test: add bounded SDK2 close ownership controls

scripts/validation/opcua-lifecycle-memory/RESOLUTION.md

@@ -0,0 +1,96 @@
+# Issue #799 resolution gates
+
+Status: prospective procedure under review, **not approved for launch**. The
+retained cold failures remain failures. This document does not change the plan's
+resource budgets, establish a replacement baseline, or authorize release.
+
+## Separate the evidence
+
+| Question | Evidence required | Current boundary |
+|---|---|---|
+| Finite generated-code startup | Fixed canonical operation sequence and bounded, lossless trace windows | Candidate saturation met the selected factory criterion. Summed native MethodSize does not explain all RSS. |
+| Cross-version lifecycle ownership and memory | Equivalent operations, token invalidation, dropped harness roots, resource-owner checks and matched executable hosts | Original closed objects retain continuation lists while held by the harness; usable steady-state comparison is not established. |
+| Continuing macOS native retention | Private-key import attribution, bounded native inventory, supported ownership correction and verification | Balanced managed disposal alone has not stopped Apple Security object accumulation. Linux results cannot close this component. |
+
+The coordinator owns integration and long executions. Two independent Sol agent
+lanes own `baseline-canonical/` and `native-retention/` respectively; use high
+effort for control implementation and ownership analysis. Astra at xhigh reviews
+each control design, its result, any production correction, and the complete
+acceptance procedure before execution. No worker changes the other lane's files,
+production factory architecture, immutable baseline, or acceptance denominator.
+
+## Short controls before a new long run
+
+The original-SDK lane must demonstrate removal from SessionManager, rejection of
+the old authentication token, and rejection of old browse/history continuation
+tokens from a fresh session. A helper boundary must drop all strong Session,
+continuation and harness references before bounded GC/weak-reference observations.
+Observe closed-session/point weak references while the same host remains live,
+then separately observe application/validator/store roots after normal host stop;
+teardown must not hide retention of closed sessions. Inventory separately
+identifies which resource owner releases each object.
+Retain the earlier held-object failure. Do not explicitly dispose abandoned
+objects or clear caches merely to make the baseline pass. Unsupported original
+ownership probes remain unsupported, rather than being reported as zero.
+
+The native lane must attribute configured-store private-key loads separately
+from public certificate and shared-handle operations using fixed counts and
+identical certificates. Include a separate bounded store-update semantic control
+so registry reuse cannot silently bypass configured-store rotation. Review exact
+SDK 2.0.1 public ownership seams before any
+application correction. A supported correction needs a failing-before/passing-
+after ownership control and preserved trust, private-key availability, reconnect
+and shutdown behavior. Custom crypto, copied transport negotiation, SDK forks,
+factory substitution and certificate-policy changes require a separate design;
+they are not fixes authorized by this procedure. Keep private PKI out of Git.
+
+## Prerequisites for reviewing warmed acceptance
+
+1. Establish operation/status/order parity and semantically valid close/ownership
+   checks across versions. Match executable host, runtime, architecture and
+   instrumentation. A growing original process is not an accepted denominator.
+2. Freeze source commits, all artifact hashes, runtime/image identities, private
+   PKI identity, fixtures and the serial same-host schedule before launch.
+3. Submit the actual harness change, negative controls and immutable artifact
+   receipts to Astra. Approval of diagnostics is not approval of acceptance.
+4. Resolve continuing macOS native growth independently. A Linux acceptance run
+   cannot waive it, even if the Linux resource guard passes.
+
+Before this draft becomes executable, define version-appropriate standard-node
+loading/factory trace coverage for the original binary. The absence of SDK2's
+`Opc.Ua.OpcUaExtensions` type must not let the original pass an irrelevant zero
+counter. Also predeclare identical retained-managed/GC and RSS sampling cadence
+and statistics, including exactly which samples feed the relative 15% comparison.
+These details remain pending; observed results cannot select them retroactively.
+
+## Proposed fixed warmup and measurement
+
+This section is a review proposal only. If the prerequisites and Astra gate pass,
+qualification uses exactly 384 canonical cycles / 96 restarts plus one settling
+cycle within 1,800 seconds. The fixed trace windows are cycles 321–352 and
+353–384, with the continuous veto across their boundary. Require zero generated-
+factory JIT/load events, zero new SDK assembly loads and zero lost events. Reject
+missing markers, wrong identity or observer faults. Do not extend or retry the
+qualification until a favorable sample appears.
+
+Prospectively select exactly the post-cycle-385 sample as the measurement
+baseline; do not choose a minimum, median or later sample from observed RSS.
+Retain all cold, peak and rejected rows. Measurement must then last at least
+7,200 actual seconds **after** warmup, retaining the +64 MiB managed, +128 MiB
+RSS and +32 descriptor caps, all canonical operations and semantic/native/
+ownership guards. Latch the first failure permanently. No resource resets,
+skipped operations or completion claim on a rejected run.
+Setup, warmup and final cleanup do not count toward measurement duration. Final
+shutdown and ownership checks are mandatory after that duration completes.
+
+For uninstrumented acceptance, first perform an identical fresh paired
+qualification rehearsal, then use the fixed warmup without EventPipe or
+allocation StackTrace tracking. The earlier tracked candidate run cannot be
+relabelled as this evidence. Predefine sampling and statistics for at least three
+matched representative runs to assess the separate plan-relative throughput,
+latency, allocation and RSS budgets. A two-hour absolute-cap pass alone does not
+satisfy those comparisons.
+
+Only verified results meeting these distinct requirements can support closing
+#799. Keep #782 G4 and draft PR #802 on hold until their remaining gates also
+pass; Windows/runtime and licensed interoperability evidence remain separate.