Merge remote-tracking branch 'origin/master' into codex/opcua-sdk-2

docs/Historian.md

@@ -337,7 +337,7 @@ and is registered the same way for every backend.
 
 > **Cross-repo follow-up — a multi-tag batch `WriteLiveValues` on the gateway contract.** The drain's
 > unit of work is one gateway round-trip **per historian tag**, because
-> `ZB.MOM.WW.HistorianGateway.Client` **0.4.0** exposes no RPC that writes values for more than one tag
+> `ZB.MOM.WW.HistorianGateway.Client` **1.0.0** exposes no RPC that writes values for more than one tag
 > in a call. Bounded parallelism (`DrainConcurrency`) is therefore the ceiling: it overlaps the
 > round-trips but cannot remove them, so a wide tag set still pays `⌈tags / concurrency⌉` network
 > hops per drain pass. Collapsing that to a single hop needs a **batch/multi-tag `WriteLiveValues`** on
@@ -345,8 +345,11 @@ and is registered the same way for every backend.
 > lands, raising `DrainBatchSize` widens each hop's payload but not the hop count — which is why the
 > concurrency window, not the batch width, is what governs drain throughput today.
 
-The HistorianGateway **Client and Contracts packages are pinned together at 0.4.0**
-([historiangw#119](https://gitea.dohertylan.com/dohertj2/historiangw/issues/119)). The removed
+The HistorianGateway **Client and Contracts packages are pinned together at 1.0.0**
+([historiangw#131](https://gitea.dohertylan.com/dohertj2/historiangw/issues/131)). The adapter maps
+`AllowUntrustedServerCertificate` directly and only for TLS: the default verifies the server, while an
+explicit opt-out applies only when `UseTls=true`. Stale certificate options are ignored on plaintext h2c.
+This follows the earlier [0.4.0 update](https://gitea.dohertylan.com/dohertj2/historiangw/issues/119). The removed
 `ReadBlocks` RPC and `ReadBlocksAsync` wrapper were unused here. A partially imported CA PEM bundle now
 fails client creation instead of accepting a narrower certificate pin; repair the configured bundle if
 startup reports `ArgumentException` for `CaCertificatePath`.

docs/plans/evidence/2026-11-10-historiangw-131.json

@@ -0,0 +1,113 @@
+{
+  "issue": "https://gitea.dohertylan.com/dohertj2/historiangw/issues/131",
+  "consumerBase": "16111a5e",
+  "opcUaSdk": "1.5.378.182 (independent of SDK2 migration)",
+  "build": {
+    "command": "dotnet build ZB.MOM.WW.OtOpcUa.slnx -c Release -m:1",
+    "exit": 0,
+    "warnings": 0,
+    "errors": 0,
+    "seconds": 37.33,
+    "logSha256": "cb4f1ee96bf05254e5c707179c1e81d99d8267e28c5117a84afa0b0c853fa329"
+  },
+  "packages": [
+    {
+      "package": "ZB.MOM.WW.HistorianGateway.Client/1.0.0",
+      "type": "package",
+      "source": "https://gitea.dohertylan.com/api/packages/dohertj2/nuget/index.json",
+      "repositoryCommit": "ea9f21c850fb618767e12690924f9966f1e433ac",
+      "sha256": {
+        "lib/net10.0/ZB.MOM.WW.HistorianGateway.Client.dll": "b89a02e0d228ec549c4dfb755694f7f67b573a6077f06ff2781165e884fc5e12",
+        "zb.mom.ww.historiangateway.client.1.0.0.nupkg": "0a3f2836727671c07c0c393e705cc9737d2ed44258213a51fb4acf0d0ab7129e"
+      }
+    },
+    {
+      "package": "ZB.MOM.WW.HistorianGateway.Contracts/1.0.0",
+      "type": "package",
+      "source": "https://gitea.dohertylan.com/api/packages/dohertj2/nuget/index.json",
+      "repositoryCommit": "ea9f21c850fb618767e12690924f9966f1e433ac",
+      "sha256": {
+        "lib/net10.0/ZB.MOM.WW.HistorianGateway.Contracts.dll": "e60d3d4650be5d251982f7847404daf1b666f61d56e2b0ccb844af8677e97743",
+        "zb.mom.ww.historiangateway.contracts.1.0.0.nupkg": "83ffd12bcbbf919c973ba522560e10aa93a4cb8c686a3232030a2cfa5f00995e"
+      }
+    }
+  ],
+  "sourceOverrides": false,
+  "tests": [
+    {
+      "project": "gateway",
+      "testExit": 0,
+      "executionGuardExit": 0,
+      "counters": {
+        "total": "529",
+        "executed": "523",
+        "passed": "523",
+        "failed": "0",
+        "error": "0",
+        "timeout": "0",
+        "aborted": "0",
+        "inconclusive": "0",
+        "passedButRunAborted": "0",
+        "notRunnable": "0",
+        "notExecuted": "0",
+        "disconnected": "0",
+        "warning": "0",
+        "completed": "0",
+        "inProgress": "0",
+        "pending": "0"
+      },
+      "outcomes": {
+        "Passed": 523,
+        "Failed": 0,
+        "NotExecuted": 6
+      },
+      "requiredTlsWireTests": [
+        {
+          "name": "ZB.MOM.WW.OtOpcUa.Driver.Historian.Gateway.Tests.HistorianGatewayTlsPolicyWireTests.Explicit_tls_opt_out_reaches_the_same_self_signed_server_shape",
+          "outcome": "Passed"
+        },
+        {
+          "name": "ZB.MOM.WW.OtOpcUa.Driver.Historian.Gateway.Tests.HistorianGatewayTlsPolicyWireTests.Default_tls_rejects_an_untrusted_server_before_the_rpc",
+          "outcome": "Passed"
+        },
+        {
+          "name": "ZB.MOM.WW.OtOpcUa.Driver.Historian.Gateway.Tests.HistorianGatewayTlsPolicyWireTests.Plaintext_ignores_stale_tls_opt_out_and_ca_settings_and_reaches_the_rpc",
+          "outcome": "Passed"
+        }
+      ],
+      "trxSha256": "68086e66da0942214c0be805366b47c443f633d90f217c91e07ec685e8aea9d9"
+    },
+    {
+      "project": "runtime",
+      "testExit": 0,
+      "executionGuardExit": 0,
+      "counters": {
+        "total": "1005",
+        "executed": "1002",
+        "passed": "1002",
+        "failed": "0",
+        "error": "0",
+        "timeout": "0",
+        "aborted": "0",
+        "inconclusive": "0",
+        "passedButRunAborted": "0",
+        "notRunnable": "0",
+        "notExecuted": "0",
+        "disconnected": "0",
+        "warning": "0",
+        "completed": "0",
+        "inProgress": "0",
+        "pending": "0"
+      },
+      "outcomes": {
+        "Passed": 1002,
+        "Failed": 0,
+        "NotExecuted": 3
+      },
+      "requiredTlsWireTests": [],
+      "trxSha256": "c12308fd650be0646beba044a4b3301dc2aefc43097b2da667d0eb5da408fc65"
+    }
+  ],
+  "review": "Astra approved source/security mapping and corrected real-wire tests; actual published package verification complete.",
+  "deploymentPerformed": false
+}