D2 follow-up: RTag2 doesn't cascade client identity to Trx

Tested hypothesis (1) from the plan: add RTag2(CM_EVENT tag id) to the
priming chain before AddNonStreamValuesBegin2.

Result:
- RTag2 itself succeeds: returns 25-byte response
  (01000000000100000001EE39C30EDCDC010100000000000000), no error buffer.
- But AddNonStreamValuesBegin2 still fails with the same
  04 33 00 00 00 (UnknownClient = 51) for all four handle formats.

So RTag2 on /Hist isn't the cross-service registration trigger we need
for /Trx. Plan doc updated with the result + next-session ordered
probes (try IStorageServiceContract, then IL walk CClientCommon,
then server-side decompile as last resort).

Probe orchestrator now also performs the RTag2 step so the test gives
one-shot diagnostic visibility of both calls.

178/178 tests pass.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

docs/plans/revision-write-path.md

@@ -169,15 +169,41 @@ finding what populates Trx's session table — likely:
    show up in the IL we've inspected (e.g., the
    `aahClientCommon.CClientCommon` calls during InitializeProxy)
 
-A future session that wants to push further should:
-1. Add `RTag2` for the sandbox tag and retry Begin2 — quick experiment
-2. If that fails, try sending the IStorageServiceContract.AddT or
-   similar to "introduce" the tag to Trx
-3. If that fails, do an IL walk of `aahClientCommon.CClientCommon`
-   methods called between Open2 and AddNonStreamValuesBegin in a
-   working native scenario (using a system tag the wrapper would
-   accept — or capturing actual on-wire bytes via the IL-rewrite
-   instrumentation if possible)
+A future session that wants to push further should try (in order):
+
+1. ✅ **DONE 2026-05-05.** Add `RTag2(CM_EVENT tag id)` to the priming
+   chain — confirmed `RTag2` itself succeeds (returns 25-byte response),
+   but `AddNonStreamValuesBegin2` still fails with `UnknownClient`.
+   So RTag2 doesn't cascade client identity to Trx.
+2. Try `IStorageServiceContract` ops (`AddT`, `AddTP`) on `/Storage`
+   — that endpoint isn't currently bound by our SDK but the contract
+   is declared in `Wcf/Contracts/IStorageServiceContract.cs`. Maybe
+   one of its ops registers the client with Trx as a side effect.
+3. Decompile / IL-walk `aahClientCommon.CClientCommon` methods that
+   the native code calls between Open2 and AddNonStreamValuesBegin
+   to find any "client-with-Trx" registration we're missing.
+4. As a last resort, decompile `aahClientAccessPoint.exe` (the server
+   binary) to find what populates Trx's session table — the answer
+   is in there, just not in the client surface.
+
+### Current state of the SDK-direct probe
+
+`HistorianWcfRevisionOrchestrator.ProbeBeginAsync` does:
+
+```
+Open2 (write-enabled, 0x401)
+  → priming (Stat.GetV ×2, Stat.GETHI ×2, UpdC3, 6× GetSystemParameter,
+             AllowRenameTags, Trx.GetV, Stat.GetV, Retr.GetV)
+  → RTag2(CM_EVENT tag id)            // succeeds
+  → Trx.GetInterfaceVersion           // succeeds, returns version 2
+  → Trx.AddNonStreamValuesBegin2 ×4   // all four handle formats fail with
+                                      // 04 33 00 00 00 (UnknownClient 51)
+```
+
+The probe is committed as a gated test
+(`HistorianWcfRevisionProbeTests.AddNonStreamValuesBegin_ProbeReturnsServerResult`)
+that can be re-run any time to verify the gate is still where we think
+it is, or to test future priming additions.
 
 ## Decision