
+Test names:
+`Mitsubishi_FX5U_default_mapping_coil_0_is_M0`,
+`Mitsubishi_FX5U_default_mapping_holding_0_is_D0`,
+`Mitsubishi_QJ71MT91_duplicate_assignment_head_disables_slave`.
+
+## X/Y addressing — hex on MELSEC, decimal on Modbus
+
+**MELSEC X (input) and Y (output) device numbers are hexadecimal on Q / L /
+iQ-R** and **octal** on FX / iQ-F (with a GX Works3 toggle) [14][15].
+
+- On a Q CPU, `X20` means decimal **32**, not 20. On an FX5U in default (octal)
+  mode, `X20` means decimal **16**. GX Works3 exposes a project-level option to
+  display FX5U X/Y in hex to match Q/L/iQ-R convention — the same physical
+  input is then called `X10` [14].
+- The Modbus Device Assignment Parameter block takes the *head device* as a
+  MELSEC-native number, which is interpreted in the CPU's native base
+  (hex for Q/L/iQ-R, octal for FX/iQ-F). After that, **Modbus offsets from
+  the head are plain decimal** — the module does not apply a second hex
+  conversion [3][9].
+- Example (QJ71MT91 on a Q CPU): assignment "Coil 0 = X0, 512 points" exposes
+  physical `X0` through `X1FF` (hex) as coils 0-511. A client reading coil 32
+  gets the bit `X20` (hex) — i.e. the 33rd input, not the value at "input 20"
+  that the operator wrote on the wiring diagram in decimal.
+- **Driver bug source**: if the operator's tag configuration says "read X20" and
+  the driver helpfully converts "20" to decimal 20 → coil offset 20, the
+  returned bit is actually `X14` (hex) — off by twelve. Our config layer must
+  preserve the MELSEC-native base that the site engineer sees in GX Works.
+- Timers/counters (`T`, `C`, `ST`) are always decimal in MELSEC notation.
+  Internal relays (`M`, `B`, `L`), data registers (`D`, `W`, `R`, `ZR`),
+  and special relays/registers (`SM`, `SD`) also decimal. **Only `X` and `Y`
+  (and on Q/L/iQ-R, `B` link relays and `W` link registers) use hex**, and
+  the X/Y decision is itself family-dependent [14][15].
+
+Test names:
+`Mitsubishi_Q_X_address_is_hex_X20_equals_coil_offset_32`,
+`Mitsubishi_FX5U_X_address_is_octal_X20_equals_coil_offset_16`,
+`Mitsubishi_W_link_register_is_hex_W10_equals_holding_offset_16`.
+
+## Word order for 32-bit values
+
+MELSEC stores 32-bit ladder values (`DINT`, `DWORD`, `REAL` / single-precision
+float) across **two consecutive D-registers, low word first** — i.e., `CDAB`
+when viewed as a Modbus register pair [2][6].
+
+```
+D100 (low word)  : 0xCC 0xDD   (big-endian bytes within the word)
+D101 (high word) : 0xAA 0xBB
+```
+
+A Modbus master reading D100/D101 as a `float` with default (ABCD) word order
+gets garbage. Ignition's built-in Modbus driver notes Mitsubishi as a "CDAB
+device" specifically for this reason [2].
+
+- **Q / L / iQ-R / iQ-F all agree** — this is a CPU-level convention, not a
+  module choice. Both the QJ71MT91 manual and the FX5 MODBUS Communication
+  manual describe 32-bit access by "reading the lower 16 bits from the start
+  address and the upper 16 bits from start+1" [6][11].
+- **Byte order within each register is big-endian** (Modbus standard). The
+  module does not byte-swap.
+- **Configurable?** The MODBUS modules themselves do **not** expose a word-
+  order toggle; the behavior is fixed to how the CPU laid out the value in the
+  two D-registers. If the ladder programmer used an `SWAP` instruction or a
+  union-style assignment, the word order can be whatever they made it — but
+  for values produced by the standard `D→DBL` and `FLT`/`FLT2` instructions
+  it is always CDAB [2].
+- **FX5U quirk**: the FX5 MODBUS Communication manual tells the programmer to
+  use the `SWAP` instruction *if* the remote Modbus peer requires
+  little-endian *byte* ordering (BADC) [11]. This is only relevant when the
+  FX5U is the Modbus *client*, but it confirms the FX5U's native wire layout
+  is big-endian-byte / little-endian-word (CDAB) on the server side too.
+- **Rumoured exception**: a handful of MrPLC forum threads report iQ-R
+  RJ71EN71 firmware < 1.05 returning DWORDs in `ABCD` order when accessed via
+  the built-in Ethernet port's MODBUS slave [8]. _Unconfirmed_; treat as a
+  per-site test.
+
+Test names:
+`Mitsubishi_Float32_word_order_is_CDAB`,
+`Mitsubishi_Int32_word_order_is_CDAB`,
+`Mitsubishi_FX5U_SWAP_instruction_changes_byte_order_not_word_order`.
+
+## BCD vs binary encoding
+
+**MELSEC stores integer values in D-registers as plain binary two's-complement**,
+not BCD [16]. This is the opposite of AutomationDirect DirectLOGIC, where
+V-memory defaults to BCD and the ladder must explicitly request binary.
+
+- A ladder `MOV K1234 D100` stores `0x04D2` (1234 decimal) in D100, not
+  `0x1234`. The Modbus master reads `0x04D2` and decodes it as an integer
+  directly — no BCD conversion needed [16].
+- **Timer / counter current values** (`T0` current value, `C0` count) are
+  stored in binary as word devices on Q/L/iQ-R/iQ-F. The ladder preset
+  (`K...`) is also binary [16][17].
+- **Timer / counter preset `K` operand in FX3U / earlier FX**: also binary when
+  loaded from a D-register or a `K` constant. The older A-series CPUs had BCD
+  presets on some timer types, but MELSEC-Q, L, iQ-R, iQ-F, and FX3U all use
+  binary presets by default [17].
+- The FX3U programming manual dedicates `FNC 18 BCD` and `FNC 19 BIN` to
+  explicit conversion — their existence confirms that anything in D-registers
+  that came from a `BCD` instruction output is BCD, but nothing is BCD by
+  default [17].
+- **7-segment display registers** are a common site-specific exception — many
+  ladders pack `BCD D100` into a D-register so the operator panel can drive
+  a display directly. Our driver should not assume; expose a per-tag
+  "encoding = binary | BCD" knob.
+
+Test names:
+`Mitsubishi_D_register_stores_binary_not_BCD`,
+`Mitsubishi_FX3U_timer_current_value_is_binary`.
+
+## Max registers per request
+
+From the FX5 MODBUS Communication manual Chapter 11 [11]:
+
+| FC | Name                       | FX5U (built-in) | QJ71MT91     | iQ-R (RJ71EN71 / built-in) | FX3U-ENET |
+|----|----------------------------|-----------------|--------------|-----------------------------|-----------|
+| 01 | Read Coils                 | 1-2000          | 1-2000 [9]   | 1-2000 [8]                  | 1-2000    |
+| 02 | Read Discrete Inputs       | 1-2000          | 1-2000       | 1-2000                      | 1-2000    |
+| 03 | Read Holding Registers     | **1-125**       | 1-125 [9]    | 1-125 [8]                   | 1-125     |
+| 04 | Read Input Registers       | 1-125           | 1-125        | 1-125                       | 1-125     |
+| 05 | Write Single Coil          | 1               | 1            | 1                           | 1         |
+| 06 | Write Single Register      | 1               | 1            | 1                           | 1         |
+| 0F | Write Multiple Coils       | 1-1968          | 1-1968       | 1-1968                      | 1-1968    |
+| 10 | Write Multiple Registers   | **1-123**       | 1-123        | 1-123                       | 1-123     |
+| 16 | Mask Write Register        | 1               | not supported | 1                          | not supported |
+| 17 | Read/Write Multiple Regs   | R:1-125, W:1-121 | not supported | R:1-125, W:1-121          | not supported |
+
+- **The FX5U / iQ-R native-port limits match the Modbus spec**: 125 for FC03/04,
+  123 for FC16 [11]. No sub-spec caps like DL260's 100-register ceiling.
+- **QJ71MT91 does not support FC16 (0x16, Mask Write Register) or FC17
+  (0x17, Read/Write Multiple)** — requesting them returns exception `01`
+  Illegal Function [9]. FX5U and iQ-R *do* support both.
+- **QJ71MT91 device size**: 64k points (65,536) for each of Coil / Input /
+  Input Register / Holding Register, plus up to 4086k points for Extended
+  File Register via a secondary assignment range [9].
+- **FX3U-ENET / -P502 function code list is a strict subset** of the common
+  eight (FC01/02/03/04/05/06/0F/10). FC16 and FC17 not supported [4].
+
+Test names:
+`Mitsubishi_FX5U_FC03_126_registers_returns_IllegalDataValue`,
+`Mitsubishi_FX5U_FC16_124_registers_returns_IllegalDataValue`,
+`Mitsubishi_QJ71MT91_FC16_MaskWrite_returns_IllegalFunction`,
+`Mitsubishi_QJ71MT91_FC23_ReadWrite_returns_IllegalFunction`.
+
+## Exception codes
+
+MELSEC MODBUS modules return **only the standard Modbus exception codes 01-04**;
+no proprietary exception codes are exposed on the wire [8][9][11]. Module-
+internal diagnostics (buffer-memory error codes like `7380H`) are logged but
+not returned as Modbus exceptions.
+
+| Code | Name                 | MELSEC trigger                                          |
+|------|----------------------|---------------------------------------------------------|
+| 01   | Illegal Function     | FC17 or FC16 on QJ71MT91/FX3U; FC08 (Diagnostics); FC43 |
+| 02   | Illegal Data Address | Modbus address outside any assignment range             |
+| 03   | Illegal Data Value   | Quantity out of per-FC range (see table above); odd coil-byte count |
+| 04   | Server Device Failure | See below                                              |
+
+- **04 (Server Failure) triggers on MELSEC**:
+    - CPU in STOP or PAUSE during a write to an assignment whose "Access from
+      External Device" permission is set to "Disabled in STOP" [9][11].
+      *With the default "always enabled" setting the write succeeds in STOP
+      mode* — another common trap.
+    - CPU errors (parameter error, watchdog) during any access.
+    - Assignment points to a device range that is not configured (e.g. write
+      to `D16384` when CPU D-device size is 12288).
+- **Write to a "System Area" device** (e.g., `SD` special registers that are
+  CPU-reserved read-only) returns `04`, not `02`, on QJ71MT91 and iQ-R — the
+  assignment is valid, the device exists, but the CPU rejects the write [8][9].
+- **FX3U-ENET / -P502** returns `04` on any write attempt while the CPU is in
+  STOP, regardless of permission settings — the older firmware does not
+  implement the "Access from External Device" granularity that Q/L/iQ-R/iQ-F
+  expose [4].
+- **No rumour of proprietary codes 05-0B** from MELSEC; operators sometimes
+  report "exception 0A" but those traces all came from a third-party gateway
+  sitting between the master and the MELSEC module.
+
+Test names:
+`Mitsubishi_QJ71MT91_STOP_mode_write_with_Disabled_permission_returns_ServerFailure`,
+`Mitsubishi_QJ71MT91_STOP_mode_write_with_default_permission_succeeds`,
+`Mitsubishi_SD_system_register_write_returns_ServerFailure`,
+`Mitsubishi_FX3U_STOP_mode_write_always_returns_ServerFailure`.
+
+## Connection behavior
+
+Max simultaneous Modbus TCP clients, per module [7][8][9][11]:
+
+| Model                | Max TCP connections | Port 502 | Keepalive | Source |
+|----------------------|---------------------|----------|-----------|--------|
+| `QJ71MT91`           | 16 (shared with master role) | Yes | No | [9]    |
+| `LJ71MT91`           | 16                  | Yes      | No        | [10]   |
+| iQ-R built-in / `RJ71EN71` | 16            | Yes      | Configurable (KeepAlive = ON in parameter) | [8] |
+| iQ-F `FX5U` built-in | 8                   | Yes      | Configurable | [7][11] |
+| `FX3U-ENET`          | 8 TCP, but **not port 502** | No (port < 1024 blocked) | No | [4][5] |
+| `FX3U-ENET-P502`     | 8, port 502 enabled | Yes      | No        | [5]    |
+
+- **QJ71MT91's 16 is total connections shared between slave-listen and
+  master-initiated sockets** [9]. A site that uses the same module as both
+  master to downstream VFDs and slave to upstream SCADA splits the 16 pool.
+- **FX3U-ENET port-502 gotcha**: if the engineer loads a configuration with
+  port 502 into a non-P502 ENET module, GX Works shows the download as
+  successful; on next power cycle the module enters error state and the
+  MODBUS listener never starts. This is documented on third-party FX3G
+  integration guides [6].
+- **CPU STOP → RUN transition**: does **not** drop Modbus connections on any
+  MELSEC family. Existing sockets stay open; outstanding requests during the
+  transition may see exception 04 for a few scans but then resume [8][9].
+- **CPU reset (power cycle or `SM1255` forced reset)** drops all Modbus
+  connections and the module re-listens after typically 5-10 seconds.
+- **Idle timeout**: QJ71MT91 and iQ-R have a per-connection "Alive-Check"
+  (idle timer) parameter, default 0 (disabled). If enabled, default 10 s
+  probe interval, 3 retries before close [8][9]. FX5U similar defaults.
+- **Keep-alive (TCP-level)**: only iQ-R / iQ-F expose a TCP keep-alive option
+  (parameter "KeepAlive" in the Ethernet settings); QJ71MT91 and FX3U-ENET
+  do not — so NAT/firewall idle drops require driver-side pinging.
+
+Test names:
+`Mitsubishi_QJ71MT91_17th_connection_refused`,
+`Mitsubishi_FX5U_9th_connection_refused`,
+`Mitsubishi_STOP_to_RUN_transition_preserves_socket`,
+`Mitsubishi_CPU_reset_closes_all_sockets`.
+
+## Behavioral oddities
+
+- **Transaction ID echo**: QJ71MT91 and iQ-R reliably echo the MBAP TxId on
+  every response across firmware revisions; no reports of TxId drops under
+  load [8][9]. FX3U-ENET has an older, less-tested TCP stack; at least one
+  MrPLC thread reports out-of-order TxId echoes under heavy polling on
+  firmware < 1.14 [4]. _Unconfirmed_ on current firmware.
+- **Per-connection request serialization**: all MELSEC slaves serialize
+  requests within a single TCP connection — a new request is not processed
+  until the prior response has been sent. Pipelining multiple requests on one
+  socket causes the module to queue them in buffer memory and respond in
+  order, but **the queue depth is 1** on QJ71MT91 (a second in-flight request
+  is held on the TCP receive buffer, not queued) [9]. Driver should treat
+  Mitsubishi slaves as strictly single-flight per socket.
+- **Partial-frame handling**: QJ71MT91 and iQ-R close the socket on malformed
+  MBAP length fields. FX5U resynchronises at the next valid MBAP header
+  within 100 ms but will emit an error to `SD` diagnostics [11]. Driver must
+  reconnect on half-close and replay.
+- **FX3U UDP vs TCP**: `FX3U-ENET` supports both UDP and TCP MODBUS transports;
+  UDP is lossy and reorders under load. Default is TCP. Some legacy SCADA
+  configurations pinned the module to UDP for multicast discovery — do not
+  select UDP unless the site requires it [4].
+- **Known firmware-revision variants**:
+    - QJ71MT91 ≤ firmware 10052000000 (year-month format): FC15 with coil
+      count that forces byte-count to an odd value silently truncates the
+      last coil. Fixed in later revisions [9]. _Operator-reported_.
+    - FX5U firmware < 1.060: no native MODBUS TCP server — only accessible via
+      a predefined-protocol function block hack. Firmware ≥ 1.060 ships
+      parameter-based server. Our capability probe should read `SD203`
+      (firmware version) and flag < 1.060 as unsupported for server mode [11][12].
+    - iQ-R RJ71EN71 early firmware: possible ABCD word order (rumoured,
+      unconfirmed) [8].
+- **SD (special-register) reads during assignment-parameter load**: while
+  the CPU is loading a new MODBUS device assignment parameter (~1-2 s), the
+  slave returns exception 04 Server Failure on every request. Happens after
+  a parameter write from GX Configurator-MB [9].
+- **iQ-R "Station-based block transfer" collision**: if the RJ71EN71 is also
+  running CC-Link IE Control on the same module, a MODBUS/TCP request that
+  arrives during a CCIE cyclic period is delayed to the next scan — visible
+  as jittery response time, not a failure [8].
+
+Test names:
+`Mitsubishi_QJ71MT91_single_flight_per_socket`,
+`Mitsubishi_FX5U_malformed_MBAP_resync_within_100ms`,
+`Mitsubishi_FX3U_TxId_preserved_across_burst`,
+`Mitsubishi_FX5U_firmware_below_1_060_reports_no_server_mode`.
+
+## Model-specific differences for test coverage
+
+Summary of which quirks differ per model, so test-class naming can reflect them:
+
+| Quirk                                    | QJ71MT91 | LJ71MT91 | iQ-R (RJ71EN71 / built-in) | iQ-F (FX5U) | FX3U-ENET(-P502) |
+|------------------------------------------|----------|----------|----------------------------|-------------|------------------|
+| FC16 Mask-Write supported                | No       | No       | Yes                        | Yes         | No               |
+| FC17 Read/Write Multiple supported       | No       | No       | Yes                        | Yes         | No               |
+| Max connections                          | 16       | 16       | 16                         | 8           | 8                |
+| X/Y numbering base                       | hex      | hex      | hex                        | octal (default) | octal        |
+| 32-bit word order                        | CDAB     | CDAB     | CDAB (firmware-dependent rumour of ABCD) | CDAB | CDAB    |
+| Port 502 supported                       | Yes      | Yes      | Yes                        | Yes         | P502 only        |
+| STOP-mode write permission configurable  | Yes      | Yes      | Yes                        | Yes         | No (always blocks) |
+| TCP keep-alive parameter                 | No       | No       | Yes                        | Yes         | No               |
+| Modbus device assignment — max entries   | 16       | 16       | 16                         | 16          | 8                |
+| Server via parameter (no FB)             | Yes      | Yes      | Yes                        | Yes (fw ≥ 1.060) | Yes         |
+
+- **Test file layout**: `Mitsubishi_QJ71MT91_*`, `Mitsubishi_LJ71MT91_*`,
+  `Mitsubishi_iQR_*`, `Mitsubishi_FX5U_*`, `Mitsubishi_FX3U_ENET_*`,
+  `Mitsubishi_FX3U_ENET_P502_*`. iQ-R built-in Ethernet and the RJ71EN71
+  behave identically for MODBUS/TCP slave purposes and can share a file
+  `Mitsubishi_iQR_*`.
+- **Cross-model shared tests** (word order CDAB, binary not BCD, standard
+  exception codes, 125-register FC03 cap) can live in a single
+  `Mitsubishi_Common_*` fixture.
+
+## References
+
+1. Mitsubishi Electric, *MODBUS Interface Module User's Manual — QJ71MB91*
+   (SH-080578ENG), RS-232/422/485 MODBUS RTU serial module for MELSEC-Q —
+   https://dl.mitsubishielectric.com/dl/fa/document/manual/plc/sh080578eng/sh080578engk.pdf
+2. Inductive Automation, *Ignition Modbus Driver — Mitsubishi Q / iQ-R word
+   order*, documents CDAB convention —
+   https://docs.inductiveautomation.com/docs/8.1/ignition-modules/opc-ua/drivers/modbus-v2
+   and forum discussion https://forum.inductiveautomation.com/t/modbus-tcp-device-word-byte-order/65984
+3. Mitsubishi Electric, *Programmable Controller User's Manual QJ71MB91 MODBUS
+   Interface Module*, Chapter 7 "Parameter Setting" describing the Modbus
+   Device Assignment Parameter block (assignments 1-16, head-device
+   configuration) —
+   https://www.lcautomation.com/dbdocument/29156/QJ71MB91%20Users%20manual.pdf
+4. Mitsubishi Electric, *FX3U-ENET User's Manual* (JY997D18101), Chapter on
+   MODBUS/TCP communication; function code support and connection limits —
+   https://dl.mitsubishielectric.com/dl/fa/document/manual/plc_fx/jy997d18101/jy997d18101h.pdf
+5. Venus Automation, *Mitsubishi FX3U-ENET-P502 Module — Open Port 502 for
+   Modbus TCP/IP* —
+   https://venusautomation.com.au/mitsubishi-fx3u-enet-p502-module-open-port-502-for-modbus-tcp-ip/
+   and FX3U-ENET-ADP user manual (JY997D45801), which confirms the -ADP
+   variant does not support MODBUS —
+   https://dl.mitsubishielectric.com/dl/fa/document/manual/plc_fx/jy997d45801/jy997d45801h.pdf
+6. XML Control / Ubidots integration notes, *FX3G Modbus* — port-502 trap,
+   D-register mapping default, word order reference —
+   https://sites.google.com/site/xmlcontrol/archive/fx3g-modbus
+   and https://ubidots.com/blog/mitsubishi-plc-as-modbus-tcp-server/
+7. FA Support Me, *Modbus TCP on Built-in Ethernet port in iQ-F and iQ-R* —
+   confirms 16-connection limit on iQ-R, 8 on iQ-F, parameter-driven
+   configuration via GX Works3 —
+   https://www.fasupportme.com/portal/en/kb/articles/modbus-tcp-on-build-in-ethernet-port-in-iq-f-and-iq-r-en
+8. Mitsubishi Electric, *MELSEC iQ-R Ethernet User's Manual (Application)*
+   (SH-081259ENG) and *MELSEC iQ-RJ71EN71 User's Manual* Chapter on
+   "Communications Using Modbus/TCP" —
+   https://www.allied-automation.com/wp-content/uploads/2015/02/MITSUBISHI_manual_plc_iq-r_ethernet_users.pdf
+   and https://www.manualslib.com/manual/1533351/Mitsubishi-Electric-Melsec-Iq-Rj71en71.html?page=109
+9. Mitsubishi Electric, *MODBUS/TCP Interface Module User's Manual — QJ71MT91*
+   (SH-080446ENG), exception codes page 248, device assignment parameter
+   pages 116-124, duplicate-assignment-disables-slave note —
+   https://dl.mitsubishielectric.com/dl/fa/document/manual/plc/sh080446eng/sh080446engj.pdf
+10. Mitsubishi Electric, *MELSEC-L Network Features* — LJ71MT91 documented as
+    L-series equivalent of QJ71MT91 with identical MODBUS/TCP behavior —
+    https://us.mitsubishielectric.com/fa/en/products/cnt/programmable-controllers/melsec-l-series/network/features/
+11. Mitsubishi Electric, *MELSEC iQ-F FX5 User's Manual (MODBUS Communication)*
+    (JY997D56101), Chapter 11 "Modbus/TCP Communication Specifications" —
+    function code max-quantity table, frame specification, device assignment
+    defaults —
+    https://dl.mitsubishielectric.com/dl/fa/document/manual/plcf/jy997d56101/jy997d56101h.pdf
+12. MrPLC forum, *FX5U Modbus-TCP Server (Slave)*, firmware ≥ 1.60 enables
+    native server via parameter; earlier firmware required function block —
+    https://mrplc.com/forums/topic/31883-fx5u-modbus-tcp-server-slave/
+    and Industrial Monitor Direct's "FX5U MODBUS TCP Server Workaround"
+    article (reflects older firmware behavior) —
+    https://industrialmonitordirect.com/blogs/knowledgebase/mitsubishi-fx5u-modbus-tcp-server-configuration-workaround
+13. Mitsubishi Electric, *MELSEC iQ-R MODBUS and MODBUS/TCP Reference Manual —
+    RJ71C24 / RJ71C24-R2* (BCN-P5999-1060) — RJ71C24 is serial RTU only,
+    not TCP —
+    https://dl.mitsubishielectric.com/dl/fa/document/manual/plc/bcn-p5999-1060/bcnp59991060b.pdf
+14. HMS Industrial Networks, *eWON and Mitsubishi FX5U PLC* (KB-0264-00) —
+    documents that FX5U X/Y are octal in GX Works3 but hex when viewed as a
+    Q-series PLC through eWON; the project-level hex/octal toggle —
+    https://hmsnetworks.blob.core.windows.net/www/docs/librariesprovider10/downloads-monitored/manuals/knowledge-base/kb-0264-00-en-ewon-and-mitsubishi-fx5u-plc.pdf
+15. Fernhill Software, *Mitsubishi Melsec PLC Data Address* — documents
+    hex-vs-octal device numbering split across MELSEC families —
+    https://www.fernhillsoftware.com/help/drivers/mitsubishi-melsec/data-address-format.html
+16. Inductive Automation support, *Understanding Mitsubishi PLCs* — D registers
+    store signed 16-bit binary, not BCD; DINT combines two consecutive D
+    registers —
+    https://support.inductiveautomation.com/hc/en-us/articles/16517576753165-Understanding-Mitsubishi-PLCs
+17. Mitsubishi Electric, *FXCPU Structured Programming Manual [Device &
+    Common]* (JY997D26001) — FNC 18 BCD and FNC 19 BIN explicit-conversion
+    instructions confirm binary-by-default storage —
+    https://dl.mitsubishielectric.com/dl/fa/document/manual/plc_fx/jy997d26001/jy997d26001l.pdf

docs/v2/modbus-test-plan.md

@@ -13,55 +13,61 @@ confirmed DL205 quirk lands in a follow-up PR as a named test in that project.
 
 ## Harness
 
-**Chosen simulator: ModbusPal** (Java, scriptable). Rationale:
-- Scriptable enough to mimic device-specific behaviors (non-standard register
-  layouts, custom exception codes, intentional response delays).
-- Runs locally, no CI dependency. Tests skip when `localhost:502` (or the configured
-  simulator endpoint) isn't reachable.
-- Free + long-maintained — physical PLC bench is unavailable in most dev
-  environments, and renting cloud PLCs isn't worth the per-test cost.
+**Chosen simulator: pymodbus 3.13.0** (`pip install 'pymodbus[simulator]==3.13.0'`).
+Replaced ModbusPal in PR 43 — see `tests/.../Pymodbus/README.md` for the
+trade-off rationale. Headline reasons:
 
-**Setup pattern** (not yet codified in a script — will land alongside the integration
-test project):
-1. Install ModbusPal, load the per-device `.xmpp` profile from
-   `tests/Driver.Modbus.IntegrationTests/ModbusPal/` (TBD directory).
-2. Start the simulator listening on `localhost:502` (or override via
-   `MODBUS_SIM_ENDPOINT` env var).
-3. `dotnet test` the integration project — tests auto-skip when the endpoint is
-   unreachable, so forgetting to start the simulator doesn't wedge CI.
+- **Headless** pure-Python CLI; no Java GUI, runs cleanly on a CI runner.
+- **Maintained** — current stable 3.13.0; ModbusPal 1.6b is abandoned.
+- **All four standard tables** (HR, IR, coils, DI) configurable; ModbusPal
+  1.6b only exposed HR + coils.
+- **Built-in actions** (`increment`, `random`, `timestamp`, `uptime`) +
+  optional custom-Python actions for declarative dynamic behaviors.
+- **Per-register raw uint16 seeding** — encoding the DL205 string-byte-order
+  / BCD / CDAB-float quirks stays explicit (the quirk math lives in the
+  `_quirk` JSON-comment fields next to each register).
+- Pip-installable on Windows; sidesteps the privileged-port admin
+  requirement by defaulting to TCP **5020** instead of 502.
+
+**Setup pattern**:
+1. `pip install "pymodbus[simulator]==3.13.0"`.
+2. Start the simulator with one of the in-repo profiles:
+   `tests\.../Pymodbus\serve.ps1 -Profile standard` (or `-Profile dl205`).
+3. `dotnet test tests\ZB.MOM.WW.OtOpcUa.Driver.Modbus.IntegrationTests` —
+   tests auto-skip when the endpoint is unreachable. Default endpoint is
+   `localhost:5020`; override via `MODBUS_SIM_ENDPOINT` for a real PLC on its
+   native port 502.
 
 ## Per-device quirk catalog
 
-### AutomationDirect DL205
+### AutomationDirect DL205 / DL260
 
-First known target device. Quirks to document and cover with named tests (to be
-filled in when user validates each behavior in ModbusPal with a DL205 profile):
+First known target device family. **Full quirk catalog with primary-source citations
+and per-quirk integration-test names lives at [`dl205.md`](dl205.md)** — that doc is
+the reference; this section is the testing roadmap.
 
-- **Word order for 32-bit values**: _pending_ — confirm whether DL205 uses ABCD
-  (Modbus TCP standard) or CDAB (Siemens-style word-swap) for Int32/UInt32/Float32.
-  Test name: `DL205_Float32_word_order_is_CDAB` (or `ABCD`, whichever proves out).
-- **Register-zero access**: _pending_ — some DL205 configurations reject FC03 at
-  register 0 with exception code 02 (illegal data address). If confirmed, the
-  integration test suite verifies `ModbusProbeOptions.ProbeAddress` default of 0
-  triggers the rejection and operators must override; test name:
-  `DL205_FC03_at_register_0_returns_IllegalDataAddress`.
-- **Coil addressing base**: _pending_ — DL205 documentation sometimes uses 1-based
-  coil addresses; verify the driver's zero-based addressing matches the physical
-  PLC without an off-by-one adjustment.
-- **Maximum registers per FC03**: _pending_ — Modbus spec caps at 125; some DL205
-  models enforce a lower limit (e.g., 64). Test name:
-  `DL205_FC03_beyond_max_registers_returns_IllegalDataValue`.
-- **Response framing under sustained load**: _pending_ — the driver's
-  single-flight semaphore assumes the server pairs requests/responses by
-  transaction id; at least one DL205 firmware revision is reported to drop the
-  TxId under load. If reproduced in ModbusPal we add a retry + log-and-continue
-  path to `ModbusTcpTransport`.
-- **Exception code on coil write to a protected bit**: _pending_ — some DL205
-  setups protect internal coils; the driver should surface the PLC's exception
-  PDU as `BadNotWritable` rather than `BadInternalError`.
+Confirmed quirks (priority order — top items are highest-impact for our driver
+and ship first as PR 41+):
 
-_User action item_: as each quirk is validated in ModbusPal, replace the _pending_
-marker with the confirmed behavior and file a named test in the integration suite.
+| Quirk | Driver impact | Integration-test name |
+|---|---|---|
+| **String packing**: 2 chars/register, **first char in low byte** (opposite of generic Modbus) | `ModbusDataType.String` decoder must be configurable per-device family — current code assumes high-byte-first | `DL205_String_low_byte_first_within_register` |
+| **Word order CDAB** for Int32/UInt32/Float32 | Already configurable via `ModbusByteOrder.WordSwap`; default per device profile | `DL205_Int32_word_order_is_CDAB` |
+| **BCD-as-default** numeric storage (only IEEE 754 when ladder uses `R` type) | New decoder mode — register reads as `0x1234` for ladder value `1234`, not as decimal `4660` | `DL205_BCD_register_decodes_as_hex_nibbles` |
+| **FC16 capped at 100 registers** (below the spec's 123) | Bulk-write batching must cap per-device-family | `DL205_FC16_101_registers_returns_IllegalDataValue` |
+| **FC03/04 capped at 128** (above the spec's 125) | Less impactful — clients that respect the spec's 125 stay safe | `DL205_FC03_129_registers_returns_IllegalDataValue` |
+| **V-memory octal-to-decimal addressing** (V2000 octal → 0x0400 decimal) | New address-format helper in profile config so operators can write `V2000` instead of computing `1024` themselves | `DL205_Vmem_V2000_maps_to_PDU_0x0400` |
+| **C-relay → coil 3072 / Y-output → coil 2048** offsets | Hard-coded constants in DL205 device profile | `DL205_C0_maps_to_coil_3072`, `DL205_Y0_maps_to_coil_2048` |
+| **Register 0 is valid** (rejects-register-0 rumour was DL05/DL06 relative-mode artefact) | None — current default is safe | `DL205_FC03_register_0_returns_V0_contents` |
+| **Max 4 simultaneous TCP clients** on H2-ECOM100 | Connect-time: handle TCP-accept failure with a clearer error message | `DL205_5th_TCP_connection_refused` |
+| **No TCP keepalive** | Driver-side periodic-probe (already wired via `IHostConnectivityProbe`) | _Covered by existing `ModbusProbeTests`_ |
+| **No mid-stream resync on malformed MBAP** | Already covered — single-flight + reconnect-on-error | _Covered by existing `ModbusDriverTests`_ |
+| **Write-protect exception code: `02` newer / `04` older** | Translate either to `BadNotWritable` | `DL205_FC06_in_ProgramMode_returns_ServerFailure` |
+
+_Operator-reported / unconfirmed_ — covered defensively in the driver but no
+integration tests until reproduced on hardware:
+- TxId drop under load (forum rumour; not reproduced).
+- Pre-2004 firmware ABCD word order (every shipped DL205/DL260 since 2004 is CDAB).
 
 ### Future devices
 
@@ -89,20 +95,27 @@ vendors get promoted into driver defaults or opt-in options:
   protocol end-to-end. The in-memory `FakeTransport` from the unit test suite is
   deliberately not used here — its value is speed + determinism, which doesn't
   help reproduce device-specific issues.
-- **Don't depend on ModbusPal state between tests.** Each test resets the
+- **Don't depend on simulator state between tests.** Each test resets the
   simulator's register bank or uses a unique address range. Avoid relying on
   "previous test left value at register 10" setups that flake when tests run in
-  parallel or re-order.
+  parallel or re-order. Either the test mutates the scratch ranges and restores
+  on finally, or it uses pymodbus's REST API to reset state between facts.
 
 ## Next concrete PRs
 
 - **PR 30 — Integration test project + DL205 profile scaffold** — **DONE**.
   Shipped `tests/ZB.MOM.WW.OtOpcUa.Driver.Modbus.IntegrationTests` with
   `ModbusSimulatorFixture` (TCP-probe, skips with a clear `SkipReason` when the
-  endpoint is unreachable), `DL205/DL205Profile.cs` (tag map stub — one
-  writable holding register at address 100), and `DL205/DL205SmokeTests.cs`
-  (write-then-read round-trip). `ModbusPal/` directory holds the README
-  pointing at the to-be-committed `DL205.xmpp` profile.
-- **PR 31+**: one PR per confirmed DL205 quirk, landing the named test + any
-  driver-side adjustment (e.g., retry on dropped TxId) needed to pass it. Drop
-  the `DL205.xmpp` profile into `ModbusPal/` alongside the first quirk PR.
+  endpoint is unreachable), `DL205/DL205Profile.cs` (tag map stub), and
+  `DL205/DL205SmokeTests.cs` (write-then-read round-trip).
+- **PR 41 — DL205 quirk catalog doc** — **DONE**. `docs/v2/dl205.md`
+  documents every DL205/DL260 Modbus divergence with primary-source citations.
+- **PR 42 — ModbusPal `.xmpp` profiles** — **SUPERSEDED by PR 43**. Replaced
+  with pymodbus JSON because ModbusPal 1.6b is abandoned, GUI-only, and only
+  exposes 2 of the 4 standard tables.
+- **PR 43 — pymodbus JSON profiles** — **DONE**. `Pymodbus/standard.json` +
+  `Pymodbus/dl205.json` + `Pymodbus/serve.ps1` runner. Both bind TCP 5020.
+- **PR 44+**: one PR per confirmed DL205 quirk, landing the named test + any
+  driver-side adjustment (string byte order, BCD decoder, V-memory address
+  helper, FC16 cap-per-device-family) needed to pass it. Each quirk's value
+  is already pre-encoded in `Pymodbus/dl205.json`.

docs/v2/plan.md

@@ -909,6 +909,26 @@ Each step leaves the system runnable. The generic extraction is effectively free
 | 140 | Enterprise shortname = `zb` (UNS level-1 segment) | Closes corrections-doc D4. Matches the existing `ZB.MOM.WW.*` namespace prefix used throughout the codebase; short by design since this segment appears in every equipment path (`zb/warsaw-west/bldg-3/line-2/cnc-mill-05/RunState`); operators already say "ZB" colloquially. Admin UI cluster-create form default-prefills `zb` for the Enterprise field. Production deployments use it directly from cluster-create | 2026-04-17 |
 | 141 | Tier 3 (AppServer IO) cutover is feasible — AVEVA's OI Gateway supports arbitrary upstream OPC UA servers as a documented pattern | Closes corrections-doc E2 with **GREEN-YELLOW** verdict. Multiple AVEVA partners (Software Toolbox, InSource) have published working integrations against four different non-AVEVA upstream servers (TOP Server, OPC Router, OmniServer, Cogent DataHub). No re-architecting of OtOpcUa required. Path: `OPC UA node → OI Gateway → SuiteLink → $DDESuiteLinkDIObject → AppServer attribute`. Recommended AppServer floor: System Platform 2023 R2 Patch 01. Two integrator-burden risks tracked: validation/GxP paperwork (no AVEVA blueprint exists for non-AVEVA upstream servers in Part 11 deployments) and unpublished scale benchmarks (in-house benchmark required before cutover scheduling). See `aveva-system-platform-io-research.md` | 2026-04-17 |
 | 142 | Phase 1 acceptance includes an end-to-end AppServer-via-OI-Gateway smoke test against OtOpcUa | Catches AppServer-specific quirks (cert exchange via reject-and-trust workflow, endpoint URL must NOT include `/discovery` suffix per Inductive Automation forum failure mode, service-account install required because OI Gateway under SYSTEM cannot connect to remote OPC servers, `Basic256Sha256` + `SignAndEncrypt` + LDAP-username token combination must work end-to-end) early — well before the Year 3 tier-3 cutover schedule. Adds one task to `phase-1-configuration-and-admin-scaffold.md` Stream E (Admin smoke test) | 2026-04-17 |
+| 143 | Polly per-capability policy — Read / HistoryRead / Discover / Probe / Alarm-subscribe auto-retry; Write does NOT auto-retry unless the tag metadata carries `[WriteIdempotent]` | Decisions #44-45 forbid auto-retry on Write because a timed-out write can succeed on the device + be replayed by the pipeline, duplicating pulses / alarm acks / counter increments / recipe-step advances. Per-capability policy in the shared Polly layer makes the retry safety story explicit; `WriteIdempotentAttribute` on tag definitions is the opt-in surface | 2026-04-19 |
+| 144 | Polly pipeline key = `(DriverInstanceId, HostName)`, not DriverInstanceId alone | Decision #35 requires per-device isolation. One dead PLC behind a multi-device Modbus driver must NOT open the circuit breaker for healthy sibling hosts. Per-instance pipelines would poison every device behind one bad endpoint | 2026-04-19 |
+| 145 | Tier A/B/C runtime enforcement splits into `MemoryTracking` (all tiers — soft/hard thresholds log + surface, NEVER kill) and `MemoryRecycle` (Tier C only — requires out-of-process topology). Tier A/B hard-breach logs a promotion-to-Tier-C recommendation; the runtime never auto-kills an in-process driver | Decisions #73-74 reserve process-kill protections for Tier C. An in-process Tier A/B "recycle" would kill every OPC UA session + every other in-proc driver for one leaky instance, blast-radius worse than the leak | 2026-04-19 |
+| 146 | Memory watchdog uses the hybrid formula `soft = max(multiplier × baseline, baseline + floor)`, with baseline captured as the median of the first 5 min of `GetMemoryFootprint()` samples post-InitializeAsync. Tier-specific constants: A multiplier=3 floor=50 MB, B multiplier=3 floor=100 MB, C multiplier=2 floor=500 MB. Hard = 2 × soft | Codex adversarial review on the Phase 6.1 plan flagged that hardcoded per-tier MB bands diverge from decision #70's specified formula. Static bands false-trigger on small-footprint drivers + miss meaningful growth on large ones. Observed-baseline + hybrid formula recovers the original intent | 2026-04-19 |
+| 147 | `WedgeDetector` uses demand-aware criteria `(state==Healthy AND hasPendingWork AND noProgressIn > threshold)`. `hasPendingWork` = (Polly bulkhead depth > 0) OR (active MonitoredItem count > 0) OR (queued historian read count > 0). Idle + subscription-only + write-only-burst drivers stay Healthy without false-fault | Previous "no successful Read in N intervals" formulation flipped legitimate idle subscribers, slow historian backfills, and write-heavy drivers to Faulted. The demand-aware check only fires when the driver claims work is outstanding | 2026-04-19 |
+| 148 | LiteDB config cache is **generation-sealed**: `sp_PublishGeneration` writes `<cache-root>/<cluster>/<generationId>.db` as a read-only sealed file; cache reads serve the last-known-sealed generation. Mixed-generation reads are impossible | Prior "refresh on every successful query" cache could serve LDAP role mapping from one generation alongside UNS topology from another, producing impossible states. Sealed-snapshot invariant keeps cache-served reads coherent with a real published state | 2026-04-19 |
+| 149 | `AuthorizationDecision { Allow \| NotGranted \| Denied, IReadOnlyList<MatchedGrant> Provenance }` — tri-state internal model. Phase 6.2 only produces `Allow` + `NotGranted` (grant-only semantics per decision #129); v2.1 Deny widens without API break | bool return would collapse `no-matching-grant` and `explicit-deny` into the same runtime state + UI explanation; provenance record is needed for the audit log anyway. Making the shape tri-state from Phase 6.2 avoids a breaking change in v2.1 | 2026-04-19 |
+| 150 | Data-plane ACL evaluator consumes `NodeAcl` rows joined against the session's resolved LDAP group memberships. `LdapGroupRoleMapping` (decision #105) is control-plane only — routes LDAP groups to Admin UI roles. Zero runtime overlap between the two | Codex adversarial review flagged that Phase 6.2 draft conflated the two — building the data-plane trie from `LdapGroupRoleMapping` would let a user inherit tag permissions from an admin-role claim path never intended as a data-path grant | 2026-04-19 |
+| 151 | `UserAuthorizationState` cached per session but bounded by `MembershipFreshnessInterval` (default 15 min). Past that interval the next hot-path authz call re-resolves LDAP group memberships; failure to re-resolve (LDAP unreachable) → fail-closed (evaluator returns `NotGranted` until memberships refresh successfully) | Previous design cached memberships until session close, so a user removed from a privileged LDAP group could keep authorized access for hours. Bounded freshness + fail-closed covers the revoke-takes-effect story | 2026-04-19 |
+| 152 | Auth cache has its own staleness budget `AuthCacheMaxStaleness` (default 5 min), independent of decision #36's availability-oriented config cache (24 h). Past 5 min on authorization data, evaluator fails closed regardless of whether the underlying config is still serving from cache | Availability-oriented caches trade correctness for uptime. Authorization data is correctness-sensitive — stale ACLs silently extend revoked access. Auth-specific budget keeps the two concerns from colliding | 2026-04-19 |
+| 153 | MonitoredItem carries `(AuthGenerationId, MembershipVersion)` stamp at create time. On every Publish, items with a mismatching stamp re-evaluate; unchanged items stay fast-path. Revoked items drop to `BadUserAccessDenied` within one publish cycle | Create-time-only authorization leaves revoked users receiving data forever; per-publish re-authorization at 100 ms cadence across 50 groups × 6 levels is too expensive. Stamp-then-reevaluate-on-change balances correctness with cost | 2026-04-19 |
+| 154 | ServiceLevel reserves `0` for operator-declared maintenance only; `1` = NoData (unreachable / Faulted); operational states occupy `2..255` in an 8-state matrix (Authoritative-Primary=255, Isolated-Primary=230, Primary-Mid-Apply=200, Recovering-Primary=180, Authoritative-Backup=100, Isolated-Backup=80, Backup-Mid-Apply=50, Recovering-Backup=30, InvalidTopology=2) | OPC UA Part 5 §6.3.34 defines `0=Maintenance` + `1=NoData`; using `0` for our Faulted case collides with spec + triggers spec-compliant clients to enter maintenance-mode cutover. Expanded 8-state matrix covers operational states the 5-state original collapsed together (e.g. Isolated-Primary vs Primary-Mid-Apply were both 200) | 2026-04-19 |
+| 155 | `ServerUriArray` includes self + peers (self first, deterministic ordering), per OPC UA Part 4 §6.6.2.2 | Previous design excluded self from the array — spec violation + clients lose the ability to map server identities consistently during failover | 2026-04-19 |
+| 156 | Redundancy peer health uses a two-layer probe: `/healthz` (2 s) as fast-fail + `UaHealthProbe` (10 s, opens OPC UA client session to peer + reads its `ServiceLevel` node) as the authority signal. HTTP-healthy ≠ UA-authoritative | `/healthz` returns 200 whenever HTTP + config DB/cache is healthy — but a peer can be HTTP-healthy with a broken OPC UA endpoint or a stuck subscription publisher. Using HTTP alone would advertise authority against servers that can't actually publish data | 2026-04-19 |
+| 157 | Publish-generation fencing — coordinator CAS on a monotonic `ConfigGenerationId`; every topology + role decision is generation-stamped; peers reject state propagated from a lower generation. Runtime `InvalidTopology` state (both self-demote to ServiceLevel 2) when >1 Primary detected post-startup | Operator race publishing two drafts with different roles can produce two locally-valid views; without fencing + runtime containment both nodes can serve as Primary until manual intervention | 2026-04-19 |
+| 158 | Apply-window uses named leases keyed to `(ConfigGenerationId, PublishRequestId)` via `await using`. `ApplyLeaseWatchdog` auto-closes any lease older than `ApplyMaxDuration` (default 10 min) | Simple `IDisposable`-counter design leaks on cancellation / async-ownership races; a stuck positive count leaves the node permanently mid-apply. Generation-keyed leases + watchdog bound worst case | 2026-04-19 |
+| 159 | CSV import header row must start with `# OtOpcUaCsv v1` (version marker). Future shape changes bump the version; parser forks per version. Canonical identifier columns follow decision #117: `ZTag, MachineCode, SAPID, EquipmentId, EquipmentUuid` | Without a version marker the CSV schema has no upgrade path — adding a required column breaks every old export silently. The version prefix makes parser dispatch explicit + future-compatible | 2026-04-19 |
+| 160 | Equipment CSV import uses a staged-import pattern: `EquipmentImportBatch` + `EquipmentImportRow` tables receive chunked inserts; `FinaliseImportBatch` is one atomic transaction that applies accepted rows to `Equipment` + `ExternalIdReservation`. Rollback = drop the batch row; `Equipment` never partially mutates | 10k-row single-transaction import holds locks too long; chunked direct writes lose all-or-nothing rollback. Staging + atomic finalize bounds transaction duration + preserves rollback semantics | 2026-04-19 |
+| 161 | UNS drag-reorder impact preview carries a `DraftRevisionToken`; Confirm re-checks against the current draft + returns `409 Conflict / refresh-required` if the draft advanced between preview and commit | Without concurrency control, two operators editing the same draft can overwrite each other's changes silently. Draft-revision token + 409 response makes the race visible + forces refresh | 2026-04-19 |
+| 162 | OPC 40010 Identification sub-folder exposed under each equipment node inherits the Equipment scope's ACL grants — the ACL trie does NOT add a new scope level for Identification | Adding a new scope level for Identification would require every grant to add a second grant for `Equipment/Identification`; inheriting the Equipment scope keeps the grant model flat + prevents operator-forgot-to-grant-Identification access surprises | 2026-04-19 |
 
