test: preserve saturation outcome and classify final CI corrections

docs/plans/2026-11-10-opcua-sdk-2-evidence.md

@@ -68,7 +68,7 @@ No optional ManagedSession/DI/AOT/cluster redesign, trust relaxation, silent war
 - G1 restored 2.0 graph / break inventory: passed; compilation convergence subsequently passed G2.
 - G2 compilation convergence: passed; whole-solution Release builds have zero warnings/errors and temporary migration assets are removed.
 - G3 behavioral/security/interoperability: pending.
-- G4 lifecycle/performance/publish: pending.
+- G4 lifecycle/performance/publish: failed/open for the canonical RSS gate (#799); scoped client lifecycle/publish results are recorded below.
 - Astra security/ownership source findings: closed for the reviewed identity, history, audit and browse changes; final release review remains pending.
 
 No upgraded artifact is approved for release.
@@ -396,7 +396,7 @@ only a **prospective diagnostic saturation design**, recorded in the report:
 384 fixed canonical cycles/96 restarts plus one settling cycle within1,800 seconds;
 fixed traced windows321–352 and353–384; zero generated-factory compilations,
 new SDK assembly loads and lost events; ownership checks active throughout.
-That experiment has not run and cannot pass G4. Matched full acceptance requires
+That experiment had not run at that review; its later diagnostic result is recorded below and cannot pass G4. Matched full acceptance requires
 an original-SDK adapter for the identical canonical workload and at least7,200
 seconds **after** a prospectively reviewed fixed warmup. Historical failures and
 macOS native retention remain open in #799. No release approval was given.
@@ -418,9 +418,8 @@ master push; [immutable package/test receipt](evidence/2026-11-10-historiangw-13
 Independent actual-package SDK2 Gateway verification also passed 523/0/6.
 
 The integrated SDK2/HG 1.0 solution built with 0 warnings/errors in 46.91 seconds.
-Fresh CI3 is running under `artifacts/opcua2/f2a8ce13/solution-tests3/`, preserving
-its test/guard exits and the 12,000 execution floor. CI2 remains the historical
-pre-HG 1.0 result; CI3 final counters will be recorded after completion.
+CI3 and the corrected follow-up run are recorded below; every command preserves
+test/guard exits and the 12,000 execution floor. CI2 remains historical pre-HG 1.0 evidence.
 
 All four self-contained Host/CLI publishes and actual Linux Host two-start/stop
 checks were repeated on the HG 1.0 graph at `f2a8ce13`: all passed. Both Host
@@ -429,3 +428,53 @@ SDK family remains 2.0.1. Six strict HMAC/peer cases, two Good published-CLI rea
 preserved certificate identity and zero task-secret matches passed. See the
 [fresh publication/runtime report](evidence/2026-11-10-opcua2/publish-smoke-hg100.md).
 Windows actual install/runtime #800 and live/paired-environment #801 remain pending.
+
+
+## CI3 investigation and corrected final verification
+
+The post-HG 1.0 full CI3 run at `f2a8ce13` produced **63 TRX, 19,124 total,
+18,489 executed, 18,472 passed, 17 failed and 635 existing skipped** results.
+Test exit 1 and execution guard 0 are retained in
+[the complete summary](evidence/2026-11-10-opcua2/solution-tests3.json).
+Eleven failures match the established baseline issues #796/#798. Five browser
+failures came from a task simulator with differing advertised/internal and host
+ports. Matching those ports restores browser 5/5 and driver 5/5 with no source
+change. Actual SDK1.5.378.182 browser binaries also fail the different-port
+advertisement with the same DNS error: [baseline NAT parity](evidence/2026-11-10-opcua2/browser-nat-parity.md).
+The preexisting browser capability gap is [#806](https://gitea.dohertylan.com/dohertj2/lmxopcua/issues/806),
+not a new SDK2 behavior or a security-policy workaround.
