docs: retain final CI failures and Linux RSS gate evidence

2026-11-10 13:28:40 -05:00
parent a8ae19b224
commit b218321bda
3 changed files with 1970 additions and 5 deletions
@@ -4,7 +4,7 @@ Execution started 2026-11-10 for [#782](https://gitea.dohertylan.com/dohertj2/lm

 ## Baseline and authority

- Baseline `83ed880e4471344deaf008da9bd028c7e170bdc7` equals fetched `origin/master`; original checkout clean. Dedicated managed worktree, branch `codex/opcua-sdk-2`.
+- Baseline `83ed880e4471344deaf008da9bd028c7e170bdc7` equaled `origin/master` when execution started; original checkout was clean. Master subsequently advanced to the independent HistorianGateway package update `16111a5e`, merged into the candidate without content conflicts. Dedicated managed worktree, branch `codex/opcua-sdk-2`.
 - Target remains exact stable SDK `2.0.1`, upstream `07e62f72500cc0923a2bab940653c8c1116fa286`. Tagged source and restored assemblies control API decisions.
 - Baseline packages are already `1.5.378.182`, not the plan preparation checkout's `.106`. #751 reflection helper exists. AggregateManager application configuration override already exists; preserve it.
 - #782 previously parked the major upgrade; the user's current explicit execution instruction supersedes that scheduling decision. No deployment authorization overrides the Wonder-box remote-execution hold.
@@ -65,11 +65,11 @@ No optional ManagedSession/DI/AOT/cluster redesign, trust relaxation, silent war
 ## Gates

 - G0 baseline/design: accepted for migration, with corrections and external/trust-matrix gaps recorded below.
- G1 restored 2.0 graph / break inventory: passed for lane execution; compilation convergence pending.
- G2 compilation convergence: pending.
+- G1 restored 2.0 graph / break inventory: passed; compilation convergence subsequently passed G2.
+- G2 compilation convergence: passed; whole-solution Release builds have zero warnings/errors and temporary migration assets are removed.
 - G3 behavioral/security/interoperability: pending.
 - G4 lifecycle/performance/publish: pending.
- Astra security/ownership and release reviews: pending.
+- Astra security/ownership source findings: closed for the reviewed identity, history, audit and browse changes; final release review remains pending.

 No upgraded artifact is approved for release.

@@ -129,4 +129,205 @@ Restore succeeds without downgrade suppression or source changes. The first comp

 This is the exposed first wave, not the solution-wide final break count: server overrides, removed collections, immutable/null/Variant APIs, certificate manager, and async identity construction block downstream compilation. Log and exact diagnostics: `artifacts/opcua2/d9984028/sdk2-spike/{build.log,diagnostics.txt}`. Later diagnostics are inventoried by lane until G2 convergence; no compile failure is claimed as behavioral success.

-Restored project graphs contain no mixed Foundation SDK versions: every Foundation package (including analyzer-only development transitive GDS assets) is 2.0.1. Host graph resolves Bcl.TimeProvider 10.0.12, RateLimiting 10.0.12, Http.Resilience 10.10.0. G1 is satisfied for lane execution; full build/tests remain required at G2/G3. Frozen boundary contract is above; production and unit paths are split by plan ownership, integration/historian oracle edits coordinator-only.
+Restored project graphs contain no mixed Foundation SDK versions: every Foundation package (including analyzer-only development transitive GDS assets) is 2.0.1. Host graph resolves Bcl.TimeProvider 10.0.12 and Http.Resilience 10.10.0; client assets resolve RateLimiting 10.0.12, while the Host shared framework prunes that separate package. G1 is satisfied for lane execution; full build/tests remain required at G2/G3. Frozen boundary contract is above; production and unit paths are split by plan ownership, integration/historian oracle edits coordinator-only.
+
+
+## Integrated implementation and source reviews
+
+The implementation is on `codex/opcua-sdk-2`, not deployed or merged to master.
+Master's independently delivered HistorianGateway client/contracts 0.4.0 change
+`16111a5e` is included, and master ancestry was merged at `88ee30e0` without a
+content change. historiangw#119 is closed; historiangw#78 deployment is separate.
