test: add isolated Linux server lifecycle soak launcher

scripts/validation/opcua-client-lifecycle/.gitignore

@@ -0,0 +1 @@
+__pycache__/

scripts/validation/opcua-client-lifecycle/Lifecycle.cs

@@ -0,0 +1,249 @@
+#pragma warning disable OTOPCUA0001
+using System.Collections;
+using System.Collections.Concurrent;
+using System.Diagnostics;
+using System.Reflection;
+using System.Security.Cryptography;
+using System.Text.Json;
+using Opc.Ua;
+using Opc.Ua.Configuration;
+using ZB.MOM.WW.OtOpcUa.Client.Shared;
+using ZB.MOM.WW.OtOpcUa.Client.Shared.Models;
+using ZB.MOM.WW.OtOpcUa.Core.Abstractions;
+using ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient;
+using ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.Browser;
+using ZB.MOM.WW.OtOpcUa.OpcUaServer;
+using WriteRequest = ZB.MOM.WW.OtOpcUa.Core.Abstractions.WriteRequest;
+using SharedSecurityMode = ZB.MOM.WW.OtOpcUa.Client.Shared.Models.SecurityMode;
+
+internal static partial class ProcessHost
+{
+    static object ServerCounts(OtOpcUaSdkServer server)
+    {
+        var sessions = server.CurrentInstance.SessionManager.GetSessions();
+        var subs = server.CurrentInstance.SubscriptionManager.GetSubscriptions();
+        return new { utc = DateTime.UtcNow, sessions = sessions.Count, subscriptions = subs.Count,
+            items = subs.Sum(s => s.MonitoredItemCount), serverProcess = Environment.ProcessId };
+    }
+}
+
+internal static class Lifecycle
+{
+    static string Root = "";
+    static string Password => Environment.GetEnvironmentVariable("OPCUA_MATRIX_PASSWORD") ?? throw new InvalidOperationException("Missing fixture credential");
+    static readonly JsonSerializerOptions Json = new() { WriteIndented = true };
+    static int managerChecks, sharedPasses, driverPasses, browserPasses;
+    static readonly List<WeakReference> Weak = [];
+    static void Require(bool pass, string message) { if (!pass) throw new InvalidOperationException(message); }
+    static object? FieldOrNull(object owner, string name)
+    {
+        var field = owner.GetType().GetField(name, BindingFlags.Instance | BindingFlags.NonPublic | BindingFlags.DeclaredOnly)
+            ?? throw new InvalidOperationException("Diagnostic layout changed: " + owner.GetType().FullName + "." + name);
+        return field.GetValue(owner);
+    }
+    static object Field(object owner, string name) => FieldOrNull(owner, name) ?? throw new InvalidOperationException("Diagnostic owner null: " + name);
+    static void Empty(object owner, string name) => Require(Field(owner, name) is ICollection items && items.Count == 0, "Retained collection: " + name);
+    static bool Disposed(object manager)
+    {
+        Require(manager.GetType().FullName == "Opc.Ua.CertificateManager", "Unexpected SDK certificate manager type");
+        Require(manager.GetType().Assembly.GetName().Version?.ToString() == "2.0.1.0", "Diagnostic requires SDK 2.0.1.0");
+        var field = manager.GetType().GetField("m_disposed", BindingFlags.NonPublic | BindingFlags.Instance | BindingFlags.DeclaredOnly);
+        Require(field?.FieldType == typeof(bool), "SDK 2.0.1 CertificateManager.m_disposed bool layout changed");
+        return (bool)field!.GetValue(manager)!;
+    }
+    static object SharedManager(OpcUaClientService shared) => Field(Field(shared, "_session"), "_certificateManager");
+    static object AppManager(object owner) => ((ApplicationInstance)Field(owner, "_ownedApplication")).ApplicationConfiguration!.CertificateManager;
+    static void CheckManager(object manager, bool disposed)
+    {
+        Require(Disposed(manager) == disposed, "Certificate manager disposal observation mismatch");
+        if (disposed) managerChecks++;
+    }
+    static ConnectionSettings Settings(string endpoint, string? password = null) => new()
+    {
+        EndpointUrl = endpoint, Username = "apikey", Password = password ?? Password,
+        SecurityMode = SharedSecurityMode.SignAndEncrypt, AutoAcceptCertificates = false,
+        CertificateStorePath = Path.Combine(Root, "data", "shared-pki"), SessionTimeoutSeconds = 30
+    };
+    static OpcUaClientDriverOptions Options(string endpoint) => new()
+    {
+        EndpointUrl = endpoint, SecurityPolicy = OpcUaSecurityPolicy.Basic256Sha256,
+        SecurityMode = OpcUaSecurityMode.SignAndEncrypt, AuthType = OpcUaAuthType.Username,
+        Username = "apikey", Password = Password, AutoAcceptCertificates = false,
+        SessionName = "ClientLifecycle", ApplicationUri = "urn:localhost:ClientLifecycle",
+        RawTags = [new("scalar", "{\"nodeId\":\"nsu=https://zb.com/otopcua/raw;s=Matrix/dev/Scalar\"}", true),
+                   new("vector", "{\"nodeId\":\"nsu=https://zb.com/otopcua/raw;s=Matrix/dev/Vector\"}", true)]
+    };
+    static async Task Wait(Func<bool> condition, CancellationToken ct)
+    {
+        while (!condition()) await Task.Delay(25, ct);
+    }
+    static object? Clr(DataValue value) => ZB.MOM.WW.OtOpcUa.Client.Shared.Helpers.ValueConverter.ToClrObject(value.WrappedValue);
+    static async Task Prepare()
+    {
+        // Public connection failures create and release the same production applications as a live attempt.
+        // No production private method is invoked and no SDK state is written by diagnostics.
+        using var ct = new CancellationTokenSource(TimeSpan.FromSeconds(15));
+        using (var shared = new OpcUaClientService())
+        { try { await shared.ConnectAsync(Settings("opc.tcp://127.0.0.1:1"), ct.Token); } catch { } }
+        await using (var driver = new OpcUaClientDriver(Options("opc.tcp://127.0.0.1:1"), "lifecycle"))
+        { try { await driver.InitializeAsync("{}", ct.Token); } catch { } }
+        var browser = new OpcUaClientDriverBrowser();
+        try { await using var session = await browser.OpenAsync(JsonSerializer.Serialize(Options("opc.tcp://127.0.0.1:1")), ct.Token); } catch { }
+        foreach (var folder in new[] { "data/shared-pki", "data/OtOpcUa/pki", "data/OtOpcUa/adminui-browse-pki" })
+            Require(Directory.GetFiles(Path.Combine(Root, folder, "own", "certs")).Length == 1, "Expected one reusable application DER certificate: " + folder);
+    }
+    static async Task Cycle(string endpoint, int cycle)
+    {
+        using var budget = new CancellationTokenSource(TimeSpan.FromSeconds(30));
+        var ct = budget.Token;
+        using var shared = new OpcUaClientService(); Weak.Add(new(shared));
+        await using var driver = new OpcUaClientDriver(Options(endpoint), "lifecycle"); Weak.Add(new(driver));
+        var browser = new OpcUaClientDriverBrowser(); Weak.Add(new(browser));
+        // Two connections on the same Shared service and two initializations on the same driver.
+        for (var pass = 0; pass < 2; pass++)
+        {
+            var seen = new ConcurrentQueue<int>();
+            EventHandler<DataChangedEventArgs> handler = (_, e) => { if (Clr(e.Value) is int n) seen.Enqueue(n); };
+            shared.DataChanged += handler;
+            var info = await shared.ConnectAsync(Settings(endpoint), ct);
+            Require(info.SecurityMode == "SignAndEncrypt" && info.SecurityPolicyUri == SecurityPolicies.Basic256Sha256, "Shared policy downgrade");
+            object? manager = SharedManager(shared); CheckManager(manager, false);
+            var nss = (string[])Clr(await shared.ReadValueAsync(VariableIds.Server_NamespaceArray, ct))!;
+            var ns = (ushort)Array.IndexOf(nss, "https://zb.com/otopcua/raw"); Require(ns > 0, "Raw namespace missing");
+            var scalar = new NodeId("Matrix/dev/Scalar", ns); var vector = new NodeId("Matrix/dev/Vector", ns);
+            await shared.SubscribeAsync(scalar, 100, ct); await shared.SubscribeAsync(vector, 100, ct);
+            var target = cycle * 10 + pass;
+            Require(StatusCode.IsGood(await shared.WriteValueAsync(scalar, target, ct)), "Shared scalar write failed");
+            Require(StatusCode.IsGood(await shared.WriteValueAsync(vector, new[] { target, 2, 3 }, ct)), "Shared vector write failed");
+            await Wait(() => seen.Contains(target), ct);
+            Require(Equals(Clr(await shared.ReadValueAsync(scalar, ct)), target), "Shared scalar roundtrip mismatch");
+            Require(((int[])Clr(await shared.ReadValueAsync(vector, ct))!).SequenceEqual(new[] { target, 2, 3 }), "Shared vector mismatch");
+            Require((await shared.BrowseAsync(new NodeId("Matrix/dev", ns), ct)).Count > 0, "Shared browse empty");
+            await shared.UnsubscribeAsync(scalar, ct); await shared.UnsubscribeAsync(vector, ct);
+            await shared.DisconnectAsync(ct);
+            Require(!shared.IsConnected && shared.CurrentConnectionInfo is null, "Shared public connection state retained");
+            Require(FieldOrNull(shared, "_session") is null, "Shared session retained"); Empty(shared, "_activeDataSubscriptions");
+            CheckManager(manager, true); manager = null; shared.DataChanged -= handler; sharedPasses++;
+
+            if (pass == 0) await driver.InitializeAsync("{}", ct);
+            else await driver.ReinitializeAsync("{}", ct);
+            Require(driver.GetHealth().State == DriverState.Healthy, "Driver initialize health");
+            manager = AppManager(driver); CheckManager(manager, false);
+            var values = new ConcurrentQueue<int>();
+            EventHandler<DataChangeEventArgs> driverHandler = (_, e) => { if (e.Snapshot.Value is int n) values.Enqueue(n); };
+            driver.OnDataChange += driverHandler;
+            var sub = await driver.SubscribeAsync(["scalar", "vector"], TimeSpan.FromMilliseconds(100), ct);
+            target++;
+            var writes = await driver.WriteAsync([new WriteRequest("scalar", target), new WriteRequest("vector", new[] { target, 4, 5 })], ct);
+            Require(writes.Count == 2 && writes.All(w => w.StatusCode == 0), "Driver write failed");
+            await Wait(() => values.Contains(target), ct);
+            var reads = await driver.ReadAsync(["scalar", "vector"], ct);
+            Require(reads.Count == 2 && reads.All(r => r.StatusCode == 0) && Equals(reads[0].Value, target)
+                && ((int[])reads[1].Value!).SequenceEqual(new[] { target, 4, 5 }), "Driver roundtrip mismatch");
+            await driver.UnsubscribeAsync(sub, ct); sub = null!;
+            // Reinitialize a live connection with an active replacement subscription, as the watchdog does.
+            sub = await driver.SubscribeAsync(["scalar", "vector"], TimeSpan.FromMilliseconds(100), ct);
+            await driver.ReinitializeAsync("{}", ct); sub = null!;
+            CheckManager(manager, true); manager = null;
+            manager = AppManager(driver); CheckManager(manager, false);
+            Require(driver.GetHealth().State == DriverState.Healthy, "Live reinitialize failed");
+            var reinitialized = await driver.ReadAsync(["scalar"], ct);
+            Require(reinitialized.Count == 1 && reinitialized[0].StatusCode == 0 && Equals(reinitialized[0].Value, target), "Live reinitialize read failed");
+            await driver.ShutdownAsync(ct); driver.OnDataChange -= driverHandler;
+            Require(driver.GetHealth().State == DriverState.Unknown, "Driver shutdown public state retained");
+            Require(FieldOrNull(driver, "<Session>k__BackingField") is null, "Driver session retained");
+            Empty(driver, "_subscriptions"); Empty(driver, "_alarmSubscriptions");
+            CheckManager(manager, true); manager = null; driverPasses++;
+
+            var browse = await browser.OpenAsync(JsonSerializer.Serialize(Options(endpoint)), ct); Weak.Add(new(browse));
+            manager = AppManager(browse); CheckManager(manager, false);
+            Require((await browse.RootAsync(ct)).Count > 0, "Browser root empty");
+            await browse.DisposeAsync().AsTask().WaitAsync(ct); CheckManager(manager, true); manager = null; browserPasses++;
+        }
+    }
+    static object Resources(int cycle, double elapsed)
+    {
+        GC.Collect(); GC.WaitForPendingFinalizers(); GC.Collect();
+        var survivors = Weak.Count(w => w.IsAlive); Weak.RemoveAll(w => !w.IsAlive);
+        Require(survivors == 0, "Disposed production client/driver/browser object retained after full GC");
+        var fd = Directory.GetFiles("/proc/self/fd");
+        var owned = 0; var pki = 0;
+        foreach (var path in fd)
+        {
+            var target = new FileInfo(path).LinkTarget;
+            if (target is null || !Path.IsPathFullyQualified(target)) continue;
+            target = Path.GetFullPath(target);
+            if (target.StartsWith(Path.GetFullPath(Root) + Path.DirectorySeparatorChar, StringComparison.Ordinal)) owned++;
+            if (target.StartsWith(Path.Combine(Path.GetFullPath(Root), "data") + Path.DirectorySeparatorChar, StringComparison.Ordinal)) pki++;
+        }
+        using var p = Process.GetCurrentProcess();
+        return new { cycle, elapsedSeconds = elapsed, utc = DateTime.UtcNow, p.WorkingSet64, p.PrivateMemorySize64,
+            managedBytes = GC.GetTotalMemory(false), allocatedBytes = GC.GetTotalAllocatedBytes(),
+            gc = new[] { GC.CollectionCount(0), GC.CollectionCount(1), GC.CollectionCount(2) },
+            fdCount = fd.Length, ownedRootFdCount = owned, ownedPkiFdCount = pki, survivingProductionObjects = survivors,
+            managerDisposalsVerified = managerChecks, sharedPasses, driverPasses, browserPasses };
+    }
+    static async Task Run(string endpoint, int seconds, bool full)
+    {
+        Require(!full || seconds >= 7200, "Full soak requires >=7200 requested seconds");
+        // Deliberate owned-manager positive control proves the exact-tag read-only diagnostic sees both states.
+        var control = CertificateManagerFactory.Create(new SecurityConfiguration(), DefaultTelemetry.Create(_ => { }));
+        Require(!Disposed(control), "Disposal diagnostic control false-state failure");
+        await control.DisposeAsync(); Require(Disposed(control), "Disposal diagnostic control true-state failure");
+        control = null!;
+        var originalCerts = CertificateHashes();
+        var elapsed = Stopwatch.StartNew(); var cycle = 0;
+        File.AppendAllText(Path.Combine(Root, "resources.jsonl"), JsonSerializer.Serialize(Resources(0, 0)) + "\n");
+        while (elapsed.Elapsed.TotalSeconds < seconds)
+        {
+            await Cycle(endpoint, ++cycle).WaitAsync(TimeSpan.FromSeconds(65));
+            // The async cycle has returned, dropping its strong manager/session/item/event references.
+            await Task.Delay(300);
+            var serverPath = Path.Combine(Root, "server", "live-resources.json");
+            var settledOk = false;
+            for (var attempt = 0; attempt < 30; attempt++)
+            {
+                using var settled = JsonDocument.Parse(await File.ReadAllTextAsync(serverPath));
+                settledOk = new[] { "sessions", "subscriptions", "items" }.All(name => settled.RootElement.GetProperty(name).GetInt32() == 0);
+                if (settledOk) break;
+                await Task.Delay(100);
+            }
+            Require(settledOk, "Server sessions/subscriptions/items retained after bounded settling");
+            if (cycle % 10 == 0 || elapsed.Elapsed.TotalSeconds >= seconds)
+                File.AppendAllText(Path.Combine(Root, "resources.jsonl"), JsonSerializer.Serialize(Resources(cycle, elapsed.Elapsed.TotalSeconds)) + "\n");
+        }
+        Require(elapsed.Elapsed.TotalSeconds >= seconds && (!full || elapsed.Elapsed.TotalSeconds >= 7200), "Real elapsed duration gate failed");
+        Require(managerChecks == cycle * 8 && sharedPasses == cycle * 2 && driverPasses == cycle * 2 && browserPasses == cycle * 2, "Incomplete lifecycle accounting");
+        Require(CertificateHashes().SequenceEqual(originalCerts), "Application certificate unexpectedly rotated or PKI changed");
+        var summary = new { status = "passed", diagnosticPositiveControl = "exact SDK2 manager false-before/true-after DisposeAsync", applicationCertificateHashes = originalCerts, requestedSeconds = seconds, elapsedSeconds = elapsed.Elapsed.TotalSeconds,
+            fullTwoHourLifecycle = full && elapsed.Elapsed.TotalSeconds >= 7200, cycles = cycle, sharedPasses, driverPasses, browserPasses,
+            managerDisposalsVerified = managerChecks, finalResources = Resources(cycle, elapsed.Elapsed.TotalSeconds),
+            scope = "Production Shared connect/disconnect/reconnect; production driver Initialize/Reinitialize/Shutdown/dispose; production browser open/browse/dispose; scalar and Int32[3] read/write/subscribe/unsubscribe; strict mutual trusted DER/Basic256Sha256 SignAndEncrypt/API-key fixture. No network stalls, revocation, surgical edits/rebuild, CP abandonment or Windows/AVEVA/performance G4 claim." };
+        File.WriteAllText(Path.Combine(Root, "summary.json"), JsonSerializer.Serialize(summary, Json));
+    }
+    static string[] CertificateHashes() => Directory.GetFiles(Path.Combine(Root, "data"), "*.der", SearchOption.AllDirectories)
+        .Where(p => p.Contains(Path.DirectorySeparatorChar + "own" + Path.DirectorySeparatorChar + "certs" + Path.DirectorySeparatorChar, StringComparison.Ordinal))
+        .Order().Select(p => Path.GetRelativePath(Root, p) + ":" + Convert.ToHexString(SHA256.HashData(File.ReadAllBytes(p))).ToLowerInvariant()).ToArray();
+    public static async Task<int> Main(string[] args)
+    {
+        if (args[0] == "server") return await ProcessHost.HelperMain(args);
+        Root = Path.GetFullPath(args[1]); Directory.CreateDirectory(Root);
+        try
+        {
+            var local = Path.GetFullPath(Environment.GetFolderPath(Environment.SpecialFolder.LocalApplicationData));
+            Require(local == Path.Combine(Root, "data"), "XDG task PKI isolation failed");
+            if (args[0] == "prepare") { await Prepare(); return 0; }
+            Require(args[0] == "run", "Unknown mode");
+            await Run(args[2], int.Parse(args[3]), args[4] == "full");
+            var sdk = AppDomain.CurrentDomain.GetAssemblies().Where(a => a.GetName().Name!.StartsWith("Opc.Ua", StringComparison.Ordinal))
+                .Select(a => new { name = a.GetName().Name, version = a.GetName().Version?.ToString(), sha256 = Convert.ToHexString(SHA256.HashData(File.ReadAllBytes(a.Location))).ToLowerInvariant() });
+            File.WriteAllText(Path.Combine(Root, "sdk-assemblies.json"), JsonSerializer.Serialize(sdk, Json));
+            return 0;
+        }
+        catch (Exception error)
+        {
+            File.WriteAllText(Path.Combine(Root, "failure.txt"), error.ToString().Replace(Password, "<fixture-secret>"));
+            return 1;
+        }
+    }
+}