+
+The final failure was a preexisting Runtime test-ordering race: an EF-presence
+wait captured the first apply before its later NodeAdded announcement. A gated
+controlled reproduction proves 1→2 with one EF and one announcement. The narrow
+repair awaits correlated clean completion replies for both rebuilds, retaining
+all idempotence assertions and existing budgets. Astra reviewed source causality
+and RED/GREEN proof. SDK2 and independent SDK1.5 owning Runtime suites each pass
+**1,002 tests, zero failures and 3 existing skips**. The test-only fix landed on
+master `52d1373e`, merged at `75057d8c`; [#805](https://gitea.dohertylan.com/dohertj2/lmxopcua/issues/805)
+closed with validation. [Exact repair evidence](evidence/2026-11-10-opcua2/rebuild-test-barrier.md).
+No product code, expected result, timing budget or skip was changed.
+
+The complete solution rebuilt at `75057d8c` with **zero warnings/errors**, 26.61 s.
+Fresh full CI4 is now running with the corrected simulator and completion-barrier
+repair, under `artifacts/opcua2/75057d8c/solution-tests4/`. Its final result will be
+recorded without discarding CI3 or relabeling focused corrections as a green full run.
+
+## Canonical candidate generated-factory saturation result
+
+The exact immutable bundle reviewed by Astra completed **384 canonical cycles,
+96 restarts and one settling cycle in 1,425.242 seconds**, inside the fixed 1,800-second
+cutoff. Both fixed trace windows and the continuous attached interval had zero
+SDK generated-factory JIT/load events, zero new SDK assembly loads and zero lost
+events. The observer detached/drained before settling; shutdown ownership checks
+passed. This meets only the selected generated-factory readiness criterion.
+
+The unchanged cold cap rejected at cycle 248: RSS 362,409,984 >358,838,272 bytes.
+The original assertion was rethrown; test/container/launcher exit 1, no ordinary
+completion or full-duration flag. Peak RSS 394,956,800 bytes; final managed memory
+19,974,280 bytes. Allocation StackTrace tracking was enabled, so this is additional
+instrumented diagnostic overhead and cannot serve as uninstrumented performance
+or acceptance evidence. [Scoped report and hashed receipts](evidence/2026-11-10-opcua2/saturation-candidate.md).
+#799 and G4 remain failed/open. A matched original-SDK canonical adapter is being
+prepared before any further acceptance-protocol review; no warmed replacement
+baseline, budget waiver, factory/runtime setting or production patch was adopted.

docs/plans/evidence/2026-11-10-opcua2/browser-nat-parity.md

@@ -0,0 +1,23 @@
+# SDK1.5 Browser different-port NAT parity
+
+Read-only application validation using existing Release Browser integration DLLs in `/Users/dohertj2/.codex/worktrees/historiangw-client-040/OtOpcUa` (current HEAD `52d1373e8129b7f4f0ea2e35f86a8a5d0ed1de36`). No repository edits, build, or restore. DLL dependency graph confirms all five OPCFoundation packages `1.5.378.182`; exact DLL hashes/package versions are in `metadata.json`.
+
+One task-owned fixture was started from cached `mcr.microsoft.com/iotedge/opc-plc:2.14.10` with `--pn=50000 --ut --aa --alm`, hostname `otopcua-sdk1-browser-nat-parity`, and localhost ephemeral mapping `127.0.0.1:32773 -> 50000`. Image ID/digest and Docker configuration are recorded in `container-metadata.txt` and `image-digest.txt`. No shared fixture, volume, or port was changed.
+
+All five original SDK1.5 Browser integration cases failed: **0 passed, 5 failed, 0 skipped**; test exit1, execution guard exit0. Each failed with `System.Net.Sockets.SocketException: nodename nor servname provided, or not known` in the SDK1.5 `DefaultSessionFactory.CreateChannelAsync/CreateAsync` path. `browser-sdk1-nat.trx` and `test.log` contain the actual failures.
