ci: #818 raise v2-integration MIN_EXECUTED 440 -> 448 after the first hosted pass (run 1225: NAT tests executed 9 + 12, 525 total)

Claude-Session: https://claude.ai/code/session_01GT67AD99zQQqpLCVm3p7xk

.github/workflows/v2-integration.yml

@@ -76,7 +76,7 @@ jobs:
         env:
           # #816/#818 added 8 executing OpcUaClient tests; raise to 448 once a hosted run confirms them (blocked on #860)
           # (scripts/ci/README.md §"Fixture-backed integration").
-          MIN_EXECUTED: "440"
+          MIN_EXECUTED: "448"
         run: bash scripts/ci/assert-not-all-skipped.sh artifacts/trx/*.trx
       - name: fixture logs on failure
         if: failure()

infra/README.md

@@ -297,11 +297,11 @@ Things that are not obvious (#606):
   step also prints an individual-skip diagnostic (`Results/UnitTestResult` records with outcome
   `NotExecuted`); it does not affect the floor. Raise the floor as the suite grows.
 
-### CI legs beyond `unit-tests` (#757; unverified on a hosted runner until first run)
+### CI legs beyond `unit-tests` (#757; `v2-integration` hosted-verified 2026-11-11, run 1225)
 
 `v2-integration.yml` runs the fixture-backed Sql / Historian (SQL Server, QuestDB) / OpcUaClient integration
 projects against throwaway containers the job starts itself (`scripts/ci/integration-fixtures.sh`; not the
-shared 10.100.0.35 host), floor `MIN_EXECUTED=440`; that includes a port-NAT opc-plc (`otopcua-ci-opcplc-nat`,
+shared 10.100.0.35 host), floor `MIN_EXECUTED=448` (first hosted pass: run 1225, 2026-11-11, 525 executed); that includes a port-NAT opc-plc (`otopcua-ci-opcplc-nat`,
 host port 50110, exported as `OPCUA_NAT_ENDPOINT`) for the NAT browse tests (#813). `v2-e2e.yml` is manual/weekly and
 skips cleanly unless 10.100.0.35 is reachable from the runner; it sets `OPCUA_NAT_ENDPOINT=opc.tcp://10.100.0.35:50010`
 (the shared NAT stack, not a probe-required port — its tests skip if it is down). Each has its own concurrency group; see

scripts/ci/README.md

@@ -79,7 +79,7 @@ Neither touches `v2-ci.yml`; each has its own concurrency group (`lmxopcua-v2-in
   one, and fails `up` if that line is missing. Upgrade QuestDB by bumping the compose file (and the docker-dev overlay);
   `CI_QDB_IMAGE` overrides the image for a one-off trial. Both run QuestDB's defaults (incl.
   `cairo.ttl.use.wall.clock=true`, which the historian relies on). Runs the Sql, Historian.SqlServer,
-  Historian.QuestDb, OpcUaClient and OpcUaClient.Browser `*.IntegrationTests` with `MIN_EXECUTED=440`.
+  Historian.QuestDb, OpcUaClient and OpcUaClient.Browser `*.IntegrationTests` with `MIN_EXECUTED=448`.
   Local run: 468 executed / 8 skipped (Oracle x2, the blackhole `docker pause` gate, one QuestDB stress test,
   4 others), about 4.5 min of test time, QuestDB the longest (~3.3 min). Not covered (no pullable image or
   needs credentials): Modbus/S7/AB/FOCAS/TwinCAT sims, Mqtt, MTConnect, Oracle, Host real-infra mode.
@@ -89,9 +89,9 @@ Neither touches `v2-ci.yml`; each has its own concurrency group (`lmxopcua-v2-in
   `OPCUA_NAT_SERVER_CERT`). Locally (2026-11-11, same CI filter) the two OpcUaClient projects went 13 → 21 executed
   with 0 skipped (`Driver.OpcUaClient` 9, `Driver.OpcUaClient.Browser` 12), and the NAT class passed 7/7 against a
   CI-style throwaway `docker run` of the NAT container plus the `docker exec` certificate hand-off.
-  Once a hosted run's TRX shows `Driver.OpcUaClient.trx` executed=9 and `Driver.OpcUaClient.Browser.trx` executed=12,
-  raise `MIN_EXECUTED` in `v2-integration.yml` **440 → 448** (and `v2-e2e.yml` 35 → 39). Hosted runs have not yet
-  reached the test step (fixture start times out on the first network probe, #860), so this is still open (#818).
+  **Hosted-confirmed 2026-11-11 (run 1225):** `Driver.OpcUaClient.trx` executed=9, `Driver.OpcUaClient.Browser.trx`
+  executed=12, 525 executed in all, so `MIN_EXECUTED` in `v2-integration.yml` is now **448** (#818). The `v2-e2e.yml`
+  35 → 39 raise still waits for a hosted e2e run.
   If the NAT three show as skipped there, the certificate
   hand-off (`docker exec … /app/pki/own/certs/*.der`) did not work on the runner — fix that, do not lower the bump.
 - **`v2-e2e.yml`** (manual + weekly cron only; `timeout-minutes: 90`). `probe-e2e-fixtures.sh` TCP-probes