From d2076e75c680f07f5ad7c521c956b08a7ed4dfca Mon Sep 17 00:00:00 2001
From: Joseph Doherty <dohejw01@gmail.com>
Date: Tue, 10 Nov 2026 09:51:58 -0500
Subject: [PATCH] build: pin OPC UA SDK 2.0.1 and migration tooling

---
 Directory.Packages.props                      |  9 +++++----
 docs/plans/2026-11-10-opcua-sdk-2-evidence.md | 19 ++++++++++++++++++-
 .../ZB.MOM.WW.OtOpcUa.Client.Shared.csproj    |  1 +
 ....OtOpcUa.Driver.OpcUaClient.Browser.csproj |  1 +
 ....OtOpcUa.Driver.OpcUaClient.Session.csproj |  1 +
 ...B.MOM.WW.OtOpcUa.Driver.OpcUaClient.csproj |  1 +
 .../ZB.MOM.WW.OtOpcUa.OpcUaServer.csproj      |  1 +
 7 files changed, 28 insertions(+), 5 deletions(-)

diff --git a/Directory.Packages.props b/Directory.Packages.props
index 34f3ae8e..8ab56f3f 100644
--- a/Directory.Packages.props
+++ b/Directory.Packages.props
@@ -126,13 +126,14 @@
          provider that breaks the "managed only" rule, which is why it is opt-in per instance. -->
     <PackageVersion Include="System.Data.Odbc" Version="10.0.14" />
     <PackageVersion Include="Novell.Directory.Ldap.NETStandard" Version="3.6.0" />
-    <PackageVersion Include="OPCFoundation.NetStandard.Opc.Ua.Client" Version="1.5.378.182" />
+    <PackageVersion Include="OPCFoundation.NetStandard.Opc.Ua.MigrationAnalyzer" Version="2.0.1" />
+    <PackageVersion Include="OPCFoundation.NetStandard.Opc.Ua.Client" Version="2.0.1" />
     <!-- Core carries Opc.Ua.StatusCodes, the oracle StatusCodeParityTests checks the drivers'
          hard-coded uint constants against. Referenced by that TEST project only — the drivers
          themselves stay SDK-free by design and keep spelling status codes as bare uints. -->
-    <PackageVersion Include="OPCFoundation.NetStandard.Opc.Ua.Core" Version="1.5.378.182" />
-    <PackageVersion Include="OPCFoundation.NetStandard.Opc.Ua.Configuration" Version="1.5.378.182" />
-    <PackageVersion Include="OPCFoundation.NetStandard.Opc.Ua.Server" Version="1.5.378.182" />
+    <PackageVersion Include="OPCFoundation.NetStandard.Opc.Ua.Core" Version="2.0.1" />
+    <PackageVersion Include="OPCFoundation.NetStandard.Opc.Ua.Configuration" Version="2.0.1" />
+    <PackageVersion Include="OPCFoundation.NetStandard.Opc.Ua.Server" Version="2.0.1" />
     <!-- Fully managed ODP.NET Core for the Sql poll driver's OracleDialect
          (OracleClientFactory.Instance). The ".Core" package is the 100%-managed driver — no Oracle
          Instant Client / OCI native install, matching the Npgsql constraint above. Latest stable of
diff --git a/docs/plans/2026-11-10-opcua-sdk-2-evidence.md b/docs/plans/2026-11-10-opcua-sdk-2-evidence.md
index 0ff2817d..eee9fc35 100644
--- a/docs/plans/2026-11-10-opcua-sdk-2-evidence.md
+++ b/docs/plans/2026-11-10-opcua-sdk-2-evidence.md
@@ -65,7 +65,7 @@ No optional ManagedSession/DI/AOT/cluster redesign, trust relaxation, silent war
 ## Gates
 