+
+A standalone scratch discovery probe referencing those exact baseline `Opc.Ua.*` DLLs called public `DiscoveryClient.CreateAsync` and `GetEndpointsAsync` against localhost:32773. It succeeded (exit0) and captured all seven advertised endpoints at `opc.tcp://otopcua-sdk1-browser-nat-parity:50000/`, including SecurityPolicy.None/MessageSecurityMode.None. See `get-endpoints.log` and `discovery-probe/{Program.cs,probe.csproj}`. The advertised hostname/port are therefore the actual discovery response, not inferred from configuration alone.
+
+This establishes the same browser failure on SDK1.5 when discovery advertises an unreachable Docker hostname/internal port. It supports classification as a preexisting NAT/advertisement limitation exposed by the test fixture mapping, rather than an SDK2-only regression. Root's matching-port SDK2 fixture pass is separate evidence.
+
+Command:
+
+```sh
+OPCUA_SIM_ENDPOINT=opc.tcp://127.0.0.1:32773 dotnet test tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.Browser.IntegrationTests/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.Browser.IntegrationTests.csproj -c Release --no-build --no-restore --logger 'trx;LogFileName=browser-sdk1-nat.trx' --results-directory /tmp/opcua-browser-sdk1-nat-parity
+MIN_EXECUTED=1 bash scripts/ci/assert-not-all-skipped.sh /tmp/opcua-browser-sdk1-nat-parity/browser-sdk1-nat.trx
+```
+
+Cleanup removed only `otopcua-sdk1-browser-nat-parity`; cleanup exit0 and exact-name absence recorded in `cleanup.log`. No source/issue changes or commits.
+
+
+The baseline browser limitation remains open in [#806](https://gitea.dohertylan.com/dohertj2/lmxopcua/issues/806). This migration retains its behavior; the fixture is configured as a directly reachable endpoint with identical host/internal/advertised ports. Focused SDK2 browser5/5 and driver5/5 passed after that correction, with no source changes.

docs/plans/evidence/2026-11-10-opcua2/rebuild-test-barrier.md

@@ -0,0 +1,43 @@
+# CI3 Runtime rebuild idempotence assertion investigation
+
+Base: `04d5513af2620f277a56acbb19ae466623fc054f` (SDK2, actual HG1.0), branch `codex/opcua2-rebuild-test-barrier`. SDK `10.0.403`. No production edits, budget changes, expected result changes, skips, or issue actions.
+
+## Cause and classification evidence
+
+`RecordingSink.EnsureFolder` queues `EF:eq-1` before the actor finishes materialisation and calls `AnnounceAddedNodes`, which queues `NA:line-1`. The old test waited only for EF, captured a possibly incomplete first-call count, then slept after sending the second request. Thus it could attribute the first apply's trailing announcement to the second apply. `FinishRebuild` sends the public `RebuildCompleted` outcome after `CompleteAddressSpaceApply` and deferred writes, so it supplies the needed completion barrier.
+
+An independent source comparison against landed SDK1.5 master `230cef4e` found no actor/test changes: `git diff 230cef4e 04d5513a -- src/Server/ZB.MOM.WW.OtOpcUa.Runtime/OpcUa/OpcUaPublishActor.cs tests/Server/ZB.MOM.WW.OtOpcUa.Runtime.Tests/OpcUa/OpcUaPublishActorRebuildTests.cs` has zero bytes (`master-candidate-source.diff`). This supports a preexisting test-ordering failure, not an SDK2 production idempotence regression.
+
+## Controlled reproduction
+
+Temporary test-only `AfterEnsureFolder` gate blocked the first apply immediately after EF was recorded. The original EF-presence wait and snapshot therefore captured exactly one call. The second request was queued, the gate released, and both apply-completion counters awaited before the unchanged count assertion. The exact CI failure reproduced: expected 1, actual 2. Diagnostic records `completed calls=EF:eq-1,NA:line-1; completions=2`. There was only one EF and one announcement: no repeated materialisation.
+
+- RED: `controlled-red/controlled-red-diagnostic.trx`, `test-diagnostic.log`, `controlled-red-source.cs`; build exit0, test exit1, guard exit0; 1 failed/0 passed/0 skipped (expected reproduction).