 ## Reference Documents
 

docs/v2/s7.md

@@ -0,0 +1,485 @@
+# Siemens SIMATIC S7 (S7-1200 / S7-1500 / S7-300 / S7-400 / ET 200SP) — Modbus TCP quirks
+
+Siemens S7 PLCs do *not* speak Modbus TCP natively at the OS/firmware level. Every
+S7 Modbus-TCP-server deployment is either (a) the **`MB_SERVER`** library block
+running on the CPU's PROFINET port (S7-1200 / S7-1500 / CPU 1510SP-series
+ET 200SP), or (b) the **`MODBUSCP`** function block running on a separate
+communication processor (**CP 343-1 / CP 343-1 Lean** on S7-300, **CP 443-1** on
+S7-400), or (c) the **`MODBUSPN`** block on an S7-1500 PN port via a licensed
+library. That means the quirks a Modbus client has to cope with are as much
+"this is how the user's PLC programmer wired the library block up" as "this is
+how the firmware behaves" — the byte-order and coil-mapping rules aren't
+hard-wired into silicon like they are on a DL260. This document catalogues the
+behaviours a driver has to handle across the supported model/CP variants, cites
+primary sources, and names the ModbusPal integration test we'd write for each
+(convention from `docs/v2/modbus-test-plan.md`: `S7_<model>_<behavior>`).
+
+## Model / CP Capability Matrix
+
+| PLC family          | Modbus TCP server mechanism        | Modbus TCP client mechanism       | License required?     | Typical port 502 source                                   |
+|---------------------|------------------------------------|------------------------------------|-----------------------|-----------------------------------------------------------|
+| S7-1200 (V4.0+)     | `MB_SERVER` on integrated PN port  | `MB_CLIENT`                       | No (in TIA Portal)    | CPU's onboard Ethernet [1][2]                              |
+| S7-1500 (all)       | `MB_SERVER` on integrated PN port  | `MB_CLIENT`                       | No (in TIA Portal)    | CPU's onboard Ethernet [1][3]                              |
+| S7-1500 + CP 1543-1 | `MB_SERVER` on CP's IP             | `MB_CLIENT`                       | No                    | Separate CP IP address [1]                                 |
+| ET 200SP CPU (1510SP, 1512SP) | `MB_SERVER` on PN port   | `MB_CLIENT`                       | No                    | CPU's onboard Ethernet [3]                                 |
+| S7-300 + CP 343-1 / CP 343-1 Lean | `MODBUSCP` (FB `MODBUSCP`, instance DB per connection) | Same FB, client mode | **Yes — 2XV9450-1MB00** per CP | CP's Ethernet port [4][5] |
+| S7-400 + CP 443-1   | `MODBUSCP`                         | `MODBUSCP` client mode            | **Yes — 2XV9450-1MB00** per CP | CP's Ethernet port [4] |
+| S7-400H + CP 443-1 (redundant H) | `MODBUSCP_REDUNDANT` / paired FBs | Not typical | Yes | Paired CPs in H-system [6] |
+| S7-300 / S7-400 CPU PN (e.g. CPU 315-2 PN/DP) | `MODBUSPN` library | `MODBUSPN` client mode | **Yes** — Modbus-TCP PN CPU lib | CPU's PN port [7] |
+| "CP 343-1 Lean"     | **Server only** (no client mode supported by Lean) | — | Yes, but with restrictions | CP's Ethernet port [4][5] |
+
+- **CP 343-1 Lean is server-only.** It can host `MODBUSCP` in server mode only;
+  client calls return an immediate error. A surprising number of "Lean + client
+  doesn't work" forum posts trace back to this [5].
+- **Pure OPC UA / PROFINET CPs (CP 1542SP-1, CP 1543-1)** support Modbus TCP on
+  S7-1500 via the same `MB_SERVER`/`MB_CLIENT` instructions by passing the
+  CP's `hw_identifier`. There is no separate "Modbus CP" license needed on
+  S7-1500, unlike S7-300/400 [1].
+- **No S7 Modbus server supports function codes 20/21 (file records),
+  22 (mask write), 23 (read-write multiple), or 43 (device identification).**
+  Sending any of these returns exception `01` (Illegal Function) on every S7
+  variant [1][4]. Our driver must not negotiate FC23 as a "bulk-read optimization"
+  when the profile is S7.
+
+Test names:
+`S7_1200_MBSERVER_Loads_OB1_Cyclic`,
+`S7_CP343_Lean_Client_Mode_Rejected`,
+`S7_All_FC23_Returns_IllegalFunction`.
+
+## Address / DB Mapping
+
+S7 Modbus servers **do not auto-expose PLC memory** — the PLC programmer has to
+wire one area per Modbus table to a DB or process-image region. This is the
+single biggest difference vs. DL205/Modicon/etc., where the memory map is
+fixed at the factory. Our driver must therefore be tolerant of "the same
+`40001` means completely different things on two S7-1200s on the same site."
+
+### S7-1200 / S7-1500 `MB_SERVER`
+
+The `MB_SERVER` instance exposes four Modbus tables to each connected client;
+each table's backing storage is a per-block parameter [1][8]:
+
+| Modbus table        | FCs         | Backing parameter           | Default / typical backing   |
+|---------------------|-------------|-----------------------------|-----------------------------|
+| Coils (0x)          | FC01, FC05, FC15 | *implicit* — Q process image | `%Q0.0`–`%Q1023.7` (→ coil addresses 0–8191) [1][9] |
+| Discrete Inputs (1x)| FC02        | *implicit* — I process image | `%I0.0`–`%I1023.7` (→ discrete addresses 0–8191) [1][9] |
+| Input Registers (3x)| FC04        | *implicit* — M memory or DB (version-dependent) | Some firmware routes FC04 through the same MB_HOLD_REG buffer [1][8] |
+| Holding Registers (4x)| FC03, FC06, FC16 | `MB_HOLD_REG` pointer  | User DB (e.g. `DB10.DBW0`) or `%MW` area [1][2][8] |
+
+- **`MB_HOLD_REG` is a pointer (VARIANT / ANY) into a user-defined DB** whose
+  first byte is holding-register 0 (`40001` in 1-based Modicon form). Byte
+  offset 2 is register 1, byte offset 4 is register 2, etc. [1][2].
+- **The DB *must* have "Optimized block access" UNCHECKED.** Optimized DBs let
+  the compiler reorder fields for alignment; Modbus requires fixed byte
+  offsets. With optimized access on, the compiler accepts the project but
+  `MB_SERVER` returns STATUS `0x8383` (misaligned access) or silently reads
+  zeros [8][10][11]. This is the #1 support-forum complaint.
+- **FC01/FC02/FC05/FC15 hit the Q and I process images directly — not the
+  `MB_HOLD_REG` DB.** Coil address 0 = `%Q0.0`, coil 1 = `%Q0.1`, coil 8 =
+  `%Q1.0`. The S7-1200 system manual publishes this mapping as `00001 → Q0.0`
+  through `09999 → Q1023.7` and `10001 → I0.0` through `19999 → I1023.7` in
+  1-based form; on the wire (0-based) that's coils 0-8191 and discrete inputs
+  0-8191 [9].
+- **`%M` markers are NOT automatically exposed.** To expose `%M` over Modbus
+  the programmer must either (a) copy `%M` to the `MB_HOLD_REG` DB each scan,
+  or (b) define an Array\[0..n\] of Bool inside that DB and copy bits in/out
+  of `%M`. Siemens has no "MB_COIL_REG" parameter analogous to
+  `MB_HOLD_REG` — this confuses users migrating from Schneider [9][12].
+- **Bit ordering within a Modbus holding register sourced from an `Array of
+  Bool`**: S7 stores bool\[0\] at `DBX0.0` which is bit 0 of byte 0 which is
+  the **low byte, low bit** of Modbus register `40001`. A naive client that
+  reads register `40001` and masks `0x0001` gets bool\[0\]. A client that
+  masks `0x8000` gets bool\[15\] because the high byte of the Modbus register
+  is the *second* byte of the DB. Siemens programmers routinely get this
+  wrong in the DB-via-DBX form; `Array[0..n] of Bool` is the recommended
+  layout because it aligns naturally [12][13].
+
+### S7-300/400 + CP 343-1 / CP 443-1 `MODBUSCP`
+
+Different paradigm: per-connection **parameter DB** (template
+`MODBUS_PARAM_CP`) declares a table of up to 8 register-area mappings. Each
+mapping is a tuple `(data_type, DB#, start_offset, length)` where `data_type`
+picks the Modbus table [4]:
+
+- `B#16#1` = Coils
+- `B#16#2` = Discrete Inputs
+- `B#16#3` = Holding Registers
+- `B#16#4` = Input Registers
+
+The `holding_register_start` and analogous `coils_start` parameters declare
+**which Modbus address range** the CP will serve, and the DB pointers say
+where in S7 memory that range lives [4][14]. Unlike `MB_SERVER`, the CP does
+not reach into `%Q`/`%I` directly — *everything* goes through a DB. If an
+address outside the declared ranges is requested, the CP returns exception
+`02` (Illegal Data Address) [4].
+
+Test names:
+`S7_1200_FC03_Reg0_Reads_DB10_DBW0`,
+`S7_1200_Optimized_DB_Returns_0x8383_MisalignedAccess`,
+`S7_1200_FC01_Coil0_Reads_Q0_0`,
+`S7_CP343_FC03_Outside_ParamBlock_Range_Returns_IllegalDataAddress`.
+
+## Data Types and Byte Order
+
+Siemens CPUs store scalars **big-endian** internally ("Motorola format"), which
+is the same byte order Modbus specifies inside each register. So for 16-bit
+values (`Int`, `Word`, `UInt`) the on-the-wire layout is straightforward
+`AB` — high byte of the PLC value in the high byte of the Modbus register
+[15][16]. No byte-swap trap for 16-bit types.
+
+The trap is 32-bit types (`DInt`, `DWord`, `Real`). Here's what actually
+happens across the S7 family:
+
+### S7-1200 / S7-1500 `MB_SERVER`
+
+- **The backing DB stores 32-bit values in big-endian byte order, high word
+  first** — i.e. `ABCD` when viewed as two consecutive Modbus registers. A
+  `Real` at `DB10.DBD0` with value `0x12345678` reads over Modbus as
+  register 0 = `0x1234`, register 1 = `0x5678` [15][16][17].
+- **This is `ABCD`, *not* `CDAB`.** Clients that hard-code CDAB (common default
+  for meters and VFDs) will get wildly wrong floats. Configure the S7 profile
+  with `WordOrder = ABCD` (aka "big-endian word + big-endian byte" aka
+  "high-word first") [15][17].
+- **`MB_SERVER` does not swap.** It's a direct memcpy from the DB bytes to
+  the Modbus payload. Whatever byte order the ladder programmer stored into
+  the DB is what the client receives [17]. This means a programmer who used
+  `MOVE_BLK` from two separate `Word`s into `DBD` with the "wrong" order can
+  produce `CDAB` without realising.
+- **`Real` is IEEE 754 single-precision** — unambiguous, no BCD trap like on
+  DL series [15].
+- **Strings**: S7 `String[n]` has a 2-byte header (max length, current length)
+  *before* the character bytes. A client reading a string over Modbus gets
+  the header in the first register and then the characters two-per-register
+  in high-byte-first order. `WString` is UTF-16 and the header is 4 bytes
+  [18]. Our driver's string decoder must expose the "skip header" option for
+  S7 profile.
+
+### S7-300/400 `MODBUSCP` (CP 343-1 / CP 443-1)
+
+- The CP writes the exact DB bytes onto the wire — again `ABCD` if the DB
+  stores `DInt`/`Real` in native Siemens order [4].
+- **`MODBUSCP` has no `data_type` byte-swap knob.** (The `data_type` parameter
+  names the Modbus table, not the byte order — see the Address Mapping
+  section.) If the other end of the link expects `CDAB`, the programmer has
+  to swap words in ladder before writing the DB [4][14].
+
+### Operator-reported oddity
+
+- Some S7 drivers (Kepware's "Siemens TCP/IP Ethernet" driver, Ignition's
+  "Siemens S7" driver) expose a per-tag `Float Byte Order` with options
+  `ABCD`/`CDAB`/`BADC`/`DCBA` because end-users have encountered every
+  permutation in the field — not because the PLC natively swaps, but because
+  ladder programmers have historically stored floats every which way [19].
+  Our S7 Modbus profile should default to `ABCD` but expose a per-tag
+  override.
+- **Unconfirmed rumour**: that S7-1500 firmware V2.0+ reverses float byte
+  order for `MB_CLIENT` only. Not reproduced; the Siemens forum thread that
+  launched it was a user error (the remote server was the swapper, not the
+  S7) [20]. Treat as false until proven.
+
+Test names:
+`S7_1200_Real_WordOrder_ABCD_Default`,
+`S7_1200_DInt_HighWord_First_At_DBD0`,
+`S7_1200_String_Header_First_Two_Bytes`,
+`S7_CP343_No_Internal_ByteSwap`.
+
+## Coil / Discrete Input Mapping
+
+On `MB_SERVER` the mapping from coil address → S7 bit is fixed at the
+process-image level [1][9][12]:
+
+| Modbus coil / discrete input addr | S7 address    | Notes                               |
+|-----------------------------------|---------------|-------------------------------------|
+| Coil 0 (FC01/05/15)               | `%Q0.0`       | bit 0 of output byte 0              |
+| Coil 7                            | `%Q0.7`       | bit 7 of output byte 0              |
+| Coil 8                            | `%Q1.0`       | bit 0 of output byte 1              |
+| Coil 8191 (max)                   | `%Q1023.7`    | highest exposed output bit          |
+| Discrete input 0 (FC02)           | `%I0.0`       | bit 0 of input byte 0               |
+| Discrete input 8191               | `%I1023.7`    | highest exposed input bit           |
+
+Formulas:
+
+```
+coil_addr   = byte_index * 8 + bit_index    (e.g. %Q5.3 → coil 43)
+discr_addr  = byte_index * 8 + bit_index    (e.g. %I10.2 → disc 82)
+```
+
+- **1-based Modicon form adds 1:** coil 0 (wire) = `00001` (Modicon), etc.
+  Our driver sends the 0-based PDU form, so `%Q0.0` writes to wire address 0.
+- **Writing FC05/FC15 to `%Q` is accepted even while the CPU is in STOP** —
+  the PLC's process image doesn't care about the user program state. But the
+  output won't propagate to the physical module until RUN (see STOP section
+  below) [1][21].
+- **`%M` markers require a DB-backed `Array of Bool`** as described in the
+  Address Mapping section. Our driver can't assume "coil N = MN.0" like it
+  can on Modicon — on S7 it's always Q/I unless the programmer built a
+  mapping DB [12].
+- **Bit-inside-holding-register**: for `Array of Bool` inside the
+  `MB_HOLD_REG` DB, bool[0] is bit 0 of byte 0 → **low byte, low bit** of
+  Modbus register 40001. Most third-party clients probe this in the low
+  byte, so the common case works; the less-common case (bool[8]) is bit 0 of
+  byte 1 → **high byte, low bit** of Modbus register 40001. Clients that
+  test only bool[0] will pass and miss the mis-alignment on bool[8] [12][13].
+
+Test names:
+`S7_1200_Coil_0_Is_Q0_0`,
+`S7_1200_Coil_8_Is_Q1_0`,
+`S7_1200_Discrete_Input_7_Is_I0_7`,
+`S7_1200_Coil_Write_In_STOP_Accepted_But_Output_Frozen`.
+
+## Function Code Support & Max Registers Per Request
+
+| FC | Name                       | S7-1200 / S7-1500 MB_SERVER | CP 343-1 / CP 443-1 MODBUSCP | Max qty per request            |
+|----|----------------------------|-----------------------------|------------------------------|--------------------------------|
+| 01 | Read Coils                 | Yes                         | Yes                          | 2000 bits (spec)               |
+| 02 | Read Discrete Inputs       | Yes                         | Yes                          | 2000 bits (spec)               |
+| 03 | Read Holding Registers     | Yes                         | Yes                          | **125** (spec max)             |
+| 04 | Read Input Registers       | Yes                         | Yes                          | **125**                        |
+| 05 | Write Single Coil          | Yes                         | Yes                          | 1                              |
+| 06 | Write Single Register      | Yes                         | Yes                          | 1                              |
+| 15 | Write Multiple Coils       | Yes                         | Yes                          | 1968 bits (spec) — *see note*  |
+| 16 | Write Multiple Registers   | Yes                         | Yes                          | **123** (spec max for TCP)     |
+| 07 | Read Exception Status      | No (RTU only)               | No                           | —                              |
+| 17 | Report Server ID           | No                          | No                           | —                              |
+| 20/21 | Read/Write File Record  | No                          | No                           | —                              |
+| 22 | Mask Write Register        | No                          | No                           | —                              |
+| 23 | Read/Write Multiple        | No                          | No                           | —                              |
+| 43 | Read Device Identification | No                          | No                           | —                              |
+
+- **S7-1200/1500 honour the full spec maxima** for FC03/04 (125) and FC16
+  (123) [1][22]. No sub-spec cap like DL260's 100-register FC16 limit.
+- **FC15 (Write Multiple Coils) on `MB_SERVER`** writes into `%Q`, which maxes
+  out at 1024 bytes = 8192 bits, but the spec's 1968-bit per-request limit
+  caps any single call first [1][9].
+- **`MB_HOLD_REG` buffer size is bounded by DB size** — max DB size on
+  S7-1200 is 64 KB, on S7-1500 is much larger (several MB depending on CPU),
+  so the practical `MB_HOLD_REG` limit is 32767 16-bit registers on S7-1200
+  and effectively unbounded on S7-1500 [22][23]. The *per-request* limit is
+  still 125.
+- **Read past the end of `MB_HOLD_REG`** returns exception `02` (Illegal
+  Data Address) at the start of the overflow register, not a partial read
+  [1][8].
+- **Request larger than spec max** (e.g. FC03 quantity 126) returns exception
+  `03` (Illegal Data Value). Verified on S7-1200 V4.2 [1][24].
+- **CP 343-1 `MODBUSCP` per-request maxima are spec** (125/125/123/1968/2000),
+  matching the standard [4]. The CP's `MODBUS_PARAM_CP` caps the total
+  *exposed* range, not the per-call quantity.
+
+Test names:
+`S7_1200_FC03_126_Registers_Returns_IllegalDataValue`,
+`S7_1200_FC16_124_Registers_Returns_IllegalDataValue`,
+`S7_1200_FC03_Past_MB_HOLD_REG_End_Returns_IllegalDataAddress`,
+`S7_1200_FC17_ReportServerId_Returns_IllegalFunction`.
+
+## Exception Codes
+
+S7 Modbus servers return only the four standard exception codes [1][4]:
+
+| Code | Name                  | Triggered by                                                         |
+|------|-----------------------|----------------------------------------------------------------------|
+| 01   | Illegal Function      | FC not in the supported list (17, 20-23, 43, any undefined FC)       |
+| 02   | Illegal Data Address  | Register outside `MB_HOLD_REG` / outside `MODBUSCP` param-block range |
+| 03   | Illegal Data Value    | Quantity exceeds spec (FC03/04 > 125, FC16 > 123, FC01/02 > 2000, FC15 > 1968) |
+| 04   | Server Failure        | Runtime error inside MB_SERVER (DB access fault, corrupt DB header, MB_SERVER disabled mid-request) [1][24] |
+
+- **No proprietary exception codes (05/06/0A/0B) are used** on any S7
+  Modbus server [1][4]. Our driver's status-code mapper can treat these as
+  "never observed" on the S7 profile.
+- **CPU in STOP → `MB_SERVER` keeps running if it's in OB1 of the firmware's
+  communication task, but OB1 itself is not scanned.** In practice:
+  - Holding-register *reads* (FC03) continue to return the last DB values
+    frozen at the moment the CPU entered STOP. The `MB_SERVER` block is in
+    OB1 so it isn't re-invoked; however the TCP stack keeps the socket open
+    and returns cached data on subsequent polls [1][21]. **Unconfirmed**
+    whether this is cached in the CP or in the CPU's communication processor;
+    behaviour varies between firmware 4.0 and 4.5 [21].
+  - Holding-register *writes* (FC06/FC16) during STOP return exception `04`
+    (Server Failure) on S7-1200 V4.2+, and return success-but-discarded on
+    older firmware [1][24]. Our driver should treat FC06/FC16 during STOP as
+    non-deterministic and not rely on the response code.
+  - Coil *writes* (FC05/FC15) to `%Q` are *accepted* by the process image
+    during STOP, but the physical output freezes at its last RUN-mode value
+    (or the configured STOP-mode substitute value) until RUN resumes [1][21].
+- **Writing a read-only address via FC06/FC16**: returns `02` (Illegal Data
+  Address), not `04`. S7 does not have "write-protected" holding registers —
+  the programmer either exposes a DB for read-write or doesn't expose it at
+  all [1][12].
+
+STATUS codes (returned in the `STATUS` output of the block, not on the wire):
+
+- `0x0000` — no error.
+- `0x7001` — first call, connection being established.
+- `0x7002` — subsequent cyclic call, connection in progress.
+- `0x8383` — data access error (optimized DB, DB too small, or type mismatch)
+  [10][24].
+- `0x8188` — invalid parameter combination (e.g. MB_MODE out of range) [24].
+- `0x80C8` — mismatched UNIT_ID between MB_CLIENT and `MB_SERVER` [25].
+
+Test names:
+`S7_1200_FC03_Outside_HoldReg_Returns_IllegalDataAddress`,
+`S7_1200_FC16_In_STOP_Returns_ServerFailure`,
+`S7_1200_FC03_In_STOP_Returns_Cached_Values`,
+`S7_1200_No_Proprietary_ExceptionCodes_0x05_0x06_0x0A_0x0B`.
+
+## Connection Behavior
+
+- **Max simultaneous Modbus TCP connections**:
+  - **S7-1200**: shares a pool of 8 open-communication connections across
+    all TCP/UDP/Modbus use. On a CPU 1211C you get 8 total; on 1215C/1217C
+    still 8 shared among PG/HMI/OUC/Modbus. Each `MB_SERVER` instance
+    reserves one. A typical site with a PG + 1 HMI + 2 Modbus clients uses
+    4 of the 8 [1][26].
+  - **S7-1500**: up to **8 concurrent Modbus TCP server connections** per
+    `MB_SERVER` port, across multiple `MB_SERVER` instance DBs each with a
+    unique port. Total open-communication resources depend on CPU (e.g.
+    CPU 1515-2 PN supports 128 OUC connections total; Modbus is a subset)
+    [1][27].
+  - **CP 343-1 Lean**: up to **8** simultaneous Modbus TCP connections on
+    port 502 [4][5]. Exceeding this refuses at TCP accept.
+  - **CP 443-1 Advanced**: up to **16** simultaneous Modbus TCP connections
+    [4].
+- **Multi-connection model on `MB_SERVER`**: one instance DB per connection.
+  An instance DB listening on port 502 serves exactly one connection at a
+  time; to serve N simultaneous clients you need N instance DBs each with a
+  unique port (502/503/504...). **This is a real trap** — most users expect
+  port 502 to multiplex [27][28]. Our driver must not assume port 502 is the
+  only listener.
+- **Keep-alive**: S7-1500's TCP stack does send TCP keepalives (default
+  every ~30 s) but the interval is not exposed as a configurable. S7-1200 is
+  the same. CP 343-1 keepalives are configured via HW Config → CP properties
+  → Options → "Send keepalive" (default **off** on older firmware, default
+  **on** on firmware V3.0+) [1][29]. Driver-side keepalive is still
+  advisable for S7-300/CP 343-1 on old firmware.
+- **Idle-timeout close**: `MB_SERVER` does *not* close idle sockets on its
+  own. However, the TCP stack on S7-1500 will close a socket that fails
+  three consecutive keepalive probes (~2 minutes). Forum reports describe
+  `MB_SERVER` connections "dying overnight" on S7-1500 when an HMI stops
+  polling — the fix is to enable driver-side periodic reads or driver-side
+  TCP keepalive [29][30].
+- **Reconnect after power cycle**: MB_SERVER starts listening ~1-2 seconds
+  after the CPU reaches RUN. If the client reconnects during STARTUP OB
+  (OB100), the connection is refused until OB1 runs the block at least once.
+  Our driver should back off and retry on `ECONNREFUSED` for the first 5
+  seconds after a power-cycle detection [1][24].
+- **Unit Identifier**: `MB_SERVER` accepts **any** Unit ID by default — there
+  is no configurable filter; the PLC ignores the Unit ID field entirely.
+  `MB_CLIENT` defaults to Unit ID = 255 as "ignore" [25][31]. Some
+  third-party Modbus-TCP gateways *require* a specific Unit ID; sending
+  anything to S7 is safe. **CP 343-1 `MODBUSCP`** also accepts any Unit ID
+  in server mode, but the parameter DB exposes a `single_write` / `unit_id`
+  field on newer firmware to allow filtering [4].
+
+Test names:
+`S7_1200_9th_TCP_Connection_Refused_On_8_Conn_Pool`,
+`S7_1500_Port_503_Required_For_Second_Instance`,
+`S7_1200_Reconnect_After_Power_Cycle_Succeeds_Within_5s`,
+`S7_1200_Unit_ID_Ignored_Any_Accepted`.
+
+## Behavioral Oddities
+
+- **Transaction ID echo** is reliable on all S7 variants. `MB_SERVER` copies
+  the MBAP TxId verbatim. No known firmware that drops TxId under load [1][31].
+- **Request serialization**: a single `MB_SERVER` instance serializes
+  requests from its one connected client — the block processes one PDU per
+  call and calls happen once per OB1 scan. OB1 scan time of 5-50 ms puts an
+  upper bound on throughput at ~20-200 requests/sec per connection [1][30].
+  Multiple `MB_SERVER` instances (one per port) run in parallel because OB1
+  calls them sequentially within the same scan.
+- **OB1 scan coupling**: `MB_SERVER` must be called cyclically from OB1 (or
+  another cyclic OB). If the programmer puts it in a conditional branch
+  that doesn't fire every scan, requests time out. The STATUS `0x7002`
+  "in progress" is *expected* between calls, not an error [1][24].
+- **Optimized DB backing `MB_HOLD_REG`** — already covered in Address
+  Mapping; STATUS becomes `0x8383`. This is the most common deployment bug
+  on S7-1500 projects migrated from older S7-1200 examples [10][11].
+- **CPU STOP behaviour** — covered in Exception Codes section. The short
+  version: reads may return stale data without error; writes return exception
+  04 on modern firmware.
+- **Partial-frame disconnect**: S7-1200/1500 TCP stack closes the socket on
+  any MBAP header where the `Length` field doesn't match the PDU length.
+  Driver must detect half-close and reconnect [1][29].
+- **MBAP `Protocol ID` must be 0**. Any non-zero value causes the CP/CPU to
+  drop the frame silently (no response, no RST) on S7-1500 firmware V2.0
+  through V2.9; firmware V3.0+ sends an RST [1][30]. *Unconfirmed* whether
+  V3.1 still sends RST or returns to silent drop.
+- **FC01/FC02 access outside `%Q`/`%I` range**: on S7-1200, requesting
+  coil address 8192 (= `%Q1024.0`) returns exception `02` (Illegal Data
+  Address) [1][9]. The 8192-bit hard cap is a process-image size limit on
+  the CPU, not a Modbus protocol limit.
+- **`MB_CLIENT` UNIT_ID mismatch with remote `MB_SERVER`** produces STATUS
+  `0x80C8` on the client side, and the server silently discards the frame
+  (no response on the wire) [25]. This matters for Modbus-TCP-to-RTU
+  gateway scenarios where the Unit ID picks the RTU slave.
+- **Non-IEEE REAL / BCD**: S7 does *not* use BCD like DirectLOGIC. `Real` is
+  always IEEE 754 single-precision. `LReal` (8-byte double) occupies 4
+  Modbus registers in `ABCDEFGH` order (big-endian byte, big-endian word)
+  [15][18].
+- **`MODBUSCP` single-write** on CP 343-1: a parameter `single_write` in the
+  param DB controls whether FC06 on a register in the "holding register"
+  area triggers a callback to the user program vs. updates the DB directly.
+  Default is direct update. If a ladder programmer enables the callback
+  without implementing the callback OB, FC06 writes hang for 5 seconds then
+  return exception `04` [4].
+
+Test names:
+`S7_1200_TxId_Preserved_Across_Burst_Of_50_Requests`,
+`S7_1200_MBSERVER_Throughput_Capped_By_OB1_Scan`,
+`S7_1200_MBAP_ProtocolID_NonZero_Frame_Dropped`,
+`S7_1200_Partial_MBAP_Causes_Half_Close`.
+
+## Model-specific Differences Worth Separate Test Coverage
+
+- **S7-1200 V4.0 vs V4.4+**: Older firmware does not support `WString` over
+  `MB_HOLD_REG` and returns `0x8383` if the DB contains one [18][24]. Test
+  both firmware bands separately.
+- **S7-1500 vs S7-1200**: S7-1500 supports multiple `MB_SERVER` instances on
+  the *same* CPU with different ports cleanly; S7-1200 can too but its
+  8-connection pool is shared tighter [1][27]. Throughput per-connection is
+  ~5× faster on S7-1500 because the comms task runs on a dedicated core.
+- **S7-300 + CP 343-1 vs S7-1200/1500**: parameter-block mapping (not
+  `MB_HOLD_REG` pointer), per-connection license, no `%Q`/`%I` direct
+  access for coils (everything goes through a DB), different STATUS codes
+  (`DONE`/`ERROR`/`STATUS` word pairs vs. the single STATUS word) [4][14].
+  Driver-side it's a different profile.
+- **CP 343-1 Lean vs CP 343-1 Advanced**: Lean is server-only; Advanced is
+  client + server. Lean's max connections = 8; Advanced = 16 [4][5].
+- **CP 443-1 in S7-400H**: uses `MODBUSCP_REDUNDANT` which presents two
+  Ethernet endpoints that fail over. Our driver's redundancy support should
+  recognize the S7-400H profile as "two IP addresses, same server state,
+  advertise via `ServerUriArray`" [6].
+- **ET 200SP CPU (1510SP / 1512SP)**: behaves as S7-1500 from `MB_SERVER`
+  perspective. No known deltas [3].
+
+## References
+
+1. Siemens Industry Online Support, *Modbus/TCP Communication between SIMATIC S7-1500 / S7-1200 and Modbus/TCP Controllers with Instructions `MB_CLIENT` and `MB_SERVER`*, Entry ID 102020340, V6 (Feb 2021). https://cache.industry.siemens.com/dl/files/340/102020340/att_118119/v6/net_modbus_tcp_s7-1500_s7-1200_en.pdf
+2. Siemens TIA Portal Online Docs, *MB_SERVER instruction*. https://docs.tia.siemens.cloud/r/simatic_s7_1200_manual_collection_eses_20/communication-processor-and-modbus-tcp/modbus-communication/modbus-tcp/modbus-tcp-instructions/mb_server-communicate-using-profinet-as-modbus-tcp-server-instruction
+3. Siemens, *SIMATIC S7-1500 Communication Function Manual* (covers ET 200SP CPU). http://public.eandm.com/Public_Docs/s71500_communication_function_manual_en-US_en-US.pdf
+4. Siemens Industry Online Support, *SIMATIC Modbus/TCP communication using CP 343-1 and CP 443-1 — Programming Manual*, Entry ID 103447617. https://cache.industry.siemens.com/dl/files/617/103447617/att_106971/v1/simatic_modbus_tcp_cp_en-US_en-US.pdf
+5. Siemens Industry Online Support FAQ *"Which technical data applies for the SIMATIC Modbus/TCP software for CP 343-1 / CP 443-1?"*, Entry ID 104946406. https://www.industry-mobile-support.siemens-info.com/en/article/detail/104946406
+6. Siemens Industry Online Support, *Redundant Modbus/TCP communication via CP 443-1 in S7-400H systems*, Entry ID 109739212. https://cache.industry.siemens.com/dl/files/212/109739212/att_887886/v1/SIMATIC_modbus_tcp_cp_red_e_en-US.pdf
+7. Siemens Industry Online Support, *SIMATIC MODBUS (TCP) PN CPU Library — Programming and Operating Manual 06/2014*, Entry ID 75330636. https://support.industry.siemens.com/cs/attachments/75330636/ModbusTCPPNCPUen.pdf
+8. DMC Inc., *Using an S7-1200 PLC as a Modbus TCP Slave*. https://www.dmcinfo.com/blog/27313/using-an-s7-1200-plc-as-a-modbus-tcp-slave/
+9. Siemens, *SIMATIC S7-1200 System Manual* (V4.x), "MB_SERVER" pages 736-742. https://www.manualslib.com/manual/1453610/Siemens-S7-1200.html?page=736
+10. lamaPLC, *Simatic Modbus S7 error- and statuscodes*. https://www.lamaplc.com/doku.php?id=simatic:errorcodes
+11. ScadaProtocols, *How to Configure Modbus TCP on Siemens S7-1200 (TIA Portal Step-by-Step)*. https://scadaprotocols.com/modbus-tcp-siemens-s7-1200-tia-portal/
+12. Industrial Monitor Direct, *Reading and Writing Memory Bits via Modbus TCP on S7-1200*. https://industrialmonitordirect.com/blogs/knowledgebase/reading-and-writing-memory-bits-via-modbus-tcp-on-s7-1200
+13. PLCtalk forum *"Siemens S7-1200 modbus understanding"*. https://www.plctalk.net/forums/threads/siemens-s7-1200-modbus-understanding.104119/
+14. Siemens SIMATIC S7 Manual, "Function block MODBUSCP — Functionality" (ManualsLib p29). https://www.manualslib.com/manual/1580661/Siemens-Simatic-S7.html?page=29
+15. Chipkin, *How Real (Floating Point) and 32-bit Data is Encoded in Modbus*. https://store.chipkin.com/articles/how-real-floating-point-and-32-bit-data-is-encoded-in-modbus-rtu-messages
+16. Siemens Industry Online Support forum, *MODBUS DATA conversion in S7-1200 CPU*, Entry ID 97287. https://support.industry.siemens.com/forum/WW/en/posts/modbus-data-converson-in-s7-1200-cpu/97287
+17. Industrial Monitor Direct, *Siemens S7-1500 MB_SERVER Modbus TCP Configuration Guide*. https://industrialmonitordirect.com/de/blogs/knowledgebase/siemens-s7-1500-mb-server-modbus-tcp-configuration-guide
+18. Siemens TIA Portal, *Data types in SIMATIC S7-1200/1500 — String/WString header layout* (system manual, "Elementary Data Types").
+19. Kepware / PTC, *Siemens TCP/IP Ethernet Driver Help*, "Byte / Word Order" tag property. https://www.opcturkey.com/uploads/siemens-tcp-ip-ethernet-manual.pdf
+20. Siemens SiePortal forum, *Transfer float out of words*, Entry ID 187811. https://sieportal.siemens.com/en-ww/support/forum/posts/transfer-float-out-of-words/187811 _(operator-reported "S7 swaps float" claim — traced to remote-device issue; **unconfirmed**.)_
+21. Siemens SiePortal forum, *S7-1200 communication with Modbus TCP*, Entry ID 133086. https://support.industry.siemens.com/forum/WW/en/posts/s7-1200-communication-with-modbus-tcp/133086
+22. Siemens SiePortal forum, *S7-1500 MB Server Holding Register Max Word*, Entry ID 224636. https://support.industry.siemens.com/forum/WW/en/posts/s7-1500-mb-server-holding-register-max-word/224636
+23. Siemens, *SIMATIC S7-1500 Technical Specifications* — CPU-specific DB size limits in each CPU manual's "Memory" table.
+24. Siemens TIA Portal Online Docs, *Error messages (S7-1200, S7-1500) — Modbus instructions*. https://docs.tia.siemens.cloud/r/en-us/v20/modbus-rtu-s7-1200-s7-1500/error-messages-s7-1200-s7-1500
+25. Industrial Monitor Direct, *Fix Siemens S7-1500 MB_Client UnitID Error 80C8*. https://industrialmonitordirect.com/blogs/knowledgebase/troubleshooting-mb-client-on-s7-1500-cpu-1515sp-modbus-tcp
+26. Siemens SiePortal forum, *How many TCP connections can the S7-1200 make?*, Entry ID 275570. https://support.industry.siemens.com/forum/WW/en/posts/how-many-tcp-connections-can-the-s7-1200-make/275570
+27. Siemens SiePortal forum, *Simultaneous connections of Modbus TCP*, Entry ID 189626. https://support.industry.siemens.com/forum/ww/en/posts/simultaneous-connections-of-modbus-tcp/189626
+28. Siemens SiePortal forum, *How many Modbus TCP IP clients can read simultaneously from S7-1517*, Entry ID 261569. https://support.industry.siemens.com/forum/WW/en/posts/how-many-modbus-tcp-ip-client-can-read-simultaneously-in-s7-1517/261569
+29. Industrial Monitor Direct, *Troubleshooting Intermittent Modbus TCP Connections on S7-1500 PLC*. https://industrialmonitordirect.com/blogs/knowledgebase/troubleshooting-intermittent-modbus-tcp-connections-on-s7-1500-plc
+30. PLCtalk forum *"S7-1500 modbus tcp speed?"*. https://www.plctalk.net/forums/threads/s7-1500-modbus-tcp-speed.114046/
+31. Siemens SiePortal forum, *MB_Unit_ID parameter in Modbus TCP*, Entry ID 156635. https://support.industry.siemens.com/forum/WW/en/posts/mb-unit-id-parameter-in-modbus-tcp/156635

docs/v2/v2-release-readiness.md

@@ -0,0 +1,102 @@
+# v2 Release Readiness
+
+> **Last updated**: 2026-04-19 (Phase 6.4 data layer merged)
+> **Status**: **NOT YET RELEASE-READY** — four Phase 6 data-layer ships have landed, but several production-path wirings are still deferred.
+
+This doc is the single view of where v2 stands against its release criteria. Update it whenever a deferred follow-up closes or a new release blocker is discovered.
+
+## Release-readiness dashboard
+
+| Phase | Shipped | Status |
+|---|---|---|
+| Phase 0 — Rename + entry gate | ✓ | Shipped |
+| Phase 1 — Configuration + Admin scaffold | ✓ | Shipped (some UI items deferred to 6.4) |
+| Phase 2 — Galaxy driver split (Proxy/Host/Shared) | ✓ | Shipped |
+| Phase 3 — OPC UA server + LDAP + security profiles | ✓ | Shipped |
+| Phase 4 — Redundancy scaffold (entities + endpoints) | ✓ | Shipped (runtime closes in 6.3) |
+| Phase 5 — Drivers | ⚠ partial | Galaxy / Modbus / S7 / OpcUaClient shipped; AB CIP / AB Legacy / TwinCAT / FOCAS deferred (task #120) |
+| Phase 6.1 — Resilience & Observability | ✓ | **SHIPPED** (PRs #78–83) |
+| Phase 6.2 — Authorization runtime | ◐ core | **SHIPPED (core)** (PRs #84–88); dispatch wiring + Admin UI deferred |
+| Phase 6.3 — Redundancy runtime | ◐ core | **SHIPPED (core)** (PRs #89–90); coordinator + UA-node wiring + Admin UI + interop deferred |
+| Phase 6.4 — Admin UI completion | ◐ data layer | **SHIPPED (data layer)** (PRs #91–92); Blazor UI + OPC 40010 address-space wiring deferred |
+
+**Aggregate test counts:** 906 baseline (pre-Phase-6) → **1159 passing** across Phase 6. One pre-existing Client.CLI `SubscribeCommandTests.Execute_PrintsSubscriptionMessage` flake tracked separately.
+
+## Release blockers (must close before v2 GA)
+
+Ordered by severity + impact on production fitness.
+
+### Security — Phase 6.2 dispatch wiring (task #143)
+
+The `AuthorizationGate` + `IPermissionEvaluator` + `PermissionTrie` stack is fully built and unit-tested, **but no dispatch path in `DriverNodeManager` actually calls it**. Every OPC UA Read / Write / HistoryRead / Browse / Call / CreateMonitoredItems on the live server currently runs through the pre-Phase-6.2 code path (which gates Write via `WriteAuthzPolicy` only — no per-tag ACL).
+
+Closing this requires:
+
+- Thread `AuthorizationGate` through `OpcUaApplicationHost → OtOpcUaServer → DriverNodeManager` (the same plumbing path Phase 6.1's `DriverResiliencePipelineBuilder` took).
+- Build a `NodeScopeResolver` that maps `fullRef → NodeScope` via a live DB lookup of the tag's UnsArea / UnsLine / Equipment path. Cache per generation.
+- Call `gate.IsAllowed(identity, operation, scope)` in OnReadValue / OnWriteValue / the four HistoryRead paths / Browse / Call / Acknowledge/Confirm/Shelve / CreateMonitoredItems / TransferSubscriptions.
+- Stamp MonitoredItems with `(AuthGenerationId, MembershipVersion)` per decision #153 so revoked grants surface `BadUserAccessDenied` within one publish cycle.
+- 3-user integration matrix covering each operation × allow/deny.
+
+**Strict mode default**: start lax (`Authorization:StrictMode = false`) during rollout so deployments without populated ACLs keep working. Flip to strict once ACL seeding lands for production clusters.
+
+### Config fallback — Phase 6.1 Stream D wiring (task #136)
+
+`ResilientConfigReader` + `GenerationSealedCache` + `StaleConfigFlag` all exist but nothing consumes them. The `NodeBootstrap` path still uses the original single-file `LiteDbConfigCache` via `ILocalConfigCache`; `sp_PublishGeneration` doesn't call `GenerationSealedCache.SealAsync` after commit; the Configuration read services don't wrap queries in `ResilientConfigReader.ReadAsync`.
+
+Closing this requires:
+
+- `sp_PublishGeneration` (or its EF-side wrapper) calls `SealAsync` after successful commit.
+- DriverInstance enumeration, LdapGroupRoleMapping fetches, cluster + namespace metadata reads route through `ResilientConfigReader.ReadAsync`.
+- Integration test: SQL container kill mid-operation → serves sealed snapshot, `UsingStaleConfig` = true, driver stays Healthy, `/healthz` body reflects the flag.
+
+### Redundancy — Phase 6.3 Streams A/C/F (tasks #145, #147, #150)
+
+`ServiceLevelCalculator` + `RecoveryStateManager` + `ApplyLeaseRegistry` exist as pure logic. **No code invokes them at runtime.** The OPC UA server still publishes a static `ServiceLevel`; `ServerUriArray` still carries only self; no coordinator reads cluster topology; no peer probing.
+
+Closing this requires:
+
+- `RedundancyCoordinator` singleton reads `ClusterNode` + peer list at startup (Stream A).
+- `PeerHttpProbeLoop` + `PeerUaProbeLoop` feed the calculator.
+- OPC UA node wiring: `ServiceLevel` becomes a live `BaseDataVariable` on calculator observer output; `ServerUriArray` includes self + peers; `RedundancySupport` static from `RedundancyMode` (Stream C).
+- `sp_PublishGeneration` wraps in `await using var lease = coordinator.BeginApplyLease(...)` so the `PrimaryMidApply` band fires during actual publishes.
+- Client interop matrix validation against Ignition / Kepware / Aveva OI Gateway (Stream F).
+
+### Remaining drivers (task #120)
+
+AB CIP, AB Legacy, TwinCAT ADS, FOCAS drivers are planned but unshipped. Decision pending on whether these are release-blocking for v2 GA or can slip to a v2.1 follow-up.
+
+## Nice-to-haves (not release-blocking)
+
+- **Admin UI** — Phase 6.1 Stream E.2/E.3 (`/hosts` column refresh), Phase 6.2 Stream D (`RoleGrantsTab` + `AclsTab` Probe), Phase 6.3 Stream E (`RedundancyTab`), Phase 6.4 Streams A/B UI pieces, Stream C DiffViewer, Stream D `IdentificationFields.razor`. Tasks #134, #144, #149, #153, #155, #156, #157.
+- **Background services** — Phase 6.1 Stream B.4 `ScheduledRecycleScheduler` HostedService (task #137), Phase 6.1 Stream A analyzer (task #135 — Roslyn analyzer asserting every capability surface routes through `CapabilityInvoker`).
+- **Multi-host dispatch** — Phase 6.1 Stream A follow-up (task #135). Currently every driver gets a single pipeline keyed on `driver.DriverInstanceId`; multi-host drivers (Modbus with N PLCs) need per-PLC host resolution so failing PLCs trip per-PLC breakers without poisoning siblings. Decision #144 requires this but we haven't wired it yet.
+
+## Running the release-readiness check
+
+```bash
+pwsh ./scripts/compliance/phase-6-all.ps1
+```
+
+This meta-runner invokes each `phase-6-N-compliance.ps1` script in sequence and reports an aggregate PASS/FAIL. It is the single-command verification that what we claim is shipped still compiles + tests pass + the plan-level invariants are still satisfied.
+
+Exit 0 = every phase passes its compliance checks + no test-count regression.
+
+## Release-readiness exit criteria
+
+v2 GA requires all of the following:
+
+- [ ] All four Phase 6.N compliance scripts exit 0.
+- [ ] `dotnet test ZB.MOM.WW.OtOpcUa.slnx` passes with ≤ 1 known-flake failure.
+- [ ] Release blockers listed above all closed (or consciously deferred to v2.1 with a written decision).
+- [ ] Production deployment checklist (separate doc) signed off by Fleet Admin.
+- [ ] At least one end-to-end integration run against the live Galaxy on the dev box succeeds.
+- [ ] OPC UA conformance test (CTT or UA Compliance Test Tool) passes against the live endpoint.
+- [ ] Non-transparent redundancy cutover validated with at least one production client (Ignition 8.3 recommended — see decision #85).
+
+## Change log
+
+- **2026-04-19** — Phase 6.4 data layer merged (PRs #91–92). Phase 6 core complete. Capstone doc created.
+- **2026-04-19** — Phase 6.3 core merged (PRs #89–90). `ServiceLevelCalculator` + `RecoveryStateManager` + `ApplyLeaseRegistry` land as pure logic; coordinator / UA-node wiring / Admin UI / interop deferred.
+- **2026-04-19** — Phase 6.2 core merged (PRs #84–88). `AuthorizationGate` + `TriePermissionEvaluator` + `LdapGroupRoleMapping` land; dispatch wiring + Admin UI deferred.
+- **2026-04-19** — Phase 6.1 shipped (PRs #78–83). Polly resilience + Tier A/B/C stability + health endpoints + LiteDB generation-sealed cache + Admin `/hosts` data layer all live.

scripts/compliance/phase-6-1-compliance.ps1

@@ -0,0 +1,139 @@
+<#
+.SYNOPSIS
+    Phase 6.1 exit-gate compliance check. Each check either passes or records a
+    failure; non-zero exit = fail.
+
+.DESCRIPTION
+    Validates Phase 6.1 (Resilience & Observability runtime) completion. Checks
+    enumerated in `docs/v2/implementation/phase-6-1-resilience-and-observability.md`
+    §"Compliance Checks (run at exit gate)".
+
+    Runs a mix of file-presence checks, text-pattern sweeps over the committed
+    codebase, and a full `dotnet test` pass to exercise the invariants each
+    class encodes. Meant to be invoked from repo root.
+
+.NOTES
+    Usage:  pwsh ./scripts/compliance/phase-6-1-compliance.ps1
+    Exit:   0 = all checks passed; non-zero = one or more FAILs
+#>
+[CmdletBinding()]
+param()
+
+$ErrorActionPreference = 'Stop'
+$script:failures = 0
+$repoRoot = (Resolve-Path (Join-Path $PSScriptRoot '..\..')).Path
+
+function Assert-Pass {
+    param([string]$Check)
+    Write-Host "  [PASS] $Check" -ForegroundColor Green
+}
+
+function Assert-Fail {
+    param([string]$Check, [string]$Reason)
+    Write-Host "  [FAIL] $Check - $Reason" -ForegroundColor Red
+    $script:failures++
+}
+
+function Assert-Deferred {
+    param([string]$Check, [string]$FollowupPr)
+    Write-Host "  [DEFERRED] $Check  (follow-up: $FollowupPr)" -ForegroundColor Yellow
+}
+
+function Assert-FileExists {
+    param([string]$Check, [string]$RelPath)
+    $full = Join-Path $repoRoot $RelPath
+    if (Test-Path $full) { Assert-Pass "$Check  ($RelPath)" }
+    else { Assert-Fail $Check "missing file: $RelPath" }
+}
+
+function Assert-TextFound {
+    param([string]$Check, [string]$Pattern, [string[]]$RelPaths)
+    foreach ($p in $RelPaths) {
+        $full = Join-Path $repoRoot $p
+        if (-not (Test-Path $full)) { continue }
+        if (Select-String -Path $full -Pattern $Pattern -Quiet) {
+            Assert-Pass "$Check  (matched in $p)"
+            return
+        }
+    }
+    Assert-Fail $Check "pattern '$Pattern' not found in any of: $($RelPaths -join ', ')"
+}
+
+Write-Host ""
+Write-Host "=== Phase 6.1 compliance - Resilience & Observability runtime ===" -ForegroundColor Cyan
+Write-Host ""
+
+Write-Host "Stream A - Resilience layer"
+Assert-FileExists "Pipeline builder present" "src/ZB.MOM.WW.OtOpcUa.Core/Resilience/DriverResiliencePipelineBuilder.cs"
+Assert-FileExists "CapabilityInvoker present" "src/ZB.MOM.WW.OtOpcUa.Core/Resilience/CapabilityInvoker.cs"
+Assert-FileExists "WriteIdempotentAttribute present" "src/ZB.MOM.WW.OtOpcUa.Core.Abstractions/WriteIdempotentAttribute.cs"
+Assert-TextFound "Pipeline key includes HostName (per-device isolation)" "PipelineKey\(.+HostName" @("src/ZB.MOM.WW.OtOpcUa.Core/Resilience/DriverResiliencePipelineBuilder.cs")
+Assert-TextFound "OnReadValue routes through invoker" "DriverCapability\.Read," @("src/ZB.MOM.WW.OtOpcUa.Server/OpcUa/DriverNodeManager.cs")
+Assert-TextFound "OnWriteValue routes through invoker" "ExecuteWriteAsync" @("src/ZB.MOM.WW.OtOpcUa.Server/OpcUa/DriverNodeManager.cs")
+Assert-TextFound "HistoryRead routes through invoker" "DriverCapability\.HistoryRead" @("src/ZB.MOM.WW.OtOpcUa.Server/OpcUa/DriverNodeManager.cs")
+Assert-FileExists "Galaxy supervisor CircuitBreaker preserved" "src/ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Proxy/Supervisor/CircuitBreaker.cs"
+Assert-FileExists "Galaxy supervisor Backoff preserved" "src/ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Proxy/Supervisor/Backoff.cs"
+
+Write-Host ""
+Write-Host "Stream B - Tier A/B/C runtime"
+Assert-FileExists "DriverTier enum present" "src/ZB.MOM.WW.OtOpcUa.Core.Abstractions/DriverTier.cs"
+Assert-TextFound "DriverTypeMetadata requires Tier" "DriverTier Tier" @("src/ZB.MOM.WW.OtOpcUa.Core.Abstractions/DriverTypeRegistry.cs")
+Assert-FileExists "MemoryTracking present" "src/ZB.MOM.WW.OtOpcUa.Core/Stability/MemoryTracking.cs"
+Assert-FileExists "MemoryRecycle present" "src/ZB.MOM.WW.OtOpcUa.Core/Stability/MemoryRecycle.cs"
+Assert-TextFound "MemoryRecycle is Tier C gated" "_tier == DriverTier\.C" @("src/ZB.MOM.WW.OtOpcUa.Core/Stability/MemoryRecycle.cs")
+Assert-FileExists "ScheduledRecycleScheduler present" "src/ZB.MOM.WW.OtOpcUa.Core/Stability/ScheduledRecycleScheduler.cs"
+Assert-TextFound "Scheduler ctor rejects Tier A/B" "tier != DriverTier\.C" @("src/ZB.MOM.WW.OtOpcUa.Core/Stability/ScheduledRecycleScheduler.cs")
+Assert-FileExists "WedgeDetector present" "src/ZB.MOM.WW.OtOpcUa.Core/Stability/WedgeDetector.cs"
+Assert-TextFound "WedgeDetector is demand-aware" "HasPendingWork" @("src/ZB.MOM.WW.OtOpcUa.Core/Stability/WedgeDetector.cs")
+
+Write-Host ""
+Write-Host "Stream C - Health + logging"
+Assert-FileExists "DriverHealthReport present" "src/ZB.MOM.WW.OtOpcUa.Core/Observability/DriverHealthReport.cs"
+Assert-FileExists "HealthEndpointsHost present" "src/ZB.MOM.WW.OtOpcUa.Server/Observability/HealthEndpointsHost.cs"
+Assert-TextFound "State matrix: Healthy = 200" "ReadinessVerdict\.Healthy => 200" @("src/ZB.MOM.WW.OtOpcUa.Core/Observability/DriverHealthReport.cs")
+Assert-TextFound "State matrix: Faulted = 503" "ReadinessVerdict\.Faulted => 503" @("src/ZB.MOM.WW.OtOpcUa.Core/Observability/DriverHealthReport.cs")
+Assert-FileExists "LogContextEnricher present" "src/ZB.MOM.WW.OtOpcUa.Core/Observability/LogContextEnricher.cs"
+Assert-TextFound "Enricher pushes DriverInstanceId property" "DriverInstanceId" @("src/ZB.MOM.WW.OtOpcUa.Core/Observability/LogContextEnricher.cs")
+Assert-TextFound "JSON sink opt-in via Serilog:WriteJson" "Serilog:WriteJson" @("src/ZB.MOM.WW.OtOpcUa.Server/Program.cs")
+
+Write-Host ""
+Write-Host "Stream D - LiteDB generation-sealed cache"
+Assert-FileExists "GenerationSealedCache present" "src/ZB.MOM.WW.OtOpcUa.Configuration/LocalCache/GenerationSealedCache.cs"
+Assert-TextFound "Sealed files marked ReadOnly" "FileAttributes\.ReadOnly" @("src/ZB.MOM.WW.OtOpcUa.Configuration/LocalCache/GenerationSealedCache.cs")
+Assert-TextFound "Corruption fails closed with GenerationCacheUnavailableException" "GenerationCacheUnavailableException" @("src/ZB.MOM.WW.OtOpcUa.Configuration/LocalCache/GenerationSealedCache.cs")
+Assert-FileExists "ResilientConfigReader present" "src/ZB.MOM.WW.OtOpcUa.Configuration/LocalCache/ResilientConfigReader.cs"
+Assert-FileExists "StaleConfigFlag present" "src/ZB.MOM.WW.OtOpcUa.Configuration/LocalCache/StaleConfigFlag.cs"
+
+Write-Host ""
+Write-Host "Stream E - Admin /hosts (data layer)"
+Assert-FileExists "DriverInstanceResilienceStatus entity" "src/ZB.MOM.WW.OtOpcUa.Configuration/Entities/DriverInstanceResilienceStatus.cs"
+Assert-FileExists "DriverResilienceStatusTracker present" "src/ZB.MOM.WW.OtOpcUa.Core/Resilience/DriverResilienceStatusTracker.cs"
+Assert-Deferred "FleetStatusHub SignalR push + Blazor /hosts column refresh" "Phase 6.1 Stream E.2/E.3 visual-compliance follow-up"
+
+Write-Host ""
+Write-Host "Cross-cutting"
+Write-Host "  Running full solution test suite..." -ForegroundColor DarkGray
+$prevPref = $ErrorActionPreference
+$ErrorActionPreference = 'Continue'
+$testOutput = & dotnet test (Join-Path $repoRoot 'ZB.MOM.WW.OtOpcUa.slnx') --nologo 2>&1
+$ErrorActionPreference = $prevPref
+$passLine = $testOutput | Select-String 'Passed:\s+(\d+)' -AllMatches
+$failLine = $testOutput | Select-String 'Failed:\s+(\d+)' -AllMatches
+$passCount = 0; foreach ($m in $passLine.Matches) { $passCount += [int]$m.Groups[1].Value }
+$failCount = 0; foreach ($m in $failLine.Matches) { $failCount += [int]$m.Groups[1].Value }
+$baseline = 906
+if ($passCount -ge $baseline) { Assert-Pass "No test-count regression ($passCount >= $baseline baseline)" }
+else { Assert-Fail "Test-count regression" "passed $passCount < baseline $baseline" }
+
+# Pre-existing Client.CLI Subscribe flake tracked separately; exit gate tolerates a single
+# known flake but flags any NEW failures.
+if ($failCount -le 1) { Assert-Pass "No new failing tests (pre-existing CLI flake tolerated)" }
+else { Assert-Fail "New failing tests" "$failCount failures > 1 tolerated" }
+
+Write-Host ""
+if ($script:failures -eq 0) {
+    Write-Host "Phase 6.1 compliance: PASS" -ForegroundColor Green
+    exit 0
+}
+Write-Host "Phase 6.1 compliance: $script:failures FAIL(s)" -ForegroundColor Red
+exit 1

scripts/compliance/phase-6-2-compliance.ps1

@@ -0,0 +1,147 @@
+<#
+.SYNOPSIS
+    Phase 6.2 exit-gate compliance check. Each check either passes or records a
+    failure; non-zero exit = fail.
+
+.DESCRIPTION
+    Validates Phase 6.2 (Authorization runtime) completion. Checks enumerated
+    in `docs/v2/implementation/phase-6-2-authorization-runtime.md`
+    §"Compliance Checks (run at exit gate)".
+
+.NOTES
+    Usage:  pwsh ./scripts/compliance/phase-6-2-compliance.ps1
+    Exit:   0 = all checks passed; non-zero = one or more FAILs
+#>
+[CmdletBinding()]
+param()
+
+$ErrorActionPreference = 'Stop'
+$script:failures = 0
+$repoRoot = (Resolve-Path (Join-Path $PSScriptRoot '..\..')).Path
+
+function Assert-Pass {
+    param([string]$Check)
+    Write-Host "  [PASS] $Check" -ForegroundColor Green
+}
+
+function Assert-Fail {
+    param([string]$Check, [string]$Reason)
+    Write-Host "  [FAIL] $Check - $Reason" -ForegroundColor Red
+    $script:failures++
+}
+
+function Assert-Deferred {
+    param([string]$Check, [string]$FollowupPr)
+    Write-Host "  [DEFERRED] $Check  (follow-up: $FollowupPr)" -ForegroundColor Yellow
+}
+
+function Assert-FileExists {
+    param([string]$Check, [string]$RelPath)
+    $full = Join-Path $repoRoot $RelPath
+    if (Test-Path $full) { Assert-Pass "$Check  ($RelPath)" }
+    else { Assert-Fail $Check "missing file: $RelPath" }
+}
+
+function Assert-TextFound {
+    param([string]$Check, [string]$Pattern, [string[]]$RelPaths)
+    foreach ($p in $RelPaths) {
+        $full = Join-Path $repoRoot $p
+        if (-not (Test-Path $full)) { continue }
+        if (Select-String -Path $full -Pattern $Pattern -Quiet) {
+            Assert-Pass "$Check  (matched in $p)"
+            return
+        }
+    }
+    Assert-Fail $Check "pattern '$Pattern' not found in any of: $($RelPaths -join ', ')"
+}
+
+function Assert-TextAbsent {
+    param([string]$Check, [string]$Pattern, [string[]]$RelPaths)
+    foreach ($p in $RelPaths) {
+        $full = Join-Path $repoRoot $p
+        if (-not (Test-Path $full)) { continue }
+        if (Select-String -Path $full -Pattern $Pattern -Quiet) {
+            Assert-Fail $Check "pattern '$Pattern' unexpectedly found in $p"
+            return
+        }
+    }
+    Assert-Pass "$Check  (pattern '$Pattern' absent from: $($RelPaths -join ', '))"
+}
+
+Write-Host ""
+Write-Host "=== Phase 6.2 compliance - Authorization runtime ===" -ForegroundColor Cyan
+Write-Host ""
+
+Write-Host "Stream A - LdapGroupRoleMapping (control plane)"
+Assert-FileExists "LdapGroupRoleMapping entity present" "src/ZB.MOM.WW.OtOpcUa.Configuration/Entities/LdapGroupRoleMapping.cs"
+Assert-FileExists "AdminRole enum present" "src/ZB.MOM.WW.OtOpcUa.Configuration/Enums/AdminRole.cs"
+Assert-FileExists "ILdapGroupRoleMappingService present" "src/ZB.MOM.WW.OtOpcUa.Configuration/Services/ILdapGroupRoleMappingService.cs"
+Assert-FileExists "LdapGroupRoleMappingService impl present" "src/ZB.MOM.WW.OtOpcUa.Configuration/Services/LdapGroupRoleMappingService.cs"
+Assert-TextFound "Write-time invariant: IsSystemWide XOR ClusterId" "IsSystemWide=true requires ClusterId" @("src/ZB.MOM.WW.OtOpcUa.Configuration/Services/LdapGroupRoleMappingService.cs")
+Assert-FileExists "EF migration for LdapGroupRoleMapping" "src/ZB.MOM.WW.OtOpcUa.Configuration/Migrations/20260419131444_AddLdapGroupRoleMapping.cs"
+
+Write-Host ""
+Write-Host "Stream B - Permission-trie evaluator (Core.Authorization)"
+Assert-FileExists "OpcUaOperation enum present" "src/ZB.MOM.WW.OtOpcUa.Core.Abstractions/OpcUaOperation.cs"
+Assert-FileExists "NodeScope record present" "src/ZB.MOM.WW.OtOpcUa.Core/Authorization/NodeScope.cs"
+Assert-FileExists "AuthorizationDecision tri-state" "src/ZB.MOM.WW.OtOpcUa.Core/Authorization/AuthorizationDecision.cs"
+Assert-TextFound "Verdict has Denied member (reserved for v2.1)" "Denied" @("src/ZB.MOM.WW.OtOpcUa.Core/Authorization/AuthorizationDecision.cs")
+Assert-FileExists "IPermissionEvaluator present" "src/ZB.MOM.WW.OtOpcUa.Core/Authorization/IPermissionEvaluator.cs"
+Assert-FileExists "PermissionTrie present" "src/ZB.MOM.WW.OtOpcUa.Core/Authorization/PermissionTrie.cs"
+Assert-FileExists "PermissionTrieBuilder present" "src/ZB.MOM.WW.OtOpcUa.Core/Authorization/PermissionTrieBuilder.cs"
+Assert-FileExists "PermissionTrieCache present" "src/ZB.MOM.WW.OtOpcUa.Core/Authorization/PermissionTrieCache.cs"
+Assert-TextFound "Cache keyed on GenerationId" "GenerationId" @("src/ZB.MOM.WW.OtOpcUa.Core/Authorization/PermissionTrieCache.cs")
+Assert-FileExists "UserAuthorizationState present" "src/ZB.MOM.WW.OtOpcUa.Core/Authorization/UserAuthorizationState.cs"
+Assert-TextFound "MembershipFreshnessInterval default 15 min" "FromMinutes\(15\)" @("src/ZB.MOM.WW.OtOpcUa.Core/Authorization/UserAuthorizationState.cs")
+Assert-TextFound "AuthCacheMaxStaleness default 5 min" "FromMinutes\(5\)" @("src/ZB.MOM.WW.OtOpcUa.Core/Authorization/UserAuthorizationState.cs")
+Assert-FileExists "TriePermissionEvaluator impl present" "src/ZB.MOM.WW.OtOpcUa.Core/Authorization/TriePermissionEvaluator.cs"
+Assert-TextFound "HistoryRead maps to NodePermissions.HistoryRead" "HistoryRead.+NodePermissions\.HistoryRead" @("src/ZB.MOM.WW.OtOpcUa.Core/Authorization/TriePermissionEvaluator.cs")
+
+Write-Host ""
+Write-Host "Control/data-plane separation (decision #150)"
+Assert-TextAbsent "Evaluator has zero references to LdapGroupRoleMapping" "LdapGroupRoleMapping" @(
+    "src/ZB.MOM.WW.OtOpcUa.Core/Authorization/TriePermissionEvaluator.cs",
+    "src/ZB.MOM.WW.OtOpcUa.Core/Authorization/PermissionTrie.cs",
+    "src/ZB.MOM.WW.OtOpcUa.Core/Authorization/PermissionTrieBuilder.cs",
+    "src/ZB.MOM.WW.OtOpcUa.Core/Authorization/PermissionTrieCache.cs",
+    "src/ZB.MOM.WW.OtOpcUa.Core/Authorization/IPermissionEvaluator.cs")
+
+Write-Host ""
+Write-Host "Stream C foundation (dispatch-wiring gate)"
+Assert-FileExists "ILdapGroupsBearer present" "src/ZB.MOM.WW.OtOpcUa.Server/Security/ILdapGroupsBearer.cs"
+Assert-FileExists "AuthorizationGate present" "src/ZB.MOM.WW.OtOpcUa.Server/Security/AuthorizationGate.cs"
+Assert-TextFound "Gate has StrictMode knob" "StrictMode" @("src/ZB.MOM.WW.OtOpcUa.Server/Security/AuthorizationGate.cs")
+Assert-Deferred "DriverNodeManager dispatch-path wiring (11 surfaces)" "Phase 6.2 Stream C follow-up task #143"
+
+Write-Host ""
+Write-Host "Stream D data layer (ValidatedNodeAclAuthoringService)"
+Assert-FileExists "ValidatedNodeAclAuthoringService present" "src/ZB.MOM.WW.OtOpcUa.Admin/Services/ValidatedNodeAclAuthoringService.cs"
+Assert-TextFound "InvalidNodeAclGrantException present" "class InvalidNodeAclGrantException" @("src/ZB.MOM.WW.OtOpcUa.Admin/Services/ValidatedNodeAclAuthoringService.cs")
+Assert-TextFound "Rejects None permissions" "Permission set cannot be None" @("src/ZB.MOM.WW.OtOpcUa.Admin/Services/ValidatedNodeAclAuthoringService.cs")
+Assert-Deferred "RoleGrantsTab + AclsTab Probe-this-permission + SignalR invalidation + draft diff section" "Phase 6.2 Stream D follow-up task #144"
+
+Write-Host ""
+Write-Host "Cross-cutting"
+Write-Host "  Running full solution test suite..." -ForegroundColor DarkGray
+$prevPref = $ErrorActionPreference
+$ErrorActionPreference = 'Continue'
+$testOutput = & dotnet test (Join-Path $repoRoot 'ZB.MOM.WW.OtOpcUa.slnx') --nologo 2>&1
+$ErrorActionPreference = $prevPref
+$passLine = $testOutput | Select-String 'Passed:\s+(\d+)' -AllMatches
+$failLine = $testOutput | Select-String 'Failed:\s+(\d+)' -AllMatches
+$passCount = 0; foreach ($m in $passLine.Matches) { $passCount += [int]$m.Groups[1].Value }
+$failCount = 0; foreach ($m in $failLine.Matches) { $failCount += [int]$m.Groups[1].Value }
+$baseline = 1042
+if ($passCount -ge $baseline) { Assert-Pass "No test-count regression ($passCount >= $baseline pre-Phase-6.2 baseline)" }
+else { Assert-Fail "Test-count regression" "passed $passCount < baseline $baseline" }
+
+if ($failCount -le 1) { Assert-Pass "No new failing tests (pre-existing CLI flake tolerated)" }
+else { Assert-Fail "New failing tests" "$failCount failures > 1 tolerated" }
+
+Write-Host ""
+if ($script:failures -eq 0) {
+    Write-Host "Phase 6.2 compliance: PASS" -ForegroundColor Green
+    exit 0
+}
+Write-Host "Phase 6.2 compliance: $script:failures FAIL(s)" -ForegroundColor Red
+exit 1

scripts/compliance/phase-6-3-compliance.ps1

@@ -0,0 +1,110 @@
+<#
+.SYNOPSIS
+    Phase 6.3 exit-gate compliance check. Each check either passes or records a
+    failure; non-zero exit = fail.
+
+.DESCRIPTION
+    Validates Phase 6.3 (Redundancy runtime) completion. Checks enumerated in
+    `docs/v2/implementation/phase-6-3-redundancy-runtime.md`
+    §"Compliance Checks (run at exit gate)".
+
+.NOTES
+    Usage:  pwsh ./scripts/compliance/phase-6-3-compliance.ps1
+    Exit:   0 = all checks passed; non-zero = one or more FAILs
+#>
+[CmdletBinding()]
+param()
+
+$ErrorActionPreference = 'Stop'
+$script:failures = 0
+$repoRoot = (Resolve-Path (Join-Path $PSScriptRoot '..\..')).Path
+
+function Assert-Pass { param([string]$C) Write-Host "  [PASS] $C" -ForegroundColor Green }
+function Assert-Fail { param([string]$C, [string]$R) Write-Host "  [FAIL] $C - $R" -ForegroundColor Red; $script:failures++ }
+function Assert-Deferred { param([string]$C, [string]$P) Write-Host "  [DEFERRED] $C  (follow-up: $P)" -ForegroundColor Yellow }
+
+function Assert-FileExists {
+    param([string]$C, [string]$P)
+    if (Test-Path (Join-Path $repoRoot $P)) { Assert-Pass "$C  ($P)" }
+    else { Assert-Fail $C "missing file: $P" }
+}
+
+function Assert-TextFound {
+    param([string]$C, [string]$Pat, [string[]]$Paths)
+    foreach ($p in $Paths) {
+        $full = Join-Path $repoRoot $p
+        if (-not (Test-Path $full)) { continue }
+        if (Select-String -Path $full -Pattern $Pat -Quiet) {
+            Assert-Pass "$C  (matched in $p)"
+            return
+        }
+    }
+    Assert-Fail $C "pattern '$Pat' not found in any of: $($Paths -join ', ')"
+}
+
+Write-Host ""
+Write-Host "=== Phase 6.3 compliance - Redundancy runtime ===" -ForegroundColor Cyan
+Write-Host ""
+
+Write-Host "Stream B - ServiceLevel 8-state matrix (decision #154)"
+Assert-FileExists "ServiceLevelCalculator present" "src/ZB.MOM.WW.OtOpcUa.Server/Redundancy/ServiceLevelCalculator.cs"
+Assert-FileExists "ServiceLevelBand enum present" "src/ZB.MOM.WW.OtOpcUa.Server/Redundancy/ServiceLevelCalculator.cs"
+Assert-TextFound "Maintenance = 0 (reserved per OPC UA Part 5)" "Maintenance\s*=\s*0" @("src/ZB.MOM.WW.OtOpcUa.Server/Redundancy/ServiceLevelCalculator.cs")
+Assert-TextFound "NoData = 1 (reserved per OPC UA Part 5)" "NoData\s*=\s*1" @("src/ZB.MOM.WW.OtOpcUa.Server/Redundancy/ServiceLevelCalculator.cs")
+Assert-TextFound "InvalidTopology = 2 (detected-inconsistency band)" "InvalidTopology\s*=\s*2" @("src/ZB.MOM.WW.OtOpcUa.Server/Redundancy/ServiceLevelCalculator.cs")
+Assert-TextFound "AuthoritativePrimary = 255" "AuthoritativePrimary\s*=\s*255" @("src/ZB.MOM.WW.OtOpcUa.Server/Redundancy/ServiceLevelCalculator.cs")
+Assert-TextFound "IsolatedPrimary = 230 (retains authority)" "IsolatedPrimary\s*=\s*230" @("src/ZB.MOM.WW.OtOpcUa.Server/Redundancy/ServiceLevelCalculator.cs")
+Assert-TextFound "PrimaryMidApply = 200" "PrimaryMidApply\s*=\s*200" @("src/ZB.MOM.WW.OtOpcUa.Server/Redundancy/ServiceLevelCalculator.cs")
+Assert-TextFound "RecoveringPrimary = 180" "RecoveringPrimary\s*=\s*180" @("src/ZB.MOM.WW.OtOpcUa.Server/Redundancy/ServiceLevelCalculator.cs")
+Assert-TextFound "AuthoritativeBackup = 100" "AuthoritativeBackup\s*=\s*100" @("src/ZB.MOM.WW.OtOpcUa.Server/Redundancy/ServiceLevelCalculator.cs")
+Assert-TextFound "IsolatedBackup = 80 (does NOT auto-promote)" "IsolatedBackup\s*=\s*80" @("src/ZB.MOM.WW.OtOpcUa.Server/Redundancy/ServiceLevelCalculator.cs")
+Assert-TextFound "BackupMidApply = 50" "BackupMidApply\s*=\s*50" @("src/ZB.MOM.WW.OtOpcUa.Server/Redundancy/ServiceLevelCalculator.cs")
+Assert-TextFound "RecoveringBackup = 30" "RecoveringBackup\s*=\s*30" @("src/ZB.MOM.WW.OtOpcUa.Server/Redundancy/ServiceLevelCalculator.cs")
+
+Write-Host ""
+Write-Host "Stream B - RecoveryStateManager"
+Assert-FileExists "RecoveryStateManager present" "src/ZB.MOM.WW.OtOpcUa.Server/Redundancy/RecoveryStateManager.cs"
+Assert-TextFound "Dwell + publish-witness gate" "_witnessed" @("src/ZB.MOM.WW.OtOpcUa.Server/Redundancy/RecoveryStateManager.cs")
+Assert-TextFound "Default dwell 60 s" "FromSeconds\(60\)" @("src/ZB.MOM.WW.OtOpcUa.Server/Redundancy/RecoveryStateManager.cs")
+
+Write-Host ""
+Write-Host "Stream D - Apply-lease registry (decision #162)"
+Assert-FileExists "ApplyLeaseRegistry present" "src/ZB.MOM.WW.OtOpcUa.Server/Redundancy/ApplyLeaseRegistry.cs"
+Assert-TextFound "BeginApplyLease returns IAsyncDisposable" "IAsyncDisposable" @("src/ZB.MOM.WW.OtOpcUa.Server/Redundancy/ApplyLeaseRegistry.cs")
+Assert-TextFound "Lease key includes PublishRequestId" "PublishRequestId" @("src/ZB.MOM.WW.OtOpcUa.Server/Redundancy/ApplyLeaseRegistry.cs")
+Assert-TextFound "Watchdog PruneStale present" "PruneStale" @("src/ZB.MOM.WW.OtOpcUa.Server/Redundancy/ApplyLeaseRegistry.cs")
+Assert-TextFound "Default ApplyMaxDuration 10 min" "FromMinutes\(10\)" @("src/ZB.MOM.WW.OtOpcUa.Server/Redundancy/ApplyLeaseRegistry.cs")
+
+Write-Host ""
+Write-Host "Deferred surfaces"
+Assert-Deferred "Stream A - RedundancyCoordinator cluster-topology loader" "task #145"
+Assert-Deferred "Stream C - OPC UA node wiring (ServiceLevel + ServerUriArray + RedundancySupport)" "task #147"
+Assert-Deferred "Stream E - Admin RedundancyTab + OpenTelemetry metrics + SignalR" "task #149"
+Assert-Deferred "Stream F - Client interop matrix + Galaxy MXAccess failover" "task #150"
+Assert-Deferred "sp_PublishGeneration rejects Transparent mode pre-publish" "task #148 part 2 (SQL-side validator)"
+
+Write-Host ""
+Write-Host "Cross-cutting"
+Write-Host "  Running full solution test suite..." -ForegroundColor DarkGray
+$prevPref = $ErrorActionPreference
+$ErrorActionPreference = 'Continue'
+$testOutput = & dotnet test (Join-Path $repoRoot 'ZB.MOM.WW.OtOpcUa.slnx') --nologo 2>&1
+$ErrorActionPreference = $prevPref
+$passLine = $testOutput | Select-String 'Passed:\s+(\d+)' -AllMatches
+$failLine = $testOutput | Select-String 'Failed:\s+(\d+)' -AllMatches
+$passCount = 0; foreach ($m in $passLine.Matches) { $passCount += [int]$m.Groups[1].Value }
+$failCount = 0; foreach ($m in $failLine.Matches) { $failCount += [int]$m.Groups[1].Value }
+$baseline = 1097
+if ($passCount -ge $baseline) { Assert-Pass "No test-count regression ($passCount >= $baseline pre-Phase-6.3 baseline)" }
+else { Assert-Fail "Test-count regression" "passed $passCount < baseline $baseline" }
+
+if ($failCount -le 1) { Assert-Pass "No new failing tests (pre-existing CLI flake tolerated)" }
+else { Assert-Fail "New failing tests" "$failCount failures > 1 tolerated" }
+
+Write-Host ""
+if ($script:failures -eq 0) {
+    Write-Host "Phase 6.3 compliance: PASS" -ForegroundColor Green
+    exit 0
+}
+Write-Host "Phase 6.3 compliance: $script:failures FAIL(s)" -ForegroundColor Red
+exit 1

