docs: ServerHistorian HistoryRead knobs + Security:Ldap resilience keys; R2-08 status (03/S2, 03/S3)

archreview/plans/R2-08-ldap-historyread-async-plan.md

@@ -674,3 +674,27 @@ Commit: `docs: ServerHistorian HistoryRead knobs + Security:Ldap resilience keys
 the usual test-run + review cadence. Risk concentrated in T11 (parallel fan-out — mitigated by the
 thread-safety audit + the paging regression suite) and T4/T5 (auth-path semantics — mitigated by the
 fail-closed default posture and behavior-neutral defaults).
+
+## Execution deviations (R2-08)
+
+- **T1 RED shape.** Written against the *current* 3-arg ctor with a `Stopwatch` timing assertion (the
+  plan's explicitly-allowed alternative), not the intended-ctor compile-fail — so every commit compiles.
+  T4 then re-pointed it at the new `Options.Create(...)` ctor to turn it green.
+- **Async parking fakes.** The concurrency-cap repro (`GatedFakeLdap`) and the limiter repro
+  (`GatedRawFake`) had to park **asynchronously** (await a `TaskCompletionSource`), not block a thread
+  synchronously — a synchronous block before the first `await` deadlocks the caller (the core task never
+  yields its `Task`). Documented inline in both fakes.
+- **T6 InternalsVisibleTo.** Driving the real `internal static OpcUaApplicationHost.HandleImpersonation`
+  from `Host.IntegrationTests` required adding an `InternalsVisibleTo` for that test assembly to the
+  OpcUaServer csproj (the plan called for the internal drive but not the grant). Additive + reversible.
+- **T13 fake ignores the deadline token.** `GatedRawFake.ReadRawAsync` deliberately does **not** observe
+  the per-request deadline `ct`: with a small `HistoryReadDeadline`, the parked first batch would
+  otherwise cancel its own read and free the limiter permit before the second batch checks (race). By
+  parking on the release gate only, the first batch holds the permit deterministically, so the second
+  batch reliably hits the saturated limiter → `BadTooManyOperations`.
+- **T14 sweep scope.** Per the executor's memory constraint (heavy `*.IntegrationTests` / Playwright
+  suites leak ~16 GB and the LDAP integration harness spins an ephemeral openldap on :3894), the
+  whole-solution `dotnet test` was **not** run. Instead: a full-solution `dotnet build` (clean) + the
+  impacted **filtered** unit suites (Host.IntegrationTests LDAP-classes only, Security.Tests,
+  Runtime.Tests options, OpcUaServer.Tests HistoryRead). The whole-solution + live legs are deferred to a
+  serial heavy pass / VPN run.