+- GREEN: same first-apply gate with explicit count1 while blocked; release, then await first correlated clean `RebuildCompleted` before snapshot and second correlated clean reply before assertion. `controlled-green/controlled-green.trx`, `controlled-green-source.cs`; build0/test0/guard0; 1 passed/0 failed/0 skipped.
+- Temporary gates are absent from final source. Only the target test changes: both requests ask for outcomes, both replies must match correlation and be clean, original EF/no-full-rebuild/unchanged-call-count assertions remain, and fixed sleep is removed. Existing `PresenceBudget` and cancellation token are retained.
+
+## Reproduction commands
+
+From the owned worktree, test project is `tests/Server/ZB.MOM.WW.OtOpcUa.Runtime.Tests/ZB.MOM.WW.OtOpcUa.Runtime.Tests.csproj`.
+
+```sh
+dotnet build "$PROJECT" -c Release --no-restore
+dotnet test "$PROJECT" -c Release --no-build --no-restore --filter 'FullyQualifiedName~Second_rebuild_with_same_artifact_is_empty_plan_no_op' --logger 'trx;LogFileName=focused.trx' --results-directory "$RESULTS"
+# Preserve dotnet exit before guard; guard does not replace test status.
+MIN_EXECUTED=1 bash scripts/ci/assert-not-all-skipped.sh "$RESULTS/focused.trx"
+# Owning suite omits --filter and uses its own fresh results directory/TRX.
+```
+
+## Final validation
+
+Commit: `b5f51406ffc7dcf5b40baa52156ea85e862ab5b4` (one test file; worktree clean).
+
+Final owning project build: exit0, 0 warnings, 0 errors, 2.97s (`final/build.log`, `final/build-status.txt`). Full unfiltered Runtime suite: 1,005 total, 1,002 passed, 0 failed, 3 existing skips, duration1m25s. Test exit0, nonzero execution guard exit0 (`final/runtime-final.trx`, `final/test.log`, `final/guard.log`, `final/status.txt`). Target test is passed in that full-suite TRX. DLL SHA256 is recorded in `final/runtime-dll.sha256`.
+
+The three existing skips are the retired-v3 artifact/composer parity tests `Composer_and_artifact_agree_on_equipment_node_device_host`, `ParseComposition_scoped_flags_cross_cluster_orphan_equipment`, and `Driverbound_equipment_kept_when_driver_in_cluster`. No skips were added or changed. No remaining diagnostics from this work.
+
+Host concurrently ran coordinator validation; this task makes no performance claim. Root owns broader CI/fixture classification and issue writes.
+
+
+
+Coordinator landing: master `52d1373e`, merged into SDK2 at `75057d8c`; [#805](https://gitea.dohertylan.com/dohertj2/lmxopcua/issues/805) closed after independent SDK1.5 master Runtime validation:1,002passed/0failed/3existing skips, test/guard exits0. No product source changed. Fresh full CI4 follows this repair and fixture correction; it is not assumed green from the owning-suite pass.

docs/plans/evidence/2026-11-10-opcua2/saturation-candidate.json

@@ -0,0 +1,352 @@
+{
+  "scope": "Instrumented candidate-only canonical saturation diagnostic. No acceptance protocol or baseline change.",
+  "allocationTracking": {
+    "enabled": true,
+    "environment": "OPCUA_CERTIFICATE_LEAK_TRACKING=1",
+    "overhead": "Exact SDK captures a StackTrace and tracker entry per certificate wrapper. Not an uninstrumented performance/acceptance baseline."
