docs: document OPC UA 2.0 compatibility and rollout

docs/drivers/OpcUaClient.md

@@ -9,8 +9,9 @@ and for the test-harness map read [OpcUaClient-Test-Fixture.md](OpcUaClient-Test
 A **remote OPC UA server**. This driver runs the *opposite* direction from the
 usual "server exposes PLC data" flow: it acts as an OPC UA **client**, opens a
 `Session` against an upstream server, and re-exposes that server's address space
-through the local OtOpcUa server. Browse, read, write, subscribe, alarm, and
-history calls are passed through to the upstream endpoint.
+through the local OtOpcUa server. Browse, read, write, subscribe and alarm
+operations use the upstream endpoint. HistoryRead uses the local server-wide
+historian instead; see [History](#history-not-supported-gitea-655).
 
 It is built on the OPC Foundation UA .NET Standard reference SDK and runs
 in-process in the OtOpcUa server's .NET 10 AnyCPU host — pure managed, no
@@ -20,6 +21,31 @@ out-of-process isolation.
 > a remote OPC UA endpoint by hand, point the general-purpose
 > [Client CLI](../Client.CLI.md) at it directly.
 
+## SDK 2.0.1 compatibility (#782)
+
+The driver, shared session layer and AdminUI browser target exact SDK **2.0.1**
+(previous **1.5.378.182**). Their existing abstractions and host-owned reconnect
+lifecycle remain in place. SDK immutable values are detached at the boundary into
+existing CLR scalars and one-dimensional arrays, preserving null/empty ByteStrings,
+UTC timestamps, Guid values, numeric widths, item order and per-item status. Matrix
+payloads remain unsupported and fail per item; this upgrade adds no matrix or
+upstream-history capability.
+
+Certificate-based identities retain their loaded certificate until their owning
+session closes, including failure cleanup. The browser releases abandoned browse
+continuation points. Endpoint policy selection, namespace-URI remapping, old-session
+notification rejection and the existing refusal to replay non-idempotent writes or
+alarm acknowledgements remain compatibility requirements.
+
+No application status-code, locale-selection or event-filter semantic change is
+approved by this upgrade. SDK value wrappers and empty-filter construction are API
+adaptations; callers must continue to inspect operation and select-clause results
+by index. Confirm actual client/server combinations with the
+[fixture map](OpcUaClient-Test-Fixture.md) and
+[rollout gates](../plans/2026-11-10-opcua-sdk-2-rollout.md) before deployment.
+Historical SDK 1.5 observations elsewhere on this page describe their original
+measurements; they are not fresh SDK 2.0.1 interoperability evidence.
+
 ## Project split
 
 | Project | Target | Role |
@@ -365,7 +391,7 @@ They are not part of `DriverHealth` or the
 ## Testing
 
 - **Unit tests** — `tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.Tests/`
-  cover the session lifecycle, namespace remapping, alarm/history passthrough,
+  cover the session lifecycle, namespace remapping, alarm dispatch,
   and config binding against a faked SDK session.
 - **Integration fixture** — exercises the driver against a reference OPC UA
   server (opc-plc) on the shared docker host; see