diff --git a/.github/workflows/v2-integration.yml b/.github/workflows/v2-integration.yml
index 039480404..d903c4a1a 100644
--- a/.github/workflows/v2-integration.yml
+++ b/.github/workflows/v2-integration.yml
@@ -74,7 +74,7 @@ jobs:
       - name: assert not-all-skipped
         if: always()
         env:
-          # #816/#818 added 8 executing OpcUaClient tests; raise to 448 once a hosted run confirms them
+          # #816/#818 added 8 executing OpcUaClient tests; raise to 448 once a hosted run confirms them (blocked on #860)
           # (scripts/ci/README.md §"Fixture-backed integration").
           MIN_EXECUTED: "440"
         run: bash scripts/ci/assert-not-all-skipped.sh artifacts/trx/*.trx
diff --git a/scripts/ci/README.md b/scripts/ci/README.md
index 9ee3a444f..752a2b1f4 100644
--- a/scripts/ci/README.md
+++ b/scripts/ci/README.md
@@ -83,19 +83,23 @@ Neither touches `v2-ci.yml`; each has its own concurrency group (`lmxopcua-v2-in
   Local run: 468 executed / 8 skipped (Oracle x2, the blackhole `docker pause` gate, one QuestDB stress test,
   4 others), about 4.5 min of test time, QuestDB the longest (~3.3 min). Not covered (no pullable image or
   needs credentials): Modbus/S7/AB/FOCAS/TwinCAT sims, Mqtt, MTConnect, Oracle, Host real-infra mode.
-  **#816/#818 added 6 executing tests here, floor NOT yet raised:** `ServerHostNameValidationTests` (3, vs the plain
-  `otopcua-ci-opcplc`) and the NAT positive-secure / host-name cases (3, which run because `integration-fixtures.sh`
-  now exports the NAT container's public certificate as `OPCUA_NAT_SERVER_CERT`). Locally (2026-11-11, shared host)
-  the two OpcUaClient projects went 13 → 19 executed with 0 skipped, and `assert-not-all-skipped.sh` counted them.
-  Once a hosted run's TRX shows `Driver.OpcUaClient.trx` executed=8 and `Driver.OpcUaClient.Browser.trx` executed=11,
-  raise `MIN_EXECUTED` in `v2-integration.yml` **440 → 448** (and `v2-e2e.yml` 35 → 39). If the NAT three show as skipped there, the certificate
+  **#816/#818 added 8 executing tests here, floor NOT yet raised:** `ServerHostNameValidationTests` (4, vs the plain
+  `otopcua-ci-opcplc`) and the NAT None-browse / positive-secure / host-name cases (4; the certificate-trusting three
+  run because `integration-fixtures.sh` exports the throwaway NAT container's public certificate as
+  `OPCUA_NAT_SERVER_CERT`). Locally (2026-11-11, same CI filter) the two OpcUaClient projects went 13 → 21 executed
+  with 0 skipped (`Driver.OpcUaClient` 9, `Driver.OpcUaClient.Browser` 12), and the NAT class passed 7/7 against a
+  CI-style throwaway `docker run` of the NAT container plus the `docker exec` certificate hand-off.
+  Once a hosted run's TRX shows `Driver.OpcUaClient.trx` executed=9 and `Driver.OpcUaClient.Browser.trx` executed=12,
+  raise `MIN_EXECUTED` in `v2-integration.yml` **440 → 448** (and `v2-e2e.yml` 35 → 39). Hosted runs have not yet
+  reached the test step (fixture start times out on the first network probe, #860), so this is still open (#818).
+  If the NAT three show as skipped there, the certificate
   hand-off (`docker exec … /app/pki/own/certs/*.der`) did not work on the runner — fix that, do not lower the bump.
 - **`v2-e2e.yml`** (manual + weekly cron only; `timeout-minutes: 90`). `probe-e2e-fixtures.sh` TCP-probes
   10.100.0.35 ports 5020/1102/50000; if any is closed every later step is skipped and the run is green with a
   notice. Otherwise runs the Modbus, S7, OpcUaClient and OpcUaClient.Browser integration projects against the
-  shared fleet with `MIN_EXECUTED=35` (`OPCUA_NAT_ENDPOINT` points at the shared NAT stack on :50010; its 6 tests
+  shared fleet with `MIN_EXECUTED=35` (`OPCUA_NAT_ENDPOINT` points at the shared NAT stack on :50010; its 7 tests
   skip if it is down, so it is not a probe-required port — and its 3 certificate-trusting ones also skip if the stack's
   certificate no longer matches the committed `Docker/nat/opc-plc-nat-server.der`, so do not count them in the floor;
-  #816's 3 `ServerHostNameValidationTests` need only the probe-required :50000, so this floor may go **35 → 38** after
+  #816's 4 `ServerHostNameValidationTests` need only the probe-required :50000, so this floor may go **35 → 39** after
   a hosted run shows them executed) (local: 42 executed / 38 skipped; Modbus skips the profiles that are not
   up). No test carries `Category=E2E` today, so the zero-match guard is this executed floor.