Initial commit: managed .NET 10 AVEVA Historian SDK + reverse-engineering toolkit

Full read-only SDK (src/AVEVA.Historian.Client) implementing the CLAUDE.md required
surface against AVEVA Historian's binary WCF protocol — no native AVEVA runtime
dependency. All operations live-verified against a local Historian:

- ProbeAsync, ReadRawAsync, ReadAggregateAsync, ReadAtTimeAsync, ReadEventsAsync
- BrowseTagNamesAsync, GetTagMetadataAsync (17 native data-type codes mapped)
- GetConnectionStatusAsync, GetStoreForwardStatusAsync, GetSystemParameterAsync
- 108/108 unit + integration tests pass

Includes the reverse-engineering toolkit (tools/AVEVA.Historian.ReverseEngineering)
used to decode the protocol: WCF probes, IL inspection via dnlib, and IL-rewrite
instrumentation (instrument-wcf-{write,read}message etc.) plus the .NET Framework
trace harness (tools/AVEVA.Historian.NativeTraceHarness) for parity testing.

Sanitized handoff evidence under docs/reverse-engineering/. Native AVEVA binaries
(current/, aveva-install-x64/, aveva-install-x86/) are gitignored — fetch separately
from the AVEVA installer.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

docs/reverse-engineering/query-handle-correlation-latest.json

@@ -0,0 +1,38 @@
+{
+  "GeneratedUtc": "2026-05-02T22:53:41Z",
+  "Scenario": "native integrated history read",
+  "Sanitized": true,
+  "InstrumentedMethods": {
+    "HistorianClient.OpenConnection": "0x060055D8",
+    "Query.StartDataQuery": "0x0600574B",
+    "CRetrievalConnectionWCF.StartQuery2": "0x06004A0D",
+    "CRetrievalConnectionWCF.GetNextQueryResultBuffer2": "0x06004A0E",
+    "HistorianClient.GetNextRow<DataQueryResultRow>": "0x0600588D"
+  },
+  "ObservedValues": {
+    "HistorianClientOpenConnectionSuccess": 1,
+    "HistorianClientOpenConnectionHandle": 2,
+    "StartDataQueryClientHandleCandidate": 2,
+    "StartDataQueryRequestLength": 251,
+    "StartDataQueryRequestSha256": "96e520349e06a5cfab6099f86c6304aac22f4f3e46dba282a859ff0a640b2608",
+    "WcfStartQuery2Success": 1,
+    "WcfStartQuery2ClientHandle": "<transient-redacted>",
+    "WcfStartQuery2QueryRequestType": 1,
+    "WcfStartQuery2RequestSize": 251,
+    "WcfStartQuery2ResponseSize": 31,
+    "WcfStartQuery2ResponseSha256": "4c062b5ce8181308f0f46bfd8c6088acb52e6ade94401651b7d3ccc8952edfb5",
+    "WcfStartQuery2ServerQueryHandle": "<transient-redacted>",
+    "WcfStartQuery2ErrorSize": 0,
+    "WcfGetNextQueryResultBuffer2Success": 1,
+    "WcfGetNextQueryResultBuffer2UsesSameWcfClientHandle": true,
+    "WcfGetNextQueryResultBuffer2UsesSameServerQueryHandle": true,
+    "WcfGetNextQueryResultBuffer2ResultSize": 570,
+    "WcfGetNextQueryResultBuffer2ResultSha256": "cc9dc2078ea0b5d5aabf2940bebe11700117a4c1e2583bfdeb033af7ddbe459d",
+    "WcfGetNextQueryResultBuffer2TerminalBufferSize": 5,
+    "WcfGetNextQueryResultBuffer2TerminalBufferSha256": "7db15e1972ced8a44dae4d75f7a1f0cd74858c7d0deb8b3522d6a05904778bf7",
+    "GetNextRowClientQueryHandle": 1,
+    "GetNextRowDataQueryResultRowLength": 512,
+    "GetNextRowDataQueryResultRowSha256": "acc37153a017c99960bf84f61d003760b7a1749c4c94c1c6fc31871403fcaf71"
+  },
+  "Conclusion": "Query.StartDataQuery passes the legacy native client handle 2 into the common retrieval layer. The successful WCF StartQuery2 call uses a different transient retrieval session handle, so direct managed read replay must reproduce the session/client mapping below the native ClientApp handle, not just the 251-byte DataQueryRequest."
+}