scripts/compliance/phase-6-4-compliance.ps1

@@ -0,0 +1,96 @@
+<#
+.SYNOPSIS
+    Phase 6.4 exit-gate compliance check. Each check either passes or records a
+    failure; non-zero exit = fail.
+
+.DESCRIPTION
+    Validates Phase 6.4 (Admin UI completion) progress. Checks enumerated in
+    `docs/v2/implementation/phase-6-4-admin-ui-completion.md`
+    §"Compliance Checks (run at exit gate)".
+
+.NOTES
+    Usage:  pwsh ./scripts/compliance/phase-6-4-compliance.ps1
+    Exit:   0 = all checks passed; non-zero = one or more FAILs
+#>
+[CmdletBinding()]
+param()
+
+$ErrorActionPreference = 'Stop'
+$script:failures = 0
+$repoRoot = (Resolve-Path (Join-Path $PSScriptRoot '..\..')).Path
+
+function Assert-Pass { param([string]$C) Write-Host "  [PASS] $C" -ForegroundColor Green }
+function Assert-Fail { param([string]$C, [string]$R) Write-Host "  [FAIL] $C - $R" -ForegroundColor Red; $script:failures++ }
+function Assert-Deferred { param([string]$C, [string]$P) Write-Host "  [DEFERRED] $C  (follow-up: $P)" -ForegroundColor Yellow }
+
+function Assert-FileExists {
+    param([string]$C, [string]$P)
+    if (Test-Path (Join-Path $repoRoot $P)) { Assert-Pass "$C  ($P)" }
+    else { Assert-Fail $C "missing file: $P" }
+}
+
+function Assert-TextFound {
+    param([string]$C, [string]$Pat, [string[]]$Paths)
+    foreach ($p in $Paths) {
+        $full = Join-Path $repoRoot $p
+        if (-not (Test-Path $full)) { continue }
+        if (Select-String -Path $full -Pattern $Pat -Quiet) {
+            Assert-Pass "$C  (matched in $p)"
+            return
+        }
+    }
+    Assert-Fail $C "pattern '$Pat' not found in any of: $($Paths -join ', ')"
+}
+
+Write-Host ""
+Write-Host "=== Phase 6.4 compliance - Admin UI completion ===" -ForegroundColor Cyan
+Write-Host ""
+
+Write-Host "Stream A data layer - UnsImpactAnalyzer"
+Assert-FileExists "UnsImpactAnalyzer present" "src/ZB.MOM.WW.OtOpcUa.Admin/Services/UnsImpactAnalyzer.cs"
+Assert-TextFound "DraftRevisionToken present" "record DraftRevisionToken" @("src/ZB.MOM.WW.OtOpcUa.Admin/Services/UnsImpactAnalyzer.cs")
+Assert-TextFound "Cross-cluster move rejected per decision #82" "CrossClusterMoveRejectedException" @("src/ZB.MOM.WW.OtOpcUa.Admin/Services/UnsImpactAnalyzer.cs")
+Assert-TextFound "LineMove + AreaRename + LineMerge covered" "UnsMoveKind\.LineMerge" @("src/ZB.MOM.WW.OtOpcUa.Admin/Services/UnsImpactAnalyzer.cs")
+
+Write-Host ""
+Write-Host "Stream B data layer - EquipmentCsvImporter"
+Assert-FileExists "EquipmentCsvImporter present" "src/ZB.MOM.WW.OtOpcUa.Admin/Services/EquipmentCsvImporter.cs"
+Assert-TextFound "CSV header version marker '# OtOpcUaCsv v1'" "OtOpcUaCsv v1" @("src/ZB.MOM.WW.OtOpcUa.Admin/Services/EquipmentCsvImporter.cs")
+Assert-TextFound "Required columns match decision #117" "ZTag.+MachineCode.+SAPID.+EquipmentId.+EquipmentUuid" @("src/ZB.MOM.WW.OtOpcUa.Admin/Services/EquipmentCsvImporter.cs")
+Assert-TextFound "Optional columns match decision #139 (Manufacturer)" "Manufacturer" @("src/ZB.MOM.WW.OtOpcUa.Admin/Services/EquipmentCsvImporter.cs")
+Assert-TextFound "Optional columns include DeviceManualUri" "DeviceManualUri" @("src/ZB.MOM.WW.OtOpcUa.Admin/Services/EquipmentCsvImporter.cs")
+Assert-TextFound "Rejects duplicate ZTag within file" "Duplicate ZTag" @("src/ZB.MOM.WW.OtOpcUa.Admin/Services/EquipmentCsvImporter.cs")
+Assert-TextFound "Rejects unknown column" "unknown column" @("src/ZB.MOM.WW.OtOpcUa.Admin/Services/EquipmentCsvImporter.cs")
+
+Write-Host ""
+Write-Host "Deferred surfaces"
+Assert-Deferred "Stream A UI - UnsTab MudBlazor drag/drop + 409 modal + Playwright" "task #153"
+Assert-Deferred "Stream B follow-up - EquipmentImportBatch staging + FinaliseImportBatch + CSV import UI" "task #155"
+Assert-Deferred "Stream C - DiffViewer refactor + 6 section plugins + 1000-row cap" "task #156"
+Assert-Deferred "Stream D - IdentificationFields.razor + DriverNodeManager OPC 40010 sub-folder" "task #157"
+
+Write-Host ""
+Write-Host "Cross-cutting"
+Write-Host "  Running full solution test suite..." -ForegroundColor DarkGray
+$prevPref = $ErrorActionPreference
+$ErrorActionPreference = 'Continue'
+$testOutput = & dotnet test (Join-Path $repoRoot 'ZB.MOM.WW.OtOpcUa.slnx') --nologo 2>&1
+$ErrorActionPreference = $prevPref
+$passLine = $testOutput | Select-String 'Passed:\s+(\d+)' -AllMatches
+$failLine = $testOutput | Select-String 'Failed:\s+(\d+)' -AllMatches
+$passCount = 0; foreach ($m in $passLine.Matches) { $passCount += [int]$m.Groups[1].Value }
+$failCount = 0; foreach ($m in $failLine.Matches) { $failCount += [int]$m.Groups[1].Value }
+$baseline = 1137
+if ($passCount -ge $baseline) { Assert-Pass "No test-count regression ($passCount >= $baseline pre-Phase-6.4 baseline)" }
+else { Assert-Fail "Test-count regression" "passed $passCount < baseline $baseline" }
+
+if ($failCount -le 1) { Assert-Pass "No new failing tests (pre-existing CLI flake tolerated)" }
+else { Assert-Fail "New failing tests" "$failCount failures > 1 tolerated" }
+
+Write-Host ""
+if ($script:failures -eq 0) {
+    Write-Host "Phase 6.4 compliance: PASS" -ForegroundColor Green
+    exit 0
+}
+Write-Host "Phase 6.4 compliance: $script:failures FAIL(s)" -ForegroundColor Red
+exit 1

scripts/compliance/phase-6-all.ps1

@@ -0,0 +1,77 @@
+<#
+.SYNOPSIS
+    Meta-runner that invokes every per-phase Phase 6.x compliance script and
+    reports an aggregate verdict.
+
+.DESCRIPTION
+    Runs phase-6-1-compliance.ps1, phase-6-2, phase-6-3, phase-6-4 in sequence.
+    Each sub-script returns its own exit code; this wrapper aggregates them.
+    Useful before a v2 release tag + as the `dotnet test` companion in CI.
+
+.NOTES
+    Usage:  pwsh ./scripts/compliance/phase-6-all.ps1
+    Exit:   0 = every phase passed; 1 = one or more phases failed
+#>
+[CmdletBinding()]
+param()
+
+$ErrorActionPreference = 'Continue'
+
+$phases = @(
+    @{ Name = 'Phase 6.1 - Resilience & Observability'; Script = 'phase-6-1-compliance.ps1' },
+    @{ Name = 'Phase 6.2 - Authorization runtime';       Script = 'phase-6-2-compliance.ps1' },
+    @{ Name = 'Phase 6.3 - Redundancy runtime';          Script = 'phase-6-3-compliance.ps1' },
+    @{ Name = 'Phase 6.4 - Admin UI completion';         Script = 'phase-6-4-compliance.ps1' }
+)
+
+$results = @()
+$startedAt = Get-Date
+
+foreach ($phase in $phases) {
+    Write-Host ""
+    Write-Host ""
+    Write-Host "=============================================================" -ForegroundColor DarkGray
+    Write-Host ("Running {0}" -f $phase.Name) -ForegroundColor Cyan
+    Write-Host "=============================================================" -ForegroundColor DarkGray
+
+    $scriptPath = Join-Path $PSScriptRoot $phase.Script
+    if (-not (Test-Path $scriptPath)) {
+        Write-Host ("  [MISSING] {0}" -f $phase.Script) -ForegroundColor Red
+        $results += @{ Name = $phase.Name; Exit = 2 }
+        continue
+    }
+
+    # Invoke each sub-script in its own powershell.exe process so its local
+    # $ErrorActionPreference + exit-code semantics can't interfere with the meta-runner's
+    # state. Slower (one process spawn per phase) but makes aggregate PASS/FAIL match
+    # standalone runs exactly.
+    & powershell.exe -NoProfile -ExecutionPolicy Bypass -File $scriptPath
+    $exitCode = $LASTEXITCODE
+    $results += @{ Name = $phase.Name; Exit = $exitCode }
+}
+
+$elapsed = (Get-Date) - $startedAt
+
+Write-Host ""
+Write-Host ""
+Write-Host "=============================================================" -ForegroundColor DarkGray
+Write-Host "Phase 6 compliance aggregate" -ForegroundColor Cyan
+Write-Host "=============================================================" -ForegroundColor DarkGray
+
+$totalFailures = 0
+foreach ($r in $results) {
+    $colour = if ($r.Exit -eq 0) { 'Green' } else { 'Red' }
+    $tag    = if ($r.Exit -eq 0) { 'PASS' }     else { "FAIL (exit=$($r.Exit))" }
+    Write-Host ("  [{0}] {1}" -f $tag, $r.Name) -ForegroundColor $colour
+    if ($r.Exit -ne 0) { $totalFailures++ }
+}
+
+Write-Host ""
+Write-Host ("Elapsed: {0:N1} s" -f $elapsed.TotalSeconds) -ForegroundColor DarkGray
+
+if ($totalFailures -eq 0) {
+    Write-Host "Phase 6 aggregate: PASS" -ForegroundColor Green
+    exit 0
+}
+Write-Host ("Phase 6 aggregate: {0} phase(s) FAILED" -f $totalFailures) -ForegroundColor Red
+exit 1

src/ZB.MOM.WW.OtOpcUa.Admin/Services/EquipmentCsvImporter.cs

@@ -0,0 +1,259 @@
+using System.Globalization;
+using System.Text;
+
+namespace ZB.MOM.WW.OtOpcUa.Admin.Services;
+
+/// <summary>
+///     RFC 4180 CSV parser for equipment import per decision #95 and Phase 6.4 Stream B.1.
+///     Produces a validated <see cref="EquipmentCsvParseResult"/> the caller (CSV import
+///     modal + staging tables) consumes. Pure-parser concern — no DB access, no staging
+///     writes; those live in the follow-up Stream B.2 work.
+/// </summary>
+/// <remarks>
+///     <para><b>Header contract</b>: line 1 must be exactly <c># OtOpcUaCsv v1</c> (version
+///     marker). Line 2 is the column header row. Unknown columns are rejected; required
+///     columns must all be present. The version bump handshake lets future shapes parse
+///     without ambiguity — v2 files go through a different parser variant.</para>
+///
+///     <para><b>Required columns</b> per decision #117: ZTag, MachineCode, SAPID,
+///     EquipmentId, EquipmentUuid, Name, UnsAreaName, UnsLineName.</para>
+///
+///     <para><b>Optional columns</b> per decision #139: Manufacturer, Model, SerialNumber,
+///     HardwareRevision, SoftwareRevision, YearOfConstruction, AssetLocation,
+///     ManufacturerUri, DeviceManualUri.</para>
+///
+///     <para><b>Row validation</b>: blank required field → rejected; duplicate ZTag within
+///     the same file → rejected. Duplicate against the DB isn't detected here — the
+///     staged-import finalize step (Stream B.4) catches that.</para>
+/// </remarks>
+public static class EquipmentCsvImporter
+{
+    public const string VersionMarker = "# OtOpcUaCsv v1";
+
+    public static IReadOnlyList<string> RequiredColumns { get; } = new[]
+    {
+        "ZTag", "MachineCode", "SAPID", "EquipmentId", "EquipmentUuid",
+        "Name", "UnsAreaName", "UnsLineName",
+    };
+
+    public static IReadOnlyList<string> OptionalColumns { get; } = new[]
+    {
+        "Manufacturer", "Model", "SerialNumber", "HardwareRevision", "SoftwareRevision",
+        "YearOfConstruction", "AssetLocation", "ManufacturerUri", "DeviceManualUri",
+    };
+
+    public static EquipmentCsvParseResult Parse(string csvText)
+    {
+        ArgumentNullException.ThrowIfNull(csvText);
+
+        var rows = SplitLines(csvText);
+        if (rows.Count == 0)
+            throw new InvalidCsvFormatException("CSV is empty.");
+
+        if (!string.Equals(rows[0].Trim(), VersionMarker, StringComparison.Ordinal))
+            throw new InvalidCsvFormatException(
+                $"CSV header line 1 must be exactly '{VersionMarker}' — got '{rows[0]}'. " +
+                "Files without the version marker are rejected so future-format files don't parse ambiguously.");
+
+        if (rows.Count < 2)
+            throw new InvalidCsvFormatException("CSV has no column header row (line 2) or data rows.");
+
+        var headerCells = SplitCsvRow(rows[1]);
+        ValidateHeader(headerCells);
+
+        var accepted = new List<EquipmentCsvRow>();
+        var rejected = new List<EquipmentCsvRowError>();
+        var ztagsSeen = new HashSet<string>(StringComparer.OrdinalIgnoreCase);
+        var colIndex = headerCells
+            .Select((name, idx) => (name, idx))
+            .ToDictionary(t => t.name, t => t.idx, StringComparer.OrdinalIgnoreCase);
+
+        for (var i = 2; i < rows.Count; i++)
+        {
+            if (string.IsNullOrWhiteSpace(rows[i])) continue;
+
+            try
+            {
+                var cells = SplitCsvRow(rows[i]);
+                if (cells.Length != headerCells.Length)
+                {
+                    rejected.Add(new EquipmentCsvRowError(
+                        LineNumber: i + 1,
+                        Reason: $"Column count {cells.Length} != header count {headerCells.Length}."));
+                    continue;
+                }
+
+                var row = BuildRow(cells, colIndex);
+                var missing = RequiredColumns.Where(c => string.IsNullOrWhiteSpace(GetCell(row, c))).ToList();
+                if (missing.Count > 0)
+                {
+                    rejected.Add(new EquipmentCsvRowError(i + 1, $"Blank required column(s): {string.Join(", ", missing)}"));
+                    continue;
+                }
+
+                if (!ztagsSeen.Add(row.ZTag))
+                {
+                    rejected.Add(new EquipmentCsvRowError(i + 1, $"Duplicate ZTag '{row.ZTag}' within file."));
+                    continue;
+                }
+
+                accepted.Add(row);
+            }
+            catch (InvalidCsvFormatException ex)
+            {
+                rejected.Add(new EquipmentCsvRowError(i + 1, ex.Message));
+            }
+        }
+
+        return new EquipmentCsvParseResult(accepted, rejected);
+    }
+
+    private static void ValidateHeader(string[] headerCells)
+    {
+        var seen = new HashSet<string>(headerCells, StringComparer.OrdinalIgnoreCase);
+
+        // Missing required
+        var missingRequired = RequiredColumns.Where(r => !seen.Contains(r)).ToList();
+        if (missingRequired.Count > 0)
+            throw new InvalidCsvFormatException($"Header is missing required column(s): {string.Join(", ", missingRequired)}");
+
+        // Unknown columns (not in required ∪ optional)
+        var known = new HashSet<string>(RequiredColumns.Concat(OptionalColumns), StringComparer.OrdinalIgnoreCase);
+        var unknown = headerCells.Where(c => !known.Contains(c)).ToList();
+        if (unknown.Count > 0)
+            throw new InvalidCsvFormatException(
+                $"Header has unknown column(s): {string.Join(", ", unknown)}. " +
+                "Bump the version marker to define a new shape before adding columns.");
+
+        // Duplicates
+        var dupe = headerCells.GroupBy(c => c, StringComparer.OrdinalIgnoreCase).FirstOrDefault(g => g.Count() > 1);
+        if (dupe is not null)
+            throw new InvalidCsvFormatException($"Header has duplicate column '{dupe.Key}'.");
+    }
+
+    private static EquipmentCsvRow BuildRow(string[] cells, Dictionary<string, int> colIndex) => new()
+    {
+        ZTag = cells[colIndex["ZTag"]],
+        MachineCode = cells[colIndex["MachineCode"]],
+        SAPID = cells[colIndex["SAPID"]],
+        EquipmentId = cells[colIndex["EquipmentId"]],
+        EquipmentUuid = cells[colIndex["EquipmentUuid"]],
+        Name = cells[colIndex["Name"]],
+        UnsAreaName = cells[colIndex["UnsAreaName"]],
+        UnsLineName = cells[colIndex["UnsLineName"]],
+        Manufacturer = colIndex.TryGetValue("Manufacturer", out var mi) ? cells[mi] : null,
+        Model = colIndex.TryGetValue("Model", out var moi) ? cells[moi] : null,
+        SerialNumber = colIndex.TryGetValue("SerialNumber", out var si) ? cells[si] : null,
+        HardwareRevision = colIndex.TryGetValue("HardwareRevision", out var hi) ? cells[hi] : null,
+        SoftwareRevision = colIndex.TryGetValue("SoftwareRevision", out var swi) ? cells[swi] : null,
+        YearOfConstruction = colIndex.TryGetValue("YearOfConstruction", out var yi) ? cells[yi] : null,
+        AssetLocation = colIndex.TryGetValue("AssetLocation", out var ai) ? cells[ai] : null,
+        ManufacturerUri = colIndex.TryGetValue("ManufacturerUri", out var mui) ? cells[mui] : null,
+        DeviceManualUri = colIndex.TryGetValue("DeviceManualUri", out var dui) ? cells[dui] : null,
+    };
+
+    private static string GetCell(EquipmentCsvRow row, string colName) => colName switch
+    {
+        "ZTag"          => row.ZTag,
+        "MachineCode"   => row.MachineCode,
+        "SAPID"         => row.SAPID,
+        "EquipmentId"   => row.EquipmentId,
+        "EquipmentUuid" => row.EquipmentUuid,
+        "Name"          => row.Name,
+        "UnsAreaName"   => row.UnsAreaName,
+        "UnsLineName"   => row.UnsLineName,
+        _ => string.Empty,
+    };
+
+    /// <summary>Split the raw text on line boundaries. Handles \r\n + \n + \r.</summary>
+    private static List<string> SplitLines(string csv) =>
+        csv.Split(["\r\n", "\n", "\r"], StringSplitOptions.None).ToList();
+
+    /// <summary>Split one CSV row with RFC 4180 quoted-field handling.</summary>
+    private static string[] SplitCsvRow(string row)
+    {
+        var cells = new List<string>();
+        var sb = new StringBuilder();
+        var inQuotes = false;
+
+        for (var i = 0; i < row.Length; i++)
+        {
+            var ch = row[i];
+            if (inQuotes)
+            {
+                if (ch == '"')
+                {
+                    // Escaped quote "" inside quoted field.
+                    if (i + 1 < row.Length && row[i + 1] == '"')
+                    {
+                        sb.Append('"');
+                        i++;
+                    }
+                    else
+                    {
+                        inQuotes = false;
+                    }
+                }
+                else
+                {
+                    sb.Append(ch);
+                }
+            }
+            else
+            {
+                if (ch == ',')
+                {
+                    cells.Add(sb.ToString());
+                    sb.Clear();
+                }
+                else if (ch == '"' && sb.Length == 0)
+                {
+                    inQuotes = true;
+                }
+                else
+                {
+                    sb.Append(ch);
+                }
+            }
+        }
+
+        cells.Add(sb.ToString());
+        return cells.ToArray();
+    }
+}
+
+/// <summary>One parsed equipment row with required + optional fields.</summary>
+public sealed class EquipmentCsvRow
+{
+    // Required (decision #117)
+    public required string ZTag { get; init; }
+    public required string MachineCode { get; init; }
+    public required string SAPID { get; init; }
+    public required string EquipmentId { get; init; }
+    public required string EquipmentUuid { get; init; }
+    public required string Name { get; init; }
+    public required string UnsAreaName { get; init; }
+    public required string UnsLineName { get; init; }
+
+    // Optional (decision #139 — OPC 40010 Identification fields)
+    public string? Manufacturer { get; init; }
+    public string? Model { get; init; }
+    public string? SerialNumber { get; init; }
+    public string? HardwareRevision { get; init; }
+    public string? SoftwareRevision { get; init; }
+    public string? YearOfConstruction { get; init; }
+    public string? AssetLocation { get; init; }
+    public string? ManufacturerUri { get; init; }
+    public string? DeviceManualUri { get; init; }
+}
+
+/// <summary>One row-level rejection captured by the parser. Line-number is 1-based in the source file.</summary>
+public sealed record EquipmentCsvRowError(int LineNumber, string Reason);
+
+/// <summary>Parser output — accepted rows land in staging; rejected rows surface in the preview modal.</summary>
+public sealed record EquipmentCsvParseResult(
+    IReadOnlyList<EquipmentCsvRow> AcceptedRows,
+    IReadOnlyList<EquipmentCsvRowError> RejectedRows);
+
+/// <summary>Thrown for file-level format problems (missing version marker, bad header, etc.).</summary>
+public sealed class InvalidCsvFormatException(string message) : Exception(message);

src/ZB.MOM.WW.OtOpcUa.Admin/Services/UnsImpactAnalyzer.cs

@@ -0,0 +1,213 @@
+namespace ZB.MOM.WW.OtOpcUa.Admin.Services;
+
+/// <summary>
+///     Pure-function impact preview for UNS structural moves per Phase 6.4 Stream A.2. Given
+///     a <see cref="UnsMoveOperation"/> plus a snapshot of the draft's UNS tree and its
+///     equipment + tag counts, returns an <see cref="UnsImpactPreview"/> the Admin UI shows
+///     in a confirmation modal before committing the move.
+/// </summary>
+/// <remarks>
+///     <para>Stateless + deterministic — testable without EF or a live draft. The caller
+///     (Razor page) loads the draft's snapshot via the normal Configuration services, passes
+///     it in, and the analyzer counts + categorises the impact. The returned
+///     <see cref="UnsImpactPreview.RevisionToken"/> is the token the caller must re-check at
+///     confirm time; a mismatch means another operator mutated the draft between preview +
+///     confirm and the operation needs to be refreshed (decision on concurrent-edit safety
+///     in Phase 6.4 Scope).</para>
+///
+///     <para>Cross-cluster moves are rejected here (decision #82) — equipment is
+///     cluster-scoped; the UI disables the drop target and surfaces an Export/Import workflow
+///     toast instead.</para>
+/// </remarks>
+public static class UnsImpactAnalyzer
+{
+    /// <summary>Run the analyzer. Returns a populated preview or throws for invalid operations.</summary>
+    public static UnsImpactPreview Analyze(UnsTreeSnapshot snapshot, UnsMoveOperation move)
+    {
+        ArgumentNullException.ThrowIfNull(snapshot);
+        ArgumentNullException.ThrowIfNull(move);
+
+        // Cross-cluster guard — the analyzer refuses rather than silently re-homing.
+        if (!string.Equals(move.SourceClusterId, move.TargetClusterId, StringComparison.OrdinalIgnoreCase))
+            throw new CrossClusterMoveRejectedException(
+                "Equipment is cluster-scoped (decision #82). Use Export → Import to migrate equipment " +
+                "across clusters; drag/drop rejected.");
+
+        return move.Kind switch
+        {
+            UnsMoveKind.LineMove => AnalyzeLineMove(snapshot, move),
+            UnsMoveKind.AreaRename => AnalyzeAreaRename(snapshot, move),
+            UnsMoveKind.LineMerge => AnalyzeLineMerge(snapshot, move),
+            _ => throw new ArgumentOutOfRangeException(nameof(move), move.Kind, $"Unsupported move kind {move.Kind}"),
+        };
+    }
+
+    private static UnsImpactPreview AnalyzeLineMove(UnsTreeSnapshot snapshot, UnsMoveOperation move)
+    {
+        var line = snapshot.FindLine(move.SourceLineId!)
+                   ?? throw new UnsMoveValidationException($"Source line '{move.SourceLineId}' not found in draft {snapshot.DraftGenerationId}.");
+
+        var targetArea = snapshot.FindArea(move.TargetAreaId!)
+                         ?? throw new UnsMoveValidationException($"Target area '{move.TargetAreaId}' not found in draft {snapshot.DraftGenerationId}.");
+
+        var warnings = new List<string>();
+        if (targetArea.LineIds.Contains(line.LineId, StringComparer.OrdinalIgnoreCase))
+            warnings.Add($"Target area '{targetArea.Name}' already contains line '{line.Name}' — dropping a no-op move.");
+
+        // If the target area has a line with the same display name as the mover, warn about
+        // visual ambiguity even though the IDs differ (operators frequently reuse line names).
+        if (targetArea.LineIds.Any(lid =>
+                snapshot.FindLine(lid) is { } sibling &&
+                string.Equals(sibling.Name, line.Name, StringComparison.OrdinalIgnoreCase) &&
+                !string.Equals(sibling.LineId, line.LineId, StringComparison.OrdinalIgnoreCase)))
+        {
+            warnings.Add($"Target area '{targetArea.Name}' already has a line named '{line.Name}'. Consider renaming before the move.");
+        }
+
+        return new UnsImpactPreview
+        {
+            AffectedEquipmentCount = line.EquipmentCount,
+            AffectedTagCount = line.TagCount,
+            CascadeWarnings = warnings,
+            RevisionToken = snapshot.RevisionToken,
+            HumanReadableSummary =
+                $"Moving line '{line.Name}' from area '{snapshot.FindAreaByLineId(line.LineId)?.Name ?? "?"}' " +
+                $"to '{targetArea.Name}' will re-home {line.EquipmentCount} equipment + re-parent {line.TagCount} tags.",
+        };
+    }
+
+    private static UnsImpactPreview AnalyzeAreaRename(UnsTreeSnapshot snapshot, UnsMoveOperation move)
+    {
+        var area = snapshot.FindArea(move.SourceAreaId!)
+                   ?? throw new UnsMoveValidationException($"Source area '{move.SourceAreaId}' not found in draft {snapshot.DraftGenerationId}.");
+
+        var affectedEquipment = area.LineIds
+            .Select(lid => snapshot.FindLine(lid)?.EquipmentCount ?? 0)
+            .Sum();
+        var affectedTags = area.LineIds
+            .Select(lid => snapshot.FindLine(lid)?.TagCount ?? 0)
+            .Sum();
+
+        return new UnsImpactPreview
+        {
+            AffectedEquipmentCount = affectedEquipment,
+            AffectedTagCount = affectedTags,
+            CascadeWarnings = [],
+            RevisionToken = snapshot.RevisionToken,
+            HumanReadableSummary =
+                $"Renaming area '{area.Name}' → '{move.NewName}' cascades to {area.LineIds.Count} lines / " +
+                $"{affectedEquipment} equipment / {affectedTags} tags.",
+        };
+    }
+
+    private static UnsImpactPreview AnalyzeLineMerge(UnsTreeSnapshot snapshot, UnsMoveOperation move)
+    {
+        var src = snapshot.FindLine(move.SourceLineId!)
+                  ?? throw new UnsMoveValidationException($"Source line '{move.SourceLineId}' not found.");
+        var dst = snapshot.FindLine(move.TargetLineId!)
+                  ?? throw new UnsMoveValidationException($"Target line '{move.TargetLineId}' not found.");
+
+        var warnings = new List<string>();
+        if (!string.Equals(snapshot.FindAreaByLineId(src.LineId)?.AreaId,
+                           snapshot.FindAreaByLineId(dst.LineId)?.AreaId,
+                           StringComparison.OrdinalIgnoreCase))
+        {
+            warnings.Add($"Lines '{src.Name}' and '{dst.Name}' are in different areas. The merge will re-parent equipment + tags into '{dst.Name}'s area.");
+        }
+
+        return new UnsImpactPreview
+        {
+            AffectedEquipmentCount = src.EquipmentCount,
+            AffectedTagCount = src.TagCount,
+            CascadeWarnings = warnings,
+            RevisionToken = snapshot.RevisionToken,
+            HumanReadableSummary =
+                $"Merging line '{src.Name}' into '{dst.Name}': {src.EquipmentCount} equipment + {src.TagCount} tags re-parent. " +
+                $"The source line is deleted at commit.",
+        };
+    }
+}
+
+/// <summary>Kind of UNS structural move the analyzer understands.</summary>
+public enum UnsMoveKind
+{
+    /// <summary>Drag a whole line from one area to another.</summary>
+    LineMove,
+
+    /// <summary>Rename an area (cascades to the UNS paths of every equipment + tag below it).</summary>
+    AreaRename,
+
+    /// <summary>Merge two lines into one; source line's equipment + tags are re-parented.</summary>
+    LineMerge,
+}
+
+/// <summary>One UNS structural move request.</summary>
+/// <param name="Kind">Move variant — selects which source + target fields are required.</param>
+/// <param name="SourceClusterId">Cluster of the source node. Must match <see cref="TargetClusterId"/> (decision #82).</param>
+/// <param name="TargetClusterId">Cluster of the target node.</param>
+/// <param name="SourceAreaId">Source area id for <see cref="UnsMoveKind.AreaRename"/>.</param>
+/// <param name="SourceLineId">Source line id for <see cref="UnsMoveKind.LineMove"/> / <see cref="UnsMoveKind.LineMerge"/>.</param>
+/// <param name="TargetAreaId">Target area id for <see cref="UnsMoveKind.LineMove"/>.</param>
+/// <param name="TargetLineId">Target line id for <see cref="UnsMoveKind.LineMerge"/>.</param>
+/// <param name="NewName">New display name for <see cref="UnsMoveKind.AreaRename"/>.</param>
+public sealed record UnsMoveOperation(
+    UnsMoveKind Kind,
+    string SourceClusterId,
+    string TargetClusterId,
+    string? SourceAreaId = null,
+    string? SourceLineId = null,
+    string? TargetAreaId = null,
+    string? TargetLineId = null,
+    string? NewName = null);
+
+/// <summary>Snapshot of the UNS tree + counts the analyzer walks.</summary>
+public sealed class UnsTreeSnapshot
+{
+    public required long DraftGenerationId { get; init; }
+    public required DraftRevisionToken RevisionToken { get; init; }
+    public required IReadOnlyList<UnsAreaSummary> Areas { get; init; }
+    public required IReadOnlyList<UnsLineSummary> Lines { get; init; }
+
+    public UnsAreaSummary? FindArea(string areaId) =>
+        Areas.FirstOrDefault(a => string.Equals(a.AreaId, areaId, StringComparison.OrdinalIgnoreCase));
+
+    public UnsLineSummary? FindLine(string lineId) =>
+        Lines.FirstOrDefault(l => string.Equals(l.LineId, lineId, StringComparison.OrdinalIgnoreCase));
+
+    public UnsAreaSummary? FindAreaByLineId(string lineId) =>
+        Areas.FirstOrDefault(a => a.LineIds.Contains(lineId, StringComparer.OrdinalIgnoreCase));
+}
+
+public sealed record UnsAreaSummary(string AreaId, string Name, IReadOnlyList<string> LineIds);
+
+public sealed record UnsLineSummary(string LineId, string Name, int EquipmentCount, int TagCount);
+
+/// <summary>
+///     Opaque per-draft revision fingerprint. Preview fetches the current token + stores it
+///     in the <see cref="UnsImpactPreview.RevisionToken"/>. Confirm compares the token against
+///     the draft's live value; mismatch means another operator mutated the draft between
+///     preview + commit — raise <c>409 Conflict / refresh-required</c> in the UI.
+/// </summary>
+public sealed record DraftRevisionToken(string Value)
+{
+    /// <summary>Compare two tokens for equality; null-safe.</summary>
+    public bool Matches(DraftRevisionToken? other) =>
+        other is not null &&
+        string.Equals(Value, other.Value, StringComparison.Ordinal);
+}
+
+/// <summary>Output of <see cref="UnsImpactAnalyzer.Analyze"/>.</summary>
+public sealed class UnsImpactPreview
+{
+    public required int AffectedEquipmentCount { get; init; }
+    public required int AffectedTagCount { get; init; }
+    public required IReadOnlyList<string> CascadeWarnings { get; init; }
+    public required DraftRevisionToken RevisionToken { get; init; }
+    public required string HumanReadableSummary { get; init; }
+}
+
+/// <summary>Thrown when a move targets a different cluster than the source (decision #82).</summary>
+public sealed class CrossClusterMoveRejectedException(string message) : Exception(message);
+
+/// <summary>Thrown when the move operation references a source / target that doesn't exist in the draft.</summary>
+public sealed class UnsMoveValidationException(string message) : Exception(message);

src/ZB.MOM.WW.OtOpcUa.Admin/Services/ValidatedNodeAclAuthoringService.cs

@@ -0,0 +1,117 @@
+using Microsoft.EntityFrameworkCore;
+using ZB.MOM.WW.OtOpcUa.Configuration;
+using ZB.MOM.WW.OtOpcUa.Configuration.Entities;
+using ZB.MOM.WW.OtOpcUa.Configuration.Enums;
+
+namespace ZB.MOM.WW.OtOpcUa.Admin.Services;
+
+/// <summary>
+///     Draft-aware write surface over <see cref="NodeAcl"/>. Replaces direct
+///     <see cref="NodeAclService"/> CRUD for Admin UI grant authoring; the raw service stays
+///     as the read / delete surface. Enforces the invariants listed in Phase 6.2 Stream D.2:
+///     scope-uniqueness per (LdapGroup, ScopeKind, ScopeId, GenerationId), grant shape
+///     consistency, and no empty permission masks.
+/// </summary>
+/// <remarks>
+///     <para>Per decision #129 grants are additive — <see cref="NodePermissions.None"/> is
+///     rejected at write time. Explicit Deny is v2.1 and is not representable in the current
+///     <c>NodeAcl</c> row; attempts to express it (e.g. empty permission set) surface as
+///     <see cref="InvalidNodeAclGrantException"/>.</para>
+///
+///     <para>Draft scope: writes always target an unpublished (Draft-state) generation id.
+///     Once a generation publishes, its rows are frozen.</para>
+/// </remarks>
+public sealed class ValidatedNodeAclAuthoringService(OtOpcUaConfigDbContext db)
+{
+    /// <summary>Add a new grant row to the given draft generation.</summary>
+    public async Task<NodeAcl> GrantAsync(
+        long draftGenerationId,
+        string clusterId,
+        string ldapGroup,
+        NodeAclScopeKind scopeKind,
+        string? scopeId,
+        NodePermissions permissions,
+        string? notes,
+        CancellationToken cancellationToken)
+    {
+        ArgumentException.ThrowIfNullOrWhiteSpace(clusterId);
+        ArgumentException.ThrowIfNullOrWhiteSpace(ldapGroup);
+
+        ValidateGrantShape(scopeKind, scopeId, permissions);
+        await EnsureNoDuplicate(draftGenerationId, clusterId, ldapGroup, scopeKind, scopeId, cancellationToken).ConfigureAwait(false);
+
+        var row = new NodeAcl
+        {
+            GenerationId = draftGenerationId,
+            NodeAclId = $"acl-{Guid.NewGuid():N}"[..20],
+            ClusterId = clusterId,
+            LdapGroup = ldapGroup,
+            ScopeKind = scopeKind,
+            ScopeId = scopeId,
+            PermissionFlags = permissions,
+            Notes = notes,
+        };
+        db.NodeAcls.Add(row);
+        await db.SaveChangesAsync(cancellationToken).ConfigureAwait(false);
+        return row;
+    }
+
+    /// <summary>
+    ///     Replace an existing grant's permission set in place. Validates the new shape;
+    ///     rejects attempts to blank-out to None (that's a Revoke via <see cref="NodeAclService"/>).
+    /// </summary>
+    public async Task<NodeAcl> UpdatePermissionsAsync(
+        Guid nodeAclRowId,
+        NodePermissions newPermissions,
+        string? notes,
+        CancellationToken cancellationToken)
+    {
+        if (newPermissions == NodePermissions.None)
+            throw new InvalidNodeAclGrantException(
+                "Permission set cannot be None — revoke the row instead of writing an empty grant.");
+
+        var row = await db.NodeAcls.FirstOrDefaultAsync(a => a.NodeAclRowId == nodeAclRowId, cancellationToken).ConfigureAwait(false)
+                  ?? throw new InvalidNodeAclGrantException($"NodeAcl row {nodeAclRowId} not found.");
+
+        row.PermissionFlags = newPermissions;
+        if (notes is not null) row.Notes = notes;
+        await db.SaveChangesAsync(cancellationToken).ConfigureAwait(false);
+        return row;
+    }
+
+    private static void ValidateGrantShape(NodeAclScopeKind scopeKind, string? scopeId, NodePermissions permissions)
+    {
+        if (permissions == NodePermissions.None)
+            throw new InvalidNodeAclGrantException(
+                "Permission set cannot be None — grants must carry at least one flag (decision #129, additive only).");
+
+        if (scopeKind == NodeAclScopeKind.Cluster && !string.IsNullOrEmpty(scopeId))
+            throw new InvalidNodeAclGrantException(
+                "Cluster-scope grants must have null ScopeId. ScopeId only applies to sub-cluster scopes.");
+
+        if (scopeKind != NodeAclScopeKind.Cluster && string.IsNullOrEmpty(scopeId))
+            throw new InvalidNodeAclGrantException(
+                $"ScopeKind={scopeKind} requires a populated ScopeId.");
+    }
+
+    private async Task EnsureNoDuplicate(
+        long generationId, string clusterId, string ldapGroup, NodeAclScopeKind scopeKind, string? scopeId,
+        CancellationToken cancellationToken)
+    {
+        var exists = await db.NodeAcls.AsNoTracking()
+            .AnyAsync(a => a.GenerationId == generationId
+                        && a.ClusterId == clusterId
+                        && a.LdapGroup == ldapGroup
+                        && a.ScopeKind == scopeKind
+                        && a.ScopeId == scopeId,
+                cancellationToken).ConfigureAwait(false);
+
+        if (exists)
+            throw new InvalidNodeAclGrantException(
+                $"A grant for (LdapGroup={ldapGroup}, ScopeKind={scopeKind}, ScopeId={scopeId}) already exists in generation {generationId}. " +
+                "Update the existing row's permissions instead of inserting a duplicate.");
+    }
+}
+
+/// <summary>Thrown when a <see cref="NodeAcl"/> grant authoring request violates an invariant.</summary>
+public sealed class InvalidNodeAclGrantException(string message) : Exception(message);

src/ZB.MOM.WW.OtOpcUa.Configuration/Entities/DriverInstanceResilienceStatus.cs

@@ -0,0 +1,44 @@
+namespace ZB.MOM.WW.OtOpcUa.Configuration.Entities;
+
+/// <summary>
+///     Runtime resilience counters the CapabilityInvoker + MemoryTracking + MemoryRecycle
+///     surfaces for each <c>(DriverInstanceId, HostName)</c> pair. Separate from
+///     <see cref="DriverHostStatus"/> (which owns per-host <i>connectivity</i> state) so a
+///     host that's Running but has tripped its breaker or is approaching its memory ceiling
+///     shows up distinctly on Admin <c>/hosts</c>.
+/// </summary>
+/// <remarks>
+///     Per <c>docs/v2/implementation/phase-6-1-resilience-and-observability.md</c> §Stream E.1.
+///     The Admin UI left-joins this table on DriverHostStatus for display; rows are written
+///     by the runtime via a HostedService that samples the tracker at a configurable
+///     interval (default 5 s) — writes are non-critical, a missed sample is tolerated.
+/// </remarks>
+public sealed class DriverInstanceResilienceStatus
+{
+    public required string DriverInstanceId { get; set; }
+    public required string HostName { get; set; }
+
+    /// <summary>Most recent time the circuit breaker for this (instance, host) opened; null if never.</summary>
+    public DateTime? LastCircuitBreakerOpenUtc { get; set; }
+
+    /// <summary>Rolling count of consecutive Polly pipeline failures for this (instance, host).</summary>
+    public int ConsecutiveFailures { get; set; }
+
+    /// <summary>Current Polly bulkhead depth (in-flight calls) for this (instance, host).</summary>
+    public int CurrentBulkheadDepth { get; set; }
+
+    /// <summary>Most recent process recycle time (Tier C only; null for in-process tiers).</summary>
+    public DateTime? LastRecycleUtc { get; set; }
+
+    /// <summary>
+    ///     Post-init memory baseline captured by <c>MemoryTracking</c> (median of first
+    ///     BaselineWindow samples). Zero while still warming up.
+    /// </summary>
+    public long BaselineFootprintBytes { get; set; }
+
+    /// <summary>Most recent footprint sample the tracker saw (steady-state read).</summary>
+    public long CurrentFootprintBytes { get; set; }
+
+    /// <summary>Row last-write timestamp — advances on every sampling tick.</summary>
+    public DateTime LastSampledUtc { get; set; }
+}

src/ZB.MOM.WW.OtOpcUa.Configuration/Entities/LdapGroupRoleMapping.cs

@@ -0,0 +1,56 @@
+using ZB.MOM.WW.OtOpcUa.Configuration.Enums;
+
+namespace ZB.MOM.WW.OtOpcUa.Configuration.Entities;
+
+/// <summary>
+///     Maps an LDAP group to an <see cref="AdminRole"/> for Admin UI access. Optionally scoped
+///     to one <see cref="ClusterId"/>; when <see cref="IsSystemWide"/> is true, the grant
+///     applies fleet-wide.
+/// </summary>
+/// <remarks>
+///     <para>Per <c>docs/v2/plan.md</c> decisions #105 and #150 — this entity is <b>control-plane
+///     only</b>. The OPC UA data-path evaluator does not read these rows; it reads
+///     <see cref="NodeAcl"/> joined directly against the session's resolved LDAP group
+///     memberships. Collapsing the two would let a user inherit tag permissions via an
+///     admin-role claim path never intended as a data-path grant.</para>
+///
+///     <para>Uniqueness: <c>(LdapGroup, ClusterId)</c> — the same LDAP group may hold
+///     different roles on different clusters, but only one row per cluster. A system-wide row
+///     (<c>IsSystemWide = true</c>, <c>ClusterId = null</c>) stacks additively with any
+///     cluster-scoped rows for the same group.</para>
+/// </remarks>
+public sealed class LdapGroupRoleMapping
+{
+    /// <summary>Surrogate primary key.</summary>
+    public Guid Id { get; set; }
+
+    /// <summary>
+    ///     LDAP group DN the membership query returns (e.g. <c>cn=fleet-admin,ou=groups,dc=corp,dc=example</c>).
+    ///     Comparison is case-insensitive per LDAP conventions.
+    /// </summary>
+    public required string LdapGroup { get; set; }
+
+    /// <summary>Admin role this group grants.</summary>
+    public required AdminRole Role { get; set; }
+
+    /// <summary>
+    ///     Cluster the grant applies to; <c>null</c> when <see cref="IsSystemWide"/> is true.
+    ///     Foreign key to <see cref="ServerCluster.ClusterId"/>.
+    /// </summary>
+    public string? ClusterId { get; set; }
+
+    /// <summary>
+    ///     <c>true</c> = grant applies across every cluster in the fleet; <c>ClusterId</c> must be null.
+    ///     <c>false</c> = grant is cluster-scoped; <c>ClusterId</c> must be populated.
+    /// </summary>
+    public required bool IsSystemWide { get; set; }
+
+    /// <summary>Row creation timestamp (UTC).</summary>
+    public DateTime CreatedAtUtc { get; set; }
+
+    /// <summary>Optional human-readable note (e.g. "added 2026-04-19 for Warsaw fleet admin handoff").</summary>
+    public string? Notes { get; set; }
+
+    /// <summary>Navigation for EF core when the row is cluster-scoped.</summary>
+    public ServerCluster? Cluster { get; set; }
+}

src/ZB.MOM.WW.OtOpcUa.Configuration/Enums/AdminRole.cs

@@ -0,0 +1,26 @@
+namespace ZB.MOM.WW.OtOpcUa.Configuration.Enums;
+
+/// <summary>
+///     Admin UI roles per <c>admin-ui.md</c> §"Admin Roles" and Phase 6.2 Stream A.
+///     These govern Admin UI capabilities (cluster CRUD, draft → publish, fleet-wide admin
+///     actions) — they do NOT govern OPC UA data-path authorization, which reads
+///     <see cref="Entities.NodeAcl"/> joined against LDAP group memberships directly.
+/// </summary>
+/// <remarks>
+///     Per <c>docs/v2/plan.md</c> decision #150 the two concerns share zero runtime code path:
+///     the control plane (Admin UI) consumes <see cref="Entities.LdapGroupRoleMapping"/>; the
+///     data plane consumes <see cref="Entities.NodeAcl"/> rows directly. Having them in one
+///     table would collapse the distinction + let a user inherit tag permissions via their
+///     admin-role claim path.
+/// </remarks>
+public enum AdminRole
+{
+    /// <summary>Read-only Admin UI access — can view cluster state, drafts, publish history.</summary>
+    ConfigViewer,
+
+    /// <summary>Can author drafts + submit for publish.</summary>
+    ConfigEditor,
+
+    /// <summary>Full Admin UI privileges including publish + fleet-admin actions.</summary>
+    FleetAdmin,
+}

src/ZB.MOM.WW.OtOpcUa.Configuration/LocalCache/GenerationSealedCache.cs

@@ -0,0 +1,170 @@
+using LiteDB;
+
+namespace ZB.MOM.WW.OtOpcUa.Configuration.LocalCache;
+
+/// <summary>
+///     Generation-sealed LiteDB cache per <c>docs/v2/plan.md</c> decision #148 and Phase 6.1
+///     Stream D.1. Each published generation writes one <b>read-only</b> LiteDB file under
+///     <c>&lt;cache-root&gt;/&lt;clusterId&gt;/&lt;generationId&gt;.db</c>. A per-cluster
+///     <c>CURRENT</c> text file holds the currently-active generation id; it is updated
+///     atomically (temp file + <see cref="File.Replace(string, string, string?)"/>) only after
+///     the sealed file is fully written.
+/// </summary>
+/// <remarks>
+///     <para>Mixed-generation reads are impossible: any read opens the single file pointed to
+///     by <c>CURRENT</c>, which is a coherent snapshot. Corruption of the CURRENT file or the
+///     sealed file surfaces as <see cref="GenerationCacheUnavailableException"/> — the reader
+///     fails closed rather than silently falling back to an older generation. Recovery path
+///     is to re-fetch from the central DB (and the Phase 6.1 Stream C <c>UsingStaleConfig</c>
+///     flag goes true until that succeeds).</para>
+///
+///     <para>This cache is the read-path fallback when the central DB is unreachable. The
+///     write path (draft edits, publish) bypasses the cache and fails hard on DB outage per
+///     Stream D.2 — inconsistent writes are worse than a temporary inability to edit.</para>
+/// </remarks>
+public sealed class GenerationSealedCache
+{
+    private const string CollectionName = "generation";
+    private const string CurrentPointerFileName = "CURRENT";
+    private readonly string _cacheRoot;
+
+    /// <summary>Root directory for all clusters' sealed caches.</summary>
+    public string CacheRoot => _cacheRoot;
+
+    public GenerationSealedCache(string cacheRoot)
+    {
+        ArgumentException.ThrowIfNullOrWhiteSpace(cacheRoot);
+        _cacheRoot = cacheRoot;
+        Directory.CreateDirectory(_cacheRoot);
+    }
+
+    /// <summary>
+    ///     Seal a generation: write the snapshot to <c>&lt;cluster&gt;/&lt;generationId&gt;.db</c>,
+    ///     mark the file read-only, then atomically publish the <c>CURRENT</c> pointer. Existing
+    ///     sealed files for prior generations are preserved (prune separately).
+    /// </summary>
+    public async Task SealAsync(GenerationSnapshot snapshot, CancellationToken ct = default)
+    {
+        ArgumentNullException.ThrowIfNull(snapshot);
+        ct.ThrowIfCancellationRequested();
+
+        var clusterDir = Path.Combine(_cacheRoot, snapshot.ClusterId);
+        Directory.CreateDirectory(clusterDir);
+        var sealedPath = Path.Combine(clusterDir, $"{snapshot.GenerationId}.db");
+
+        if (File.Exists(sealedPath))
+        {
+            // Already sealed — idempotent. Treat as no-op + update pointer in case an earlier
+            // seal succeeded but the pointer update failed (crash recovery).
+            WritePointerAtomically(clusterDir, snapshot.GenerationId);
+            return;
+        }
+
+        var tmpPath = sealedPath + ".tmp";
+        try
+        {
+            using (var db = new LiteDatabase(new ConnectionString { Filename = tmpPath, Upgrade = false }))
+            {
+                var col = db.GetCollection<GenerationSnapshot>(CollectionName);
+                col.Insert(snapshot);
+            }
+
+            File.Move(tmpPath, sealedPath);
+            File.SetAttributes(sealedPath, File.GetAttributes(sealedPath) | FileAttributes.ReadOnly);
+            WritePointerAtomically(clusterDir, snapshot.GenerationId);
+        }
+        catch
+        {
+            try { if (File.Exists(tmpPath)) File.Delete(tmpPath); } catch { /* best-effort */ }
+            throw;
+        }
+
+        await Task.CompletedTask;
+    }
+
+    /// <summary>
+    ///     Read the current sealed snapshot for <paramref name="clusterId"/>. Throws
+    ///     <see cref="GenerationCacheUnavailableException"/> when the pointer is missing
+    ///     (first-boot-no-snapshot case) or when the sealed file is corrupt. Never silently
+    ///     falls back to a prior generation.
+    /// </summary>
+    public Task<GenerationSnapshot> ReadCurrentAsync(string clusterId, CancellationToken ct = default)
+    {
+        ArgumentException.ThrowIfNullOrWhiteSpace(clusterId);
+        ct.ThrowIfCancellationRequested();
+
+        var clusterDir = Path.Combine(_cacheRoot, clusterId);
+        var pointerPath = Path.Combine(clusterDir, CurrentPointerFileName);
+        if (!File.Exists(pointerPath))
+            throw new GenerationCacheUnavailableException(
+                $"No sealed generation for cluster '{clusterId}' at '{clusterDir}'. First-boot case: the central DB must be reachable at least once before cache fallback is possible.");
+
+        long generationId;
+        try
+        {
+            var text = File.ReadAllText(pointerPath).Trim();
+            generationId = long.Parse(text, System.Globalization.CultureInfo.InvariantCulture);
+        }
+        catch (Exception ex)
+        {
+            throw new GenerationCacheUnavailableException(
+                $"CURRENT pointer at '{pointerPath}' is corrupt or unreadable.", ex);
+        }
+
+        var sealedPath = Path.Combine(clusterDir, $"{generationId}.db");
+        if (!File.Exists(sealedPath))
+            throw new GenerationCacheUnavailableException(
+                $"CURRENT points at generation {generationId} but '{sealedPath}' is missing — fails closed rather than serving an older generation.");
+
+        try
+        {
+            using var db = new LiteDatabase(new ConnectionString { Filename = sealedPath, ReadOnly = true });
+            var col = db.GetCollection<GenerationSnapshot>(CollectionName);
+            var snapshot = col.FindAll().FirstOrDefault()
+                ?? throw new GenerationCacheUnavailableException(
+                    $"Sealed file '{sealedPath}' contains no snapshot row — file is corrupt.");
+            return Task.FromResult(snapshot);
+        }
+        catch (GenerationCacheUnavailableException) { throw; }
+        catch (Exception ex) when (ex is LiteException or InvalidDataException or IOException
+                                      or NotSupportedException or FormatException)
+        {
+            throw new GenerationCacheUnavailableException(
+                $"Sealed file '{sealedPath}' is corrupt or unreadable — fails closed rather than falling back to an older generation.", ex);
+        }
+    }
+
+    /// <summary>Return the generation id the <c>CURRENT</c> pointer points at, or null if no pointer exists.</summary>
+    public long? TryGetCurrentGenerationId(string clusterId)
+    {
+        ArgumentException.ThrowIfNullOrWhiteSpace(clusterId);
+        var pointerPath = Path.Combine(_cacheRoot, clusterId, CurrentPointerFileName);
+        if (!File.Exists(pointerPath)) return null;
+        try
+        {
+            return long.Parse(File.ReadAllText(pointerPath).Trim(), System.Globalization.CultureInfo.InvariantCulture);
+        }
+        catch
+        {
+            return null;
+        }
+    }
+
+    private static void WritePointerAtomically(string clusterDir, long generationId)
+    {
+        var pointerPath = Path.Combine(clusterDir, CurrentPointerFileName);
+        var tmpPath = pointerPath + ".tmp";
+        File.WriteAllText(tmpPath, generationId.ToString(System.Globalization.CultureInfo.InvariantCulture));
+        if (File.Exists(pointerPath))
+            File.Replace(tmpPath, pointerPath, destinationBackupFileName: null);
+        else
+            File.Move(tmpPath, pointerPath);
+    }
+}
+
+/// <summary>Sealed cache is unreachable — caller must fail closed.</summary>
+public sealed class GenerationCacheUnavailableException : Exception
+{
+    public GenerationCacheUnavailableException(string message) : base(message) { }
+    public GenerationCacheUnavailableException(string message, Exception inner) : base(message, inner) { }
+}

src/ZB.MOM.WW.OtOpcUa.Configuration/LocalCache/ResilientConfigReader.cs

@@ -0,0 +1,90 @@
+using Microsoft.Extensions.Logging;
+using Polly;
+using Polly.Retry;
+using Polly.Timeout;
+
+namespace ZB.MOM.WW.OtOpcUa.Configuration.LocalCache;
+
+/// <summary>
+///     Wraps a central-DB fetch function with Phase 6.1 Stream D.2 resilience:
+///     <b>timeout 2 s → retry 3× jittered → fallback to sealed cache</b>. Maintains the
+///     <see cref="StaleConfigFlag"/> — fresh on central-DB success, stale on cache fallback.
+/// </summary>
+/// <remarks>
+///     <para>Read-path only per plan. The write path (draft save, publish) bypasses this
+///     wrapper entirely and fails hard on DB outage so inconsistent writes never land.</para>
+///
+///     <para>Fallback is triggered by <b>any exception</b> the fetch raises (central-DB
+///     unreachable, SqlException, timeout). If the sealed cache also fails (no pointer,
+///     corrupt file, etc.), <see cref="GenerationCacheUnavailableException"/> surfaces — caller
+///     must fail the current request (InitializeAsync for a driver, etc.).</para>
+/// </remarks>
+public sealed class ResilientConfigReader
+{
+    private readonly GenerationSealedCache _cache;
+    private readonly StaleConfigFlag _staleFlag;
+    private readonly ResiliencePipeline _pipeline;
+    private readonly ILogger<ResilientConfigReader> _logger;
+
+    public ResilientConfigReader(
+        GenerationSealedCache cache,
+        StaleConfigFlag staleFlag,
+        ILogger<ResilientConfigReader> logger,
+        TimeSpan? timeout = null,
+        int retryCount = 3)
+    {
+        _cache = cache;
+        _staleFlag = staleFlag;
+        _logger = logger;
+        var builder = new ResiliencePipelineBuilder()
+            .AddTimeout(new TimeoutStrategyOptions { Timeout = timeout ?? TimeSpan.FromSeconds(2) });
+
+        if (retryCount > 0)
+        {
+            builder.AddRetry(new RetryStrategyOptions
+            {
+                MaxRetryAttempts = retryCount,
+                BackoffType = DelayBackoffType.Exponential,
+                UseJitter = true,
+                Delay = TimeSpan.FromMilliseconds(100),
+                MaxDelay = TimeSpan.FromSeconds(1),
+                ShouldHandle = new PredicateBuilder().Handle<Exception>(ex => ex is not OperationCanceledException),
+            });
+        }
+
+        _pipeline = builder.Build();
+    }
+
+    /// <summary>
+    ///     Execute <paramref name="centralFetch"/> through the resilience pipeline. On full failure
+    ///     (post-retry), reads the sealed cache for <paramref name="clusterId"/> and passes the
+    ///     snapshot to <paramref name="fromSnapshot"/> to extract the requested shape.
+    /// </summary>
+    public async ValueTask<T> ReadAsync<T>(
+        string clusterId,
+        Func<CancellationToken, ValueTask<T>> centralFetch,
+        Func<GenerationSnapshot, T> fromSnapshot,
+        CancellationToken cancellationToken)
+    {
+        ArgumentException.ThrowIfNullOrWhiteSpace(clusterId);
+        ArgumentNullException.ThrowIfNull(centralFetch);
+        ArgumentNullException.ThrowIfNull(fromSnapshot);
+
+        try
+        {
+            var result = await _pipeline.ExecuteAsync(centralFetch, cancellationToken).ConfigureAwait(false);
+            _staleFlag.MarkFresh();
+            return result;
+        }
+        catch (Exception ex) when (ex is not OperationCanceledException)
+        {
+            _logger.LogWarning(ex, "Central-DB read failed after retries; falling back to sealed cache for cluster {ClusterId}", clusterId);
+            // GenerationCacheUnavailableException surfaces intentionally — fails the caller's
+            // operation. StaleConfigFlag stays unchanged; the flag only flips when we actually
+            // served a cache snapshot.
+            var snapshot = await _cache.ReadCurrentAsync(clusterId, cancellationToken).ConfigureAwait(false);
+            _staleFlag.MarkStale();
+            return fromSnapshot(snapshot);
+        }
+    }
+}

src/ZB.MOM.WW.OtOpcUa.Configuration/LocalCache/StaleConfigFlag.cs

@@ -0,0 +1,20 @@
+namespace ZB.MOM.WW.OtOpcUa.Configuration.LocalCache;
+
+/// <summary>
+///     Thread-safe <c>UsingStaleConfig</c> signal per Phase 6.1 Stream D.3. Flips true whenever
+///     a read falls back to a sealed cache snapshot; flips false on the next successful central-DB
+///     round-trip. Surfaced on <c>/healthz</c> body and on the Admin <c>/hosts</c> page.
+/// </summary>
+public sealed class StaleConfigFlag
+{
+    private int _stale;
+
+    /// <summary>True when the last config read was served from the sealed cache, not the central DB.</summary>
+    public bool IsStale => Volatile.Read(ref _stale) != 0;
+
+    /// <summary>Mark the current config as stale (a read fell back to the cache).</summary>
+    public void MarkStale() => Volatile.Write(ref _stale, 1);
+
+    /// <summary>Mark the current config as fresh (a central-DB read succeeded).</summary>
+    public void MarkFresh() => Volatile.Write(ref _stale, 0);
+}

src/ZB.MOM.WW.OtOpcUa.Configuration/Migrations/20260419124034_AddDriverInstanceResilienceStatus.cs

@@ -0,0 +1,46 @@
+using System;
+using Microsoft.EntityFrameworkCore.Migrations;
+
+#nullable disable
+
+namespace ZB.MOM.WW.OtOpcUa.Configuration.Migrations
+{
+    /// <inheritdoc />
+    public partial class AddDriverInstanceResilienceStatus : Migration
+    {
+        /// <inheritdoc />
+        protected override void Up(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.CreateTable(
+                name: "DriverInstanceResilienceStatus",
+                columns: table => new
+                {
+                    DriverInstanceId = table.Column<string>(type: "nvarchar(64)", maxLength: 64, nullable: false),
+                    HostName = table.Column<string>(type: "nvarchar(256)", maxLength: 256, nullable: false),
+                    LastCircuitBreakerOpenUtc = table.Column<DateTime>(type: "datetime2(3)", nullable: true),
+                    ConsecutiveFailures = table.Column<int>(type: "int", nullable: false),
+                    CurrentBulkheadDepth = table.Column<int>(type: "int", nullable: false),
+                    LastRecycleUtc = table.Column<DateTime>(type: "datetime2(3)", nullable: true),
+                    BaselineFootprintBytes = table.Column<long>(type: "bigint", nullable: false),
+                    CurrentFootprintBytes = table.Column<long>(type: "bigint", nullable: false),
+                    LastSampledUtc = table.Column<DateTime>(type: "datetime2(3)", nullable: false)
+                },
+                constraints: table =>
+                {
+                    table.PrimaryKey("PK_DriverInstanceResilienceStatus", x => new { x.DriverInstanceId, x.HostName });
+                });
+
+            migrationBuilder.CreateIndex(
+                name: "IX_DriverResilience_LastSampled",
+                table: "DriverInstanceResilienceStatus",
+                column: "LastSampledUtc");
+        }
+
+        /// <inheritdoc />
+        protected override void Down(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.DropTable(
+                name: "DriverInstanceResilienceStatus");
+        }
+    }
+}

src/ZB.MOM.WW.OtOpcUa.Configuration/Migrations/20260419131444_AddLdapGroupRoleMapping.cs

@@ -0,0 +1,62 @@
+using System;
+using Microsoft.EntityFrameworkCore.Migrations;
+
+#nullable disable
+
+namespace ZB.MOM.WW.OtOpcUa.Configuration.Migrations
+{
+    /// <inheritdoc />
+    public partial class AddLdapGroupRoleMapping : Migration
+    {
+        /// <inheritdoc />
+        protected override void Up(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.CreateTable(
+                name: "LdapGroupRoleMapping",
+                columns: table => new
+                {
+                    Id = table.Column<Guid>(type: "uniqueidentifier", nullable: false),
+                    LdapGroup = table.Column<string>(type: "nvarchar(512)", maxLength: 512, nullable: false),
+                    Role = table.Column<string>(type: "nvarchar(32)", maxLength: 32, nullable: false),
+                    ClusterId = table.Column<string>(type: "nvarchar(64)", maxLength: 64, nullable: true),
+                    IsSystemWide = table.Column<bool>(type: "bit", nullable: false),
+                    CreatedAtUtc = table.Column<DateTime>(type: "datetime2(3)", nullable: false),
+                    Notes = table.Column<string>(type: "nvarchar(512)", maxLength: 512, nullable: true)
+                },
+                constraints: table =>
+                {
+                    table.PrimaryKey("PK_LdapGroupRoleMapping", x => x.Id);
+                    table.ForeignKey(
+                        name: "FK_LdapGroupRoleMapping_ServerCluster_ClusterId",
+                        column: x => x.ClusterId,
+                        principalTable: "ServerCluster",
+                        principalColumn: "ClusterId",
+                        onDelete: ReferentialAction.Cascade);
+                });
+
+            migrationBuilder.CreateIndex(
+                name: "IX_LdapGroupRoleMapping_ClusterId",
+                table: "LdapGroupRoleMapping",
+                column: "ClusterId");
+
+            migrationBuilder.CreateIndex(
+                name: "IX_LdapGroupRoleMapping_Group",
+                table: "LdapGroupRoleMapping",
+                column: "LdapGroup");
+
+            migrationBuilder.CreateIndex(
+                name: "UX_LdapGroupRoleMapping_Group_Cluster",
+                table: "LdapGroupRoleMapping",
+                columns: new[] { "LdapGroup", "ClusterId" },
+                unique: true,
+                filter: "[ClusterId] IS NOT NULL");
+        }
+
+        /// <inheritdoc />
+        protected override void Down(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.DropTable(
+                name: "LdapGroupRoleMapping");
+        }
+    }
+}

src/ZB.MOM.WW.OtOpcUa.Configuration/Migrations/OtOpcUaConfigDbContextModelSnapshot.cs

@@ -434,6 +434,45 @@ namespace ZB.MOM.WW.OtOpcUa.Configuration.Migrations
                         });
                 });
 
+            modelBuilder.Entity("ZB.MOM.WW.OtOpcUa.Configuration.Entities.DriverInstanceResilienceStatus", b =>
+                {
+                    b.Property<string>("DriverInstanceId")
+                        .HasMaxLength(64)
+                        .HasColumnType("nvarchar(64)");
+
+                    b.Property<string>("HostName")
+                        .HasMaxLength(256)
+                        .HasColumnType("nvarchar(256)");
+
+                    b.Property<long>("BaselineFootprintBytes")
+                        .HasColumnType("bigint");
+
+                    b.Property<int>("ConsecutiveFailures")
+                        .HasColumnType("int");
+
+                    b.Property<int>("CurrentBulkheadDepth")
+                        .HasColumnType("int");
+
+                    b.Property<long>("CurrentFootprintBytes")
+                        .HasColumnType("bigint");
+
+                    b.Property<DateTime?>("LastCircuitBreakerOpenUtc")
+                        .HasColumnType("datetime2(3)");
+
+                    b.Property<DateTime?>("LastRecycleUtc")
+                        .HasColumnType("datetime2(3)");
+
+                    b.Property<DateTime>("LastSampledUtc")
+                        .HasColumnType("datetime2(3)");
+
+                    b.HasKey("DriverInstanceId", "HostName");
+
+                    b.HasIndex("LastSampledUtc")
+                        .HasDatabaseName("IX_DriverResilience_LastSampled");
+
+                    b.ToTable("DriverInstanceResilienceStatus", (string)null);
+                });
+
             modelBuilder.Entity("ZB.MOM.WW.OtOpcUa.Configuration.Entities.Equipment", b =>
                 {
                     b.Property<Guid>("EquipmentRowId")
@@ -624,6 +663,51 @@ namespace ZB.MOM.WW.OtOpcUa.Configuration.Migrations
                     b.ToTable("ExternalIdReservation", (string)null);
                 });
 