+  },
+  "bundle": {
+    "sourceRevision": "2738d7cc8675298ceb38ed19ca58a9f643036ff1",
+    "receiptSha256": "e4eed693c80baa29266f58cee4473b1181bc6de8f4c460843bd6b1993bcf7179",
+    "sdk": "2.0.1",
+    "gateway": "1.0.0",
+    "runtime": "self-contained Linux ARM64 10.0.14 for target and observer",
+    "sha256": "e4eed693c80baa29266f58cee4473b1181bc6de8f4c460843bd6b1993bcf7179"
+  },
+  "run": {
+    "acceptance": false,
+    "containerExitStatus": 1,
+    "wallSeconds": 1429.7275004169205,
+    "sourceRevision": "2738d7cc8675298ceb38ed19ca58a9f643036ff1",
+    "receiptSha256": "e4eed693c80baa29266f58cee4473b1181bc6de8f4c460843bd6b1993bcf7179",
+    "descriptorTests": {
+      "executed": 2,
+      "skipped": 0
+    },
+    "experimentTests": {
+      "executed": 1,
+      "skipped": 0
+    },
+    "diagnosticOutcome": {
+      "kind": "saturation-result",
+      "utc": "2026-11-10T20:30:58.5817344+00:00",
+      "canonicalCycles": 384,
+      "settlingCycles": 1,
+      "restarts": 96,
+      "phaseSeconds": 1425.2416632,
+      "readiness": true,
+      "coldBudgetRejected": true,
+      "shutdownOwnershipVerified": true,
+      "acceptance": false
+    },
+    "protocolCompleted": true
+  },
+  "start": {
+    "kind": "start",
+    "utc": "2026-11-10T20:07:13.3303503+00:00",
+    "processId": 200,
+    "mode": "saturation",
+    "requestedSeconds": 1800,
+    "minimumFullSeconds": 7200,
+    "build": "2738d7cc8675298ceb38ed19ca58a9f643036ff1",
+    "sdk": "2.0.1+07e62f72500cc0923a2bab940653c8c1116fa286",
+    "diagnosticInstrumentation": "SDK2.0.1 CP lists and certificate-validation cached stores; read-only",
+    "limits": {
+      "retainedManagedGrowthBytes": 67108864,
+      "rssGrowthBytes": 134217728,
+      "fdGrowth": 32
+    },
+    "coverage": "encrypted sessions; scalar/Int16[] Raw+UNS; subscription removal; browse abandonment; history release/cross-session/close; surgical changes/rebuild; revocation; paused TCP read/recovery; same-PKI restart"
+  },
+  "coldRejection": {
+    "kind": "budget-rejected",
+    "cycle": 248,
+    "seconds": 913.8748808,
+    "resources": {
+      "Cycle": 248,
+      "Seconds": 913.830416,
+      "Sessions": 0,
+      "Subscriptions": 0,
+      "Items": 0,
+      "BrowsePoints": 0,
+      "HistoryPoints": 0,
+      "LiveDataItems": 0,
+      "LiveEventItems": 0,
+      "MonitoredNodes": 0,
+      "Variables": 19,
+      "Folders": 4,
+      "Conditions": 1,
+      "CachedCertificateStores": 2,
+      "Descriptors": 193,
+      "PkiDescriptors": 0,
+      "ManagedBytes": 19961096,
+      "RssBytes": 362409984,
+      "AllocatedBytes": 5662357112,
+      "Gen0": 619,
+      "Gen1": 496,
+      "Gen2": 496,
+      "GcCommittedBytes": 48226304,
+      "GcHeapBytes": 22015464,
+      "GcFragmentedBytes": 2054368,
+      "PinnedObjects": 1,
+      "PendingFinalizers": 17,
+      "JitMethods": 75848,
+      "JitIlBytes": 11437192,
+      "ActiveTimers": 16,
+      "Threads": 21
+    },
+    "baseline": {
+      "Cycle": 3,
+      "Seconds": 7.6451075,
+      "Sessions": 0,
+      "Subscriptions": 0,
+      "Items": 0,
+      "BrowsePoints": 0,
+      "HistoryPoints": 0,
+      "LiveDataItems": 0,
+      "LiveEventItems": 0,