+
+The server, client and driver lanes were integrated and validated in isolated
+worktrees. Astra reviewed the design, aggregate compatibility architecture,
+identity/peer provenance, certificate ownership, production history continuation
+store, write conversions/revert ownership, alarm compatibility, and filtered event
+and audit delivery. No source review is represented as release approval.
+
+- Identity registry admission is installed before listeners and remains until
+  shutdown. Rejected/disabled credentials cannot fall through to a default identity.
+  SDK role augmentation preserves the application's principal and key ID.
+- Activation uses public transport peer evidence, scoped across asynchronous work
+  and restored in `finally`. Unknown peers retain the existing process-wide budget;
+  this application has no CIDR admission or reverse-connect policy to invent.
+- Immutable SDK values are normalized only at existing application boundaries.
+  Scalar numeric leniency, checked one-dimensional conversions, pass-through arrays,
+  byte/ByteString rank, null/empty and detached buffers remain pinned. Matrices remain
+  unsupported. Public SDK-facing client DTOs remain SDK-facing.
+- Session history tokens are consumed/released through the real SDK store, with
+  exact node/realm, read kind, topology epoch and current authority checks. Existing
+  canonical-query semantics are retained; no undocumented filter fingerprint was
+  introduced.
+- SDK2 alarm early AlreadyAcked/AlreadyConfirmed checks are adapted only for the
+  current nonempty trunk EventId, preserving application authorization and routing.
+  Write reverts bind the actual node instance and committed attempt, preventing a
+  late failure from undoing a newer write/publish or replacement node.
+- Audit delivery uses a private, revocable operation context for one exact source
+  and type. Both existing permission callbacks can veto; no global role/node
+  permission array is widened. Ordinary SDK automatic audits remain denied. The
+  encrypted wire test proves exactly one application audit to the Read audience
+  and none to the denied audience.
+
+A cross-version wire test found an additional SDK2 creation change: `Create`
+reset an alarm's preassigned reference to the null NodeId, hiding it from its raw
+parent's hierarchical browse. Restoring HasComponent **after** Create fixed all
+three supported alarm types in both realms (`fa823378`, integrated `41e65f6a`).
+All 12 actual-node/wire regressions failed first, then passed. Full server units
+at that fix: **1115 passed, zero failures, one existing skip**. Astra approved
+its source scope and the matching separate-process results.
+
+## Preserved aggregate algorithms and independent oracles
+
+The owner explicitly chose current application results over changed SDK2
+aggregate semantics. A private source adapter contains the eight original MIT
+algorithm/factory files from 1.5.378.182 with original source hashes. It is not an
+old SDK runtime. A fresh SDK AggregateManager registers the same 37 factories
+exactly once; calling the base registration first would duplicate diagnostic nodes.
+
+The separately pinned original-SDK generator produced **6,144 vectors**: the
+original 4,144 plus 2,000 numeric-width, nonfinite/conversion, tie/picosecond and
+configuration edge cases. Fixture SHA-256:
+`2ec2a1ac97f05d199c18da55157f8bbe0276853c3ba73ebf1b509c535c5a7dd8`.
+Original SDK assembly SHA-256:
+`d8d9706dea577858325730cd89896826ed82f7bfcf9503ccd0260311663a69f4`.
+
+All cases pass both directly and through the booted production aggregate manager.
+Values, CLR types, all status bits, source/server time and picoseconds, exceptions,
+queue acceptance and incremental/partial results are compared. SDK2 FILETIME zero
+is explicitly observed as the original CLR unset sentinel; no calculation or
+expected output was regenerated from the candidate.
+
+The SQL application's PercentGood policy already differs from SDK1.5.378.182.
+The same ten of 275 parity tests fail on the original and candidate with identical
+names/messages. Independent application results and regression expectations stay
+unchanged; [#796](https://gitea.dohertylan.com/dohertj2/lmxopcua/issues/796)
+tracks that baseline debt. It is not a green test run.
+
+## Local compatibility and security evidence
+
+- Full wire integration reached **187 passed, zero failures/skips** in the second
+  CI-equivalent run, excluding the separately gated E2E soak category. It includes
+  all original contracts plus production continuation, trusted-channel, audit,
+  hierarchy and current authority regressions.