+            modelBuilder.Entity("ZB.MOM.WW.OtOpcUa.Configuration.Entities.LdapGroupRoleMapping", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("uniqueidentifier");
+
+                    b.Property<string>("ClusterId")
+                        .HasMaxLength(64)
+                        .HasColumnType("nvarchar(64)");
+
+                    b.Property<DateTime>("CreatedAtUtc")
+                        .HasColumnType("datetime2(3)");
+
+                    b.Property<bool>("IsSystemWide")
+                        .HasColumnType("bit");
+
+                    b.Property<string>("LdapGroup")
+                        .IsRequired()
+                        .HasMaxLength(512)
+                        .HasColumnType("nvarchar(512)");
+
+                    b.Property<string>("Notes")
+                        .HasMaxLength(512)
+                        .HasColumnType("nvarchar(512)");
+
+                    b.Property<string>("Role")
+                        .IsRequired()
+                        .HasMaxLength(32)
+                        .HasColumnType("nvarchar(32)");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("ClusterId");
+
+                    b.HasIndex("LdapGroup")
+                        .HasDatabaseName("IX_LdapGroupRoleMapping_Group");
+
+                    b.HasIndex("LdapGroup", "ClusterId")
+                        .IsUnique()
+                        .HasDatabaseName("UX_LdapGroupRoleMapping_Group_Cluster")
+                        .HasFilter("[ClusterId] IS NOT NULL");
+
+                    b.ToTable("LdapGroupRoleMapping", (string)null);
+                });
+
             modelBuilder.Entity("ZB.MOM.WW.OtOpcUa.Configuration.Entities.Namespace", b =>
                 {
                     b.Property<Guid>("NamespaceRowId")
@@ -1142,6 +1226,16 @@ namespace ZB.MOM.WW.OtOpcUa.Configuration.Migrations
                     b.Navigation("Generation");
                 });
 
+            modelBuilder.Entity("ZB.MOM.WW.OtOpcUa.Configuration.Entities.LdapGroupRoleMapping", b =>
+                {
+                    b.HasOne("ZB.MOM.WW.OtOpcUa.Configuration.Entities.ServerCluster", "Cluster")
+                        .WithMany()
+                        .HasForeignKey("ClusterId")
+                        .OnDelete(DeleteBehavior.Cascade);
+
+                    b.Navigation("Cluster");
+                });
+
             modelBuilder.Entity("ZB.MOM.WW.OtOpcUa.Configuration.Entities.Namespace", b =>
                 {
                     b.HasOne("ZB.MOM.WW.OtOpcUa.Configuration.Entities.ServerCluster", "Cluster")

src/ZB.MOM.WW.OtOpcUa.Configuration/OtOpcUaConfigDbContext.cs

@@ -28,6 +28,8 @@ public sealed class OtOpcUaConfigDbContext(DbContextOptions<OtOpcUaConfigDbConte
     public DbSet<ConfigAuditLog> ConfigAuditLogs => Set<ConfigAuditLog>();
     public DbSet<ExternalIdReservation> ExternalIdReservations => Set<ExternalIdReservation>();
     public DbSet<DriverHostStatus> DriverHostStatuses => Set<DriverHostStatus>();
+    public DbSet<DriverInstanceResilienceStatus> DriverInstanceResilienceStatuses => Set<DriverInstanceResilienceStatus>();
+    public DbSet<LdapGroupRoleMapping> LdapGroupRoleMappings => Set<LdapGroupRoleMapping>();
 
     protected override void OnModelCreating(ModelBuilder modelBuilder)
     {
@@ -49,6 +51,8 @@ public sealed class OtOpcUaConfigDbContext(DbContextOptions<OtOpcUaConfigDbConte
         ConfigureConfigAuditLog(modelBuilder);
         ConfigureExternalIdReservation(modelBuilder);
         ConfigureDriverHostStatus(modelBuilder);
+        ConfigureDriverInstanceResilienceStatus(modelBuilder);
+        ConfigureLdapGroupRoleMapping(modelBuilder);
     }
 
     private static void ConfigureServerCluster(ModelBuilder modelBuilder)
@@ -512,4 +516,53 @@ public sealed class OtOpcUaConfigDbContext(DbContextOptions<OtOpcUaConfigDbConte
             e.HasIndex(x => x.LastSeenUtc).HasDatabaseName("IX_DriverHostStatus_LastSeen");
         });
     }
+
+    private static void ConfigureDriverInstanceResilienceStatus(ModelBuilder modelBuilder)
+    {
+        modelBuilder.Entity<DriverInstanceResilienceStatus>(e =>
+        {
+            e.ToTable("DriverInstanceResilienceStatus");
+            e.HasKey(x => new { x.DriverInstanceId, x.HostName });
+            e.Property(x => x.DriverInstanceId).HasMaxLength(64);
+            e.Property(x => x.HostName).HasMaxLength(256);
+            e.Property(x => x.LastCircuitBreakerOpenUtc).HasColumnType("datetime2(3)");
+            e.Property(x => x.LastRecycleUtc).HasColumnType("datetime2(3)");
+            e.Property(x => x.LastSampledUtc).HasColumnType("datetime2(3)");
+            // LastSampledUtc drives the Admin UI's stale-sample filter same way DriverHostStatus's
+            // LastSeenUtc index does for connectivity rows.
+            e.HasIndex(x => x.LastSampledUtc).HasDatabaseName("IX_DriverResilience_LastSampled");
+        });
+    }
+
+    private static void ConfigureLdapGroupRoleMapping(ModelBuilder modelBuilder)
+    {
+        modelBuilder.Entity<LdapGroupRoleMapping>(e =>
+        {
+            e.ToTable("LdapGroupRoleMapping");
+            e.HasKey(x => x.Id);
+            e.Property(x => x.LdapGroup).HasMaxLength(512).IsRequired();
+            e.Property(x => x.Role).HasConversion<string>().HasMaxLength(32);
+            e.Property(x => x.ClusterId).HasMaxLength(64);
+            e.Property(x => x.CreatedAtUtc).HasColumnType("datetime2(3)");
+            e.Property(x => x.Notes).HasMaxLength(512);
+
+            // FK to ServerCluster when cluster-scoped; null for system-wide grants.
+            e.HasOne(x => x.Cluster)
+                .WithMany()
+                .HasForeignKey(x => x.ClusterId)
+                .OnDelete(DeleteBehavior.Cascade);
+
+            // Uniqueness: one row per (LdapGroup, ClusterId). Null ClusterId is treated as its own
+            // "bucket" so a system-wide row coexists with cluster-scoped rows for the same group.
+            // SQL Server treats NULL as a distinct value in unique-index comparisons by default
+            // since 2008 SP1 onwards under the session setting we use — tested in SchemaCompliance.
+            e.HasIndex(x => new { x.LdapGroup, x.ClusterId })
+                .IsUnique()
+                .HasDatabaseName("UX_LdapGroupRoleMapping_Group_Cluster");
+
+            // Hot-path lookup during cookie auth: "what grants does this user's set of LDAP
+            // groups carry?". Fires on every sign-in so the index earns its keep.
+            e.HasIndex(x => x.LdapGroup).HasDatabaseName("IX_LdapGroupRoleMapping_Group");
+        });
+    }
 }

src/ZB.MOM.WW.OtOpcUa.Configuration/Services/ILdapGroupRoleMappingService.cs

@@ -0,0 +1,47 @@
+using ZB.MOM.WW.OtOpcUa.Configuration.Entities;
+using ZB.MOM.WW.OtOpcUa.Configuration.Enums;
+
+namespace ZB.MOM.WW.OtOpcUa.Configuration.Services;
+
+/// <summary>
+///     CRUD surface for <see cref="LdapGroupRoleMapping"/> — the control-plane mapping from
+///     LDAP groups to Admin UI roles. Consumed only by Admin UI code paths; the OPC UA
+///     data-path evaluator MUST NOT depend on this interface (see decision #150 and the
+///     Phase 6.2 compliance check on control/data-plane separation).
+/// </summary>
+/// <remarks>
+///     Per Phase 6.2 Stream A.2 this service is expected to run behind the Phase 6.1
+///     <c>ResilientConfigReader</c> pipeline (timeout → retry → fallback-to-cache) so a
+///     transient DB outage during sign-in falls back to the sealed snapshot rather than
+///     denying every login.
+/// </remarks>
+public interface ILdapGroupRoleMappingService
+{
+    /// <summary>List every mapping whose LDAP group matches one of <paramref name="ldapGroups"/>.</summary>
+    /// <remarks>
+    ///     Hot path — fires on every sign-in. The default EF implementation relies on the
+    ///     <c>IX_LdapGroupRoleMapping_Group</c> index. Case-insensitive per LDAP conventions.
+    /// </remarks>
+    Task<IReadOnlyList<LdapGroupRoleMapping>> GetByGroupsAsync(
+        IEnumerable<string> ldapGroups, CancellationToken cancellationToken);
+
+    /// <summary>Enumerate every mapping; Admin UI listing only.</summary>
+    Task<IReadOnlyList<LdapGroupRoleMapping>> ListAllAsync(CancellationToken cancellationToken);
+
+    /// <summary>Create a new grant.</summary>
+    /// <exception cref="InvalidLdapGroupRoleMappingException">
+    ///     Thrown when the proposed row violates an invariant (IsSystemWide inconsistent with
+    ///     ClusterId, duplicate (group, cluster) pair, etc.) — ValidatedLdapGroupRoleMappingService
+    ///     is the write surface that enforces these; the raw service here surfaces DB-level violations.
+    /// </exception>
+    Task<LdapGroupRoleMapping> CreateAsync(LdapGroupRoleMapping row, CancellationToken cancellationToken);
+
+    /// <summary>Delete a mapping by its surrogate key.</summary>
+    Task DeleteAsync(Guid id, CancellationToken cancellationToken);
+}
+
+/// <summary>Thrown when <see cref="LdapGroupRoleMapping"/> authoring violates an invariant.</summary>
+public sealed class InvalidLdapGroupRoleMappingException : Exception
+{
+    public InvalidLdapGroupRoleMappingException(string message) : base(message) { }
+}

src/ZB.MOM.WW.OtOpcUa.Configuration/Services/LdapGroupRoleMappingService.cs

@@ -0,0 +1,69 @@
+using Microsoft.EntityFrameworkCore;
+using ZB.MOM.WW.OtOpcUa.Configuration.Entities;
+
+namespace ZB.MOM.WW.OtOpcUa.Configuration.Services;
+
+/// <summary>
+///     EF Core implementation of <see cref="ILdapGroupRoleMappingService"/>. Enforces the
+///     "exactly one of (ClusterId, IsSystemWide)" invariant at the write surface so a
+///     malformed row can't land in the DB.
+/// </summary>
+public sealed class LdapGroupRoleMappingService(OtOpcUaConfigDbContext db) : ILdapGroupRoleMappingService
+{
+    public async Task<IReadOnlyList<LdapGroupRoleMapping>> GetByGroupsAsync(
+        IEnumerable<string> ldapGroups, CancellationToken cancellationToken)
+    {
+        ArgumentNullException.ThrowIfNull(ldapGroups);
+        var groupSet = ldapGroups.ToList();
+        if (groupSet.Count == 0) return [];
+
+        return await db.LdapGroupRoleMappings
+            .AsNoTracking()
+            .Where(m => groupSet.Contains(m.LdapGroup))
+            .ToListAsync(cancellationToken)
+            .ConfigureAwait(false);
+    }
+
+    public async Task<IReadOnlyList<LdapGroupRoleMapping>> ListAllAsync(CancellationToken cancellationToken)
+        => await db.LdapGroupRoleMappings
+            .AsNoTracking()
+            .OrderBy(m => m.LdapGroup)
+            .ThenBy(m => m.ClusterId)
+            .ToListAsync(cancellationToken)
+            .ConfigureAwait(false);
+
+    public async Task<LdapGroupRoleMapping> CreateAsync(LdapGroupRoleMapping row, CancellationToken cancellationToken)
+    {
+        ArgumentNullException.ThrowIfNull(row);
+        ValidateInvariants(row);
+
+        if (row.Id == Guid.Empty) row.Id = Guid.NewGuid();
+        if (row.CreatedAtUtc == default) row.CreatedAtUtc = DateTime.UtcNow;
+
+        db.LdapGroupRoleMappings.Add(row);
+        await db.SaveChangesAsync(cancellationToken).ConfigureAwait(false);
+        return row;
+    }
+
+    public async Task DeleteAsync(Guid id, CancellationToken cancellationToken)
+    {
+        var existing = await db.LdapGroupRoleMappings.FindAsync([id], cancellationToken).ConfigureAwait(false);
+        if (existing is null) return;
+        db.LdapGroupRoleMappings.Remove(existing);
+        await db.SaveChangesAsync(cancellationToken).ConfigureAwait(false);
+    }
+
+    private static void ValidateInvariants(LdapGroupRoleMapping row)
+    {
+        if (string.IsNullOrWhiteSpace(row.LdapGroup))
+            throw new InvalidLdapGroupRoleMappingException("LdapGroup must not be empty.");
+
+        if (row.IsSystemWide && !string.IsNullOrEmpty(row.ClusterId))
+            throw new InvalidLdapGroupRoleMappingException(
+                "IsSystemWide=true requires ClusterId to be null. A fleet-wide grant cannot also be cluster-scoped.");
+
+        if (!row.IsSystemWide && string.IsNullOrEmpty(row.ClusterId))
+            throw new InvalidLdapGroupRoleMappingException(
+                "IsSystemWide=false requires a populated ClusterId. A cluster-scoped grant needs its target cluster.");
+    }
+}

src/ZB.MOM.WW.OtOpcUa.Configuration/ZB.MOM.WW.OtOpcUa.Configuration.csproj

@@ -19,7 +19,9 @@
             <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
         </PackageReference>
         <PackageReference Include="Microsoft.Extensions.Configuration.Abstractions" Version="10.0.0"/>
+        <PackageReference Include="Microsoft.Extensions.Logging.Abstractions" Version="10.0.0"/>
         <PackageReference Include="LiteDB" Version="5.0.21"/>
+        <PackageReference Include="Polly.Core" Version="8.6.6"/>
     </ItemGroup>
 
     <ItemGroup>

src/ZB.MOM.WW.OtOpcUa.Core.Abstractions/DriverAttributeInfo.cs

@@ -25,6 +25,14 @@ namespace ZB.MOM.WW.OtOpcUa.Core.Abstractions;
 ///     OPC UA <c>AlarmConditionState</c> when true. Defaults to false so existing non-Galaxy
 ///     drivers aren't forced to flow a flag they don't produce.
 /// </param>
+/// <param name="WriteIdempotent">
+///     True when a timed-out or failed write to this attribute is safe to replay. Per
+///     <c>docs/v2/plan.md</c> decisions #44, #45, #143 — writes are NOT auto-retried by default
+///     because replaying a pulse / alarm-ack / counter-increment / recipe-step advance can
+///     duplicate field actions. Drivers flag only tags whose semantics make retry safe
+///     (holding registers with level-set values, set-point writes to analog tags) — the
+///     capability invoker respects this flag when deciding whether to apply Polly retry.
+/// </param>
 public sealed record DriverAttributeInfo(
     string FullName,
     DriverDataType DriverDataType,
@@ -32,4 +40,5 @@ public sealed record DriverAttributeInfo(
     uint? ArrayDim,
     SecurityClassification SecurityClass,
     bool IsHistorized,
-    bool IsAlarm = false);
+    bool IsAlarm = false,
+    bool WriteIdempotent = false);

src/ZB.MOM.WW.OtOpcUa.Core.Abstractions/DriverCapability.cs

@@ -0,0 +1,42 @@
+namespace ZB.MOM.WW.OtOpcUa.Core.Abstractions;
+
+/// <summary>
+///     Enumerates the driver-capability surface points guarded by Phase 6.1 resilience pipelines.
+///     Each value corresponds to one method (or tightly-related method group) on the
+///     <c>Core.Abstractions</c> capability interfaces (<see cref="IReadable"/>, <see cref="IWritable"/>,
+///     <see cref="ITagDiscovery"/>, <see cref="ISubscribable"/>, <see cref="IHostConnectivityProbe"/>,
+///     <see cref="IAlarmSource"/>, <see cref="IHistoryProvider"/>).
+/// </summary>
+/// <remarks>
+///     Per <c>docs/v2/plan.md</c> decision #143 (per-capability retry policy): Read / HistoryRead /
+///     Discover / Probe / AlarmSubscribe auto-retry; <see cref="Write"/> does NOT retry unless the
+///     tag-definition carries <see cref="WriteIdempotentAttribute"/>. Alarm-acknowledge is treated
+///     as a write for retry semantics (an alarm-ack is not idempotent at the plant-floor acknowledgement
+///     level even if the OPC UA spec permits re-issue).
+/// </remarks>
+public enum DriverCapability
+{
+    /// <summary>Batch <see cref="IReadable.ReadAsync"/>. Retries by default.</summary>
+    Read,
+
+    /// <summary>Batch <see cref="IWritable.WriteAsync"/>. Does not retry unless tag is <see cref="WriteIdempotentAttribute">idempotent</see>.</summary>
+    Write,
+
+    /// <summary><see cref="ITagDiscovery.DiscoverAsync"/>. Retries by default.</summary>
+    Discover,
+
+    /// <summary><see cref="ISubscribable.SubscribeAsync"/> and unsubscribe. Retries by default.</summary>
+    Subscribe,
+
+    /// <summary><see cref="IHostConnectivityProbe"/> probe loop. Retries by default.</summary>
+    Probe,
+
+    /// <summary><see cref="IAlarmSource.SubscribeAlarmsAsync"/>. Retries by default.</summary>
+    AlarmSubscribe,
+
+    /// <summary><see cref="IAlarmSource.AcknowledgeAsync"/>. Does NOT retry — ack is a write-shaped operation (decision #143).</summary>
+    AlarmAcknowledge,
+
+    /// <summary><see cref="IHistoryProvider"/> reads (Raw/Processed/AtTime/Events). Retries by default.</summary>
+    HistoryRead,
+}

src/ZB.MOM.WW.OtOpcUa.Core.Abstractions/DriverTier.cs

@@ -0,0 +1,34 @@
+namespace ZB.MOM.WW.OtOpcUa.Core.Abstractions;
+
+/// <summary>
+///     Stability tier of a driver type. Determines which cross-cutting runtime protections
+///     apply — per-tier retry defaults, memory-tracking thresholds, and whether out-of-process
+///     supervision with process-level recycle is in play.
+/// </summary>
+/// <remarks>
+///     Per <c>docs/v2/driver-stability.md</c> §2-4 and <c>docs/v2/plan.md</c> decisions #63-74.
+///
+///     <list type="bullet">
+///         <item><b>A</b> — managed, known-good SDK; low blast radius. In-process. Fast retries.
+///             Examples: OPC UA Client (OPCFoundation stack), S7 (S7NetPlus).</item>
+///         <item><b>B</b> — native or semi-trusted SDK with an in-process footprint. Examples: Modbus.</item>
+///         <item><b>C</b> — unmanaged SDK with COM/STA constraints, leak risk, or other out-of-process
+///             requirements. Must run as a separate Host process behind a Proxy with a supervisor that
+///             can recycle the process on hard-breach. Example: Galaxy (MXAccess COM).</item>
+///     </list>
+///
+///     <para>Process-kill protections (<c>MemoryRecycle</c>, <c>ScheduledRecycleScheduler</c>) are
+///     Tier C only per decisions #73-74 and #145 — killing an in-process Tier A/B driver also kills
+///     every OPC UA session and every co-hosted driver, blast-radius worse than the leak.</para>
+/// </remarks>
+public enum DriverTier
+{
+    /// <summary>Managed SDK, in-process, low blast radius.</summary>
+    A,
+
+    /// <summary>Native or semi-trusted SDK, in-process.</summary>
+    B,
+
+    /// <summary>Unmanaged SDK, out-of-process required with Proxy+Host+Supervisor.</summary>
+    C,
+}

src/ZB.MOM.WW.OtOpcUa.Core.Abstractions/DriverTypeRegistry.cs

@@ -69,12 +69,20 @@ public sealed class DriverTypeRegistry
 /// <param name="DriverConfigJsonSchema">JSON Schema (Draft 2020-12) the driver's <c>DriverConfig</c> column must validate against.</param>
 /// <param name="DeviceConfigJsonSchema">JSON Schema for <c>DeviceConfig</c> (multi-device drivers); null if the driver has no device layer.</param>
 /// <param name="TagConfigJsonSchema">JSON Schema for <c>TagConfig</c>; required for every driver since every driver has tags.</param>
+/// <param name="Tier">
+///     Stability tier per <c>docs/v2/driver-stability.md</c> §2-4 and <c>docs/v2/plan.md</c>
+///     decisions #63-74. Drives the shared resilience pipeline defaults
+///     (<see cref="Tier"/> × capability → <c>CapabilityPolicy</c>), the <c>MemoryTracking</c>
+///     hybrid-formula constants, and whether process-level <c>MemoryRecycle</c> / scheduled-
+///     recycle protections apply (Tier C only). Every registered driver type must declare one.
+/// </param>
 public sealed record DriverTypeMetadata(
     string TypeName,
     NamespaceKindCompatibility AllowedNamespaceKinds,
     string DriverConfigJsonSchema,
     string? DeviceConfigJsonSchema,
-    string TagConfigJsonSchema);
+    string TagConfigJsonSchema,
+    DriverTier Tier);
 
 /// <summary>Bitmask of namespace kinds a driver type may populate. Per decision #111.</summary>
 [Flags]

src/ZB.MOM.WW.OtOpcUa.Core.Abstractions/IDriverSupervisor.cs

@@ -0,0 +1,26 @@
+namespace ZB.MOM.WW.OtOpcUa.Core.Abstractions;
+
+/// <summary>
+///     Process-level supervisor contract a Tier C driver's out-of-process topology provides
+///     (e.g. <c>Driver.Galaxy.Proxy/Supervisor/</c>). Concerns: restart the Host process when a
+///     hard fault is detected (memory breach, wedge, scheduled recycle window).
+/// </summary>
+/// <remarks>
+///     Per <c>docs/v2/plan.md</c> decisions #68, #73-74, and #145. Tier A/B drivers do NOT have
+///     a supervisor because they run in-process — recycling would kill every OPC UA session and
+///     every co-hosted driver. The Core.Stability layer only invokes this interface for Tier C
+///     instances after asserting the tier via <see cref="DriverTypeMetadata.Tier"/>.
+/// </remarks>
+public interface IDriverSupervisor
+{
+    /// <summary>Driver instance this supervisor governs.</summary>
+    string DriverInstanceId { get; }
+
+    /// <summary>
+    ///     Request the supervisor to recycle (terminate + restart) the Host process. Implementations
+    ///     are expected to be idempotent under repeat calls during an in-flight recycle.
+    /// </summary>
+    /// <param name="reason">Human-readable reason — flows into the supervisor's logs.</param>
+    /// <param name="cancellationToken">Cancels the recycle request; an in-flight restart is not interrupted.</param>
+    Task RecycleAsync(string reason, CancellationToken cancellationToken);
+}

src/ZB.MOM.WW.OtOpcUa.Core.Abstractions/OpcUaOperation.cs

@@ -0,0 +1,59 @@
+namespace ZB.MOM.WW.OtOpcUa.Core.Abstractions;
+
+/// <summary>
+///     Every OPC UA operation surface the Phase 6.2 authorization evaluator gates, per
+///     <c>docs/v2/implementation/phase-6-2-authorization-runtime.md</c> §Stream C and
+///     decision #143. The evaluator maps each operation onto the corresponding
+///     <c>NodePermissions</c> bit(s) to decide whether the calling session is allowed.
+/// </summary>
+/// <remarks>
+///     Write is split out into <see cref="WriteOperate"/> / <see cref="WriteTune"/> /
+///     <see cref="WriteConfigure"/> because the underlying driver-reported
+///     <see cref="SecurityClassification"/> already carries that distinction — the
+///     evaluator maps the requested tag's security class to the matching operation value
+///     before checking the permission bit.
+/// </remarks>
+public enum OpcUaOperation
+{
+    /// <summary>
+    ///     <c>Browse</c> + <c>TranslateBrowsePathsToNodeIds</c>. Ancestor visibility implied
+    ///     when any descendant has a grant; denied ancestors filter from browse results.
+    /// </summary>
+    Browse,
+
+    /// <summary><c>Read</c> on a variable node.</summary>
+    Read,
+
+    /// <summary><c>Write</c> when the target has <see cref="SecurityClassification.Operate"/> / <see cref="SecurityClassification.FreeAccess"/>.</summary>
+    WriteOperate,
+
+    /// <summary><c>Write</c> when the target has <see cref="SecurityClassification.Tune"/>.</summary>
+    WriteTune,
+
+    /// <summary><c>Write</c> when the target has <see cref="SecurityClassification.Configure"/>.</summary>
+    WriteConfigure,
+
+    /// <summary><c>HistoryRead</c> — uses its own <c>NodePermissions.HistoryRead</c> bit; Read alone is NOT sufficient (decision in Phase 6.2 Compliance).</summary>
+    HistoryRead,
+
+    /// <summary><c>HistoryUpdate</c> — annotation / insert / delete on historian.</summary>
+    HistoryUpdate,
+
+    /// <summary><c>CreateMonitoredItems</c>. Per-item denial in mixed-authorization batches.</summary>
+    CreateMonitoredItems,
+
+    /// <summary><c>TransferSubscriptions</c>. Re-evaluates transferred items against current auth state.</summary>
+    TransferSubscriptions,
+
+    /// <summary><c>Call</c> on a Method node.</summary>
+    Call,
+
+    /// <summary>Alarm <c>Acknowledge</c>.</summary>
+    AlarmAcknowledge,
+
+    /// <summary>Alarm <c>Confirm</c>.</summary>
+    AlarmConfirm,
+
+    /// <summary>Alarm <c>Shelve</c> / <c>Unshelve</c>.</summary>
+    AlarmShelve,
+}

src/ZB.MOM.WW.OtOpcUa.Core.Abstractions/WriteIdempotentAttribute.cs

@@ -0,0 +1,19 @@
+namespace ZB.MOM.WW.OtOpcUa.Core.Abstractions;
+
+/// <summary>
+///     Opts a tag-definition record into auto-retry on <see cref="IWritable.WriteAsync"/> failures.
+///     Absence of this attribute means writes are <b>not</b> retried — a timed-out write may have
+///     already succeeded at the device, and replaying pulses, alarm acks, counter increments, or
+///     recipe-step advances can duplicate irreversible field actions.
+/// </summary>
+/// <remarks>
+///     Per <c>docs/v2/plan.md</c> decisions #44, #45, and #143. Applied to tag-definition POCOs
+///     (e.g. <c>ModbusTagDefinition</c>, <c>S7TagDefinition</c>, OPC UA client tag rows) at the
+///     property or record level. The <c>CapabilityInvoker</c> in <c>ZB.MOM.WW.OtOpcUa.Core.Resilience</c>
+///     reads this attribute via reflection once at driver-init time and caches the result; no
+///     per-write reflection cost.
+/// </remarks>
+[AttributeUsage(AttributeTargets.Property | AttributeTargets.Class | AttributeTargets.Struct, AllowMultiple = false, Inherited = true)]
+public sealed class WriteIdempotentAttribute : Attribute
+{
+}

src/ZB.MOM.WW.OtOpcUa.Core/Authorization/AuthorizationDecision.cs

@@ -0,0 +1,48 @@
+using ZB.MOM.WW.OtOpcUa.Core.Abstractions;
+using ZB.MOM.WW.OtOpcUa.Configuration.Enums;
+
+namespace ZB.MOM.WW.OtOpcUa.Core.Authorization;
+
+/// <summary>
+///     Tri-state result of an <see cref="IPermissionEvaluator.Authorize"/> call, per decision
+///     #149. Phase 6.2 only produces <see cref="AuthorizationVerdict.Allow"/> and
+///     <see cref="AuthorizationVerdict.NotGranted"/>; the <see cref="AuthorizationVerdict.Denied"/>
+///     variant exists in the model so v2.1 Explicit Deny lands without an API break. Provenance
+///     carries the matched grants (or empty when not granted) for audit + the Admin UI "Probe
+///     this permission" diagnostic.
+/// </summary>
+public sealed record AuthorizationDecision(
+    AuthorizationVerdict Verdict,
+    IReadOnlyList<MatchedGrant> Provenance)
+{
+    public bool IsAllowed => Verdict == AuthorizationVerdict.Allow;
+
+    /// <summary>Convenience constructor for the common "no grants matched" outcome.</summary>
+    public static AuthorizationDecision NotGranted() => new(AuthorizationVerdict.NotGranted, []);
+
+    /// <summary>Allow with the list of grants that matched.</summary>
+    public static AuthorizationDecision Allowed(IReadOnlyList<MatchedGrant> provenance)
+        => new(AuthorizationVerdict.Allow, provenance);
+}
+
+/// <summary>Three-valued authorization outcome.</summary>
+public enum AuthorizationVerdict
+{
+    /// <summary>At least one grant matches the requested (operation, scope) pair.</summary>
+    Allow,
+
+    /// <summary>No grant matches. Phase 6.2 default — treated as deny at the OPC UA surface.</summary>
+    NotGranted,
+
+    /// <summary>Explicit deny grant matched. Reserved for v2.1; never produced by Phase 6.2.</summary>
+    Denied,
+}
+
+/// <summary>One grant that contributed to an Allow verdict — for audit / UI diagnostics.</summary>
+/// <param name="LdapGroup">LDAP group the matched grant belongs to.</param>
+/// <param name="Scope">Where in the hierarchy the grant was anchored.</param>
+/// <param name="PermissionFlags">The bitmask the grant contributed.</param>
+public sealed record MatchedGrant(
+    string LdapGroup,
+    NodeAclScopeKind Scope,
+    NodePermissions PermissionFlags);

src/ZB.MOM.WW.OtOpcUa.Core/Authorization/IPermissionEvaluator.cs

@@ -0,0 +1,23 @@
+using ZB.MOM.WW.OtOpcUa.Core.Abstractions;
+
+namespace ZB.MOM.WW.OtOpcUa.Core.Authorization;
+
+/// <summary>
+///     Evaluates whether a session is authorized to perform an OPC UA <see cref="OpcUaOperation"/>
+///     on the node addressed by a <see cref="NodeScope"/>. Phase 6.2 Stream B central surface.
+/// </summary>
+/// <remarks>
+///     Data-plane only. Reads <c>NodeAcl</c> rows joined against the session's resolved LDAP
+///     groups (via <see cref="UserAuthorizationState"/>). Must not depend on the control-plane
+///     admin-role mapping table per decision #150 — the two concerns share zero runtime code.
+/// </remarks>
+public interface IPermissionEvaluator
+{
+    /// <summary>
+    ///     Authorize the requested operation for the session. Callers (<c>DriverNodeManager</c>
+    ///     Read / Write / HistoryRead / Subscribe / Browse / Call dispatch) map their native
+    ///     failure to <c>BadUserAccessDenied</c> per OPC UA Part 4 when the result is not
+    ///     <see cref="AuthorizationVerdict.Allow"/>.
+    /// </summary>
+    AuthorizationDecision Authorize(UserAuthorizationState session, OpcUaOperation operation, NodeScope scope);
+}

src/ZB.MOM.WW.OtOpcUa.Core/Authorization/NodeScope.cs

@@ -0,0 +1,58 @@
+namespace ZB.MOM.WW.OtOpcUa.Core.Authorization;
+
+/// <summary>
+///     Address of a node in the 6-level scope hierarchy the Phase 6.2 evaluator walks.
+///     Assembled by the dispatch layer from the node's namespace + UNS path + tag; passed
+///     to <see cref="IPermissionEvaluator"/> which walks the matching trie path.
+/// </summary>
+/// <remarks>
+///     <para>Per decision #129 and the Phase 6.2 Stream B plan the hierarchy is
+///     <c>Cluster → Namespace → UnsArea → UnsLine → Equipment → Tag</c> for UNS
+///     (Equipment-kind) namespaces. Galaxy (SystemPlatform-kind) namespaces instead use
+///     <c>Cluster → Namespace → FolderSegment(s) → Tag</c>, and each folder segment takes
+///     one trie level — so a deeply-nested Galaxy folder implicitly reaches the same
+///     depth as a full UNS path.</para>
+///
+///     <para>Unset mid-path levels (e.g. a Cluster-scoped request with no UnsArea) leave
+///     the corresponding id <c>null</c>. The evaluator walks as far as the scope goes +
+///     stops at the first null.</para>
+/// </remarks>
+public sealed record NodeScope
+{
+    /// <summary>Cluster the node belongs to. Required.</summary>
+    public required string ClusterId { get; init; }
+
+    /// <summary>Namespace within the cluster. Null is not allowed for a request against a real node.</summary>
+    public string? NamespaceId { get; init; }
+
+    /// <summary>For Equipment-kind namespaces: UNS area (e.g. "warsaw-west"). Null on Galaxy.</summary>
+    public string? UnsAreaId { get; init; }
+
+    /// <summary>For Equipment-kind namespaces: UNS line below the area. Null on Galaxy.</summary>
+    public string? UnsLineId { get; init; }
+
+    /// <summary>For Equipment-kind namespaces: equipment row below the line. Null on Galaxy.</summary>
+    public string? EquipmentId { get; init; }
+
+    /// <summary>
+    ///     For Galaxy (SystemPlatform-kind) namespaces only: the folder path segments from
+    ///     namespace root to the target tag, in order. Empty on Equipment namespaces.
+    /// </summary>
+    public IReadOnlyList<string> FolderSegments { get; init; } = [];
+
+    /// <summary>Target tag id when the scope addresses a specific tag; null for folder / equipment-level scopes.</summary>
+    public string? TagId { get; init; }
+
+    /// <summary>Which hierarchy applies — Equipment-kind (UNS) or SystemPlatform-kind (Galaxy).</summary>
+    public required NodeHierarchyKind Kind { get; init; }
+}
+
+/// <summary>Selector between the two scope-hierarchy shapes.</summary>
+public enum NodeHierarchyKind
+{
+    /// <summary><c>Cluster → Namespace → UnsArea → UnsLine → Equipment → Tag</c> — UNS / Equipment kind.</summary>
+    Equipment,
+
+    /// <summary><c>Cluster → Namespace → FolderSegment(s) → Tag</c> — Galaxy / SystemPlatform kind.</summary>
+    SystemPlatform,
+}

src/ZB.MOM.WW.OtOpcUa.Core/Authorization/PermissionTrie.cs

@@ -0,0 +1,125 @@
+using ZB.MOM.WW.OtOpcUa.Configuration.Enums;
+
+namespace ZB.MOM.WW.OtOpcUa.Core.Authorization;
+
+/// <summary>
+///     In-memory permission trie for one <c>(ClusterId, GenerationId)</c>. Walk from the cluster
+///     root down through namespace → UNS levels (or folder segments) → tag, OR-ing the
+///     <see cref="TrieGrant.PermissionFlags"/> granted at each visited level for each of the session's
+///     LDAP groups. The accumulated bitmask is compared to the permission required by the
+///     requested <see cref="Abstractions.OpcUaOperation"/>.
+/// </summary>
+/// <remarks>
+///     Per decision #129 (additive grants, no explicit Deny in v2.0) the walk is pure union:
+///     encountering a grant at any level contributes its flags, never revokes them. A grant at
+///     the Cluster root therefore cascades to every tag below it; a grant at a deep equipment
+///     leaf is visible only on that equipment subtree.
+/// </remarks>
+public sealed class PermissionTrie
+{
+    /// <summary>Cluster this trie belongs to.</summary>
+    public required string ClusterId { get; init; }
+
+    /// <summary>Config generation the trie was built from — used by the cache for invalidation.</summary>
+    public required long GenerationId { get; init; }
+
+    /// <summary>Root of the trie. Level 0 (cluster-level grants) live directly here.</summary>
+    public PermissionTrieNode Root { get; init; } = new();
+
+    /// <summary>
+    ///     Walk the trie collecting grants that apply to <paramref name="scope"/> for any of the
+    ///     session's <paramref name="ldapGroups"/>. Returns the matched-grant list; the caller
+    ///     OR-s the flag bits to decide whether the requested permission is carried.
+    /// </summary>
+    public IReadOnlyList<MatchedGrant> CollectMatches(NodeScope scope, IEnumerable<string> ldapGroups)
+    {
+        ArgumentNullException.ThrowIfNull(scope);
+        ArgumentNullException.ThrowIfNull(ldapGroups);
+
+        var groups = ldapGroups.ToHashSet(StringComparer.OrdinalIgnoreCase);
+        if (groups.Count == 0) return [];
+
+        var matches = new List<MatchedGrant>();
+
+        // Level 0 — cluster-scoped grants.
+        CollectAtLevel(Root, NodeAclScopeKind.Cluster, groups, matches);
+
+        // Level 1 — namespace.
+        if (scope.NamespaceId is null) return matches;
+        if (!Root.Children.TryGetValue(scope.NamespaceId, out var ns)) return matches;
+        CollectAtLevel(ns, NodeAclScopeKind.Namespace, groups, matches);
+
+        // Two hierarchies diverge below the namespace.
+        if (scope.Kind == NodeHierarchyKind.Equipment)
+            WalkEquipment(ns, scope, groups, matches);
+        else
+            WalkSystemPlatform(ns, scope, groups, matches);
+
+        return matches;
+    }
+
+    private static void WalkEquipment(PermissionTrieNode ns, NodeScope scope, HashSet<string> groups, List<MatchedGrant> matches)
+    {
+        if (scope.UnsAreaId is null) return;
+        if (!ns.Children.TryGetValue(scope.UnsAreaId, out var area)) return;
+        CollectAtLevel(area, NodeAclScopeKind.UnsArea, groups, matches);
+
+        if (scope.UnsLineId is null) return;
+        if (!area.Children.TryGetValue(scope.UnsLineId, out var line)) return;
+        CollectAtLevel(line, NodeAclScopeKind.UnsLine, groups, matches);
+
+        if (scope.EquipmentId is null) return;
+        if (!line.Children.TryGetValue(scope.EquipmentId, out var eq)) return;
+        CollectAtLevel(eq, NodeAclScopeKind.Equipment, groups, matches);
+
+        if (scope.TagId is null) return;
+        if (!eq.Children.TryGetValue(scope.TagId, out var tag)) return;
+        CollectAtLevel(tag, NodeAclScopeKind.Tag, groups, matches);
+    }
+
+    private static void WalkSystemPlatform(PermissionTrieNode ns, NodeScope scope, HashSet<string> groups, List<MatchedGrant> matches)
+    {
+        // FolderSegments are nested under the namespace; each is its own trie level. Reuse the
+        // UnsArea scope kind for the flags — NodeAcl rows for Galaxy tags carry ScopeKind.Tag
+        // for leaf grants and ScopeKind.Namespace for folder-root grants; deeper folder grants
+        // are modeled as Equipment-level rows today since NodeAclScopeKind doesn't enumerate
+        // a dedicated FolderSegment kind. Future-proof TODO tracked in Stream B follow-up.
+        var current = ns;
+        foreach (var segment in scope.FolderSegments)
+        {
+            if (!current.Children.TryGetValue(segment, out var child)) return;
+            CollectAtLevel(child, NodeAclScopeKind.Equipment, groups, matches);
+            current = child;
+        }
+
+        if (scope.TagId is null) return;
+        if (!current.Children.TryGetValue(scope.TagId, out var tag)) return;
+        CollectAtLevel(tag, NodeAclScopeKind.Tag, groups, matches);
+    }
+
+    private static void CollectAtLevel(PermissionTrieNode node, NodeAclScopeKind level, HashSet<string> groups, List<MatchedGrant> matches)
+    {
+        foreach (var grant in node.Grants)
+        {
+            if (groups.Contains(grant.LdapGroup))
+                matches.Add(new MatchedGrant(grant.LdapGroup, level, grant.PermissionFlags));
+        }
+    }
+}
+
+/// <summary>One node in a <see cref="PermissionTrie"/>.</summary>
+public sealed class PermissionTrieNode
+{
+    /// <summary>Grants anchored at this trie level.</summary>
+    public List<TrieGrant> Grants { get; } = [];
+
+    /// <summary>
+    ///     Children keyed by the next level's id — namespace id under cluster; UnsAreaId or
+    ///     folder-segment name under namespace; etc. Comparer is OrdinalIgnoreCase so the walk
+    ///     tolerates case drift between the NodeAcl row and the requested scope.
+    /// </summary>
+    public Dictionary<string, PermissionTrieNode> Children { get; } = new(StringComparer.OrdinalIgnoreCase);
+}
+
+/// <summary>Projection of a <see cref="Configuration.Entities.NodeAcl"/> row into the trie.</summary>
+public sealed record TrieGrant(string LdapGroup, NodePermissions PermissionFlags);

src/ZB.MOM.WW.OtOpcUa.Core/Authorization/PermissionTrieBuilder.cs

@@ -0,0 +1,97 @@
+using ZB.MOM.WW.OtOpcUa.Configuration.Entities;
+using ZB.MOM.WW.OtOpcUa.Configuration.Enums;
+
+namespace ZB.MOM.WW.OtOpcUa.Core.Authorization;
+
+/// <summary>
+///     Builds a <see cref="PermissionTrie"/> from a set of <see cref="NodeAcl"/> rows anchored
+///     in one generation. The trie is keyed on the rows' scope hierarchy — rows with
+///     <see cref="NodeAclScopeKind.Cluster"/> land at the trie root, rows with
+///     <see cref="NodeAclScopeKind.Tag"/> land at a leaf, etc.
+/// </summary>
+/// <remarks>
+///     <para>Intended to be called by <see cref="PermissionTrieCache"/> once per published
+///     generation; the resulting trie is immutable for the life of the cache entry. Idempotent —
+///     two builds from the same rows produce equal tries (grant lists may be in insertion order;
+///     evaluators don't depend on order).</para>
+///
+///     <para>The builder deliberately does not know about the node-row metadata the trie path
+///     will be walked with. The caller assembles <see cref="NodeScope"/> values from the live
+///     config (UnsArea parent of UnsLine, etc.); this class only honors the <c>ScopeId</c>
+///     each row carries.</para>
+/// </remarks>
+public static class PermissionTrieBuilder
+{
+    /// <summary>
+    ///     Build a trie for one cluster/generation from the supplied rows. The caller is
+    ///     responsible for pre-filtering rows to the target generation + cluster.
+    /// </summary>
+    public static PermissionTrie Build(
+        string clusterId,
+        long generationId,
+        IReadOnlyList<NodeAcl> rows,
+        IReadOnlyDictionary<string, NodeAclPath>? scopePaths = null)
+    {
+        ArgumentException.ThrowIfNullOrWhiteSpace(clusterId);
+        ArgumentNullException.ThrowIfNull(rows);
+
+        var trie = new PermissionTrie { ClusterId = clusterId, GenerationId = generationId };
+
+        foreach (var row in rows)
+        {
+            if (!string.Equals(row.ClusterId, clusterId, StringComparison.OrdinalIgnoreCase)) continue;
+            var grant = new TrieGrant(row.LdapGroup, row.PermissionFlags);
+
+            var node = row.ScopeKind switch
+            {
+                NodeAclScopeKind.Cluster => trie.Root,
+                _ => Descend(trie.Root, row, scopePaths),
+            };
+
+            if (node is not null)
+                node.Grants.Add(grant);
+        }
+
+        return trie;
+    }
+
+    private static PermissionTrieNode? Descend(PermissionTrieNode root, NodeAcl row, IReadOnlyDictionary<string, NodeAclPath>? scopePaths)
+    {
+        if (string.IsNullOrEmpty(row.ScopeId)) return null;
+
+        // For sub-cluster scopes the caller supplies a path lookup so we know the containing
+        // namespace / UnsArea / UnsLine ids. Without a path lookup we fall back to putting the
+        // row directly under the root using its ScopeId — works for deterministic tests, not
+        // for production where the hierarchy must be honored.
+        if (scopePaths is null || !scopePaths.TryGetValue(row.ScopeId, out var path))
+        {
+            return EnsureChild(root, row.ScopeId);
+        }
+
+        var node = root;
+        foreach (var segment in path.Segments)
+            node = EnsureChild(node, segment);
+        return node;
+    }
+
+    private static PermissionTrieNode EnsureChild(PermissionTrieNode parent, string key)
+    {
+        if (!parent.Children.TryGetValue(key, out var child))
+        {
+            child = new PermissionTrieNode();
+            parent.Children[key] = child;
+        }
+        return child;
+    }
+}
+
+/// <summary>
+///     Ordered list of trie-path segments from root to the target node. Supplied to
+///     <see cref="PermissionTrieBuilder.Build"/> so the builder knows where a
+///     <see cref="NodeAclScopeKind.UnsLine"/>-scoped row sits in the hierarchy.
+/// </summary>
+/// <param name="Segments">
+///     Namespace id, then (for Equipment kind) UnsAreaId / UnsLineId / EquipmentId / TagId as
+///     applicable; or (for SystemPlatform kind) NamespaceId / FolderSegment / .../TagId.
+/// </param>
+public sealed record NodeAclPath(IReadOnlyList<string> Segments);

src/ZB.MOM.WW.OtOpcUa.Core/Authorization/PermissionTrieCache.cs

@@ -0,0 +1,88 @@
+using System.Collections.Concurrent;
+
+namespace ZB.MOM.WW.OtOpcUa.Core.Authorization;
+
+/// <summary>
+///     Process-singleton cache of <see cref="PermissionTrie"/> instances keyed on
+///     <c>(ClusterId, GenerationId)</c>. Hot-path evaluation reads
+///     <see cref="GetTrie(string)"/> without awaiting DB access; the cache is populated
+///     out-of-band on publish + on first reference via
+///     <see cref="Install(PermissionTrie)"/>.
+/// </summary>
+/// <remarks>
+///     Per decision #148 and Phase 6.2 Stream B.4 the cache is generation-sealed: once a
+///     trie is installed for <c>(ClusterId, GenerationId)</c> the entry is immutable. When a
+///     new generation publishes, the caller calls <see cref="Install"/> with the new trie
+///     + the cache atomically updates its "current generation" pointer for that cluster.
+///     Older generations are retained so an in-flight request evaluating the prior generation
+///     still succeeds — GC via <see cref="Prune(string, int)"/>.
+/// </remarks>
+public sealed class PermissionTrieCache
+{
+    private readonly ConcurrentDictionary<string, ClusterEntry> _byCluster =
+        new(StringComparer.OrdinalIgnoreCase);
+
+    /// <summary>Install a trie for a cluster + make it the current generation.</summary>
+    public void Install(PermissionTrie trie)
+    {
+        ArgumentNullException.ThrowIfNull(trie);
+        _byCluster.AddOrUpdate(trie.ClusterId,
+            _ => ClusterEntry.FromSingle(trie),
+            (_, existing) => existing.WithAdditional(trie));
+    }
+
+    /// <summary>Get the current-generation trie for a cluster; null when nothing installed.</summary>
+    public PermissionTrie? GetTrie(string clusterId)
+    {
+        ArgumentException.ThrowIfNullOrWhiteSpace(clusterId);
+        return _byCluster.TryGetValue(clusterId, out var entry) ? entry.Current : null;
+    }
+
+    /// <summary>Get a specific (cluster, generation) trie; null if that pair isn't cached.</summary>
+    public PermissionTrie? GetTrie(string clusterId, long generationId)
+    {
+        if (!_byCluster.TryGetValue(clusterId, out var entry)) return null;
+        return entry.Tries.TryGetValue(generationId, out var trie) ? trie : null;
+    }
+
+    /// <summary>The generation id the <see cref="GetTrie(string)"/> shortcut currently serves for a cluster.</summary>
+    public long? CurrentGenerationId(string clusterId)
+        => _byCluster.TryGetValue(clusterId, out var entry) ? entry.Current.GenerationId : null;
+
+    /// <summary>Drop every cached trie for one cluster.</summary>
+    public void Invalidate(string clusterId) => _byCluster.TryRemove(clusterId, out _);
+
+    /// <summary>
+    ///     Retain only the most-recent <paramref name="keepLatest"/> generations for a cluster.
+    ///     No-op when there's nothing to drop.
+    /// </summary>
+    public void Prune(string clusterId, int keepLatest = 3)
+    {
+        if (keepLatest < 1) throw new ArgumentOutOfRangeException(nameof(keepLatest), keepLatest, "keepLatest must be >= 1");
+        if (!_byCluster.TryGetValue(clusterId, out var entry)) return;
+
+        if (entry.Tries.Count <= keepLatest) return;
+        var keep = entry.Tries
+            .OrderByDescending(kvp => kvp.Key)
+            .Take(keepLatest)
+            .ToDictionary(kvp => kvp.Key, kvp => kvp.Value);
+        _byCluster[clusterId] = new ClusterEntry(entry.Current, keep);
+    }
+
+    /// <summary>Diagnostics counter: number of cached (cluster, generation) tries.</summary>
+    public int CachedTrieCount => _byCluster.Values.Sum(e => e.Tries.Count);
+
+    private sealed record ClusterEntry(PermissionTrie Current, IReadOnlyDictionary<long, PermissionTrie> Tries)
+    {
+        public static ClusterEntry FromSingle(PermissionTrie trie) =>
+            new(trie, new Dictionary<long, PermissionTrie> { [trie.GenerationId] = trie });
+
+        public ClusterEntry WithAdditional(PermissionTrie trie)
+        {
+            var next = new Dictionary<long, PermissionTrie>(Tries) { [trie.GenerationId] = trie };
+            // The highest generation wins as "current" — handles out-of-order installs.
+            var current = trie.GenerationId >= Current.GenerationId ? trie : Current;
+            return new ClusterEntry(current, next);
+        }
+    }
+}

src/ZB.MOM.WW.OtOpcUa.Core/Authorization/TriePermissionEvaluator.cs

@@ -0,0 +1,70 @@
+using ZB.MOM.WW.OtOpcUa.Configuration.Enums;
+using ZB.MOM.WW.OtOpcUa.Core.Abstractions;
+
+namespace ZB.MOM.WW.OtOpcUa.Core.Authorization;
+
+/// <summary>
+///     Default <see cref="IPermissionEvaluator"/> implementation. Resolves the
+///     <see cref="PermissionTrie"/> for the session's cluster (via
+///     <see cref="PermissionTrieCache"/>), walks it collecting matched grants, OR-s the
+///     permission flags, and maps against the operation-specific required permission.
+/// </summary>
+public sealed class TriePermissionEvaluator : IPermissionEvaluator
+{
+    private readonly PermissionTrieCache _cache;
+    private readonly TimeProvider _timeProvider;
+
+    public TriePermissionEvaluator(PermissionTrieCache cache, TimeProvider? timeProvider = null)
+    {
+        ArgumentNullException.ThrowIfNull(cache);
+        _cache = cache;
+        _timeProvider = timeProvider ?? TimeProvider.System;
+    }
+
+    public AuthorizationDecision Authorize(UserAuthorizationState session, OpcUaOperation operation, NodeScope scope)
+    {
+        ArgumentNullException.ThrowIfNull(session);
+        ArgumentNullException.ThrowIfNull(scope);
+
+        // Decision #152 — beyond the staleness ceiling every call fails closed regardless of
+        // cache warmth elsewhere in the process.
+        if (session.IsStale(_timeProvider.GetUtcNow().UtcDateTime))
+            return AuthorizationDecision.NotGranted();
+
+        if (!string.Equals(session.ClusterId, scope.ClusterId, StringComparison.OrdinalIgnoreCase))
+            return AuthorizationDecision.NotGranted();
+
+        var trie = _cache.GetTrie(scope.ClusterId);
+        if (trie is null) return AuthorizationDecision.NotGranted();
+
+        var matches = trie.CollectMatches(scope, session.LdapGroups);
+        if (matches.Count == 0) return AuthorizationDecision.NotGranted();
+
+        var required = MapOperationToPermission(operation);
+        var granted = NodePermissions.None;
+        foreach (var m in matches) granted |= m.PermissionFlags;
+
+        return (granted & required) == required
+            ? AuthorizationDecision.Allowed(matches)
+            : AuthorizationDecision.NotGranted();
+    }
+
+    /// <summary>Maps each <see cref="OpcUaOperation"/> to the <see cref="NodePermissions"/> bit required to grant it.</summary>
+    public static NodePermissions MapOperationToPermission(OpcUaOperation op) => op switch
+    {
+        OpcUaOperation.Browse               => NodePermissions.Browse,
+        OpcUaOperation.Read                 => NodePermissions.Read,
+        OpcUaOperation.WriteOperate         => NodePermissions.WriteOperate,
+        OpcUaOperation.WriteTune            => NodePermissions.WriteTune,
+        OpcUaOperation.WriteConfigure       => NodePermissions.WriteConfigure,
+        OpcUaOperation.HistoryRead          => NodePermissions.HistoryRead,
+        OpcUaOperation.HistoryUpdate        => NodePermissions.HistoryRead, // HistoryUpdate bit not yet in NodePermissions; TODO Stream C follow-up
+        OpcUaOperation.CreateMonitoredItems => NodePermissions.Subscribe,
+        OpcUaOperation.TransferSubscriptions=> NodePermissions.Subscribe,
+        OpcUaOperation.Call                 => NodePermissions.MethodCall,
+        OpcUaOperation.AlarmAcknowledge     => NodePermissions.AlarmAcknowledge,
+        OpcUaOperation.AlarmConfirm         => NodePermissions.AlarmConfirm,
+        OpcUaOperation.AlarmShelve          => NodePermissions.AlarmShelve,
+        _ => throw new ArgumentOutOfRangeException(nameof(op), op, $"No permission mapping defined for operation {op}."),
+    };
+}

src/ZB.MOM.WW.OtOpcUa.Core/Authorization/UserAuthorizationState.cs

@@ -0,0 +1,69 @@
+namespace ZB.MOM.WW.OtOpcUa.Core.Authorization;
+
+/// <summary>
+///     Per-session authorization state cached on the OPC UA session object + keyed on the
+///     session id. Captures the LDAP group memberships resolved at sign-in, the generation
+///     the membership was resolved against, and the bounded freshness window.
+/// </summary>
+/// <remarks>
+///     Per decision #151 the membership is bounded by <see cref="MembershipFreshnessInterval"/>
+///     (default 15 min). After that, the next hot-path authz call re-resolves LDAP group
+///     memberships; failure to re-resolve (LDAP unreachable) flips the session to fail-closed
+///     until a refresh succeeds.
+///
+///     Per decision #152 <see cref="AuthCacheMaxStaleness"/> (default 5 min) is separate from
+///     Phase 6.1's availability-oriented 24h cache — beyond this window the evaluator returns
+///     <see cref="AuthorizationVerdict.NotGranted"/> regardless of config-cache warmth.
+/// </remarks>
+public sealed record UserAuthorizationState
+{
+    /// <summary>Opaque session id (reuse OPC UA session handle when possible).</summary>
+    public required string SessionId { get; init; }
+
+    /// <summary>Cluster the session is scoped to — every request targets nodes in this cluster.</summary>
+    public required string ClusterId { get; init; }
+
+    /// <summary>
+    ///     LDAP groups the user is a member of as resolved at sign-in / last membership refresh.
+    ///     Case comparison is handled downstream by the evaluator (OrdinalIgnoreCase).
+    /// </summary>
+    public required IReadOnlyList<string> LdapGroups { get; init; }
+
+    /// <summary>Timestamp when <see cref="LdapGroups"/> was last resolved from the directory.</summary>
+    public required DateTime MembershipResolvedUtc { get; init; }
+
+    /// <summary>
+    ///     Trie generation the session is currently bound to. When
+    ///     <see cref="PermissionTrieCache"/> moves to a new generation, the session's
+    ///     <c>(AuthGenerationId, MembershipVersion)</c> stamp no longer matches its
+    ///     MonitoredItems and they re-evaluate on next publish (decision #153).
+    /// </summary>
+    public required long AuthGenerationId { get; init; }
+
+    /// <summary>
+    ///     Monotonic counter incremented every time membership is re-resolved. Combined with
+    ///     <see cref="AuthGenerationId"/> into the subscription stamp per decision #153.
+    /// </summary>
+    public required long MembershipVersion { get; init; }
+
+    /// <summary>Bounded membership freshness window; past this the next authz call refreshes.</summary>
+    public TimeSpan MembershipFreshnessInterval { get; init; } = TimeSpan.FromMinutes(15);
+
+    /// <summary>Hard staleness ceiling — beyond this, the evaluator fails closed.</summary>
+    public TimeSpan AuthCacheMaxStaleness { get; init; } = TimeSpan.FromMinutes(5);
+
+    /// <summary>
+    ///     True when <paramref name="utcNow"/> - <see cref="MembershipResolvedUtc"/> exceeds
+    ///     <see cref="AuthCacheMaxStaleness"/>. The evaluator short-circuits to NotGranted
+    ///     whenever this is true.
+    /// </summary>
+    public bool IsStale(DateTime utcNow) => utcNow - MembershipResolvedUtc > AuthCacheMaxStaleness;
+
+    /// <summary>
+    ///     True when membership is past its freshness interval but still within the staleness
+    ///     ceiling — a signal to the caller to kick off an async refresh, while the current
+    ///     call still evaluates against the cached memberships.
+    /// </summary>
+    public bool NeedsRefresh(DateTime utcNow) =>
+        !IsStale(utcNow) && utcNow - MembershipResolvedUtc > MembershipFreshnessInterval;
+}

src/ZB.MOM.WW.OtOpcUa.Core/Observability/DriverHealthReport.cs

@@ -0,0 +1,86 @@
+using ZB.MOM.WW.OtOpcUa.Core.Abstractions;
+
+namespace ZB.MOM.WW.OtOpcUa.Core.Observability;
+
+/// <summary>
+///     Domain-layer health aggregation for Phase 6.1 Stream C. Pure functions over the driver
+///     fleet — given each driver's <see cref="DriverState"/>, produce a <see cref="ReadinessVerdict"/>
+///     that maps to HTTP status codes at the endpoint layer.
+/// </summary>
+/// <remarks>
+///     State matrix per <c>docs/v2/implementation/phase-6-1-resilience-and-observability.md</c>
+///     §Stream C.1:
+///     <list type="bullet">
+///         <item><see cref="DriverState.Unknown"/> / <see cref="DriverState.Initializing"/>
+///             → /readyz 503 (not yet ready).</item>
+///         <item><see cref="DriverState.Healthy"/> → /readyz 200.</item>
+///         <item><see cref="DriverState.Degraded"/> → /readyz 200 with flagged driver IDs.</item>
+///         <item><see cref="DriverState.Faulted"/> → /readyz 503.</item>
+///     </list>
+///     The overall verdict is computed across the fleet: any Faulted → Faulted; any
+///     Unknown/Initializing → NotReady; any Degraded → Degraded; else Healthy. An empty fleet
+///     is Healthy (nothing to degrade).
+/// </remarks>
+public static class DriverHealthReport
+{
+    /// <summary>Compute the fleet-wide readiness verdict from per-driver states.</summary>
+    public static ReadinessVerdict Aggregate(IReadOnlyList<DriverHealthSnapshot> drivers)
+    {
+        ArgumentNullException.ThrowIfNull(drivers);
+        if (drivers.Count == 0) return ReadinessVerdict.Healthy;
+
+        var anyFaulted = drivers.Any(d => d.State == DriverState.Faulted);
+        if (anyFaulted) return ReadinessVerdict.Faulted;
+
+        var anyInitializing = drivers.Any(d =>
+            d.State == DriverState.Unknown || d.State == DriverState.Initializing);
+        if (anyInitializing) return ReadinessVerdict.NotReady;
+
+        // Reconnecting = driver alive but not serving live data; report as Degraded so /readyz
+        // stays 200 (the fleet can still serve cached / last-good data) while operators see the
+        // affected driver in the body.
+        var anyDegraded = drivers.Any(d =>
+            d.State == DriverState.Degraded || d.State == DriverState.Reconnecting);
+        if (anyDegraded) return ReadinessVerdict.Degraded;
+
+        return ReadinessVerdict.Healthy;
+    }
+
+    /// <summary>
+    ///     Map a <see cref="ReadinessVerdict"/> to the HTTP status the /readyz endpoint should
+    ///     return per the Stream C.1 state matrix.
+    /// </summary>
+    public static int HttpStatus(ReadinessVerdict verdict) => verdict switch
+    {
+        ReadinessVerdict.Healthy => 200,
+        ReadinessVerdict.Degraded => 200,
+        ReadinessVerdict.NotReady => 503,
+        ReadinessVerdict.Faulted => 503,
+        _ => 500,
+    };
+}
+
+/// <summary>Per-driver snapshot fed into <see cref="DriverHealthReport.Aggregate"/>.</summary>
+/// <param name="DriverInstanceId">Driver instance identifier (from <c>IDriver.DriverInstanceId</c>).</param>
+/// <param name="State">Current <see cref="DriverState"/> from <c>IDriver.GetHealth</c>.</param>
+/// <param name="DetailMessage">Optional driver-supplied detail (e.g. "primary PLC unreachable").</param>
+public sealed record DriverHealthSnapshot(
+    string DriverInstanceId,
+    DriverState State,
+    string? DetailMessage = null);
+
+/// <summary>Overall fleet readiness — derived from driver states by <see cref="DriverHealthReport.Aggregate"/>.</summary>
+public enum ReadinessVerdict
+{
+    /// <summary>All drivers Healthy (or fleet is empty).</summary>
+    Healthy,
+
+    /// <summary>At least one driver Degraded; none Faulted / NotReady.</summary>
+    Degraded,
+
+    /// <summary>At least one driver Unknown / Initializing; none Faulted.</summary>
+    NotReady,
+
+    /// <summary>At least one driver Faulted.</summary>
+    Faulted,
+}

