R1.4 GetHistorianInfo: bounded out on 2020 WCF (named-value-only, no struct)

Captured the native HistorianAccess.GetHistorianInfo(out HistorianInfo, out err)
and decoded the wire: over 2020 WCF, GETHI is a named-value query whose only
working key is "HistorianVersion" (response ~30 bytes = the version string).
Probed 7 storage-mode key names -> all ok=False/err. The 518-byte HISTORIAN_INFO
struct + EventStorageMode@514 is the 2023R2 HCAL-native/gRPC model (confirmed
from the decompiled 2023R2 source); on 2020 the native client derives the mode
outside the WCF wire.

Version is already exposed (ProbeAsync/GetRuntimeParameterAsync), so no hollow
GetHistorianInfoAsync is shipped (same disposition as R1.3 timezone). This
completes the reachable 2020-WCF M1 read surface; remaining M1 = config writes
(gated on explicit request) or gRPC/2023R2-only items.

RE aids kept: harness `historian-info` scenario, Capture-HistorianInfo.ps1,
decode-historian-info-capture.py, and StringHandleProbeDiagnosticTests
.GETHI_CandidateInfoNames (asserts the named-value-only finding; gated).
Docs: wcf-historian-info.md (new) + roadmap/matrix/wall-doc updates. 230 tests green.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01B6mcaT2PjRFKcogzp9UkfC

docs/plans/hcal-capability-matrix.md

@@ -99,7 +99,7 @@ blob needs RE).
 |---|---|---|---|---|---|
 | System parameter | `GetSystemParameter` | `Status.GetSystemParameter` | ✅ | DONE | |
 | Runtime parameter | `GetRuntimeParameter` | `Status.GetRuntimeParameter` | ⬜ | TRIVIAL | same shape as GetSystemParameter |
-| Historian info | `GetHistorianInfo` | `Status.GetHistorianInfo` | 🟗 | BOUNDED | GETHI buffer; partially decoded (incl. EventStorageMode @ offset 514) |
+| Historian info | `GetHistorianInfo` | `Status.GetHistorianInfo` | 🟗 | BOUNDED | **2020 WCF = version-only** (GETHI is a named-value query; `EventStorageMode` not on the wire). 518-byte struct + `EventStorageMode`@514 is gRPC/2023R2-only. See `wcf-historian-info.md` |
 | Server timezone | `GetSystemTimeZoneInfo` | `Status.GetSystemTimeZoneName` | ⬜ | TRIVIAL | |
 | Historization status | `GetHistorizationStatus` | `Status` op | ⬜ | BOUNDED | |
 | Store-and-forward status | `GetStoreForwardStatus` | (push events / pull GETHI) | 🟗 | HARD | currently synthesized; real read needs duplex push or a decoded pull endpoint — see store-forward plan |

docs/plans/hcal-roadmap.md

@@ -41,10 +41,14 @@ HCAL replacement, built on the **2023 R2 gRPC transport**. Derived from
 > (✅ 2026-06-20 — `ReadEventsAsync(…, HistorianEventFilter)`, live-honored). M2 event send is
 > also done (✅ WCF `AddS2`). **R1.2 `GetRuntimeParameterAsync` is also done** (✅ 2026-06-20,
 > `aa/Stat/GETRP`, live-verified) — notably a *string-handle* op that punches through the wall
-> using the Open2 storage-session GUID as an **uppercase** string handle, which is a strong lead
-> that the GETHI/ExeC failures are (at least partly) a handle-*format* issue rather than only a
-> missing native registration. **Cheap high-value follow-up: retry GETHI/ExeC with the uppercased
-> storage GUID** before assuming the registration wall (see `wcf-string-handle-wall.md` §Update).
+> using the Open2 storage-session GUID as an **uppercase** string handle, which proved the
+> GETHI/ExeC failures were a handle-*format* issue rather than a missing native registration.
+> **Follow-up done:** R1.1 `ExecuteSqlCommandAsync` shipped; R1.5 extended-property read shipped
+> (R1.6 collapsed into it — no distinct localized op). **R1.4 `GetHistorianInfo` bounded out on
+> 2020 WCF** — GETHI there is a named-value query (only `HistorianVersion`); `EventStorageMode` is
+> 2023R2-gRPC-only (see `wcf-historian-info.md`). Net: the **reachable 2020-WCF M1 read surface is
+> complete**; what remains is config *writes* (M1c — gated on an explicit user request) and the
+> gRPC/2023R2-only items (R1.3 timezone, R1.4 EventStorageMode — need a live 2023 R2 server).
 