scripts/validation/opcua-client-lifecycle/Lifecycle.csproj

@@ -0,0 +1,9 @@
+<Project Sdk="Microsoft.NET.Sdk">
+<PropertyGroup><OutputType>Exe</OutputType><StartupObject>Lifecycle</StartupObject><DefineConstants>SDK2</DefineConstants></PropertyGroup>
+<ItemGroup>
+<FrameworkReference Include="Microsoft.AspNetCore.App" />
+<ProjectReference Include="../../../src/Server/ZB.MOM.WW.OtOpcUa.Host/ZB.MOM.WW.OtOpcUa.Host.csproj" />
+<ProjectReference Include="../../../src/Client/ZB.MOM.WW.OtOpcUa.Client.Shared/ZB.MOM.WW.OtOpcUa.Client.Shared.csproj" />
+<ProjectReference Include="../../../src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.csproj" />
+<ProjectReference Include="../../../src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.Browser/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.Browser.csproj" />
+</ItemGroup></Project>

scripts/validation/opcua-client-lifecycle/ProcessHost.cs

@@ -0,0 +1,360 @@
+// Copy of compatibility ProcessHost at 7b353d7b; lifecycle-owned changes only.
+#pragma warning disable OTOPCUA0001 // This wire harness deliberately exercises public driver capabilities directly.
+using System.Collections.Concurrent;
+using System.Net;
+using System.Net.Sockets;
+using System.Reflection;
+using System.Text.Json;
+using Microsoft.Extensions.Logging.Abstractions;
+using Opc.Ua;
+using Opc.Ua.Client;
+using ZB.MOM.WW.OtOpcUa.Client.Shared;
+using ZB.MOM.WW.OtOpcUa.Client.Shared.Models;
+using ZB.MOM.WW.OtOpcUa.Commons.OpcUa;
+using ZB.MOM.WW.OtOpcUa.Configuration.Entities;
+using ZB.MOM.WW.OtOpcUa.Configuration.Enums;
+using ZB.MOM.WW.OtOpcUa.Core.Abstractions;
+using ZB.MOM.WW.OtOpcUa.Core.Authorization;
+using ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient;
+using ZB.MOM.WW.OtOpcUa.OpcUaServer;
+using ZB.MOM.WW.OtOpcUa.OpcUaServer.Security;
+using AlarmEventArgs = ZB.MOM.WW.OtOpcUa.Client.Shared.Models.AlarmEventArgs;
+using WriteRequest = ZB.MOM.WW.OtOpcUa.Core.Abstractions.WriteRequest;
+using SharedSecurityMode = ZB.MOM.WW.OtOpcUa.Client.Shared.Models.SecurityMode;
+using CoreHistory = ZB.MOM.WW.OtOpcUa.Core.Abstractions.HistoryReadResult;
+
+internal static partial class ProcessHost
+{
+    static readonly DateTime Epoch = new(2026, 10, 1, 0, 0, 0, DateTimeKind.Utc);
+    const string RawUri = "https://zb.com/otopcua/raw", UnsUri = "https://zb.com/otopcua/uns";
+    const string Folder = "Matrix/dev", Scalar = Folder + "/Scalar", Vector = Folder + "/Vector", Alarm = Folder + "/Alarm";
+    static readonly CancellationToken Ct = new CancellationTokenSource(TimeSpan.FromSeconds(int.Parse(Environment.GetEnvironmentVariable("OPCUA_LIFECYCLE_SERVER_SECONDS") ?? "240"))).Token;
+    static string Password => Environment.GetEnvironmentVariable("OPCUA_MATRIX_PASSWORD") ?? throw new InvalidOperationException("Missing ephemeral credential");
+    static readonly List<object> Cases = [];
+    static readonly List<object> Observations = [];
+    static int Failures;
+    static string Root = "";
+    static object? Clr(DataValue v)
+    {
+#if SDK2
+        return ZB.MOM.WW.OtOpcUa.Client.Shared.Helpers.ValueConverter.ToClrObject(v.WrappedValue);
+#else
+        return v.Value;
+#endif
+    }
+    static DateTime SourceTime(DataValue value)
+    {
+#if SDK2
+        return value.SourceTimestamp.ToDateTime();
+#else
+        return value.SourceTimestamp;
+#endif
+    }
+    static DateTime ServerTime(DataValue value)
+    {
+#if SDK2
+        return value.ServerTimestamp.ToDateTime();
+#else
+        return value.ServerTimestamp;
+#endif
+    }
+    static void Require(bool yes, string message) { if (!yes) throw new InvalidOperationException(message); }
+    static async Task Case(string name, Func<Task> action)
+    {
+        try { await action(); Cases.Add(new { name, status = "passed" }); }
+        catch (Exception e) { Failures++; Cases.Add(new { name, status = "failed", error = e.ToString() }); }
+    }
+    static async Task Wait(Func<bool> predicate)
+    {
+        for (int i = 0; i < 200; i++) { if (predicate()) return; await Task.Delay(50, Ct); }
+        Require(false, "Notification deadline exceeded");
+    }
+    static ConnectionSettings Settings(string endpoint) => new()
+    {
+        EndpointUrl = endpoint,
+        Username = "apikey",
+        Password = Password,
+        SecurityMode = SharedSecurityMode.SignAndEncrypt,
+        AutoAcceptCertificates = false,
+        CertificateStorePath = Environment.GetEnvironmentVariable("OPCUA_MATRIX_CLIENT_PKI") ?? Path.Combine(Root, "client-pki")
+    };
+    public static async Task<int> HelperMain(string[] args)
+    {
+        Root = Path.GetFullPath(args[1]); Directory.CreateDirectory(Root);
+        try
+        {
+            switch (args[0])
+            {
+                case "local-data-path": Console.WriteLine(Environment.GetFolderPath(Environment.SpecialFolder.LocalApplicationData)); return 0;
+                case "driver": await Driver(args[2]); break;
+                case "server": await Serve(); return 0;
+                case "client": await Client(args[2]); break;
+                case "performance": await Performance(args[2]); break;
+                default: throw new ArgumentException("Expected prepare/server/client");
+            }
+        }
+        catch (Exception e) { Failures++; Cases.Add(new { name = "process", status = "failed", error = e.ToString() }); }
+        File.WriteAllText(Path.Combine(Root, "result.json"), JsonSerializer.Serialize(new { sdk = typeof(NodeId).Assembly.GetName().Version?.ToString(), process = Environment.ProcessId, cases = Cases, observations = Observations, failures = Failures, loadedSdkAssemblies = AppDomain.CurrentDomain.GetAssemblies().Where(a => a.GetName().Name!.StartsWith("Opc.Ua", StringComparison.Ordinal)).Select(a => new { name = a.GetName().Name, version = a.GetName().Version?.ToString(), path = a.Location }) }, new JsonSerializerOptions { WriteIndented = true }));
+        return Failures == 0 ? 0 : 1;
+    }
+    static async Task Serve()
+    {
+        var options = new OpcUaApplicationHostOptions
+        {
+            ApplicationName = "OtOpcUa.Matrix",
+            ApplicationUri = "urn:OtOpcUa.Matrix.ClientLifecycle",
+            PublicHostname = "127.0.0.1",
+            PkiStoreRoot = Path.Combine(Root, "server-pki"),
+            AllowAnonymous = false,
+            AutoAcceptUntrustedClientCertificates = false,
+            EnabledSecurityProfiles = Environment.GetEnvironmentVariable("OPCUA_MATRIX_SERVER_SECURITY") == "none"
+                ? [OpcUaSecurityProfile.None] : [OpcUaSecurityProfile.Basic256Sha256SignAndEncrypt]
+        };
+        using (var listener = new TcpListener(IPAddress.Loopback, 0)) { listener.Start(); options.OpcUaPort = ((IPEndPoint)listener.LocalEndpoint).Port; }
+        var server = new OtOpcUaSdkServer();
+        await using var host = new OpcUaApplicationHost(options, NullLogger<OpcUaApplicationHost>.Instance, new Auth());
+        await host.StartAsync(server, Ct);
+        var nm = server.NodeManager!; var sink = new SdkAddressSpaceSink(nm);
+        var authority = new DataPlaneAuthorityState();
+        authority.Apply("matrix", "rev1", [new ApiKey { ApiKeyId = "matrix", Name = "matrix", SecretHash = "fixture", Principal = "matrix", Enabled = true, CreatedUtc = DateTime.UtcNow.AddDays(-1) }],
+            [new NodeAcl { NodeAclId = "all", ClusterId = "matrix", Principal = "matrix", ScopeKind = NodeAclScopeKind.Cluster, PermissionFlags = (NodePermissions)int.MaxValue }], new Dictionary<AclScopeRef, IReadOnlyList<NodeAclPath>>());
+        nm.DataPlaneAuthority = authority;
+        nm.Authorizer = new DataPlaneAuthorizer(authority, new TriePermissionEvaluator(authority.Tries), true, NullLogger.Instance, TimeProvider.System);
+        var history = new Source(Root); nm.HistorianDataSource = history;
+        sink.EnsureFolder(Folder, null, "dev", AddressSpaceRealm.Raw);
+        sink.EnsureFolder("Eq", null, "Eq", AddressSpaceRealm.Uns);
+        foreach (var realm in new[] { AddressSpaceRealm.Raw, AddressSpaceRealm.Uns })
+        {
+            var scalar = realm == AddressSpaceRealm.Raw ? Scalar : "Eq/Scalar";
+            var vector = realm == AddressSpaceRealm.Raw ? Vector : "Eq/Vector";
+            var parent = realm == AddressSpaceRealm.Raw ? Folder : "Eq";
+            sink.EnsureVariable(scalar, parent, "Scalar", "Int32", true, realm, "matrix.scalar");
+            sink.EnsureVariable(vector, parent, "Vector", "Int32", true, realm, isArray: true, arrayLength: 3);
+            sink.WriteValue(scalar, 17, 0, Epoch, realm); sink.WriteValue(vector, new[] { 1, 2, 3 }, 0, Epoch, realm);
+        }
+        sink.AddReference("Eq/Scalar", AddressSpaceRealm.Uns, Scalar, AddressSpaceRealm.Raw);
+        sink.MaterialiseAlarmCondition(Alarm, Folder, "Alarm", "OffNormalAlarm", 800, AddressSpaceRealm.Raw, isNative: true);
+        sink.WireAlarmNotifiers(Alarm, AddressSpaceRealm.Raw, ["Eq"], AddressSpaceRealm.Uns);
+        sink.EnsureVariable(Folder + "/UnsetTimestamp", Folder, "UnsetTimestamp", "Int32", false, AddressSpaceRealm.Raw);
+        sink.WriteValue(Folder + "/UnsetTimestamp", 3, 0, DateTime.MinValue, AddressSpaceRealm.Raw);
+        nm.NodeWriteGateway = new Gateway();
+        var state = new AlarmConditionSnapshot(true, false, true, true, AlarmShelvingKind.Unshelved, 800, "matrix-alarm");
+        nm.NativeAlarmAckRouter = _ => Task.Run(() => { state = state with { Acknowledged = true }; sink.WriteAlarmCondition(Alarm, state, DateTime.UtcNow, AddressSpaceRealm.Raw); });
+        File.WriteAllText(Path.Combine(Root, "endpoint.txt"), $"opc.tcp://127.0.0.1:{options.OpcUaPort}/OtOpcUa");
+        File.WriteAllText(Path.Combine(Root, "ready.json"), JsonSerializer.Serialize(new { endpoint = $"opc.tcp://127.0.0.1:{options.OpcUaPort}/OtOpcUa", process = Environment.ProcessId, sdk = typeof(NodeId).Assembly.GetName().Version?.ToString(), rawUri = RawUri, unsUri = UnsUri }));
+        int tick = 0;
+        while (!File.Exists(Path.Combine(Root, "stop")))
+        {
+            sink.WriteAlarmCondition(Alarm, state with { Message = ++tick % 2 == 0 ? "matrix-alarm" : "matrix-tick" }, DateTime.UtcNow, AddressSpaceRealm.Raw);
+            var counts = ServerCounts(server);
+            File.WriteAllText(Path.Combine(Root, "live-resources.tmp"), JsonSerializer.Serialize(counts));
+            File.Move(Path.Combine(Root, "live-resources.tmp"), Path.Combine(Root, "live-resources.json"), true);
+            await Task.Delay(250, Ct);
+        }
+        using var process = System.Diagnostics.Process.GetCurrentProcess();
+        File.WriteAllText(Path.Combine(Root, "server-resources.json"), JsonSerializer.Serialize(new { process.WorkingSet64, process.PrivateMemorySize64, process.HandleCount, threads=process.Threads.Count, cpuMilliseconds=process.TotalProcessorTime.TotalMilliseconds, allocatedBytes=GC.GetTotalAllocatedBytes(), collections=new[]{GC.CollectionCount(0),GC.CollectionCount(1),GC.CollectionCount(2)} }, new JsonSerializerOptions {WriteIndented=true}));
+    }
+    static async Task Client(string endpoint)
+    {
+        using var client = new OpcUaClientService();
+        await Case("trusted-SignAndEncrypt-API-key", async () => { var info = await client.ConnectAsync(Settings(endpoint), Ct); Require(info.SecurityMode == "SignAndEncrypt" && info.SecurityPolicyUri == SecurityPolicies.Basic256Sha256, "Unexpected negotiated policy"); Observations.Add(new { info.SecurityMode, info.SecurityPolicyUri }); });
+        if (!client.IsConnected) return;
+        var namespaces = (string[])Clr(await client.ReadValueAsync(VariableIds.Server_NamespaceArray, Ct))!;
+        var raw = (ushort)Array.IndexOf(namespaces, RawUri); var uns = (ushort)Array.IndexOf(namespaces, UnsUri);
+        NodeId ScalarId(ushort ns) => new(ns == raw ? Scalar : "Eq/Scalar", ns);
+        NodeId VectorId(ushort ns) => new(ns == raw ? Vector : "Eq/Vector", ns);
+        await Case("raw-UNS-URI-browse", async () =>
+        {
+            Require(raw > 0 && uns > 0, "Missing namespace URI");
+            var rawChildren = await client.BrowseAsync(new NodeId(Folder, raw), Ct);
+            var unsChildren = await client.BrowseAsync(new NodeId("Eq", uns), Ct);
+            Observations.Add(new { rawChildren, unsChildren });
+            // Supplement the production Shared results with unfiltered wire-reference metadata.
+            var adapter = typeof(OpcUaClientService).GetField("_session", BindingFlags.Instance | BindingFlags.NonPublic)!.GetValue(client)!;
+            var sdkSession = (Opc.Ua.Client.Session)adapter.GetType().GetField("_session", BindingFlags.Instance | BindingFlags.NonPublic)!.GetValue(adapter)!;
+            var (_, _, rawReferences) = await sdkSession.BrowseAsync(null, null, new NodeId(Folder, raw), 0u,
+                BrowseDirection.Forward, ReferenceTypeIds.References, true, 0u);
+            Observations.Add(new { rawReferences = (rawReferences.ToArray() ?? []).Select(reference => new { nodeId = reference.NodeId.ToString(), browseName = reference.BrowseName.ToString(), nodeClass = reference.NodeClass.ToString(), typeDefinition = reference.TypeDefinition.ToString(), referenceType = reference.ReferenceTypeId.ToString(), reference.IsForward }).ToArray() });
+            var expectedRaw = new[] { Scalar, Vector, Alarm, Folder + "/UnsetTimestamp" }.Select(id => new NodeId(id, raw).ToString());
+            Require(expectedRaw.All(id => rawChildren.Any(child => child.NodeId == id)), "Missing raw children: " + string.Join(",", expectedRaw.Where(id => !rawChildren.Any(child => child.NodeId == id))));
+            Require(new[] { "Eq/Scalar", "Eq/Vector" }.Select(id => new NodeId(id, uns).ToString()).All(id => unsChildren.Any(child => child.NodeId == id)), "Missing UNS scalar/array children");
+        });
+        await Case("initial-quality-explicit-source-and-server-timestamps", async () => { var initial = await client.ReadValueAsync(ScalarId(raw), Ct); Require(StatusCode.IsGood(initial.StatusCode), "Bad initial quality"); Require(SourceTime(initial) == Epoch && ServerTime(initial) > Epoch, "Lost explicit initial timestamps"); Observations.Add(new { sourceTimestamp = SourceTime(initial).ToString("O"), serverTimestamp = ServerTime(initial).ToString("O"), contract = "Source supplied as 2026-10-01T00:00:00Z; server timestamp observed without normalization or historian algorithm changes" }); });
+        foreach (var ns in new[] { raw, uns })
+        {
+            await Case($"scalar-read-write-ns-{ns}", async () => { Require(Clr(await client.ReadValueAsync(ScalarId(ns), Ct)) is int, "Scalar lost Int32 type"); Require(StatusCode.IsGood(await client.WriteValueAsync(ScalarId(ns), 42, Ct)), "Scalar write failed"); Require((int)Clr(await client.ReadValueAsync(ScalarId(ns), Ct))! == 42, "Scalar round trip failed"); });
+            await Case($"typed-array-read-write-ns-{ns}", async () => { Require(Clr(await client.ReadValueAsync(VectorId(ns), Ct)) is int[], "Array lost Int32[] type"); Require(StatusCode.IsGood(await client.WriteValueAsync(VectorId(ns), new[] { 7, 8, 9 }, Ct)), "Array write failed"); Require(((int[])Clr(await client.ReadValueAsync(VectorId(ns), Ct))!).SequenceEqual(new[] { 7, 8, 9 }), "Array round trip failed"); });
+        }
+        await Case("monitor-quality-timestamps", async () => { var seen = new ConcurrentQueue<DataValue>(); client.DataChanged += (_, e) => seen.Enqueue(e.Value); await client.SubscribeAsync(ScalarId(raw), 100, Ct); await client.WriteValueAsync(ScalarId(raw), 73, Ct); await Wait(() => seen.Any(v => Equals(Clr(v), 73))); var v = seen.Last(v => Equals(Clr(v), 73)); Require(StatusCode.IsGood(v.StatusCode) && SourceTime(v) > Epoch && ServerTime(v) > Epoch, "Bad monitor quality or missing timestamps"); Observations.Add(new { sourceTimestamp = SourceTime(v).ToString("O"), serverTimestamp = ServerTime(v).ToString("O"), status = v.StatusCode.ToString() }); await client.UnsubscribeAsync(ScalarId(raw), Ct); });
+        await Case("event-filter-and-native-ack", async () => { var alarms = new ConcurrentQueue<AlarmEventArgs>(); client.AlarmEvent += (_, a) => alarms.Enqueue(a); await client.SubscribeAlarmsAsync(ObjectIds.Server, 100, Ct); await Wait(() => alarms.Any(a => a.Message == "matrix-alarm" && a.ActiveState && a.Severity == 800)); var alarm = alarms.Last(a => a.Message == "matrix-alarm"); Require(alarm.EventId?.Length > 0, "Missing event ID"); Require(StatusCode.IsGood(await client.AcknowledgeAlarmAsync(new NodeId(Alarm, raw).ToString(), alarm.EventId!, "matrix-ack", Ct)), "Ack refused"); await Wait(() => alarms.Any(a => a.Message == "matrix-alarm" && a.AckedState)); await client.UnsubscribeAlarmsAsync(Ct); });
+        await Case("raw-history-CP-paging", async () => { var values = await client.HistoryReadRawAsync(ScalarId(raw), Epoch, Epoch.AddMinutes(1), 100, Ct); Require(values.Count == 25, "Expected 25 raw samples, got " + values.Count); Require(values.Select(v => Convert.ToInt32(Clr(v))).SequenceEqual(Enumerable.Range(0, 25)), "Raw page loss/duplicates/order"); });
+        await Case("event-history-CP-paging", async () =>
+        {
+            var filter = new EventFilter();
+#if SDK2
+            filter.SelectClauses += new SimpleAttributeOperand(ObjectTypeIds.BaseEventType, new QualifiedName("EventId")) { AttributeId = Attributes.Value };
+#else
+            filter.SelectClauses.Add(new SimpleAttributeOperand {TypeDefinitionId=ObjectTypeIds.BaseEventType,BrowsePath=new QualifiedNameCollection {new QualifiedName("EventId")},AttributeId=Attributes.Value});
+#endif
+            var events = await client.HistoryReadEventsAsync(new NodeId(Folder, raw), Epoch, Epoch.AddMinutes(1), filter, 100, Ct); Require(events.Count == 25, "Expected 25 event samples, got " + events.Count);
+#if SDK2
+            var ids = events.Select(e => System.Text.Encoding.UTF8.GetString((byte[])ZB.MOM.WW.OtOpcUa.Client.Shared.Helpers.ValueConverter.ToClrObject(e.Fields[0])!));
+#else
+            var ids=events.Select(e=>System.Text.Encoding.UTF8.GetString((byte[])e.Fields[0].Value));
+#endif
+            Require(ids.SequenceEqual(Enumerable.Range(0, 25).Select(i => $"e{i:00}")), "Event history loss/duplicates/order across timestamp ties");
+        });
+        await Case("event-history-where-filter-positive-and-negative", async () =>
+        {
+            foreach (var type in new[] { ObjectTypeIds.BaseEventType, ObjectTypeIds.AuditEventType })
+            {
+                var filter = new EventFilter();
+#if SDK2
+                filter.SelectClauses += new SimpleAttributeOperand(ObjectTypeIds.BaseEventType, new QualifiedName("EventId")) { AttributeId = Attributes.Value };
+                filter.WhereClause.Push(FilterOperator.OfType, Variant.From(type));
+#else
+                filter.SelectClauses.Add(new SimpleAttributeOperand(ObjectTypeIds.BaseEventType,new QualifiedName("EventId")){AttributeId=Attributes.Value});
+                filter.WhereClause.Push(FilterOperator.OfType,new LiteralOperand(new Variant(type)));
+#endif
+                var events = await client.HistoryReadEventsAsync(new NodeId(Folder, raw), Epoch, Epoch.AddMinutes(1), filter, 100, Ct);
+                Require(events.Count == (type == ObjectTypeIds.BaseEventType ? 25 : 0), $"Where filter for {type} expected {(type == ObjectTypeIds.BaseEventType ? 25 : 0)} got {events.Count}");
+            }
+        });
+        var unset = await client.ReadValueAsync(new NodeId(Folder + "/UnsetTimestamp", raw), Ct);
+        Observations.Add(new { sourceTimestamp = SourceTime(unset).ToString("O"), serverTimestamp = ServerTime(unset).ToString("O"), timestampObservation = "Fixture source supplied DateTime.MinValue (unset). These are unmodified application/SDK wire observations; no historian algorithm or expected timestamp was changed." });
+        await Benchmark(client, ScalarId(raw), VectorId(raw));
+        await client.DisconnectAsync(Ct);
+    }
+    static OpcUaClientDriverOptions DriverOptions(string endpoint) => new()
+    {
+        EndpointUrl = endpoint,
+        SecurityPolicy = OpcUaSecurityPolicy.Basic256Sha256,
+        SecurityMode = OpcUaSecurityMode.SignAndEncrypt,
+        AuthType = OpcUaAuthType.Username,
+        Username = "apikey",
+        Password = Password,
+        AutoAcceptCertificates = false,
+        RawTags = [new("scalar",JsonSerializer.Serialize(new {nodeId=$"nsu={RawUri};s={Scalar}"}),true),
+            new("vector",JsonSerializer.Serialize(new {nodeId=$"nsu={RawUri};s={Vector}"}),true),
+            new("uns",JsonSerializer.Serialize(new {nodeId=$"nsu={UnsUri};s=Eq/Scalar"}),true)],
+        SessionName = "MatrixDriver",
+        ApplicationUri = "urn:localhost:MatrixDriver"
+    };
+    static string IsolatedLocalData()
+    {
+        var local = Path.GetFullPath(Environment.GetFolderPath(Environment.SpecialFolder.LocalApplicationData));
+        Require(local.StartsWith(Path.GetFullPath(Root) + Path.DirectorySeparatorChar, StringComparison.Ordinal), "Driver/CLI canonical PKI must be in task-owned root: " + local);
+        return local;
+    }
+    static async Task Driver(string endpoint)
+    {
+        IsolatedLocalData();
+        await using var driver = new OpcUaClientDriver(DriverOptions(endpoint), "matrix");
+        await Case("driver-trusted-encrypted-API-key-connect", () => driver.InitializeAsync("{}", Ct));
+        await Case("driver-raw-UNS-URI-scalar-and-array-read", async () =>
+        {
+            var values = await driver.ReadAsync(["scalar", "vector", "uns"], Ct);
+            Require(values.Count == 3 && values.All(x => x.StatusCode == 0), "Read failure");
+            Require(values[0].Value is int && values[1].Value is int[] && values[2].Value is int, "Lost scalar/array type");
+        });
+        await Case("driver-scalar-array-write-roundtrip", async () =>
+        {
+            var writes = await driver.WriteAsync([new WriteRequest("scalar", 91), new WriteRequest("vector", new[] { 11, 12, 13 })], Ct);
+            Require(writes.All(x => x.StatusCode == 0), "Write failed");
+            var values = await driver.ReadAsync(["scalar", "vector"], Ct);
+            Require(Equals(values[0].Value, 91) && ((int[])values[1].Value!).SequenceEqual(new[] { 11, 12, 13 }), "Write round trip mismatch");
+        });
+        await Case("driver-monitor-quality-timestamps", async () =>
+        {
+            var seen = new ConcurrentQueue<DataValueSnapshot>();
+            driver.OnDataChange += (_, e) => seen.Enqueue(e.Snapshot);
+            var subscription = await driver.SubscribeAsync(["scalar"], TimeSpan.FromMilliseconds(100), Ct);
+            await driver.WriteAsync([new WriteRequest("scalar", 92)], Ct);
+            await Wait(() => seen.Any(x => Equals(x.Value, 92)));
+            var value = seen.Last(x => Equals(x.Value, 92));
+            Require(value.StatusCode == 0 && value.SourceTimestampUtc.HasValue && value.ServerTimestampUtc > Epoch, "Missing monitor quality/timestamps");
+            Observations.Add(new { value.SourceTimestampUtc, value.ServerTimestampUtc, value.StatusCode });
+            await driver.UnsubscribeAsync(subscription, Ct);
+        });
+        Observations.Add(new { capability = "driver-history", status = "not-applicable", evidence = "Driver has no IHistoryProvider/HistoryRead capability; .claude/rules/drivers.md #655. Shared/CLI own history." });
+        await driver.ShutdownAsync(Ct);
+    }
+    static async Task Performance(string endpoint)
+    {
+        using var client = new OpcUaClientService();
+        var info = await client.ConnectAsync(Settings(endpoint), Ct);
+        Require(info.SecurityMode == "SignAndEncrypt" && info.SecurityPolicyUri == SecurityPolicies.Basic256Sha256, "Unexpected benchmark endpoint policy");
+        var namespaces = (string[])Clr(await client.ReadValueAsync(VariableIds.Server_NamespaceArray, Ct))!;
+        var raw = (ushort)Array.IndexOf(namespaces, RawUri);
+        Require(raw > 0, "Missing benchmark raw namespace");
+        Observations.Add(new {info.SecurityMode, info.SecurityPolicyUri, tieredCompilation=Environment.GetEnvironmentVariable("DOTNET_TieredCompilation"), scope="Two scalar/Int32[3] variables; zero data monitors during measurement; five fixture variables and one native condition"});
+        await Case("warmed-production-client-read-write-measurement", () => Benchmark(client, new NodeId(Scalar, raw), new NodeId(Vector, raw)));
+        await client.DisconnectAsync(Ct);
+    }
+    static async Task Benchmark(OpcUaClientService client, NodeId scalar, NodeId vector)
+    {
+        // Local diagnostic subset; excludes reconnect, history and load.
+        var rounds = int.Parse(Environment.GetEnvironmentVariable("OPCUA_MATRIX_PERF_ROUNDS") ?? "3");
+        var warmups = int.Parse(Environment.GetEnvironmentVariable("OPCUA_MATRIX_PERF_WARMUPS") ?? "10");
+        var measured = int.Parse(Environment.GetEnvironmentVariable("OPCUA_MATRIX_PERF_MEASURED") ?? "50");
+        Require(rounds > 0 && warmups >= 0 && measured > 0, "Invalid performance sample counts");
+        for (int round = 1; round <= rounds; round++)
+        {
+            for (int warmup = 0; warmup < warmups; warmup++)
+            {
+                await client.ReadValueAsync(scalar, Ct); await client.WriteValueAsync(scalar, warmup, Ct);
+                await client.ReadValueAsync(vector, Ct); await client.WriteValueAsync(vector, new[] { warmup, warmup + 1, warmup + 2 }, Ct);
+            }
+            var samples = new Dictionary<string, List<double>>();
+            var before = System.Diagnostics.Process.GetCurrentProcess(); var cpu = before.TotalProcessorTime;
+            var allocated = GC.GetTotalAllocatedBytes(); var gc = new[] { GC.CollectionCount(0), GC.CollectionCount(1), GC.CollectionCount(2) };
+            foreach (var operation in new[] { "scalar-read", "scalar-write", "array-read", "array-write" })
+            {
+                var times = new List<double>();
+                for (int i = 0; i < measured; i++)
+                {
+                    var start = System.Diagnostics.Stopwatch.GetTimestamp();
+                    if (operation == "scalar-read") await client.ReadValueAsync(scalar, Ct);
+                    else if (operation == "scalar-write") Require(StatusCode.IsGood(await client.WriteValueAsync(scalar, i, Ct)), "Benchmark scalar write");
+                    else if (operation == "array-read") await client.ReadValueAsync(vector, Ct);
+                    else Require(StatusCode.IsGood(await client.WriteValueAsync(vector, new[] { i, i + 1, i + 2 }, Ct)), "Benchmark array write");
+                    times.Add(System.Diagnostics.Stopwatch.GetElapsedTime(start).TotalMilliseconds);
+                }
+                samples[operation] = times;
+            }
+            before.Refresh();
+            Observations.Add(new
+            {
+                benchmarkRound = round,
+                warmupOperationsPerKind = 10,
+                operationsPerKind = 50,
+                latencyMilliseconds = samples.ToDictionary(x => x.Key, x => new { p50 = x.Value.Order().ElementAt((int)Math.Ceiling(measured * 0.50) - 1), p95 = x.Value.Order().ElementAt((int)Math.Ceiling(measured * 0.95) - 1), p99 = x.Value.Order().ElementAt((int)Math.Ceiling(measured * 0.99) - 1), throughputOperationsPerSecond = measured * 1000.0 / x.Value.Sum() }),
+                clientCpuMilliseconds = (before.TotalProcessorTime - cpu).TotalMilliseconds,
+                clientAllocatedBytes = GC.GetTotalAllocatedBytes() - allocated, clientAllocatedBytesPerOperation = (GC.GetTotalAllocatedBytes() - allocated) / (4.0 * measured),
+                clientWorkingSetBytes = before.WorkingSet64,
+                clientPrivateBytes = before.PrivateMemorySize64,
+                clientThreads = before.Threads.Count,
+                clientHandles = before.HandleCount,
+                collections = new[] { GC.CollectionCount(0) - gc[0], GC.CollectionCount(1) - gc[1], GC.CollectionCount(2) - gc[2] }
+            });
+        }
+    }
+    sealed class Auth : IOpcUaUserAuthenticator
+    {
+        public Task<OpcUaUserAuthResult> AuthenticateUserNameAsync(string username, string password, CancellationToken ct) => Task.FromResult(username == "apikey" && password == Password ? OpcUaUserAuthResult.AllowKey("matrix", [OpcUaDataPlaneRoles.WriteOperate, OpcUaDataPlaneRoles.AlarmAck], "matrix") : OpcUaUserAuthResult.Deny("Invalid ephemeral fixture key"));
+    }
+    sealed class Gateway : IOpcUaNodeWriteGateway { public Task<NodeWriteOutcome> WriteAsync(string id, object? value, AddressSpaceRealm realm, CancellationToken ct) => Task.FromResult(new NodeWriteOutcome(true, null)); }
+    sealed class Source(string root) : IHistorianDataSource
+    {
+        void Log(string operation, int rows) => File.AppendAllText(Path.Combine(root, "history-requests.jsonl"), JsonSerializer.Serialize(new { operation, rows }) + "\n");
+        public int MaxRawValuesPerRead => 7;
+        public Task<CoreHistory> ReadRawAsync(string r, DateTime s, DateTime e, uint m, CancellationToken ct)
+        { var all = Enumerable.Range(0, 25).Select(i => new DataValueSnapshot(i, 0, Epoch.AddSeconds(i), Epoch.AddSeconds(i))).Where(v => v.SourceTimestampUtc >= s && v.SourceTimestampUtc < e).ToList(); var rows = all.Take((int)(m == 0 ? 7 : m)).ToArray(); Log("raw", rows.Length); return Task.FromResult(new CoreHistory(rows, all.Count > rows.Length ? [1] : null)); }
+        public Task<HistoricalEventsResult> ReadEventsAsync(string? source, DateTime s, DateTime e, int max, CancellationToken ct)
+        { var all = Enumerable.Range(0, 25).Select(i => new HistoricalEvent($"e{i:00}", "matrix", Epoch.AddSeconds(i / 2), Epoch, "matrix-history", 500)).Where(v => v.EventTimeUtc >= s && v.EventTimeUtc < e).ToList(); var rows = all.Take(Math.Min(7, max <= 0 ? 7 : max)).ToArray(); Log("events", rows.Length); return Task.FromResult(new HistoricalEventsResult(rows, all.Count > rows.Length ? [1] : null)); }
+        public Task<CoreHistory> ReadProcessedAsync(string r, DateTime s, DateTime e, TimeSpan i, HistoryAggregateType a, CancellationToken ct) => NullHistorianDataSource.Instance.ReadProcessedAsync(r, s, e, i, a, ct);
+        public Task<CoreHistory> ReadAtTimeAsync(string r, IReadOnlyList<DateTime> t, CancellationToken ct) => NullHistorianDataSource.Instance.ReadAtTimeAsync(r, t, ct);
+        public HistorianHealthSnapshot GetHealthSnapshot() => NullHistorianDataSource.Instance.GetHealthSnapshot();
+        public void Dispose() { }
+    }
+}