src/ZB.MOM.WW.OtOpcUa.Core/Observability/LogContextEnricher.cs

@@ -0,0 +1,53 @@
+using Serilog.Context;
+using ZB.MOM.WW.OtOpcUa.Core.Abstractions;
+
+namespace ZB.MOM.WW.OtOpcUa.Core.Observability;
+
+/// <summary>
+///     Convenience wrapper around Serilog <see cref="LogContext"/> — attaches the set of
+///     structured properties a capability call should carry (DriverInstanceId, DriverType,
+///     CapabilityName, CorrelationId). Callers wrap their call-site body in a <c>using</c>
+///     block; inner <c>Log.Information</c> / <c>Log.Warning</c> calls emit the context
+///     automatically via the Serilog enricher chain.
+/// </summary>
+/// <remarks>
+///     Per <c>docs/v2/implementation/phase-6-1-resilience-and-observability.md</c> §Stream C.2.
+///     The correlation ID should be the OPC UA <c>RequestHeader.RequestHandle</c> when in-flight;
+///     otherwise a short random GUID. Callers supply whichever is available.
+/// </remarks>
+public static class LogContextEnricher
+{
+    /// <summary>Attach the capability-call property set. Dispose the returned scope to pop.</summary>
+    public static IDisposable Push(string driverInstanceId, string driverType, DriverCapability capability, string correlationId)
+    {
+        ArgumentException.ThrowIfNullOrWhiteSpace(driverInstanceId);
+        ArgumentException.ThrowIfNullOrWhiteSpace(driverType);
+        ArgumentException.ThrowIfNullOrWhiteSpace(correlationId);
+
+        var a = LogContext.PushProperty("DriverInstanceId", driverInstanceId);
+        var b = LogContext.PushProperty("DriverType", driverType);
+        var c = LogContext.PushProperty("CapabilityName", capability.ToString());
+        var d = LogContext.PushProperty("CorrelationId", correlationId);
+        return new CompositeScope(a, b, c, d);
+    }
+
+    /// <summary>
+    ///     Generate a short correlation ID when no OPC UA RequestHandle is available.
+    ///     12-hex-char slice of a GUID — long enough for log correlation, short enough to
+    ///     scan visually.
+    /// </summary>
+    public static string NewCorrelationId() => Guid.NewGuid().ToString("N")[..12];
+
+    private sealed class CompositeScope : IDisposable
+    {
+        private readonly IDisposable[] _inner;
+        public CompositeScope(params IDisposable[] inner) => _inner = inner;
+
+        public void Dispose()
+        {
+            // Reverse-order disposal matches Serilog's stack semantics.
+            for (var i = _inner.Length - 1; i >= 0; i--)
+                _inner[i].Dispose();
+        }
+    }
+}

src/ZB.MOM.WW.OtOpcUa.Core/Resilience/CapabilityInvoker.cs

@@ -0,0 +1,120 @@
+using Polly;
+using ZB.MOM.WW.OtOpcUa.Core.Abstractions;
+using ZB.MOM.WW.OtOpcUa.Core.Observability;
+
+namespace ZB.MOM.WW.OtOpcUa.Core.Resilience;
+
+/// <summary>
+///     Executes driver-capability calls through a shared Polly pipeline. One invoker per
+///     <c>(DriverInstance, IDriver)</c> pair; the underlying <see cref="DriverResiliencePipelineBuilder"/>
+///     is process-singleton so all invokers share its cache.
+/// </summary>
+/// <remarks>
+///     Per <c>docs/v2/plan.md</c> decisions #143-144 and Phase 6.1 Stream A.3. The server's dispatch
+///     layer routes every capability call (<c>IReadable.ReadAsync</c>, <c>IWritable.WriteAsync</c>,
+///     <c>ITagDiscovery.DiscoverAsync</c>, <c>ISubscribable.SubscribeAsync/UnsubscribeAsync</c>,
+///     <c>IHostConnectivityProbe</c> probe loop, <c>IAlarmSource.SubscribeAlarmsAsync/AcknowledgeAsync</c>,
+///     and all four <c>IHistoryProvider</c> reads) through this invoker.
+/// </remarks>
+public sealed class CapabilityInvoker
+{
+    private readonly DriverResiliencePipelineBuilder _builder;
+    private readonly string _driverInstanceId;
+    private readonly string _driverType;
+    private readonly Func<DriverResilienceOptions> _optionsAccessor;
+
+    /// <summary>
+    ///     Construct an invoker for one driver instance.
+    /// </summary>
+    /// <param name="builder">Shared, process-singleton pipeline builder.</param>
+    /// <param name="driverInstanceId">The <c>DriverInstance.Id</c> column value.</param>
+    /// <param name="optionsAccessor">
+    ///     Snapshot accessor for the current resilience options. Invoked per call so Admin-edit +
+    ///     pipeline-invalidate can take effect without restarting the invoker.
+    /// </param>
+    /// <param name="driverType">Driver type name for structured-log enrichment (e.g. <c>"Modbus"</c>).</param>
+    public CapabilityInvoker(
+        DriverResiliencePipelineBuilder builder,
+        string driverInstanceId,
+        Func<DriverResilienceOptions> optionsAccessor,
+        string driverType = "Unknown")
+    {
+        ArgumentNullException.ThrowIfNull(builder);
+        ArgumentNullException.ThrowIfNull(optionsAccessor);
+
+        _builder = builder;
+        _driverInstanceId = driverInstanceId;
+        _driverType = driverType;
+        _optionsAccessor = optionsAccessor;
+    }
+
+    /// <summary>Execute a capability call returning a value, honoring the per-capability pipeline.</summary>
+    /// <typeparam name="TResult">Return type of the underlying driver call.</typeparam>
+    public async ValueTask<TResult> ExecuteAsync<TResult>(
+        DriverCapability capability,
+        string hostName,
+        Func<CancellationToken, ValueTask<TResult>> callSite,
+        CancellationToken cancellationToken)
+    {
+        ArgumentNullException.ThrowIfNull(callSite);
+
+        var pipeline = ResolvePipeline(capability, hostName);
+        using (LogContextEnricher.Push(_driverInstanceId, _driverType, capability, LogContextEnricher.NewCorrelationId()))
+        {
+            return await pipeline.ExecuteAsync(callSite, cancellationToken).ConfigureAwait(false);
+        }
+    }
+
+    /// <summary>Execute a void-returning capability call, honoring the per-capability pipeline.</summary>
+    public async ValueTask ExecuteAsync(
+        DriverCapability capability,
+        string hostName,
+        Func<CancellationToken, ValueTask> callSite,
+        CancellationToken cancellationToken)
+    {
+        ArgumentNullException.ThrowIfNull(callSite);
+
+        var pipeline = ResolvePipeline(capability, hostName);
+        using (LogContextEnricher.Push(_driverInstanceId, _driverType, capability, LogContextEnricher.NewCorrelationId()))
+        {
+            await pipeline.ExecuteAsync(callSite, cancellationToken).ConfigureAwait(false);
+        }
+    }
+
+    /// <summary>
+    ///     Execute a <see cref="DriverCapability.Write"/> call honoring <see cref="WriteIdempotentAttribute"/>
+    ///     semantics — if <paramref name="isIdempotent"/> is <c>false</c>, retries are disabled regardless
+    ///     of the tag-level configuration (the pipeline for a non-idempotent write never retries per
+    ///     decisions #44-45). If <c>true</c>, the call runs through the capability's pipeline which may
+    ///     retry when the tier configuration permits.
+    /// </summary>
+    public async ValueTask<TResult> ExecuteWriteAsync<TResult>(
+        string hostName,
+        bool isIdempotent,
+        Func<CancellationToken, ValueTask<TResult>> callSite,
+        CancellationToken cancellationToken)
+    {
+        ArgumentNullException.ThrowIfNull(callSite);
+
+        if (!isIdempotent)
+        {
+            var noRetryOptions = _optionsAccessor() with
+            {
+                CapabilityPolicies = new Dictionary<DriverCapability, CapabilityPolicy>
+                {
+                    [DriverCapability.Write] = _optionsAccessor().Resolve(DriverCapability.Write) with { RetryCount = 0 },
+                },
+            };
+            var pipeline = _builder.GetOrCreate(_driverInstanceId, $"{hostName}::non-idempotent", DriverCapability.Write, noRetryOptions);
+            using (LogContextEnricher.Push(_driverInstanceId, _driverType, DriverCapability.Write, LogContextEnricher.NewCorrelationId()))
+            {
+                return await pipeline.ExecuteAsync(callSite, cancellationToken).ConfigureAwait(false);
+            }
+        }
+
+        return await ExecuteAsync(DriverCapability.Write, hostName, callSite, cancellationToken).ConfigureAwait(false);
+    }
+
+    private ResiliencePipeline ResolvePipeline(DriverCapability capability, string hostName) =>
+        _builder.GetOrCreate(_driverInstanceId, hostName, capability, _optionsAccessor());
+}

src/ZB.MOM.WW.OtOpcUa.Core/Resilience/DriverResilienceOptions.cs

@@ -0,0 +1,96 @@
+using ZB.MOM.WW.OtOpcUa.Core.Abstractions;
+
+namespace ZB.MOM.WW.OtOpcUa.Core.Resilience;
+
+/// <summary>
+///     Per-tier × per-capability resilience policy configuration for a driver instance.
+///     Bound from <c>DriverInstance.ResilienceConfig</c> JSON (nullable column; null = tier defaults).
+///     Per <c>docs/v2/plan.md</c> decisions #143 and #144.
+/// </summary>
+public sealed record DriverResilienceOptions
+{
+    /// <summary>Tier the owning driver type is registered as; drives the default map.</summary>
+    public required DriverTier Tier { get; init; }
+
+    /// <summary>
+    ///     Per-capability policy overrides. Capabilities absent from this map fall back to
+    ///     <see cref="GetTierDefaults(DriverTier)"/> for the configured <see cref="Tier"/>.
+    /// </summary>
+    public IReadOnlyDictionary<DriverCapability, CapabilityPolicy> CapabilityPolicies { get; init; }
+        = new Dictionary<DriverCapability, CapabilityPolicy>();
+
+    /// <summary>Bulkhead (max concurrent in-flight calls) for every capability. Default 32.</summary>
+    public int BulkheadMaxConcurrent { get; init; } = 32;
+
+    /// <summary>
+    ///     Bulkhead queue depth. Zero = no queueing; overflow fails fast with
+    ///     <c>BulkheadRejectedException</c>. Default 64.
+    /// </summary>
+    public int BulkheadMaxQueue { get; init; } = 64;
+
+    /// <summary>
+    ///     Look up the effective policy for a capability, falling back to tier defaults when no
+    ///     override is configured. Never returns null.
+    /// </summary>
+    public CapabilityPolicy Resolve(DriverCapability capability)
+    {
+        if (CapabilityPolicies.TryGetValue(capability, out var policy))
+            return policy;
+
+        var defaults = GetTierDefaults(Tier);
+        return defaults[capability];
+    }
+
+    /// <summary>
+    ///     Per-tier per-capability default policy table, per decisions #143-144 and the Phase 6.1
+    ///     Stream A.2 specification. Retries skipped on <see cref="DriverCapability.Write"/> and
+    ///     <see cref="DriverCapability.AlarmAcknowledge"/> regardless of tier.
+    /// </summary>
+    public static IReadOnlyDictionary<DriverCapability, CapabilityPolicy> GetTierDefaults(DriverTier tier) =>
+        tier switch
+        {
+            DriverTier.A => new Dictionary<DriverCapability, CapabilityPolicy>
+            {
+                [DriverCapability.Read]             = new(TimeoutSeconds: 2,  RetryCount: 3, BreakerFailureThreshold: 5),
+                [DriverCapability.Write]            = new(TimeoutSeconds: 2,  RetryCount: 0, BreakerFailureThreshold: 5),
+                [DriverCapability.Discover]         = new(TimeoutSeconds: 30, RetryCount: 2, BreakerFailureThreshold: 3),
+                [DriverCapability.Subscribe]        = new(TimeoutSeconds: 5,  RetryCount: 3, BreakerFailureThreshold: 5),
+                [DriverCapability.Probe]            = new(TimeoutSeconds: 2,  RetryCount: 3, BreakerFailureThreshold: 5),
+                [DriverCapability.AlarmSubscribe]   = new(TimeoutSeconds: 5,  RetryCount: 3, BreakerFailureThreshold: 5),
+                [DriverCapability.AlarmAcknowledge] = new(TimeoutSeconds: 5,  RetryCount: 0, BreakerFailureThreshold: 5),
+                [DriverCapability.HistoryRead]      = new(TimeoutSeconds: 30, RetryCount: 2, BreakerFailureThreshold: 5),
+            },
+            DriverTier.B => new Dictionary<DriverCapability, CapabilityPolicy>
+            {
+                [DriverCapability.Read]             = new(TimeoutSeconds: 4,  RetryCount: 3, BreakerFailureThreshold: 5),
+                [DriverCapability.Write]            = new(TimeoutSeconds: 4,  RetryCount: 0, BreakerFailureThreshold: 5),
+                [DriverCapability.Discover]         = new(TimeoutSeconds: 60, RetryCount: 2, BreakerFailureThreshold: 3),
+                [DriverCapability.Subscribe]        = new(TimeoutSeconds: 8,  RetryCount: 3, BreakerFailureThreshold: 5),
+                [DriverCapability.Probe]            = new(TimeoutSeconds: 4,  RetryCount: 3, BreakerFailureThreshold: 5),
+                [DriverCapability.AlarmSubscribe]   = new(TimeoutSeconds: 8,  RetryCount: 3, BreakerFailureThreshold: 5),
+                [DriverCapability.AlarmAcknowledge] = new(TimeoutSeconds: 8,  RetryCount: 0, BreakerFailureThreshold: 5),
+                [DriverCapability.HistoryRead]      = new(TimeoutSeconds: 60, RetryCount: 2, BreakerFailureThreshold: 5),
+            },
+            DriverTier.C => new Dictionary<DriverCapability, CapabilityPolicy>
+            {
+                [DriverCapability.Read]             = new(TimeoutSeconds: 10,  RetryCount: 1, BreakerFailureThreshold: 0),
+                [DriverCapability.Write]            = new(TimeoutSeconds: 10,  RetryCount: 0, BreakerFailureThreshold: 0),
+                [DriverCapability.Discover]         = new(TimeoutSeconds: 120, RetryCount: 1, BreakerFailureThreshold: 0),
+                [DriverCapability.Subscribe]        = new(TimeoutSeconds: 15,  RetryCount: 1, BreakerFailureThreshold: 0),
+                [DriverCapability.Probe]            = new(TimeoutSeconds: 10,  RetryCount: 1, BreakerFailureThreshold: 0),
+                [DriverCapability.AlarmSubscribe]   = new(TimeoutSeconds: 15,  RetryCount: 1, BreakerFailureThreshold: 0),
+                [DriverCapability.AlarmAcknowledge] = new(TimeoutSeconds: 15,  RetryCount: 0, BreakerFailureThreshold: 0),
+                [DriverCapability.HistoryRead]      = new(TimeoutSeconds: 120, RetryCount: 1, BreakerFailureThreshold: 0),
+            },
+            _ => throw new ArgumentOutOfRangeException(nameof(tier), tier, $"No default policy table defined for tier {tier}."),
+        };
+}
+
+/// <summary>Policy for one capability on one driver instance.</summary>
+/// <param name="TimeoutSeconds">Per-call timeout (wraps the inner Polly execution).</param>
+/// <param name="RetryCount">Number of retry attempts after the first failure; zero = no retry.</param>
+/// <param name="BreakerFailureThreshold">
+///     Consecutive-failure count that opens the circuit breaker; zero = no breaker
+///     (Tier C uses the supervisor's process-level breaker instead, per decision #68).
+/// </param>
+public sealed record CapabilityPolicy(int TimeoutSeconds, int RetryCount, int BreakerFailureThreshold);

src/ZB.MOM.WW.OtOpcUa.Core/Resilience/DriverResiliencePipelineBuilder.cs

@@ -0,0 +1,118 @@
+using System.Collections.Concurrent;
+using Polly;
+using Polly.CircuitBreaker;
+using Polly.Retry;
+using Polly.Timeout;
+using ZB.MOM.WW.OtOpcUa.Core.Abstractions;
+
+namespace ZB.MOM.WW.OtOpcUa.Core.Resilience;
+
+/// <summary>
+///     Builds and caches Polly resilience pipelines keyed on
+///     <c>(DriverInstanceId, HostName, DriverCapability)</c>. One dead PLC behind a multi-device
+///     driver cannot open the circuit breaker for healthy sibling hosts.
+/// </summary>
+/// <remarks>
+///     Per <c>docs/v2/plan.md</c> decision #144 (per-device isolation). Composition from outside-in:
+///     <b>Timeout → Retry (when capability permits) → Circuit Breaker (when tier permits) → Bulkhead</b>.
+///
+///     <para>Pipeline resolution is lock-free on the hot path: the inner
+///     <see cref="ConcurrentDictionary{TKey,TValue}"/> caches a <see cref="ResiliencePipeline"/> per key;
+///     first-call cost is one <see cref="ResiliencePipelineBuilder"/>.Build. Thereafter reads are O(1).</para>
+/// </remarks>
+public sealed class DriverResiliencePipelineBuilder
+{
+    private readonly ConcurrentDictionary<PipelineKey, ResiliencePipeline> _pipelines = new();
+    private readonly TimeProvider _timeProvider;
+
+    /// <summary>Construct with the ambient clock (use <see cref="TimeProvider.System"/> in prod).</summary>
+    public DriverResiliencePipelineBuilder(TimeProvider? timeProvider = null)
+    {
+        _timeProvider = timeProvider ?? TimeProvider.System;
+    }
+
+    /// <summary>
+    ///     Get or build the pipeline for a given <c>(driver instance, host, capability)</c> triple.
+    ///     Calls with the same key + same options reuse the same pipeline instance; the first caller
+    ///     wins if a race occurs (both pipelines would be behaviourally identical).
+    /// </summary>
+    /// <param name="driverInstanceId">DriverInstance primary key — opaque to this layer.</param>
+    /// <param name="hostName">
+    ///     Host the call targets. For single-host drivers (Galaxy, some OPC UA Client configs) pass the
+    ///     driver's canonical host string. For multi-host drivers (Modbus with N PLCs), pass the
+    ///     specific PLC so one dead PLC doesn't poison healthy siblings.
+    /// </param>
+    /// <param name="capability">Which capability surface is being called.</param>
+    /// <param name="options">Per-driver-instance options (tier + per-capability overrides).</param>
+    public ResiliencePipeline GetOrCreate(
+        string driverInstanceId,
+        string hostName,
+        DriverCapability capability,
+        DriverResilienceOptions options)
+    {
+        ArgumentNullException.ThrowIfNull(options);
+        ArgumentException.ThrowIfNullOrWhiteSpace(hostName);
+
+        var key = new PipelineKey(driverInstanceId, hostName, capability);
+        return _pipelines.GetOrAdd(key, static (_, state) => Build(state.capability, state.options, state.timeProvider),
+            (capability, options, timeProvider: _timeProvider));
+    }
+
+    /// <summary>Drop cached pipelines for one driver instance (e.g. on ResilienceConfig change). Test + Admin-reload use.</summary>
+    public int Invalidate(string driverInstanceId)
+    {
+        var removed = 0;
+        foreach (var key in _pipelines.Keys)
+        {
+            if (key.DriverInstanceId == driverInstanceId && _pipelines.TryRemove(key, out _))
+                removed++;
+        }
+        return removed;
+    }
+
+    /// <summary>Snapshot of the current number of cached pipelines. For diagnostics only.</summary>
+    public int CachedPipelineCount => _pipelines.Count;
+
+    private static ResiliencePipeline Build(
+        DriverCapability capability,
+        DriverResilienceOptions options,
+        TimeProvider timeProvider)
+    {
+        var policy = options.Resolve(capability);
+        var builder = new ResiliencePipelineBuilder { TimeProvider = timeProvider };
+
+        builder.AddTimeout(new TimeoutStrategyOptions
+        {
+            Timeout = TimeSpan.FromSeconds(policy.TimeoutSeconds),
+        });
+
+        if (policy.RetryCount > 0)
+        {
+            builder.AddRetry(new RetryStrategyOptions
+            {
+                MaxRetryAttempts = policy.RetryCount,
+                BackoffType = DelayBackoffType.Exponential,
+                UseJitter = true,
+                Delay = TimeSpan.FromMilliseconds(100),
+                MaxDelay = TimeSpan.FromSeconds(5),
+                ShouldHandle = new PredicateBuilder().Handle<Exception>(ex => ex is not OperationCanceledException),
+            });
+        }
+
+        if (policy.BreakerFailureThreshold > 0)
+        {
+            builder.AddCircuitBreaker(new CircuitBreakerStrategyOptions
+            {
+                FailureRatio = 1.0,
+                MinimumThroughput = policy.BreakerFailureThreshold,
+                SamplingDuration = TimeSpan.FromSeconds(30),
+                BreakDuration = TimeSpan.FromSeconds(15),
+                ShouldHandle = new PredicateBuilder().Handle<Exception>(ex => ex is not OperationCanceledException),
+            });
+        }
+
+        return builder.Build();
+    }
+
+    private readonly record struct PipelineKey(string DriverInstanceId, string HostName, DriverCapability Capability);
+}

src/ZB.MOM.WW.OtOpcUa.Core/Resilience/DriverResilienceStatusTracker.cs

@@ -0,0 +1,104 @@
+using System.Collections.Concurrent;
+
+namespace ZB.MOM.WW.OtOpcUa.Core.Resilience;
+
+/// <summary>
+///     Process-singleton tracker of live resilience counters per
+///     <c>(DriverInstanceId, HostName)</c>. Populated by the CapabilityInvoker and the
+///     MemoryTracking layer; consumed by a HostedService that periodically persists a
+///     snapshot to the <c>DriverInstanceResilienceStatus</c> table for Admin <c>/hosts</c>.
+/// </summary>
+/// <remarks>
+///     Per Phase 6.1 Stream E. No DB dependency here — the tracker is pure in-memory so
+///     tests can exercise it without EF Core or SQL Server. The HostedService that writes
+///     snapshots lives in the Server project (Stream E.2); the actual SignalR push + Blazor
+///     page refresh (E.3) lands in a follow-up visual-review PR.
+/// </remarks>
+public sealed class DriverResilienceStatusTracker
+{
+    private readonly ConcurrentDictionary<StatusKey, ResilienceStatusSnapshot> _status = new();
+
+    /// <summary>Record a Polly pipeline failure for <paramref name="hostName"/>.</summary>
+    public void RecordFailure(string driverInstanceId, string hostName, DateTime utcNow)
+    {
+        var key = new StatusKey(driverInstanceId, hostName);
+        _status.AddOrUpdate(key,
+            _ => new ResilienceStatusSnapshot { ConsecutiveFailures = 1, LastSampledUtc = utcNow },
+            (_, existing) => existing with
+            {
+                ConsecutiveFailures = existing.ConsecutiveFailures + 1,
+                LastSampledUtc = utcNow,
+            });
+    }
+
+    /// <summary>Reset the consecutive-failure count on a successful pipeline execution.</summary>
+    public void RecordSuccess(string driverInstanceId, string hostName, DateTime utcNow)
+    {
+        var key = new StatusKey(driverInstanceId, hostName);
+        _status.AddOrUpdate(key,
+            _ => new ResilienceStatusSnapshot { ConsecutiveFailures = 0, LastSampledUtc = utcNow },
+            (_, existing) => existing with
+            {
+                ConsecutiveFailures = 0,
+                LastSampledUtc = utcNow,
+            });
+    }
+
+    /// <summary>Record a circuit-breaker open event.</summary>
+    public void RecordBreakerOpen(string driverInstanceId, string hostName, DateTime utcNow)
+    {
+        var key = new StatusKey(driverInstanceId, hostName);
+        _status.AddOrUpdate(key,
+            _ => new ResilienceStatusSnapshot { LastBreakerOpenUtc = utcNow, LastSampledUtc = utcNow },
+            (_, existing) => existing with { LastBreakerOpenUtc = utcNow, LastSampledUtc = utcNow });
+    }
+
+    /// <summary>Record a process recycle event (Tier C only).</summary>
+    public void RecordRecycle(string driverInstanceId, string hostName, DateTime utcNow)
+    {
+        var key = new StatusKey(driverInstanceId, hostName);
+        _status.AddOrUpdate(key,
+            _ => new ResilienceStatusSnapshot { LastRecycleUtc = utcNow, LastSampledUtc = utcNow },
+            (_, existing) => existing with { LastRecycleUtc = utcNow, LastSampledUtc = utcNow });
+    }
+
+    /// <summary>Capture / update the MemoryTracking-supplied baseline + current footprint.</summary>
+    public void RecordFootprint(string driverInstanceId, string hostName, long baselineBytes, long currentBytes, DateTime utcNow)
+    {
+        var key = new StatusKey(driverInstanceId, hostName);
+        _status.AddOrUpdate(key,
+            _ => new ResilienceStatusSnapshot
+            {
+                BaselineFootprintBytes = baselineBytes,
+                CurrentFootprintBytes = currentBytes,
+                LastSampledUtc = utcNow,
+            },
+            (_, existing) => existing with
+            {
+                BaselineFootprintBytes = baselineBytes,
+                CurrentFootprintBytes = currentBytes,
+                LastSampledUtc = utcNow,
+            });
+    }
+
+    /// <summary>Snapshot of a specific (instance, host) pair; null if no counters recorded yet.</summary>
+    public ResilienceStatusSnapshot? TryGet(string driverInstanceId, string hostName) =>
+        _status.TryGetValue(new StatusKey(driverInstanceId, hostName), out var snapshot) ? snapshot : null;
+
+    /// <summary>Copy of every currently-tracked (instance, host, snapshot) triple. Safe under concurrent writes.</summary>
+    public IReadOnlyList<(string DriverInstanceId, string HostName, ResilienceStatusSnapshot Snapshot)> Snapshot() =>
+        _status.Select(kvp => (kvp.Key.DriverInstanceId, kvp.Key.HostName, kvp.Value)).ToList();
+
+    private readonly record struct StatusKey(string DriverInstanceId, string HostName);
+}
+
+/// <summary>Snapshot of the resilience counters for one <c>(DriverInstanceId, HostName)</c> pair.</summary>
+public sealed record ResilienceStatusSnapshot
+{
+    public int ConsecutiveFailures { get; init; }
+    public DateTime? LastBreakerOpenUtc { get; init; }
+    public DateTime? LastRecycleUtc { get; init; }
+    public long BaselineFootprintBytes { get; init; }
+    public long CurrentFootprintBytes { get; init; }
+    public DateTime LastSampledUtc { get; init; }
+}

src/ZB.MOM.WW.OtOpcUa.Core/Stability/MemoryRecycle.cs

@@ -0,0 +1,65 @@
+using Microsoft.Extensions.Logging;
+using ZB.MOM.WW.OtOpcUa.Core.Abstractions;
+
+namespace ZB.MOM.WW.OtOpcUa.Core.Stability;
+
+/// <summary>
+///     Tier C only process-recycle companion to <see cref="MemoryTracking"/>. On a
+///     <see cref="MemoryTrackingAction.HardBreach"/> signal, invokes the supplied
+///     <see cref="IDriverSupervisor"/> to restart the out-of-process Host.
+/// </summary>
+/// <remarks>
+///     Per <c>docs/v2/plan.md</c> decisions #74 and #145. Tier A/B hard-breach on an in-process
+///     driver would kill every OPC UA session and every co-hosted driver, so for Tier A/B this
+///     class logs a <b>promotion-to-Tier-C recommendation</b> and does NOT invoke any supervisor.
+///     A future tier-migration workflow acts on the recommendation.
+/// </remarks>
+public sealed class MemoryRecycle
+{
+    private readonly DriverTier _tier;
+    private readonly IDriverSupervisor? _supervisor;
+    private readonly ILogger<MemoryRecycle> _logger;
+
+    public MemoryRecycle(DriverTier tier, IDriverSupervisor? supervisor, ILogger<MemoryRecycle> logger)
+    {
+        _tier = tier;
+        _supervisor = supervisor;
+        _logger = logger;
+    }
+
+    /// <summary>
+    ///     Handle a <see cref="MemoryTracking"/> classification for the driver. For Tier C with a
+    ///     wired supervisor, <c>HardBreach</c> triggers <see cref="IDriverSupervisor.RecycleAsync"/>.
+    ///     All other combinations are no-ops with respect to process state (soft breaches + Tier A/B
+    ///     hard breaches just log).
+    /// </summary>
+    /// <returns>True when a recycle was requested; false otherwise.</returns>
+    public async Task<bool> HandleAsync(MemoryTrackingAction action, long footprintBytes, CancellationToken cancellationToken)
+    {
+        switch (action)
+        {
+            case MemoryTrackingAction.SoftBreach:
+                _logger.LogWarning(
+                    "Memory soft-breach on driver {DriverId}: footprint={Footprint:N0} bytes, tier={Tier}. Surfaced to Admin; no action.",
+                    _supervisor?.DriverInstanceId ?? "(unknown)", footprintBytes, _tier);
+                return false;
+
+            case MemoryTrackingAction.HardBreach when _tier == DriverTier.C && _supervisor is not null:
+                _logger.LogError(
+                    "Memory hard-breach on Tier C driver {DriverId}: footprint={Footprint:N0} bytes. Requesting supervisor recycle.",
+                    _supervisor.DriverInstanceId, footprintBytes);
+                await _supervisor.RecycleAsync($"Memory hard-breach: {footprintBytes} bytes", cancellationToken).ConfigureAwait(false);
+                return true;
+
+            case MemoryTrackingAction.HardBreach:
+                _logger.LogError(
+                    "Memory hard-breach on Tier {Tier} in-process driver {DriverId}: footprint={Footprint:N0} bytes. " +
+                    "Recommending promotion to Tier C; NOT auto-killing (decisions #74, #145).",
+                    _tier, _supervisor?.DriverInstanceId ?? "(unknown)", footprintBytes);
+                return false;
+
+            default:
+                return false;
+        }
+    }
+}

src/ZB.MOM.WW.OtOpcUa.Core/Stability/MemoryTracking.cs

@@ -0,0 +1,136 @@
+using ZB.MOM.WW.OtOpcUa.Core.Abstractions;
+
+namespace ZB.MOM.WW.OtOpcUa.Core.Stability;
+
+/// <summary>
+///     Tier-agnostic memory-footprint tracker. Captures the post-initialize <b>baseline</b>
+///     from the first samples after <c>IDriver.InitializeAsync</c>, then classifies each
+///     subsequent sample against a hybrid soft/hard threshold per
+///     <c>docs/v2/plan.md</c> decision #146 — <c>soft = max(multiplier × baseline, baseline + floor)</c>,
+///     <c>hard = 2 × soft</c>.
+/// </summary>
+/// <remarks>
+///     <para>Per decision #145, this tracker <b>never kills a process</b>. Soft and hard breaches
+///     log + surface to the Admin UI via <c>DriverInstanceResilienceStatus</c>. The matching
+///     process-level recycle protection lives in a separate <c>MemoryRecycle</c> that activates
+///     for Tier C drivers only (where the driver runs out-of-process behind a supervisor that
+///     can safely restart it without tearing down the OPC UA session or co-hosted in-proc
+///     drivers).</para>
+///
+///     <para>Baseline capture: the tracker starts in <see cref="TrackingPhase.WarmingUp"/> for
+///     <see cref="BaselineWindow"/> (default 5 min). During that window samples are collected;
+///     the baseline is computed as the median once the window elapses. Before that point every
+///     classification returns <see cref="MemoryTrackingAction.Warming"/>.</para>
+/// </remarks>
+public sealed class MemoryTracking
+{
+    private readonly DriverTier _tier;
+    private readonly TimeSpan _baselineWindow;
+    private readonly List<long> _warmupSamples = [];
+    private long _baselineBytes;
+    private TrackingPhase _phase = TrackingPhase.WarmingUp;
+    private DateTime? _warmupStartUtc;
+
+    /// <summary>Tier-default multiplier/floor constants per decision #146.</summary>
+    public static (int Multiplier, long FloorBytes) GetTierConstants(DriverTier tier) => tier switch
+    {
+        DriverTier.A => (Multiplier: 3, FloorBytes: 50L * 1024 * 1024),
+        DriverTier.B => (Multiplier: 3, FloorBytes: 100L * 1024 * 1024),
+        DriverTier.C => (Multiplier: 2, FloorBytes: 500L * 1024 * 1024),
+        _ => throw new ArgumentOutOfRangeException(nameof(tier), tier, $"No memory-tracking constants defined for tier {tier}."),
+    };
+
+    /// <summary>Window over which post-init samples are collected to compute the baseline.</summary>
+    public TimeSpan BaselineWindow => _baselineWindow;
+
+    /// <summary>Current phase: <see cref="TrackingPhase.WarmingUp"/> or <see cref="TrackingPhase.Steady"/>.</summary>
+    public TrackingPhase Phase => _phase;
+
+    /// <summary>Captured baseline; 0 until warmup completes.</summary>
+    public long BaselineBytes => _baselineBytes;
+
+    /// <summary>Effective soft threshold (zero while warming up).</summary>
+    public long SoftThresholdBytes => _baselineBytes == 0 ? 0 : ComputeSoft(_tier, _baselineBytes);
+
+    /// <summary>Effective hard threshold = 2 × soft (zero while warming up).</summary>
+    public long HardThresholdBytes => _baselineBytes == 0 ? 0 : ComputeSoft(_tier, _baselineBytes) * 2;
+
+    public MemoryTracking(DriverTier tier, TimeSpan? baselineWindow = null)
+    {
+        _tier = tier;
+        _baselineWindow = baselineWindow ?? TimeSpan.FromMinutes(5);
+    }
+
+    /// <summary>
+    ///     Submit a memory-footprint sample. Returns the action the caller should surface.
+    ///     During warmup, always returns <see cref="MemoryTrackingAction.Warming"/> and accumulates
+    ///     samples; once the window elapses the first steady-phase sample triggers baseline capture
+    ///     (median of warmup samples).
+    /// </summary>
+    public MemoryTrackingAction Sample(long footprintBytes, DateTime utcNow)
+    {
+        if (_phase == TrackingPhase.WarmingUp)
+        {
+            _warmupStartUtc ??= utcNow;
+            _warmupSamples.Add(footprintBytes);
+            if (utcNow - _warmupStartUtc.Value >= _baselineWindow && _warmupSamples.Count > 0)
+            {
+                _baselineBytes = ComputeMedian(_warmupSamples);
+                _phase = TrackingPhase.Steady;
+            }
+            else
+            {
+                return MemoryTrackingAction.Warming;
+            }
+        }
+
+        if (footprintBytes >= HardThresholdBytes) return MemoryTrackingAction.HardBreach;
+        if (footprintBytes >= SoftThresholdBytes) return MemoryTrackingAction.SoftBreach;
+        return MemoryTrackingAction.None;
+    }
+
+    private static long ComputeSoft(DriverTier tier, long baseline)
+    {
+        var (multiplier, floor) = GetTierConstants(tier);
+        return Math.Max(multiplier * baseline, baseline + floor);
+    }
+
+    private static long ComputeMedian(List<long> samples)
+    {
+        var sorted = samples.Order().ToArray();
+        var mid = sorted.Length / 2;
+        return sorted.Length % 2 == 1
+            ? sorted[mid]
+            : (sorted[mid - 1] + sorted[mid]) / 2;
+    }
+}
+
+/// <summary>Phase of a <see cref="MemoryTracking"/> lifecycle.</summary>
+public enum TrackingPhase
+{
+    /// <summary>Collecting post-init samples; baseline not yet computed.</summary>
+    WarmingUp,
+
+    /// <summary>Baseline captured; every sample classified against soft/hard thresholds.</summary>
+    Steady,
+}
+
+/// <summary>Classification the tracker returns per sample.</summary>
+public enum MemoryTrackingAction
+{
+    /// <summary>Baseline not yet captured; sample collected, no threshold check.</summary>
+    Warming,
+
+    /// <summary>Below soft threshold.</summary>
+    None,
+
+    /// <summary>Between soft and hard thresholds — log + surface, no action.</summary>
+    SoftBreach,
+
+    /// <summary>
+    ///     ≥ hard threshold. Log + surface + (Tier C only, via <c>MemoryRecycle</c>) request
+    ///     process recycle via the driver supervisor. Tier A/B breach never invokes any
+    ///     kill path per decisions #145 and #74.
+    /// </summary>
+    HardBreach,
+}

src/ZB.MOM.WW.OtOpcUa.Core/Stability/ScheduledRecycleScheduler.cs

@@ -0,0 +1,86 @@
+using Microsoft.Extensions.Logging;
+using ZB.MOM.WW.OtOpcUa.Core.Abstractions;
+
+namespace ZB.MOM.WW.OtOpcUa.Core.Stability;
+
+/// <summary>
+///     Tier C opt-in periodic-recycle driver per <c>docs/v2/plan.md</c> decision #67.
+///     A tick method advanced by the caller (fed by a background timer in prod; by test clock
+///     in unit tests) decides whether the configured interval has elapsed and, if so, drives the
+///     supplied <see cref="IDriverSupervisor"/> to recycle the Host.
+/// </summary>
+/// <remarks>
+///     Tier A/B drivers MUST NOT use this class — scheduled recycle for in-process drivers would
+///     kill every OPC UA session and every co-hosted driver. The ctor throws when constructed
+///     with any tier other than C to make the misuse structurally impossible.
+///
+///     <para>Keeps no background thread of its own — callers invoke <see cref="TickAsync"/> on
+///     their ambient scheduler tick (Phase 6.1 Stream C's health-endpoint host runs one). That
+///     decouples the unit under test from wall-clock time and thread-pool scheduling.</para>
+/// </remarks>
+public sealed class ScheduledRecycleScheduler
+{
+    private readonly TimeSpan _recycleInterval;
+    private readonly IDriverSupervisor _supervisor;
+    private readonly ILogger<ScheduledRecycleScheduler> _logger;
+    private DateTime _nextRecycleUtc;
+
+    /// <summary>
+    ///     Construct the scheduler for a Tier C driver. Throws if <paramref name="tier"/> isn't C.
+    /// </summary>
+    /// <param name="tier">Driver tier; must be <see cref="DriverTier.C"/>.</param>
+    /// <param name="recycleInterval">Interval between recycles (e.g. 7 days).</param>
+    /// <param name="startUtc">Anchor time; next recycle fires at <paramref name="startUtc"/> + <paramref name="recycleInterval"/>.</param>
+    /// <param name="supervisor">Supervisor that performs the actual recycle.</param>
+    /// <param name="logger">Diagnostic sink.</param>
+    public ScheduledRecycleScheduler(
+        DriverTier tier,
+        TimeSpan recycleInterval,
+        DateTime startUtc,
+        IDriverSupervisor supervisor,
+        ILogger<ScheduledRecycleScheduler> logger)
+    {
+        if (tier != DriverTier.C)
+            throw new ArgumentException(
+                $"ScheduledRecycleScheduler is Tier C only (got {tier}). " +
+                "In-process drivers must not use scheduled recycle; see decisions #74 and #145.",
+                nameof(tier));
+
+        if (recycleInterval <= TimeSpan.Zero)
+            throw new ArgumentException("RecycleInterval must be positive.", nameof(recycleInterval));
+
+        _recycleInterval = recycleInterval;
+        _supervisor = supervisor;
+        _logger = logger;
+        _nextRecycleUtc = startUtc + recycleInterval;
+    }
+
+    /// <summary>Next scheduled recycle UTC. Advances by <see cref="RecycleInterval"/> on each fire.</summary>
+    public DateTime NextRecycleUtc => _nextRecycleUtc;
+
+    /// <summary>Recycle interval this scheduler was constructed with.</summary>
+    public TimeSpan RecycleInterval => _recycleInterval;
+
+    /// <summary>
+    ///     Tick the scheduler forward. If <paramref name="utcNow"/> is past
+    ///     <see cref="NextRecycleUtc"/>, requests a recycle from the supervisor and advances
+    ///     <see cref="NextRecycleUtc"/> by exactly one interval. Returns true when a recycle fired.
+    /// </summary>
+    public async Task<bool> TickAsync(DateTime utcNow, CancellationToken cancellationToken)
+    {
+        if (utcNow < _nextRecycleUtc)
+            return false;
+
+        _logger.LogInformation(
+            "Scheduled recycle due for Tier C driver {DriverId} at {Now:o}; advancing next to {Next:o}.",
+            _supervisor.DriverInstanceId, utcNow, _nextRecycleUtc + _recycleInterval);
+
+        await _supervisor.RecycleAsync("Scheduled periodic recycle", cancellationToken).ConfigureAwait(false);
+        _nextRecycleUtc += _recycleInterval;
+        return true;
+    }
+
+    /// <summary>Request an immediate recycle outside the schedule (e.g. MemoryRecycle hard-breach escalation).</summary>
+    public Task RequestRecycleNowAsync(string reason, CancellationToken cancellationToken) =>
+        _supervisor.RecycleAsync(reason, cancellationToken);
+}

src/ZB.MOM.WW.OtOpcUa.Core/Stability/WedgeDetector.cs

@@ -0,0 +1,81 @@
+using ZB.MOM.WW.OtOpcUa.Core.Abstractions;
+
+namespace ZB.MOM.WW.OtOpcUa.Core.Stability;
+
+/// <summary>
+///     Demand-aware driver-wedge detector per <c>docs/v2/plan.md</c> decision #147.
+///     Flips a driver to <see cref="WedgeVerdict.Faulted"/> only when BOTH of the following hold:
+///     (a) there is pending work outstanding, AND (b) no progress has been observed for longer
+///     than <see cref="Threshold"/>. Idle drivers, write-only burst drivers, and subscription-only
+///     drivers whose signals don't arrive regularly all stay Healthy.
+/// </summary>
+/// <remarks>
+///     <para>Pending work signal is supplied by the caller via <see cref="DemandSignal"/>:
+///     non-zero Polly bulkhead depth, ≥1 active MonitoredItem, or ≥1 queued historian read
+///     each qualifies. The detector itself is state-light: all it remembers is the last
+///     <c>LastProgressUtc</c> it saw and the last wedge verdict. No history buffer.</para>
+///
+///     <para>Default threshold per plan: <c>5 × PublishingInterval</c>, with a minimum of 60 s.
+///     Concrete values are driver-agnostic and configured per-instance by the caller.</para>
+/// </remarks>
+public sealed class WedgeDetector
+{
+    /// <summary>Wedge-detection threshold; pass &lt; 60 s and the detector clamps to 60 s.</summary>
+    public TimeSpan Threshold { get; }
+
+    /// <summary>Whether the driver reported itself <see cref="DriverState.Healthy"/> at construction.</summary>
+    public WedgeDetector(TimeSpan threshold)
+    {
+        Threshold = threshold < TimeSpan.FromSeconds(60) ? TimeSpan.FromSeconds(60) : threshold;
+    }
+
+    /// <summary>
+    ///     Classify the current state against the demand signal. Does not retain state across
+    ///     calls — each call is self-contained; the caller owns the <c>LastProgressUtc</c> clock.
+    /// </summary>
+    public WedgeVerdict Classify(DriverState state, DemandSignal demand, DateTime utcNow)
+    {
+        if (state != DriverState.Healthy)
+            return WedgeVerdict.NotApplicable;
+
+        if (!demand.HasPendingWork)
+            return WedgeVerdict.Idle;
+
+        var sinceProgress = utcNow - demand.LastProgressUtc;
+        return sinceProgress > Threshold ? WedgeVerdict.Faulted : WedgeVerdict.Healthy;
+    }
+}
+
+/// <summary>
+///     Caller-supplied demand snapshot. All three counters are OR'd — any non-zero means work
+///     is outstanding, which is the trigger for checking the <see cref="LastProgressUtc"/> clock.
+/// </summary>
+/// <param name="BulkheadDepth">Polly bulkhead depth (in-flight capability calls).</param>
+/// <param name="ActiveMonitoredItems">Number of live OPC UA MonitoredItems bound to this driver.</param>
+/// <param name="QueuedHistoryReads">Pending historian-read requests the driver owes the server.</param>
+/// <param name="LastProgressUtc">Last time the driver reported a successful unit of work (read, subscribe-ack, publish).</param>
+public readonly record struct DemandSignal(
+    int BulkheadDepth,
+    int ActiveMonitoredItems,
+    int QueuedHistoryReads,
+    DateTime LastProgressUtc)
+{
+    /// <summary>True when any of the three counters is &gt; 0.</summary>
+    public bool HasPendingWork => BulkheadDepth > 0 || ActiveMonitoredItems > 0 || QueuedHistoryReads > 0;
+}
+
+/// <summary>Outcome of a single <see cref="WedgeDetector.Classify"/> call.</summary>
+public enum WedgeVerdict
+{
+    /// <summary>Driver wasn't Healthy to begin with — wedge detection doesn't apply.</summary>
+    NotApplicable,
+
+    /// <summary>Driver claims Healthy + no pending work → stays Healthy.</summary>
+    Idle,
+
+    /// <summary>Driver claims Healthy + has pending work + has made progress within the threshold → stays Healthy.</summary>
+    Healthy,
+
+    /// <summary>Driver claims Healthy + has pending work + has NOT made progress within the threshold → wedged.</summary>
+    Faulted,
+}

src/ZB.MOM.WW.OtOpcUa.Core/ZB.MOM.WW.OtOpcUa.Core.csproj

@@ -16,6 +16,11 @@
         <ProjectReference Include="..\ZB.MOM.WW.OtOpcUa.Configuration\ZB.MOM.WW.OtOpcUa.Configuration.csproj"/>
     </ItemGroup>
 
+    <ItemGroup>
+        <PackageReference Include="Polly.Core" Version="8.6.6"/>
+        <PackageReference Include="Serilog" Version="4.3.0"/>
+    </ItemGroup>
+
     <ItemGroup>
         <InternalsVisibleTo Include="ZB.MOM.WW.OtOpcUa.Core.Tests"/>
     </ItemGroup>

src/ZB.MOM.WW.OtOpcUa.Driver.Modbus/DirectLogicAddress.cs

@@ -0,0 +1,165 @@
+namespace ZB.MOM.WW.OtOpcUa.Driver.Modbus;
+
+/// <summary>
+///     AutomationDirect DirectLOGIC address-translation helpers. DL205 / DL260 / DL350 CPUs
+///     address V-memory in OCTAL while the Modbus wire uses DECIMAL PDU addresses — operators
+///     see "V2000" in the PLC ladder-logic editor but the Modbus client must write PDU 0x0400.
+///     The formulas differ between user V-memory (simple octal-to-decimal) and system V-memory
+///     (fixed bank mappings), so the two cases are separate methods rather than one overloaded
+///     "ToPdu" call.
+/// </summary>
+/// <remarks>
+///     See <c>docs/v2/dl205.md</c> §V-memory for the full CPU-family matrix + rationale.
+///     References: D2-USER-M appendix (DL205/D2-260), H2-ECOM-M §6.5 (absolute vs relative
+///     addressing), AutomationDirect forum guidance on V40400 system-base.
+/// </remarks>
+public static class DirectLogicAddress
+{
+    /// <summary>
+    ///     Convert a DirectLOGIC user V-memory address (octal) to a 0-based Modbus PDU address.
+    ///     Accepts bare octal (<c>"2000"</c>) or <c>V</c>-prefixed (<c>"V2000"</c>). Range
+    ///     depends on CPU model — DL205 D2-260 user memory is V1400-V7377 + V10000-V17777
+    ///     octal, DL260 extends to V77777 octal.
+    /// </summary>
+    /// <exception cref="ArgumentException">Input is null / empty / contains non-octal digits (8,9).</exception>
+    /// <exception cref="OverflowException">Parsed value exceeds ushort.MaxValue (0xFFFF).</exception>
+    public static ushort UserVMemoryToPdu(string vAddress)
+    {
+        if (string.IsNullOrWhiteSpace(vAddress))
+            throw new ArgumentException("V-memory address must not be empty", nameof(vAddress));
+        var s = vAddress.Trim();
+        if (s[0] == 'V' || s[0] == 'v') s = s.Substring(1);
+        if (s.Length == 0)
+            throw new ArgumentException($"V-memory address '{vAddress}' has no digits", nameof(vAddress));
+
+        // Octal conversion. Reject 8/9 digits up-front — int.Parse in the obvious base would
+        // accept them silently because .NET has no built-in base-8 parser.
+        uint result = 0;
+        foreach (var ch in s)
+        {
+            if (ch < '0' || ch > '7')
+                throw new ArgumentException(
+                    $"V-memory address '{vAddress}' contains non-octal digit '{ch}' — DirectLOGIC V-addresses are octal (0-7)",
+                    nameof(vAddress));
+            result = result * 8 + (uint)(ch - '0');
+            if (result > ushort.MaxValue)
+                throw new OverflowException(
+                    $"V-memory address '{vAddress}' exceeds the 16-bit Modbus PDU address range");
+        }
+        return (ushort)result;
+    }
+
+    /// <summary>
+    ///     DirectLOGIC system V-memory starts at octal V40400 on DL260 / H2-ECOM100 in factory
+    ///     "absolute" addressing mode. Unlike user V-memory, the mapping is NOT a simple
+    ///     octal-to-decimal conversion — the CPU relocates the system bank to Modbus PDU 0x2100
+    ///     (decimal 8448). This helper returns the CPU-family base plus a user-supplied offset
+    ///     within the system bank.
+    /// </summary>
+    public const ushort SystemVMemoryBasePdu = 0x2100;
+
+    /// <param name="offsetWithinSystemBank">
+    ///     0-based register offset within the system bank. Pass 0 for V40400 itself; pass 1 for
+    ///     V40401 (octal), and so on. NOT an octal-decoded value — the system bank lives at
+    ///     consecutive PDU addresses, so the offset is plain decimal.
+    /// </param>
+    public static ushort SystemVMemoryToPdu(ushort offsetWithinSystemBank)
+    {
+        var pdu = SystemVMemoryBasePdu + offsetWithinSystemBank;
+        if (pdu > ushort.MaxValue)
+            throw new OverflowException(
+                $"System V-memory offset {offsetWithinSystemBank} maps past 0xFFFF");
+        return (ushort)pdu;
+    }
+
+    // Bit-memory bases per DL260 user manual §I/O-configuration.
+    // Numbers after X / Y / C / SP are OCTAL in DirectLOGIC notation. The Modbus base is
+    // added to the octal-decoded offset; e.g. Y017 = Modbus coil 2048 + octal(17) = 2048 + 15 = 2063.
+
+    /// <summary>
+    ///     DL260 Y-output coil base. Y0 octal → Modbus coil address 2048 (0-based).
+    /// </summary>
+    public const ushort YOutputBaseCoil = 2048;
+
+    /// <summary>
+    ///     DL260 C-relay coil base. C0 octal → Modbus coil address 3072 (0-based).
+    /// </summary>
+    public const ushort CRelayBaseCoil = 3072;
+
+    /// <summary>
+    ///     DL260 X-input discrete-input base. X0 octal → Modbus discrete input 0.
+    /// </summary>
+    public const ushort XInputBaseDiscrete = 0;
+
+    /// <summary>
+    ///     DL260 SP special-relay discrete-input base. SP0 octal → Modbus discrete input 1024.
+    ///     Read-only; writing SP relays is rejected with Illegal Data Address.
+    /// </summary>
+    public const ushort SpecialBaseDiscrete = 1024;
+
+    /// <summary>
+    ///     Translate a DirectLOGIC Y-output address (e.g. <c>"Y0"</c>, <c>"Y17"</c>) to its
+    ///     0-based Modbus coil address on DL260. The trailing number is OCTAL, matching the
+    ///     ladder-logic editor's notation.
+    /// </summary>
+    public static ushort YOutputToCoil(string yAddress) =>
+        AddOctalOffset(YOutputBaseCoil, StripPrefix(yAddress, 'Y'));
+
+    /// <summary>
+    ///     Translate a DirectLOGIC C-relay address (e.g. <c>"C0"</c>, <c>"C1777"</c>) to its
+    ///     0-based Modbus coil address.
+    /// </summary>
+    public static ushort CRelayToCoil(string cAddress) =>
+        AddOctalOffset(CRelayBaseCoil, StripPrefix(cAddress, 'C'));
+
+    /// <summary>
+    ///     Translate a DirectLOGIC X-input address (e.g. <c>"X0"</c>, <c>"X17"</c>) to its
+    ///     0-based Modbus discrete-input address. Reading an unpopulated X returns 0, not an
+    ///     exception — the CPU sizes the table to configured I/O, not installed modules.
+    /// </summary>
+    public static ushort XInputToDiscrete(string xAddress) =>
+        AddOctalOffset(XInputBaseDiscrete, StripPrefix(xAddress, 'X'));
+
+    /// <summary>
+    ///     Translate a DirectLOGIC SP-special-relay address (e.g. <c>"SP0"</c>) to its 0-based
+    ///     Modbus discrete-input address. Accepts <c>"SP"</c> prefix case-insensitively.
+    /// </summary>
+    public static ushort SpecialToDiscrete(string spAddress)
+    {
+        if (string.IsNullOrWhiteSpace(spAddress))
+            throw new ArgumentException("SP address must not be empty", nameof(spAddress));
+        var s = spAddress.Trim();
+        if (s.Length >= 2 && (s[0] == 'S' || s[0] == 's') && (s[1] == 'P' || s[1] == 'p'))
+            s = s.Substring(2);
+        return AddOctalOffset(SpecialBaseDiscrete, s);
+    }
+
+    private static string StripPrefix(string address, char expectedPrefix)
+    {
+        if (string.IsNullOrWhiteSpace(address))
+            throw new ArgumentException("Address must not be empty", nameof(address));
+        var s = address.Trim();
+        if (s.Length > 0 && char.ToUpperInvariant(s[0]) == char.ToUpperInvariant(expectedPrefix))
+            s = s.Substring(1);
+        return s;
+    }
+
+    private static ushort AddOctalOffset(ushort baseAddr, string octalDigits)
+    {
+        if (octalDigits.Length == 0)
+            throw new ArgumentException("Address has no digits", nameof(octalDigits));
+        uint offset = 0;
+        foreach (var ch in octalDigits)
+        {
+            if (ch < '0' || ch > '7')
+                throw new ArgumentException(
+                    $"Address contains non-octal digit '{ch}' — DirectLOGIC I/O addresses are octal (0-7)",
+                    nameof(octalDigits));
+            offset = offset * 8 + (uint)(ch - '0');
+        }
+        var result = baseAddr + offset;
+        if (result > ushort.MaxValue)
+            throw new OverflowException($"Address {baseAddr}+{offset} exceeds 0xFFFF");
+        return (ushort)result;
+    }
+}

src/ZB.MOM.WW.OtOpcUa.Driver.Modbus/MelsecAddress.cs

@@ -0,0 +1,161 @@
+namespace ZB.MOM.WW.OtOpcUa.Driver.Modbus;
+
+/// <summary>
+///     Mitsubishi MELSEC PLC family selector for address-translation helpers. The Q/L/iQ-R
+///     families write bit-device addresses (X, Y) in <b>hexadecimal</b> in GX Works and the
+///     CPU manuals; the FX and iQ-F families write them in <b>octal</b> (same convention as
+///     AutomationDirect DirectLOGIC). Mixing the two up is the #1 MELSEC driver bug source —
+///     an operator typing <c>X20</c> into a Q-series tag config means decimal 32, but the
+///     same string on an FX3U means decimal 16, so the helper must know the family to route
+///     correctly.
+/// </summary>
+public enum MelsecFamily
+{
+    /// <summary>
+    ///     MELSEC-Q / MELSEC-L / MELSEC iQ-R. X and Y device numbers are interpreted as
+    ///     <b>hexadecimal</b>; <c>X20</c> means decimal 32.
+    /// </summary>
+    Q_L_iQR,
+
+    /// <summary>
+    ///     MELSEC-F (FX3U / FX3GE / FX3G) and MELSEC iQ-F (FX5U). X and Y device numbers
+    ///     are interpreted as <b>octal</b> (same as DirectLOGIC); <c>X20</c> means decimal 16.
+    ///     iQ-F has a GX Works3 project toggle that can flip to decimal — if a site uses
+    ///     that, configure the tag's Address directly as a decimal PDU address and do not
+    ///     route through this helper.
+    /// </summary>
+    F_iQF,
+}
+
+/// <summary>
+///     Mitsubishi MELSEC address-translation helpers for the QJ71MT91 / LJ71MT91 / RJ71EN71 /
+///     iQ-R built-in / iQ-F / FX3U-ENET-P502 Modbus modules. MELSEC does NOT hard-wire
+///     Modbus-to-device mappings like DL260 does — every site configures its own "Modbus
+///     Device Assignment Parameter" block of up to 16 entries. The helpers here cover only
+///     the <b>address-notation</b> portion of the translation (hex X20 vs octal X20 + adding
+///     the bank base); the caller is still responsible for knowing the assignment-block
+///     offset for their site.
+/// </summary>
+/// <remarks>
+///     See <c>docs/v2/mitsubishi.md</c> §device-assignment + §X-Y-hex-trap for the full
+///     matrix and primary-source citations.
+/// </remarks>
+public static class MelsecAddress
+{
+    /// <summary>
+    ///     Translate a MELSEC X-input address (e.g. <c>"X0"</c>, <c>"X10"</c>) to a 0-based
+    ///     Modbus discrete-input address, given the PLC family's address notation (hex or
+    ///     octal) and the Modbus Device Assignment block's X-range base.
+    /// </summary>
+    /// <param name="xAddress">MELSEC X address. <c>X</c> prefix optional, case-insensitive.</param>
+    /// <param name="family">The PLC family — determines whether the trailing digits are hex or octal.</param>
+    /// <param name="xBankBase">
+    ///     0-based Modbus DI address the assignment-block has configured X0 to land at.
+    ///     Typical default on QJ71MT91 sample projects: 0. Pass the site-specific value.
+    /// </param>
+    public static ushort XInputToDiscrete(string xAddress, MelsecFamily family, ushort xBankBase = 0) =>
+        AddFamilyOffset(xBankBase, StripPrefix(xAddress, 'X'), family);
+
+    /// <summary>
+    ///     Translate a MELSEC Y-output address to a 0-based Modbus coil address. Same rules
+    ///     as <see cref="XInputToDiscrete"/> for hex/octal parsing.
+    /// </summary>
+    public static ushort YOutputToCoil(string yAddress, MelsecFamily family, ushort yBankBase = 0) =>
+        AddFamilyOffset(yBankBase, StripPrefix(yAddress, 'Y'), family);
+
+    /// <summary>
+    ///     Translate a MELSEC M-relay address (internal relay) to a 0-based Modbus coil
+    ///     address. M-addresses are <b>decimal</b> on every MELSEC family — unlike X/Y which
+    ///     are hex on Q/L/iQ-R. Includes the bank base that the assignment-block configured.
+    /// </summary>
+    public static ushort MRelayToCoil(string mAddress, ushort mBankBase = 0)
+    {
+        var digits = StripPrefix(mAddress, 'M');
+        if (!ushort.TryParse(digits, out var offset))
+            throw new ArgumentException(
+                $"M-relay address '{mAddress}' is not a valid decimal integer", nameof(mAddress));
+        var result = mBankBase + offset;
+        if (result > ushort.MaxValue)
+            throw new OverflowException($"M-relay {mAddress} + base {mBankBase} exceeds 0xFFFF");
+        return (ushort)result;
+    }
+
+    /// <summary>
+    ///     Translate a MELSEC D-register address (data register) to a 0-based Modbus holding
+    ///     register address. D-addresses are <b>decimal</b>. Default assignment convention is
+    ///     D0 → HR 0 (pass <paramref name="dBankBase"/> = 0); sites with shifted layouts pass
+    ///     their configured base.
+    /// </summary>
+    public static ushort DRegisterToHolding(string dAddress, ushort dBankBase = 0)
+    {
+        var digits = StripPrefix(dAddress, 'D');
+        if (!ushort.TryParse(digits, out var offset))
+            throw new ArgumentException(
+                $"D-register address '{dAddress}' is not a valid decimal integer", nameof(dAddress));
+        var result = dBankBase + offset;
+        if (result > ushort.MaxValue)
+            throw new OverflowException($"D-register {dAddress} + base {dBankBase} exceeds 0xFFFF");
+        return (ushort)result;
+    }
+
+    private static string StripPrefix(string address, char expectedPrefix)
+    {
+        if (string.IsNullOrWhiteSpace(address))
+            throw new ArgumentException("Address must not be empty", nameof(address));
+        var s = address.Trim();
+        if (s.Length > 0 && char.ToUpperInvariant(s[0]) == char.ToUpperInvariant(expectedPrefix))
+            s = s.Substring(1);
+        if (s.Length == 0)
+            throw new ArgumentException($"Address '{address}' has no digits after prefix", nameof(address));
+        return s;
+    }
+
+    private static ushort AddFamilyOffset(ushort baseAddr, string digits, MelsecFamily family)
+    {
+        uint offset = family switch
+        {
+            MelsecFamily.Q_L_iQR => ParseHex(digits),
+            MelsecFamily.F_iQF => ParseOctal(digits),
+            _ => throw new ArgumentOutOfRangeException(nameof(family), family, "Unknown MELSEC family"),
+        };
+        var result = baseAddr + offset;
+        if (result > ushort.MaxValue)
+            throw new OverflowException($"Address {baseAddr}+{offset} exceeds 0xFFFF");
+        return (ushort)result;
+    }
+
+    private static uint ParseHex(string digits)
+    {
+        uint result = 0;
+        foreach (var ch in digits)
+        {
+            uint nibble;
+            if (ch >= '0' && ch <= '9') nibble = (uint)(ch - '0');
+            else if (ch >= 'A' && ch <= 'F') nibble = (uint)(ch - 'A' + 10);
+            else if (ch >= 'a' && ch <= 'f') nibble = (uint)(ch - 'a' + 10);
+            else throw new ArgumentException(
+                $"Address contains non-hex digit '{ch}' — Q/L/iQ-R X/Y addresses are hexadecimal",
+                nameof(digits));
+            result = result * 16 + nibble;
+            if (result > ushort.MaxValue)
+                throw new OverflowException($"Hex address exceeds 0xFFFF");
+        }
+        return result;
+    }
+
+    private static uint ParseOctal(string digits)
+    {
+        uint result = 0;
+        foreach (var ch in digits)
+        {
+            if (ch < '0' || ch > '7')
+                throw new ArgumentException(
+                    $"Address contains non-octal digit '{ch}' — FX/iQ-F X/Y addresses are octal (0-7)",
+                    nameof(digits));
+            result = result * 8 + (uint)(ch - '0');
+            if (result > ushort.MaxValue)
+                throw new OverflowException($"Octal address exceeds 0xFFFF");
+        }
+        return result;
+    }
+}

src/ZB.MOM.WW.OtOpcUa.Driver.Modbus/ModbusDriver.cs

@@ -37,7 +37,7 @@ public sealed class ModbusDriver(ModbusDriverOptions options, string driverInsta
     private CancellationTokenSource? _probeCts;
     private readonly ModbusDriverOptions _options = options;
     private readonly Func<ModbusDriverOptions, IModbusTransport> _transportFactory =
-        transportFactory ?? (o => new ModbusTcpTransport(o.Host, o.Port, o.Timeout));
+        transportFactory ?? (o => new ModbusTcpTransport(o.Host, o.Port, o.Timeout, o.AutoReconnect));
 
     private IModbusTransport? _transport;
     private DriverHealth _health = new(DriverState.Unknown, null, null);
@@ -115,7 +115,8 @@ public sealed class ModbusDriver(ModbusDriverOptions options, string driverInsta
                 ArrayDim: null,
                 SecurityClass: t.Writable ? SecurityClassification.Operate : SecurityClassification.ViewOnly,
                 IsHistorized: false,
-                IsAlarm: false));
+                IsAlarm: false,
+                WriteIdempotent: t.WriteIdempotent));
         }
         return Task.CompletedTask;
     }
@@ -141,9 +142,16 @@ public sealed class ModbusDriver(ModbusDriverOptions options, string driverInsta
                 results[i] = new DataValueSnapshot(value, 0u, now, now);
                 _health = new DriverHealth(DriverState.Healthy, now, null);
             }
+            catch (ModbusException mex)
+            {
+                results[i] = new DataValueSnapshot(null, MapModbusExceptionToStatus(mex.ExceptionCode), null, now);
+                _health = new DriverHealth(DriverState.Degraded, _health.LastSuccessfulRead, mex.Message);
+            }
             catch (Exception ex)
             {
-                results[i] = new DataValueSnapshot(null, StatusBadInternalError, null, now);
+                // Non-Modbus-layer failure: socket dropped, timeout, malformed response. Surface
+                // as communication error so callers can distinguish it from tag-level faults.
+                results[i] = new DataValueSnapshot(null, StatusBadCommunicationError, null, now);
                 _health = new DriverHealth(DriverState.Degraded, _health.LastSuccessfulRead, ex.Message);
             }
         }
@@ -171,11 +179,14 @@ public sealed class ModbusDriver(ModbusDriverOptions options, string driverInsta
             {
                 var quantity = RegisterCount(tag);
                 var fc = tag.Region == ModbusRegion.HoldingRegisters ? (byte)0x03 : (byte)0x04;
-                var pdu = new byte[] { fc, (byte)(tag.Address >> 8), (byte)(tag.Address & 0xFF),
-                                       (byte)(quantity >> 8), (byte)(quantity & 0xFF) };
-                var resp = await transport.SendAsync(_options.UnitId, pdu, ct).ConfigureAwait(false);
-                // resp = [fc][byte-count][data...]
-                var data = new ReadOnlySpan<byte>(resp, 2, resp[1]);
+                // Auto-chunk when the tag's register span exceeds the caller-configured cap.
+                // Affects long strings (FC03/04 > 125 regs is spec-forbidden; DL205 caps at 128,
+                // Mitsubishi Q caps at 64). Non-string tags max out at 4 regs so the cap never
+                // triggers for numerics.
+                var cap = _options.MaxRegistersPerRead == 0 ? (ushort)125 : _options.MaxRegistersPerRead;
+                var data = quantity <= cap
+                    ? await ReadRegisterBlockAsync(transport, fc, tag.Address, quantity, ct).ConfigureAwait(false)
+                    : await ReadRegisterBlockChunkedAsync(transport, fc, tag.Address, quantity, cap, ct).ConfigureAwait(false);
                 return DecodeRegister(data, tag);
             }
             default:
@@ -183,6 +194,33 @@ public sealed class ModbusDriver(ModbusDriverOptions options, string driverInsta
         }
     }
 