+- Focused final security probes: **17/17**, zero skips. Seven trusted cases cover
+  explicit DER trust, Sign and SignAndEncrypt, invalid credentials, an untrusted
+  client, same-session reactivation, and concurrent IPv4/IPv6 attempts correlated
+  with their own peer before/after an await barrier. Eighteen earlier continuation
+  cases cover raw/modified/events with alias, replacement, rebuild, grant/key
+  revocation and expiry, proving no backend dispatch or saved-data disclosure.
+- Native current-trunk retry tests use a narrow raw-device grant with zero global
+  roles, then revoke/expire authority and require no route/state/EventId/event
+  change. Scripted retry tests explicitly use the existing cluster grant.
+  A separate real-session original/candidate probe preserves the opaque scripted
+  ID's equipment-scope denial and broad-grant positive. This **preexisting**
+  production feature gap remains [#797](https://gitea.dohertylan.com/dohertj2/lmxopcua/issues/797);
+  a slash-qualified synthetic ID is not a valid UI-authored workaround.
+- Target certificate manager/endpoint identity tests: **7/7** (valid, expired,
+  revoked, missing issuer, issuer usage, hostname and URI). These are manager/API
+  checks, not seven network handshakes.
+- Corrected a preexisting client creation-policy bug: 2048 meant months, not RSA
+  bits. New certificates use the SDK's 12-month default; existing longer-valid
+  certificates and identical private-key bytes are reused. A real-factory red
+  lifetime case became green; all **324 Shared tests passed**. RSA minimum remains
+  the SDK's separate 2048-bit default.
+- Separate-process original→candidate, candidate→original, candidate→candidate,
+  and original→original Shared legs plus candidate driver/actual CLI legs:
+  **62/62 passed**. Strict alarm identities remain asserted. Shared/server/driver
+  use explicit mutual DER trust and encrypted API-key sessions; CLI's existing
+  autoaccept is disclosed and is not rejection-policy evidence. The same harness
+  first exposed the hierarchy defect at **60/62**. Commands, artifact hashes,
+  policies and outcomes are checked in under
+  `scripts/validation/opcua-sdk-compatibility/evidence/2026-11-10/`.
+- The actual unchanged ScadaBridge adapter, SDK1.5.378.106, passed **9 None/API-key
+  cases against each server** (18 total). Strict encrypted connections fail on
+  both original/candidate because its application certificate is unconfigured:
+  [ScadaBridge#121](https://gitea.dohertylan.com/dohertj2/ScadaBridge/issues/121).
+  That is a retained failure, not a secure interoperability pass. Reproducible
+  isolated consumer receipts are in `scripts/validation/scadabridge-sdk-compatibility/`.
+- Real local SQL Server: **195/195** on each version. QuestDB10.0.1: **233 passed,
+  zero failed, one existing opt-in race-stress skip** on each version. Case maps
+  match exactly. Only task databases/prefixes and the task QuestDB container/volume
+  were removed. See [backend receipts](evidence/2026-11-10-opcua2/backend-matrix.md).
+  This is not real AVEVA evidence.
+
+## Solution, performance and package evidence
+
+Whole-solution Release builds pass with **zero warnings/errors**, including all
+inventory consumers. All restored production Foundation packages are 2.0.1; no
+MigrationAnalyzer reference/runtime asset remains. The only old SDK is isolated
+in the explicitly original-SDK validation process outside the solution.
+
+The first full CI-equivalent run executed **18,459** cases with execution guard
+passed (floor12,000), but failed203: 192 from an incorrect test-oracle reflection
+port (repaired and **554/554 Core.Abstractions tests passed**), the ten known
+PercentGood baseline failures, and a ScriptWorker250ms timing assertion.
+The latter also fails independently on untouched baseline83ed880e (880.13ms),
+so no threshold/filter/skip was changed; it is
+[#798](https://gitea.dohertylan.com/dohertj2/lmxopcua/issues/798).
+The fresh second full solution run produced **63 TRX files, 19,121 total,
+18,486 executed, 18,475 passed, 11 failed and 635 existing skipped cases**.