scripts/validation/opcua-client-lifecycle/README.md

@@ -0,0 +1,96 @@
+# Production OPC UA client lifecycle diagnostic
+
+This standalone harness runs the unchanged production `OpcUaClientService`,
+`OpcUaClientDriver`, and `OpcUaClientDriverBrowser` in one persistent Linux client
+process against a separate process using the production SDK server and node
+manager. Both processes load OPC Foundation SDK 2.0.1. The server fixture is a
+local copy of the compatibility harness at commit `7b353d7b`; only this directory's
+copy has configurable lifetime and atomic public resource snapshots.
+
+Run a short diagnostic from a checkout containing the SDK 2.0.1 changes:
+
+```sh
+python3 scripts/validation/opcua-client-lifecycle/run.py \
+  --duration 90 --output /tmp/otopcua-client-lifecycle-diagnostic-unique
+```
+
+The coordinator must launch and own the full process separately:
+
+```sh
+python3 scripts/validation/opcua-client-lifecycle/run.py \
+  --full --duration 7200 --output /tmp/otopcua-client-lifecycle-full-unique
+```
+
+The output path must not exist. `--full` rejects a duration below 7200 seconds;
+`fullTwoHourLifecycle` is true only after the client monotonic clock has actually
+elapsed at least 7200 seconds and every final check completes. A diagnostic pass
+cannot satisfy that gate. The outer process also has a duration plus 300-second
+hard deadline and forcibly removes its own container on timeout.
+
+The launcher publishes this standalone project, then uses the locally cached
+official `mcr.microsoft.com/dotnet/sdk:10.0.103-noble` Linux arm64 image with
+`--network none`, no host ports and fresh task-owned PKI. `XDG_DATA_HOME` is the
+only storage environment override; it never changes `HOME`. A generated
+credential stays in the child process environment. The output root is mode 0700
+and contains generated private keys: **never commit the entire output directory**.
+Commit only the selected redacted JSON/log receipts under `evidence/`.
+
+Preparation invokes bounded failing connections through each product's public
+API to create its own application certificate. It does not reflectively invoke
+configuration builders or replace the store. Before the live session, public DER
+certificates are exchanged explicitly among the three clients and server.
+Autoaccept is disabled on both ends. Negotiation must be Basic256Sha256
+SignAndEncrypt and API-key-shaped credentials must pass the fixture authenticator
+and production authority/ACL path. Existing own DER hashes must remain unchanged
+across all loop iterations.
+
+Every cycle performs two Shared connect/read/write/subscribe/unsubscribe/
+disconnect rounds on the same object. It performs two driver initialize/read/
+write/subscribe/unsubscribe rounds, each followed by a live reinitialize with an
+active subscription, then shutdown. It opens, browses and disposes two production
+AdminUI browser sessions. Scalar Int32 and Int32[3] writes must roundtrip exactly,
+and both Shared and driver scalar data notifications must arrive.
+
+The external harness reads ownership fields for diagnostics only. Fields are
+looked up by exact name, with missing/null layouts failing the run. It does not
+write reflected fields or change SDK state. For SDK 2.0.1.0 only, each captured
+`CertificateManager.m_disposed` boolean must be false while connected and true
+after release. An independently created, deliberately disposed SDK manager proves
+the before/after probe. All strong manager references are dropped each pass.
+Eight released managers are checked per cycle: two Shared, four driver (including
+live reinitialization), and two browser. Production session and data subscription
+collections must clear, and public Shared connection information and driver health
+must return to disconnected/Unknown. Collected weak references to disposed client,
+driver, browser and browse-session objects must have no survivors at samples.
+
+After every cycle the server's public session/subscription/monitored-item counts
+must return to zero within a bounded settle period. Resource samples capture GC,
+managed allocation/retained bytes, RSS/private bytes, global FDs and task/PKI FDs.
+Owned-path FD matching canonicalizes absolute paths and uses a path-separator
+boundary. Sampling starts cold, then every ten cycles and at completion. RSS and
+FD observations require interpretation after warmup; they are not performance
+budgets or an automatic G4 acceptance decision.
+
+Artifacts are `result.json`, `source.json`, `command.json`, `build.log`,
+`container.log`, and `task/{summary.json,resources.jsonl,sdk-assemblies.json,
+client.log,server.log,prepare.log,server/live-resources.json}`. A failure additionally
+writes a redacted `task/failure.txt`. The server uses a fixed application URI and
+the three client certificate stores are reused for the entire process lifetime.
+
+This is a small local lifecycle gate, not the entire Task 12 gate. It does not
+cover certificate revocation, network stalls, node surgical edits/rebuild,
+continuation-point abandonment/churn, representative driver fanout/load,
+Windows install/publish, ScadaBridge or AVEVA interoperability. It makes no
+baseline/candidate performance or full G4 claim. The coordinator's separate server
+lifecycle harness supplies complementary SDK session/CP/server mutation coverage.
+
+The checked-in 2026-11-10 diagnostic completed **91.104 seconds**, 68 cycles,
+136 Shared rounds, 136 driver rounds (plus 136 live driver reinitializations),
+136 browser sessions, and 544 verified released certificate managers. The final
+sample had zero surviving weak product objects and zero owned PKI FDs; server
+sessions/subscriptions/items returned to zero after every cycle. Warm samples
+showed 146–148 total FDs; the final managed heap was 4,737,536 bytes and RSS was
+181,018,624 bytes. The deliberate manager before/after control passed and
+`--full --duration 90` exited 2 before creating artifacts. This is diagnostic
+coverage only; the two-hour gate remains pending until a coordinator-owned full
+run completes. Receipts are under `evidence/2026-11-10-diagnostic/`.

