docs: record final review hold and baseline ownership limits

docs/plans/2026-11-10-opcua-sdk-2-evidence.md

@@ -484,3 +484,39 @@ or acceptance evidence. [Scoped report and hashed receipts](evidence/2026-11-10-
 #799 and G4 remain failed/open. A matched original-SDK canonical adapter is being
 prepared before any further acceptance-protocol review; no warmed replacement
 baseline, budget waiver, factory/runtime setting or production patch was adopted.
+
+
+## Original canonical adapter limitation and final review boundary
+
+The [original-SDK canonical adapter](../../scripts/validation/opcua-lifecycle-memory/baseline-canonical/README.md)
+compiles against the unchanged `83ed880e` publications with zero warnings/errors;
+its package/input/source hashes are preserved. A short normal-cycle control
+completed encrypted sessions, typed writes/readbacks, all ten history calls,
+revocation, surgery/rebuild, stalled-read recovery, subscription cleanup and both
+client closes. The retained closed Session object still held one browse and six
+history points while SessionManager had zero active sessions; the copied assertion
+fails with exit1, including after a separate fixed250ms observation. Exact1.5
+binary inspection shows Close removes diagnostics, while Dispose clears those
+lists. Held-object state does not prove live server retention or an unbounded leak.
+
+A separate active-session restart control cleared the observable session/
+subscription/item/CP counts, then returned **exit2: unsupported ownership parity**.
+Original ApplicationInstance/CertificateValidator have no SDK2 manager-disposal
+observable; cached store references1→1 are not file-handle counts. Unsupported
+metrics were not fabricated as zeros. This is not a passing four-cycle sequence,
+a matched process-memory host, an accepted RSS denominator or a long-run result.
+Astra independently verified208 reference hashes, all short-run projections and
+the exact immutable close/dispose behavior. The diagnostic package is reviewable;
+shared semantic/token/weak-root/resource-owner checks remain prerequisites to a
+new acceptance procedure.
+
+Astra's final integrated verdict is **source/security review closed, release HOLD**.
+It independently verified all63 final CI4 TRX hashes/counters and exact baseline
+failure attribution, the two-hour client receipts and428-file recursive manifest,
+the candidate saturation result and original failure preservation, and the
+original adapter's explicit limitations. No new must-fix migration source/security
+finding remains. **CI remains red on11 baseline cases; G3 external evidence and
+G4 resource/performance acceptance remain unresolved.** #799, #800, #801 and
+ScadaBridge#121 stay open. Neither an SDK version substitution, production crypto/
+session-factory workaround, resource-cap waiver nor warmed acceptance baseline
+was approved. SDK2 remains on draft PR#802; it is not merged to master or deployed.

docs/plans/2026-11-10-opcua-sdk-2-rollout.md

@@ -107,6 +107,13 @@ Shared/driver/reinitialize/browser Linux lifecycle run passed its actual two-hou
 duration and cleanup checks, as recorded above; it does not replace this failed
 server workload. See [long-run scope](2026-11-10-opcua-sdk-2-evidence.md#resource-finding-and-long-run-scope)
 for instrumentation limitations and final-result updates.
+The fixed candidate saturation diagnostic later met its selected generated-factory
+criterion, but retained the cold RSS rejection and exit1. The original-SDK adapter
+records partial wire coverage and unsupported ownership/process-memory parity;
+it supplies no approved performance denominator. See [scoped saturation result](evidence/2026-11-10-opcua2/saturation-candidate.md)
+and [original adapter limitations](../../scripts/validation/opcua-lifecycle-memory/baseline-canonical/README.md).
+Astra's final source/security review is closed; release remains on HOLD.
+
 
 | Operator release field | Still required before its release decision |
 |---|---|