+Its test exit is **1**, execution guard **0** (floor12,000). The exact eleven
+failures are the same ten PercentGood cases (#796) and one timing case (#798);
+there are no additional failure classes. This is baseline-matching evidence,
+**not a green solution run**. The command/logs are retained under ignored
+`artifacts/opcua2/88ee30e0/solution-tests2/`;
+[versioned counters and exact failures](evidence/2026-11-10-opcua2/solution-tests2.json)
+retain the nonzero status. Fixture-backed gates remain separate.
+
+Three alternating warmed lock measurements per version show medians17→15ms for
+10k-tag rebuild and81→80ms for50k-node removal, with equal visit counts.
+See [bounded subset and host-load caveats](evidence/2026-11-10-opcua2/lock-benchmarks.md).
+The separate 72,000-call warmed native-process experiment records median p95
+changes +14.95% scalar read, +1.58% scalar write, -16.28% array read, -17.24%
+array write, plus lower allocated bytes/workload operation. It retains the
+scalar-read outlier, small-workload scope, host-load and JIT-mode caveats. Neither
+these samples nor the short cold-tiered measurements certify full G4.
+
+Four self-contained publishes (Linux ARM64 and Windows x64 Host/CLI) pass with
+runtime10.0.14, unique SDK DLL basenames, native RID validation and file hashes.
+Actual Linux Host passes two start/stop cycles with unchanged certificate identity,
+healthy web checks, real HMAC-key positive/negative cases and strict peer negatives.
+Console/rolling logs contain zero task-secret occurrences. See
+[publish/runtime receipts](evidence/2026-11-10-opcua2/publish-smoke.md).
+Windows service/runtime installation remains
+[#800](https://gitea.dohertylan.com/dohertj2/lmxopcua/issues/800), not inferred from
+cross-publishing. Approved live AVEVA/consumer/pair validation remains
+[#801](https://gitea.dohertylan.com/dohertj2/lmxopcua/issues/801).
+
+## Resource finding and long-run scope
+
+The Mac SDK-server restart soak failed twice around17 minutes at the unchanged
+initial-RSS+128MiB guard. One run completed250 cycles/62 restarts; managed memory,
+FDs, cached stores and logical collections remained bounded, but process RSS did
+not meet its limit. **No two-hour pass is claimed.**
+[#799](https://gitea.dohertylan.com/dohertj2/lmxopcua/issues/799) retains the failed
+TRX/JSONL and active investigation. Explicit SDK wrapper tracking found created=
+disposed and no outstanding/unreachable-undisposed wrapper after cleanup;
+controlled private PFX imports/SDK copies accumulate native Apple Security
+objects, unlike shared-handle/public-only controls. These controls do not attribute the entire RSS increase or isolate the server
+from the co-located SDK client. Astra found no safe narrow public copy-policy
+setting in exact2.0.1. Switching channel/session factories would change lifecycle
+semantics and requires separate design. No unproven production patch or resource-
+budget waiver was applied.
+
+The original Mac PKI-specific descriptor zero was invalid because `/var` and
+`/private/var` were compared literally. Corrected canonical, directory-bounded
+instrumentation proves0→1→0 for an open test file and reaps a timed-out probe.
+The original logical/global-FD evidence remains usable; its PKI-zero claim does
+not. A corrected90-second smoke is explicitly not two-hour evidence.
+
+The same-cap self-contained **Linux ARM64 server/node-manager workload also
+failed**, at **248 cycles / 61 restarts / 903.508 seconds**: RSS353,931,264
+exceeded351,850,496 bytes (cycle3 baseline+128MiB). Managed memory~20.5MB,
+descriptors189, PKI descriptors0, cached stores2 and logical collections remained
+bounded. Runtime10.0.14, SDK2.0.1; test/container/launcher fail. This broadens
+#799 beyond macOS; no complete/two-hour pass exists.
+[Selected Linux failed-run receipts](evidence/2026-11-10-opcua2/server-linux-soak-failed.json)
+retain hashes, unchanged limits, positive descriptor controls and failure.
+
+The independent root-owned actual production Shared/driver/live-reinitialize/
+browser lifecycle run on Linux is still in progress. Its final elapsed duration,
+counters, resource limits and completion/exit guards must be recorded separately.