+      "MonitoredNodes": 0,
+      "Variables": 19,
+      "Folders": 4,
+      "Conditions": 1,
+      "CachedCertificateStores": 2,
+      "Descriptors": 191,
+      "PkiDescriptors": 0,
+      "ManagedBytes": 19878208,
+      "RssBytes": 224620544,
+      "AllocatedBytes": 86490920,
+      "Gen0": 7,
+      "Gen1": 6,
+      "Gen2": 6,
+      "GcCommittedBytes": 41967616,
+      "GcHeapBytes": 20716064,
+      "GcFragmentedBytes": 837856,
+      "PinnedObjects": 1,
+      "PendingFinalizers": 16,
+      "JitMethods": 35741,
+      "JitIlBytes": 4635402,
+      "ActiveTimers": 18,
+      "Threads": 27
+    },
+    "failure": "Shouldly.ShouldAssertException: 362409984L\r\n    should be less than or equal to\r\n358838272L\r\n    but was not\n   at ZB.MOM.WW.OtOpcUa.OpcUaServer.IntegrationTests.Sdk2LifecycleSoakTests.Repeated_lifecycles_return_resources_to_a_steady_baseline() in tests/Server/ZB.MOM.WW.OtOpcUa.OpcUaServer.IntegrationTests/Sdk2LifecycleSoakTests.cs:line 133"
+  },
+  "observer": {
+    "protocol": "sdk2-saturation-v1",
+    "runId": "545b3093-5eab-4348-a72d-926b9d1da7da",
+    "targetPid": 200,
+    "observerPid": 109,
+    "active": false,
+    "drained": true,
+    "markersValid": true,
+    "eventsLost": 0,
+    "sdkFactoryJit": 0,
+    "sdkFactoryLoads": 0,
+    "sdkAssemblyLoads": 0,
+    "windows": [
+      {
+        "name": "window1",
+        "firstCycle": 321,
+        "lastCycle": 352,
+        "startRestarts": 80,
+        "endRestarts": 88,
+        "sdkFactoryJit": 0,
+        "sdkFactoryLoads": 0,
+        "sdkAssemblyLoads": 0
+      },
+      {
+        "name": "window2",
+        "firstCycle": 353,
+        "lastCycle": 384,
+        "startRestarts": 88,
+        "endRestarts": 96,
+        "sdkFactoryJit": 0,
+        "sdkFactoryLoads": 0,
+        "sdkAssemblyLoads": 0
+      }
+    ],
+    "otherJit": 287,
+    "loadedNativeBytes": 60760,
+    "runtimeControlJit": 0,
+    "configuration": {
+      "runtimeProvider": "Microsoft-Windows-DotNETRuntime",
+      "level": "Verbose",
+      "keywords": "0x18",
+      "markerProvider": "OtOpcUa-Sdk2-Saturation",
+      "circularBufferMiB": 16,
+      "requestRundown": false
+    },
+    "acceptance": false
+  },
+  "tests": {
+    "descriptor-controls": {
+      "counters": {
+        "total": "2",
+        "executed": "2",
+        "passed": "2",
+        "failed": "0",
+        "error": "0",
+        "timeout": "0",
+        "aborted": "0",
+        "inconclusive": "0",
+        "passedButRunAborted": "0",
+        "notRunnable": "0",
+        "notExecuted": "0",
+        "disconnected": "0",
+        "warning": "0",
+        "completed": "0",
+        "inProgress": "0",
+        "pending": "0"
+      },
+      "sha256": "0de2cd05f9f1dbcaee3cff33e3e625723f5dc19b8f2dbcf3fbf1376792bc489c",
+      "errors": []
+    },
+    "saturation": {
+      "counters": {
+        "total": "1",
+        "executed": "1",
+        "passed": "0",
+        "failed": "1",
+        "error": "0",
+        "timeout": "0",
+        "aborted": "0",
+        "inconclusive": "0",
+        "passedButRunAborted": "0",
+        "notRunnable": "0",
+        "notExecuted": "0",
+        "disconnected": "0",