scripts/validation/opcua-client-lifecycle/container.sh

@@ -0,0 +1,35 @@
+#!/usr/bin/env bash
+# Disposable network-isolated container only. All PKI is owned by this fresh task root.
+set -euo pipefail
+mkdir -p /task/data /task/server
+export XDG_DATA_HOME=/task/data
+export OPCUA_LIFECYCLE_SERVER_SECONDS=$((LIFECYCLE_SECONDS + 300))
+dotnet /app/Lifecycle.dll prepare /task > /task/prepare.log 2>&1
+mkdir -p /task/server/server-pki/trusted/certs
+for pki in /task/data/shared-pki /task/data/OtOpcUa/pki /task/data/OtOpcUa/adminui-browse-pki; do
+    cp "$pki"/own/certs/* /task/server/server-pki/trusted/certs/
+done
+dotnet /app/Lifecycle.dll server /task/server > /task/server.log 2>&1 &
+server_pid=$!
+cleanup() {
+    touch /task/server/stop
+    for attempt in $(seq 1 150); do
+        kill -0 "$server_pid" 2>/dev/null || break
+        sleep 0.1
+    done
+    kill "$server_pid" 2>/dev/null || true
+    wait "$server_pid" || true
+}
+trap cleanup EXIT
+for attempt in $(seq 1 600); do
+    test ! -f /task/server/ready.json || break
+    kill -0 "$server_pid" || exit 1
+    sleep 0.1
+done
+test -f /task/server/ready.json
+for pki in /task/data/shared-pki /task/data/OtOpcUa/pki /task/data/OtOpcUa/adminui-browse-pki; do
+    mkdir -p "$pki/trusted/certs"
+    cp /task/server/server-pki/own/certs/* "$pki/trusted/certs/"
+done
+endpoint=$(cat /task/server/endpoint.txt)
+dotnet /app/Lifecycle.dll run /task "$endpoint" "$LIFECYCLE_SECONDS" "$LIFECYCLE_MODE" > /task/client.log 2>&1

scripts/validation/opcua-client-lifecycle/evidence/2026-11-10-diagnostic/build.log

@@ -0,0 +1,63 @@
+
+  Determining projects to restore...
+  All projects are up-to-date for restore.
+  ZB.MOM.WW.OtOpcUa.Analyzers -> /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Tooling/ZB.MOM.WW.OtOpcUa.Analyzers/bin/Release/netstandard2.0/ZB.MOM.WW.OtOpcUa.Analyzers.dll
+  ZB.MOM.WW.OtOpcUa.Core.Abstractions -> /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Core/ZB.MOM.WW.OtOpcUa.Core.Abstractions/bin/Release/net10.0/ZB.MOM.WW.OtOpcUa.Core.Abstractions.dll
+  ZB.MOM.WW.OtOpcUa.Commons -> /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Core/ZB.MOM.WW.OtOpcUa.Commons/bin/Release/net10.0/ZB.MOM.WW.OtOpcUa.Commons.dll
+  ZB.MOM.WW.OtOpcUa.Cluster -> /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Core/ZB.MOM.WW.OtOpcUa.Cluster/bin/Release/net10.0/ZB.MOM.WW.OtOpcUa.Cluster.dll
+  ZB.MOM.WW.OtOpcUa.Core.Scripting.Abstractions -> /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Core/ZB.MOM.WW.OtOpcUa.Core.Scripting.Abstractions/bin/Release/net10.0/ZB.MOM.WW.OtOpcUa.Core.Scripting.Abstractions.dll
+  ZB.MOM.WW.OtOpcUa.Core.Scripting -> /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Core/ZB.MOM.WW.OtOpcUa.Core.Scripting/bin/Release/net10.0/ZB.MOM.WW.OtOpcUa.Core.Scripting.dll
+  ZB.MOM.WW.OtOpcUa.Core.VirtualTags -> /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Core/ZB.MOM.WW.OtOpcUa.Core.VirtualTags/bin/Release/net10.0/ZB.MOM.WW.OtOpcUa.Core.VirtualTags.dll
+  ZB.MOM.WW.OtOpcUa.Driver.Sql.Contracts -> /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Sql.Contracts/bin/Release/net10.0/ZB.MOM.WW.OtOpcUa.Driver.Sql.Contracts.dll
+  ZB.MOM.WW.OtOpcUa.Configuration -> /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Core/ZB.MOM.WW.OtOpcUa.Configuration/bin/Release/net10.0/ZB.MOM.WW.OtOpcUa.Configuration.dll
+  ZB.MOM.WW.OtOpcUa.Core -> /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Core/ZB.MOM.WW.OtOpcUa.Core/bin/Release/net10.0/ZB.MOM.WW.OtOpcUa.Core.dll
+  ZB.MOM.WW.OtOpcUa.Core.Scripting.Protocol -> /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Core/ZB.MOM.WW.OtOpcUa.Core.Scripting.Protocol/bin/Release/net10.0/ZB.MOM.WW.OtOpcUa.Core.Scripting.Protocol.dll
+  ZB.MOM.WW.OtOpcUa.Core.Scripting.OutOfProcess -> /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Core/ZB.MOM.WW.OtOpcUa.Core.Scripting.OutOfProcess/bin/Release/net10.0/ZB.MOM.WW.OtOpcUa.Core.Scripting.OutOfProcess.dll
+  ZB.MOM.WW.OtOpcUa.Core.ScriptedAlarms -> /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Core/ZB.MOM.WW.OtOpcUa.Core.ScriptedAlarms/bin/Release/net10.0/ZB.MOM.WW.OtOpcUa.Core.ScriptedAlarms.dll
+  ZB.MOM.WW.OtOpcUa.Security -> /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Server/ZB.MOM.WW.OtOpcUa.Security/bin/Release/net10.0/ZB.MOM.WW.OtOpcUa.Security.dll
+  ZB.MOM.WW.OtOpcUa.Driver.Modbus.Addressing -> /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Modbus.Addressing/bin/Release/net10.0/ZB.MOM.WW.OtOpcUa.Driver.Modbus.Addressing.dll
+  ZB.MOM.WW.OtOpcUa.Driver.Modbus.Contracts -> /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Modbus.Contracts/bin/Release/net10.0/ZB.MOM.WW.OtOpcUa.Driver.Modbus.Contracts.dll
+  ZB.MOM.WW.OtOpcUa.Driver.S7.Contracts -> /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.S7.Contracts/bin/Release/net10.0/ZB.MOM.WW.OtOpcUa.Driver.S7.Contracts.dll
+  ZB.MOM.WW.OtOpcUa.Driver.AbCip.Contracts -> /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.AbCip.Contracts/bin/Release/net10.0/ZB.MOM.WW.OtOpcUa.Driver.AbCip.Contracts.dll
+  ZB.MOM.WW.OtOpcUa.Driver.AbLegacy.Contracts -> /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.AbLegacy.Contracts/bin/Release/net10.0/ZB.MOM.WW.OtOpcUa.Driver.AbLegacy.Contracts.dll
+  ZB.MOM.WW.OtOpcUa.Driver.TwinCAT.Contracts -> /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.TwinCAT.Contracts/bin/Release/net10.0/ZB.MOM.WW.OtOpcUa.Driver.TwinCAT.Contracts.dll
+  ZB.MOM.WW.OtOpcUa.Driver.FOCAS.Contracts -> /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.FOCAS.Contracts/bin/Release/net10.0/ZB.MOM.WW.OtOpcUa.Driver.FOCAS.Contracts.dll
+  ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Contracts -> /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Contracts/bin/Release/net10.0/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Contracts.dll
+  ZB.MOM.WW.OtOpcUa.Driver.MTConnect.Contracts -> /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.MTConnect.Contracts/bin/Release/net10.0/ZB.MOM.WW.OtOpcUa.Driver.MTConnect.Contracts.dll
+  ZB.MOM.WW.OtOpcUa.Driver.Calculation.Contracts -> /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Calculation.Contracts/bin/Release/net10.0/ZB.MOM.WW.OtOpcUa.Driver.Calculation.Contracts.dll
+  ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.Contracts -> /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.Contracts/bin/Release/net10.0/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.Contracts.dll
+  ZB.MOM.WW.OtOpcUa.ControlPlane -> /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Server/ZB.MOM.WW.OtOpcUa.ControlPlane/bin/Release/net10.0/ZB.MOM.WW.OtOpcUa.ControlPlane.dll
+  ZB.MOM.WW.OtOpcUa.OpcUaServer -> /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Server/ZB.MOM.WW.OtOpcUa.OpcUaServer/bin/Release/net10.0/ZB.MOM.WW.OtOpcUa.OpcUaServer.dll
+  ZB.MOM.WW.OtOpcUa.Core.AlarmHistorian -> /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Core/ZB.MOM.WW.OtOpcUa.Core.AlarmHistorian/bin/Release/net10.0/ZB.MOM.WW.OtOpcUa.Core.AlarmHistorian.dll
+  ZB.MOM.WW.OtOpcUa.Runtime -> /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Server/ZB.MOM.WW.OtOpcUa.Runtime/bin/Release/net10.0/ZB.MOM.WW.OtOpcUa.Runtime.dll
+  ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Contracts -> /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Contracts/bin/Release/net10.0/ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Contracts.dll
+  ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.Session -> /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.Session/bin/Release/net10.0/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.Session.dll
+  ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.Browser -> /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.Browser/bin/Release/net10.0/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.Browser.dll
+  ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Browser -> /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Browser/bin/Release/net10.0/ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Browser.dll
+  ZB.MOM.WW.OtOpcUa.Driver.Sql.Dialect -> /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Sql.Dialect/bin/Release/net10.0/ZB.MOM.WW.OtOpcUa.Driver.Sql.Dialect.dll
+  ZB.MOM.WW.OtOpcUa.Driver.Sql.Browser -> /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Sql.Browser/bin/Release/net10.0/ZB.MOM.WW.OtOpcUa.Driver.Sql.Browser.dll
+  ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Transport -> /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Transport/bin/Release/net10.0/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Transport.dll
+  ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Browser -> /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Browser/bin/Release/net10.0/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Browser.dll
+  ZB.MOM.WW.OtOpcUa.AdminUI -> /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Server/ZB.MOM.WW.OtOpcUa.AdminUI/bin/Release/net10.0/ZB.MOM.WW.OtOpcUa.AdminUI.dll
+  ZB.MOM.WW.OtOpcUa.Driver.Ab.Transport -> /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Ab.Transport/bin/Release/net10.0/ZB.MOM.WW.OtOpcUa.Driver.Ab.Transport.dll
+  ZB.MOM.WW.OtOpcUa.Driver.AbCip -> /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.AbCip/bin/Release/net10.0/ZB.MOM.WW.OtOpcUa.Driver.AbCip.dll
+  ZB.MOM.WW.OtOpcUa.Driver.AbLegacy -> /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.AbLegacy/bin/Release/net10.0/ZB.MOM.WW.OtOpcUa.Driver.AbLegacy.dll
+  ZB.MOM.WW.OtOpcUa.Driver.Calculation -> /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Calculation/bin/Release/net10.0/ZB.MOM.WW.OtOpcUa.Driver.Calculation.dll
+  ZB.MOM.WW.OtOpcUa.Driver.FOCAS -> /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.FOCAS/bin/Release/net10.0/ZB.MOM.WW.OtOpcUa.Driver.FOCAS.dll
+  ZB.MOM.WW.OtOpcUa.Driver.Galaxy -> /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Galaxy/bin/Release/net10.0/ZB.MOM.WW.OtOpcUa.Driver.Galaxy.dll
+  ZB.MOM.WW.OtOpcUa.Driver.Historian.Sql.Common -> /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Historian.Sql.Common/bin/Release/net10.0/ZB.MOM.WW.OtOpcUa.Driver.Historian.Sql.Common.dll
+  ZB.MOM.WW.OtOpcUa.Driver.Historian.Gateway -> /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Historian.Gateway/bin/Release/net10.0/ZB.MOM.WW.OtOpcUa.Driver.Historian.Gateway.dll
+  ZB.MOM.WW.OtOpcUa.Driver.Historian.SqlServer -> /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Historian.SqlServer/bin/Release/net10.0/ZB.MOM.WW.OtOpcUa.Driver.Historian.SqlServer.dll
+  ZB.MOM.WW.OtOpcUa.Driver.Historian.QuestDb -> /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Historian.QuestDb/bin/Release/net10.0/ZB.MOM.WW.OtOpcUa.Driver.Historian.QuestDb.dll
+  ZB.MOM.WW.OtOpcUa.Driver.Modbus -> /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Modbus/bin/Release/net10.0/ZB.MOM.WW.OtOpcUa.Driver.Modbus.dll
+  ZB.MOM.WW.OtOpcUa.Driver.Mqtt -> /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt/bin/Release/net10.0/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.dll
+  ZB.MOM.WW.OtOpcUa.Driver.MTConnect -> /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.MTConnect/bin/Release/net10.0/ZB.MOM.WW.OtOpcUa.Driver.MTConnect.dll
+  ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient -> /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient/bin/Release/net10.0/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.dll
+  ZB.MOM.WW.OtOpcUa.Driver.S7 -> /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.S7/bin/Release/net10.0/ZB.MOM.WW.OtOpcUa.Driver.S7.dll
+  ZB.MOM.WW.OtOpcUa.Driver.Sql -> /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Sql/bin/Release/net10.0/ZB.MOM.WW.OtOpcUa.Driver.Sql.dll
+  ZB.MOM.WW.OtOpcUa.Driver.TwinCAT -> /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.TwinCAT/bin/Release/net10.0/ZB.MOM.WW.OtOpcUa.Driver.TwinCAT.dll
+  ZB.MOM.WW.OtOpcUa.ScriptWorker -> /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Server/ZB.MOM.WW.OtOpcUa.ScriptWorker/bin/Release/net10.0/ZB.MOM.WW.OtOpcUa.ScriptWorker.dll
+  ZB.MOM.WW.OtOpcUa.Host -> /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Server/ZB.MOM.WW.OtOpcUa.Host/bin/Release/net10.0/OtOpcUa.Host.dll
+  ZB.MOM.WW.OtOpcUa.Client.Shared -> /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Client/ZB.MOM.WW.OtOpcUa.Client.Shared/bin/Release/net10.0/ZB.MOM.WW.OtOpcUa.Client.Shared.dll
+  Lifecycle -> /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/scripts/validation/opcua-client-lifecycle/bin/Release/net10.0/Lifecycle.dll
+  Lifecycle -> /private/tmp/opcua2-production-client-diagnostic-20261110c/app/

scripts/validation/opcua-client-lifecycle/evidence/2026-11-10-diagnostic/command.json

@@ -0,0 +1,25 @@
+{
+  "argv": [
+    "docker",
+    "run",
+    "--rm",
+    "--name",
+    "otopcua-client-lifecycle-a2c271bbeb54",
+    "--network",
+    "none",
+    "-e",
+    "OPCUA_MATRIX_PASSWORD",
+    "-e",
+    "LIFECYCLE_SECONDS",
+    "-e",
+    "LIFECYCLE_MODE",
+    "-v",
+    "/private/tmp/opcua2-production-client-diagnostic-20261110c/app:/app:ro",
+    "-v",
+    "/private/tmp/opcua2-production-client-diagnostic-20261110c/task:/task",
+    "mcr.microsoft.com/dotnet/sdk:10.0.103-noble",
+    "bash",
+    "/task/container.sh"
+  ],
+  "timeoutSeconds": 390
+}

scripts/validation/opcua-client-lifecycle/evidence/2026-11-10-diagnostic/full-duration-guard.log

@@ -0,0 +1,3 @@
+usage: run.py [-h] --output OUTPUT [--duration DURATION] [--full]
+              [--image IMAGE]
+run.py: error: --full requires duration >=7200; diagnostic duration must be positive

scripts/validation/opcua-client-lifecycle/evidence/2026-11-10-diagnostic/resources.jsonl

@@ -0,0 +1,8 @@
+{"cycle":0,"elapsedSeconds":0,"utc":"2026-11-10T17:39:34.5140163Z","WorkingSet64":50884608,"PrivateMemorySize64":87019520,"managedBytes":243384,"allocatedBytes":307688,"gc":[2,2,2],"fdCount":66,"ownedRootFdCount":4,"ownedPkiFdCount":0,"survivingProductionObjects":0,"managerDisposalsVerified":0,"sharedPasses":0,"driverPasses":0,"browserPasses":0}
+{"cycle":10,"elapsedSeconds":13.7816334,"utc":"2026-11-10T17:39:48.307566Z","WorkingSet64":168873984,"PrivateMemorySize64":210952192,"managedBytes":4622440,"allocatedBytes":53385048,"gc":[5,4,4],"fdCount":146,"ownedRootFdCount":4,"ownedPkiFdCount":0,"survivingProductionObjects":0,"managerDisposalsVerified":80,"sharedPasses":20,"driverPasses":20,"browserPasses":20}
+{"cycle":20,"elapsedSeconds":26.955914,"utc":"2026-11-10T17:40:01.4729188Z","WorkingSet64":181080064,"PrivateMemorySize64":230060032,"managedBytes":4716120,"allocatedBytes":100286768,"gc":[8,6,6],"fdCount":146,"ownedRootFdCount":4,"ownedPkiFdCount":0,"survivingProductionObjects":0,"managerDisposalsVerified":160,"sharedPasses":40,"driverPasses":40,"browserPasses":40}
+{"cycle":30,"elapsedSeconds":40.3288294,"utc":"2026-11-10T17:40:14.8512936Z","WorkingSet64":181923840,"PrivateMemorySize64":230674432,"managedBytes":4624608,"allocatedBytes":146998480,"gc":[11,8,8],"fdCount":146,"ownedRootFdCount":4,"ownedPkiFdCount":0,"survivingProductionObjects":0,"managerDisposalsVerified":240,"sharedPasses":60,"driverPasses":60,"browserPasses":60}
+{"cycle":40,"elapsedSeconds":53.6437668,"utc":"2026-11-10T17:40:28.1646671Z","WorkingSet64":183074816,"PrivateMemorySize64":232931328,"managedBytes":4503968,"allocatedBytes":193703712,"gc":[14,10,10],"fdCount":148,"ownedRootFdCount":4,"ownedPkiFdCount":0,"survivingProductionObjects":0,"managerDisposalsVerified":320,"sharedPasses":80,"driverPasses":80,"browserPasses":80}
+{"cycle":50,"elapsedSeconds":66.9338459,"utc":"2026-11-10T17:40:41.4571518Z","WorkingSet64":184758272,"PrivateMemorySize64":232972288,"managedBytes":4503736,"allocatedBytes":240424880,"gc":[17,12,12],"fdCount":148,"ownedRootFdCount":4,"ownedPkiFdCount":0,"survivingProductionObjects":0,"managerDisposalsVerified":400,"sharedPasses":100,"driverPasses":100,"browserPasses":100}
+{"cycle":60,"elapsedSeconds":80.254683,"utc":"2026-11-10T17:40:54.7806201Z","WorkingSet64":180539392,"PrivateMemorySize64":233132032,"managedBytes":4504072,"allocatedBytes":287112440,"gc":[20,14,14],"fdCount":148,"ownedRootFdCount":4,"ownedPkiFdCount":0,"survivingProductionObjects":0,"managerDisposalsVerified":480,"sharedPasses":120,"driverPasses":120,"browserPasses":120}
+{"cycle":68,"elapsedSeconds":91.0947059,"utc":"2026-11-10T17:41:05.614513Z","WorkingSet64":180760576,"PrivateMemorySize64":233250816,"managedBytes":4739896,"allocatedBytes":324761520,"gc":[23,16,16],"fdCount":148,"ownedRootFdCount":4,"ownedPkiFdCount":0,"survivingProductionObjects":0,"managerDisposalsVerified":544,"sharedPasses":136,"driverPasses":136,"browserPasses":136}

scripts/validation/opcua-client-lifecycle/evidence/2026-11-10-diagnostic/result.json

