Branch B (upstream-blocked): probed nuget.org for an xunit.v3 Akka TestKit —
Akka.TestKit.Xunit3 and Akka.TestKit.Xunit.v3 both return BlobNotFound (verified
2026-07-13), so the 3 holdouts (AdminUI/ControlPlane/Runtime.Tests) cannot migrate
off xunit v2 yet. Bumped the pin 2.9.2 -> 2.9.3 (latest 2.9.x) and moved the blocker
rationale + removal condition to a comment at the pin in Directory.Packages.props so
it lives at the version, not just in 3 scattered csprojs. All 3 suites green on 2.9.3
(514 + 63 + 364 tests).
- docs/Client.CLI.md: added ### ack / confirm / shelve / enable / disable sections
(synopsis + options + example + expected output), each noting the AlarmAck LDAP-role
gate and that --event-id comes from a prior `alarms` notification. Doc now covers all
13 CLI commands (was 8). Overview operations list updated.
- StyleGuide.md: 'ScadaBridge' -> 'OtOpcUa' (header line 3) + the ScadaBridge:Timeout
config-key example -> OpcUa:Timeout.
- .editorconfig (new, root): minimal code-style anchor; all C# analyzer rules at
suggestion severity so nothing fails a TreatWarningsAsErrors build (verified: 808
warnings unchanged from baseline, 0 errors).
- v2-e2e.yml deleted: its `--filter Category=E2E` matches zero tests repo-wide (the
E2ETests project doesn't exist) so it reported a permanent false green; and its
docker-dev fleet binds the LAN-only shared GLAuth (10.100.0.35:3893) + builds local
images, so it isn't hosted-runner-bootable anyway. FOLLOW-UP: when a runner-reachable
fleet + a real tests/Server/...E2ETests land, add a fresh workflow WITH a zero-match
guard (fail if Category=E2E matches nothing).
- v2-ci.yml integration matrix removed: fully redundant with the unit-tests leg, which
already runs both Host.IntegrationTests + OpcUaServer.IntegrationTests under the
identical filter, fixtureless, gated at MIN_EXECUTED=1. No coverage lost. The S-2
option-#2 fixture-backed-leg follow-up is preserved as a NOTE comment in the workflow.
Header comments updated; YAML validates; jobs are now build -> unit-tests.
- pending.md, current.md: git rm --cached (untrack, keep on disk) + root-anchored
.gitignore entries — making the files' own declared 'never stage' rule true.
- looseends.md: deleted (2026-05-18 snapshot; sole open item + all follow-ups
target the retired Wonderware historian sidecar rig, moot since the gateway
cutover; recoverable from history).
- stillpending.md -> docs/plans/2026-06-18-stillpending-backlog-audit.md (git mv;
referenced by docs/Historian.md + memory index, preserved under dated-plan convention).
- HISTORIAN-GATEWAY-INTEGRATION-ISSUES.md -> docs/plans/2026-06-27-historian-gateway-integration-issues.md (git mv).
- docs/Historian.md §'Closed backlog §2 items' repointed at the archived path.
Historical docs/plans/* references to the bare stillpending.md filename are frozen
point-in-time records, left untouched per the documentation-audit convention.
The 5 Driver.Historian.Wonderware* husks are untracked bin/obj build artifacts
(0 tracked files; absent from slnx). A fresh worktree carries no untracked files,
so there is nothing to rm. Only tracked Wonderware residue is the intentional
retired doc stub + closed-review findings.md (kept). Deviation recorded in plan.
Zero-reference proof passed: no *.csproj/*.props/*.targets/*.slnx names any
of the 7 binaries; no <HintPath> element exists repo-wide. Build clean after
removal. Added lib/ to .gitignore to block re-introduction.
Out of scope: purging these from git *history* (BFG/filter-repo) is a separate,
heavier decision that rewrites every clone; this removes them from the tip only.