 ## Guiding principles
 
@@ -106,7 +110,7 @@ read/browse/status surface is Windows-free and the gRPC stack is the default pat
 ### 1b. Bounded (decode one `bytes` payload; S–M each)
 | ID | Capability | gRPC op | Payload to decode | Depends |
 |---|---|---|---|---|
-| R1.4 | `GetHistorianInfoAsync` | `Status.GetHistorianInfo` (`GETHI`) | ✅ **REACHABLE (2026-06-20, live-probed)** via the uppercase storage GUID — `GETHI` returns data (`StringHandleProbeDiagnosticTests`). The version-keyed request returns `uint charCount + UTF-16`; the full info struct (incl. `EventStorageMode`@514) needs its own request capture. **Public API not yet shipped.** | uppercase string handle |
+| R1.4 | `GetHistorianInfoAsync` | `Status.GetHistorianInfo` (`GETHI`) | ⚠ **Bounded out on 2020 WCF (2026-06-20) — `EventStorageMode` not on the wire; version-only.** Captured the native `GetHistorianInfo(out HistorianInfo, out err)`: over 2020 WCF, `GETHI` is a **named-value query** whose only working key is `HistorianVersion` (returns `uint charCount + UTF-16` version, ~30 bytes). Probed 7 storage-mode key names → all `ok=False`/err. The 518-byte `HISTORIAN_INFO` struct + `EventStorageMode`@514 is the **2023R2 HCAL-native/gRPC** model (confirmed from the decompiled 2023R2 source); on 2020 the native client derives `EventStorageMode` **outside the WCF wire**. Version is already exposed (`ProbeAsync`/`GetRuntimeParameterAsync`), so **not shipped** here — same status as R1.3. Ship `HistorianInfo`/`HistorianEventStorageMode` on the gRPC path against a live 2023 R2 server. RE aids: `scripts/Capture-HistorianInfo.ps1`, `scripts/decode-historian-info-capture.py`, harness `historian-info` scenario, `StringHandleProbeDiagnosticTests.GETHI_CandidateInfoNames`. See `docs/reverse-engineering/wcf-historian-info.md`. | gRPC/2023R2 |
 | R1.5 | Extended-property **read** | `Retrieval.GetTagExtendedPropertiesFromName` | 🟡 **Likely reachable** via uppercase string handle (GetTepByNm family) — not yet individually re-probed. TEP result buffer. | uppercase string handle |
 | R1.6 | Localized-property **read** | `Retrieval.GetTagLocalizedPropertiesFromName` | 🟡 **Likely reachable** (same family) — not yet re-probed. | uppercase string handle |
 | ~~R1.7~~ | Event **filters** | filter bytes in `Retrieval.StartEventQuery` | ✅ **DONE (2026-06-20), live-honored.** `ReadEventsAsync(start, end, HistorianEventFilter)`. The filter rides `StartEventQuery`'s `pRequestBuff` (captured via `EventQuery.AddEventFilter` + instrument-wcf-writemessage; Equal vs Contains diffed to isolate the op). Filter block: `ushort 0 + uint filterCount + uint condCount + uint nameLen + name(UTF-16) + uint 1 + ushort op + uint 1 + value(0x09-len-0x00 compact-ASCII) + byte 0`. **REAL, not inert** (a non-matching predicate returns 0 events; matching returns the subset). Single string-valued predicate only; multi-filter (OR) / multi-condition (AND via `AddEventFilterCondition`) framing not yet fully captured. See `HistorianEventFilter`, golden `WcfEventQueryProtocolTests`. | — |