+A short diagnostic, a running process, or a different workload is never substituted
+for a required passing gate. G4 and release approval remain open.
@@ -0,0 +1,361 @@
+{
+  "issue": "#799",
+  "status": "failed",
+  "scope": "In-process SDK client and production server/node-manager lifecycle; not standalone server attribution",
+  "source": {
+    "launcherSourceRevision": "38098ce142ab8c382825aa754e0758071dd3a46b",
+    "publishedSourceRevision": "74c938f37cbb9cf08b6ca72e4effc511120dc274",
+    "productionEquivalentTo": "7b353d7bae5311a2f0a33c0a82c88d2c5b49d76f",
+    "productionDiffEmpty": true,
+    "canonicalDescriptorProbeCommit": "642aefe3",
+    "testSourceSha256": "e695783e05787d94bf5d167b25b1c48b446b800c28259f023c28ed6012d737d1",
+    "publishCommand": "reused self-contained artifact: /private/tmp/opcua2-server-linux-diagnostic-20261110a/app",
+    "appPath": "/private/tmp/opcua2-server-linux-diagnostic-20261110a/app",
+    "apphost": {
+      "format": "ELF64 AArch64",
+      "sha256": "97531b8005df9dc8b129d2b22ba2049cf572d5d970046f7e8644ec632e860032"
+    },
+    "runtimeConfig": {
+      "runtimeOptions": {
+        "tfm": "net10.0",
+        "includedFrameworks": [
+          {
+            "name": "Microsoft.NETCore.App",
+            "version": "10.0.14"
+          },
+          {
+            "name": "Microsoft.AspNetCore.App",
+            "version": "10.0.14"
+          }
+        ],
+        "configProperties": {
+          "System.Reflection.Metadata.MetadataUpdater.IsSupported": false,
+          "System.Reflection.NullabilityInfoContext.IsSupported": true,
+          "System.Runtime.Serialization.EnableUnsafeBinaryFormatterSerialization": false
+        }
+      }
+    },
+    "sdkDependencies": [
+      "OPCFoundation.NetStandard.Opc.Ua.Client/2.0.1",
+      "OPCFoundation.NetStandard.Opc.Ua.Configuration/2.0.1",
+      "OPCFoundation.NetStandard.Opc.Ua.Core.Schema/2.0.1",
+      "OPCFoundation.NetStandard.Opc.Ua.Core.Types/2.0.1",
+      "OPCFoundation.NetStandard.Opc.Ua.Core/2.0.1",
+      "OPCFoundation.NetStandard.Opc.Ua.Security.Certificates/2.0.1",
+      "OPCFoundation.NetStandard.Opc.Ua.Server/2.0.1",
+      "OPCFoundation.NetStandard.Opc.Ua.Types/2.0.1"
+    ],
+    "image": {
+      "Id": "sha256:b04611ee9e1b7d36797012ed921962c57189cb4dbb3dff12afb8e158110f293b",
+      "RepoDigests": [
+        "mcr.microsoft.com/dotnet/sdk@sha256:e362a8dbcd691522456da26a5198b8f3ca1d7641c95624fadc5e3e82678bd08a"
+      ],
+      "Architecture": "arm64",
+      "Os": "linux"
+    },
+    "hostDotnet": ".NET SDK:\n Version:           10.0.403\n Commit:            5a2162bea6\n Workload version:  10.0.400-manifests.a00bebb6\n MSBuild version:   18.9.15+5a2162bea\n\nRuntime Environment:\n OS Name:     Mac OS X\n OS Version:  26.5\n OS Platform: Darwin\n RID:         osx-arm64\n Base Path:   /opt/homebrew/Cellar/dotnet/10.0.403/libexec/sdk/10.0.403/\n\n.NET workloads installed:\nThere are no installed workloads to display.\nConfigured to use workload sets when installing new manifests.\nNo workload sets are installed. Run \"dotnet workload restore\" to install a workload set.