Re-ran all seven domain reviews at master f6eaa267 (reports rewritten in
place, each with a prior-finding status table): all 4 round-1 Criticals
verified closed; new top findings are the S7 connect-timeout OCE regression
(05/STAB-14), the ResilienceConfig operator-authorable brick (01/S-6), and
a batch of resilience-seam Mediums. 00-OVERALL.md carries the updated
maturity matrix + 12-item action list.
Adds R2-01..R2-12 design/implementation plans (one per action item, house
format + bite-sized TDD task breakdowns + co-located .tasks.json; 193 tasks,
~18-24 dev-days). STATUS.md updated: round-1 topology marked historical
(all merged+pushed), re-review findings table + plan pointers added.
Flip the #12 rig-bug note from 'recommend fixing' to fixed: FOLLOWUP-10 + STATUS task #12
+ new branch topology row. central-1 verified booting clean with the committed compose.
Ran the #10 live gate: built the Host image from source (crit13 tip; Gitea feed answers
200 anonymously so restore worked), stood up the docker-dev rig, central-1 booted healthy
on the new invoker wiring. Prod DI binds the REAL DriverCapabilityInvokerFactory —
confirmed live + by a new deterministic guard (ResilienceInvokerFactoryRegistrationTests,
crit13 8a8b9ec5). The behavioral retry/breaker log-line was NOT observed: reading the
Modbus driver showed its cheap paths don't throw a wrapped exception (Discover offline,
Subscribe lazy, reads non-wrapped) — only an idempotent write-to-dead-endpoint or S7 does,
not worth the multi-dependency chase since the retry behavior is deterministically proven.
Also found a rig bug: docker-dev compose's retired Wonderware ServerHistorian keys
(Host/Port/SharedSecret, Enabled=true) crash the Host at bring-up (historian-gateway cutover
now reads Endpoint -> empty UriFormatException). Worked around with an override; recommend
fixing the committed compose. FOLLOWUP-10 + STATUS updated; crit13 topology head -> 8a8b9ec5.
Updates FOLLOWUP-10 + STATUS.md now that #10 is wired:
- The filed "thread CapabilityInvoker into the actor" was infeasible — Runtime is
deliberately Polly-free (refs Core.Abstractions, not Core). Shipped a seam mirroring
IDriverFactory (branch fix/archreview-crit10-wire-capability-invoker @ 62556c24).
- Triage corrections: only 6 of 7 sites are real (GenericDriverNodeManager is test-only
scaffolding, re-annotated); tier-defaults only (ResilienceConfig not in the artifact).
- Observability finding: the resilience-status tracker has no reader (Stream E.2/E.3
never shipped) → added retry/breaker logging as the interim surface + live-verify enabler.
- Verification: negative-control, recording-invoker routing, real-invoker actor-context,
analyzer + logging tests; clean solution build; Runtime 358 / Core 238 / Analyzers 32.
- Residual: live behavioral gate (rig recipe recorded) + the ResilienceConfig-in-artifact
sub-gap follow-up.
Track remediation progress: 2 of 4 Criticals done (03/S1 split-brain resolver;
02/U2+U3 VT timeout+ALC) + both CLAUDE.md doc-drifts fixed. STATUS.md is the
single source of truth (branch topology, completed items, task list, next-up,
resume facts). Each plan carries a status banner.
Add the 7 per-domain design+implementation plans (archreview/plans/) with
an index, produced from the 2026-07-08 architecture review.
Fix two confirmed doc drifts the review flagged (theme #5):
- CLAUDE.md KNOWN LIMITATION 2: the continuous-historization historized-ref
feed IS wired (AddressSpaceApplier.FeedHistorizedRefs -> UpdateHistorizedRefs
-> recorder); rewrite to reflect that value-capture is code-complete and only
the live end-to-end + restart-convergence verification remains.
- CLAUDE.md ScriptAnalysis gating: endpoints use Roles=Administrator,Designer
via RequireAuthorization, not the FleetAdmin policy.
Joseph Doherty