@@ -0,0 +1,50 @@
+{
+  "exitCode": 0,
+  "containerElapsedSeconds": 93.73282008292153,
+  "summary": {
+    "status": "passed",
+    "diagnosticPositiveControl": "exact SDK2 manager false-before/true-after DisposeAsync",
+    "applicationCertificateHashes": [
+      "data/OtOpcUa/adminui-browse-pki/own/certs/OtOpcUa AdminUI Browse [14579B861300836A2A96549E307DB4123778B0C5].der:89e21ac01a5582dd04df77add2fad19495c695b69f4a48a05d2c71283325503b",
+      "data/OtOpcUa/pki/own/certs/ClientLifecycle [AF2D40052FCDDC9A8C09686E6E8E0F17CFF5A979].der:e9bdc63bc2cc0b7901389f958b2fd6bfaf5369f439dc996e152668a3fa3c381c",
+      "data/shared-pki/own/certs/OtOpcUaClient [91C87A8D0AC11919E0AFD44457BF932F3587F1B0].der:b4f2018a43f161e18d25f7b8bb80590ccec13afcf7b9189f6d97e10a68b55602"
+    ],
+    "requestedSeconds": 90,
+    "elapsedSeconds": 91.1041217,
+    "fullTwoHourLifecycle": false,
+    "cycles": 68,
+    "sharedPasses": 136,
+    "driverPasses": 136,
+    "browserPasses": 136,
+    "managerDisposalsVerified": 544,
+    "finalResources": {
+      "cycle": 68,
+      "elapsedSeconds": 91.1041218,
+      "utc": "2026-11-10T17:41:05.6187359Z",
+      "WorkingSet64": 181018624,
+      "PrivateMemorySize64": 233250816,
+      "managedBytes": 4737536,
+      "allocatedBytes": 324891240,
+      "gc": [
+        25,
+        18,
+        18
+      ],
+      "fdCount": 148,
+      "ownedRootFdCount": 4,
+      "ownedPkiFdCount": 0,
+      "survivingProductionObjects": 0,
+      "managerDisposalsVerified": 544,
+      "sharedPasses": 136,
+      "driverPasses": 136,
+      "browserPasses": 136
+    },
+    "scope": "Production Shared connect/disconnect/reconnect; production driver Initialize/Reinitialize/Shutdown/dispose; production browser open/browse/dispose; scalar and Int32[3] read/write/subscribe/unsubscribe; strict mutual trusted DER/Basic256Sha256 SignAndEncrypt/API-key fixture. No network stalls, revocation, surgical edits/rebuild, CP abandonment or Windows/AVEVA/performance G4 claim."
+  },
+  "applicationCertificates": {
+    "data/OtOpcUa/adminui-browse-pki/own/certs/OtOpcUa AdminUI Browse [14579B861300836A2A96549E307DB4123778B0C5].der": "89e21ac01a5582dd04df77add2fad19495c695b69f4a48a05d2c71283325503b",
+    "data/OtOpcUa/pki/own/certs/ClientLifecycle [AF2D40052FCDDC9A8C09686E6E8E0F17CFF5A979].der": "e9bdc63bc2cc0b7901389f958b2fd6bfaf5369f439dc996e152668a3fa3c381c",
+    "data/shared-pki/own/certs/OtOpcUaClient [91C87A8D0AC11919E0AFD44457BF932F3587F1B0].der": "b4f2018a43f161e18d25f7b8bb80590ccec13afcf7b9189f6d97e10a68b55602",
+    "server/server-pki/own/certs/OtOpcUa.Matrix [29412ADF65A3E370B5CDCABE9386217B43E1C1C1].der": "c3beb0f1c0536635c7ceb0dcfc42c6220d78d4a38c00ef199c137a6ba36bb04c"
+  }
+}

scripts/validation/opcua-client-lifecycle/evidence/2026-11-10-diagnostic/sdk-assemblies.json

@@ -0,0 +1,32 @@
+[
+  {
+    "name": "Opc.Ua.Core",
+    "version": "2.0.1.0",
+    "sha256": "9d0857aa6b7f3c49037d4ea557b4da8edf07e146069464481783e66c5c9cd35a"
+  },
+  {
+    "name": "Opc.Ua.Types",
+    "version": "2.0.1.0",
+    "sha256": "c542f69882f4e8a4ebd5ccc28a3881d6967c7ffb6dcc3c56dc6c776f39c2ede1"
+  },
+  {
+    "name": "Opc.Ua.Security.Certificates",
+    "version": "2.0.1.0",
+    "sha256": "7f4969aceb2f0db5328c6882cb4b117342f3b18905c38acdba600683860c4fd0"
+  },
+  {
+    "name": "Opc.Ua.Core.Types",
+    "version": "2.0.1.0",
+    "sha256": "a7dd141b8dabe8848ff28c2fb8e16a85a0508e6a49e6b1a1c1e267175b99af96"
+  },
+  {
+    "name": "Opc.Ua.Client",
+    "version": "2.0.1.0",
+    "sha256": "620da406fabdbc75d11f9827ea7e39d2d3c762471bd2264b0d11f1d6cd9247cd"
+  },
+  {
+    "name": "Opc.Ua.Configuration",
+    "version": "2.0.1.0",
+    "sha256": "6ed6a594c93c3ff35d1a16539a9fe87c1e2640549cc2f48ed6bae333dc8bf0e7"
+  }
+]

scripts/validation/opcua-client-lifecycle/evidence/2026-11-10-diagnostic/server-live-resources.json

@@ -0,0 +1 @@
+{"utc":"2026-11-10T17:41:05.3943073Z","sessions":0,"subscriptions":0,"items":0,"serverProcess":26}

scripts/validation/opcua-client-lifecycle/evidence/2026-11-10-diagnostic/server-ready.json

@@ -0,0 +1 @@
+{"endpoint":"opc.tcp://127.0.0.1:36237/OtOpcUa","process":26,"sdk":"2.0.1.0","rawUri":"https://zb.com/otopcua/raw","unsUri":"https://zb.com/otopcua/uns"}

scripts/validation/opcua-client-lifecycle/evidence/2026-11-10-diagnostic/server-server-resources.json

@@ -0,0 +1,13 @@
+{
+  "WorkingSet64": 232546304,
+  "PrivateMemorySize64": 263188480,
+  "HandleCount": 151,
+  "threads": 17,
+  "cpuMilliseconds": 11661.139,
+  "allocatedBytes": 334834272,
+  "collections": [
+    9,
+    1,
+    0
+  ]
+}

scripts/validation/opcua-client-lifecycle/evidence/2026-11-10-diagnostic/source.json

@@ -0,0 +1,17 @@
+{
+  "commit": "7b353d7bae5311a2f0a33c0a82c88d2c5b49d76f",
+  "root": "/Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa",
+  "durationSeconds": 90,
+  "mode": "diagnostic",
+  "image": {
+    "Id": "sha256:b04611ee9e1b7d36797012ed921962c57189cb4dbb3dff12afb8e158110f293b",
+    "RepoDigests": [
+      "mcr.microsoft.com/dotnet/sdk@sha256:e362a8dbcd691522456da26a5198b8f3ca1d7641c95624fadc5e3e82678bd08a"
+    ],
+    "Architecture": "arm64",
+    "Os": "linux"
+  },
+  "network": "none",
+  "startedUtc": "2026-11-10T17:39:26Z",
+  "scope": "actual unchanged production Shared/OpcUaClientDriver/AdminUI browser in a repeated same-process loop; SDK 2.0.1 only"
+}

scripts/validation/opcua-client-lifecycle/evidence/2026-11-10-diagnostic/summary.json

@@ -0,0 +1,40 @@
+{
+  "status": "passed",
+  "diagnosticPositiveControl": "exact SDK2 manager false-before/true-after DisposeAsync",
+  "applicationCertificateHashes": [
+    "data/OtOpcUa/adminui-browse-pki/own/certs/OtOpcUa AdminUI Browse [14579B861300836A2A96549E307DB4123778B0C5].der:89e21ac01a5582dd04df77add2fad19495c695b69f4a48a05d2c71283325503b",
+    "data/OtOpcUa/pki/own/certs/ClientLifecycle [AF2D40052FCDDC9A8C09686E6E8E0F17CFF5A979].der:e9bdc63bc2cc0b7901389f958b2fd6bfaf5369f439dc996e152668a3fa3c381c",
+    "data/shared-pki/own/certs/OtOpcUaClient [91C87A8D0AC11919E0AFD44457BF932F3587F1B0].der:b4f2018a43f161e18d25f7b8bb80590ccec13afcf7b9189f6d97e10a68b55602"
+  ],
+  "requestedSeconds": 90,
+  "elapsedSeconds": 91.1041217,
+  "fullTwoHourLifecycle": false,
+  "cycles": 68,
+  "sharedPasses": 136,
+  "driverPasses": 136,
+  "browserPasses": 136,
+  "managerDisposalsVerified": 544,
+  "finalResources": {
+    "cycle": 68,
+    "elapsedSeconds": 91.1041218,
+    "utc": "2026-11-10T17:41:05.6187359Z",
+    "WorkingSet64": 181018624,
+    "PrivateMemorySize64": 233250816,
+    "managedBytes": 4737536,
+    "allocatedBytes": 324891240,
+    "gc": [
+      25,
+      18,
+      18
+    ],
+    "fdCount": 148,
+    "ownedRootFdCount": 4,
+    "ownedPkiFdCount": 0,
+    "survivingProductionObjects": 0,
+    "managerDisposalsVerified": 544,
+    "sharedPasses": 136,
+    "driverPasses": 136,
+    "browserPasses": 136
+  },
+  "scope": "Production Shared connect/disconnect/reconnect; production driver Initialize/Reinitialize/Shutdown/dispose; production browser open/browse/dispose; scalar and Int32[3] read/write/subscribe/unsubscribe; strict mutual trusted DER/Basic256Sha256 SignAndEncrypt/API-key fixture. No network stalls, revocation, surgical edits/rebuild, CP abandonment or Windows/AVEVA/performance G4 claim."
+}

scripts/validation/opcua-client-lifecycle/evidence/2026-11-10-diagnostic/verification.json

@@ -0,0 +1,36 @@
+{
+  "diagnosticExitCode": 0,
+  "fullDurationGuardExitCode": 2,
+  "rawArtifactRoot": "/private/tmp/opcua2-production-client-diagnostic-20261110c",
+  "shortRunDoesNotMeetTwoHourGate": true,
+  "harnessFiles": [
+    {
+      "path": "scripts/validation/opcua-client-lifecycle/.gitignore",
+      "sha256": "32dae3052f331ee34d628ef535709b301259a45df7c7522c4d35dcf49873f00b"
+    },
+    {
+      "path": "scripts/validation/opcua-client-lifecycle/Lifecycle.cs",
+      "sha256": "609b73b55c4ad2ed7dcd70f42dbc702cc233cd2f9ace8c686f8fe1cbb8471f3a"
+    },
+    {
+      "path": "scripts/validation/opcua-client-lifecycle/Lifecycle.csproj",
+      "sha256": "379ce48ae014f4a52c9e9096a3fce5046689475a08408f279e430463f5f19085"
+    },
+    {
+      "path": "scripts/validation/opcua-client-lifecycle/ProcessHost.cs",
+      "sha256": "89b6f518c9706753e7f62bda4f8312e3390cf8d0ced99d847e8df52d935720d6"
+    },
+    {
+      "path": "scripts/validation/opcua-client-lifecycle/README.md",
+      "sha256": "05cc5b39f58abd7381b3eec51e0fe18bc6de6f525430810ef21b4679fe1e5d20"
+    },
+    {
+      "path": "scripts/validation/opcua-client-lifecycle/container.sh",
+      "sha256": "899cea38d6a7e21448308dea8931a3d2fe0986d736eaf96e4769ef1637ed5aae"
+    },
+    {
+      "path": "scripts/validation/opcua-client-lifecycle/run.py",
+      "sha256": "8da86e2215fcaa883a9212b6dde0e897795efd5d75307af6318345b61c965ad8"
+    }
+  ]
+}

scripts/validation/opcua-client-lifecycle/run.py

@@ -0,0 +1,76 @@
+#!/usr/bin/env python3
+"""Build and run isolated actual production Shared/driver/browser lifecycle loops."""
+import argparse
+import hashlib
+import json
+import os
+from pathlib import Path
+import secrets
+import shutil
+import subprocess
+import time
+import uuid
+
+HERE = Path(__file__).resolve().parent
+ROOT = HERE.parents[2]
+
+
+def write(path, value):
+    path.write_text(json.dumps(value, indent=2) + '\n')
+
+
+def certs(root):
+    return {str(p.relative_to(root)): hashlib.sha256(p.read_bytes()).hexdigest()
+            for p in sorted(root.rglob('*.der')) if '/own/certs/' in str(p)}
+
+
+def main():
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument('--output', required=True, type=Path, help='Fresh nonexistent task evidence root, includes private PKI; never commit entire output')
+    parser.add_argument('--duration', type=int, default=90)
+    parser.add_argument('--full', action='store_true', help='Requires >=7200 seconds of real completed client runtime')
+    parser.add_argument('--image', default='mcr.microsoft.com/dotnet/sdk:10.0.103-noble')
+    args = parser.parse_args()
+    if args.duration <= 0 or (args.full and args.duration < 7200):
+        parser.error('--full requires duration >=7200; diagnostic duration must be positive')
+    output = args.output.resolve()
+    output.mkdir(parents=True, exist_ok=False)
+    os.chmod(output, 0o700)
+    build = output / 'app'
+    task = output / 'task'
+    task.mkdir()
+    image = json.loads(subprocess.check_output(['docker', 'image', 'inspect', args.image, '--format', '{{json .}}'], text=True))
+    if image['Architecture'] != 'arm64' or image['Os'] != 'linux':
+        raise RuntimeError('Expected cached official Linux arm64 SDK image')
+    write(output / 'source.json', {'commit': subprocess.check_output(['git', '-C', str(ROOT), 'rev-parse', 'HEAD'], text=True).strip(),
+          'root': str(ROOT), 'durationSeconds': args.duration, 'mode': 'full' if args.full else 'diagnostic',
+          'image': {k: image.get(k) for k in ('Id', 'RepoDigests', 'Architecture', 'Os')}, 'network': 'none',
+          'startedUtc': time.strftime('%Y-%m-%dT%H:%M:%SZ', time.gmtime()),
+          'scope': 'actual unchanged production Shared/OpcUaClientDriver/AdminUI browser in a repeated same-process loop; SDK 2.0.1 only'})
+    with (output / 'build.log').open('w') as log:
+        subprocess.run(['dotnet', 'publish', str(HERE / 'Lifecycle.csproj'), '-c', 'Release', '-m:1', '--nologo', '-o', str(build)], stdout=log, stderr=subprocess.STDOUT, check=True, timeout=300)
+    shutil.copy2(HERE / 'container.sh', task / 'container.sh')
+    name = 'otopcua-client-lifecycle-' + uuid.uuid4().hex[:12]
+    env = dict(os.environ, OPCUA_MATRIX_PASSWORD='otua_lifecycle_' + secrets.token_urlsafe(32),
+               LIFECYCLE_SECONDS=str(args.duration), LIFECYCLE_MODE='full' if args.full else 'diagnostic')
+    command = ['docker', 'run', '--rm', '--name', name, '--network', 'none',
+               '-e', 'OPCUA_MATRIX_PASSWORD', '-e', 'LIFECYCLE_SECONDS', '-e', 'LIFECYCLE_MODE',
+               '-v', str(build) + ':/app:ro', '-v', str(task) + ':/task', args.image, 'bash', '/task/container.sh']
+    write(output / 'command.json', {'argv': command, 'timeoutSeconds': args.duration + 300})
+    started = time.monotonic()
+    try:
+        with (output / 'container.log').open('w') as log:
+            result = subprocess.run(command, stdout=log, stderr=subprocess.STDOUT, env=env, timeout=args.duration + 300)
+    except BaseException:
+        subprocess.run(['docker', 'rm', '-f', name], stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL, timeout=20)
+        raise
+    summary = json.loads((task / 'summary.json').read_text()) if (task / 'summary.json').exists() else None
+    write(output / 'result.json', {'exitCode': result.returncode, 'containerElapsedSeconds': time.monotonic() - started,
+          'summary': summary, 'applicationCertificates': certs(task)})
+    if result.returncode or not summary or (args.full and not summary['fullTwoHourLifecycle']):
+        raise RuntimeError('Lifecycle run failed; inspect task/failure.txt, client.log and server.log: ' + str(output))
+    print(json.dumps({'output': str(output), 'summary': summary}, indent=2))
+
+
+if __name__ == '__main__':
+    main()

