docs: record reviewed close ownership and native attribution

2026-11-10 16:39:34 -05:00
parent af71fb11ba
commit 0c0209f9a6
3 changed files with 1631 additions and 0 deletions
@@ -520,3 +520,32 @@ G4 resource/performance acceptance remain unresolved.** #799, #800, #801 and
 ScadaBridge#121 stay open. Neither an SDK version substitution, production crypto/
 session-factory workaround, resource-cap waiver nor warmed acceptance baseline
 was approved. SDK2 remains on draft PR#802; it is not merged to master or deployed.
+
+## Follow-on #799 close ownership and native attribution
+
+The [candidate bounded close control](evidence/2026-11-10-opcua2/close-ownership-candidate.md)
+at `564f1091` passed with one abandoned browse and six abandoned history points.
+Old authentication returns exactly BadSessionIdInvalid; old continuation tokens
+are rejected without a history-backend read while fresh-session positives work.
+All 23 old-object weak targets collect with the same host still running; all 13
+application/server/manager/core/store targets collect after normal shutdown.
+SDK2's stronger `(0,0)` closed-list check, two manager-disposal checks, empty
+caches and zero PKI descriptors remain enforced. Astra verified the actual TRX.
+Six affected history tests also pass; their original launcher mistakenly expected
+seven, and the retained false guard receipt has a separate independently reviewed
+six-test source/TRX correction. No failed test was relabelled or rerun for that fix.
+
+The [fixed macOS store-versus-registry control](../../scripts/validation/opcua-lifecycle-memory/native-retention/README.md)
+completed its execution/ownership checks, **not native-retention acceptance**.
+Two hundred configured-store acquisitions leave AppleDatabase inventory 3→203;
+registry AddRefs remain 3→3. After normal disposal and five seconds idle, both
+arms have zero SDK certificate owners, runtime-tracked temporary keychains,
+temporary-keychain files, keychain descriptors and PKI descriptors. The installed
+runtime calls CFRelease after native deletion; a missing managed release is not
+indicated. Native ownership/delete status, complete RSS attribution and a supported
+mitigation remain unresolved. Registry substitution would change deliberate
+configured-store replacement semantics and was not adopted.
+
+These results leave the original cold RSS failures and #799/G4 unchanged. The
+[prospective resolution procedure](../../scripts/validation/opcua-lifecycle-memory/RESOLUTION.md)
+is explicitly a design draft, not approval to launch a warmed acceptance run.
@@ -0,0 +1,41 @@
+# Candidate close and weak-root control
+
+The final bounded control at `564f10914357fc34db303b2faf030907663e6779`
+passed: one test executed, one passed, no skips; runner elapsed 10.082 seconds.
+It creates one abandoned browse point and six abandoned history points through
+the same encrypted canonical fixture helpers. Before close, the retained server
+session has exactly `(1,6)` points; SDK2's stronger post-close `(0,0)` check remains.
+
+The old authentication token returns exactly `BadSessionIdInvalid` (`0x80250000`).
+A fresh session rejects both old continuation tokens with
+`BadContinuationPointInvalid`; invalid history does not call the historian.
+Fresh reads and the session's own browse/history roundtrips succeed around the
+denials, so a generally broken channel cannot satisfy this control.
+
+After the session helper and its completed async state machine leave the isolated
+boundary, **all 23 old client/session/point/value/state targets are collectible
+while the same server is still running**, in each of five fixed GC observations.
+After normal host/application disposal and the fixture boundary, all 13 observed
+application/configuration/manager/validation-core/store/server/node-manager/
+backend targets are collectible in every round. Independent retained/collectible
+observer controls behave as expected. Both SDK2 certificate managers are disposed,
+cached stores are empty and actual PKI descriptors are zero.
+
+Earlier one-history-point control receipts remain recorded: `b5986c61` passed
+with the original two-status auth whitelist; `6737e367` passed after narrowing to
+the observed exact status. Six affected history tests also passed at `6737e367`.
+Their launcher mistakenly expected seven tests. The original false guard receipt
+is retained; a separate source inventory and TRX review confirms four session
+history tests plus two event-paging tests, all executed/passed. No seventh source
+test is missing and the tests were not rerun to correct that bookkeeping error.
+
+[Machine-readable observations, commands and raw hashes](close-ownership-candidate.json)
+retain all four executions. The current build has zero warnings/errors. Astra
+reviewed the design and actual code before each diagnostic execution; it verified
+all three close-control TRX files, the aligned 23/13 weak-target result and the
+six-test inventory correction independently.
+
+This establishes bounded candidate close semantics and managed collectibility.
+It does **not** establish full canonical operation/host parity with the original
+standalone adapter, a steady RSS denominator, a resource-budget waiver, macOS
+native-retention resolution or G4 acceptance. No production code changed.