\n\nHost:\n  Version:      10.0.14\n  Architecture: arm64\n  Commit:       0427b9abbe\n\n.NET SDKs installed:\n  10.0.403 [/opt/homebrew/Cellar/dotnet/10.0.403/libexec/sdk]\n\n.NET runtimes installed:\n  Microsoft.AspNetCore.App 10.0.14 [/opt/homebrew/Cellar/dotnet/10.0.403/libexec/shared/Microsoft.AspNetCore.App]\n  Microsoft.NETCore.App 10.0.14 [/opt/homebrew/Cellar/dotnet/10.0.403/libexec/shared/Microsoft.NETCore.App]\n\nOther architectures found:\n  None\n\nEnvironment variables:\n  DOTNET_ROOT                              [/opt/homebrew/Cellar/dotnet/10.0.403/libexec]\n\nglobal.json file:\n  /Users/dohertj2/.codex/worktrees/opcua-sdk-2-upgrade/OtOpcUa/global.json\n\nLearn more:\n  https://aka.ms/dotnet/info\n\nDownload .NET:\n  https://aka.ms/dotnet/download\n",
+    "network": "none",
+    "mode": "full",
+    "durationSeconds": 7200,
+    "startedUtc": "2026-11-10T18:10:21Z"
+  },
+  "launcherResult": {
+    "status": "failed",
+    "containerExitCode": 1,
+    "containerElapsedSeconds": 907.5196822080761,
+    "validationError": "TRX expected exact passed/executed count 1: /private/tmp/opcua2-server-linux-full-20261110/task/results/soak.trx"
+  },
+  "start": {
+    "kind": "start",
+    "utc": "2026-11-10T18:10:24.882222+00:00",
+    "processId": 192,
+    "mode": "full",
+    "requestedSeconds": 7200,
+    "minimumFullSeconds": 7200,
+    "build": "38098ce142ab8c382825aa754e0758071dd3a46b",
+    "sdk": "2.0.1+07e62f72500cc0923a2bab940653c8c1116fa286",
+    "diagnosticInstrumentation": "SDK2.0.1 CP lists and certificate-validation cached stores; read-only",
+    "limits": {
+      "retainedManagedGrowthBytes": 67108864,
+      "rssGrowthBytes": 134217728,
+      "fdGrowth": 32
+    },
+    "coverage": "encrypted sessions; scalar/Int16[] Raw+UNS; subscription removal; browse abandonment; history release/cross-session/close; surgical changes/rebuild; revocation; paused TCP read/recovery; same-PKI restart"
+  },
+  "failed": {
+    "kind": "failed",
+    "cycles": 248,
+    "restarts": 61,
+    "seconds": 903.5081762,
+    "exceptionType": "Shouldly.ShouldAssertException"
+  },
+  "test": {
+    "executionId": "b3f13597-f945-44bf-9134-cb0282f6455c",
+    "testId": "3a3639bf-5159-da35-0b1a-0a6c89f03e2c",
+    "testName": "ZB.MOM.WW.OtOpcUa.OpcUaServer.IntegrationTests.Sdk2LifecycleSoakTests.Repeated_lifecycles_return_resources_to_a_steady_baseline",
+    "computerName": "b0dfc9462250",
+    "duration": "00:15:04.9982391",
+    "startTime": "2026-11-10T18:10:23.4089949+00:00",
+    "endTime": "2026-11-10T18:25:28.4141750+00:00",
+    "testType": "13cdc9d9-ddb5-4fa4-a97d-d965ccfc6d4b",
+    "outcome": "Failed",
+    "testListId": "8c84fa94-04c1-424b-9868-57a2d4851a1d",
+    "relativeResultsDirectory": "b3f13597-f945-44bf-9134-cb0282f6455c"
+  },
+  "error": "Shouldly.ShouldAssertException : 353931264L\r\n    should be less than or equal to\r\n351850496L\r\n    but was not",
+  "counters": {
+    "total": "1",
+    "executed": "1",
+    "passed": "0",
+    "failed": "1",
+    "error": "0",
+    "timeout": "0",
+    "aborted": "0",
+    "inconclusive": "0",
+    "passedButRunAborted": "0",
+    "notRunnable": "0",
+    "notExecuted": "0",