+        "warning": "0",
+        "completed": "0",
+        "inProgress": "0",
+        "pending": "0"
+      },
+      "sha256": "1b5cba9e1b3c348d0dcbb79ba4c715d0e837602c78afc2c221c64c2e776e825b",
+      "errors": [
+        "Shouldly.ShouldAssertException : 362409984L\r\n    should be less than or equal to\r\n358838272L\r\n    but was not"
+      ]
+    }
+  },
+  "firstSample": {
+    "Cycle": 1,
+    "Seconds": 2.7631819,
+    "Sessions": 0,
+    "Subscriptions": 0,
+    "Items": 0,
+    "BrowsePoints": 0,
+    "HistoryPoints": 0,
+    "LiveDataItems": 0,
+    "LiveEventItems": 0,
+    "MonitoredNodes": 0,
+    "Variables": 19,
+    "Folders": 4,
+    "Conditions": 1,
+    "CachedCertificateStores": 2,
+    "Descriptors": 191,
+    "PkiDescriptors": 0,
+    "ManagedBytes": 19275376,
+    "RssBytes": 222228480,
+    "AllocatedBytes": 62054576,
+    "Gen0": 3,
+    "Gen1": 2,
+    "Gen2": 2,
+    "GcCommittedBytes": 47521792,
+    "GcHeapBytes": 20204744,
+    "GcFragmentedBytes": 929368,
+    "PinnedObjects": 1,
+    "PendingFinalizers": 19,
+    "JitMethods": 29401,
+    "JitIlBytes": 4142214,
+    "ActiveTimers": 12,
+    "Threads": 27
+  },
+  "baselineSample": {
+    "Cycle": 3,
+    "Seconds": 7.6451075,
+    "Sessions": 0,
+    "Subscriptions": 0,
+    "Items": 0,
+    "BrowsePoints": 0,
+    "HistoryPoints": 0,
+    "LiveDataItems": 0,
+    "LiveEventItems": 0,
+    "MonitoredNodes": 0,
+    "Variables": 19,
+    "Folders": 4,
+    "Conditions": 1,
+    "CachedCertificateStores": 2,
+    "Descriptors": 191,
+    "PkiDescriptors": 0,
+    "ManagedBytes": 19878208,
+    "RssBytes": 224620544,
+    "AllocatedBytes": 86490920,
+    "Gen0": 7,
+    "Gen1": 6,
+    "Gen2": 6,
+    "GcCommittedBytes": 41967616,
+    "GcHeapBytes": 20716064,
+    "GcFragmentedBytes": 837856,
+    "PinnedObjects": 1,
+    "PendingFinalizers": 16,
+    "JitMethods": 35741,
+    "JitIlBytes": 4635402,
+    "ActiveTimers": 18,
+    "Threads": 27
+  },
+  "lastSample": {
+    "Cycle": 385,
+    "Seconds": 1425.221077,
+    "Sessions": 0,
+    "Subscriptions": 0,
+    "Items": 0,
+    "BrowsePoints": 0,
+    "HistoryPoints": 0,
+    "LiveDataItems": 0,
+    "LiveEventItems": 0,
+    "MonitoredNodes": 0,
+    "Variables": 19,
+    "Folders": 4,
+    "Conditions": 1,
+    "CachedCertificateStores": 2,
+    "Descriptors": 200,
+    "PkiDescriptors": 0,
+    "ManagedBytes": 19974280,
+    "RssBytes": 367771648,
+    "AllocatedBytes": 8790684304,
+    "Gen0": 963,
+    "Gen1": 770,
+    "Gen2": 770,
+    "GcCommittedBytes": 46555136,
+    "GcHeapBytes": 20348120,
+    "GcFragmentedBytes": 373840,
+    "PinnedObjects": 1,
+    "PendingFinalizers": 27,
+    "JitMethods": 80193,
+    "JitIlBytes": 12208985,
+    "ActiveTimers": 15,
+    "Threads": 22
+  },
+  "peakResources": {
+    "ManagedBytes": 20501376,
+    "RssBytes": 394956800,
+    "Descriptors": 201,
+    "PkiDescriptors": 0,
+    "JitMethods": 80193,
+    "GcCommittedBytes": 48549888
+  },
+  "evidenceSha256": {
+    "run-receipt.json": "842eacf845af019df087c69c55bb527d83c6e0d6f42057c8dd63d65eb5f86511",
+    "resources.jsonl": "eab640b684908d6978ca323c919d40b8ec6496a483484e3f86a396511e28dbc3",
