docs: record Astra source verdict and preserve failed lifecycle scope

docs/plans/2026-11-10-opcua-sdk-2-evidence.md

@@ -331,3 +331,30 @@ browser lifecycle run on Linux is still in progress. Its final elapsed duration,
 counters, resource limits and completion/exit guards must be recorded separately.
 A short diagnostic, a running process, or a different workload is never substituted
 for a required passing gate. G4 and release approval remain open.
+
+
+## Final integrated source review and diagnostic instrumentation
+
+Astra (`gpt-6-astra`, xhigh) reviewed integrated source `aa9af0dc` read-only and
+reported **no new must-fix migration source/security finding**. It rechecked
+identity registry/rejection, scoped public peer evidence, restricted identity
+behavior, actual continuation ownership/node/topology binding, temporary audit
+capability, exact alarm retry guards, write/node attempt ownership and client/
+driver generation/disposal. Its independently inspected security receipt is
+17/17 with zero skips. This is source/security review, **not release approval**:
+Astra retains #799 and explicitly withholds G4/release approval on both platforms.
+The reviewed production tree remains unchanged by later diagnostic commits.
+
+Test-only instrumentation now writes the complete captured resource tuple before
+resource assertions and includes GC committed/heap/fragmentation, pinned/finalizer,
+JIT method/IL, thread and timer counters. Explicit bounded profile mode preserves
+the first original budget rejection, marks subsequent samples rejected, and
+rethrows it before completion; full/diagnostic modes still fail immediately.
+The full7200-second minimum and every original cap are unchanged. Both descriptor
+positive/timeout controls passed again, **2/2**, at integrated `b57595cb`.
+Historical failed-run hashes and source revisions remain exact; they are not
+relabeled as results from this newer instrumentation.
+
+The pushed implementation is reviewable as
+[draft PR#802](https://gitea.dohertylan.com/dohertj2/lmxopcua/pulls/802).
+It is explicitly held from merge/release, and #782 remains open.

scripts/validation/opcua-server-lifecycle-linux/README.md

@@ -27,15 +27,20 @@ python3 scripts/validation/opcua-server-lifecycle-linux/run.py \
 An already published artifact can be reused with
 `--published-app /absolute/path/to/app`. Its parent must contain the launcher's
 `publish-receipt.json`; the test source, apphost and test assembly hashes must
-match. The recorded diagnostic artifact can be reused with:
+match. Reuse only a publish produced from the current canonical test source:
 
 ```sh
-python3 /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/scripts/validation/opcua-server-lifecycle-linux/run.py \
+python3 scripts/validation/opcua-server-lifecycle-linux/run.py \
   --full --duration 7200 \
-  --published-app /tmp/opcua2-server-linux-diagnostic-20261110a/app \
-  --output /tmp/opcua2-server-linux-full-20261110
+  --published-app /absolute/path/to/current-diagnostic/app \
+  --output /tmp/otopcua-server-linux-full-another-unique
 ```
 
+The historical 2026-11-10 diagnostic publish predates the later pre-assert/GC/JIT
+instrumentation. Its recorded full-run command is retained in the failed-run
+receipt; a current launcher correctly rejects that publish's test-source hash.
+Republish to measure the current instrumented test.
+
 The output directory must be fresh. It is mode 0700 and can contain task-owned
 private PKI under `task/tmp` during a run or after a failure. Never commit the
 entire output. The existing successful test removes its own stores. Only selected
@@ -101,7 +106,31 @@ TRX result. Both descriptor tests passed: the symlink control observed
 was reaped in 267 ms. All quiescent logical-resource counts and PKI FDs were zero.
 Third-cycle to final deltas were **−145,080 managed bytes, +53,739,520 RSS bytes,
 and +2 FDs**, within the unchanged diagnostic limits. These short observations do
-not establish a two-hour resource trend. The full Linux gate remains pending.
+not establish a two-hour resource trend. The attempted full Linux gate failed as recorded below.
 CLI rejection of `--full --duration 90`, rejection of a short completion as a full
 run, and rejection of the wrong TRX executed count were also verified. Selected
 receipts are in `evidence/2026-11-10-diagnostic/`.
+
+
+The actual full attempt on 2026-11-10 **failed** at 248 cycles, 61 restarts and
+903.508 seconds: RSS353,931,264 exceeded351,850,496 bytes (third-cycle baseline
++128MiB). Managed memory (~20.5MB), global descriptors189, PKI descriptors0,
+cached stores2 and logical collections remained bounded. This is a combined
+in-process SDK client/server measurement, not standalone server attribution.
+The test/container/launcher returned failure; no completion or two-hour pass
+exists. Selected sanitized source/runtime/hash/TRX/resource receipts are in
+[`server-linux-soak-failed.json`](../../../docs/plans/evidence/2026-11-10-opcua2/server-linux-soak-failed.json).
+[#799](https://gitea.dohertylan.com/dohertj2/lmxopcua/issues/799) tracks the
+cross-platform investigation; unchanged thresholds remain mandatory.
+
+The canonical test additionally supports explicit `OTOPCUA_SDK2_SOAK_MODE=profile`
+for 60–1800 seconds when invoked directly with the same opt-in/output/build
+environment. This launcher deliberately exposes diagnostic/full modes only.
+Profile mode logs each captured resource tuple before assertions, including
+GC committed/fragmented bytes, JIT method/IL counts, timers and threads. After a
+resource-budget failure it may continue bounded diagnostic collection, labels
+subsequent rows `quiescent-budget-rejected`, and rethrows the first original
+assertion before any completion record. It never changes thresholds, produces a
+two-hour flag, or turns a rejected run into a pass. Full/diagnostic modes retain
+immediate assertion failure. Native/private/file/anonymous RSS profiling and a
+matched original-SDK control are needed before attributing the failed gate.