+    "disconnected": "0",
+    "warning": "0",
+    "completed": "0",
+    "inProgress": "0",
+    "pending": "0"
+  },
+  "samples": [
+    {
+      "Cycle": 1,
+      "Seconds": 2.6707062,
+      "Sessions": 0,
+      "Subscriptions": 0,
+      "Items": 0,
+      "BrowsePoints": 0,
+      "HistoryPoints": 0,
+      "LiveDataItems": 0,
+      "LiveEventItems": 0,
+      "MonitoredNodes": 0,
+      "Variables": 19,
+      "Folders": 4,
+      "Conditions": 1,
+      "CachedCertificateStores": 2,
+      "Descriptors": 187,
+      "PkiDescriptors": 0,
+      "ManagedBytes": 19829880,
+      "RssBytes": 212717568,
+      "AllocatedBytes": 45694176,
+      "Gen0": 3,
+      "Gen1": 2,
+      "Gen2": 2
+    },
+    {
+      "Cycle": 3,
+      "Seconds": 7.5077403,
+      "Sessions": 0,
+      "Subscriptions": 0,
+      "Items": 0,
+      "BrowsePoints": 0,
+      "HistoryPoints": 0,
+      "LiveDataItems": 0,
+      "LiveEventItems": 0,
+      "MonitoredNodes": 0,
+      "Variables": 19,
+      "Folders": 4,
+      "Conditions": 1,
+      "CachedCertificateStores": 2,
+      "Descriptors": 187,
+      "PkiDescriptors": 0,
+      "ManagedBytes": 20362800,
+      "RssBytes": 217632768,
+      "AllocatedBytes": 52216848,
+      "Gen0": 7,
+      "Gen1": 6,
+      "Gen2": 6
+    },
+    {
+      "Cycle": 25,
+      "Seconds": 90.9064734,
+      "Sessions": 0,
+      "Subscriptions": 0,
+      "Items": 0,
+      "BrowsePoints": 0,
+      "HistoryPoints": 0,
+      "LiveDataItems": 0,
+      "LiveEventItems": 0,
+      "MonitoredNodes": 0,
+      "Variables": 19,
+      "Folders": 4,
+      "Conditions": 1,
+      "CachedCertificateStores": 2,
+      "Descriptors": 189,
+      "PkiDescriptors": 0,
+      "ManagedBytes": 20360784,
+      "RssBytes": 269185024,
+      "AllocatedBytes": 349530024,
+      "Gen0": 57,
+      "Gen1": 50,
+      "Gen2": 50
+    },
+    {
+      "Cycle": 50,
+      "Seconds": 181.3146113,
+      "Sessions": 0,
+      "Subscriptions": 0,
+      "Items": 0,
+      "BrowsePoints": 0,
+      "HistoryPoints": 0,
+      "LiveDataItems": 0,
+      "LiveEventItems": 0,
+      "MonitoredNodes": 0,
+      "Variables": 19,
+      "Folders": 4,
+      "Conditions": 1,
+      "CachedCertificateStores": 2,
+      "Descriptors": 189,
+      "PkiDescriptors": 0,
+      "ManagedBytes": 20444424,
+      "RssBytes": 230686720,
+      "AllocatedBytes": 652625024,
+      "Gen0": 113,
+      "Gen1": 100,
+      "Gen2": 100
+    },
+    {
+      "Cycle": 100,
+      "Seconds": 361.5237015,
+      "Sessions": 0,
+      "Subscriptions": 0,
+      "Items": 0,
+      "BrowsePoints": 0,
+      "HistoryPoints": 0,
+      "LiveDataItems": 0,
+      "LiveEventItems": 0,
+      "MonitoredNodes": 0,
+      "Variables": 19,
+      "Folders": 4,
+      "Conditions": 1,
+      "CachedCertificateStores": 2,
+      "Descriptors": 190,
+      "PkiDescriptors": 0,
+      "ManagedBytes": 20637848,
+      "RssBytes": 229531648,
+      "AllocatedBytes": 1261146560,
+      "Gen0": 225,
+      "Gen1": 200,
+      "Gen2": 200
+    },
+    {
+      "Cycle": 150,
+      "Seconds": 546.7687542,
+      "Sessions": 0,
+      "Subscriptions": 0,
+      "Items": 0,