scripts/validation/opcua-server-lifecycle-linux/.gitignore

@@ -0,0 +1 @@
+__pycache__/

scripts/validation/opcua-server-lifecycle-linux/README.md

@@ -0,0 +1,107 @@
+# Linux SDK 2 server lifecycle soak
+
+This launcher publishes and runs the existing
+`Sdk2LifecycleSoakTests.Repeated_lifecycles_return_resources_to_a_steady_baseline`
+without copying, rewriting, suppressing or changing its test logic. It imports the
+canonical descriptor fixes from `642aefe3`: physical symlink resolution, path
+separator boundaries, open/closed PKI positive controls, and bounded probe process
+and stream cleanup. The same test still owns the production server, node manager,
+sessions, subscriptions, continuation points, revocation, stalled TCP proxy,
+surgical changes/rebuild and same-PKI restarts.
+
+A diagnostic run:
+
+```sh
+python3 scripts/validation/opcua-server-lifecycle-linux/run.py \
+  --duration 90 --output /tmp/otopcua-server-linux-diagnostic-unique
+```
+
+The coordinator must launch and own a full run in its persistent execution
+session. A diagnostic cannot satisfy the full gate:
+
+```sh
+python3 scripts/validation/opcua-server-lifecycle-linux/run.py \
+  --full --duration 7200 --output /tmp/otopcua-server-linux-full-unique
+```
+
+An already published artifact can be reused with
+`--published-app /absolute/path/to/app`. Its parent must contain the launcher's
+`publish-receipt.json`; the test source, apphost and test assembly hashes must
+match. The recorded diagnostic artifact can be reused with:
+
+```sh
+python3 /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/scripts/validation/opcua-server-lifecycle-linux/run.py \
+  --full --duration 7200 \
+  --published-app /tmp/opcua2-server-linux-diagnostic-20261110a/app \
+  --output /tmp/opcua2-server-linux-full-20261110
+```
+
+The output directory must be fresh. It is mode 0700 and can contain task-owned
+private PKI under `task/tmp` during a run or after a failure. Never commit the
+entire output. The existing successful test removes its own stores. Only selected
+redacted receipt/log/JSONL/TRX files belong under this directory's `evidence/`.
+
+The exact publish command uses the host .NET SDK (recorded as 10.0.403 for the
+verified diagnostic), RID `linux-arm64`, self-contained runtime 10.0.14, explicit
+`UseAppHost=true`, `PublishSingleFile=false`, `PublishTrimmed=false`, one MSBuild
+node, and an external task-owned artifacts directory. All runtime packs were
+already cached. No production or test source is patched during publish. The
+launcher requires an empty production/package source diff against `7b353d7b` and
+records the actual published revision separately from the launcher revision.
+That is source equivalence, not a claim that separately built Linux and macOS
+assemblies have identical hashes. The full publish file hashes, exact test source
+hash, runtimeconfig and SDK dependency versions are retained.
+
+The cached official SDK image
+`mcr.microsoft.com/dotnet/sdk:10.0.103-noble` is resolved to its immutable local
+image ID and must be Linux arm64. The container has `--network none`, no host
+ports and only a read-only application mount plus its fresh task volume.
+`TMPDIR=/task/tmp` and `XDG_DATA_HOME=/task/data` isolate temporary files and PKI;
+`HOME` is not changed. Nothing targets fleet instances, production stores or
+other task fixtures.
+
+The image's VSTest runner first executes exactly the two existing descriptor
+controls. A separate invocation executes exactly one lifecycle test. Both TRX
+files must contain the expected exact executed/passed counts, no skips and no
+failure/error/abort/timeout. The published xUnit v3 application must be ELF64
+AArch64. During the live test, `/proc/<testpid>/exe` must point to the published
+application and the mapped CLR must be `/app/libcoreclr.so`, proving that the
+out-of-process test host is the self-contained Linux publish rather than an
+accidentally copied macOS host.
+
+The original test resource limits remain **64 MiB retained managed growth,
+128 MiB RSS growth, and 32 additional FDs**, using its original third-cycle
+baseline and original managed trend check. Quiescent sessions, subscriptions,
+items, browse/history points, monitored-node/live-item counts and PKI FDs must be
+zero. Cached certificate stores and address-space shape must remain at baseline.
+The original exact-tag read-only diagnostics and manager/store disposal assertions
+are unchanged. The wrapper verifies the same limits in the header and requires
+one start, one completion, no failed row, one active/stall/quiescent row per
+completed cycle and one restart per four cycles. Full mode requires both requested
+and actual monotonic observation time of at least 7200 seconds and a true final
+`satisfiesTwoHourDuration`. The outer container deadline is duration plus 300
+seconds. Its own container is forcibly removed on timeout/interruption.
+
+Artifacts include `publish.log`, `publish-receipt.json`, `source.json`,
+`artifact-manifest.json`, `command.json`, `result.json`, `container.log`, and
+`task/{soak.jsonl,soak.log,descriptor-controls.log,linux-precheck.txt,
+linux-runtime-process.txt,container-dotnet-info.txt,results/*.trx}`. A reused
+artifact keeps its original publish receipt; `source.json` identifies both source
+revisions. `result.json` is passing only after TRX and completion validation.
+
+This supplies supported Linux runtime evidence. It does not resolve the observed
+macOS RSS failure or establish its cause. A short Linux pass is not a two-hour
+pass, and a later Linux pass alone cannot explain away the macOS failure. This
+lane makes no Windows, AVEVA, interoperability or complete G4 performance claim.
+
+The final checked-in diagnostic completed **91.602 seconds**, 25 cycles, six
+actual server restarts, 25 recovered network stalls, and one passing lifecycle
+TRX result. Both descriptor tests passed: the symlink control observed
+`before=0, opened=1, closed=0`, excluded the sibling path, and the timed-out probe
+was reaped in 267 ms. All quiescent logical-resource counts and PKI FDs were zero.
+Third-cycle to final deltas were **−145,080 managed bytes, +53,739,520 RSS bytes,
+and +2 FDs**, within the unchanged diagnostic limits. These short observations do
+not establish a two-hour resource trend. The full Linux gate remains pending.
+CLI rejection of `--full --duration 90`, rejection of a short completion as a full
+run, and rejection of the wrong TRX executed count were also verified. Selected
+receipts are in `evidence/2026-11-10-diagnostic/`.

scripts/validation/opcua-server-lifecycle-linux/container.sh

@@ -0,0 +1,41 @@
+#!/usr/bin/env bash
+# Task-owned Linux namespace only. Existing test logic and limits are unchanged.
+set -euo pipefail
+mkdir -p /task/tmp /task/data /task/results
+export TMPDIR=/task/tmp
+export XDG_DATA_HOME=/task/data
+export OTOPCUA_SDK2_SOAK=1
+export OTOPCUA_SDK2_SOAK_OUTPUT=/task/soak.jsonl
+export DOTNET_CLI_TELEMETRY_OPTOUT=1
+export DOTNET_NOLOGO=1
+[[ $(uname -s) == Linux && $(uname -m) == aarch64 ]]
+[[ -d /proc/self/fd ]]
+printf 'kernel=%s machine=%s tmp=%s procfs=yes\n' "$(uname -s)" "$(uname -m)" "$(readlink -f "$TMPDIR")" > /task/linux-precheck.txt
+dotnet --info > /task/container-dotnet-info.txt
+dotnet vstest /app/ZB.MOM.WW.OtOpcUa.OpcUaServer.IntegrationTests.dll \
+  --TestCaseFilter:'FullyQualifiedName~Sdk2LifecycleSoakTests.Descriptor_probe_' \
+  --ResultsDirectory:/task/results '--Logger:trx;LogFileName=descriptor-controls.trx' > /task/descriptor-controls.log 2>&1
+# VSTest launches the published xUnit v3 self-contained Linux ELF apphost.
+# A distinct invocation gives the soak its own otherwise idle test process.
+dotnet vstest /app/ZB.MOM.WW.OtOpcUa.OpcUaServer.IntegrationTests.dll \
+  --TestCaseFilter:'FullyQualifiedName=ZB.MOM.WW.OtOpcUa.OpcUaServer.IntegrationTests.Sdk2LifecycleSoakTests.Repeated_lifecycles_return_resources_to_a_steady_baseline' \
+  --ResultsDirectory:/task/results '--Logger:trx;LogFileName=soak.trx' > /task/soak.log 2>&1 &
+vstest_pid=$!
+observed=0
+for attempt in $(seq 1 600); do
+    if [[ -s /task/soak.jsonl ]]; then
+        test_pid=$(head -n 1 /task/soak.jsonl | sed -n 's/.*"processId":\([0-9]*\),.*/\1/p')
+        [[ -n "$test_pid" ]]
+        test_exe=$(readlink "/proc/$test_pid/exe")
+        [[ "$test_exe" == /app/ZB.MOM.WW.OtOpcUa.OpcUaServer.IntegrationTests ]]
+        printf 'testProcessId=%s\nactualExecutable=%s\n' "$test_pid" "$test_exe" > /task/linux-runtime-process.txt
+        awk '$6 ~ /\/(libcoreclr.so|libhostfxr.so|libhostpolicy.so|System.Private.CoreLib.dll)$/ {print $6}' "/proc/$test_pid/maps" | sort -u >> /task/linux-runtime-process.txt
+        grep -Fx /app/libcoreclr.so /task/linux-runtime-process.txt > /dev/null
+        observed=1
+        break
+    fi
+    kill -0 "$vstest_pid" 2>/dev/null || break
+    sleep 0.1
+done
+[[ "$observed" == 1 ]]
+wait "$vstest_pid"

scripts/validation/opcua-server-lifecycle-linux/evidence/2026-11-10-diagnostic/command.json

@@ -0,0 +1,25 @@
+{
+  "argv": [
+    "docker",
+    "run",
+    "--rm",
+    "--name",
+    "otopcua-server-linux-soak-fb2c804a7d01",
+    "--network",
+    "none",
+    "-e",
+    "OTOPCUA_SDK2_SOAK_MODE=diagnostic",
+    "-e",
+    "OTOPCUA_SDK2_SOAK_SECONDS=90",
+    "-e",
+    "OTOPCUA_SOAK_BUILD_SHA=74c938f37cbb9cf08b6ca72e4effc511120dc274",
+    "-v",
+    "/private/tmp/opcua2-server-linux-diagnostic-20261110a/app:/app:ro",
+    "-v",
+    "/private/tmp/opcua2-server-linux-diagnostic-20261110c/task:/task",
+    "sha256:b04611ee9e1b7d36797012ed921962c57189cb4dbb3dff12afb8e158110f293b",
+    "bash",
+    "/task/container.sh"
+  ],
+  "timeoutSeconds": 390
+}

scripts/validation/opcua-server-lifecycle-linux/evidence/2026-11-10-diagnostic/container-dotnet-info.txt

@@ -0,0 +1,51 @@
+.NET SDK:
+ Version:           10.0.103
+ Commit:            c2435c3e0f
+ Workload version:  10.0.100-manifests.a62d7899
+ MSBuild version:   18.0.11+c2435c3e0
+
+Runtime Environment:
+ OS Name:     ubuntu
+ OS Version:  24.04
+ OS Platform: Linux
+ RID:         linux-arm64
+ Base Path:   /usr/share/dotnet/sdk/10.0.103/
+
+.NET workloads installed:
+There are no installed workloads to display.
+Configured to use workload sets when installing new manifests.
+No workload sets are installed. Run "dotnet workload restore" to install a workload set.
+
+Host:
+  Version:      10.0.3
+  Architecture: arm64
+  Commit:       c2435c3e0f
+
+.NET SDKs installed:
+  10.0.103 [/usr/share/dotnet/sdk]
+
+.NET runtimes installed:
+  Microsoft.AspNetCore.App 10.0.3 [/usr/share/dotnet/shared/Microsoft.AspNetCore.App]
+  Microsoft.NETCore.App 10.0.3 [/usr/share/dotnet/shared/Microsoft.NETCore.App]
+
+Other architectures found:
+  None
+
+Environment variables:
+  DOTNET_CLI_TELEMETRY_OPTOUT              [1]
+  DOTNET_GENERATE_ASPNET_CERTIFICATE       [false]
+  DOTNET_NOLOGO                            [1]
+  DOTNET_ROLL_FORWARD                      [Major]
+  DOTNET_RUNNING_IN_CONTAINER              [true]
+  DOTNET_SDK_VERSION                       [10.0.103]
+  DOTNET_USE_POLLING_FILE_WATCHER          [true]
+  DOTNET_VERSION                           [10.0.3]
+
+global.json file:
+  Not found
+
+Learn more:
+  https://aka.ms/dotnet/info
+
+Download .NET:
+  https://aka.ms/dotnet/download

scripts/validation/opcua-server-lifecycle-linux/evidence/2026-11-10-diagnostic/descriptor-controls.log

@@ -0,0 +1,7 @@
+VSTest version 18.0.1 (arm64)
+
+Starting test execution, please wait...
+A total of 1 test files matched the specified pattern.
+Results File: /task/results/descriptor-controls.trx
+
+Passed!  - Failed:     0, Passed:     2, Skipped:     0, Total:     2, Duration: 297 ms - ZB.MOM.WW.OtOpcUa.OpcUaServer.IntegrationTests.dll (net10.0)

scripts/validation/opcua-server-lifecycle-linux/evidence/2026-11-10-diagnostic/descriptor-controls.trx

@@ -0,0 +1,48 @@
+<?xml version="1.0" encoding="utf-8"?>
+<TestRun id="a4046507-6b54-4afc-b1d6-dbb3ad85db1c" name="@8c898f464f50 2026-11-10 18:06:02" xmlns="http://microsoft.com/schemas/VisualStudio/TeamTest/2010">
+  <Times creation="2026-11-10T18:06:02.0288408+00:00" queuing="2026-11-10T18:06:02.0288408+00:00" start="2026-11-10T18:06:01.1322717+00:00" finish="2026-11-10T18:06:02.0312051+00:00" />
+  <TestSettings name="default" id="bfdcc811-3a6d-455f-9eda-152573bdc6d9">
+    <Deployment runDeploymentRoot="_8c898f464f50_2026-11-10_18_06_02" />
+  </TestSettings>
+  <Results>
+    <UnitTestResult executionId="5dae5583-2c39-479e-9715-2339d7f6593d" testId="02aca891-6c73-5df6-4396-20f20d6490ce" testName="ZB.MOM.WW.OtOpcUa.OpcUaServer.IntegrationTests.Sdk2LifecycleSoakTests.Descriptor_probe_times_out_and_reaps_a_process_that_keeps_both_streams_open" computerName="8c898f464f50" duration="00:00:00.2676070" startTime="2026-11-10T18:06:01.6988716+00:00" endTime="2026-11-10T18:06:01.9669755+00:00" testType="13cdc9d9-ddb5-4fa4-a97d-d965ccfc6d4b" outcome="Passed" testListId="8c84fa94-04c1-424b-9868-57a2d4851a1d" relativeResultsDirectory="5dae5583-2c39-479e-9715-2339d7f6593d">
+      <Output>
+        <StdOut>Descriptor timeout control: deadlineMs=250, elapsedMs=267, childExited=True</StdOut>
+      </Output>
+    </UnitTestResult>
+    <UnitTestResult executionId="b05a5663-eb92-4c4c-993a-7236c459b1ce" testId="1d78597f-0424-4abc-5484-1d1084deba0d" testName="ZB.MOM.WW.OtOpcUa.OpcUaServer.IntegrationTests.Sdk2LifecycleSoakTests.Descriptor_probe_observes_an_open_PKI_file_through_a_symlink_alias_and_its_close" computerName="8c898f464f50" duration="00:00:00.0235426" startTime="2026-11-10T18:06:01.6695099+00:00" endTime="2026-11-10T18:06:01.6964907+00:00" testType="13cdc9d9-ddb5-4fa4-a97d-d965ccfc6d4b" outcome="Passed" testListId="8c84fa94-04c1-424b-9868-57a2d4851a1d" relativeResultsDirectory="b05a5663-eb92-4c4c-993a-7236c459b1ce">
+      <Output>
+        <StdOut>PKI descriptor control: before=0, opened=1, closed=0; siblingExcluded=true; aliasResolved=true</StdOut>
+      </Output>
+    </UnitTestResult>
+  </Results>
+  <TestDefinitions>
+    <UnitTest name="ZB.MOM.WW.OtOpcUa.OpcUaServer.IntegrationTests.Sdk2LifecycleSoakTests.Descriptor_probe_observes_an_open_PKI_file_through_a_symlink_alias_and_its_close" storage="/app/zb.mom.ww.otopcua.opcuaserver.integrationtests.dll" id="1d78597f-0424-4abc-5484-1d1084deba0d">
+      <Execution id="b05a5663-eb92-4c4c-993a-7236c459b1ce" />
+      <TestMethod codeBase="/app/ZB.MOM.WW.OtOpcUa.OpcUaServer.IntegrationTests.dll" adapterTypeName="executor://xunit/VsTestRunner3/netcore/" className="ZB.MOM.WW.OtOpcUa.OpcUaServer.IntegrationTests.Sdk2LifecycleSoakTests" name="Descriptor_probe_observes_an_open_PKI_file_through_a_symlink_alias_and_its_close" />
+    </UnitTest>
+    <UnitTest name="ZB.MOM.WW.OtOpcUa.OpcUaServer.IntegrationTests.Sdk2LifecycleSoakTests.Descriptor_probe_times_out_and_reaps_a_process_that_keeps_both_streams_open" storage="/app/zb.mom.ww.otopcua.opcuaserver.integrationtests.dll" id="02aca891-6c73-5df6-4396-20f20d6490ce">
+      <Execution id="5dae5583-2c39-479e-9715-2339d7f6593d" />
+      <TestMethod codeBase="/app/ZB.MOM.WW.OtOpcUa.OpcUaServer.IntegrationTests.dll" adapterTypeName="executor://xunit/VsTestRunner3/netcore/" className="ZB.MOM.WW.OtOpcUa.OpcUaServer.IntegrationTests.Sdk2LifecycleSoakTests" name="Descriptor_probe_times_out_and_reaps_a_process_that_keeps_both_streams_open" />
+    </UnitTest>
+  </TestDefinitions>
+  <TestEntries>
+    <TestEntry testId="02aca891-6c73-5df6-4396-20f20d6490ce" executionId="5dae5583-2c39-479e-9715-2339d7f6593d" testListId="8c84fa94-04c1-424b-9868-57a2d4851a1d" />
+    <TestEntry testId="1d78597f-0424-4abc-5484-1d1084deba0d" executionId="b05a5663-eb92-4c4c-993a-7236c459b1ce" testListId="8c84fa94-04c1-424b-9868-57a2d4851a1d" />
+  </TestEntries>
+  <TestLists>
+    <TestList name="Results Not in a List" id="8c84fa94-04c1-424b-9868-57a2d4851a1d" />
+    <TestList name="All Loaded Results" id="19431567-8539-422a-85d7-44ee4e166bda" />
+  </TestLists>
+  <ResultSummary outcome="Completed">
+    <Counters total="2" executed="2" passed="2" failed="0" error="0" timeout="0" aborted="0" inconclusive="0" passedButRunAborted="0" notRunnable="0" notExecuted="0" disconnected="0" warning="0" completed="0" inProgress="0" pending="0" />
+    <Output>
+      <StdOut>[xUnit.net 00:00:00.00] xUnit.net VSTest Adapter v3.0.2+dd36e86129 (64-bit .NET 10.0.14)
+[xUnit.net 00:00:00.08]   Discovering: ZB.MOM.WW.OtOpcUa.OpcUaServer.IntegrationTests
+[xUnit.net 00:00:00.22]   Discovered:  ZB.MOM.WW.OtOpcUa.OpcUaServer.IntegrationTests
+[xUnit.net 00:00:00.30]   Starting:    ZB.MOM.WW.OtOpcUa.OpcUaServer.IntegrationTests
+[xUnit.net 00:00:00.64]   Finished:    ZB.MOM.WW.OtOpcUa.OpcUaServer.IntegrationTests
+</StdOut>
+    </Output>
+  </ResultSummary>
+</TestRun>

scripts/validation/opcua-server-lifecycle-linux/evidence/2026-11-10-diagnostic/full-duration-guard.log

@@ -0,0 +1,3 @@
+usage: run.py [-h] --output OUTPUT [--duration DURATION] [--full]
+              [--published-app PUBLISHED_APP] [--image IMAGE]
+run.py: error: full requires duration >=7200; diagnostic requires 60..120 seconds

scripts/validation/opcua-server-lifecycle-linux/evidence/2026-11-10-diagnostic/linux-precheck.txt