docs/reverse-engineering/wcf-historian-info.md

@@ -0,0 +1,68 @@
+# GetHistorianInfo over 2020 WCF — GETHI is named-value-only (HCAL R1.4)
+
+**Status: ⚠ Bounded out on 2020 WCF (2026-06-20).** `GetHistorianInfoAsync` is **not shipped**:
+the one field that motivates it — `EventStorageMode` — is **not on the 2020 WCF wire**. The
+version field that GETHI *does* return over WCF is already exposed (`ProbeAsync`,
+`GetRuntimeParameterAsync("HistorianVersion")`), so there is nothing new to ship here without a
+2023 R2 gRPC server. This parallels R1.3 (`GetServerTimeZone`), which is likewise 2023R2-only.
+
+## What the capture showed
+
+`scripts/Capture-HistorianInfo.ps1` drives the native `HistorianAccess.GetHistorianInfo(out
+HistorianInfo, out error)` through the instrumented (`instrument-wcf-{write,read}message`)
+`current/aahClientManaged.dll`. The native call **succeeds** and returns
+`EventStorageMode = Blocks`, `ServerVersion = 20,0,000,000`, no error.
+
+But the wire tells a different story (`scripts/decode-historian-info-capture.py`):
+
+- The only `GETHI` op on the wire is **`aa/Stat/GETHI(handle, pRequestBuff)`** with
+  `pRequestBuff = 53 67 02 00` (sig `0x6753` + version `2`) `+ uint charCount(16) + UTF-16
+  "HistorianVersion"` — i.e. the **named-value request**, identical to the GETRP/version shape.
+- Its response `pResponseBuff` is **~30 bytes**: `uint charCount(12) + UTF-16 "20,0,000,000"`
+  (+ a `02 00 01 00` trailer). **Just the version** — not a 518-byte struct.
+- The post-GETHI ops in the same capture are `Hist/UpdC3` + a run of `Stat/GetSystemParameter`
+  (`AllowOriginals`, `HistorianPartner`, `HistorianVersion`, `MaxCyclicStorageTimeout`,
+  `RealTimeWindow`, `FutureTimeThreshold`, `AllowRenameTags`). **None carries a storage-mode
+  value.** So the native wrapper's `EventStorageMode` is derived by the C++ HCAL **outside the
+  WCF wire**, not fetched over it.
+
+## Probe: does GETHI expose storage mode under any name?
+
+`StringHandleProbeDiagnosticTests.GETHI_CandidateInfoNames_AgainstLocalHistorian` (gated on
+`HISTORIAN_HOST=localhost`) issues GETHI for `HistorianVersion` plus seven storage-mode name
+guesses. Result on the live 2020 server:
+
+| GETHI parameter name | result |
+|---|---|
+| `HistorianVersion` | **ok=True**, respLen=32 (version) |
+| `EventStorageMode`, `EventStorageType`, `StorageType`, `HistorianEventStorageMode`, `EventStorage`, `StorageMode`, `HistorianInfo` | **ok=False**, errLen=5, empty |
+
+So GETHI on 2020 WCF is a strict named-value lookup with exactly one known-good key
+(`HistorianVersion`). There is no storage-mode key, no full-struct request.
+
+## Why the 518-byte struct doesn't apply here
+
+The 2023 R2 decompiled `ArchestrA.HistorianAccess.GetHistorianInfo` (analysis folder) allocates
+a **518-byte `HISTORIAN_INFO`** struct, pre-inits `int32 @514` to `-1`, calls native HCAL
+(vtable+648) which fills it, then reads version (UTF-16 @0) + `EventStorageMode` (`@514`:
+`-1`=Unsupported, `0`=Database, else=Blocks). That is the **HCAL-native / 2023R2 gRPC**
+front-door model (`StatusService.GetHistorianInfo` returns `bytes btHistorianInfo`). On **2020
+WCF** that struct is never marshaled across the wire — only the version named-value is. The
+native client's `EventStorageMode` therefore comes from C++-internal state the managed WCF
+replay cannot observe or reproduce.
+
+## Conclusion / where it lands
+
+- **2020 WCF:** `GetHistorianInfoAsync` would add nothing over existing surface (version only) and
+  could not report a real `EventStorageMode` — so it is intentionally **not shipped** (no hollow
+  `Unsupported`-returning API; project discipline: don't ship misleading behavior).
+- **2023 R2 gRPC:** `Status.GetHistorianInfo` returns the full 518-byte `btHistorianInfo`; decode
+  version@0 + `EventStorageMode`@514 there. Build + verify against a live 2023 R2 server. The
+  `HistorianInfo` / `HistorianEventStorageMode` public types should land alongside that path.
+
+## Tooling kept as RE aids
+
+- `tools/AVEVA.Historian.NativeTraceHarness` `historian-info` scenario (drives the native call).
+- `scripts/Capture-HistorianInfo.ps1` + `scripts/decode-historian-info-capture.py`.
+- `StringHandleProbeDiagnosticTests.GETHI_CandidateInfoNames_AgainstLocalHistorian` (locks the
+  named-value-only finding; gated).

docs/reverse-engineering/wcf-string-handle-wall.md

@@ -111,7 +111,11 @@ GETHI and **ExeC both return data with the uppercased storage-session GUID**.
   read-only with `System.Formats.Nrbf` + `XDocument` (BinaryFormatter is gone from .NET 10).
   Shipped: `HistorianSqlResultProtocol`, `HistorianWcfSqlClient`, golden `WcfSqlResultProtocolTests`,
   gated live tests. See `docs/reverse-engineering/wcf-exec-sql.md`.
-- **GETHI (R1.4)** also returns data with the uppercase handle (probe; public API not yet shipped).
+- **GETHI (R1.4)** returns data with the uppercase handle, **but only the named `HistorianVersion`
+  value** — over 2020 WCF GETHI is a named-value query (the only working key), *not* a full-struct
+  read. `EventStorageMode` (the 518-byte-struct `@514` field) is **not on the 2020 WCF wire**; it is
+  the 2023R2 HCAL-native/gRPC model. So R1.4 is **bounded out on WCF / gRPC-2023R2-only** and the
+  public API is intentionally not shipped. Full analysis: `docs/reverse-engineering/wcf-historian-info.md`.
 
 So the "wall" collapses to the handle **format** for the Retrieval/Status string-handle ops.
 **Exception — QTB/QTG:** `StartTagQuery` does *not* punch through; captured with a correctly