docs(archreview): record R2-06 live gate attempt (3/6 green; RuntimeDb Windows-auth + gateway EnsureTags blockers)

archreview/plans/R2-06-serverhistorian-failfast-plan.md.tasks.json

@@ -94,7 +94,7 @@
         "T9",
         "T11"
       ],
-      "note": "needs live gateway over VPN; needs-user / serial live pass"
+      "note": "ATTEMPTED 2026-07-13 on VPN vs a real 0.2.0 gateway (deployed locally in Docker → real AVEVA historian on wonder-sql-vd03). 3/6 green (read, alarm SendEvent-ack, EnsureTags-observable). Blocked: RuntimeDb SQL path needs Windows-auth as NAM\\dohertj2 (a Linux container can't SQL-auth a WINDOWS_LOGIN) → tests 2/3; and gateway EnsureTags returns ArgumentOutOfRangeException on this deployment (gateway-side) → test 5. U-7 retype policy STILL UNDETERMINED live (EnsureTags errors before a real Float→Int1 accept/reject). Deployment fixes made: FQDN Historian__Host + libgssapi-krb5-2/gss-ntlmssp in the gateway image. Full record in STATUS.md."
     }
   ]
 }

archreview/plans/STATUS.md

@@ -291,3 +291,50 @@ gates (R2-06 VPN, R2-08 live LDAP, R2-01 S7 blackhole) still need their infra.
   `using …Core.Abstractions.Historian;` in ~11 consumers (no behavioral change). **Gitea PR #438 → master `50e04707`.**
   Verified: Core.Abstractions `129/129` (was 128/129), Runtime historian+DI `72/72`, Gateway driver unit `102/102`,
   full solution build `0 errors`.
+
+---
+
+## R2-06 live gate (T12) — attempted on the VPN, 3/6 green (2026-07-13)
+
+The R2-06 `Category=LiveIntegration` gate was run against a **real 0.2.0 `ZB.MOM.WW.HistorianGateway`** deployed
+locally in Docker (`~/Desktop/HistorianGateway/docker`, republished at 0.2.0) pointed at the **real AVEVA
+Historian** on `wonder-sql-vd03.zmr.zimmer.com:32565` + Galaxy SQL on `wonder-app-vd03`, over the corporate VPN.
+OtOpcUa's `GatewayLiveFixture` connected h2c to the local gateway (`http://localhost:5221`,
+`HISTGW_GATEWAY_ALLOW_UNTRUSTED=true` since h2c ⇒ no cert validation; gateway `ApiKeys:Mode=Disabled`, placeholder key).
+
+**Two real deployment fixes were needed** (both in the sibling `HistorianGateway/docker/`, local-only):
+1. **DNS** — the base compose set the *short* name `Historian__Host: wonder-sql-vd03`, which does not resolve
+   inside the container; overrode it to the FQDN (Galaxy/RuntimeDb already used FQDNs).
+2. **Kerberos/NTLM libs** — the historian **v6 session path** (reads + `EnsureTags`) and the SQL path authenticate
+   the Windows account `Historian__UserName=NAM\dohertj2` via .NET Negotiate/GSSAPI, which `aspnet:10.0` doesn't
+   ship. Without `libgssapi_krb5.so.2` every read/tag op failed with `InvalidOperationException`; adding
+   `libgssapi-krb5-2 gss-ntlmssp` to `docker/Dockerfile` fixed the historian path. (The **v8 event path** —
+   `SendEvent` — uses ECDH, not GSSAPI, so it worked before the fix.)
+
+**Result — 3/6 PASS:**
+- ✅ `Galaxy_tag_read_round_trip` (ReadRaw `SysTimeSec`) — historian gRPC read path live.
+- ✅ `Alarm_SendEvent_is_acked` — the alarm `SendEvent` (v8 event) path live.
+- ✅ `EnsureTags_type_change_outcome_is_observable` — passes on the *observability* contract (see caveat below).
+
+**3/6 blocked (not OtOpcUa/R2-06 code defects):**
+- ❌ `Write_then_read_on_sandbox_tag`, `Alarm_SendEvent_then_ReadEvents` — the **RuntimeDb SQL path**
+  (`WriteLiveValues` / SQL `ReadEvents`) must authenticate as `NAM\dohertj2`, a **WINDOWS_LOGIN** (verified via
+  `sys.server_principals`). A Linux container can't SQL-auth as a Windows login (host `sqlcmd` works only because
+  the go driver auto-negotiates NTLM); even with `gss-ntlmssp` present, `Encrypt=True` + explicit domain creds
+  didn't connect (`SQL event read failed` / write not acked). The account is *correct* (it has INSERT on
+  `Runtime.dbo.History` + SELECT on `dbo.Events`); the **auth mechanism** isn't available to a Mac container without
+  a `kinit` TGT against the NAM realm. Environmental, not a code defect.
+- ❌ `EnsureTags_boolean_sandbox_provisions_as_Int1` — the gateway's `EnsureTags` returns
+  `ArgumentOutOfRangeException` for **every** definition (even a fresh Float create, reproduced directly via
+  `grpcurl`), *after* auth succeeds. This is a **gateway-side** issue (HistorianGateway's own live tests report
+  `EnsureTags` provisioning works against `wonder-sql-vd03`, so it's env/transport/version-specific — possibly the
+  `RemoteGrpc` transport not serving tag-config mutations); the gateway maps it to a bare type-name and logs no
+  stack even at Debug, so the detail isn't observable without instrumenting the gateway/histsdk itself.
+
+**⚠️ U-7 retype policy — still UNDETERMINED live.** Because `EnsureTags` errors on this deployment, the retype
+probe (test 6) passes only by observing the generic `ArgumentOutOfRangeException` — it does **not** exercise a real
+Float→Int1 accept/reject. So the 06/U-7 assessment note's three hypotheses (accepted-versioned /
+accepted-retyped / rejected) remain open pending a working gateway `EnsureTags` on a real historian. The R2-06
+**code** deliverables (S-11 fail-fast + `ServerHistorianOptionsValidator`; U-7 Boolean→Int1 mapping + upsert
+semantics; C-7 doc) are all unit-covered and merged; this note records that the live *policy capture* leg is
+still outstanding, gated on the gateway `EnsureTags` fix + a SQL-auth path for the RuntimeDb tests.