 - G0 baseline/design: accepted for migration, with corrections and external/trust-matrix gaps recorded below.
-- G1 restored 2.0 graph / break inventory: pending.
+- G1 restored 2.0 graph / break inventory: passed for lane execution; compilation convergence pending.
 - G2 compilation convergence: pending.
 - G3 behavioral/security/interoperability: pending.
 - G4 lifecycle/performance/publish: pending.
@@ -113,3 +113,20 @@ G0 is accepted for migration with these explicitly accounted external/trust-matr
 Inspected all four exact 2.0.1 net10 nuspec dependency groups. They require Extensions Configuration/Abstractions, DI/Abstractions, Diagnostics, Http, Logging/Abstractions, Options/ConfigurationExtensions at 10.0.12; Client/Server require Hosting.Abstractions 10.0.12; Client also Http.Resilience 10.10.0; RateLimiting and Bcl.TimeProvider 10.0.12 are transitive. Raise existing central Extensions pins to 10.0.12 coherently (including Configuration.Json/Hosting/WindowsServices); no unrelated EF/ASP.NET uplift, no downgrade of Xml/Pkcs 10.0.13.
 
 Standalone Extensions uplift with SDK still 1.5.378.182: whole-solution restore succeeds; Release build succeeds **0 warnings / 0 errors** (31.79s). Logs `artifacts/opcua2/56250a88/extensions-uplift/`. All-host runtime regressions (AdminUI, DataProtection/auth, ControlPlane, Host, Runtime) remain mandatory in G3 whole-solution testing; this compile check does not claim behavioral verification.
+
+## G1 package/analyzer spike
+
+Astra closed both G0 corrections and approved migration after independently verifying all nine TRX files. The standalone Extensions uplift built cleanly. All four SDK pins are now exactly 2.0.1. MigrationAnalyzer 2.0.1 is temporary in five direct production consumers, with `PrivateAssets=all` and **only** analyzers/build/buildtransitive assets: no runtime compatibility shim is referenced. Exact package ships Roslyn 4.14/5.0 assemblies; the selected analyzer loads on this SDK (UA diagnostics emitted, no CS9057). Tagged analyzer guidance is reviewed case by case; no blanket codefix pass. Generator collection shims must be removed with the package before G2.
+
+Restore succeeds without downgrade suppression or source changes. The first compiler wave reports:
+
+| Owning project | Distinct diagnostics |
+|---|---:|
+| ZB.MOM.WW.OtOpcUa.Client.Shared | 90 |
+| ZB.MOM.WW.OtOpcUa.Driver.Historian.Sql.Common.Tests | 15 |
+| ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.Session | 8 |
+| ZB.MOM.WW.OtOpcUa.OpcUaServer | 15 |
+
+This is the exposed first wave, not the solution-wide final break count: server overrides, removed collections, immutable/null/Variant APIs, certificate manager, and async identity construction block downstream compilation. Log and exact diagnostics: `artifacts/opcua2/d9984028/sdk2-spike/{build.log,diagnostics.txt}`. Later diagnostics are inventoried by lane until G2 convergence; no compile failure is claimed as behavioral success.
+
+Restored project graphs contain no mixed Foundation SDK versions: every Foundation package (including analyzer-only development transitive GDS assets) is 2.0.1. Host graph resolves Bcl.TimeProvider 10.0.12, RateLimiting 10.0.12, Http.Resilience 10.10.0. G1 is satisfied for lane execution; full build/tests remain required at G2/G3. Frozen boundary contract is above; production and unit paths are split by plan ownership, integration/historian oracle edits coordinator-only.
diff --git a/src/Client/ZB.MOM.WW.OtOpcUa.Client.Shared/ZB.MOM.WW.OtOpcUa.Client.Shared.csproj b/src/Client/ZB.MOM.WW.OtOpcUa.Client.Shared/ZB.MOM.WW.OtOpcUa.Client.Shared.csproj
index 4ad02026..e6dc5edf 100644
--- a/src/Client/ZB.MOM.WW.OtOpcUa.Client.Shared/ZB.MOM.WW.OtOpcUa.Client.Shared.csproj
+++ b/src/Client/ZB.MOM.WW.OtOpcUa.Client.Shared/ZB.MOM.WW.OtOpcUa.Client.Shared.csproj
@@ -8,6 +8,7 @@
     </PropertyGroup>
 
