diff --git a/scripts/validation/scadabridge-sdk-compatibility/README.md b/scripts/validation/scadabridge-sdk-compatibility/README.md
index 3b3eb4c54..7122a4c07 100644
--- a/scripts/validation/scadabridge-sdk-compatibility/README.md
+++ b/scripts/validation/scadabridge-sdk-compatibility/README.md
@@ -24,9 +24,17 @@ python3 scripts/validation/scadabridge-sdk-compatibility/run.py \
   --results /absolute/fresh-consumer-evidence
 ```
 
-The helper runs four separate consumer/server pairs: each application version
-with None and SignAndEncrypt. None is enabled only in its own test fixture;
-the ordinary compatibility host remains strict SignAndEncrypt. The task key is
+The helper runs each application version with None, Sign and SignAndEncrypt,
+plus two trust negative controls per secure profile (server does not trust the
+client, client does not trust the server) that must fail closed. None and Sign
+are enabled only in their own test fixtures (`OPCUA_MATRIX_SERVER_SECURITY=none|sign`);
+the ordinary compatibility host remains strict SignAndEncrypt. Before each secure
+leg the probe's `prepare` step provisions the consumer identity through
+ScadaBridge's own certificate code and exports only its public certificate, which
+the runner places in the server's trusted store before the server starts.
+`OPCUA_MATRIX_ACL=off` disables the server's node-ACL check; with it on, masters
+after lmxopcua#808 deny the three UNS cases because this fixture creates the `Eq`
+folder without a deployed generation (fixture limitation, see lmxopcua#782). The task key is
 generated per process pair, issuer/trusted/rejected stores are task-local, and
 server public certificates are explicitly copied. Autoaccept remains false.
 Never commit an entire output directory: it contains the fixture's private PKI.
@@ -37,10 +45,10 @@ and timestamps, alarm filter/ConditionRefresh and disconnect/reconnect. History
 and Part 9 acknowledgment are not exposed by the inspected consumer interfaces;
 the parent Shared/CLI matrix covers those application services instead.
 
-ScadaBridge#121 is a reproduced preexisting limitation: SignAndEncrypt fails
-against **both** original and candidate servers because the consumer does not
-configure an application certificate. A matching baseline failure is evidence,
-not a secure-channel pass. The runner retains the nonzero result and each actual
-failure; it does not loosen trust or change expected results to return success.
-The current None subset and the missing secure identity must be reported
-separately. No ScadaBridge production source or user PKI is modified.
+ScadaBridge#121 (consumer never configured an application certificate) is
+fixed in ScadaBridge `ff835447`/`36c64a6b`. Re-run 2026-11-12 with ScadaBridge
+`424db155`: None, Sign and SignAndEncrypt 9/9 against the SDK 1.5.378 baseline
+(`83ed880e`), the SDK 2.0.1 candidate (`ebdc5892`) and master `182fb353` with
+ACL off; all trust negative controls failed closed. The runner retains the
+nonzero result and each actual failure; it does not loosen trust or change
+expected results to return success. No ScadaBridge production source or user PKI is modified.