docs(c2): 2020-vs-2023R2 positive control for the event-read server gate #2

2026-06-26T11:08:46-04:00

dohertj2 commented

2026-06-26 11:08:46 -04:00

Summary

Folds the live 2020-vs-2023R2 positive control into the C2 evidence trail and corrects a stale code comment.

Prior C2 evidence triangulated the gate but lacked a positive control. This adds it: the same native WCF event-read client returns 5 real events from a local AVEVA Historian 2020 but 0 from the 2023 R2 server over the identical sequence/window, while both boxes hold tens of thousands of events in SQL. That isolates the zero-rows to the 2023 R2 server — not the client, protocol, or serializers.

Changes

docs/reverse-engineering/wcf-event-read-spike-results.md — new "2026-06-26 positive control" section (2020 vs 2023 R2 A/B from one WCF client; stock-2020-client version self-block caveat; stock-2023R2 gRPC cross-check).
docs/reverse-engineering/grpc-event-query-capture.md — re-control note: the 2026-06-22 stock 50-row capture did not reproduce (stock 2023 R2 client now also returns 0 rows).
tests/.../HistorianGrpcIntegrationTests.cs — corrects the stale "capture-gated, NOT server-gated" comment to the server-gate conclusion backed by the controls.

Verification

Build clean (tests project, Release, 0 warnings).
Gathered live today; output sanitized (counts / native return codes / buffer lengths only — no host, credential, or event identity).
Docs + comment only; no production logic. C2 stays closed won't-fix — this strengthens the rationale.

https://claude.ai/code/session_012SDSQ3AcaXqPcBtDESBRii

## Summary Folds the live **2020-vs-2023R2 positive control** into the C2 evidence trail and corrects a stale code comment. Prior C2 evidence triangulated the gate but lacked a positive control. This adds it: the *same* native WCF event-read client returns **5 real events from a local AVEVA Historian 2020** but **0 from the 2023 R2 server** over the identical sequence/window, while both boxes hold tens of thousands of events in SQL. That isolates the zero-rows to the **2023 R2 server** — not the client, protocol, or serializers. ## Changes - `docs/reverse-engineering/wcf-event-read-spike-results.md` — new "2026-06-26 positive control" section (2020 vs 2023 R2 A/B from one WCF client; stock-2020-client version self-block caveat; stock-2023R2 gRPC cross-check). - `docs/reverse-engineering/grpc-event-query-capture.md` — re-control note: the 2026-06-22 stock 50-row capture did **not** reproduce (stock 2023 R2 client now also returns 0 rows). - `tests/.../HistorianGrpcIntegrationTests.cs` — corrects the stale "capture-gated, NOT server-gated" comment to the server-gate conclusion backed by the controls. ## Verification - Build clean (tests project, Release, 0 warnings). - Gathered live today; output sanitized (counts / native return codes / buffer lengths only — no host, credential, or event identity). - Docs + comment only; no production logic. C2 stays **closed won't-fix** — this strengthens the rationale. https://claude.ai/code/session_012SDSQ3AcaXqPcBtDESBRii

dohertj2 added 1 commit 2026-06-26 11:08:47 -04:00

docs(c2): record 2020-vs-2023R2 positive control for the event-read server gate 54bcf8a5e0

Adds the positive control that the prior C2 evidence lacked. The SAME native WCF
event-read client returns real events (5) from a local AVEVA Historian 2020 but 0
from the 2023 R2 server over the identical sequence and window, while both boxes
hold tens of thousands of events in SQL — isolating the zero-rows to the 2023 R2
server, not the client, protocol, or serializers.

- wcf-event-read-spike-results.md: new "2026-06-26 positive control" section
  (2020 vs 2023 R2 A/B from one WCF client; stock-2020-client version-self-block
  caveat; stock-2023R2 gRPC cross-check).
- grpc-event-query-capture.md: re-control note — the 2026-06-22 stock 50-row
  capture did NOT reproduce; the stock 2023 R2 client now also returns 0 rows.
- HistorianGrpcIntegrationTests: correct the stale "capture-gated, NOT
  server-gated" comment to the server-gate conclusion backed by the controls.

Sanitized throughout (counts, native return codes, buffer lengths only).

Claude-Session: https://claude.ai/code/session_012SDSQ3AcaXqPcBtDESBRii

dohertj2 referenced this pull request

2026-06-27 11:58:31 -04:00

C4: capture native event-send wire that populates Source_Object (CM_EVENT SourceName drop) #3

This pull request can be merged automatically.

You are not authorized to merge this pull request.

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin docs/c2-2020-positive-control:docs/c2-2020-positive-control

git checkout docs/c2-2020-positive-control

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: dohertj2/histsdk#2