+    "control/drained.json": "5a61b090086f379f3cc96b1efe328225efdafb027795a57f7636acfbf2bc5594",
+    "results/descriptor-controls.trx": "0de2cd05f9f1dbcaee3cff33e3e625723f5dc19b8f2dbcf3fbf1376792bc489c",
+    "results/saturation.trx": "1b5cba9e1b3c348d0dcbb79ba4c715d0e837602c78afc2c221c64c2e776e825b",
+    "test-exit-status.txt": "4355a46b19d348dc2f57c046f8ef63d4538ebb936000f3c9ee954a27460dd865",
+    "observer-exit-status.txt": "9a271f2a916b0b6ee6cecb2426f0b3206ef074578be55d9bc94f6f3fe3ab86aa",
+    "target-runtime.txt": "1287d31fb4a49b24e82c346e2b9d2a4ef956d151e08f0497c3aef78617d2a012",
+    "observer-runtime.txt": "38c764d4f77a4bfa9c27905c5f8feb1076d30ea626f28d0f188e4bf86bb0c456"
+  },
+  "noOrdinaryCompleteRecord": true,
+  "privatePkiAndRawTraceExcluded": true,
+  "sanitization": {
+    "checkoutPrefixRedacted": true,
+    "rawResourceHashPreserved": true
+  }
+}

docs/plans/evidence/2026-11-10-opcua2/saturation-candidate.md

@@ -0,0 +1,35 @@
+# Candidate canonical saturation diagnostic
+
+The prospectively fixed experiment completed 384 canonical cycles / 96 restarts
+plus one settling cycle in **1,425.242 seconds**, within the 1,800-second cutoff.
+Both traced windows, 321–352 and 353–384, recorded **zero generated-factory JIT/load
+events, zero new SDK assembly loads and zero lost events**; the continuous attached
+interval also had zero such events. Other JIT starts: 287. Summed CLR `MethodSize`
+values: 60,760 bytes; this is not an RSS/PSS measurement. The observer was active
+before cycle 321 and stopped/drained before cycle 385. Shutdown ownership checks
+passed.
+
+**The cold resource failure remains:** cycle 248 RSS 362,409,984 exceeded
+358,838,272 bytes (cycle 3 + 128 MiB). The first assertion was retained and rethrown;
+test/container/launcher exit 1, one failed executed lifecycle test, no ordinary
+completion/full-duration result. Descriptor controls passed 2/2. Readiness=true
+describes the selected generated-factory criterion on the canonical workload,
+**not general runtime/performance readiness, G4 acceptance or #799 closure**.
+
+Source `2738d7cc`, exact SDK 2.0.1 and HG 1.0.0; both participants use self-contained
+Linux ARM64 runtime 10.0.14. Astra approved the exact immutable 1,275-file bundle
+before launch and independently verified 1,064 module identities. The production/
+central-package source tree matched the candidate. Outer output permissions were
+0700; private PKI and raw trace stay unversioned.
+
+`OPCUA_CERTIFICATE_LEAK_TRACKING=1` was enabled before startup. Exact SDK tracking
+captures an allocation StackTrace and tracker entry per wrapper. This additional
+diagnostic overhead prevents reuse as an uninstrumented performance/acceptance
+baseline. Caps and measurement baseline were unchanged.
+
+[Hashed result, windows, failure and runtime receipts](saturation-candidate.json)
+preserve cold/warm/peak observations. A matched original-SDK canonical adapter,
+prospectively reviewed acceptance procedure and at least 7,200 seconds after fixed
+warmup are still required before a replacement resource gate could be considered.
+Continued macOS native certificate-object accumulation remains separate and
+unresolved. No production workaround or acceptance waiver was applied.