+      "BrowsePoints": 0,
+      "HistoryPoints": 0,
+      "LiveDataItems": 0,
+      "LiveEventItems": 0,
+      "MonitoredNodes": 0,
+      "Variables": 19,
+      "Folders": 4,
+      "Conditions": 1,
+      "CachedCertificateStores": 2,
+      "Descriptors": 189,
+      "PkiDescriptors": 0,
+      "ManagedBytes": 20388720,
+      "RssBytes": 281825280,
+      "AllocatedBytes": 1907065880,
+      "Gen0": 338,
+      "Gen1": 300,
+      "Gen2": 300
+    },
+    {
+      "Cycle": 200,
+      "Seconds": 727.6899225,
+      "Sessions": 0,
+      "Subscriptions": 0,
+      "Items": 0,
+      "BrowsePoints": 0,
+      "HistoryPoints": 0,
+      "LiveDataItems": 0,
+      "LiveEventItems": 0,
+      "MonitoredNodes": 0,
+      "Variables": 19,
+      "Folders": 4,
+      "Conditions": 1,
+      "CachedCertificateStores": 2,
+      "Descriptors": 189,
+      "PkiDescriptors": 0,
+      "ManagedBytes": 20678608,
+      "RssBytes": 269180928,
+      "AllocatedBytes": 2516228704,
+      "Gen0": 450,
+      "Gen1": 400,
+      "Gen2": 400
+    },
+    {
+      "Cycle": 245,
+      "Seconds": 896.2277082,
+      "Sessions": 0,
+      "Subscriptions": 0,
+      "Items": 0,
+      "BrowsePoints": 0,
+      "HistoryPoints": 0,
+      "LiveDataItems": 0,
+      "LiveEventItems": 0,
+      "MonitoredNodes": 0,
+      "Variables": 19,
+      "Folders": 4,
+      "Conditions": 1,
+      "CachedCertificateStores": 2,
+      "Descriptors": 189,
+      "PkiDescriptors": 0,
+      "ManagedBytes": 20292328,
+      "RssBytes": 341528576,
+      "AllocatedBytes": 3109239976,
+      "Gen0": 552,
+      "Gen1": 490,
+      "Gen2": 490
+    },
+    {
+      "Cycle": 247,
+      "Seconds": 901.025049,
+      "Sessions": 0,
+      "Subscriptions": 0,
+      "Items": 0,
+      "BrowsePoints": 0,
+      "HistoryPoints": 0,
+      "LiveDataItems": 0,
+      "LiveEventItems": 0,
+      "MonitoredNodes": 0,
+      "Variables": 19,
+      "Folders": 4,
+      "Conditions": 1,
+      "CachedCertificateStores": 2,
+      "Descriptors": 189,
+      "PkiDescriptors": 0,
+      "ManagedBytes": 20547624,
+      "RssBytes": 349171712,
+      "AllocatedBytes": 3115447904,
+      "Gen0": 556,
+      "Gen1": 494,
+      "Gen2": 494
+    }
+  ],
+  "maximumRecordedQuiescent": {
+    "ManagedBytes": 20890032,
+    "RssBytes": 349171712,
+    "Descriptors": 191,
+    "PkiDescriptors": 0
+  },
+  "evidenceSha256": {
+    "result.json": "cb3d4dc9c3dcd80392e66f21d6b6e36907d8438c550a1723dced57a0968e7e89",
+    "source.json": "5bd909d1f289d38039b996ed110b450cd3914a6a69d96c7f3aa83b016629497d",
+    "task/soak.jsonl": "1d24d32382b5be6ebca2615389929818dd6c9874b7787cb91482ceaa5d3b9cd3",
+    "task/results/soak.trx": "798c97c3158ec35d9dbae754e98f57a7bf403ae10b81473f98a52a89c2401265",
+    "task/results/descriptor-controls.trx": "99ca030ff7542e2dc43959d8cf9a2f129352db9c6a44d5d011c6e10fa9327f01"
+  },
+  "limitations": [
+    "No complete row; no two-hour pass.",
+    "Failed sample248 RSS is reported in TRX before JSONL quiescent emission.",
+    "No resource budget or production workaround changed.",
+    "Private PKI and full task output are deliberately excluded."
+  ]
+}