docs: record reviewed native import reproduction

docs/plans/2026-11-10-opcua-sdk-2-evidence.md

@@ -595,6 +595,17 @@ failed after one partial operation on a diagnostic identity-association
 assumption; all owners and private files were cleaned. It is not a repeated
 import result or evidence of native retention resolution.
 
+The separately reviewed [corrected native import control](../../scripts/validation/opcua-lifecycle-memory/native-retention/NATIVE_IMPORT.md)
+completed all 200 imports through the exact installed native bridge in a child
+with no CLR or OPC UA SDK. AppleDatabase inventory was **1→201** and remained
+201 after idle; all 2,402 returned Core Foundation references and 200 keychains
+were released, with no owned files/descriptors and unchanged keychain fingerprints.
+Deletion occurred during copied-certificate untracking with item references still
+live. This establishes that a managed caller is unnecessary for reproduction; it
+does not distinguish native bridge ownership from Apple Security retention or
+authorize a production workaround. A separate matched deletion-order control
+remains under review. The failed first attempt is retained independently.
+
 #799 and G4 remain open. The [proposed Linux late-slope diagnostic](../../scripts/validation/opcua-lifecycle-memory/LATE_SLOPE.md)
 has implementation design approval only. It retains the cold baseline and first
 resource rejection and cannot emit acceptance. No new long run or release is