@@ -0,0 +1 @@
+kernel=Linux machine=aarch64 tmp=/task/tmp procfs=yes

scripts/validation/opcua-server-lifecycle-linux/evidence/2026-11-10-diagnostic/linux-runtime-process.txt

@@ -0,0 +1,6 @@
+testProcessId=196
+actualExecutable=/app/ZB.MOM.WW.OtOpcUa.OpcUaServer.IntegrationTests
+/app/System.Private.CoreLib.dll
+/app/libcoreclr.so
+/app/libhostfxr.so
+/app/libhostpolicy.so

scripts/validation/opcua-server-lifecycle-linux/evidence/2026-11-10-diagnostic/publish-receipt.json

@@ -0,0 +1,29 @@
+{
+  "sourceRevision": "74c938f37cbb9cf08b6ca72e4effc511120dc274",
+  "command": [
+    "dotnet",
+    "publish",
+    "/Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/tests/Server/ZB.MOM.WW.OtOpcUa.OpcUaServer.IntegrationTests/ZB.MOM.WW.OtOpcUa.OpcUaServer.IntegrationTests.csproj",
+    "-c",
+    "Release",
+    "-r",
+    "linux-arm64",
+    "--self-contained",
+    "true",
+    "-p:RuntimeFrameworkVersion=10.0.14",
+    "-p:PublishSingleFile=false",
+    "-p:PublishTrimmed=false",
+    "-p:UseAppHost=true",
+    "--artifacts-path",
+    "/tmp/opcua2-server-linux-diagnostic-20261110a/build-artifacts",
+    "-o",
+    "/tmp/opcua2-server-linux-diagnostic-20261110a/app",
+    "-m:1",
+    "--nologo"
+  ],
+  "hostDotnet": ".NET SDK:\n Version:           10.0.403\n Commit:            5a2162bea6\n Workload version:  10.0.400-manifests.a00bebb6\n MSBuild version:   18.9.15+5a2162bea\n\nRuntime Environment:\n OS Name:     Mac OS X\n OS Version:  26.5\n OS Platform: Darwin\n RID:         osx-arm64\n Base Path:   /opt/homebrew/Cellar/dotnet/10.0.403/libexec/sdk/10.0.403/\n\n.NET workloads installed:\nThere are no installed workloads to display.\nConfigured to use workload sets when installing new manifests.\nNo workload sets are installed. Run \"dotnet workload restore\" to install a workload set.\n\nHost:\n  Version:      10.0.14\n  Architecture: arm64\n  Commit:       0427b9abbe\n\n.NET SDKs installed:\n  10.0.403 [/opt/homebrew/Cellar/dotnet/10.0.403/libexec/sdk]\n\n.NET runtimes installed:\n  Microsoft.AspNetCore.App 10.0.14 [/opt/homebrew/Cellar/dotnet/10.0.403/libexec/shared/Microsoft.AspNetCore.App]\n  Microsoft.NETCore.App 10.0.14 [/opt/homebrew/Cellar/dotnet/10.0.403/libexec/shared/Microsoft.NETCore.App]\n\nOther architectures found:\n  None\n\nEnvironment variables:\n  DOTNET_ROOT                              [/opt/homebrew/Cellar/dotnet/10.0.403/libexec]\n\nglobal.json file:\n  /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/global.json\n\nLearn more:\n  https://aka.ms/dotnet/info\n\nDownload .NET:\n  https://aka.ms/dotnet/download\n",
+  "testSourceSha256": "e695783e05787d94bf5d167b25b1c48b446b800c28259f023c28ed6012d737d1",
+  "apphostSha256": "97531b8005df9dc8b129d2b22ba2049cf572d5d970046f7e8644ec632e860032",
+  "testAssemblySha256": "9d64b5b3dd9bf7eff38f6fabe10382c107ab824485a309ba9649bfee9bbd843a",
+  "publishExitCode": 0
+}

scripts/validation/opcua-server-lifecycle-linux/evidence/2026-11-10-diagnostic/publish.log

@@ -0,0 +1,121 @@
+
+  Determining projects to restore...
+  Restored /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Core/ZB.MOM.WW.OtOpcUa.Core.Abstractions/ZB.MOM.WW.OtOpcUa.Core.Abstractions.csproj (in 490 ms).
+  Restored /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.TwinCAT.Contracts/ZB.MOM.WW.OtOpcUa.Driver.TwinCAT.Contracts.csproj (in 494 ms).
+  Restored /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.MTConnect.Contracts/ZB.MOM.WW.OtOpcUa.Driver.MTConnect.Contracts.csproj (in 494 ms).
+  Restored /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Modbus.Contracts/ZB.MOM.WW.OtOpcUa.Driver.Modbus.Contracts.csproj (in 2 ms).
+  Restored /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Modbus.Addressing/ZB.MOM.WW.OtOpcUa.Driver.Modbus.Addressing.csproj (in 4 ms).
+  Restored /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.Session/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.Session.csproj (in 569 ms).
+  Restored /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Tooling/ZB.MOM.WW.OtOpcUa.Analyzers/ZB.MOM.WW.OtOpcUa.Analyzers.csproj (in 574 ms).
+  Restored /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Calculation.Contracts/ZB.MOM.WW.OtOpcUa.Driver.Calculation.Contracts.csproj (in 1 ms).
+  Restored /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Core/ZB.MOM.WW.OtOpcUa.Core.Scripting.OutOfProcess/ZB.MOM.WW.OtOpcUa.Core.Scripting.OutOfProcess.csproj (in 591 ms).
+  Restored /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Server/ZB.MOM.WW.OtOpcUa.ScriptWorker/ZB.MOM.WW.OtOpcUa.ScriptWorker.csproj (in 589 ms).
+  Restored /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Ab.Transport/ZB.MOM.WW.OtOpcUa.Driver.Ab.Transport.csproj (in 6 ms).
+  Restored /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.AbCip.Contracts/ZB.MOM.WW.OtOpcUa.Driver.AbCip.Contracts.csproj (in 6 ms).
+  Restored /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Server/ZB.MOM.WW.OtOpcUa.Security/ZB.MOM.WW.OtOpcUa.Security.csproj (in 605 ms).
+  Restored /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.Contracts/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.Contracts.csproj (in 2 ms).
+  Restored /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.AbLegacy/ZB.MOM.WW.OtOpcUa.Driver.AbLegacy.csproj (in 36 ms).
+  Restored /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Calculation/ZB.MOM.WW.OtOpcUa.Driver.Calculation.csproj (in 101 ms).
+  Restored /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Galaxy/ZB.MOM.WW.OtOpcUa.Driver.Galaxy.csproj (in 107 ms).
+  Restored /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.AbCip/ZB.MOM.WW.OtOpcUa.Driver.AbCip.csproj (in 31 ms).
+  Restored /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Server/ZB.MOM.WW.OtOpcUa.OpcUaServer/ZB.MOM.WW.OtOpcUa.OpcUaServer.csproj (in 613 ms).
+  Restored /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Contracts/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Contracts.csproj (in 9 ms).
+  Restored /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Transport/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Transport.csproj (in 10 ms).
+  Restored /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Core/ZB.MOM.WW.OtOpcUa.Core.Scripting.Protocol/ZB.MOM.WW.OtOpcUa.Core.Scripting.Protocol.csproj (in 6 ms).
+  Restored /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Browser/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Browser.csproj (in 19 ms).
+  Restored /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Core/ZB.MOM.WW.OtOpcUa.Core/ZB.MOM.WW.OtOpcUa.Core.csproj (in 30 ms).
+  Restored /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.Browser/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.Browser.csproj (in 27 ms).
+  Restored /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Core/ZB.MOM.WW.OtOpcUa.Core.Scripting.Abstractions/ZB.MOM.WW.OtOpcUa.Core.Scripting.Abstractions.csproj (in 2 ms).
+  Restored /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Server/ZB.MOM.WW.OtOpcUa.Runtime/ZB.MOM.WW.OtOpcUa.Runtime.csproj (in 651 ms).
+  Restored /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Core/ZB.MOM.WW.OtOpcUa.Core.VirtualTags/ZB.MOM.WW.OtOpcUa.Core.VirtualTags.csproj (in 12 ms).
+  Restored /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Core/ZB.MOM.WW.OtOpcUa.Core.Scripting/ZB.MOM.WW.OtOpcUa.Core.Scripting.csproj (in 12 ms).
+  Restored /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Core/ZB.MOM.WW.OtOpcUa.Commons/ZB.MOM.WW.OtOpcUa.Commons.csproj (in 4 ms).
+  Restored /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.MTConnect/ZB.MOM.WW.OtOpcUa.Driver.MTConnect.csproj (in 33 ms).
+  Restored /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Historian.QuestDb/ZB.MOM.WW.OtOpcUa.Driver.Historian.QuestDb.csproj (in 656 ms).
+  Restored /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Historian.Gateway/ZB.MOM.WW.OtOpcUa.Driver.Historian.Gateway.csproj (in 655 ms).
+  Restored /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Historian.SqlServer/ZB.MOM.WW.OtOpcUa.Driver.Historian.SqlServer.csproj (in 144 ms).
+  Restored /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.csproj (in 36 ms).
+  Restored /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Core/ZB.MOM.WW.OtOpcUa.Core.ScriptedAlarms/ZB.MOM.WW.OtOpcUa.Core.ScriptedAlarms.csproj (in 11 ms).
+  Restored /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Sql.Contracts/ZB.MOM.WW.OtOpcUa.Driver.Sql.Contracts.csproj (in 6 ms).
+  Restored /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Client/ZB.MOM.WW.OtOpcUa.Client.Shared/ZB.MOM.WW.OtOpcUa.Client.Shared.csproj (in 11 ms).
+  Restored /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.AbLegacy.Contracts/ZB.MOM.WW.OtOpcUa.Driver.AbLegacy.Contracts.csproj (in 2 ms).
+  Restored /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.S7.Contracts/ZB.MOM.WW.OtOpcUa.Driver.S7.Contracts.csproj (in 2 ms).
+  Restored /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Core/ZB.MOM.WW.OtOpcUa.Core.AlarmHistorian/ZB.MOM.WW.OtOpcUa.Core.AlarmHistorian.csproj (in 44 ms).
+  Restored /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Core/ZB.MOM.WW.OtOpcUa.Cluster/ZB.MOM.WW.OtOpcUa.Cluster.csproj (in 45 ms).
+  Restored /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Contracts/ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Contracts.csproj (in 6 ms).
+  Restored /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Sql.Browser/ZB.MOM.WW.OtOpcUa.Driver.Sql.Browser.csproj (in 36 ms).
+  Restored /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Historian.Sql.Common/ZB.MOM.WW.OtOpcUa.Driver.Historian.Sql.Common.csproj (in 10 ms).
+  Restored /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Sql/ZB.MOM.WW.OtOpcUa.Driver.Sql.csproj (in 50 ms).
+  Restored /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Sql.Dialect/ZB.MOM.WW.OtOpcUa.Driver.Sql.Dialect.csproj (in 66 ms).
+  Restored /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Server/ZB.MOM.WW.OtOpcUa.ControlPlane/ZB.MOM.WW.OtOpcUa.ControlPlane.csproj (in 53 ms).
+  Restored /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.FOCAS.Contracts/ZB.MOM.WW.OtOpcUa.Driver.FOCAS.Contracts.csproj (in 3 ms).
+  Restored /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Modbus/ZB.MOM.WW.OtOpcUa.Driver.Modbus.csproj (in 41 ms).
+  Restored /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Browser/ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Browser.csproj (in 9 ms).
+  Restored /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.S7/ZB.MOM.WW.OtOpcUa.Driver.S7.csproj (in 49 ms).
+  Restored /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Core/ZB.MOM.WW.OtOpcUa.Configuration/ZB.MOM.WW.OtOpcUa.Configuration.csproj (in 92 ms).
+  Restored /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.csproj (in 51 ms).
+  Restored /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.TwinCAT/ZB.MOM.WW.OtOpcUa.Driver.TwinCAT.csproj (in 86 ms).
+  Restored /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.FOCAS/ZB.MOM.WW.OtOpcUa.Driver.FOCAS.csproj (in 24 ms).
+  Restored /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Server/ZB.MOM.WW.OtOpcUa.AdminUI/ZB.MOM.WW.OtOpcUa.AdminUI.csproj (in 89 ms).
+  Restored /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Server/ZB.MOM.WW.OtOpcUa.Host/ZB.MOM.WW.OtOpcUa.Host.csproj (in 784 ms).
+  Restored /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/tests/Server/ZB.MOM.WW.OtOpcUa.OpcUaServer.IntegrationTests/ZB.MOM.WW.OtOpcUa.OpcUaServer.IntegrationTests.csproj (in 793 ms).
+  ZB.MOM.WW.OtOpcUa.Analyzers -> /tmp/opcua2-server-linux-diagnostic-20261110a/build-artifacts/bin/ZB.MOM.WW.OtOpcUa.Analyzers/release/ZB.MOM.WW.OtOpcUa.Analyzers.dll
+  ZB.MOM.WW.OtOpcUa.Core.Abstractions -> /tmp/opcua2-server-linux-diagnostic-20261110a/build-artifacts/bin/ZB.MOM.WW.OtOpcUa.Core.Abstractions/release/ZB.MOM.WW.OtOpcUa.Core.Abstractions.dll
+  ZB.MOM.WW.OtOpcUa.Commons -> /tmp/opcua2-server-linux-diagnostic-20261110a/build-artifacts/bin/ZB.MOM.WW.OtOpcUa.Commons/release/ZB.MOM.WW.OtOpcUa.Commons.dll
+  ZB.MOM.WW.OtOpcUa.Core.Scripting.Abstractions -> /tmp/opcua2-server-linux-diagnostic-20261110a/build-artifacts/bin/ZB.MOM.WW.OtOpcUa.Core.Scripting.Abstractions/release/ZB.MOM.WW.OtOpcUa.Core.Scripting.Abstractions.dll
+  ZB.MOM.WW.OtOpcUa.Core.Scripting -> /tmp/opcua2-server-linux-diagnostic-20261110a/build-artifacts/bin/ZB.MOM.WW.OtOpcUa.Core.Scripting/release/ZB.MOM.WW.OtOpcUa.Core.Scripting.dll
+  ZB.MOM.WW.OtOpcUa.Core.VirtualTags -> /tmp/opcua2-server-linux-diagnostic-20261110a/build-artifacts/bin/ZB.MOM.WW.OtOpcUa.Core.VirtualTags/release/ZB.MOM.WW.OtOpcUa.Core.VirtualTags.dll
+  ZB.MOM.WW.OtOpcUa.Driver.Sql.Contracts -> /tmp/opcua2-server-linux-diagnostic-20261110a/build-artifacts/bin/ZB.MOM.WW.OtOpcUa.Driver.Sql.Contracts/release/ZB.MOM.WW.OtOpcUa.Driver.Sql.Contracts.dll
+  ZB.MOM.WW.OtOpcUa.Configuration -> /tmp/opcua2-server-linux-diagnostic-20261110a/build-artifacts/bin/ZB.MOM.WW.OtOpcUa.Configuration/release/ZB.MOM.WW.OtOpcUa.Configuration.dll
+  ZB.MOM.WW.OtOpcUa.Core -> /tmp/opcua2-server-linux-diagnostic-20261110a/build-artifacts/bin/ZB.MOM.WW.OtOpcUa.Core/release/ZB.MOM.WW.OtOpcUa.Core.dll
+  ZB.MOM.WW.OtOpcUa.OpcUaServer -> /tmp/opcua2-server-linux-diagnostic-20261110a/build-artifacts/bin/ZB.MOM.WW.OtOpcUa.OpcUaServer/release/ZB.MOM.WW.OtOpcUa.OpcUaServer.dll
+  ZB.MOM.WW.OtOpcUa.Cluster -> /tmp/opcua2-server-linux-diagnostic-20261110a/build-artifacts/bin/ZB.MOM.WW.OtOpcUa.Cluster/release/ZB.MOM.WW.OtOpcUa.Cluster.dll
+  ZB.MOM.WW.OtOpcUa.Core.Scripting.Protocol -> /tmp/opcua2-server-linux-diagnostic-20261110a/build-artifacts/bin/ZB.MOM.WW.OtOpcUa.Core.Scripting.Protocol/release/ZB.MOM.WW.OtOpcUa.Core.Scripting.Protocol.dll
+  ZB.MOM.WW.OtOpcUa.Core.Scripting.OutOfProcess -> /tmp/opcua2-server-linux-diagnostic-20261110a/build-artifacts/bin/ZB.MOM.WW.OtOpcUa.Core.Scripting.OutOfProcess/release/ZB.MOM.WW.OtOpcUa.Core.Scripting.OutOfProcess.dll
+  ZB.MOM.WW.OtOpcUa.Core.ScriptedAlarms -> /tmp/opcua2-server-linux-diagnostic-20261110a/build-artifacts/bin/ZB.MOM.WW.OtOpcUa.Core.ScriptedAlarms/release/ZB.MOM.WW.OtOpcUa.Core.ScriptedAlarms.dll
+  ZB.MOM.WW.OtOpcUa.Security -> /tmp/opcua2-server-linux-diagnostic-20261110a/build-artifacts/bin/ZB.MOM.WW.OtOpcUa.Security/release/ZB.MOM.WW.OtOpcUa.Security.dll
+  ZB.MOM.WW.OtOpcUa.Driver.Modbus.Addressing -> /tmp/opcua2-server-linux-diagnostic-20261110a/build-artifacts/bin/ZB.MOM.WW.OtOpcUa.Driver.Modbus.Addressing/release/ZB.MOM.WW.OtOpcUa.Driver.Modbus.Addressing.dll
+  ZB.MOM.WW.OtOpcUa.Driver.Modbus.Contracts -> /tmp/opcua2-server-linux-diagnostic-20261110a/build-artifacts/bin/ZB.MOM.WW.OtOpcUa.Driver.Modbus.Contracts/release/ZB.MOM.WW.OtOpcUa.Driver.Modbus.Contracts.dll
+  ZB.MOM.WW.OtOpcUa.Driver.S7.Contracts -> /tmp/opcua2-server-linux-diagnostic-20261110a/build-artifacts/bin/ZB.MOM.WW.OtOpcUa.Driver.S7.Contracts/release/ZB.MOM.WW.OtOpcUa.Driver.S7.Contracts.dll
+  ZB.MOM.WW.OtOpcUa.Driver.AbCip.Contracts -> /tmp/opcua2-server-linux-diagnostic-20261110a/build-artifacts/bin/ZB.MOM.WW.OtOpcUa.Driver.AbCip.Contracts/release/ZB.MOM.WW.OtOpcUa.Driver.AbCip.Contracts.dll
+  ZB.MOM.WW.OtOpcUa.Driver.AbLegacy.Contracts -> /tmp/opcua2-server-linux-diagnostic-20261110a/build-artifacts/bin/ZB.MOM.WW.OtOpcUa.Driver.AbLegacy.Contracts/release/ZB.MOM.WW.OtOpcUa.Driver.AbLegacy.Contracts.dll
+  ZB.MOM.WW.OtOpcUa.Driver.TwinCAT.Contracts -> /tmp/opcua2-server-linux-diagnostic-20261110a/build-artifacts/bin/ZB.MOM.WW.OtOpcUa.Driver.TwinCAT.Contracts/release/ZB.MOM.WW.OtOpcUa.Driver.TwinCAT.Contracts.dll
+  ZB.MOM.WW.OtOpcUa.Driver.FOCAS.Contracts -> /tmp/opcua2-server-linux-diagnostic-20261110a/build-artifacts/bin/ZB.MOM.WW.OtOpcUa.Driver.FOCAS.Contracts/release/ZB.MOM.WW.OtOpcUa.Driver.FOCAS.Contracts.dll
+  ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Contracts -> /tmp/opcua2-server-linux-diagnostic-20261110a/build-artifacts/bin/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Contracts/release/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Contracts.dll
+  ZB.MOM.WW.OtOpcUa.Driver.MTConnect.Contracts -> /tmp/opcua2-server-linux-diagnostic-20261110a/build-artifacts/bin/ZB.MOM.WW.OtOpcUa.Driver.MTConnect.Contracts/release/ZB.MOM.WW.OtOpcUa.Driver.MTConnect.Contracts.dll
+  ZB.MOM.WW.OtOpcUa.Driver.Calculation.Contracts -> /tmp/opcua2-server-linux-diagnostic-20261110a/build-artifacts/bin/ZB.MOM.WW.OtOpcUa.Driver.Calculation.Contracts/release/ZB.MOM.WW.OtOpcUa.Driver.Calculation.Contracts.dll
+  ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.Contracts -> /tmp/opcua2-server-linux-diagnostic-20261110a/build-artifacts/bin/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.Contracts/release/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.Contracts.dll
+  ZB.MOM.WW.OtOpcUa.ControlPlane -> /tmp/opcua2-server-linux-diagnostic-20261110a/build-artifacts/bin/ZB.MOM.WW.OtOpcUa.ControlPlane/release/ZB.MOM.WW.OtOpcUa.ControlPlane.dll
+  ZB.MOM.WW.OtOpcUa.Core.AlarmHistorian -> /tmp/opcua2-server-linux-diagnostic-20261110a/build-artifacts/bin/ZB.MOM.WW.OtOpcUa.Core.AlarmHistorian/release/ZB.MOM.WW.OtOpcUa.Core.AlarmHistorian.dll
+  ZB.MOM.WW.OtOpcUa.Runtime -> /tmp/opcua2-server-linux-diagnostic-20261110a/build-artifacts/bin/ZB.MOM.WW.OtOpcUa.Runtime/release/ZB.MOM.WW.OtOpcUa.Runtime.dll
+  ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Contracts -> /tmp/opcua2-server-linux-diagnostic-20261110a/build-artifacts/bin/ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Contracts/release/ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Contracts.dll
+  ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.Session -> /tmp/opcua2-server-linux-diagnostic-20261110a/build-artifacts/bin/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.Session/release/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.Session.dll
+  ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.Browser -> /tmp/opcua2-server-linux-diagnostic-20261110a/build-artifacts/bin/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.Browser/release/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.Browser.dll
+  ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Browser -> /tmp/opcua2-server-linux-diagnostic-20261110a/build-artifacts/bin/ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Browser/release/ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Browser.dll
+  ZB.MOM.WW.OtOpcUa.Driver.Sql.Dialect -> /tmp/opcua2-server-linux-diagnostic-20261110a/build-artifacts/bin/ZB.MOM.WW.OtOpcUa.Driver.Sql.Dialect/release/ZB.MOM.WW.OtOpcUa.Driver.Sql.Dialect.dll
+  ZB.MOM.WW.OtOpcUa.Driver.Sql.Browser -> /tmp/opcua2-server-linux-diagnostic-20261110a/build-artifacts/bin/ZB.MOM.WW.OtOpcUa.Driver.Sql.Browser/release/ZB.MOM.WW.OtOpcUa.Driver.Sql.Browser.dll
+  ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Transport -> /tmp/opcua2-server-linux-diagnostic-20261110a/build-artifacts/bin/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Transport/release/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Transport.dll
+  ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Browser -> /tmp/opcua2-server-linux-diagnostic-20261110a/build-artifacts/bin/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Browser/release/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Browser.dll
+  ZB.MOM.WW.OtOpcUa.AdminUI -> /tmp/opcua2-server-linux-diagnostic-20261110a/build-artifacts/bin/ZB.MOM.WW.OtOpcUa.AdminUI/release/ZB.MOM.WW.OtOpcUa.AdminUI.dll
+  ZB.MOM.WW.OtOpcUa.Driver.Ab.Transport -> /tmp/opcua2-server-linux-diagnostic-20261110a/build-artifacts/bin/ZB.MOM.WW.OtOpcUa.Driver.Ab.Transport/release/ZB.MOM.WW.OtOpcUa.Driver.Ab.Transport.dll
+  ZB.MOM.WW.OtOpcUa.Driver.AbCip -> /tmp/opcua2-server-linux-diagnostic-20261110a/build-artifacts/bin/ZB.MOM.WW.OtOpcUa.Driver.AbCip/release/ZB.MOM.WW.OtOpcUa.Driver.AbCip.dll
+  ZB.MOM.WW.OtOpcUa.Driver.AbLegacy -> /tmp/opcua2-server-linux-diagnostic-20261110a/build-artifacts/bin/ZB.MOM.WW.OtOpcUa.Driver.AbLegacy/release/ZB.MOM.WW.OtOpcUa.Driver.AbLegacy.dll
+  ZB.MOM.WW.OtOpcUa.Driver.Calculation -> /tmp/opcua2-server-linux-diagnostic-20261110a/build-artifacts/bin/ZB.MOM.WW.OtOpcUa.Driver.Calculation/release/ZB.MOM.WW.OtOpcUa.Driver.Calculation.dll
+  ZB.MOM.WW.OtOpcUa.Driver.FOCAS -> /tmp/opcua2-server-linux-diagnostic-20261110a/build-artifacts/bin/ZB.MOM.WW.OtOpcUa.Driver.FOCAS/release/ZB.MOM.WW.OtOpcUa.Driver.FOCAS.dll
+  ZB.MOM.WW.OtOpcUa.Driver.Galaxy -> /tmp/opcua2-server-linux-diagnostic-20261110a/build-artifacts/bin/ZB.MOM.WW.OtOpcUa.Driver.Galaxy/release/ZB.MOM.WW.OtOpcUa.Driver.Galaxy.dll
+  ZB.MOM.WW.OtOpcUa.Driver.Historian.Sql.Common -> /tmp/opcua2-server-linux-diagnostic-20261110a/build-artifacts/bin/ZB.MOM.WW.OtOpcUa.Driver.Historian.Sql.Common/release/ZB.MOM.WW.OtOpcUa.Driver.Historian.Sql.Common.dll
+  ZB.MOM.WW.OtOpcUa.Driver.Historian.Gateway -> /tmp/opcua2-server-linux-diagnostic-20261110a/build-artifacts/bin/ZB.MOM.WW.OtOpcUa.Driver.Historian.Gateway/release/ZB.MOM.WW.OtOpcUa.Driver.Historian.Gateway.dll
+  ZB.MOM.WW.OtOpcUa.Driver.Historian.SqlServer -> /tmp/opcua2-server-linux-diagnostic-20261110a/build-artifacts/bin/ZB.MOM.WW.OtOpcUa.Driver.Historian.SqlServer/release/ZB.MOM.WW.OtOpcUa.Driver.Historian.SqlServer.dll
+  ZB.MOM.WW.OtOpcUa.Driver.Historian.QuestDb -> /tmp/opcua2-server-linux-diagnostic-20261110a/build-artifacts/bin/ZB.MOM.WW.OtOpcUa.Driver.Historian.QuestDb/release/ZB.MOM.WW.OtOpcUa.Driver.Historian.QuestDb.dll
+  ZB.MOM.WW.OtOpcUa.Driver.Modbus -> /tmp/opcua2-server-linux-diagnostic-20261110a/build-artifacts/bin/ZB.MOM.WW.OtOpcUa.Driver.Modbus/release/ZB.MOM.WW.OtOpcUa.Driver.Modbus.dll
+  ZB.MOM.WW.OtOpcUa.Driver.Mqtt -> /tmp/opcua2-server-linux-diagnostic-20261110a/build-artifacts/bin/ZB.MOM.WW.OtOpcUa.Driver.Mqtt/release/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.dll
+  ZB.MOM.WW.OtOpcUa.Driver.MTConnect -> /tmp/opcua2-server-linux-diagnostic-20261110a/build-artifacts/bin/ZB.MOM.WW.OtOpcUa.Driver.MTConnect/release/ZB.MOM.WW.OtOpcUa.Driver.MTConnect.dll
+  ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient -> /tmp/opcua2-server-linux-diagnostic-20261110a/build-artifacts/bin/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient/release/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.dll
+  ZB.MOM.WW.OtOpcUa.Driver.S7 -> /tmp/opcua2-server-linux-diagnostic-20261110a/build-artifacts/bin/ZB.MOM.WW.OtOpcUa.Driver.S7/release/ZB.MOM.WW.OtOpcUa.Driver.S7.dll
+  ZB.MOM.WW.OtOpcUa.Driver.Sql -> /tmp/opcua2-server-linux-diagnostic-20261110a/build-artifacts/bin/ZB.MOM.WW.OtOpcUa.Driver.Sql/release/ZB.MOM.WW.OtOpcUa.Driver.Sql.dll
+  ZB.MOM.WW.OtOpcUa.Driver.TwinCAT -> /tmp/opcua2-server-linux-diagnostic-20261110a/build-artifacts/bin/ZB.MOM.WW.OtOpcUa.Driver.TwinCAT/release/ZB.MOM.WW.OtOpcUa.Driver.TwinCAT.dll
+  ZB.MOM.WW.OtOpcUa.ScriptWorker -> /tmp/opcua2-server-linux-diagnostic-20261110a/build-artifacts/bin/ZB.MOM.WW.OtOpcUa.ScriptWorker/release_linux-arm64/ZB.MOM.WW.OtOpcUa.ScriptWorker.dll
+  ZB.MOM.WW.OtOpcUa.Host -> /tmp/opcua2-server-linux-diagnostic-20261110a/build-artifacts/bin/ZB.MOM.WW.OtOpcUa.Host/release_linux-arm64/OtOpcUa.Host.dll
+  ZB.MOM.WW.OtOpcUa.Client.Shared -> /tmp/opcua2-server-linux-diagnostic-20261110a/build-artifacts/bin/ZB.MOM.WW.OtOpcUa.Client.Shared/release/ZB.MOM.WW.OtOpcUa.Client.Shared.dll
+  ZB.MOM.WW.OtOpcUa.OpcUaServer.IntegrationTests -> /tmp/opcua2-server-linux-diagnostic-20261110a/build-artifacts/bin/ZB.MOM.WW.OtOpcUa.OpcUaServer.IntegrationTests/release_linux-arm64/ZB.MOM.WW.OtOpcUa.OpcUaServer.IntegrationTests.dll
+  ZB.MOM.WW.OtOpcUa.OpcUaServer.IntegrationTests -> /tmp/opcua2-server-linux-diagnostic-20261110a/app/