+    private async Task<byte[]> ReadRegisterBlockAsync(
+        IModbusTransport transport, byte fc, ushort address, ushort quantity, CancellationToken ct)
+    {
+        var pdu = new byte[] { fc, (byte)(address >> 8), (byte)(address & 0xFF),
+                               (byte)(quantity >> 8), (byte)(quantity & 0xFF) };
+        var resp = await transport.SendAsync(_options.UnitId, pdu, ct).ConfigureAwait(false);
+        // resp = [fc][byte-count][data...]
+        var data = new byte[resp[1]];
+        Buffer.BlockCopy(resp, 2, data, 0, resp[1]);
+        return data;
+    }
+
+    private async Task<byte[]> ReadRegisterBlockChunkedAsync(
+        IModbusTransport transport, byte fc, ushort address, ushort totalRegs, ushort cap, CancellationToken ct)
+    {
+        var assembled = new byte[totalRegs * 2];
+        ushort done = 0;
+        while (done < totalRegs)
+        {
+            var chunk = (ushort)Math.Min(cap, totalRegs - done);
+            var chunkBytes = await ReadRegisterBlockAsync(transport, fc, (ushort)(address + done), chunk, ct).ConfigureAwait(false);
+            Buffer.BlockCopy(chunkBytes, 0, assembled, done * 2, chunkBytes.Length);
+            done += chunk;
+        }
+        return assembled;
+    }
+
     // ---- IWritable ----
 
     public async Task<IReadOnlyList<WriteResult>> WriteAsync(
@@ -208,6 +246,10 @@ public sealed class ModbusDriver(ModbusDriverOptions options, string driverInsta
                 await WriteOneAsync(transport, tag, w.Value, cancellationToken).ConfigureAwait(false);
                 results[i] = new WriteResult(0u);
             }
+            catch (ModbusException mex)
+            {
+                results[i] = new WriteResult(MapModbusExceptionToStatus(mex.ExceptionCode));
+            }
             catch (Exception)
             {
                 results[i] = new WriteResult(StatusBadInternalError);
@@ -239,8 +281,13 @@ public sealed class ModbusDriver(ModbusDriverOptions options, string driverInsta
                 }
                 else
                 {
-                    // FC 16 (Write Multiple Registers) for 32-bit types
+                    // FC 16 (Write Multiple Registers) for 32-bit types.
                     var qty = (ushort)(bytes.Length / 2);
+                    var writeCap = _options.MaxRegistersPerWrite == 0 ? (ushort)123 : _options.MaxRegistersPerWrite;
+                    if (qty > writeCap)
+                        throw new InvalidOperationException(
+                            $"Write of {qty} registers to {tag.Name} exceeds MaxRegistersPerWrite={writeCap}. " +
+                            $"Split the tag (e.g. shorter StringLength) — partial FC16 chunks would lose atomicity.");
                     var pdu = new byte[6 + 1 + bytes.Length];
                     pdu[0] = 0x10;
                     pdu[1] = (byte)(tag.Address >> 8); pdu[2] = (byte)(tag.Address & 0xFF);
@@ -404,8 +451,8 @@ public sealed class ModbusDriver(ModbusDriverOptions options, string driverInsta
     /// </summary>
     internal static ushort RegisterCount(ModbusTagDefinition tag) => tag.DataType switch
     {
-        ModbusDataType.Int16 or ModbusDataType.UInt16 or ModbusDataType.BitInRegister => 1,
-        ModbusDataType.Int32 or ModbusDataType.UInt32 or ModbusDataType.Float32 => 2,
+        ModbusDataType.Int16 or ModbusDataType.UInt16 or ModbusDataType.BitInRegister or ModbusDataType.Bcd16 => 1,
+        ModbusDataType.Int32 or ModbusDataType.UInt32 or ModbusDataType.Float32 or ModbusDataType.Bcd32 => 2,
         ModbusDataType.Int64 or ModbusDataType.UInt64 or ModbusDataType.Float64 => 4,
         ModbusDataType.String => (ushort)((tag.StringLength + 1) / 2), // 2 chars per register
         _ => throw new InvalidOperationException($"Non-register data type {tag.DataType}"),
@@ -435,6 +482,17 @@ public sealed class ModbusDriver(ModbusDriverOptions options, string driverInsta
         {
             case ModbusDataType.Int16: return BinaryPrimitives.ReadInt16BigEndian(data);
             case ModbusDataType.UInt16: return BinaryPrimitives.ReadUInt16BigEndian(data);
+            case ModbusDataType.Bcd16:
+            {
+                var raw = BinaryPrimitives.ReadUInt16BigEndian(data);
+                return (int)DecodeBcd(raw, nibbles: 4);
+            }
+            case ModbusDataType.Bcd32:
+            {
+                var b = NormalizeWordOrder(data, tag.ByteOrder);
+                var raw = BinaryPrimitives.ReadUInt32BigEndian(b);
+                return (int)DecodeBcd(raw, nibbles: 8);
+            }
             case ModbusDataType.BitInRegister:
             {
                 var raw = BinaryPrimitives.ReadUInt16BigEndian(data);
@@ -472,13 +530,21 @@ public sealed class ModbusDriver(ModbusDriverOptions options, string driverInsta
             }
             case ModbusDataType.String:
             {
-                // ASCII, 2 chars per register, packed high byte = first char.
-                // Respect the caller's StringLength (truncate nul-padded regions).
+                // ASCII, 2 chars per register. HighByteFirst (standard) packs the first char in
+                // the high byte of each register; LowByteFirst (DL205/DL260) packs the first char
+                // in the low byte. Respect StringLength (truncate nul-padded regions).
                 var chars = new char[tag.StringLength];
                 for (var i = 0; i < tag.StringLength; i++)
                 {
-                    var b = data[i];
-                    if (b == 0) { return new string(chars, 0, i); }
+                    var regIdx = i / 2;
+                    var highByte = data[regIdx * 2];
+                    var lowByte  = data[regIdx * 2 + 1];
+                    byte b;
+                    if (tag.StringByteOrder == ModbusStringByteOrder.HighByteFirst)
+                        b = (i % 2 == 0) ? highByte : lowByte;
+                    else
+                        b = (i % 2 == 0) ? lowByte : highByte;
+                    if (b == 0) return new string(chars, 0, i);
                     chars[i] = (char)b;
                 }
                 return new string(chars);
@@ -502,6 +568,21 @@ public sealed class ModbusDriver(ModbusDriverOptions options, string driverInsta
                 var v = Convert.ToUInt16(value);
                 var b = new byte[2]; BinaryPrimitives.WriteUInt16BigEndian(b, v); return b;
             }
+            case ModbusDataType.Bcd16:
+            {
+                var v = Convert.ToUInt32(value);
+                if (v > 9999) throw new OverflowException($"BCD16 value {v} exceeds 4 decimal digits");
+                var raw = (ushort)EncodeBcd(v, nibbles: 4);
+                var b = new byte[2]; BinaryPrimitives.WriteUInt16BigEndian(b, raw); return b;
+            }
+            case ModbusDataType.Bcd32:
+            {
+                var v = Convert.ToUInt32(value);
+                if (v > 99_999_999u) throw new OverflowException($"BCD32 value {v} exceeds 8 decimal digits");
+                var raw = EncodeBcd(v, nibbles: 8);
+                var b = new byte[4]; BinaryPrimitives.WriteUInt32BigEndian(b, raw);
+                return NormalizeWordOrder(b, tag.ByteOrder);
+            }
             case ModbusDataType.Int32:
             {
                 var v = Convert.ToInt32(value);
@@ -543,7 +624,14 @@ public sealed class ModbusDriver(ModbusDriverOptions options, string driverInsta
                 var s = Convert.ToString(value) ?? string.Empty;
                 var regs = (tag.StringLength + 1) / 2;
                 var b = new byte[regs * 2];
-                for (var i = 0; i < tag.StringLength && i < s.Length; i++) b[i] = (byte)s[i];
+                for (var i = 0; i < tag.StringLength && i < s.Length; i++)
+                {
+                    var regIdx = i / 2;
+                    var destIdx = tag.StringByteOrder == ModbusStringByteOrder.HighByteFirst
+                        ? (i % 2 == 0 ? regIdx * 2 : regIdx * 2 + 1)
+                        : (i % 2 == 0 ? regIdx * 2 + 1 : regIdx * 2);
+                    b[destIdx] = (byte)s[i];
+                }
                 // remaining bytes stay 0 — nul-padded per PLC convention
                 return b;
             }
@@ -564,15 +652,77 @@ public sealed class ModbusDriver(ModbusDriverOptions options, string driverInsta
         ModbusDataType.Float32 => DriverDataType.Float32,
         ModbusDataType.Float64 => DriverDataType.Float64,
         ModbusDataType.String => DriverDataType.String,
+        ModbusDataType.Bcd16 or ModbusDataType.Bcd32 => DriverDataType.Int32,
         _ => DriverDataType.Int32,
     };
 
+    /// <summary>
+    ///     Decode an N-nibble binary-coded-decimal value. Each nibble of <paramref name="raw"/>
+    ///     encodes one decimal digit (most-significant nibble first). Rejects nibbles &gt; 9 —
+    ///     the hardware sometimes produces garbage during transitions and silent non-BCD reads
+    ///     would quietly corrupt the caller's data.
+    /// </summary>
+    internal static uint DecodeBcd(uint raw, int nibbles)
+    {
+        uint result = 0;
+        for (var i = nibbles - 1; i >= 0; i--)
+        {
+            var digit = (raw >> (i * 4)) & 0xF;
+            if (digit > 9)
+                throw new InvalidDataException(
+                    $"Non-BCD nibble 0x{digit:X} at position {i} of raw=0x{raw:X}");
+            result = result * 10 + digit;
+        }
+        return result;
+    }
+
+    /// <summary>
+    ///     Encode a decimal value as N-nibble BCD. Caller is responsible for range-checking
+    ///     against the nibble capacity (10^nibbles - 1).
+    /// </summary>
+    internal static uint EncodeBcd(uint value, int nibbles)
+    {
+        uint result = 0;
+        for (var i = 0; i < nibbles; i++)
+        {
+            var digit = value % 10;
+            result |= digit << (i * 4);
+            value /= 10;
+        }
+        return result;
+    }
+
     private IModbusTransport RequireTransport() =>
         _transport ?? throw new InvalidOperationException("ModbusDriver not initialized");
 
     private const uint StatusBadInternalError = 0x80020000u;
     private const uint StatusBadNodeIdUnknown = 0x80340000u;
     private const uint StatusBadNotWritable = 0x803B0000u;
+    private const uint StatusBadOutOfRange = 0x803C0000u;
+    private const uint StatusBadNotSupported = 0x803D0000u;
+    private const uint StatusBadDeviceFailure = 0x80550000u;
+    private const uint StatusBadCommunicationError = 0x80050000u;
+
+    /// <summary>
+    ///     Map a server-returned Modbus exception code to the most informative OPC UA
+    ///     StatusCode. Keeps the driver's outward-facing status surface aligned with what a
+    ///     Modbus engineer would expect when reading the spec: exception 02 (Illegal Data
+    ///     Address) surfaces as BadOutOfRange so clients can distinguish "tag wrong" from
+    ///     generic BadInternalError, exception 04 (Server Failure) as BadDeviceFailure so
+    ///     operators see a CPU-mode problem rather than a driver bug, etc. Per
+    ///     <c>docs/v2/dl205.md</c>, DL205/DL260 returns only codes 01-04 — no proprietary
+    ///     extensions.
+    /// </summary>
+    internal static uint MapModbusExceptionToStatus(byte exceptionCode) => exceptionCode switch
+    {
+        0x01 => StatusBadNotSupported,     // Illegal Function — FC not in supported list
+        0x02 => StatusBadOutOfRange,       // Illegal Data Address — register outside mapped range
+        0x03 => StatusBadOutOfRange,       // Illegal Data Value — quantity over per-FC cap
+        0x04 => StatusBadDeviceFailure,    // Server Failure — CPU in PROGRAM mode during protected write
+        0x05 or 0x06 => StatusBadDeviceFailure, // Acknowledge / Server Busy — long-running op / busy
+        0x0A or 0x0B => StatusBadCommunicationError, // Gateway path unavailable / target failed to respond
+        _ => StatusBadInternalError,
+    };
 
     public void Dispose() => DisposeAsync().AsTask().GetAwaiter().GetResult();
     public async ValueTask DisposeAsync()

src/ZB.MOM.WW.OtOpcUa.Driver.Modbus/ModbusDriverOptions.cs

@@ -25,6 +25,37 @@ public sealed class ModbusDriverOptions
     ///     <see cref="IHostConnectivityProbe"/>.
     /// </summary>
     public ModbusProbeOptions Probe { get; init; } = new();
+
+    /// <summary>
+    ///     Maximum registers per FC03 (Read Holding Registers) / FC04 (Read Input Registers)
+    ///     transaction. Modbus-TCP spec allows 125; many device families impose lower caps:
+    ///     AutomationDirect DL205/DL260 cap at <c>128</c>, Mitsubishi Q/FX3U cap at <c>64</c>,
+    ///     Omron CJ/CS cap at <c>125</c>. Set to the lowest cap across the devices this driver
+    ///     instance talks to; the driver auto-chunks larger reads into consecutive requests.
+    ///     Default <c>125</c> — the spec maximum, safe against any conforming server. Setting
+    ///     to <c>0</c> disables the cap (discouraged — the spec upper bound still applies).
+    /// </summary>
+    public ushort MaxRegistersPerRead { get; init; } = 125;
+
+    /// <summary>
+    ///     Maximum registers per FC16 (Write Multiple Registers) transaction. Spec maximum is
+    ///     <c>123</c>; DL205/DL260 cap at <c>100</c>. Matching caller-vs-device semantics:
+    ///     exceeding the cap currently throws (writes aren't auto-chunked because a partial
+    ///     write across two FC16 calls is no longer atomic — caller must explicitly opt in
+    ///     by shortening the tag's <c>StringLength</c> or splitting it into multiple tags).
+    /// </summary>
+    public ushort MaxRegistersPerWrite { get; init; } = 123;
+
+    /// <summary>
+    ///     When <c>true</c> (default) the built-in <see cref="ModbusTcpTransport"/> detects
+    ///     mid-transaction socket failures (<see cref="System.IO.EndOfStreamException"/>,
+    ///     <see cref="System.Net.Sockets.SocketException"/>) and transparently reconnects +
+    ///     retries the PDU exactly once. Required for DL205/DL260 because the H2-ECOM100
+    ///     does not send TCP keepalives — intermediate NAT / firewall devices silently close
+    ///     idle sockets and the first send after the drop would otherwise surface as a
+    ///     connection error to the caller even though the PLC is up.
+    /// </summary>
+    public bool AutoReconnect { get; init; } = true;
 }
 
 public sealed class ModbusProbeOptions
@@ -55,6 +86,20 @@ public sealed class ModbusProbeOptions
 /// <param name="ByteOrder">Word ordering for multi-register types. Ignored for Bool / Int16 / UInt16 / BitInRegister / String.</param>
 /// <param name="BitIndex">For <c>DataType = BitInRegister</c>: which bit of the holding register (0-15, LSB-first).</param>
 /// <param name="StringLength">For <c>DataType = String</c>: number of ASCII characters (2 per register, rounded up).</param>
+/// <param name="StringByteOrder">
+///     Per-register byte order for <c>DataType = String</c>. Standard Modbus packs the first
+///     character in the high byte (<see cref="ModbusStringByteOrder.HighByteFirst"/>).
+///     AutomationDirect DirectLOGIC (DL205/DL260) and a few legacy families pack the first
+///     character in the low byte instead — see <c>docs/v2/dl205.md</c> §strings.
+/// </param>
+/// <param name="WriteIdempotent">
+///     Per <c>docs/v2/plan.md</c> decisions #44, #45, #143 — flag a tag as safe to replay on
+///     write timeout / failure. Default <c>false</c>; writes do not auto-retry. Safe candidates:
+///     holding-register set-points for analog values and configuration registers where the same
+///     value can be written again without side-effects. Unsafe: coils that drive edge-triggered
+///     actions (pulse outputs), counter-increment addresses on PLCs that treat writes as deltas,
+///     any BCD / counter register where repeat-writes advance state.
+/// </param>
 public sealed record ModbusTagDefinition(
     string Name,
     ModbusRegion Region,
@@ -63,7 +108,9 @@ public sealed record ModbusTagDefinition(
     bool Writable = true,
     ModbusByteOrder ByteOrder = ModbusByteOrder.BigEndian,
     byte BitIndex = 0,
-    ushort StringLength = 0);
+    ushort StringLength = 0,
+    ModbusStringByteOrder StringByteOrder = ModbusStringByteOrder.HighByteFirst,
+    bool WriteIdempotent = false);
 
 public enum ModbusRegion { Coils, DiscreteInputs, InputRegisters, HoldingRegisters }
 
@@ -82,6 +129,18 @@ public enum ModbusDataType
     BitInRegister,
     /// <summary>ASCII string packed 2 chars per register, <see cref="ModbusTagDefinition.StringLength"/> characters long.</summary>
     String,
+    /// <summary>
+    ///     16-bit binary-coded decimal. Each nibble encodes one decimal digit (0-9). Register
+    ///     value <c>0x1234</c> decodes as decimal <c>1234</c> — NOT binary <c>0x04D2 = 4660</c>.
+    ///     DL205/DL260 and several Mitsubishi / Omron families store timers, counters, and
+    ///     operator-facing numerics as BCD by default.
+    /// </summary>
+    Bcd16,
+    /// <summary>
+    ///     32-bit (two-register) BCD. Decodes 8 decimal digits. Word ordering follows
+    ///     <see cref="ModbusTagDefinition.ByteOrder"/> the same way <see cref="Int32"/> does.
+    /// </summary>
+    Bcd32,
 }
 
 /// <summary>
@@ -95,3 +154,17 @@ public enum ModbusByteOrder
     BigEndian,
     WordSwap,
 }
+
+/// <summary>
+///     Per-register byte order for ASCII strings packed 2 chars per register. Standard Modbus
+///     convention is <see cref="HighByteFirst"/> — the first character of each pair occupies
+///     the high byte of the register. AutomationDirect DirectLOGIC (DL205, DL260, DL350) and a
+///     handful of legacy controllers pack <see cref="LowByteFirst"/>, which inverts that within
+///     each register. Word ordering across multiple registers is always ascending address for
+///     strings — only the byte order inside each register flips.
+/// </summary>
+public enum ModbusStringByteOrder
+{
+    HighByteFirst,
+    LowByteFirst,
+}

src/ZB.MOM.WW.OtOpcUa.Driver.Modbus/ModbusTcpTransport.cs

@@ -8,33 +8,83 @@ namespace ZB.MOM.WW.OtOpcUa.Driver.Modbus;
 ///     support concurrent transactions, but the single-flight model keeps the wire trace
 ///     easy to diagnose and avoids interleaved-response correlation bugs.
 /// </summary>
+/// <remarks>
+///     <para>
+///         Survives mid-transaction socket drops: when a send/read fails with a socket-level
+///         error (<see cref="IOException"/>, <see cref="SocketException"/>, <see cref="EndOfStreamException"/>)
+///         the transport disposes the dead socket, reconnects, and retries the PDU exactly
+///         once. Deliberately limited to a single retry — further failures bubble up so the
+///         driver's health surface reflects the real state instead of masking a dead PLC.
+///     </para>
+///     <para>
+///         Why this matters for DL205/DL260: the AutomationDirect H2-ECOM100 does NOT send
+///         TCP keepalives per <c>docs/v2/dl205.md</c> §behavioral-oddities, so any NAT/firewall
+///         between the gateway and PLC can silently close an idle socket after 2-5 minutes.
+///         Also enables OS-level <c>SO_KEEPALIVE</c> so the driver's own side detects a stuck
+///         socket in reasonable time even when the application is mostly idle.
+///     </para>
+/// </remarks>
 public sealed class ModbusTcpTransport : IModbusTransport
 {
     private readonly string _host;
     private readonly int _port;
     private readonly TimeSpan _timeout;
+    private readonly bool _autoReconnect;
     private readonly SemaphoreSlim _gate = new(1, 1);
     private TcpClient? _client;
     private NetworkStream? _stream;
     private ushort _nextTx;
     private bool _disposed;
 
-    public ModbusTcpTransport(string host, int port, TimeSpan timeout)
+    public ModbusTcpTransport(string host, int port, TimeSpan timeout, bool autoReconnect = true)
     {
         _host = host;
         _port = port;
         _timeout = timeout;
+        _autoReconnect = autoReconnect;
     }
 
     public async Task ConnectAsync(CancellationToken ct)
     {
-        _client = new TcpClient();
+        // Resolve the host explicitly + prefer IPv4. .NET's TcpClient default-constructor is
+        // dual-stack (IPv6 first, fallback to IPv4) — but most Modbus TCP devices (PLCs and
+        // simulators like pymodbus) bind 0.0.0.0 only, so the IPv6 attempt times out and we
+        // burn the entire ConnectAsync budget before even trying IPv4. Resolving first +
+        // dialing the IPv4 address directly sidesteps that.
+        var addresses = await System.Net.Dns.GetHostAddressesAsync(_host, ct).ConfigureAwait(false);
+        var ipv4 = System.Linq.Enumerable.FirstOrDefault(addresses,
+            a => a.AddressFamily == System.Net.Sockets.AddressFamily.InterNetwork);
+        var target = ipv4 ?? (addresses.Length > 0 ? addresses[0] : System.Net.IPAddress.Loopback);
+
+        _client = new TcpClient(target.AddressFamily);
+        EnableKeepAlive(_client);
+
         using var cts = CancellationTokenSource.CreateLinkedTokenSource(ct);
         cts.CancelAfter(_timeout);
-        await _client.ConnectAsync(_host, _port, cts.Token).ConfigureAwait(false);
+        await _client.ConnectAsync(target, _port, cts.Token).ConfigureAwait(false);
         _stream = _client.GetStream();
     }
 
+    /// <summary>
+    ///     Enable SO_KEEPALIVE with aggressive probe timing. DL205/DL260 doesn't send keepalives
+    ///     itself; having the OS probe the socket every ~30s lets the driver notice a dead PLC
+    ///     or broken NAT path long before the default 2-hour Windows idle timeout fires.
+    ///     Non-fatal if the underlying OS rejects the option (some older Linux / container
+    ///     sandboxes don't expose the fine-grained timing levers — the driver still works,
+    ///     application-level probe still detects problems).
+    /// </summary>
+    private static void EnableKeepAlive(TcpClient client)
+    {
+        try
+        {
+            client.Client.SetSocketOption(SocketOptionLevel.Socket, SocketOptionName.KeepAlive, true);
+            client.Client.SetSocketOption(SocketOptionLevel.Tcp, SocketOptionName.TcpKeepAliveTime, 30);
+            client.Client.SetSocketOption(SocketOptionLevel.Tcp, SocketOptionName.TcpKeepAliveInterval, 10);
+            client.Client.SetSocketOption(SocketOptionLevel.Tcp, SocketOptionName.TcpKeepAliveRetryCount, 3);
+        }
+        catch { /* best-effort; older OSes may not expose the granular knobs */ }
+    }
+
     public async Task<byte[]> SendAsync(byte unitId, byte[] pdu, CancellationToken ct)
     {
         if (_disposed) throw new ObjectDisposedException(nameof(ModbusTcpTransport));
@@ -43,6 +93,28 @@ public sealed class ModbusTcpTransport : IModbusTransport
         await _gate.WaitAsync(ct).ConfigureAwait(false);
         try
         {
+            try
+            {
+                return await SendOnceAsync(unitId, pdu, ct).ConfigureAwait(false);
+            }
+            catch (Exception ex) when (_autoReconnect && IsSocketLevelFailure(ex))
+            {
+                // Mid-transaction drop: tear down the dead socket, reconnect, resend. Single
+                // retry — if it fails again, let it propagate so health/status reflect reality.
+                await TearDownAsync().ConfigureAwait(false);
+                await ConnectAsync(ct).ConfigureAwait(false);
+                return await SendOnceAsync(unitId, pdu, ct).ConfigureAwait(false);
+            }
+        }
+        finally
+        {
+            _gate.Release();
+        }
+    }
+
+    private async Task<byte[]> SendOnceAsync(byte unitId, byte[] pdu, CancellationToken ct)
+    {
+        if (_stream is null) throw new InvalidOperationException("Transport not connected");
         var txId = ++_nextTx;
 
         // MBAP: [TxId(2)][Proto=0(2)][Length(2)][UnitId(1)] + PDU
@@ -81,10 +153,25 @@ public sealed class ModbusTcpTransport : IModbusTransport
 
         return respPdu;
     }
-        finally
+
+    /// <summary>
+    ///     Distinguish socket-layer failures (eligible for reconnect-and-retry) from
+    ///     protocol-layer failures (must propagate — retrying the same PDU won't help if the
+    ///     PLC just returned exception 02 Illegal Data Address).
+    /// </summary>
+    private static bool IsSocketLevelFailure(Exception ex) =>
+        ex is EndOfStreamException
+        || ex is IOException
+        || ex is SocketException
+        || ex is ObjectDisposedException;
+
+    private async Task TearDownAsync()
     {
-            _gate.Release();
-        }
+        try { if (_stream is not null) await _stream.DisposeAsync().ConfigureAwait(false); }
+        catch { /* best-effort */ }
+        _stream = null;
+        try { _client?.Dispose(); } catch { }
+        _client = null;
     }
 
     private static async Task ReadExactlyAsync(Stream s, byte[] buf, CancellationToken ct)

src/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient/OpcUaClientDriverOptions.cs

@@ -0,0 +1,180 @@
+namespace ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient;
+
+/// <summary>
+///     OPC UA Client (gateway) driver configuration. Bound from <c>DriverConfig</c> JSON at
+///     driver-host registration time. Models the settings documented in
+///     <c>docs/v2/driver-specs.md</c> §8.
+/// </summary>
+/// <remarks>
+///     This driver connects to a REMOTE OPC UA server and re-exposes its address space
+///     through the local OtOpcUa server — the opposite direction from the usual "server
+///     exposes PLC data" flow. Tier A (pure managed, OPC Foundation reference SDK); universal
+///     protections cover it.
+/// </remarks>
+public sealed class OpcUaClientDriverOptions
+{
+    /// <summary>
+    ///     Remote OPC UA endpoint URL, e.g. <c>opc.tcp://plc.internal:4840</c>. Convenience
+    ///     shortcut for a single-endpoint deployment — equivalent to setting
+    ///     <see cref="EndpointUrls"/> to a list with this one URL. When both are provided,
+    ///     the list wins and <see cref="EndpointUrl"/> is ignored.
+    /// </summary>
+    public string EndpointUrl { get; init; } = "opc.tcp://localhost:4840";
+
+    /// <summary>
+    ///     Ordered list of candidate endpoint URLs for failover. The driver tries each in
+    ///     order at <see cref="OpcUaClientDriver.InitializeAsync"/> and on session drop;
+    ///     the first URL that successfully connects wins. Typical use-case: an OPC UA server
+    ///     pair running in hot-standby (primary 4840 + backup 4841) where either can serve
+    ///     the same address space. Leave unset (or empty) to use <see cref="EndpointUrl"/>
+    ///     as a single-URL shortcut.
+    /// </summary>
+    public IReadOnlyList<string> EndpointUrls { get; init; } = [];
+
+    /// <summary>
+    ///     Per-endpoint connect-attempt timeout during the failover sweep. Short enough that
+    ///     cycling through several dead servers doesn't blow the overall init budget, long
+    ///     enough to tolerate a slow TLS handshake on a healthy server. Applied independently
+    ///     of <see cref="Timeout"/> which governs steady-state operations.
+    /// </summary>
+    public TimeSpan PerEndpointConnectTimeout { get; init; } = TimeSpan.FromSeconds(3);
+
+    /// <summary>
+    ///     Security policy to require when selecting an endpoint. Either a
+    ///     <see cref="OpcUaSecurityPolicy"/> enum constant or a free-form string (for
+    ///     forward-compatibility with future OPC UA policies not yet in the enum).
+    ///     Matched against <c>EndpointDescription.SecurityPolicyUri</c> suffix — the driver
+    ///     connects to the first endpoint whose policy name matches AND whose mode matches
+    ///     <see cref="SecurityMode"/>. When set to <see cref="OpcUaSecurityPolicy.None"/>
+    ///     the driver picks any unsecured endpoint regardless of policy string.
+    /// </summary>
+    public OpcUaSecurityPolicy SecurityPolicy { get; init; } = OpcUaSecurityPolicy.None;
+
+    /// <summary>Security mode.</summary>
+    public OpcUaSecurityMode SecurityMode { get; init; } = OpcUaSecurityMode.None;
+
+    /// <summary>Authentication type.</summary>
+    public OpcUaAuthType AuthType { get; init; } = OpcUaAuthType.Anonymous;
+
+    /// <summary>User name (required only for <see cref="OpcUaAuthType.Username"/>).</summary>
+    public string? Username { get; init; }
+
+    /// <summary>Password (required only for <see cref="OpcUaAuthType.Username"/>).</summary>
+    public string? Password { get; init; }
+
+    /// <summary>
+    ///     Filesystem path to the user-identity certificate (PFX/PEM). Required when
+    ///     <see cref="AuthType"/> is <see cref="OpcUaAuthType.Certificate"/>. The driver
+    ///     loads the cert + private key, which the remote server validates against its
+    ///     <c>TrustedUserCertificates</c> store to authenticate the session's user token.
+    ///     Leave unset to use the driver's application-instance certificate as the user
+    ///     token (not typical — most deployments have a separate user cert).
+    /// </summary>
+    public string? UserCertificatePath { get; init; }
+
+    /// <summary>
+    ///     Optional password that unlocks <see cref="UserCertificatePath"/> when the PFX is
+    ///     protected. PEM files generally have their password on the adjacent key file; this
+    ///     knob only applies to password-locked PFX.
+    /// </summary>
+    public string? UserCertificatePassword { get; init; }
+
+    /// <summary>Server-negotiated session timeout. Default 120s per driver-specs.md §8.</summary>
+    public TimeSpan SessionTimeout { get; init; } = TimeSpan.FromSeconds(120);
+
+    /// <summary>Client-side keep-alive interval.</summary>
+    public TimeSpan KeepAliveInterval { get; init; } = TimeSpan.FromSeconds(5);
+
+    /// <summary>Initial reconnect delay after a session drop.</summary>
+    public TimeSpan ReconnectPeriod { get; init; } = TimeSpan.FromSeconds(5);
+
+    /// <summary>
+    ///     When <c>true</c>, the driver accepts any self-signed / untrusted server certificate.
+    ///     Dev-only — must be <c>false</c> in production so MITM attacks against the opc.tcp
+    ///     channel fail closed.
+    /// </summary>
+    public bool AutoAcceptCertificates { get; init; } = false;
+
+    /// <summary>
+    ///     Application URI the driver reports during session creation. Must match the
+    ///     subject-alt-name on the client certificate if one is used, which is why it's a
+    ///     config knob rather than hard-coded.
+    /// </summary>
+    public string ApplicationUri { get; init; } = "urn:localhost:OtOpcUa:GatewayClient";
+
+    /// <summary>
+    ///     Friendly name sent to the remote server for diagnostics. Shows up in the remote
+    ///     server's session-list so operators can identify which gateway instance is calling.
+    /// </summary>
+    public string SessionName { get; init; } = "OtOpcUa-Gateway";
+
+    /// <summary>Connect + per-operation timeout.</summary>
+    public TimeSpan Timeout { get; init; } = TimeSpan.FromSeconds(10);
+
+    /// <summary>
+    ///     Root NodeId to mirror. Default <c>null</c> = <c>ObjectsFolder</c> (i=85). Set to
+    ///     a scoped root to restrict the address space the driver exposes locally — useful
+    ///     when the remote server has tens of thousands of nodes and only a subset is
+    ///     needed downstream.
+    /// </summary>
+    public string? BrowseRoot { get; init; }
+
+    /// <summary>
+    ///     Cap on total nodes discovered during <c>DiscoverAsync</c>. Default 10_000 —
+    ///     bounds memory on runaway remote servers without being so low that normal
+    ///     deployments hit it. When the cap is reached discovery stops and a warning is
+    ///     written to the driver health surface; the partially-discovered tree is still
+    ///     projected into the local address space.
+    /// </summary>
+    public int MaxDiscoveredNodes { get; init; } = 10_000;
+
+    /// <summary>
+    ///     Max hierarchical depth of the browse. Default 10 — deep enough for realistic
+    ///     OPC UA information models, shallow enough that cyclic graphs can't spin the
+    ///     browse forever.
+    /// </summary>
+    public int MaxBrowseDepth { get; init; } = 10;
+}
+
+/// <summary>OPC UA message security mode.</summary>
+public enum OpcUaSecurityMode
+{
+    None,
+    Sign,
+    SignAndEncrypt,
+}
+
+/// <summary>
+///     OPC UA security policies recognized by the driver. Maps to the standard
+///     <c>http://opcfoundation.org/UA/SecurityPolicy#</c> URI suffixes the SDK uses for
+///     endpoint matching.
+/// </summary>
+/// <remarks>
+///     <see cref="Basic128Rsa15"/> and <see cref="Basic256"/> are <b>deprecated</b> per OPC UA
+///     spec v1.04 — they remain in the enum only for brownfield interop with older servers.
+///     Prefer <see cref="Basic256Sha256"/>, <see cref="Aes128_Sha256_RsaOaep"/>, or
+///     <see cref="Aes256_Sha256_RsaPss"/> for new deployments.
+/// </remarks>
+public enum OpcUaSecurityPolicy
+{
+    /// <summary>No security. Unsigned, unencrypted wire.</summary>
+    None,
+    /// <summary>Deprecated (OPC UA 1.04). Retained for legacy server interop.</summary>
+    Basic128Rsa15,
+    /// <summary>Deprecated (OPC UA 1.04). Retained for legacy server interop.</summary>
+    Basic256,
+    /// <summary>Recommended baseline for current deployments.</summary>
+    Basic256Sha256,
+    /// <summary>Current OPC UA policy; AES-128 + SHA-256 + RSA-OAEP.</summary>
+    Aes128_Sha256_RsaOaep,
+    /// <summary>Current OPC UA policy; AES-256 + SHA-256 + RSA-PSS.</summary>
+    Aes256_Sha256_RsaPss,
+}
+
+/// <summary>User authentication type sent to the remote server.</summary>
+public enum OpcUaAuthType
+{
+    Anonymous,
+    Username,
+    Certificate,
+}

src/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.csproj

@@ -0,0 +1,28 @@
+<Project Sdk="Microsoft.NET.Sdk">
+
+    <PropertyGroup>
+        <TargetFramework>net10.0</TargetFramework>
+        <Nullable>enable</Nullable>
+        <ImplicitUsings>enable</ImplicitUsings>
+        <LangVersion>latest</LangVersion>
+        <TreatWarningsAsErrors>true</TreatWarningsAsErrors>
+        <GenerateDocumentationFile>true</GenerateDocumentationFile>
+        <NoWarn>$(NoWarn);CS1591</NoWarn>
+        <RootNamespace>ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient</RootNamespace>
+        <AssemblyName>ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient</AssemblyName>
+    </PropertyGroup>
+
+    <ItemGroup>
+        <ProjectReference Include="..\ZB.MOM.WW.OtOpcUa.Core.Abstractions\ZB.MOM.WW.OtOpcUa.Core.Abstractions.csproj"/>
+    </ItemGroup>
+
+    <ItemGroup>
+        <PackageReference Include="OPCFoundation.NetStandard.Opc.Ua.Client" Version="1.5.378.106"/>
+        <PackageReference Include="OPCFoundation.NetStandard.Opc.Ua.Configuration" Version="1.5.378.106"/>
+    </ItemGroup>
+
+    <ItemGroup>
+        <InternalsVisibleTo Include="ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.Tests"/>
+    </ItemGroup>
+
+</Project>

src/ZB.MOM.WW.OtOpcUa.Driver.S7/S7AddressParser.cs

@@ -0,0 +1,216 @@
+namespace ZB.MOM.WW.OtOpcUa.Driver.S7;
+
+/// <summary>
+///     Siemens S7 memory area. The driver's tag-address parser maps every S7 tag string into
+///     exactly one of these + an offset. Values match the on-wire S7 area codes only
+///     incidentally — S7.Net uses its own <c>DataType</c> enum (<c>DataBlock</c>, <c>Memory</c>,
+///     <c>Input</c>, <c>Output</c>, <c>Timer</c>, <c>Counter</c>) so the adapter layer translates.
+/// </summary>
+public enum S7Area
+{
+    DataBlock,
+    Memory,  // M (Merker / marker byte)
+    Input,   // I (process-image input)
+    Output,  // Q (process-image output)
+    Timer,
+    Counter,
+}
+
+/// <summary>
+///     Access width for a DB / M / I / Q address. Timers and counters are always 16-bit
+///     opaque (not user-addressable via size suffixes).
+/// </summary>
+public enum S7Size
+{
+    Bit,     // X
+    Byte,    // B
+    Word,    // W — 16-bit
+    DWord,   // D — 32-bit
+}
+
+/// <summary>
+///     Parsed form of an S7 tag-address string. Produced by <see cref="S7AddressParser.Parse"/>.
+/// </summary>
+/// <param name="Area">Memory area (DB, M, I, Q, T, C).</param>
+/// <param name="DbNumber">Data block number; only meaningful when <paramref name="Area"/> is <see cref="S7Area.DataBlock"/>.</param>
+/// <param name="Size">Access width. Always <see cref="S7Size.Word"/> for Timer and Counter.</param>
+/// <param name="ByteOffset">Byte offset into the area (for DB/M/I/Q) or the timer/counter number.</param>
+/// <param name="BitOffset">Bit position 0-7 when <paramref name="Size"/> is <see cref="S7Size.Bit"/>; 0 otherwise.</param>
+public readonly record struct S7ParsedAddress(
+    S7Area Area,
+    int DbNumber,
+    S7Size Size,
+    int ByteOffset,
+    int BitOffset);
+
+/// <summary>
+///     Parses Siemens S7 address strings into <see cref="S7ParsedAddress"/>. Accepts the
+///     Siemens TIA-Portal / STEP 7 Classic syntax documented in <c>docs/v2/driver-specs.md</c> §5:
+///     <list type="bullet">
+///         <item><c>DB{n}.DB{X|B|W|D}{offset}[.bit]</c> — e.g. <c>DB1.DBX0.0</c>, <c>DB1.DBW0</c>, <c>DB1.DBD4</c></item>
+///         <item><c>M{B|W|D}{offset}</c> or <c>M{offset}.{bit}</c> — e.g. <c>MB0</c>, <c>MW0</c>, <c>MD4</c>, <c>M0.0</c></item>
+///         <item><c>I{B|W|D}{offset}</c> or <c>I{offset}.{bit}</c> — e.g. <c>IB0</c>, <c>IW0</c>, <c>ID0</c>, <c>I0.0</c></item>
+///         <item><c>Q{B|W|D}{offset}</c> or <c>Q{offset}.{bit}</c> — e.g. <c>QB0</c>, <c>QW0</c>, <c>QD0</c>, <c>Q0.0</c></item>
+///         <item><c>T{n}</c> — e.g. <c>T0</c>, <c>T15</c></item>
+///         <item><c>C{n}</c> — e.g. <c>C0</c>, <c>C10</c></item>
+///     </list>
+///     Grammar is case-insensitive. Leading/trailing whitespace tolerated. Bit specifiers
+///     must be 0-7; byte offsets must be non-negative; DB numbers must be &gt;= 1.
+/// </summary>
+/// <remarks>
+///     Parse is deliberately strict — the parser rejects syntactic garbage up-front so a bad
+///     tag config fails at driver init time instead of surfacing as a misleading
+///     <c>BadInternalError</c> on every Read against that tag.
+/// </remarks>
+public static class S7AddressParser
+{
+    /// <summary>
+    ///     Parse an S7 address. Throws <see cref="FormatException"/> on any syntax error with
+    ///     the offending input echoed in the message so operators can correlate to the tag
+    ///     config that produced the fault.
+    /// </summary>
+    public static S7ParsedAddress Parse(string address)
+    {
+        if (string.IsNullOrWhiteSpace(address))
+            throw new FormatException("S7 address must not be empty");
+        var s = address.Trim().ToUpperInvariant();
+
+        // --- DB{n}.DB{X|B|W|D}{offset}[.bit] ---
+        if (s.StartsWith("DB") && TryParseDataBlock(s, out var dbResult))
+            return dbResult;
+
+        if (s.Length < 2)
+            throw new FormatException($"S7 address '{address}' is too short to parse");
+
+        var areaChar = s[0];
+        var rest = s.Substring(1);
+
+        switch (areaChar)
+        {
+            case 'M': return ParseMIQ(S7Area.Memory, rest, address);
+            case 'I': return ParseMIQ(S7Area.Input, rest, address);
+            case 'Q': return ParseMIQ(S7Area.Output, rest, address);
+            case 'T': return ParseTimerOrCounter(S7Area.Timer, rest, address);
+            case 'C': return ParseTimerOrCounter(S7Area.Counter, rest, address);
+            default:
+                throw new FormatException($"S7 address '{address}' starts with unknown area '{areaChar}' (expected DB/M/I/Q/T/C)");
+        }
+    }
+
+    /// <summary>
+    ///     Try-parse variant for callers that can't afford an exception on bad input (e.g.
+    ///     config validation pages in the Admin UI). Returns <c>false</c> for any input that
+    ///     would throw from <see cref="Parse"/>.
+    /// </summary>
+    public static bool TryParse(string address, out S7ParsedAddress result)
+    {
+        try
+        {
+            result = Parse(address);
+            return true;
+        }
+        catch (FormatException)
+        {
+            result = default;
+            return false;
+        }
+    }
+
+    private static bool TryParseDataBlock(string s, out S7ParsedAddress result)
+    {
+        result = default;
+        // Split on first '.': left side must be DB{n}, right side DB{X|B|W|D}{offset}[.bit]
+        var dot = s.IndexOf('.');
+        if (dot < 0) return false;
+        var head = s.Substring(0, dot);    // DB{n}
+        var tail = s.Substring(dot + 1);   // DB{X|B|W|D}{offset}[.bit]
+
+        if (head.Length < 3) return false;
+        if (!int.TryParse(head.AsSpan(2), out var dbNumber) || dbNumber < 1)
+            throw new FormatException($"S7 DB number in '{s}' must be a positive integer");
+
+        if (!tail.StartsWith("DB") || tail.Length < 4)
+            throw new FormatException($"S7 DB address tail '{tail}' must start with DB{{X|B|W|D}}");
+
+        var sizeChar = tail[2];
+        var offsetStart = 3;
+        var size = sizeChar switch
+        {
+            'X' => S7Size.Bit,
+            'B' => S7Size.Byte,
+            'W' => S7Size.Word,
+            'D' => S7Size.DWord,
+            _ => throw new FormatException($"S7 DB size '{sizeChar}' in '{s}' must be X/B/W/D"),
+        };
+
+        var (byteOffset, bitOffset) = ParseOffsetAndOptionalBit(tail, offsetStart, size, s);
+        result = new S7ParsedAddress(S7Area.DataBlock, dbNumber, size, byteOffset, bitOffset);
+        return true;
+    }
+
+    private static S7ParsedAddress ParseMIQ(S7Area area, string rest, string original)
+    {
+        if (rest.Length == 0)
+            throw new FormatException($"S7 address '{original}' has no offset");
+
+        var first = rest[0];
+        S7Size size;
+        int offsetStart;
+        switch (first)
+        {
+            case 'B': size = S7Size.Byte;  offsetStart = 1; break;
+            case 'W': size = S7Size.Word;  offsetStart = 1; break;
+            case 'D': size = S7Size.DWord; offsetStart = 1; break;
+            default:
+                // No size prefix => bit-level address requires explicit .bit. Size stays Bit;
+                // ParseOffsetAndOptionalBit will demand the dot.
+                size = S7Size.Bit;
+                offsetStart = 0;
+                break;
+        }
+
+        var (byteOffset, bitOffset) = ParseOffsetAndOptionalBit(rest, offsetStart, size, original);
+        return new S7ParsedAddress(area, DbNumber: 0, size, byteOffset, bitOffset);
+    }
+
+    private static S7ParsedAddress ParseTimerOrCounter(S7Area area, string rest, string original)
+    {
+        if (rest.Length == 0)
+            throw new FormatException($"S7 address '{original}' has no {area} number");
+        if (!int.TryParse(rest, out var number) || number < 0)
+            throw new FormatException($"S7 {area} number in '{original}' must be a non-negative integer");
+        return new S7ParsedAddress(area, DbNumber: 0, S7Size.Word, number, BitOffset: 0);
+    }
+
+    private static (int byteOffset, int bitOffset) ParseOffsetAndOptionalBit(
+        string s, int start, S7Size size, string original)
+    {
+        var offsetEnd = start;
+        while (offsetEnd < s.Length && s[offsetEnd] >= '0' && s[offsetEnd] <= '9')
+            offsetEnd++;
+        if (offsetEnd == start)
+            throw new FormatException($"S7 address '{original}' has no byte-offset digits");
+
+        if (!int.TryParse(s.AsSpan(start, offsetEnd - start), out var byteOffset) || byteOffset < 0)
+            throw new FormatException($"S7 byte offset in '{original}' must be non-negative");
+
+        // No bit-suffix: done unless size is Bit with no prefix, which requires one.
+        if (offsetEnd == s.Length)
+        {
+            if (size == S7Size.Bit)
+                throw new FormatException($"S7 address '{original}' needs a .{{bit}} suffix for bit access");
+            return (byteOffset, 0);
+        }
+
+        if (s[offsetEnd] != '.')
+            throw new FormatException($"S7 address '{original}' has unexpected character after offset");
+
+        if (size != S7Size.Bit)
+            throw new FormatException($"S7 address '{original}' has a bit suffix but the size is {size} — bit access needs X (DB) or no size prefix (M/I/Q)");
+
+        if (!int.TryParse(s.AsSpan(offsetEnd + 1), out var bitOffset) || bitOffset is < 0 or > 7)
+            throw new FormatException($"S7 bit offset in '{original}' must be 0-7");
+
+        return (byteOffset, bitOffset);
+    }
+}

src/ZB.MOM.WW.OtOpcUa.Driver.S7/S7Driver.cs

@@ -0,0 +1,514 @@
+using S7.Net;
+using ZB.MOM.WW.OtOpcUa.Core.Abstractions;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.S7;
+
+/// <summary>
+///     Siemens S7 native driver — speaks S7comm over ISO-on-TCP (port 102) via the S7netplus
+///     library. First implementation of <see cref="IDriver"/> for an in-process .NET Standard
+///     PLC protocol that is NOT Modbus, validating that the v2 driver-capability interfaces
+///     generalize beyond Modbus + Galaxy.
+/// </summary>
+/// <remarks>
+///     <para>
+///         PR 62 ships the scaffold: <see cref="IDriver"/> only (Initialize / Reinitialize /
+///         Shutdown / GetHealth). <see cref="ITagDiscovery"/>, <see cref="IReadable"/>,
+///         <see cref="IWritable"/>, <see cref="ISubscribable"/>, <see cref="IHostConnectivityProbe"/>
+///         land in PRs 63-65 once the address parser (PR 63) is in place.
+///     </para>
+///     <para>
+///         <b>Single-connection policy</b>: S7netplus documented pattern is one
+///         <c>Plc</c> instance per PLC, serialized with a <see cref="SemaphoreSlim"/>.
+///         Parallelising reads against a single S7 CPU doesn't help — the CPU scans the
+///         communication mailbox at most once per cycle (2-10 ms) and queues concurrent
+///         requests wire-side anyway. Multiple client-side connections just waste the CPU's
+///         8-64 connection-resource budget.
+///     </para>
+/// </remarks>
+public sealed class S7Driver(S7DriverOptions options, string driverInstanceId)
+    : IDriver, ITagDiscovery, IReadable, IWritable, ISubscribable, IHostConnectivityProbe, IDisposable, IAsyncDisposable
+{
+    // ---- ISubscribable + IHostConnectivityProbe state ----
+
+    private readonly System.Collections.Concurrent.ConcurrentDictionary<long, SubscriptionState> _subscriptions = new();
+    private long _nextSubscriptionId;
+    private readonly object _probeLock = new();
+    private HostState _hostState = HostState.Unknown;
+    private DateTime _hostStateChangedUtc = DateTime.UtcNow;
+    private CancellationTokenSource? _probeCts;
+
+    public event EventHandler<DataChangeEventArgs>? OnDataChange;
+    public event EventHandler<HostStatusChangedEventArgs>? OnHostStatusChanged;
+
+    /// <summary>OPC UA StatusCode used when the tag name isn't in the driver's tag map.</summary>
+    private const uint StatusBadNodeIdUnknown = 0x80340000u;
+    /// <summary>OPC UA StatusCode used when the tag's data type isn't implemented yet.</summary>
+    private const uint StatusBadNotSupported = 0x803D0000u;
+    /// <summary>OPC UA StatusCode used when the tag is declared read-only.</summary>
+    private const uint StatusBadNotWritable = 0x803B0000u;
+    /// <summary>OPC UA StatusCode used when write fails validation (e.g. out-of-range value).</summary>
+    private const uint StatusBadInternalError = 0x80020000u;
+    /// <summary>OPC UA StatusCode used for socket / timeout / protocol-layer faults.</summary>
+    private const uint StatusBadCommunicationError = 0x80050000u;
+    /// <summary>OPC UA StatusCode used when S7 returns <c>ErrorCode.WrongCPU</c> / PUT/GET disabled.</summary>
+    private const uint StatusBadDeviceFailure = 0x80550000u;
+
+    private readonly Dictionary<string, S7TagDefinition> _tagsByName = new(StringComparer.OrdinalIgnoreCase);
+    private readonly Dictionary<string, S7ParsedAddress> _parsedByName = new(StringComparer.OrdinalIgnoreCase);
+
+    private readonly S7DriverOptions _options = options;
+    private readonly SemaphoreSlim _gate = new(1, 1);
+
+    /// <summary>
+    ///     Per-connection gate. Internal so PRs 63-65 (read/write/subscribe) can serialize on
+    ///     the same semaphore without exposing it publicly. Single-connection-per-PLC is a
+    ///     hard requirement of S7netplus — see class remarks.
+    /// </summary>
+    internal SemaphoreSlim Gate => _gate;
+
+    /// <summary>
+    ///     Active S7.Net PLC connection. Null until <see cref="InitializeAsync"/> returns; null
+    ///     after <see cref="ShutdownAsync"/>. Read-only outside this class; PR 64's Read/Write
+    ///     will take the <see cref="_gate"/> before touching it.
+    /// </summary>
+    internal Plc? Plc { get; private set; }
+
+    private DriverHealth _health = new(DriverState.Unknown, null, null);
+    private bool _disposed;
+
+    public string DriverInstanceId => driverInstanceId;
+    public string DriverType => "S7";
+
+    public async Task InitializeAsync(string driverConfigJson, CancellationToken cancellationToken)
+    {
+        _health = new DriverHealth(DriverState.Initializing, null, null);
+        try
+        {
+            var plc = new Plc(_options.CpuType, _options.Host, _options.Rack, _options.Slot);
+            // S7netplus writes timeouts into the underlying TcpClient via Plc.WriteTimeout /
+            // Plc.ReadTimeout (milliseconds). Set before OpenAsync so the handshake itself
+            // honours the bound.
+            plc.WriteTimeout = (int)_options.Timeout.TotalMilliseconds;
+            plc.ReadTimeout = (int)_options.Timeout.TotalMilliseconds;
+
+            using var cts = CancellationTokenSource.CreateLinkedTokenSource(cancellationToken);
+            cts.CancelAfter(_options.Timeout);
+            await plc.OpenAsync(cts.Token).ConfigureAwait(false);
+
+            Plc = plc;
+
+            // Parse every tag's address once at init so config typos fail fast here instead
+            // of surfacing as BadInternalError on every Read against the bad tag. The parser
+            // also rejects bit-offset > 7, DB 0, unknown area letters, etc.
+            _tagsByName.Clear();
+            _parsedByName.Clear();
+            foreach (var t in _options.Tags)
+            {
+                var parsed = S7AddressParser.Parse(t.Address); // throws FormatException
+                _tagsByName[t.Name] = t;
+                _parsedByName[t.Name] = parsed;
+            }
+
+            _health = new DriverHealth(DriverState.Healthy, DateTime.UtcNow, null);
+
+            // Kick off the probe loop once the connection is up. Initial HostState stays
+            // Unknown until the first probe tick succeeds — avoids broadcasting a premature
+            // Running transition before any PDU round-trip has happened.
+            if (_options.Probe.Enabled)
+            {
+                _probeCts = new CancellationTokenSource();
+                _ = Task.Run(() => ProbeLoopAsync(_probeCts.Token), _probeCts.Token);
+            }
+        }
+        catch (Exception ex)
+        {
+            // Clean up a partially-constructed Plc so a retry from the caller doesn't leak
+            // the TcpClient. S7netplus's Close() is best-effort and idempotent.
+            try { Plc?.Close(); } catch { }
+            Plc = null;
+            _health = new DriverHealth(DriverState.Faulted, null, ex.Message);
+            throw;
+        }
+    }
+
+    public async Task ReinitializeAsync(string driverConfigJson, CancellationToken cancellationToken)
+    {
+        await ShutdownAsync(cancellationToken).ConfigureAwait(false);
+        await InitializeAsync(driverConfigJson, cancellationToken).ConfigureAwait(false);
+    }
+
+    public Task ShutdownAsync(CancellationToken cancellationToken)
+    {
+        try { _probeCts?.Cancel(); } catch { }
+        _probeCts?.Dispose();
+        _probeCts = null;
+
+        foreach (var state in _subscriptions.Values)
+        {
+            try { state.Cts.Cancel(); } catch { }
+            state.Cts.Dispose();
+        }
+        _subscriptions.Clear();
+
+        try { Plc?.Close(); } catch { /* best-effort — tearing down anyway */ }
+        Plc = null;
+        _health = new DriverHealth(DriverState.Unknown, _health.LastSuccessfulRead, null);
+        return Task.CompletedTask;
+    }
+
+    public DriverHealth GetHealth() => _health;
+
+    /// <summary>
+    ///     Approximate memory footprint. The Plc instance + one 240-960 byte PDU buffer is
+    ///     under 4 KB; return 0 because the <see cref="IDriver"/> contract asks for a
+    ///     driver-attributable growth number and S7.Net doesn't expose one.
+    /// </summary>
+    public long GetMemoryFootprint() => 0;
+
+    public Task FlushOptionalCachesAsync(CancellationToken cancellationToken) => Task.CompletedTask;
+
+    // ---- IReadable ----
+
+    public async Task<IReadOnlyList<DataValueSnapshot>> ReadAsync(
+        IReadOnlyList<string> fullReferences, CancellationToken cancellationToken)
+    {
+        var plc = RequirePlc();
+        var now = DateTime.UtcNow;
+        var results = new DataValueSnapshot[fullReferences.Count];
+
+        await _gate.WaitAsync(cancellationToken).ConfigureAwait(false);
+        try
+        {
+            for (var i = 0; i < fullReferences.Count; i++)
+            {
+                var name = fullReferences[i];
+                if (!_tagsByName.TryGetValue(name, out var tag))
+                {
+                    results[i] = new DataValueSnapshot(null, StatusBadNodeIdUnknown, null, now);
+                    continue;
+                }
+                try
+                {
+                    var value = await ReadOneAsync(plc, tag, cancellationToken).ConfigureAwait(false);
+                    results[i] = new DataValueSnapshot(value, 0u, now, now);
+                    _health = new DriverHealth(DriverState.Healthy, now, null);
+                }
+                catch (NotSupportedException)
+                {
+                    results[i] = new DataValueSnapshot(null, StatusBadNotSupported, null, now);
+                }
+                catch (global::S7.Net.PlcException pex)
+                {
+                    // S7.Net's PlcException carries an ErrorCode; PUT/GET-disabled on
+                    // S7-1200/1500 surfaces here. Map to BadDeviceFailure so operators see a
+                    // device-config problem (toggle PUT/GET in TIA Portal) rather than a
+                    // transient fault — per driver-specs.md §5.
+                    results[i] = new DataValueSnapshot(null, StatusBadDeviceFailure, null, now);
+                    _health = new DriverHealth(DriverState.Degraded, _health.LastSuccessfulRead, pex.Message);
+                }
+                catch (Exception ex)
+                {
+                    results[i] = new DataValueSnapshot(null, StatusBadCommunicationError, null, now);
+                    _health = new DriverHealth(DriverState.Degraded, _health.LastSuccessfulRead, ex.Message);
+                }
+            }
+        }
+        finally { _gate.Release(); }
+        return results;
+    }
+
+    private async Task<object> ReadOneAsync(global::S7.Net.Plc plc, S7TagDefinition tag, CancellationToken ct)
+    {
+        var addr = _parsedByName[tag.Name];
+        // S7.Net's string-based ReadAsync returns object where the boxed .NET type depends on
+        // the size suffix: DBX=bool, DBB=byte, DBW=ushort, DBD=uint. Our S7DataType enum
+        // specifies the SEMANTIC type (Int16 vs UInt16 vs Float32 etc.); the reinterpret below
+        // converts the raw unsigned boxed value into the requested type without issuing an
+        // extra PLC round-trip.
+        var raw = await plc.ReadAsync(tag.Address, ct).ConfigureAwait(false)
+            ?? throw new System.IO.InvalidDataException($"S7.Net returned null for '{tag.Address}'");
+
+        return (tag.DataType, addr.Size, raw) switch
+        {
+            (S7DataType.Bool, S7Size.Bit, bool b) => b,
+            (S7DataType.Byte, S7Size.Byte, byte by) => by,
+            (S7DataType.UInt16, S7Size.Word, ushort u16) => u16,
+            (S7DataType.Int16, S7Size.Word, ushort u16) => unchecked((short)u16),
+            (S7DataType.UInt32, S7Size.DWord, uint u32) => u32,
+            (S7DataType.Int32, S7Size.DWord, uint u32) => unchecked((int)u32),
+            (S7DataType.Float32, S7Size.DWord, uint u32) => BitConverter.UInt32BitsToSingle(u32),
+
+            (S7DataType.Int64, _, _)   => throw new NotSupportedException("S7 Int64 reads land in a follow-up PR"),
+            (S7DataType.UInt64, _, _)  => throw new NotSupportedException("S7 UInt64 reads land in a follow-up PR"),
+            (S7DataType.Float64, _, _) => throw new NotSupportedException("S7 Float64 (LReal) reads land in a follow-up PR"),
+            (S7DataType.String, _, _)  => throw new NotSupportedException("S7 STRING reads land in a follow-up PR"),
+            (S7DataType.DateTime, _, _) => throw new NotSupportedException("S7 DateTime reads land in a follow-up PR"),
+
+            _ => throw new System.IO.InvalidDataException(
+                $"S7 Read type-mismatch: tag '{tag.Name}' declared {tag.DataType} but address '{tag.Address}' " +
+                $"parsed as Size={addr.Size}; S7.Net returned {raw.GetType().Name}"),
+        };
+    }
+
+    // ---- IWritable ----
+
+    public async Task<IReadOnlyList<WriteResult>> WriteAsync(
+        IReadOnlyList<WriteRequest> writes, CancellationToken cancellationToken)
+    {
+        var plc = RequirePlc();
+        var results = new WriteResult[writes.Count];
+
+        await _gate.WaitAsync(cancellationToken).ConfigureAwait(false);
+        try
+        {
+            for (var i = 0; i < writes.Count; i++)
+            {
+                var w = writes[i];
+                if (!_tagsByName.TryGetValue(w.FullReference, out var tag))
+                {
+                    results[i] = new WriteResult(StatusBadNodeIdUnknown);
+                    continue;
+                }
+                if (!tag.Writable)
+                {
+                    results[i] = new WriteResult(StatusBadNotWritable);
+                    continue;
+                }
+                try
+                {
+                    await WriteOneAsync(plc, tag, w.Value, cancellationToken).ConfigureAwait(false);
+                    results[i] = new WriteResult(0u);
+                }
+                catch (NotSupportedException)
+                {
+                    results[i] = new WriteResult(StatusBadNotSupported);
+                }
+                catch (global::S7.Net.PlcException)
+                {
+                    results[i] = new WriteResult(StatusBadDeviceFailure);
+                }
+                catch (Exception)
+                {
+                    results[i] = new WriteResult(StatusBadInternalError);
+                }
+            }
+        }
+        finally { _gate.Release(); }
+        return results;
+    }
+
+    private async Task WriteOneAsync(global::S7.Net.Plc plc, S7TagDefinition tag, object? value, CancellationToken ct)
+    {
+        // S7.Net's Plc.WriteAsync(string address, object value) expects the boxed value to
+        // match the address's size-suffix type: DBX=bool, DBB=byte, DBW=ushort, DBD=uint.
+        // Our S7DataType lets the caller pass short/int/float; convert to the unsigned
+        // wire representation before handing off.
+        var boxed = tag.DataType switch
+        {
+            S7DataType.Bool    => (object)Convert.ToBoolean(value),
+            S7DataType.Byte    => (object)Convert.ToByte(value),
+            S7DataType.UInt16  => (object)Convert.ToUInt16(value),
+            S7DataType.Int16   => (object)unchecked((ushort)Convert.ToInt16(value)),
+            S7DataType.UInt32  => (object)Convert.ToUInt32(value),
+            S7DataType.Int32   => (object)unchecked((uint)Convert.ToInt32(value)),
+            S7DataType.Float32 => (object)BitConverter.SingleToUInt32Bits(Convert.ToSingle(value)),
+
+            S7DataType.Int64   => throw new NotSupportedException("S7 Int64 writes land in a follow-up PR"),
+            S7DataType.UInt64  => throw new NotSupportedException("S7 UInt64 writes land in a follow-up PR"),
+            S7DataType.Float64 => throw new NotSupportedException("S7 Float64 (LReal) writes land in a follow-up PR"),
+            S7DataType.String  => throw new NotSupportedException("S7 STRING writes land in a follow-up PR"),
+            S7DataType.DateTime => throw new NotSupportedException("S7 DateTime writes land in a follow-up PR"),
+            _ => throw new InvalidOperationException($"Unknown S7DataType {tag.DataType}"),
+        };
+        await plc.WriteAsync(tag.Address, boxed, ct).ConfigureAwait(false);
+    }
+
+    private global::S7.Net.Plc RequirePlc() =>
+        Plc ?? throw new InvalidOperationException("S7Driver not initialized");
+
+    // ---- ITagDiscovery ----
+
+    public Task DiscoverAsync(IAddressSpaceBuilder builder, CancellationToken cancellationToken)
+    {
+        ArgumentNullException.ThrowIfNull(builder);
+        var folder = builder.Folder("S7", "S7");
+        foreach (var t in _options.Tags)
+        {
+            folder.Variable(t.Name, t.Name, new DriverAttributeInfo(
+                FullName: t.Name,
+                DriverDataType: MapDataType(t.DataType),
+                IsArray: false,
+                ArrayDim: null,
+                SecurityClass: t.Writable ? SecurityClassification.Operate : SecurityClassification.ViewOnly,
+                IsHistorized: false,
+                IsAlarm: false,
+                WriteIdempotent: t.WriteIdempotent));
+        }
+        return Task.CompletedTask;
+    }
+
+    private static DriverDataType MapDataType(S7DataType t) => t switch
+    {
+        S7DataType.Bool => DriverDataType.Boolean,
+        S7DataType.Byte => DriverDataType.Int32,      // no 8-bit in DriverDataType yet
+        S7DataType.Int16 or S7DataType.UInt16 or S7DataType.Int32 or S7DataType.UInt32 => DriverDataType.Int32,
+        S7DataType.Int64 or S7DataType.UInt64 => DriverDataType.Int32, // widens; lossy for >2^31-1
+        S7DataType.Float32 => DriverDataType.Float32,
+        S7DataType.Float64 => DriverDataType.Float64,
+        S7DataType.String => DriverDataType.String,
+        S7DataType.DateTime => DriverDataType.DateTime,
+        _ => DriverDataType.Int32,
+    };
+
+    // ---- ISubscribable (polling overlay) ----
+
+    public Task<ISubscriptionHandle> SubscribeAsync(
+        IReadOnlyList<string> fullReferences, TimeSpan publishingInterval, CancellationToken cancellationToken)
+    {
+        var id = Interlocked.Increment(ref _nextSubscriptionId);
+        var cts = new CancellationTokenSource();
+        // Floor at 100 ms — S7 CPUs scan 2-10 ms but the comms mailbox is processed at most
+        // once per scan; sub-100 ms polling just queues wire-side with worse latency.
+        var interval = publishingInterval < TimeSpan.FromMilliseconds(100)
+            ? TimeSpan.FromMilliseconds(100)
+            : publishingInterval;
+        var handle = new S7SubscriptionHandle(id);
+        var state = new SubscriptionState(handle, [.. fullReferences], interval, cts);
+        _subscriptions[id] = state;
+        _ = Task.Run(() => PollLoopAsync(state, cts.Token), cts.Token);
+        return Task.FromResult<ISubscriptionHandle>(handle);
+    }
+
+    public Task UnsubscribeAsync(ISubscriptionHandle handle, CancellationToken cancellationToken)
+    {
+        if (handle is S7SubscriptionHandle h && _subscriptions.TryRemove(h.Id, out var state))
+        {
+            state.Cts.Cancel();
+            state.Cts.Dispose();
+        }
+        return Task.CompletedTask;
+    }
+
+    private async Task PollLoopAsync(SubscriptionState state, CancellationToken ct)
+    {
+        // Initial-data push per OPC UA Part 4 convention.
+        try { await PollOnceAsync(state, forceRaise: true, ct).ConfigureAwait(false); }
+        catch (OperationCanceledException) { return; }
+        catch { /* first-read error — polling continues */ }
+
+        while (!ct.IsCancellationRequested)
+        {
+            try { await Task.Delay(state.Interval, ct).ConfigureAwait(false); }
+            catch (OperationCanceledException) { return; }
+
+            try { await PollOnceAsync(state, forceRaise: false, ct).ConfigureAwait(false); }
+            catch (OperationCanceledException) { return; }
+            catch { /* transient polling error — loop continues, health surface reflects it */ }
+        }
+    }
+
+    private async Task PollOnceAsync(SubscriptionState state, bool forceRaise, CancellationToken ct)
+    {
+        var snapshots = await ReadAsync(state.TagReferences, ct).ConfigureAwait(false);
+        for (var i = 0; i < state.TagReferences.Count; i++)
+        {
+            var tagRef = state.TagReferences[i];
+            var current = snapshots[i];
+            var lastSeen = state.LastValues.TryGetValue(tagRef, out var prev) ? prev : default;
+
+            if (forceRaise || !Equals(lastSeen?.Value, current.Value) || lastSeen?.StatusCode != current.StatusCode)
+            {
+                state.LastValues[tagRef] = current;
+                OnDataChange?.Invoke(this, new DataChangeEventArgs(state.Handle, tagRef, current));
+            }
+        }
+    }
+
+    private sealed record SubscriptionState(
+        S7SubscriptionHandle Handle,
+        IReadOnlyList<string> TagReferences,
+        TimeSpan Interval,
+        CancellationTokenSource Cts)
+    {
+        public System.Collections.Concurrent.ConcurrentDictionary<string, DataValueSnapshot> LastValues { get; }
+            = new(StringComparer.OrdinalIgnoreCase);
+    }
+
+    private sealed record S7SubscriptionHandle(long Id) : ISubscriptionHandle
+    {
+        public string DiagnosticId => $"s7-sub-{Id}";
+    }
+
+    // ---- IHostConnectivityProbe ----
+
+    /// <summary>
+    ///     Host identifier surfaced in <see cref="GetHostStatuses"/>. <c>host:port</c> format
+    ///     matches the Modbus driver's convention so the Admin UI dashboard renders both
+    ///     family's rows uniformly.
+    /// </summary>
+    public string HostName => $"{_options.Host}:{_options.Port}";
+
+    public IReadOnlyList<HostConnectivityStatus> GetHostStatuses()
+    {
+        lock (_probeLock)
+            return [new HostConnectivityStatus(HostName, _hostState, _hostStateChangedUtc)];
+    }
+
+    private async Task ProbeLoopAsync(CancellationToken ct)
+    {
+        while (!ct.IsCancellationRequested)
+        {
+            var success = false;
+            try
+            {
+                // Probe via S7.Net's low-cost GetCpuStatus — returns the CPU state (Run/Stop)
+                // and is intentionally light on the comms mailbox. Single-word Plc.ReadAsync
+                // would also work but GetCpuStatus doubles as a "PLC actually up" check.
+                using var probeCts = CancellationTokenSource.CreateLinkedTokenSource(ct);
+                probeCts.CancelAfter(_options.Probe.Timeout);
+
+                var plc = Plc;
+                if (plc is null) throw new InvalidOperationException("Plc dropped during probe");
+
+                await _gate.WaitAsync(probeCts.Token).ConfigureAwait(false);
+                try
+                {
+                    _ = await plc.ReadStatusAsync(probeCts.Token).ConfigureAwait(false);
+                    success = true;
+                }
+                finally { _gate.Release(); }
+            }
+            catch (OperationCanceledException) when (ct.IsCancellationRequested) { return; }
+            catch { /* transport/timeout/exception — treated as Stopped below */ }
+
+            TransitionTo(success ? HostState.Running : HostState.Stopped);
+
+            try { await Task.Delay(_options.Probe.Interval, ct).ConfigureAwait(false); }
+            catch (OperationCanceledException) { return; }
+        }
+    }
+
+    private void TransitionTo(HostState newState)
+    {
+        HostState old;
+        lock (_probeLock)
+        {
+            old = _hostState;
+            if (old == newState) return;
+            _hostState = newState;
+            _hostStateChangedUtc = DateTime.UtcNow;
+        }
+        OnHostStatusChanged?.Invoke(this, new HostStatusChangedEventArgs(HostName, old, newState));
+    }
+
+    public void Dispose() => DisposeAsync().AsTask().GetAwaiter().GetResult();
+
+    public async ValueTask DisposeAsync()
+    {
+        if (_disposed) return;
+        _disposed = true;
+        try { await ShutdownAsync(CancellationToken.None).ConfigureAwait(false); }
+        catch { /* disposal is best-effort */ }
+        _gate.Dispose();
+    }
+}