     <ItemGroup>
+        <PackageReference Include="OPCFoundation.NetStandard.Opc.Ua.MigrationAnalyzer" PrivateAssets="all" IncludeAssets="analyzers;build;buildtransitive" />
         <PackageReference Include="OPCFoundation.NetStandard.Opc.Ua.Client"/>
         <PackageReference Include="Serilog"/>
     </ItemGroup>
diff --git a/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.Browser/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.Browser.csproj b/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.Browser/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.Browser.csproj
index 94fd7e3b..a023fb83 100644
--- a/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.Browser/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.Browser.csproj
+++ b/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.Browser/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.Browser.csproj
@@ -13,6 +13,7 @@
         <ProjectReference Include="..\ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.Session\ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.Session.csproj" />
     </ItemGroup>
     <ItemGroup>
+        <PackageReference Include="OPCFoundation.NetStandard.Opc.Ua.MigrationAnalyzer" PrivateAssets="all" IncludeAssets="analyzers;build;buildtransitive" />
         <PackageReference Include="OPCFoundation.NetStandard.Opc.Ua.Client" />
         <PackageReference Include="OPCFoundation.NetStandard.Opc.Ua.Configuration" />
         <PackageReference Include="Microsoft.Extensions.Logging.Abstractions" />
diff --git a/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.Session/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.Session.csproj b/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.Session/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.Session.csproj
index a495b149..db5458cb 100644
--- a/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.Session/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.Session.csproj
+++ b/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.Session/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.Session.csproj
@@ -34,6 +34,7 @@
         ContractsIsDependencyLightTests in Driver.OpcUaClient.Tests.
     -->
     <ItemGroup>
+        <PackageReference Include="OPCFoundation.NetStandard.Opc.Ua.MigrationAnalyzer" PrivateAssets="all" IncludeAssets="analyzers;build;buildtransitive" />
         <PackageReference Include="OPCFoundation.NetStandard.Opc.Ua.Client" />
         <!-- OpcUaUserIdentityFactory: the secret: resolution of the credential fields feeding the SDK UserIdentity is
              shared by the driver and the AdminUI browse (review 2026-10-21 O-5), so the browse presents exactly the
diff --git a/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.csproj b/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.csproj
index a93a9d07..e4945f30 100644
--- a/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.csproj
+++ b/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.csproj
@@ -21,6 +21,7 @@
     </ItemGroup>
 
     <ItemGroup>
+        <PackageReference Include="OPCFoundation.NetStandard.Opc.Ua.MigrationAnalyzer" PrivateAssets="all" IncludeAssets="analyzers;build;buildtransitive" />
         <PackageReference Include="OPCFoundation.NetStandard.Opc.Ua.Client"/>
         <PackageReference Include="OPCFoundation.NetStandard.Opc.Ua.Configuration"/>
         <PackageReference Include="ZB.MOM.WW.Secrets.Abstractions"/>
diff --git a/src/Server/ZB.MOM.WW.OtOpcUa.OpcUaServer/ZB.MOM.WW.OtOpcUa.OpcUaServer.csproj b/src/Server/ZB.MOM.WW.OtOpcUa.OpcUaServer/ZB.MOM.WW.OtOpcUa.OpcUaServer.csproj
index f3f694e3..ccc65441 100644
--- a/src/Server/ZB.MOM.WW.OtOpcUa.OpcUaServer/ZB.MOM.WW.OtOpcUa.OpcUaServer.csproj
+++ b/src/Server/ZB.MOM.WW.OtOpcUa.OpcUaServer/ZB.MOM.WW.OtOpcUa.OpcUaServer.csproj
@@ -5,6 +5,7 @@
     </PropertyGroup>
 
     <ItemGroup>
+        <PackageReference Include="OPCFoundation.NetStandard.Opc.Ua.MigrationAnalyzer" PrivateAssets="all" IncludeAssets="analyzers;build;buildtransitive" />
         <PackageReference Include="OPCFoundation.NetStandard.Opc.Ua.Server"/>
         <!-- All OPC UA packages aligned at the central 1.5.378.182 (Opc.Ua.Server 1.5.378.182 is now
              published). The prior VersionOverride pinned Opc.Ua.Configuration/Core to 1.5.374.126 to match