Full per-tag browse(): parse the type-info tree (access-sequences)

[ale-rinaldi]

Full per-tag browse() — parse the type-info tree

list_datablocks() now enumerates all DBs (gijzelaerr#749), but browse() does not yet return the per-tag symbol tree (name + access-sequence + datatype). This is the last read-side feature for parity with the C# reference driver (thomas-v2/S7CommPlusDriver), which enumerates the full symbol table.

Goal

browse() returns a flat list of variables — {name, access_sequence (LID path), data_type, db_number} — convertible to snap7.tags.Tag and readable via read_tag(). On a real S7-1500 this should yield the full symbol set of the loaded program (name | access-sequence | type).

Already in place

• DB list via EXPLORE(thePLCProgram) + S7CommPlus fragment reassembly (send_request(..., reassemble=True)) — feat(s7commplus): enumerate datablocks via EXPLORE (request fix + fragment reassembly) gijzelaerr/python-snap7#749.
• PObject-tree parser, corrected V2 wire format and TLS — fix(s7commplus): correct V2 symbolic reads on a real S7-1500 (wire format + async/server TLS-in-COTP) gijzelaerr/python-snap7#745/fix(s7commplus): restrict TLS groups in-code so the handshake works on OpenSSL >= 3.5 gijzelaerr/python-snap7#746.

What's missing (the hard part)

Mirror Browser + the type-info parsing from the C# driver:

1. For each DB, read LID = 1 (ItemAddress AccessArea=db_relid, AccessSubArea=DB_ValueActual, LID=[1]) to get the type-info RID (needed for instance DBs e.g. TON, whose TI is not the DB's own RID).
2. Add the native areas manually (IArea/QArea/MArea/S7Timers/S7Counters) with their known RIDs.
3. EXPLORE Ids.ObjectOMSTypeInfoContainer (537) recursively — a very large, multi-fragment PDU (reassembly already handles it) — to obtain the full type system.
4. Recombine type-info with the DB nodes into a tree (Root → struct members → leaves), computing access-sequences (LID paths) and offsets; handle arrays, struct-arrays, optimized/non-optimized offsets and bit-offsets.

C# reference (thomas-v2/S7CommPlusDriver, LGPL-3.0)

• ClientApi/Browser.cs (~700 lines: BuildFlatList/AddFlatSubnodes)
• Core/PObject.cs, Core/PVartypeList.cs, Core/POffsetInfoType.cs
• S7CommPlusConnection.Browse() (the LID=1 → TI-RID step + recombination)

Validation

Against a live S7-1500: browse() yields the program's full symbol set; spot-check that read_tag() on a browsed Tag returns the same value as a direct read_symbolic() by access-sequence.

Depends on gijzelaerr#749.