src/ZB.MOM.WW.OtOpcUa.Driver.S7/S7DriverOptions.cs

@@ -0,0 +1,120 @@
+using S7NetCpuType = global::S7.Net.CpuType;
+
+namespace ZB.MOM.WW.OtOpcUa.Driver.S7;
+
+/// <summary>
+///     Siemens S7 native (S7comm / ISO-on-TCP port 102) driver configuration. Bound from the
+///     driver's <c>DriverConfig</c> JSON at <c>DriverHost.RegisterAsync</c>. Unlike the Modbus
+///     driver the S7 driver uses the PLC's *native* protocol — port 102 ISO-on-TCP rather
+///     than Modbus's 502, and S7-specific area codes (DB, M, I, Q) rather than holding-
+///     register / coil tables.
+/// </summary>
+/// <remarks>
+///     <para>
+///         The driver requires <b>PUT/GET communication enabled</b> in the TIA Portal
+///         hardware config for S7-1200/1500. The factory default disables PUT/GET access,
+///         so a driver configured against a freshly-flashed CPU will see a hard error
+///         (S7.Net surfaces it as <c>Plc.ReadAsync</c> returning <c>ErrorCode.Accessing</c>).
+///         The driver maps that specifically to <c>BadNotSupported</c> and flags it as a
+///         configuration alert rather than a transient fault — blind Polly retry is wasted
+///         effort when the PLC will keep refusing every request.
+///     </para>
+///     <para>
+///         See <c>docs/v2/driver-specs.md</c> §5 for the full specification.
+///     </para>
+/// </remarks>
+public sealed class S7DriverOptions
+{
+    /// <summary>PLC IP address or hostname.</summary>
+    public string Host { get; init; } = "127.0.0.1";
+
+    /// <summary>TCP port. ISO-on-TCP is 102 on every S7 model; override only for unusual NAT setups.</summary>
+    public int Port { get; init; } = 102;
+
+    /// <summary>
+    ///     CPU family. Determines the ISO-TSAP slot byte that S7.Net uses during connection
+    ///     setup — pick the family that matches the target PLC exactly.
+    /// </summary>
+    public S7NetCpuType CpuType { get; init; } = S7NetCpuType.S71500;
+
+    /// <summary>
+    ///     Hardware rack number. Almost always 0; relevant only for distributed S7-400 racks
+    ///     with multiple CPUs.
+    /// </summary>
+    public short Rack { get; init; } = 0;
+
+    /// <summary>
+    ///     CPU slot. Conventions per family: S7-300 = slot 2, S7-400 = slot 2 or 3,
+    ///     S7-1200 / S7-1500 = slot 0 (onboard PN). S7.Net uses this to build the remote
+    ///     TSAP. Wrong slot → connection refused during handshake.
+    /// </summary>
+    public short Slot { get; init; } = 0;
+
+    /// <summary>Connect + per-operation timeout.</summary>
+    public TimeSpan Timeout { get; init; } = TimeSpan.FromSeconds(5);
+
+    /// <summary>Pre-declared tag map. S7 has a symbol-table protocol but S7.Net does not expose it, so the driver operates off a static tag list configured per-site. Address grammar documented in S7AddressParser (PR 63).</summary>
+    public IReadOnlyList<S7TagDefinition> Tags { get; init; } = [];
+
+    /// <summary>
+    ///     Background connectivity-probe settings. When enabled, the driver runs a tick loop
+    ///     that issues a cheap read against <see cref="S7ProbeOptions.ProbeAddress"/> every
+    ///     <see cref="S7ProbeOptions.Interval"/> and raises <c>OnHostStatusChanged</c> on
+    ///     Running ↔ Stopped transitions.
+    /// </summary>
+    public S7ProbeOptions Probe { get; init; } = new();
+}
+
+public sealed class S7ProbeOptions
+{
+    public bool Enabled { get; init; } = true;
+    public TimeSpan Interval { get; init; } = TimeSpan.FromSeconds(5);
+    public TimeSpan Timeout { get; init; } = TimeSpan.FromSeconds(2);
+
+    /// <summary>
+    ///     Address to probe for liveness. DB1.DBW0 is the convention if the PLC project
+    ///     reserves a small fingerprint DB for health checks (per <c>docs/v2/s7.md</c>);
+    ///     if not, pick any valid Merker word like <c>MW0</c>.
+    /// </summary>
+    public string ProbeAddress { get; init; } = "MW0";
+}
+
+/// <summary>
+///     One S7 variable as exposed by the driver. Addresses use S7.Net syntax — see
+///     <c>S7AddressParser</c> (PR 63) for the grammar.
+/// </summary>
+/// <param name="Name">Tag name; OPC UA browse name + driver full reference.</param>
+/// <param name="Address">S7 address string, e.g. <c>DB1.DBW0</c>, <c>M0.0</c>, <c>I0.0</c>, <c>QD4</c>. Grammar documented in <c>S7AddressParser</c> (PR 63).</param>
+/// <param name="DataType">Logical data type — drives the underlying S7.Net read/write width.</param>
+/// <param name="Writable">When true the driver accepts writes for this tag.</param>
+/// <param name="StringLength">For <c>DataType = String</c>: S7-string max length. Default 254 (S7 max).</param>
+/// <param name="WriteIdempotent">
+///     Per <c>docs/v2/plan.md</c> decisions #44, #45, #143 — flag a tag as safe to replay on
+///     write timeout / failure. Default <c>false</c>; writes do not auto-retry. Safe candidates
+///     on S7: DB word/dword set-points holding analog values, configuration DBs where the same
+///     value can be written again without side-effects. Unsafe: M (merker) bits or Q (output)
+///     coils that drive edge-triggered routines in the PLC program.
+/// </param>
+public sealed record S7TagDefinition(
+    string Name,
+    string Address,
+    S7DataType DataType,
+    bool Writable = true,
+    int StringLength = 254,
+    bool WriteIdempotent = false);
+
+public enum S7DataType
+{
+    Bool,
+    Byte,
+    Int16,
+    UInt16,
+    Int32,
+    UInt32,
+    Int64,
+    UInt64,
+    Float32,
+    Float64,
+    String,
+    DateTime,
+}

src/ZB.MOM.WW.OtOpcUa.Driver.S7/ZB.MOM.WW.OtOpcUa.Driver.S7.csproj

@@ -0,0 +1,27 @@
+<Project Sdk="Microsoft.NET.Sdk">
+
+    <PropertyGroup>
+        <TargetFramework>net10.0</TargetFramework>
+        <Nullable>enable</Nullable>
+        <ImplicitUsings>enable</ImplicitUsings>
+        <LangVersion>latest</LangVersion>
+        <TreatWarningsAsErrors>true</TreatWarningsAsErrors>
+        <GenerateDocumentationFile>true</GenerateDocumentationFile>
+        <NoWarn>$(NoWarn);CS1591</NoWarn>
+        <RootNamespace>ZB.MOM.WW.OtOpcUa.Driver.S7</RootNamespace>
+        <AssemblyName>ZB.MOM.WW.OtOpcUa.Driver.S7</AssemblyName>
+    </PropertyGroup>
+
+    <ItemGroup>
+        <ProjectReference Include="..\ZB.MOM.WW.OtOpcUa.Core.Abstractions\ZB.MOM.WW.OtOpcUa.Core.Abstractions.csproj"/>
+    </ItemGroup>
+
+    <ItemGroup>
+        <PackageReference Include="S7netplus" Version="0.20.0"/>
+    </ItemGroup>
+
+    <ItemGroup>
+        <InternalsVisibleTo Include="ZB.MOM.WW.OtOpcUa.Driver.S7.Tests"/>
+    </ItemGroup>
+
+</Project>

src/ZB.MOM.WW.OtOpcUa.Server/Observability/HealthEndpointsHost.cs

@@ -0,0 +1,181 @@
+using System.Net;
+using System.Text;
+using System.Text.Json;
+using Microsoft.Extensions.Logging;
+using ZB.MOM.WW.OtOpcUa.Core.Abstractions;
+using ZB.MOM.WW.OtOpcUa.Core.Hosting;
+using ZB.MOM.WW.OtOpcUa.Core.Observability;
+
+namespace ZB.MOM.WW.OtOpcUa.Server.Observability;
+
+/// <summary>
+///     Standalone <see cref="HttpListener"/> host for <c>/healthz</c> and <c>/readyz</c>
+///     separate from the OPC UA binding. Per <c>docs/v2/implementation/phase-6-1-resilience-
+///     and-observability.md</c> §Stream C.1.
+/// </summary>
+/// <remarks>
+///     Binds to <c>http://localhost:4841</c> by default — loopback avoids the Windows URL-ACL
+///     elevation requirement that binding to <c>http://+:4841</c> (wildcard) would impose.
+///     When a deployment needs remote probing, a reverse proxy or explicit netsh urlacl grant
+///     is the expected path; documented in <c>docs/v2/Server-Deployment.md</c> in a follow-up.
+/// </remarks>
+public sealed class HealthEndpointsHost : IAsyncDisposable
+{
+    private readonly string _prefix;
+    private readonly DriverHost _driverHost;
+    private readonly Func<bool> _configDbHealthy;
+    private readonly Func<bool> _usingStaleConfig;
+    private readonly ILogger<HealthEndpointsHost> _logger;
+    private readonly HttpListener _listener = new();
+    private readonly DateTime _startedUtc = DateTime.UtcNow;
+    private CancellationTokenSource? _cts;
+    private Task? _acceptLoop;
+    private bool _disposed;
+
+    public HealthEndpointsHost(
+        DriverHost driverHost,
+        ILogger<HealthEndpointsHost> logger,
+        Func<bool>? configDbHealthy = null,
+        Func<bool>? usingStaleConfig = null,
+        string prefix = "http://localhost:4841/")
+    {
+        _driverHost = driverHost;
+        _logger = logger;
+        _configDbHealthy = configDbHealthy ?? (() => true);
+        _usingStaleConfig = usingStaleConfig ?? (() => false);
+        _prefix = prefix.EndsWith('/') ? prefix : prefix + "/";
+        _listener.Prefixes.Add(_prefix);
+    }
+
+    public void Start()
+    {
+        _listener.Start();
+        _cts = new CancellationTokenSource();
+        _acceptLoop = Task.Run(() => AcceptLoopAsync(_cts.Token));
+        _logger.LogInformation("Health endpoints listening on {Prefix}", _prefix);
+    }
+
+    private async Task AcceptLoopAsync(CancellationToken ct)
+    {
+        while (!ct.IsCancellationRequested)
+        {
+            HttpListenerContext ctx;
+            try
+            {
+                ctx = await _listener.GetContextAsync().ConfigureAwait(false);
+            }
+            catch (HttpListenerException) when (ct.IsCancellationRequested) { break; }
+            catch (ObjectDisposedException) { break; }
+
+            _ = Task.Run(() => HandleAsync(ctx), ct);
+        }
+    }
+
+    private async Task HandleAsync(HttpListenerContext ctx)
+    {
+        try
+        {
+            var path = ctx.Request.Url?.AbsolutePath ?? "/";
+            switch (path)
+            {
+                case "/healthz":
+                    await WriteHealthzAsync(ctx).ConfigureAwait(false);
+                    break;
+                case "/readyz":
+                    await WriteReadyzAsync(ctx).ConfigureAwait(false);
+                    break;
+                default:
+                    ctx.Response.StatusCode = 404;
+                    break;
+            }
+        }
+        catch (Exception ex)
+        {
+            _logger.LogWarning(ex, "Health endpoint handler failure");
+            try { ctx.Response.StatusCode = 500; } catch { /* ignore */ }
+        }
+        finally
+        {
+            try { ctx.Response.Close(); } catch { /* ignore */ }
+        }
+    }
+
+    private async Task WriteHealthzAsync(HttpListenerContext ctx)
+    {
+        var configHealthy = _configDbHealthy();
+        var staleConfig = _usingStaleConfig();
+        // /healthz is 200 when process alive + (config DB reachable OR cache-warm).
+        // Stale-config still serves 200 so the process isn't flagged dead when the DB
+        // blips; the body surfaces the stale flag for operators.
+        var healthy = configHealthy || staleConfig;
+        ctx.Response.StatusCode = healthy ? 200 : 503;
+
+        var body = JsonSerializer.Serialize(new
+        {
+            status = healthy ? "healthy" : "unhealthy",
+            uptimeSeconds = (int)(DateTime.UtcNow - _startedUtc).TotalSeconds,
+            configDbReachable = configHealthy,
+            usingStaleConfig = staleConfig,
+        });
+        await WriteBodyAsync(ctx, body).ConfigureAwait(false);
+    }
+
+    private async Task WriteReadyzAsync(HttpListenerContext ctx)
+    {
+        var snapshots = BuildSnapshots();
+        var verdict = DriverHealthReport.Aggregate(snapshots);
+        ctx.Response.StatusCode = DriverHealthReport.HttpStatus(verdict);
+
+        var body = JsonSerializer.Serialize(new
+        {
+            verdict = verdict.ToString(),
+            uptimeSeconds = (int)(DateTime.UtcNow - _startedUtc).TotalSeconds,
+            drivers = snapshots.Select(d => new
+            {
+                id = d.DriverInstanceId,
+                state = d.State.ToString(),
+                detail = d.DetailMessage,
+            }).ToArray(),
+            degradedDrivers = snapshots
+                .Where(d => d.State == DriverState.Degraded || d.State == DriverState.Reconnecting)
+                .Select(d => d.DriverInstanceId)
+                .ToArray(),
+        });
+        await WriteBodyAsync(ctx, body).ConfigureAwait(false);
+    }
+
+    private IReadOnlyList<DriverHealthSnapshot> BuildSnapshots()
+    {
+        var list = new List<DriverHealthSnapshot>();
+        foreach (var id in _driverHost.RegisteredDriverIds)
+        {
+            var driver = _driverHost.GetDriver(id);
+            if (driver is null) continue;
+            var health = driver.GetHealth();
+            list.Add(new DriverHealthSnapshot(driver.DriverInstanceId, health.State, health.LastError));
+        }
+        return list;
+    }
+
+    private static async Task WriteBodyAsync(HttpListenerContext ctx, string body)
+    {
+        var bytes = Encoding.UTF8.GetBytes(body);
+        ctx.Response.ContentType = "application/json; charset=utf-8";
+        ctx.Response.ContentLength64 = bytes.LongLength;
+        await ctx.Response.OutputStream.WriteAsync(bytes).ConfigureAwait(false);
+    }
+
+    public async ValueTask DisposeAsync()
+    {
+        if (_disposed) return;
+        _disposed = true;
+        _cts?.Cancel();
+        try { _listener.Stop(); } catch { /* ignore */ }
+        if (_acceptLoop is not null)
+        {
+            try { await _acceptLoop.ConfigureAwait(false); } catch { /* ignore */ }
+        }
+        _listener.Close();
+        _cts?.Dispose();
+    }
+}

src/ZB.MOM.WW.OtOpcUa.Server/OpcUa/DriverNodeManager.cs

@@ -3,8 +3,14 @@ using Microsoft.Extensions.Logging;
 using Opc.Ua;
 using Opc.Ua.Server;
 using ZB.MOM.WW.OtOpcUa.Core.Abstractions;
+using ZB.MOM.WW.OtOpcUa.Core.Resilience;
 using ZB.MOM.WW.OtOpcUa.Server.Security;
 using DriverWriteRequest = ZB.MOM.WW.OtOpcUa.Core.Abstractions.WriteRequest;
+// Core.Abstractions defines a type-named HistoryReadResult (driver-side samples + continuation
+// point) that collides with Opc.Ua.HistoryReadResult (service-layer per-node result). We
+// assign driver-side results to an explicitly-aliased local and construct only the service
+// type in the overrides below.
+using OpcHistoryReadResult = Opc.Ua.HistoryReadResult;
 
 namespace ZB.MOM.WW.OtOpcUa.Server.OpcUa;
 
@@ -28,8 +34,14 @@ public sealed class DriverNodeManager : CustomNodeManager2, IAddressSpaceBuilder
     private readonly IDriver _driver;
     private readonly IReadable? _readable;
     private readonly IWritable? _writable;
+    private readonly CapabilityInvoker _invoker;
     private readonly ILogger<DriverNodeManager> _logger;
 
+    // Per-variable idempotency flag populated during Variable() registration from
+    // DriverAttributeInfo.WriteIdempotent. Drives ExecuteWriteAsync's retry gating in
+    // OnWriteValue; absent entries default to false (decisions #44, #45, #143).
+    private readonly Dictionary<string, bool> _writeIdempotentByFullRef = new(StringComparer.OrdinalIgnoreCase);
+
     /// <summary>The driver whose address space this node manager exposes.</summary>
     public IDriver Driver => _driver;
 
@@ -48,12 +60,13 @@ public sealed class DriverNodeManager : CustomNodeManager2, IAddressSpaceBuilder
     private FolderState _currentFolder = null!;
 
     public DriverNodeManager(IServerInternal server, ApplicationConfiguration configuration,
-        IDriver driver, ILogger<DriverNodeManager> logger)
+        IDriver driver, CapabilityInvoker invoker, ILogger<DriverNodeManager> logger)
         : base(server, configuration, namespaceUris: $"urn:OtOpcUa:{driver.DriverInstanceId}")
     {
         _driver = driver;
         _readable = driver as IReadable;
         _writable = driver as IWritable;
+        _invoker = invoker;
         _logger = logger;
     }
 
@@ -71,7 +84,13 @@ public sealed class DriverNodeManager : CustomNodeManager2, IAddressSpaceBuilder
                 NodeId = new NodeId(_driver.DriverInstanceId, NamespaceIndex),
                 BrowseName = new QualifiedName(_driver.DriverInstanceId, NamespaceIndex),
                 DisplayName = new LocalizedText(_driver.DriverInstanceId),
-                EventNotifier = EventNotifiers.None,
+                // Driver root is the conventional event notifier for HistoryReadEvents — clients
+                // request alarm history by targeting it and the node manager routes through
+                // IHistoryProvider.ReadEventsAsync. SubscribeToEvents is also set so live-event
+                // subscriptions (Alarm & Conditions) can point here in a future PR; today the
+                // alarm events are emitted by per-variable AlarmConditionState siblings but a
+                // "subscribe to all events from this driver" path would use this notifier.
+                EventNotifier = (byte)(EventNotifiers.SubscribeToEvents | EventNotifiers.HistoryRead),
             };
 
             // Link under Objects folder so clients see the driver subtree at browse root.
@@ -122,14 +141,22 @@ public sealed class DriverNodeManager : CustomNodeManager2, IAddressSpaceBuilder
                 DisplayName = new LocalizedText(displayName),
                 DataType = MapDataType(attributeInfo.DriverDataType),
                 ValueRank = attributeInfo.IsArray ? ValueRanks.OneDimension : ValueRanks.Scalar,
-                AccessLevel = AccessLevels.CurrentReadOrWrite,
-                UserAccessLevel = AccessLevels.CurrentReadOrWrite,
+                // Historized attributes get the HistoryRead access bit so the stack dispatches
+                // incoming HistoryRead service calls to this node. Without it the base class
+                // returns BadHistoryOperationUnsupported before our per-kind hook ever runs.
+                // HistoryWrite isn't granted — history rewrite is a separate capability the
+                // driver doesn't support today.
+                AccessLevel = (byte)(AccessLevels.CurrentReadOrWrite
+                    | (attributeInfo.IsHistorized ? AccessLevels.HistoryRead : 0)),
+                UserAccessLevel = (byte)(AccessLevels.CurrentReadOrWrite
+                    | (attributeInfo.IsHistorized ? AccessLevels.HistoryRead : 0)),
                 Historizing = attributeInfo.IsHistorized,
             };
             _currentFolder.AddChild(v);
             AddPredefinedNode(SystemContext, v);
             _variablesByFullRef[attributeInfo.FullName] = v;
             _securityByFullRef[attributeInfo.FullName] = attributeInfo.SecurityClass;
+            _writeIdempotentByFullRef[attributeInfo.FullName] = attributeInfo.WriteIdempotent;
 
             v.OnReadValue = OnReadValue;
             v.OnWriteValue = OnWriteValue;
@@ -170,7 +197,11 @@ public sealed class DriverNodeManager : CustomNodeManager2, IAddressSpaceBuilder
         try
         {
             var fullRef = node.NodeId.Identifier as string ?? "";
-            var result = _readable.ReadAsync([fullRef], CancellationToken.None).GetAwaiter().GetResult();
+            var result = _invoker.ExecuteAsync(
+                DriverCapability.Read,
+                _driver.DriverInstanceId,
+                async ct => (IReadOnlyList<DataValueSnapshot>)await _readable.ReadAsync([fullRef], ct).ConfigureAwait(false),
+                CancellationToken.None).AsTask().GetAwaiter().GetResult();
             if (result.Count == 0)
             {
                 statusCode = StatusCodes.BadNoData;
@@ -363,9 +394,15 @@ public sealed class DriverNodeManager : CustomNodeManager2, IAddressSpaceBuilder
 
         try
         {
-            var results = _writable.WriteAsync(
-                [new DriverWriteRequest(fullRef!, value)],
-                CancellationToken.None).GetAwaiter().GetResult();
+            var isIdempotent = _writeIdempotentByFullRef.GetValueOrDefault(fullRef!, false);
+            var capturedValue = value;
+            var results = _invoker.ExecuteWriteAsync(
+                _driver.DriverInstanceId,
+                isIdempotent,
+                async ct => (IReadOnlyList<WriteResult>)await _writable.WriteAsync(
+                    [new DriverWriteRequest(fullRef!, capturedValue)],
+                    ct).ConfigureAwait(false),
+                CancellationToken.None).AsTask().GetAwaiter().GetResult();
             if (results.Count > 0 && results[0].StatusCode != 0)
             {
                 statusCode = results[0].StatusCode;
@@ -384,4 +421,394 @@ public sealed class DriverNodeManager : CustomNodeManager2, IAddressSpaceBuilder
     internal int VariableCount => _variablesByFullRef.Count;
     internal bool TryGetVariable(string fullRef, out BaseDataVariableState? v)
         => _variablesByFullRef.TryGetValue(fullRef, out v!);
+
+    // ===================== HistoryRead service handlers (LMX #1, PR 38) =====================
+    //
+    // Wires the driver's IHistoryProvider capability (PR 35 added ReadAtTimeAsync / ReadEventsAsync
+    // alongside the PR 19 ReadRawAsync / ReadProcessedAsync) to the OPC UA HistoryRead service.
+    // CustomNodeManager2 has four protected per-kind hooks; the base dispatches to the right one
+    // based on the concrete HistoryReadDetails subtype. Each hook is sync-returning-void — the
+    // per-driver async calls are bridged via GetAwaiter().GetResult(), matching the pattern
+    // OnReadValue / OnWriteValue already use in this class so HistoryRead doesn't introduce a
+    // different sync-over-async convention.
+    //
+    // Per-node routing: every HistoryReadValueId in nodesToRead has a NodeHandle in
+    // nodesToProcess; the NodeHandle's NodeId.Identifier is the driver-side full reference
+    // (set during Variable() registration) so we can dispatch straight to IHistoryProvider
+    // without a second lookup. Nodes without IHistoryProvider backing (drivers that don't
+    // implement the capability) surface BadHistoryOperationUnsupported per slot and the
+    // rest of the batch continues — same failure-isolation pattern as OnWriteValue.
+    //
+    // Continuation-point handling is pass-through only in this PR: the driver returns null
+    // from its ContinuationPoint field today so the outer result's ContinuationPoint stays
+    // empty. Full Session.SaveHistoryContinuationPoint plumbing is a follow-up when a driver
+    // actually needs paging — the dispatch shape doesn't change, only the result-population.
+
+    private IHistoryProvider? History => _driver as IHistoryProvider;
+
+    protected override void HistoryReadRawModified(
+        ServerSystemContext context, ReadRawModifiedDetails details, TimestampsToReturn timestamps,
+        IList<HistoryReadValueId> nodesToRead, IList<OpcHistoryReadResult> results,
+        IList<ServiceResult> errors, List<NodeHandle> nodesToProcess,
+        IDictionary<NodeId, NodeState> cache)
+    {
+        if (History is null)
+        {
+            MarkAllUnsupported(nodesToProcess, results, errors);
+            return;
+        }
+
+        // IsReadModified=true requests a "modifications" history (who changed the data, when
+        // it was re-written). The driver side has no modifications store — surface that
+        // explicitly rather than silently returning raw data, which would mislead the client.
+        if (details.IsReadModified)
+        {
+            MarkAllUnsupported(nodesToProcess, results, errors, StatusCodes.BadHistoryOperationUnsupported);
+            return;
+        }
+
+        for (var n = 0; n < nodesToProcess.Count; n++)
+        {
+            var handle = nodesToProcess[n];
+            // NodeHandle.Index points back to the slot in the outer results/errors/nodesToRead
+            // arrays. nodesToProcess is the filtered subset (just the nodes this manager
+            // claimed), so writing to results[n] lands in the wrong slot when N > 1 and nodes
+            // are interleaved across multiple node managers.
+            var i = handle.Index;
+            var fullRef = ResolveFullRef(handle);
+            if (fullRef is null)
+            {
+                WriteNodeIdUnknown(results, errors, i);
+                continue;
+            }
+
+            try
+            {
+                var driverResult = _invoker.ExecuteAsync(
+                    DriverCapability.HistoryRead,
+                    _driver.DriverInstanceId,
+                    async ct => await History.ReadRawAsync(
+                        fullRef,
+                        details.StartTime,
+                        details.EndTime,
+                        details.NumValuesPerNode,
+                        ct).ConfigureAwait(false),
+                    CancellationToken.None).AsTask().GetAwaiter().GetResult();
+
+                WriteResult(results, errors, i, StatusCodes.Good,
+                    BuildHistoryData(driverResult.Samples), driverResult.ContinuationPoint);
+            }
+            catch (NotSupportedException)
+            {
+                WriteUnsupported(results, errors, i);
+            }
+            catch (Exception ex)
+            {
+                _logger.LogWarning(ex, "HistoryReadRaw failed for {FullRef}", fullRef);
+                WriteInternalError(results, errors, i);
+            }
+        }
+    }
+
+    protected override void HistoryReadProcessed(
+        ServerSystemContext context, ReadProcessedDetails details, TimestampsToReturn timestamps,
+        IList<HistoryReadValueId> nodesToRead, IList<OpcHistoryReadResult> results,
+        IList<ServiceResult> errors, List<NodeHandle> nodesToProcess,
+        IDictionary<NodeId, NodeState> cache)
+    {
+        if (History is null)
+        {
+            MarkAllUnsupported(nodesToProcess, results, errors);
+            return;
+        }
+
+        // AggregateType is one NodeId shared across every item in the batch — map once.
+        var aggregate = MapAggregate(details.AggregateType?.FirstOrDefault());
+        if (aggregate is null)
+        {
+            MarkAllUnsupported(nodesToProcess, results, errors, StatusCodes.BadAggregateNotSupported);
+            return;
+        }
+
+        var interval = TimeSpan.FromMilliseconds(details.ProcessingInterval);
+        for (var n = 0; n < nodesToProcess.Count; n++)
+        {
+            var handle = nodesToProcess[n];
+            // NodeHandle.Index points back to the slot in the outer results/errors/nodesToRead
+            // arrays. nodesToProcess is the filtered subset (just the nodes this manager
+            // claimed), so writing to results[n] lands in the wrong slot when N > 1 and nodes
+            // are interleaved across multiple node managers.
+            var i = handle.Index;
+            var fullRef = ResolveFullRef(handle);
+            if (fullRef is null)
+            {
+                WriteNodeIdUnknown(results, errors, i);
+                continue;
+            }
+
+            try
+            {
+                var driverResult = _invoker.ExecuteAsync(
+                    DriverCapability.HistoryRead,
+                    _driver.DriverInstanceId,
+                    async ct => await History.ReadProcessedAsync(
+                        fullRef,
+                        details.StartTime,
+                        details.EndTime,
+                        interval,
+                        aggregate.Value,
+                        ct).ConfigureAwait(false),
+                    CancellationToken.None).AsTask().GetAwaiter().GetResult();
+
+                WriteResult(results, errors, i, StatusCodes.Good,
+                    BuildHistoryData(driverResult.Samples), driverResult.ContinuationPoint);
+            }
+            catch (NotSupportedException)
+            {
+                WriteUnsupported(results, errors, i);
+            }
+            catch (Exception ex)
+            {
+                _logger.LogWarning(ex, "HistoryReadProcessed failed for {FullRef}", fullRef);
+                WriteInternalError(results, errors, i);
+            }
+        }
+    }
+
+    protected override void HistoryReadAtTime(
+        ServerSystemContext context, ReadAtTimeDetails details, TimestampsToReturn timestamps,
+        IList<HistoryReadValueId> nodesToRead, IList<OpcHistoryReadResult> results,
+        IList<ServiceResult> errors, List<NodeHandle> nodesToProcess,
+        IDictionary<NodeId, NodeState> cache)
+    {
+        if (History is null)
+        {
+            MarkAllUnsupported(nodesToProcess, results, errors);
+            return;
+        }
+
+        var requestedTimes = (IReadOnlyList<DateTime>)(details.ReqTimes?.ToArray() ?? Array.Empty<DateTime>());
+        for (var n = 0; n < nodesToProcess.Count; n++)
+        {
+            var handle = nodesToProcess[n];
+            // NodeHandle.Index points back to the slot in the outer results/errors/nodesToRead
+            // arrays. nodesToProcess is the filtered subset (just the nodes this manager
+            // claimed), so writing to results[n] lands in the wrong slot when N > 1 and nodes
+            // are interleaved across multiple node managers.
+            var i = handle.Index;
+            var fullRef = ResolveFullRef(handle);
+            if (fullRef is null)
+            {
+                WriteNodeIdUnknown(results, errors, i);
+                continue;
+            }
+
+            try
+            {
+                var driverResult = _invoker.ExecuteAsync(
+                    DriverCapability.HistoryRead,
+                    _driver.DriverInstanceId,
+                    async ct => await History.ReadAtTimeAsync(fullRef, requestedTimes, ct).ConfigureAwait(false),
+                    CancellationToken.None).AsTask().GetAwaiter().GetResult();
+
+                WriteResult(results, errors, i, StatusCodes.Good,
+                    BuildHistoryData(driverResult.Samples), driverResult.ContinuationPoint);
+            }
+            catch (NotSupportedException)
+            {
+                WriteUnsupported(results, errors, i);
+            }
+            catch (Exception ex)
+            {
+                _logger.LogWarning(ex, "HistoryReadAtTime failed for {FullRef}", fullRef);
+                WriteInternalError(results, errors, i);
+            }
+        }
+    }
+
+    protected override void HistoryReadEvents(
+        ServerSystemContext context, ReadEventDetails details, TimestampsToReturn timestamps,
+        IList<HistoryReadValueId> nodesToRead, IList<OpcHistoryReadResult> results,
+        IList<ServiceResult> errors, List<NodeHandle> nodesToProcess,
+        IDictionary<NodeId, NodeState> cache)
+    {
+        if (History is null)
+        {
+            MarkAllUnsupported(nodesToProcess, results, errors);
+            return;
+        }
+
+        // SourceName filter extraction is deferred — EventFilter SelectClauses + WhereClause
+        // handling is a dedicated concern (proper per-select-clause Variant population + where
+        // filter evaluation). This PR treats the event query as "all events in range for the
+        // node's source" and populates only the standard BaseEventType fields. Richer filter
+        // handling is a follow-up; clients issuing empty/default filters get the right answer
+        // today which covers the common alarm-history browse case.
+        var maxEvents = (int)details.NumValuesPerNode;
+        if (maxEvents <= 0) maxEvents = 1000;
+
+        for (var n = 0; n < nodesToProcess.Count; n++)
+        {
+            var handle = nodesToProcess[n];
+            // NodeHandle.Index points back to the slot in the outer results/errors/nodesToRead
+            // arrays. nodesToProcess is the filtered subset (just the nodes this manager
+            // claimed), so writing to results[n] lands in the wrong slot when N > 1 and nodes
+            // are interleaved across multiple node managers.
+            var i = handle.Index;
+            // Event history queries may target a notifier object (e.g. the driver-root folder)
+            // rather than a specific variable — in that case we pass sourceName=null to mean
+            // "all sources in the driver's namespace" per the IHistoryProvider contract.
+            var fullRef = ResolveFullRef(handle);
+
+            try
+            {
+                var driverResult = _invoker.ExecuteAsync(
+                    DriverCapability.HistoryRead,
+                    _driver.DriverInstanceId,
+                    async ct => await History.ReadEventsAsync(
+                        sourceName: fullRef,
+                        startUtc: details.StartTime,
+                        endUtc: details.EndTime,
+                        maxEvents: maxEvents,
+                        cancellationToken: ct).ConfigureAwait(false),
+                    CancellationToken.None).AsTask().GetAwaiter().GetResult();
+
+                WriteResult(results, errors, i, StatusCodes.Good,
+                    BuildHistoryEvent(driverResult.Events), driverResult.ContinuationPoint);
+            }
+            catch (NotSupportedException)
+            {
+                WriteUnsupported(results, errors, i);
+            }
+            catch (Exception ex)
+            {
+                _logger.LogWarning(ex, "HistoryReadEvents failed for {FullRef}", fullRef);
+                WriteInternalError(results, errors, i);
+            }
+        }
+    }
+
+    private string? ResolveFullRef(NodeHandle handle) => handle.NodeId?.Identifier as string;
+
+    // Both the results list AND the parallel errors list must be populated — MasterNodeManager
+    // merges them and the merged StatusCode is what the client sees. Leaving errors[i] at its
+    // default (BadHistoryOperationUnsupported) overrides a Good result with Unsupported, which
+    // masks a correctly-constructed HistoryData response. This was the subtle failure mode
+    // that cost most of PR 38's debugging budget.
+    private static void WriteResult(IList<OpcHistoryReadResult> results, IList<ServiceResult> errors,
+        int i, uint statusCode, ExtensionObject historyData, byte[]? continuationPoint)
+    {
+        results[i] = new OpcHistoryReadResult
+        {
+            StatusCode = statusCode,
+            HistoryData = historyData,
+            ContinuationPoint = continuationPoint,
+        };
+        errors[i] = statusCode == StatusCodes.Good
+            ? ServiceResult.Good
+            : new ServiceResult(statusCode);
+    }
+
+    private static void WriteUnsupported(IList<OpcHistoryReadResult> results, IList<ServiceResult> errors, int i)
+    {
+        results[i] = new OpcHistoryReadResult { StatusCode = StatusCodes.BadHistoryOperationUnsupported };
+        errors[i] = StatusCodes.BadHistoryOperationUnsupported;
+    }
+
+    private static void WriteInternalError(IList<OpcHistoryReadResult> results, IList<ServiceResult> errors, int i)
+    {
+        results[i] = new OpcHistoryReadResult { StatusCode = StatusCodes.BadInternalError };
+        errors[i] = StatusCodes.BadInternalError;
+    }
+
+    private static void WriteNodeIdUnknown(IList<OpcHistoryReadResult> results, IList<ServiceResult> errors, int i)
+    {
+        WriteNodeIdUnknown(results, errors, i);
+        errors[i] = StatusCodes.BadNodeIdUnknown;
+    }
+
+    private static void MarkAllUnsupported(
+        List<NodeHandle> nodes, IList<OpcHistoryReadResult> results, IList<ServiceResult> errors,
+        uint statusCode = StatusCodes.BadHistoryOperationUnsupported)
+    {
+        foreach (var handle in nodes)
+        {
+            results[handle.Index] = new OpcHistoryReadResult { StatusCode = statusCode };
+            errors[handle.Index] = statusCode == StatusCodes.Good ? ServiceResult.Good : new ServiceResult(statusCode);
+        }
+    }
+
+    /// <summary>
+    ///     Map the OPC UA Part 13 aggregate-function NodeId to the driver's
+    ///     <see cref="HistoryAggregateType"/>. Internal so the test suite can pin the mapping
+    ///     without exposing public API. Returns null for unsupported aggregates so the service
+    ///     handler can surface <c>BadAggregateNotSupported</c> on the whole batch.
+    /// </summary>
+    internal static HistoryAggregateType? MapAggregate(NodeId? aggregateNodeId)
+    {
+        if (aggregateNodeId is null) return null;
+
+        // Every AggregateFunction_* identifier is a numeric uint on the Server (0) namespace.
+        // Comparing NodeIds by value handles all the cross-encoding cases (expanded vs plain).
+        if (aggregateNodeId == ObjectIds.AggregateFunction_Average) return HistoryAggregateType.Average;
+        if (aggregateNodeId == ObjectIds.AggregateFunction_Minimum) return HistoryAggregateType.Minimum;
+        if (aggregateNodeId == ObjectIds.AggregateFunction_Maximum) return HistoryAggregateType.Maximum;
+        if (aggregateNodeId == ObjectIds.AggregateFunction_Total) return HistoryAggregateType.Total;
+        if (aggregateNodeId == ObjectIds.AggregateFunction_Count) return HistoryAggregateType.Count;
+        return null;
+    }
+
+    /// <summary>
+    ///     Wrap driver samples as <c>HistoryData</c> in an <c>ExtensionObject</c> — the on-wire
+    ///     shape the OPC UA HistoryRead service expects for raw / processed / at-time reads.
+    /// </summary>
+    internal static ExtensionObject BuildHistoryData(IReadOnlyList<DataValueSnapshot> samples)
+    {
+        var values = new DataValueCollection(samples.Count);
+        foreach (var s in samples) values.Add(ToDataValue(s));
+        return new ExtensionObject(new HistoryData { DataValues = values });
+    }
+
+    /// <summary>
+    ///     Wrap driver events as <c>HistoryEvent</c> in an <c>ExtensionObject</c>. Populates
+    ///     the minimum BaseEventType field set (SourceName, Message, Severity, Time,
+    ///     ReceiveTime, EventId) so clients that request the default
+    ///     <c>SimpleAttributeOperand</c> select-clauses see useful data. Custom EventFilter
+    ///     SelectClause evaluation is deferred — when a client sends a specific operand list,
+    ///     they currently get the standard fields back and ignore the extras. Documented on the
+    ///     public follow-up list.
+    /// </summary>
+    internal static ExtensionObject BuildHistoryEvent(IReadOnlyList<HistoricalEvent> events)
+    {
+        var fieldLists = new HistoryEventFieldListCollection(events.Count);
+        foreach (var e in events)
+        {
+            var fields = new VariantCollection
+            {
+                // Order must match BaseEventType's conventional field ordering so clients that
+                // didn't customize the SelectClauses still see recognizable columns. A future
+                // PR that respects the client's SelectClause list will drive this from the filter.
+                new Variant(e.EventId),
+                new Variant(e.SourceName ?? string.Empty),
+                new Variant(new LocalizedText(e.Message ?? string.Empty)),
+                new Variant(e.Severity),
+                new Variant(e.EventTimeUtc),
+                new Variant(e.ReceivedTimeUtc),
+            };
+            fieldLists.Add(new HistoryEventFieldList { EventFields = fields });
+        }
+        return new ExtensionObject(new HistoryEvent { Events = fieldLists });
+    }
+
+    internal static DataValue ToDataValue(DataValueSnapshot s)
+    {
+        var dv = new DataValue
+        {
+            Value = s.Value,
+            StatusCode = new StatusCode(s.StatusCode),
+            ServerTimestamp = s.ServerTimestampUtc,
+        };
+        if (s.SourceTimestampUtc.HasValue) dv.SourceTimestamp = s.SourceTimestampUtc.Value;
+        return dv;
+    }
 }

src/ZB.MOM.WW.OtOpcUa.Server/OpcUa/OpcUaApplicationHost.cs

@@ -3,6 +3,8 @@ using Opc.Ua;
 using Opc.Ua.Configuration;
 using ZB.MOM.WW.OtOpcUa.Core.Hosting;
 using ZB.MOM.WW.OtOpcUa.Core.OpcUa;
+using ZB.MOM.WW.OtOpcUa.Core.Resilience;
+using ZB.MOM.WW.OtOpcUa.Server.Observability;
 using ZB.MOM.WW.OtOpcUa.Server.Security;
 
 namespace ZB.MOM.WW.OtOpcUa.Server.OpcUa;
@@ -20,18 +22,22 @@ public sealed class OpcUaApplicationHost : IAsyncDisposable
     private readonly OpcUaServerOptions _options;
     private readonly DriverHost _driverHost;
     private readonly IUserAuthenticator _authenticator;
+    private readonly DriverResiliencePipelineBuilder _pipelineBuilder;
     private readonly ILoggerFactory _loggerFactory;
     private readonly ILogger<OpcUaApplicationHost> _logger;
     private ApplicationInstance? _application;
     private OtOpcUaServer? _server;
+    private HealthEndpointsHost? _healthHost;
     private bool _disposed;
 
     public OpcUaApplicationHost(OpcUaServerOptions options, DriverHost driverHost,
-        IUserAuthenticator authenticator, ILoggerFactory loggerFactory, ILogger<OpcUaApplicationHost> logger)
+        IUserAuthenticator authenticator, ILoggerFactory loggerFactory, ILogger<OpcUaApplicationHost> logger,
+        DriverResiliencePipelineBuilder? pipelineBuilder = null)
     {
         _options = options;
         _driverHost = driverHost;
         _authenticator = authenticator;
+        _pipelineBuilder = pipelineBuilder ?? new DriverResiliencePipelineBuilder();
         _loggerFactory = loggerFactory;
         _logger = logger;
     }
@@ -58,12 +64,23 @@ public sealed class OpcUaApplicationHost : IAsyncDisposable
             throw new InvalidOperationException(
                 $"OPC UA application certificate could not be validated or created in {_options.PkiStoreRoot}");
 
-        _server = new OtOpcUaServer(_driverHost, _authenticator, _loggerFactory);
+        _server = new OtOpcUaServer(_driverHost, _authenticator, _pipelineBuilder, _loggerFactory);
         await _application.Start(_server).ConfigureAwait(false);
 
         _logger.LogInformation("OPC UA server started — endpoint={Endpoint} driverCount={Count}",
             _options.EndpointUrl, _server.DriverNodeManagers.Count);
 
+        // Phase 6.1 Stream C: health endpoints on :4841 (loopback by default — see
+        // HealthEndpointsHost remarks for the Windows URL-ACL tradeoff).
+        if (_options.HealthEndpointsEnabled)
+        {
+            _healthHost = new HealthEndpointsHost(
+                _driverHost,
+                _loggerFactory.CreateLogger<HealthEndpointsHost>(),
+                prefix: _options.HealthEndpointsPrefix);
+            _healthHost.Start();
+        }
+
         // Drive each driver's discovery through its node manager. The node manager IS the
         // IAddressSpaceBuilder; GenericDriverNodeManager captures alarm-condition sinks into
         // its internal map and wires OnAlarmEvent → sink routing.
@@ -217,6 +234,12 @@ public sealed class OpcUaApplicationHost : IAsyncDisposable
         {
             _logger.LogWarning(ex, "OPC UA server stop threw during dispose");
         }
+
+        if (_healthHost is not null)
+        {
+            try { await _healthHost.DisposeAsync().ConfigureAwait(false); }
+            catch (Exception ex) { _logger.LogWarning(ex, "Health endpoints host dispose threw"); }
+        }
         await Task.CompletedTask;
     }
 }

src/ZB.MOM.WW.OtOpcUa.Server/OpcUa/OpcUaServerOptions.cs

@@ -58,6 +58,20 @@ public sealed class OpcUaServerOptions
     /// </summary>
     public bool AutoAcceptUntrustedClientCertificates { get; init; } = true;
 
+    /// <summary>
+    ///     Whether to start the Phase 6.1 Stream C <c>/healthz</c> + <c>/readyz</c> HTTP listener.
+    ///     Defaults to <c>true</c>; set false in embedded deployments that don't need HTTP
+    ///     (e.g. tests that only exercise the OPC UA surface).
+    /// </summary>
+    public bool HealthEndpointsEnabled { get; init; } = true;
+
+    /// <summary>
+    ///     URL prefix the health endpoints bind to. Default <c>http://localhost:4841/</c> — loopback
+    ///     avoids Windows URL-ACL elevation. Production deployments that need remote probing should
+    ///     either reverse-proxy or use <c>http://+:4841/</c> with netsh urlacl granted.
+    /// </summary>
+    public string HealthEndpointsPrefix { get; init; } = "http://localhost:4841/";
+
     /// <summary>
     ///     Security profile advertised on the endpoint. Default <see cref="OpcUaSecurityProfile.None"/>
     ///     preserves the PR 17 endpoint shape; set to <see cref="OpcUaSecurityProfile.Basic256Sha256SignAndEncrypt"/>

src/ZB.MOM.WW.OtOpcUa.Server/OpcUa/OtOpcUaServer.cs

@@ -5,6 +5,7 @@ using Opc.Ua.Server;
 using ZB.MOM.WW.OtOpcUa.Core.Abstractions;
 using ZB.MOM.WW.OtOpcUa.Core.Hosting;
 using ZB.MOM.WW.OtOpcUa.Core.OpcUa;
+using ZB.MOM.WW.OtOpcUa.Core.Resilience;
 using ZB.MOM.WW.OtOpcUa.Server.Security;
 
 namespace ZB.MOM.WW.OtOpcUa.Server.OpcUa;
@@ -19,13 +20,19 @@ public sealed class OtOpcUaServer : StandardServer
 {
     private readonly DriverHost _driverHost;
     private readonly IUserAuthenticator _authenticator;
+    private readonly DriverResiliencePipelineBuilder _pipelineBuilder;
     private readonly ILoggerFactory _loggerFactory;
     private readonly List<DriverNodeManager> _driverNodeManagers = new();
 
-    public OtOpcUaServer(DriverHost driverHost, IUserAuthenticator authenticator, ILoggerFactory loggerFactory)
+    public OtOpcUaServer(
+        DriverHost driverHost,
+        IUserAuthenticator authenticator,
+        DriverResiliencePipelineBuilder pipelineBuilder,
+        ILoggerFactory loggerFactory)
     {
         _driverHost = driverHost;
         _authenticator = authenticator;
+        _pipelineBuilder = pipelineBuilder;
         _loggerFactory = loggerFactory;
     }
 
@@ -46,7 +53,12 @@ public sealed class OtOpcUaServer : StandardServer
             if (driver is null) continue;
 
             var logger = _loggerFactory.CreateLogger<DriverNodeManager>();
-            var manager = new DriverNodeManager(server, configuration, driver, logger);
+            // Per-driver resilience options: default Tier A pending Stream B.1 which wires
+            // per-type tiers into DriverTypeRegistry. Read ResilienceConfig JSON from the
+            // DriverInstance row in a follow-up PR; for now every driver gets Tier A defaults.
+            var options = new DriverResilienceOptions { Tier = DriverTier.A };
+            var invoker = new CapabilityInvoker(_pipelineBuilder, driver.DriverInstanceId, () => options, driver.DriverType);
+            var manager = new DriverNodeManager(server, configuration, driver, invoker, logger);
             _driverNodeManagers.Add(manager);
         }
 

src/ZB.MOM.WW.OtOpcUa.Server/Program.cs

@@ -4,6 +4,7 @@ using Microsoft.Extensions.DependencyInjection;
 using Microsoft.Extensions.Hosting;
 using Microsoft.Extensions.Logging;
 using Serilog;
+using Serilog.Formatting.Compact;
 using ZB.MOM.WW.OtOpcUa.Configuration;
 using ZB.MOM.WW.OtOpcUa.Configuration.LocalCache;
 using ZB.MOM.WW.OtOpcUa.Core.Hosting;
@@ -13,11 +14,25 @@ using ZB.MOM.WW.OtOpcUa.Server.Security;
 
 var builder = Host.CreateApplicationBuilder(args);
 
-Log.Logger = new LoggerConfiguration()
+// Per Phase 6.1 Stream C.3: SIEMs (Splunk, Datadog) ingest the JSON file without a
+// regex parser. Plain-text rolling file stays on by default for human readability;
+// JSON file is opt-in via appsetting `Serilog:WriteJson = true`.
+var writeJson = builder.Configuration.GetValue<bool>("Serilog:WriteJson");
+var loggerBuilder = new LoggerConfiguration()
     .ReadFrom.Configuration(builder.Configuration)
+    .Enrich.FromLogContext()
     .WriteTo.Console()
-    .WriteTo.File("logs/otopcua-.log", rollingInterval: RollingInterval.Day)
-    .CreateLogger();
+    .WriteTo.File("logs/otopcua-.log", rollingInterval: RollingInterval.Day);
+
+if (writeJson)
+{
+    loggerBuilder = loggerBuilder.WriteTo.File(
+        new CompactJsonFormatter(),
+        "logs/otopcua-.json.log",
+        rollingInterval: RollingInterval.Day);
+}
+
+Log.Logger = loggerBuilder.CreateLogger();
 
 builder.Services.AddSerilog();
 builder.Services.AddWindowsService(o => o.ServiceName = "OtOpcUa");

src/ZB.MOM.WW.OtOpcUa.Server/Redundancy/ApplyLeaseRegistry.cs

@@ -0,0 +1,85 @@
+using System.Collections.Concurrent;
+
+namespace ZB.MOM.WW.OtOpcUa.Server.Redundancy;
+
+/// <summary>
+///     Tracks in-progress publish-generation apply leases keyed on
+///     <c>(ConfigGenerationId, PublishRequestId)</c>. Per decision #162 a sealed lease pattern
+///     ensures <see cref="IsApplyInProgress"/> reflects every exit path (success / exception /
+///     cancellation) because the IAsyncDisposable returned by <see cref="BeginApplyLease"/>
+///     decrements unconditionally.
+/// </summary>
+/// <remarks>
+///     A watchdog loop calls <see cref="PruneStale"/> periodically with the configured
+///     <see cref="ApplyMaxDuration"/>; any lease older than that is force-closed so a crashed
+///     publisher can't pin the node at <see cref="ServiceLevelBand.PrimaryMidApply"/>.
+/// </remarks>
+public sealed class ApplyLeaseRegistry
+{
+    private readonly ConcurrentDictionary<LeaseKey, DateTime> _leases = new();
+    private readonly TimeProvider _timeProvider;
+
+    public TimeSpan ApplyMaxDuration { get; }
+
+    public ApplyLeaseRegistry(TimeSpan? applyMaxDuration = null, TimeProvider? timeProvider = null)
+    {
+        ApplyMaxDuration = applyMaxDuration ?? TimeSpan.FromMinutes(10);
+        _timeProvider = timeProvider ?? TimeProvider.System;
+    }
+
+    /// <summary>
+    ///     Register a new lease. Returns an <see cref="IAsyncDisposable"/> whose disposal
+    ///     decrements the registry; use <c>await using</c> in the caller so every exit path
+    ///     closes the lease.
+    /// </summary>
+    public IAsyncDisposable BeginApplyLease(long generationId, Guid publishRequestId)
+    {
+        var key = new LeaseKey(generationId, publishRequestId);
+        _leases[key] = _timeProvider.GetUtcNow().UtcDateTime;
+        return new LeaseScope(this, key);
+    }
+
+    /// <summary>True when at least one apply lease is currently open.</summary>
+    public bool IsApplyInProgress => !_leases.IsEmpty;
+
+    /// <summary>Current open-lease count — diagnostics only.</summary>
+    public int OpenLeaseCount => _leases.Count;
+
+    /// <summary>Force-close any lease older than <see cref="ApplyMaxDuration"/>. Watchdog tick.</summary>
+    /// <returns>Number of leases the watchdog closed on this tick.</returns>
+    public int PruneStale()
+    {
+        var now = _timeProvider.GetUtcNow().UtcDateTime;
+        var closed = 0;
+        foreach (var kv in _leases)
+        {
+            if (now - kv.Value > ApplyMaxDuration && _leases.TryRemove(kv.Key, out _))
+                closed++;
+        }
+        return closed;
+    }
+
+    private void Release(LeaseKey key) => _leases.TryRemove(key, out _);
+
+    private readonly record struct LeaseKey(long GenerationId, Guid PublishRequestId);
+
+    private sealed class LeaseScope : IAsyncDisposable
+    {
+        private readonly ApplyLeaseRegistry _owner;
+        private readonly LeaseKey _key;
+        private int _disposed;
+
+        public LeaseScope(ApplyLeaseRegistry owner, LeaseKey key)
+        {
+            _owner = owner;
+            _key = key;
+        }
+
+        public ValueTask DisposeAsync()
+        {
+            if (Interlocked.Exchange(ref _disposed, 1) == 0)
+                _owner.Release(_key);
+            return ValueTask.CompletedTask;
+        }
+    }
+}

src/ZB.MOM.WW.OtOpcUa.Server/Redundancy/RecoveryStateManager.cs

@@ -0,0 +1,65 @@
+namespace ZB.MOM.WW.OtOpcUa.Server.Redundancy;
+
+/// <summary>
+///     Tracks the Recovering-band dwell for a node after a <c>Faulted → Healthy</c> transition.
+///     Per decision #154 and Phase 6.3 Stream B.4 a node that has just returned to health stays
+///     in the Recovering band (180 Primary / 30 Backup) until BOTH: (a) the configured
+///     <see cref="DwellTime"/> has elapsed, AND (b) at least one successful publish-witness
+///     read has been observed.
+/// </summary>
+/// <remarks>
+///     Purely in-memory, no I/O. The coordinator feeds events into <see cref="MarkFaulted"/>,
+///     <see cref="MarkRecovered"/>, and <see cref="RecordPublishWitness"/>; <see cref="IsDwellMet"/>
+///     becomes true only after both conditions converge.
+/// </remarks>
+public sealed class RecoveryStateManager
+{
+    private readonly TimeSpan _dwellTime;
+    private readonly TimeProvider _timeProvider;
+
+    /// <summary>Last time the node transitioned Faulted → Healthy. Null until first recovery.</summary>
+    private DateTime? _recoveredUtc;
+
+    /// <summary>True once a publish-witness read has succeeded after the last recovery.</summary>
+    private bool _witnessed;
+
+    public TimeSpan DwellTime => _dwellTime;
+
+    public RecoveryStateManager(TimeSpan? dwellTime = null, TimeProvider? timeProvider = null)
+    {
+        _dwellTime = dwellTime ?? TimeSpan.FromSeconds(60);
+        _timeProvider = timeProvider ?? TimeProvider.System;
+    }
+
+    /// <summary>Report that the node has entered the Faulted state.</summary>
+    public void MarkFaulted()
+    {
+        _recoveredUtc = null;
+        _witnessed = false;
+    }
+
+    /// <summary>Report that the node has transitioned Faulted → Healthy; dwell clock starts now.</summary>
+    public void MarkRecovered()
+    {
+        _recoveredUtc = _timeProvider.GetUtcNow().UtcDateTime;
+        _witnessed = false;
+    }
+
+    /// <summary>Report a successful publish-witness read.</summary>
+    public void RecordPublishWitness() => _witnessed = true;
+
+    /// <summary>
+    ///     True when the dwell is considered met: either the node never faulted in the first
+    ///     place, or both (dwell time elapsed + publish witness recorded) since the last
+    ///     recovery. False means the coordinator should report Recovering-band ServiceLevel.
+    /// </summary>
+    public bool IsDwellMet()
+    {
+        if (_recoveredUtc is null) return true; // never faulted → dwell N/A
+
+        if (!_witnessed) return false;
+
+        var elapsed = _timeProvider.GetUtcNow().UtcDateTime - _recoveredUtc.Value;
+        return elapsed >= _dwellTime;
+    }
+}

src/ZB.MOM.WW.OtOpcUa.Server/Redundancy/ServiceLevelCalculator.cs

@@ -0,0 +1,131 @@
+using ZB.MOM.WW.OtOpcUa.Configuration.Enums;
+
+namespace ZB.MOM.WW.OtOpcUa.Server.Redundancy;
+
+/// <summary>
+///     Pure-function translator from the redundancy-state inputs (role, self health, peer
+///     reachability via HTTP + UA probes, apply-in-progress flag, recovery dwell, topology
+///     validity) to the OPC UA Part 5 §6.3.34 <see cref="byte"/> ServiceLevel value.
+/// </summary>
+/// <remarks>
+///     <para>Per decision #154 the 8-state matrix avoids the reserved bands (0=Maintenance,
+///     1=NoData) for operational states. Operational values occupy 2..255 so a spec-compliant
+///     client that cuts over on "&lt;3 = unhealthy" keeps working without its vendor treating
+///     the server as "under maintenance" during normal runtime.</para>
+///
+///     <para>This class is pure — no threads, no I/O. The coordinator that owns it re-evaluates
+///     on every input change and pushes the new byte through an <c>IObserver&lt;byte&gt;</c> to
+///     the OPC UA ServiceLevel variable. Tests exercise the full matrix without touching a UA
+///     stack.</para>
+/// </remarks>
+public static class ServiceLevelCalculator
+{
+    /// <summary>Compute the ServiceLevel for the given inputs.</summary>
+    /// <param name="role">Role declared for this node in the shared config DB.</param>
+    /// <param name="selfHealthy">This node's own health (from Phase 6.1 /healthz).</param>
+    /// <param name="peerUaHealthy">Peer node reachable via OPC UA probe.</param>
+    /// <param name="peerHttpHealthy">Peer node reachable via HTTP /healthz probe.</param>
+    /// <param name="applyInProgress">True while this node is inside a publish-generation apply window.</param>
+    /// <param name="recoveryDwellMet">True once the post-fault dwell + publish-witness conditions are met.</param>
+    /// <param name="topologyValid">False when the cluster has detected &gt;1 Primary (InvalidTopology demotes both nodes).</param>
+    /// <param name="operatorMaintenance">True when operator has declared the node in maintenance.</param>
+    public static byte Compute(
+        RedundancyRole role,
+        bool selfHealthy,
+        bool peerUaHealthy,
+        bool peerHttpHealthy,
+        bool applyInProgress,
+        bool recoveryDwellMet,
+        bool topologyValid,
+        bool operatorMaintenance = false)
+    {
+        // Reserved bands first — they override everything per OPC UA Part 5 §6.3.34.
+        if (operatorMaintenance) return (byte)ServiceLevelBand.Maintenance;       // 0
+        if (!selfHealthy)        return (byte)ServiceLevelBand.NoData;            // 1
+        if (!topologyValid)      return (byte)ServiceLevelBand.InvalidTopology;   // 2
+
+        // Standalone nodes have no peer — treat as authoritative when healthy.
+        if (role == RedundancyRole.Standalone)
+            return (byte)(applyInProgress ? ServiceLevelBand.PrimaryMidApply : ServiceLevelBand.AuthoritativePrimary);
+
+        var isPrimary = role == RedundancyRole.Primary;
+
+        // Apply-in-progress band dominates recovery + isolation (client should cut to peer).
+        if (applyInProgress)
+            return (byte)(isPrimary ? ServiceLevelBand.PrimaryMidApply : ServiceLevelBand.BackupMidApply);
+
+        // Post-fault recovering — hold until dwell + witness satisfied.
+        if (!recoveryDwellMet)
+            return (byte)(isPrimary ? ServiceLevelBand.RecoveringPrimary : ServiceLevelBand.RecoveringBackup);
+
+        // Peer unreachable (either probe fails) → isolated band. Per decision #154 Primary
+        // retains authority at 230 when isolated; Backup signals 80 "take over if asked" and
+        // does NOT auto-promote (non-transparent model).
+        var peerReachable = peerUaHealthy && peerHttpHealthy;
+        if (!peerReachable)
+            return (byte)(isPrimary ? ServiceLevelBand.IsolatedPrimary : ServiceLevelBand.IsolatedBackup);
+
+        return (byte)(isPrimary ? ServiceLevelBand.AuthoritativePrimary : ServiceLevelBand.AuthoritativeBackup);
+    }
+
+    /// <summary>Labels a ServiceLevel byte with its matrix band name — for logs + Admin UI.</summary>
+    public static ServiceLevelBand Classify(byte value) => value switch
+    {
+        (byte)ServiceLevelBand.Maintenance          => ServiceLevelBand.Maintenance,
+        (byte)ServiceLevelBand.NoData               => ServiceLevelBand.NoData,
+        (byte)ServiceLevelBand.InvalidTopology      => ServiceLevelBand.InvalidTopology,
+        (byte)ServiceLevelBand.RecoveringBackup     => ServiceLevelBand.RecoveringBackup,
+        (byte)ServiceLevelBand.BackupMidApply       => ServiceLevelBand.BackupMidApply,
+        (byte)ServiceLevelBand.IsolatedBackup       => ServiceLevelBand.IsolatedBackup,
+        (byte)ServiceLevelBand.AuthoritativeBackup  => ServiceLevelBand.AuthoritativeBackup,
+        (byte)ServiceLevelBand.RecoveringPrimary    => ServiceLevelBand.RecoveringPrimary,
+        (byte)ServiceLevelBand.PrimaryMidApply      => ServiceLevelBand.PrimaryMidApply,
+        (byte)ServiceLevelBand.IsolatedPrimary      => ServiceLevelBand.IsolatedPrimary,
+        (byte)ServiceLevelBand.AuthoritativePrimary => ServiceLevelBand.AuthoritativePrimary,
+        _ => ServiceLevelBand.Unknown,
+    };
+}
+
+/// <summary>
+///     Named bands of the 8-state ServiceLevel matrix. Numeric values match the
+///     <see cref="ServiceLevelCalculator"/> table exactly; any drift will be caught by the
+///     Phase 6.3 compliance script.
+/// </summary>
+public enum ServiceLevelBand : byte
+{
+    /// <summary>Operator-declared maintenance. Reserved per OPC UA Part 5 §6.3.34.</summary>
+    Maintenance = 0,
+
+    /// <summary>Unreachable / Faulted. Reserved per OPC UA Part 5 §6.3.34.</summary>
+    NoData = 1,
+
+    /// <summary>Detected-inconsistency band — &gt;1 Primary observed runtime; both nodes self-demote.</summary>
+    InvalidTopology = 2,
+
+    /// <summary>Backup post-fault, dwell not met.</summary>
+    RecoveringBackup = 30,
+
+    /// <summary>Backup inside a publish-apply window.</summary>
+    BackupMidApply = 50,
+
+    /// <summary>Backup with unreachable Primary — "take over if asked"; does NOT auto-promote.</summary>
+    IsolatedBackup = 80,
+
+    /// <summary>Backup nominal operation.</summary>
+    AuthoritativeBackup = 100,
+
+    /// <summary>Primary post-fault, dwell not met.</summary>
+    RecoveringPrimary = 180,
+
+    /// <summary>Primary inside a publish-apply window.</summary>
+    PrimaryMidApply = 200,
+
+    /// <summary>Primary with unreachable peer, self serving — retains authority.</summary>
+    IsolatedPrimary = 230,
+
+    /// <summary>Primary nominal operation.</summary>
+    AuthoritativePrimary = 255,
+
+    /// <summary>Sentinel for unrecognised byte values.</summary>
+    Unknown = 254,
+}

src/ZB.MOM.WW.OtOpcUa.Server/Security/AuthorizationGate.cs

@@ -0,0 +1,86 @@
+using Opc.Ua;
+using ZB.MOM.WW.OtOpcUa.Core.Abstractions;
+using ZB.MOM.WW.OtOpcUa.Core.Authorization;
+
+namespace ZB.MOM.WW.OtOpcUa.Server.Security;
+
+/// <summary>
+///     Bridges the OPC UA stack's <see cref="ISystemContext.UserIdentity"/> to the
+///     <see cref="IPermissionEvaluator"/> evaluator. Resolves the session's
+///     <see cref="UserAuthorizationState"/> from whatever the identity claims + the stack's
+///     session handle, then delegates to the evaluator and returns a single bool the
+///     dispatch paths can use to short-circuit with <c>BadUserAccessDenied</c>.
+/// </summary>
+/// <remarks>
+///     <para>This class is deliberately the single integration seam between the Server
+///     project and the <c>Core.Authorization</c> evaluator. DriverNodeManager holds one
+///     reference and calls <see cref="IsAllowed"/> on every Read / Write / HistoryRead /
+///     Browse / Call / CreateMonitoredItems / etc. The evaluator itself stays pure — it
+///     doesn't know about the OPC UA stack types.</para>
+///
+///     <para>Fail-open-during-transition: when the evaluator is configured with
+///     <c>StrictMode = false</c>, missing cluster tries OR sessions without resolved
+///     LDAP groups get <c>true</c> so existing deployments keep working while ACLs are
+///     populated. Flip to strict via <c>Authorization:StrictMode = true</c> in production.</para>
+/// </remarks>
+public sealed class AuthorizationGate
+{
+    private readonly IPermissionEvaluator _evaluator;
+    private readonly bool _strictMode;
+    private readonly TimeProvider _timeProvider;
+
+    public AuthorizationGate(IPermissionEvaluator evaluator, bool strictMode = false, TimeProvider? timeProvider = null)
+    {
+        _evaluator = evaluator ?? throw new ArgumentNullException(nameof(evaluator));
+        _strictMode = strictMode;
+        _timeProvider = timeProvider ?? TimeProvider.System;
+    }
+
+    /// <summary>True when strict authorization is enabled — no-grant = denied.</summary>
+    public bool StrictMode => _strictMode;
+
+    /// <summary>
+    ///     Authorize an OPC UA operation against the session identity + scope. Returns true to
+    ///     allow the dispatch to continue; false to surface <c>BadUserAccessDenied</c>.
+    /// </summary>
+    public bool IsAllowed(IUserIdentity? identity, OpcUaOperation operation, NodeScope scope)
+    {
+        // Anonymous / unknown identity — strict mode denies, lax mode allows so the fallback
+        // auth layers (WriteAuthzPolicy) still see the call.
+        if (identity is null) return !_strictMode;
+
+        var session = BuildSessionState(identity, scope.ClusterId);
+        if (session is null)
+        {
+            // Identity doesn't carry LDAP groups. In lax mode let the dispatch proceed so
+            // older deployments keep working; strict mode denies.
+            return !_strictMode;
+        }
+
+        var decision = _evaluator.Authorize(session, operation, scope);
+        if (decision.IsAllowed) return true;
+
+        return !_strictMode;
+    }
+
+    /// <summary>
+    ///     Materialize a <see cref="UserAuthorizationState"/> from the session identity.
+    ///     Returns null when the identity doesn't carry LDAP group metadata.
+    /// </summary>
+    public UserAuthorizationState? BuildSessionState(IUserIdentity identity, string clusterId)
+    {
+        if (identity is not ILdapGroupsBearer bearer || bearer.LdapGroups.Count == 0)
+            return null;
+
+        var sessionId = identity.DisplayName ?? Guid.NewGuid().ToString("N");
+        return new UserAuthorizationState
+        {
+            SessionId = sessionId,
+            ClusterId = clusterId,
+            LdapGroups = bearer.LdapGroups,
+            MembershipResolvedUtc = _timeProvider.GetUtcNow().UtcDateTime,
+            AuthGenerationId = 0,
+            MembershipVersion = 0,
+        };
+    }
+}

src/ZB.MOM.WW.OtOpcUa.Server/Security/ILdapGroupsBearer.cs

@@ -0,0 +1,20 @@
+namespace ZB.MOM.WW.OtOpcUa.Server.Security;
+
+/// <summary>
+///     Minimal interface an <see cref="Opc.Ua.IUserIdentity"/> exposes so the Phase 6.2
+///     authorization evaluator can read the session's resolved LDAP group DNs without a
+///     hard dependency on any specific identity subtype. Implemented by OtOpcUaServer's
+///     role-based identity; tests stub it to drive the evaluator under different group
+///     memberships.
+/// </summary>
+/// <remarks>
+///     Control/data-plane separation (decision #150): Admin UI role routing consumes
+///     <see cref="IRoleBearer.Roles"/> via <c>LdapGroupRoleMapping</c>; the OPC UA data-path
+///     evaluator consumes <see cref="LdapGroups"/> directly against <c>NodeAcl</c>. The two
+///     are sourced from the same directory query at sign-in but never cross.
+/// </remarks>
+public interface ILdapGroupsBearer
+{
+    /// <summary>Fully-qualified LDAP group DNs the user is a member of.</summary>
+    IReadOnlyList<string> LdapGroups { get; }
+}

src/ZB.MOM.WW.OtOpcUa.Server/ZB.MOM.WW.OtOpcUa.Server.csproj

@@ -21,6 +21,7 @@
         <PackageReference Include="Serilog.Settings.Configuration" Version="9.0.0"/>
         <PackageReference Include="Serilog.Sinks.Console" Version="6.0.0"/>
         <PackageReference Include="Serilog.Sinks.File" Version="7.0.0"/>
+        <PackageReference Include="Serilog.Formatting.Compact" Version="3.0.0"/>
         <PackageReference Include="OPCFoundation.NetStandard.Opc.Ua.Server" Version="1.5.374.126"/>
         <PackageReference Include="OPCFoundation.NetStandard.Opc.Ua.Configuration" Version="1.5.374.126"/>
         <PackageReference Include="Novell.Directory.Ldap.NETStandard" Version="3.6.0"/>

tests/ZB.MOM.WW.OtOpcUa.Admin.Tests/EquipmentCsvImporterTests.cs

@@ -0,0 +1,169 @@
+using Shouldly;
+using Xunit;
+using ZB.MOM.WW.OtOpcUa.Admin.Services;
+
+namespace ZB.MOM.WW.OtOpcUa.Admin.Tests;
+
+[Trait("Category", "Unit")]
+public sealed class EquipmentCsvImporterTests
+{
+    private const string Header =
+        "# OtOpcUaCsv v1\n" +
+        "ZTag,MachineCode,SAPID,EquipmentId,EquipmentUuid,Name,UnsAreaName,UnsLineName";
+
+    [Fact]
+    public void EmptyFile_Throws()
+    {
+        Should.Throw<InvalidCsvFormatException>(() => EquipmentCsvImporter.Parse(""));
+    }
+
+    [Fact]
+    public void MissingVersionMarker_Throws()
+    {
+        var csv = "ZTag,MachineCode,SAPID,EquipmentId,EquipmentUuid,Name,UnsAreaName,UnsLineName\nx,x,x,x,x,x,x,x";
+
+        var ex = Should.Throw<InvalidCsvFormatException>(() => EquipmentCsvImporter.Parse(csv));
+        ex.Message.ShouldContain("# OtOpcUaCsv v1");
+    }
+
+    [Fact]
+    public void MissingRequiredColumn_Throws()
+    {
+        var csv = "# OtOpcUaCsv v1\n" +
+                  "ZTag,MachineCode,SAPID,EquipmentId,Name,UnsAreaName,UnsLineName\n" +
+                  "z1,mc,sap,eq1,Name1,area,line";
+
+        var ex = Should.Throw<InvalidCsvFormatException>(() => EquipmentCsvImporter.Parse(csv));
+        ex.Message.ShouldContain("EquipmentUuid");
+    }
+
+    [Fact]
+    public void UnknownColumn_Throws()
+    {
+        var csv = Header + ",WeirdColumn\nz1,mc,sap,eq1,uu,Name1,area,line,value";
+
+        var ex = Should.Throw<InvalidCsvFormatException>(() => EquipmentCsvImporter.Parse(csv));
+        ex.Message.ShouldContain("WeirdColumn");
+    }
+
+    [Fact]
+    public void DuplicateColumn_Throws()
+    {
+        var csv = "# OtOpcUaCsv v1\n" +
+                  "ZTag,ZTag,MachineCode,SAPID,EquipmentId,EquipmentUuid,Name,UnsAreaName,UnsLineName\n" +
+                  "z1,z1,mc,sap,eq,uu,Name,area,line";
+
+        Should.Throw<InvalidCsvFormatException>(() => EquipmentCsvImporter.Parse(csv));
+    }
+
+    [Fact]
+    public void ValidSingleRow_RoundTrips()
+    {
+        var csv = Header + "\nz-001,MC-1,SAP-1,eq-001,uuid-1,Oven-A,Warsaw,Line-1";
+
+        var result = EquipmentCsvImporter.Parse(csv);
+
+        result.AcceptedRows.Count.ShouldBe(1);
+        result.RejectedRows.ShouldBeEmpty();
+        var row = result.AcceptedRows[0];
+        row.ZTag.ShouldBe("z-001");
+        row.MachineCode.ShouldBe("MC-1");
+        row.Name.ShouldBe("Oven-A");
+        row.UnsLineName.ShouldBe("Line-1");
+    }
+
+    [Fact]
+    public void OptionalColumns_Populated_WhenPresent()
+    {
+        var csv = "# OtOpcUaCsv v1\n" +
+                  "ZTag,MachineCode,SAPID,EquipmentId,EquipmentUuid,Name,UnsAreaName,UnsLineName,Manufacturer,Model,SerialNumber,HardwareRevision,SoftwareRevision,YearOfConstruction,AssetLocation,ManufacturerUri,DeviceManualUri\n" +
+                  "z-1,MC,SAP,eq,uuid,Oven,Warsaw,Line1,Siemens,S7-1500,SN123,Rev-1,Fw-2.3,2023,Bldg-3,https://siemens.example,https://siemens.example/manual";
+
+        var result = EquipmentCsvImporter.Parse(csv);
+
+        result.AcceptedRows.Count.ShouldBe(1);
+        var row = result.AcceptedRows[0];
+        row.Manufacturer.ShouldBe("Siemens");
+        row.Model.ShouldBe("S7-1500");
+        row.SerialNumber.ShouldBe("SN123");
+        row.YearOfConstruction.ShouldBe("2023");
+        row.ManufacturerUri.ShouldBe("https://siemens.example");
+    }
+
+    [Fact]
+    public void BlankRequiredField_Rejects_Row()
+    {
+        var csv = Header + "\nz-1,MC,SAP,eq,uuid,,Warsaw,Line1"; // Name blank
+
+        var result = EquipmentCsvImporter.Parse(csv);
+
+        result.AcceptedRows.ShouldBeEmpty();
+        result.RejectedRows.Count.ShouldBe(1);
+        result.RejectedRows[0].Reason.ShouldContain("Name");
+    }
+
+    [Fact]
+    public void DuplicateZTag_Rejects_SecondRow()
+    {
+        var csv = Header +
+                  "\nz-1,MC1,SAP1,eq1,u1,N1,A,L1" +
+                  "\nz-1,MC2,SAP2,eq2,u2,N2,A,L1";
+
+        var result = EquipmentCsvImporter.Parse(csv);
+
+        result.AcceptedRows.Count.ShouldBe(1);
+        result.RejectedRows.Count.ShouldBe(1);
+        result.RejectedRows[0].Reason.ShouldContain("Duplicate ZTag");
+    }
+
+    [Fact]
+    public void QuotedField_With_CommaAndQuote_Parses_Correctly()
+    {
+        // RFC 4180: "" inside a quoted field is an escaped quote.
+        var csv = Header +
+                  "\n\"z-1\",\"MC\",\"SAP,with,commas\",\"eq\",\"uuid\",\"Oven \"\"Ultra\"\"\",\"Warsaw\",\"Line1\"";
+
+        var result = EquipmentCsvImporter.Parse(csv);
+
+        result.AcceptedRows.Count.ShouldBe(1);
+        result.AcceptedRows[0].SAPID.ShouldBe("SAP,with,commas");
+        result.AcceptedRows[0].Name.ShouldBe("Oven \"Ultra\"");
+    }
+
+    [Fact]
+    public void MismatchedColumnCount_Rejects_Row()
+    {
+        var csv = Header + "\nz-1,MC,SAP,eq,uuid,Name,Warsaw"; // missing UnsLineName cell
+
+        var result = EquipmentCsvImporter.Parse(csv);
+
+        result.AcceptedRows.ShouldBeEmpty();
+        result.RejectedRows.Count.ShouldBe(1);
+        result.RejectedRows[0].Reason.ShouldContain("Column count");
+    }
+
+    [Fact]
+    public void BlankLines_BetweenRows_AreIgnored()
+    {
+        var csv = Header +
+                  "\nz-1,MC,SAP,eq1,u1,N1,A,L1" +
+                  "\n" +
+                  "\nz-2,MC,SAP,eq2,u2,N2,A,L1";
+
+        var result = EquipmentCsvImporter.Parse(csv);
+
+        result.AcceptedRows.Count.ShouldBe(2);
+        result.RejectedRows.ShouldBeEmpty();
+    }
+
+    [Fact]
+    public void Header_Constants_Match_Decision_117_and_139()
+    {
+        EquipmentCsvImporter.RequiredColumns.ShouldBe(
+            ["ZTag", "MachineCode", "SAPID", "EquipmentId", "EquipmentUuid", "Name", "UnsAreaName", "UnsLineName"]);
+
+        EquipmentCsvImporter.OptionalColumns.ShouldBe(
+            ["Manufacturer", "Model", "SerialNumber", "HardwareRevision", "SoftwareRevision",
+             "YearOfConstruction", "AssetLocation", "ManufacturerUri", "DeviceManualUri"]);
+    }
+}

tests/ZB.MOM.WW.OtOpcUa.Admin.Tests/UnsImpactAnalyzerTests.cs

@@ -0,0 +1,173 @@
+using Shouldly;
+using Xunit;
+using ZB.MOM.WW.OtOpcUa.Admin.Services;
+
+namespace ZB.MOM.WW.OtOpcUa.Admin.Tests;
+
+[Trait("Category", "Unit")]
+public sealed class UnsImpactAnalyzerTests
+{
+    private static UnsTreeSnapshot TwoAreaSnapshot() => new()
+    {
+        DraftGenerationId = 1,
+        RevisionToken = new DraftRevisionToken("rev-1"),
+        Areas =
+        [
+            new UnsAreaSummary("area-pack", "Packaging", ["line-oven", "line-wrap"]),
+            new UnsAreaSummary("area-asm", "Assembly",  ["line-weld"]),
+        ],
+        Lines =
+        [
+            new UnsLineSummary("line-oven", "Oven-2",   EquipmentCount: 14, TagCount: 237),
+            new UnsLineSummary("line-wrap", "Wrapper",  EquipmentCount: 3,  TagCount: 40),
+            new UnsLineSummary("line-weld", "Welder",   EquipmentCount: 5,  TagCount: 80),
+        ],
+    };
+
+    [Fact]
+    public void LineMove_Counts_Affected_Equipment_And_Tags()
+    {
+        var snapshot = TwoAreaSnapshot();
+        var move = new UnsMoveOperation(
+            Kind: UnsMoveKind.LineMove,
+            SourceClusterId: "c1", TargetClusterId: "c1",
+            SourceLineId: "line-oven",
+            TargetAreaId: "area-asm");
+
+        var preview = UnsImpactAnalyzer.Analyze(snapshot, move);
+
+        preview.AffectedEquipmentCount.ShouldBe(14);
+        preview.AffectedTagCount.ShouldBe(237);
+        preview.RevisionToken.Value.ShouldBe("rev-1");
+        preview.HumanReadableSummary.ShouldContain("'Oven-2'");
+        preview.HumanReadableSummary.ShouldContain("'Assembly'");
+    }
+
+    [Fact]
+    public void CrossCluster_LineMove_Throws()
+    {
+        var snapshot = TwoAreaSnapshot();
+        var move = new UnsMoveOperation(
+            Kind: UnsMoveKind.LineMove,
+            SourceClusterId: "c1", TargetClusterId: "c2",
+            SourceLineId: "line-oven",
+            TargetAreaId: "area-asm");
+
+        Should.Throw<CrossClusterMoveRejectedException>(
+            () => UnsImpactAnalyzer.Analyze(snapshot, move));
+    }
+
+    [Fact]
+    public void LineMove_With_UnknownSource_Throws_Validation()
+    {
+        var snapshot = TwoAreaSnapshot();
+        var move = new UnsMoveOperation(
+            UnsMoveKind.LineMove, "c1", "c1",
+            SourceLineId: "line-does-not-exist",
+            TargetAreaId: "area-asm");
+
+        Should.Throw<UnsMoveValidationException>(
+            () => UnsImpactAnalyzer.Analyze(snapshot, move));
+    }
+
+    [Fact]
+    public void LineMove_With_UnknownTarget_Throws_Validation()
+    {
+        var snapshot = TwoAreaSnapshot();
+        var move = new UnsMoveOperation(
+            UnsMoveKind.LineMove, "c1", "c1",
+            SourceLineId: "line-oven",
+            TargetAreaId: "area-nowhere");
+
+        Should.Throw<UnsMoveValidationException>(
+            () => UnsImpactAnalyzer.Analyze(snapshot, move));
+    }
+
+    [Fact]
+    public void LineMove_To_Area_WithSameName_Warns_AboutAmbiguity()
+    {
+        var snapshot = new UnsTreeSnapshot
+        {
+            DraftGenerationId = 1,
+            RevisionToken = new DraftRevisionToken("rev-1"),
+            Areas =
+            [
+                new UnsAreaSummary("area-a", "Packaging", ["line-1"]),
+                new UnsAreaSummary("area-b", "Assembly",  ["line-2"]),
+            ],
+            Lines =
+            [
+                new UnsLineSummary("line-1", "Oven", 10, 100),
+                new UnsLineSummary("line-2", "Oven", 5, 50),
+            ],
+        };
+        var move = new UnsMoveOperation(
+            UnsMoveKind.LineMove, "c1", "c1",
+            SourceLineId: "line-1",
+            TargetAreaId: "area-b");
+
+        var preview = UnsImpactAnalyzer.Analyze(snapshot, move);
+
+        preview.CascadeWarnings.ShouldContain(w => w.Contains("already has a line named 'Oven'"));
+    }
+
+    [Fact]
+    public void AreaRename_Cascades_AcrossAllLines()
+    {
+        var snapshot = TwoAreaSnapshot();
+        var move = new UnsMoveOperation(
+            Kind: UnsMoveKind.AreaRename,
+            SourceClusterId: "c1", TargetClusterId: "c1",
+            SourceAreaId: "area-pack",
+            NewName: "Packaging-West");
+
+        var preview = UnsImpactAnalyzer.Analyze(snapshot, move);
+
+        preview.AffectedEquipmentCount.ShouldBe(14 + 3, "sum of lines in 'Packaging'");
+        preview.AffectedTagCount.ShouldBe(237 + 40);
+        preview.HumanReadableSummary.ShouldContain("'Packaging-West'");
+    }
+
+    [Fact]
+    public void LineMerge_CrossArea_Warns()
+    {
+        var snapshot = TwoAreaSnapshot();
+        var move = new UnsMoveOperation(
+            Kind: UnsMoveKind.LineMerge,
+            SourceClusterId: "c1", TargetClusterId: "c1",
+            SourceLineId: "line-oven",
+            TargetLineId: "line-weld");
+
+        var preview = UnsImpactAnalyzer.Analyze(snapshot, move);
+
+        preview.AffectedEquipmentCount.ShouldBe(14);
+        preview.CascadeWarnings.ShouldContain(w => w.Contains("different areas"));
+    }
+
+    [Fact]
+    public void LineMerge_SameArea_NoWarning()
+    {
+        var snapshot = TwoAreaSnapshot();
+        var move = new UnsMoveOperation(
+            Kind: UnsMoveKind.LineMerge,
+            SourceClusterId: "c1", TargetClusterId: "c1",
+            SourceLineId: "line-oven",
+            TargetLineId: "line-wrap");
+
+        var preview = UnsImpactAnalyzer.Analyze(snapshot, move);
+
+        preview.CascadeWarnings.ShouldBeEmpty();
+    }
+
+    [Fact]
+    public void DraftRevisionToken_Matches_OnEqualValues()
+    {
+        var a = new DraftRevisionToken("rev-1");
+        var b = new DraftRevisionToken("rev-1");
+        var c = new DraftRevisionToken("rev-2");
+
+        a.Matches(b).ShouldBeTrue();
+        a.Matches(c).ShouldBeFalse();
+        a.Matches(null).ShouldBeFalse();
+    }
+}

tests/ZB.MOM.WW.OtOpcUa.Admin.Tests/ValidatedNodeAclAuthoringServiceTests.cs

@@ -0,0 +1,146 @@
+using Microsoft.EntityFrameworkCore;
+using Shouldly;
+using Xunit;
+using ZB.MOM.WW.OtOpcUa.Admin.Services;
+using ZB.MOM.WW.OtOpcUa.Configuration;
+using ZB.MOM.WW.OtOpcUa.Configuration.Enums;
+
+namespace ZB.MOM.WW.OtOpcUa.Admin.Tests;
+
+[Trait("Category", "Unit")]
+public sealed class ValidatedNodeAclAuthoringServiceTests : IDisposable
+{
+    private readonly OtOpcUaConfigDbContext _db;
+
+    public ValidatedNodeAclAuthoringServiceTests()
+    {
+        var options = new DbContextOptionsBuilder<OtOpcUaConfigDbContext>()
+            .UseInMemoryDatabase($"val-nodeacl-{Guid.NewGuid():N}")
+            .Options;
+        _db = new OtOpcUaConfigDbContext(options);
+    }
+
+    public void Dispose() => _db.Dispose();
+
+    [Fact]
+    public async Task Grant_Rejects_NonePermissions()
+    {
+        var svc = new ValidatedNodeAclAuthoringService(_db);
+
+        await Should.ThrowAsync<InvalidNodeAclGrantException>(() => svc.GrantAsync(
+            draftGenerationId: 1, clusterId: "c1", ldapGroup: "cn=ops",
+            scopeKind: NodeAclScopeKind.Cluster, scopeId: null,
+            permissions: NodePermissions.None, notes: null, CancellationToken.None));
+    }
+
+    [Fact]
+    public async Task Grant_Rejects_ClusterScope_With_ScopeId()
+    {
+        var svc = new ValidatedNodeAclAuthoringService(_db);
+
+        await Should.ThrowAsync<InvalidNodeAclGrantException>(() => svc.GrantAsync(
+            1, "c1", "cn=ops",
+            NodeAclScopeKind.Cluster, scopeId: "not-null-wrong",
+            NodePermissions.Read, null, CancellationToken.None));
+    }
+
+    [Fact]
+    public async Task Grant_Rejects_SubClusterScope_Without_ScopeId()
+    {
+        var svc = new ValidatedNodeAclAuthoringService(_db);
+
+        await Should.ThrowAsync<InvalidNodeAclGrantException>(() => svc.GrantAsync(
+            1, "c1", "cn=ops",
+            NodeAclScopeKind.Equipment, scopeId: null,
+            NodePermissions.Read, null, CancellationToken.None));
+    }
+
+    [Fact]
+    public async Task Grant_Succeeds_When_Valid()
+    {
+        var svc = new ValidatedNodeAclAuthoringService(_db);
+
+        var row = await svc.GrantAsync(
+            1, "c1", "cn=ops",
+            NodeAclScopeKind.Cluster, null,
+            NodePermissions.Read | NodePermissions.Browse, "fleet reader", CancellationToken.None);
+
+        row.LdapGroup.ShouldBe("cn=ops");
+        row.PermissionFlags.ShouldBe(NodePermissions.Read | NodePermissions.Browse);
+        row.NodeAclId.ShouldNotBeNullOrWhiteSpace();
+    }
+
+    [Fact]
+    public async Task Grant_Rejects_DuplicateScopeGroup_Pair()
+    {
+        var svc = new ValidatedNodeAclAuthoringService(_db);
+        await svc.GrantAsync(1, "c1", "cn=ops", NodeAclScopeKind.Cluster, null,
+            NodePermissions.Read, null, CancellationToken.None);
+
+        await Should.ThrowAsync<InvalidNodeAclGrantException>(() => svc.GrantAsync(
+            1, "c1", "cn=ops", NodeAclScopeKind.Cluster, null,
+            NodePermissions.WriteOperate, null, CancellationToken.None));
+    }
+
+    [Fact]
+    public async Task Grant_SameGroup_DifferentScope_IsAllowed()
+    {
+        var svc = new ValidatedNodeAclAuthoringService(_db);
+        await svc.GrantAsync(1, "c1", "cn=ops", NodeAclScopeKind.Cluster, null,
+            NodePermissions.Read, null, CancellationToken.None);
+
+        var tagRow = await svc.GrantAsync(1, "c1", "cn=ops",
+            NodeAclScopeKind.Tag, scopeId: "tag-xyz",
+            NodePermissions.WriteOperate, null, CancellationToken.None);
+
+        tagRow.ScopeKind.ShouldBe(NodeAclScopeKind.Tag);
+    }
+
+    [Fact]
+    public async Task Grant_SameGroupScope_DifferentDraft_IsAllowed()
+    {
+        var svc = new ValidatedNodeAclAuthoringService(_db);
+        await svc.GrantAsync(1, "c1", "cn=ops", NodeAclScopeKind.Cluster, null,
+            NodePermissions.Read, null, CancellationToken.None);
+
+        var draft2Row = await svc.GrantAsync(2, "c1", "cn=ops",
+            NodeAclScopeKind.Cluster, null,
+            NodePermissions.Read, null, CancellationToken.None);
+
+        draft2Row.GenerationId.ShouldBe(2);
+    }
+
+    [Fact]
+    public async Task UpdatePermissions_Rejects_None()
+    {
+        var svc = new ValidatedNodeAclAuthoringService(_db);
+        var row = await svc.GrantAsync(1, "c1", "cn=ops", NodeAclScopeKind.Cluster, null,
+            NodePermissions.Read, null, CancellationToken.None);
+
+        await Should.ThrowAsync<InvalidNodeAclGrantException>(
+            () => svc.UpdatePermissionsAsync(row.NodeAclRowId, NodePermissions.None, null, CancellationToken.None));
+    }
+
+    [Fact]
+    public async Task UpdatePermissions_RoundTrips_NewFlags()
+    {
+        var svc = new ValidatedNodeAclAuthoringService(_db);
+        var row = await svc.GrantAsync(1, "c1", "cn=ops", NodeAclScopeKind.Cluster, null,
+            NodePermissions.Read, null, CancellationToken.None);
+
+        var updated = await svc.UpdatePermissionsAsync(row.NodeAclRowId,
+            NodePermissions.Read | NodePermissions.WriteOperate, "bumped", CancellationToken.None);
+
+        updated.PermissionFlags.ShouldBe(NodePermissions.Read | NodePermissions.WriteOperate);
+        updated.Notes.ShouldBe("bumped");
+    }
+
+    [Fact]
+    public async Task UpdatePermissions_MissingRow_Throws()
+    {
+        var svc = new ValidatedNodeAclAuthoringService(_db);
+
+        await Should.ThrowAsync<InvalidNodeAclGrantException>(
+            () => svc.UpdatePermissionsAsync(Guid.NewGuid(), NodePermissions.Read, null, CancellationToken.None));
+    }
+}

tests/ZB.MOM.WW.OtOpcUa.Admin.Tests/ZB.MOM.WW.OtOpcUa.Admin.Tests.csproj

@@ -22,6 +22,7 @@
     <ItemGroup>
         <ProjectReference Include="..\..\src\ZB.MOM.WW.OtOpcUa.Admin\ZB.MOM.WW.OtOpcUa.Admin.csproj"/>
         <PackageReference Include="Microsoft.Data.SqlClient" Version="6.1.1"/>
+        <PackageReference Include="Microsoft.EntityFrameworkCore.InMemory" Version="10.0.0"/>
     </ItemGroup>
 
     <ItemGroup>

tests/ZB.MOM.WW.OtOpcUa.Configuration.Tests/GenerationSealedCacheTests.cs

@@ -0,0 +1,157 @@
+using Shouldly;
+using Xunit;
+using ZB.MOM.WW.OtOpcUa.Configuration.LocalCache;
+
+namespace ZB.MOM.WW.OtOpcUa.Configuration.Tests;
+
+[Trait("Category", "Unit")]
+public sealed class GenerationSealedCacheTests : IDisposable
+{
+    private readonly string _root = Path.Combine(Path.GetTempPath(), $"otopcua-sealed-{Guid.NewGuid():N}");
+
+    public void Dispose()
+    {
+        try
+        {
+            if (!Directory.Exists(_root)) return;
+            // Remove ReadOnly attribute first so Directory.Delete can clean sealed files.
+            foreach (var f in Directory.EnumerateFiles(_root, "*", SearchOption.AllDirectories))
+                File.SetAttributes(f, FileAttributes.Normal);
+            Directory.Delete(_root, recursive: true);
+        }
+        catch { /* best-effort cleanup */ }
+    }
+
+    private GenerationSnapshot MakeSnapshot(string clusterId, long generationId, string payload = "{\"sample\":true}") =>
+        new()
+        {
+            ClusterId = clusterId,
+            GenerationId = generationId,
+            CachedAt = DateTime.UtcNow,
+            PayloadJson = payload,
+        };
+
+    [Fact]
+    public async Task FirstBoot_NoSnapshot_ReadThrows()
+    {
+        var cache = new GenerationSealedCache(_root);
+
+        await Should.ThrowAsync<GenerationCacheUnavailableException>(
+            () => cache.ReadCurrentAsync("cluster-a"));
+    }
+
+    [Fact]
+    public async Task SealThenRead_RoundTrips()
+    {
+        var cache = new GenerationSealedCache(_root);
+        var snapshot = MakeSnapshot("cluster-a", 42, "{\"hello\":\"world\"}");
+
+        await cache.SealAsync(snapshot);
+
+        var read = await cache.ReadCurrentAsync("cluster-a");
+        read.GenerationId.ShouldBe(42);
+        read.ClusterId.ShouldBe("cluster-a");
+        read.PayloadJson.ShouldBe("{\"hello\":\"world\"}");
+    }
+
+    [Fact]
+    public async Task SealedFile_IsReadOnly_OnDisk()
+    {
+        var cache = new GenerationSealedCache(_root);
+        await cache.SealAsync(MakeSnapshot("cluster-a", 5));
+
+        var sealedPath = Path.Combine(_root, "cluster-a", "5.db");
+        File.Exists(sealedPath).ShouldBeTrue();
+        var attrs = File.GetAttributes(sealedPath);
+        attrs.HasFlag(FileAttributes.ReadOnly).ShouldBeTrue("sealed file must be read-only");
+    }
+
+    [Fact]
+    public async Task SealingTwoGenerations_PointerAdvances_ToLatest()
+    {
+        var cache = new GenerationSealedCache(_root);
+        await cache.SealAsync(MakeSnapshot("cluster-a", 1));
+        await cache.SealAsync(MakeSnapshot("cluster-a", 2));
+
+        cache.TryGetCurrentGenerationId("cluster-a").ShouldBe(2);
+        var read = await cache.ReadCurrentAsync("cluster-a");
+        read.GenerationId.ShouldBe(2);
+    }
+
+    [Fact]
+    public async Task PriorGenerationFile_Survives_AfterNewSeal()
+    {
+        var cache = new GenerationSealedCache(_root);
+        await cache.SealAsync(MakeSnapshot("cluster-a", 1));
+        await cache.SealAsync(MakeSnapshot("cluster-a", 2));
+
+        File.Exists(Path.Combine(_root, "cluster-a", "1.db")).ShouldBeTrue(
+            "prior generations preserved for audit; pruning is separate");
+        File.Exists(Path.Combine(_root, "cluster-a", "2.db")).ShouldBeTrue();
+    }
+
+    [Fact]
+    public async Task CorruptSealedFile_ReadFailsClosed()
+    {
+        var cache = new GenerationSealedCache(_root);
+        await cache.SealAsync(MakeSnapshot("cluster-a", 7));
+
+        // Corrupt the sealed file: clear read-only, truncate, leave pointer intact.
+        var sealedPath = Path.Combine(_root, "cluster-a", "7.db");
+        File.SetAttributes(sealedPath, FileAttributes.Normal);
+        File.WriteAllBytes(sealedPath, [0x00, 0x01, 0x02]);
+
+        await Should.ThrowAsync<GenerationCacheUnavailableException>(
+            () => cache.ReadCurrentAsync("cluster-a"));
+    }
+
+    [Fact]
+    public async Task MissingSealedFile_ReadFailsClosed()
+    {
+        var cache = new GenerationSealedCache(_root);
+        await cache.SealAsync(MakeSnapshot("cluster-a", 3));
+
+        // Delete the sealed file but leave the pointer — corruption scenario.
+        var sealedPath = Path.Combine(_root, "cluster-a", "3.db");
+        File.SetAttributes(sealedPath, FileAttributes.Normal);
+        File.Delete(sealedPath);
+
+        await Should.ThrowAsync<GenerationCacheUnavailableException>(
+            () => cache.ReadCurrentAsync("cluster-a"));
+    }
+
+    [Fact]
+    public async Task CorruptPointerFile_ReadFailsClosed()
+    {
+        var cache = new GenerationSealedCache(_root);
+        await cache.SealAsync(MakeSnapshot("cluster-a", 9));
+
+        var pointerPath = Path.Combine(_root, "cluster-a", "CURRENT");
+        File.WriteAllText(pointerPath, "not-a-number");
+
+        await Should.ThrowAsync<GenerationCacheUnavailableException>(
+            () => cache.ReadCurrentAsync("cluster-a"));
+    }
+
+    [Fact]
+    public async Task SealSameGenerationTwice_IsIdempotent()
+    {
+        var cache = new GenerationSealedCache(_root);
+        await cache.SealAsync(MakeSnapshot("cluster-a", 11));
+        await cache.SealAsync(MakeSnapshot("cluster-a", 11, "{\"v\":2}"));
+
+        var read = await cache.ReadCurrentAsync("cluster-a");
+        read.PayloadJson.ShouldBe("{\"sample\":true}", "sealed file is immutable; second seal no-ops");
+    }
+
+    [Fact]
+    public async Task IndependentClusters_DoNotInterfere()
+    {
+        var cache = new GenerationSealedCache(_root);
+        await cache.SealAsync(MakeSnapshot("cluster-a", 1));
+        await cache.SealAsync(MakeSnapshot("cluster-b", 10));
+
+        (await cache.ReadCurrentAsync("cluster-a")).GenerationId.ShouldBe(1);
+        (await cache.ReadCurrentAsync("cluster-b")).GenerationId.ShouldBe(10);
+    }
+}

tests/ZB.MOM.WW.OtOpcUa.Configuration.Tests/LdapGroupRoleMappingServiceTests.cs

@@ -0,0 +1,138 @@
+using Microsoft.EntityFrameworkCore;
+using Shouldly;
+using Xunit;
+using ZB.MOM.WW.OtOpcUa.Configuration.Entities;
+using ZB.MOM.WW.OtOpcUa.Configuration.Enums;
+using ZB.MOM.WW.OtOpcUa.Configuration.Services;
+
+namespace ZB.MOM.WW.OtOpcUa.Configuration.Tests;
+
+[Trait("Category", "Unit")]
+public sealed class LdapGroupRoleMappingServiceTests : IDisposable
+{
+    private readonly OtOpcUaConfigDbContext _db;
+
+    public LdapGroupRoleMappingServiceTests()
+    {
+        var options = new DbContextOptionsBuilder<OtOpcUaConfigDbContext>()
+            .UseInMemoryDatabase($"ldap-grm-{Guid.NewGuid():N}")
+            .Options;
+        _db = new OtOpcUaConfigDbContext(options);
+    }
+
+    public void Dispose() => _db.Dispose();
+
+    private LdapGroupRoleMapping Make(string group, AdminRole role, string? clusterId = null, bool? isSystemWide = null) =>
+        new()
+        {
+            LdapGroup = group,
+            Role = role,
+            ClusterId = clusterId,
+            IsSystemWide = isSystemWide ?? (clusterId is null),
+        };
+
+    [Fact]
+    public async Task Create_SetsId_AndCreatedAtUtc()
+    {
+        var svc = new LdapGroupRoleMappingService(_db);
+        var row = Make("cn=fleet,dc=x", AdminRole.FleetAdmin);
+
+        var saved = await svc.CreateAsync(row, CancellationToken.None);
+
+        saved.Id.ShouldNotBe(Guid.Empty);
+        saved.CreatedAtUtc.ShouldBeGreaterThan(DateTime.UtcNow.AddMinutes(-1));
+    }
+
+    [Fact]
+    public async Task Create_Rejects_EmptyLdapGroup()
+    {
+        var svc = new LdapGroupRoleMappingService(_db);
+        var row = Make("", AdminRole.FleetAdmin);
+
+        await Should.ThrowAsync<InvalidLdapGroupRoleMappingException>(
+            () => svc.CreateAsync(row, CancellationToken.None));
+    }
+
+    [Fact]
+    public async Task Create_Rejects_SystemWide_With_ClusterId()
+    {
+        var svc = new LdapGroupRoleMappingService(_db);
+        var row = Make("cn=g", AdminRole.ConfigViewer, clusterId: "c1", isSystemWide: true);
+
+        await Should.ThrowAsync<InvalidLdapGroupRoleMappingException>(
+            () => svc.CreateAsync(row, CancellationToken.None));
+    }
+
+    [Fact]
+    public async Task Create_Rejects_NonSystemWide_WithoutClusterId()
+    {
+        var svc = new LdapGroupRoleMappingService(_db);
+        var row = Make("cn=g", AdminRole.ConfigViewer, clusterId: null, isSystemWide: false);
+
+        await Should.ThrowAsync<InvalidLdapGroupRoleMappingException>(
+            () => svc.CreateAsync(row, CancellationToken.None));
+    }
+
+    [Fact]
+    public async Task GetByGroups_Returns_MatchingGrants_Only()
+    {
+        var svc = new LdapGroupRoleMappingService(_db);
+        await svc.CreateAsync(Make("cn=fleet,dc=x", AdminRole.FleetAdmin), CancellationToken.None);
+        await svc.CreateAsync(Make("cn=editor,dc=x", AdminRole.ConfigEditor), CancellationToken.None);
+        await svc.CreateAsync(Make("cn=viewer,dc=x", AdminRole.ConfigViewer), CancellationToken.None);
+
+        var results = await svc.GetByGroupsAsync(
+            ["cn=fleet,dc=x", "cn=viewer,dc=x"], CancellationToken.None);
+
+        results.Count.ShouldBe(2);
+        results.Select(r => r.Role).ShouldBe([AdminRole.FleetAdmin, AdminRole.ConfigViewer], ignoreOrder: true);
+    }
+
+    [Fact]
+    public async Task GetByGroups_Empty_Input_ReturnsEmpty()
+    {
+        var svc = new LdapGroupRoleMappingService(_db);
+        await svc.CreateAsync(Make("cn=fleet,dc=x", AdminRole.FleetAdmin), CancellationToken.None);
+
+        var results = await svc.GetByGroupsAsync([], CancellationToken.None);
+
+        results.ShouldBeEmpty();
+    }
+
+    [Fact]
+    public async Task ListAll_Orders_ByGroupThenCluster()
+    {
+        var svc = new LdapGroupRoleMappingService(_db);
+        await svc.CreateAsync(Make("cn=b,dc=x", AdminRole.FleetAdmin), CancellationToken.None);
+        await svc.CreateAsync(Make("cn=a,dc=x", AdminRole.ConfigEditor, clusterId: "c2", isSystemWide: false), CancellationToken.None);
+        await svc.CreateAsync(Make("cn=a,dc=x", AdminRole.ConfigEditor, clusterId: "c1", isSystemWide: false), CancellationToken.None);
+
+        var results = await svc.ListAllAsync(CancellationToken.None);
+
+        results[0].LdapGroup.ShouldBe("cn=a,dc=x");
+        results[0].ClusterId.ShouldBe("c1");
+        results[1].ClusterId.ShouldBe("c2");
+        results[2].LdapGroup.ShouldBe("cn=b,dc=x");
+    }
+
+    [Fact]
+    public async Task Delete_Removes_Matching_Row()
+    {
+        var svc = new LdapGroupRoleMappingService(_db);
+        var saved = await svc.CreateAsync(Make("cn=fleet,dc=x", AdminRole.FleetAdmin), CancellationToken.None);
+
+        await svc.DeleteAsync(saved.Id, CancellationToken.None);
+
+        var after = await svc.ListAllAsync(CancellationToken.None);
+        after.ShouldBeEmpty();
+    }
+
+    [Fact]
+    public async Task Delete_Unknown_Id_IsNoOp()
+    {
+        var svc = new LdapGroupRoleMappingService(_db);
+
+        await svc.DeleteAsync(Guid.NewGuid(), CancellationToken.None);
+        // no exception
+    }
+}

tests/ZB.MOM.WW.OtOpcUa.Configuration.Tests/ResilientConfigReaderTests.cs

@@ -0,0 +1,154 @@
+using Microsoft.Extensions.Logging.Abstractions;
+using Shouldly;
+using Xunit;
+using ZB.MOM.WW.OtOpcUa.Configuration.LocalCache;
+
+namespace ZB.MOM.WW.OtOpcUa.Configuration.Tests;
+
+[Trait("Category", "Unit")]
+public sealed class ResilientConfigReaderTests : IDisposable
+{
+    private readonly string _root = Path.Combine(Path.GetTempPath(), $"otopcua-reader-{Guid.NewGuid():N}");
+
+    public void Dispose()
+    {
+        try
+        {
+            if (!Directory.Exists(_root)) return;
+            foreach (var f in Directory.EnumerateFiles(_root, "*", SearchOption.AllDirectories))
+                File.SetAttributes(f, FileAttributes.Normal);
+            Directory.Delete(_root, recursive: true);
+        }
+        catch { /* best-effort */ }
+    }
+
+    [Fact]
+    public async Task CentralDbSucceeds_ReturnsValue_MarksFresh()
+    {
+        var cache = new GenerationSealedCache(_root);
+        var flag = new StaleConfigFlag { };
+        flag.MarkStale(); // pre-existing stale state
+        var reader = new ResilientConfigReader(cache, flag, NullLogger<ResilientConfigReader>.Instance);
+
+        var result = await reader.ReadAsync(
+            "cluster-a",
+            _ => ValueTask.FromResult("fresh-from-db"),
+            _ => "from-cache",
+            CancellationToken.None);
+
+        result.ShouldBe("fresh-from-db");
+        flag.IsStale.ShouldBeFalse("successful central-DB read clears stale flag");
+    }
+
+    [Fact]
+    public async Task CentralDbFails_ExhaustsRetries_FallsBackToCache_MarksStale()
+    {
+        var cache = new GenerationSealedCache(_root);
+        await cache.SealAsync(new GenerationSnapshot
+        {
+            ClusterId = "cluster-a", GenerationId = 99, CachedAt = DateTime.UtcNow,
+            PayloadJson = "{\"cached\":true}",
+        });
+        var flag = new StaleConfigFlag();
+        var reader = new ResilientConfigReader(cache, flag, NullLogger<ResilientConfigReader>.Instance,
+            timeout: TimeSpan.FromSeconds(10), retryCount: 2);
+        var attempts = 0;
+
+        var result = await reader.ReadAsync(
+            "cluster-a",
+            _ =>
+            {
+                attempts++;
+                throw new InvalidOperationException("SQL dead");
+#pragma warning disable CS0162
+                return ValueTask.FromResult("never");
+#pragma warning restore CS0162
+            },
+            snap => snap.PayloadJson,
+            CancellationToken.None);
+
+        attempts.ShouldBe(3, "1 initial + 2 retries = 3 attempts");
+        result.ShouldBe("{\"cached\":true}");
+        flag.IsStale.ShouldBeTrue("cache fallback flips stale flag true");
+    }
+
+    [Fact]
+    public async Task CentralDbFails_AndCacheAlsoUnavailable_Throws()
+    {
+        var cache = new GenerationSealedCache(_root);
+        var flag = new StaleConfigFlag();
+        var reader = new ResilientConfigReader(cache, flag, NullLogger<ResilientConfigReader>.Instance,
+            timeout: TimeSpan.FromSeconds(10), retryCount: 0);
+
+        await Should.ThrowAsync<GenerationCacheUnavailableException>(async () =>
+        {
+            await reader.ReadAsync<string>(
+                "cluster-a",
+                _ => throw new InvalidOperationException("SQL dead"),
+                _ => "never",
+                CancellationToken.None);
+        });
+
+        flag.IsStale.ShouldBeFalse("no snapshot ever served, so flag stays whatever it was");
+    }
+
+    [Fact]
+    public async Task Cancellation_NotRetried()
+    {
+        var cache = new GenerationSealedCache(_root);
+        var flag = new StaleConfigFlag();
+        var reader = new ResilientConfigReader(cache, flag, NullLogger<ResilientConfigReader>.Instance,
+            timeout: TimeSpan.FromSeconds(10), retryCount: 5);
+        using var cts = new CancellationTokenSource();
+        cts.Cancel();
+        var attempts = 0;
+
+        await Should.ThrowAsync<OperationCanceledException>(async () =>
+        {
+            await reader.ReadAsync<string>(
+                "cluster-a",
+                ct =>
+                {
+                    attempts++;
+                    ct.ThrowIfCancellationRequested();
+                    return ValueTask.FromResult("ok");
+                },
+                _ => "cache",
+                cts.Token);
+        });
+
+        attempts.ShouldBeLessThanOrEqualTo(1);
+    }
+}
+
+[Trait("Category", "Unit")]
+public sealed class StaleConfigFlagTests
+{
+    [Fact]
+    public void Default_IsFresh()
+    {
+        new StaleConfigFlag().IsStale.ShouldBeFalse();
+    }
+
+    [Fact]
+    public void MarkStale_ThenFresh_Toggles()
+    {
+        var flag = new StaleConfigFlag();
+        flag.MarkStale();
+        flag.IsStale.ShouldBeTrue();
+        flag.MarkFresh();
+        flag.IsStale.ShouldBeFalse();
+    }
+
+    [Fact]
+    public void ConcurrentWrites_Converge()
+    {
+        var flag = new StaleConfigFlag();
+        Parallel.For(0, 1000, i =>
+        {
+            if (i % 2 == 0) flag.MarkStale(); else flag.MarkFresh();
+        });
+        flag.MarkFresh();
+        flag.IsStale.ShouldBeFalse();
+    }
+}

tests/ZB.MOM.WW.OtOpcUa.Configuration.Tests/SchemaComplianceTests.cs

@@ -29,6 +29,8 @@ public sealed class SchemaComplianceTests
             "DriverInstance", "Device", "Equipment", "Tag", "PollGroup",
             "NodeAcl", "ExternalIdReservation",
             "DriverHostStatus",
+            "DriverInstanceResilienceStatus",
+            "LdapGroupRoleMapping",
         };
 
         var actual = QueryStrings(@"

tests/ZB.MOM.WW.OtOpcUa.Configuration.Tests/ZB.MOM.WW.OtOpcUa.Configuration.Tests.csproj

@@ -14,6 +14,7 @@
         <PackageReference Include="Shouldly" Version="4.3.0"/>
         <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.12.0"/>
         <PackageReference Include="Microsoft.Data.SqlClient" Version="6.1.1"/>
+        <PackageReference Include="Microsoft.EntityFrameworkCore.InMemory" Version="10.0.0"/>
         <PackageReference Include="xunit.runner.visualstudio" Version="3.0.2">
             <PrivateAssets>all</PrivateAssets>
             <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>

tests/ZB.MOM.WW.OtOpcUa.Core.Abstractions.Tests/DriverTypeRegistryTests.cs

@@ -7,11 +7,13 @@ public sealed class DriverTypeRegistryTests
 {
     private static DriverTypeMetadata SampleMetadata(
         string typeName = "Modbus",
-        NamespaceKindCompatibility allowed = NamespaceKindCompatibility.Equipment) =>
+        NamespaceKindCompatibility allowed = NamespaceKindCompatibility.Equipment,
+        DriverTier tier = DriverTier.B) =>
         new(typeName, allowed,
             DriverConfigJsonSchema: "{\"type\": \"object\"}",
             DeviceConfigJsonSchema: "{\"type\": \"object\"}",
-            TagConfigJsonSchema: "{\"type\": \"object\"}");
+            TagConfigJsonSchema: "{\"type\": \"object\"}",
+            Tier: tier);
 
     [Fact]
     public void Register_ThenGet_RoundTrips()
@@ -24,6 +26,20 @@ public sealed class DriverTypeRegistryTests
         registry.Get("Modbus").ShouldBe(metadata);
     }
 
+    [Theory]
+    [InlineData(DriverTier.A)]
+    [InlineData(DriverTier.B)]
+    [InlineData(DriverTier.C)]
+    public void Register_Requires_NonNullTier(DriverTier tier)
+    {
+        var registry = new DriverTypeRegistry();
+        var metadata = SampleMetadata(typeName: $"Driver-{tier}", tier: tier);
+
+        registry.Register(metadata);
+
+        registry.Get(metadata.TypeName).Tier.ShouldBe(tier);
+    }
+
     [Fact]
     public void Get_IsCaseInsensitive()
     {

tests/ZB.MOM.WW.OtOpcUa.Core.Tests/Authorization/PermissionTrieCacheTests.cs

@@ -0,0 +1,104 @@
+using Shouldly;
+using Xunit;
+using ZB.MOM.WW.OtOpcUa.Core.Authorization;
+
+namespace ZB.MOM.WW.OtOpcUa.Core.Tests.Authorization;
+
+[Trait("Category", "Unit")]
+public sealed class PermissionTrieCacheTests
+{
+    private static PermissionTrie Trie(string cluster, long generation) => new()
+    {
+        ClusterId = cluster,
+        GenerationId = generation,
+    };
+
+    [Fact]
+    public void GetTrie_Empty_ReturnsNull()
+    {
+        new PermissionTrieCache().GetTrie("c1").ShouldBeNull();
+    }
+
+    [Fact]
+    public void Install_ThenGet_RoundTrips()
+    {
+        var cache = new PermissionTrieCache();
+        cache.Install(Trie("c1", 5));
+
+        cache.GetTrie("c1")!.GenerationId.ShouldBe(5);
+        cache.CurrentGenerationId("c1").ShouldBe(5);
+    }
+
+    [Fact]
+    public void NewGeneration_BecomesCurrent()
+    {
+        var cache = new PermissionTrieCache();
+        cache.Install(Trie("c1", 1));
+        cache.Install(Trie("c1", 2));
+
+        cache.CurrentGenerationId("c1").ShouldBe(2);
+        cache.GetTrie("c1", 1).ShouldNotBeNull("prior generation retained for in-flight requests");
+        cache.GetTrie("c1", 2).ShouldNotBeNull();
+    }
+
+    [Fact]
+    public void OutOfOrder_Install_DoesNotDowngrade_Current()
+    {
+        var cache = new PermissionTrieCache();
+        cache.Install(Trie("c1", 3));
+        cache.Install(Trie("c1", 1)); // late-arriving older generation
+
+        cache.CurrentGenerationId("c1").ShouldBe(3, "older generation must not become current");
+        cache.GetTrie("c1", 1).ShouldNotBeNull("but older is still retrievable by explicit lookup");
+    }
+
+    [Fact]
+    public void Invalidate_DropsCluster()
+    {
+        var cache = new PermissionTrieCache();
+        cache.Install(Trie("c1", 1));
+        cache.Install(Trie("c2", 1));
+
+        cache.Invalidate("c1");
+
+        cache.GetTrie("c1").ShouldBeNull();
+        cache.GetTrie("c2").ShouldNotBeNull("sibling cluster unaffected");
+    }
+
+    [Fact]
+    public void Prune_RetainsMostRecent()
+    {
+        var cache = new PermissionTrieCache();
+        for (var g = 1L; g <= 5; g++) cache.Install(Trie("c1", g));
+
+        cache.Prune("c1", keepLatest: 2);
+
+        cache.GetTrie("c1", 5).ShouldNotBeNull();
+        cache.GetTrie("c1", 4).ShouldNotBeNull();
+        cache.GetTrie("c1", 3).ShouldBeNull();
+        cache.GetTrie("c1", 1).ShouldBeNull();
+    }
+
+    [Fact]
+    public void Prune_LessThanKeep_IsNoOp()
+    {
+        var cache = new PermissionTrieCache();
+        cache.Install(Trie("c1", 1));
+        cache.Install(Trie("c1", 2));
+
+        cache.Prune("c1", keepLatest: 10);
+
+        cache.CachedTrieCount.ShouldBe(2);
+    }
+
+    [Fact]
+    public void ClusterIsolation()
+    {
+        var cache = new PermissionTrieCache();
+        cache.Install(Trie("c1", 1));
+        cache.Install(Trie("c2", 9));
+
+        cache.CurrentGenerationId("c1").ShouldBe(1);
+        cache.CurrentGenerationId("c2").ShouldBe(9);
+    }
+}