scripts/validation/opcua-server-lifecycle-linux/evidence/2026-11-10-diagnostic/result.json

@@ -0,0 +1,160 @@
+{
+  "status": "passed",
+  "containerExitCode": 0,
+  "containerElapsedSeconds": 95.26570125005674,
+  "descriptorControls": {
+    "counts": {
+      "total": "2",
+      "executed": "2",
+      "passed": "2",
+      "failed": "0",
+      "error": "0",
+      "timeout": "0",
+      "aborted": "0",
+      "inconclusive": "0",
+      "passedButRunAborted": "0",
+      "notRunnable": "0",
+      "notExecuted": "0",
+      "disconnected": "0",
+      "warning": "0",
+      "completed": "0",
+      "inProgress": "0",
+      "pending": "0"
+    },
+    "tests": [
+      "ZB.MOM.WW.OtOpcUa.OpcUaServer.IntegrationTests.Sdk2LifecycleSoakTests.Descriptor_probe_times_out_and_reaps_a_process_that_keeps_both_streams_open",
+      "ZB.MOM.WW.OtOpcUa.OpcUaServer.IntegrationTests.Sdk2LifecycleSoakTests.Descriptor_probe_observes_an_open_PKI_file_through_a_symlink_alias_and_its_close"
+    ]
+  },
+  "soakTest": {
+    "counts": {
+      "total": "1",
+      "executed": "1",
+      "passed": "1",
+      "failed": "0",
+      "error": "0",
+      "timeout": "0",
+      "aborted": "0",
+      "inconclusive": "0",
+      "passedButRunAborted": "0",
+      "notRunnable": "0",
+      "notExecuted": "0",
+      "disconnected": "0",
+      "warning": "0",
+      "completed": "0",
+      "inProgress": "0",
+      "pending": "0"
+    },
+    "tests": [
+      "ZB.MOM.WW.OtOpcUa.OpcUaServer.IntegrationTests.Sdk2LifecycleSoakTests.Repeated_lifecycles_return_resources_to_a_steady_baseline"
+    ]
+  },
+  "evidence": {
+    "start": {
+      "kind": "start",
+      "utc": "2026-11-10T18:06:04.0984012+00:00",
+      "processId": 196,
+      "mode": "diagnostic",
+      "requestedSeconds": 90,
+      "minimumFullSeconds": 7200,
+      "build": "74c938f37cbb9cf08b6ca72e4effc511120dc274",
+      "sdk": "2.0.1+07e62f72500cc0923a2bab940653c8c1116fa286",
+      "diagnosticInstrumentation": "SDK2.0.1 CP lists and certificate-validation cached stores; read-only",
+      "limits": {
+        "retainedManagedGrowthBytes": 67108864,
+        "rssGrowthBytes": 134217728,
+        "fdGrowth": 32
+      },
+      "coverage": "encrypted sessions; scalar/Int16[] Raw+UNS; subscription removal; browse abandonment; history release/cross-session/close; surgical changes/rebuild; revocation; paused TCP read/recovery; same-PKI restart"
+    },
+    "complete": {
+      "kind": "complete",
+      "utc": "2026-11-10T18:07:35.7007963+00:00",
+      "mode": "diagnostic",
+      "cycles": 25,
+      "restarts": 6,
+      "seconds": 91.6023965,
+      "satisfiesTwoHourDuration": false
+    },
+    "rowCounts": {
+      "active": 25,
+      "complete": 1,
+      "network-stall-recovered": 25,
+      "quiescent": 25,
+      "restart": 6,
+      "start": 1
+    },
+    "firstResources": {
+      "Cycle": 1,
+      "Seconds": 2.6710051,
+      "Sessions": 0,
+      "Subscriptions": 0,
+      "Items": 0,
+      "BrowsePoints": 0,
+      "HistoryPoints": 0,
+      "LiveDataItems": 0,
+      "LiveEventItems": 0,
+      "MonitoredNodes": 0,
+      "Variables": 19,
+      "Folders": 4,
+      "Conditions": 1,
+      "CachedCertificateStores": 2,
+      "Descriptors": 187,
+      "PkiDescriptors": 0,
+      "ManagedBytes": 19828144,
+      "RssBytes": 207749120,
+      "AllocatedBytes": 45697696,
+      "Gen0": 3,
+      "Gen1": 2,
+      "Gen2": 2
+    },
+    "baselineResources": {
+      "Cycle": 3,
+      "Seconds": 7.466919,
+      "Sessions": 0,
+      "Subscriptions": 0,
+      "Items": 0,
+      "BrowsePoints": 0,
+      "HistoryPoints": 0,
+      "LiveDataItems": 0,
+      "LiveEventItems": 0,
+      "MonitoredNodes": 0,
+      "Variables": 19,
+      "Folders": 4,
+      "Conditions": 1,
+      "CachedCertificateStores": 2,
+      "Descriptors": 188,
+      "PkiDescriptors": 0,
+      "ManagedBytes": 20404584,
+      "RssBytes": 212303872,
+      "AllocatedBytes": 52268352,
+      "Gen0": 7,
+      "Gen1": 6,
+      "Gen2": 6
+    },
+    "lastResources": {
+      "Cycle": 25,
+      "Seconds": 91.5753658,
+      "Sessions": 0,
+      "Subscriptions": 0,
+      "Items": 0,
+      "BrowsePoints": 0,
+      "HistoryPoints": 0,
+      "LiveDataItems": 0,
+      "LiveEventItems": 0,
+      "MonitoredNodes": 0,
+      "Variables": 19,
+      "Folders": 4,
+      "Conditions": 1,
+      "CachedCertificateStores": 2,
+      "Descriptors": 190,
+      "PkiDescriptors": 0,
+      "ManagedBytes": 20259504,
+      "RssBytes": 266043392,
+      "AllocatedBytes": 349723432,
+      "Gen0": 57,
+      "Gen1": 50,
+      "Gen2": 50
+    }
+  }
+}

scripts/validation/opcua-server-lifecycle-linux/evidence/2026-11-10-diagnostic/soak.jsonl

@@ -0,0 +1,83 @@
+{"kind":"start","utc":"2026-11-10T18:06:04.0984012+00:00","processId":196,"mode":"diagnostic","requestedSeconds":90,"minimumFullSeconds":7200,"build":"74c938f37cbb9cf08b6ca72e4effc511120dc274","sdk":"2.0.1\u002B07e62f72500cc0923a2bab940653c8c1116fa286","diagnosticInstrumentation":"SDK2.0.1 CP lists and certificate-validation cached stores; read-only","limits":{"retainedManagedGrowthBytes":67108864,"rssGrowthBytes":134217728,"fdGrowth":32},"coverage":"encrypted sessions; scalar/Int16[] Raw\u002BUNS; subscription removal; browse abandonment; history release/cross-session/close; surgical changes/rebuild; revocation; paused TCP read/recovery; same-PKI restart"}
+{"kind":"active","cycle":1,"sessions":2,"subscriptions":1,"items":3,"browsePoints":1,"historyPoints":6}
+{"kind":"network-stall-recovered","cycle":1,"status":"BadRequestInterrupted","seconds":1.0480969}
+{"kind":"quiescent","cycleSeconds":2.6930539,"resources":{"Cycle":1,"Seconds":2.6710051,"Sessions":0,"Subscriptions":0,"Items":0,"BrowsePoints":0,"HistoryPoints":0,"LiveDataItems":0,"LiveEventItems":0,"MonitoredNodes":0,"Variables":19,"Folders":4,"Conditions":1,"CachedCertificateStores":2,"Descriptors":187,"PkiDescriptors":0,"ManagedBytes":19828144,"RssBytes":207749120,"AllocatedBytes":45697696,"Gen0":3,"Gen1":2,"Gen2":2}}
+{"kind":"active","cycle":2,"sessions":2,"subscriptions":1,"items":3,"browsePoints":1,"historyPoints":6}
+{"kind":"network-stall-recovered","cycle":2,"status":"BadRequestInterrupted","seconds":1.0446531}
+{"kind":"quiescent","cycleSeconds":2.4080887,"resources":{"Cycle":2,"Seconds":5.1027619,"Sessions":0,"Subscriptions":0,"Items":0,"BrowsePoints":0,"HistoryPoints":0,"LiveDataItems":0,"LiveEventItems":0,"MonitoredNodes":0,"Variables":19,"Folders":4,"Conditions":1,"CachedCertificateStores":2,"Descriptors":187,"PkiDescriptors":0,"ManagedBytes":20236624,"RssBytes":209514496,"AllocatedBytes":49129448,"Gen0":5,"Gen1":4,"Gen2":4}}
+{"kind":"active","cycle":3,"sessions":2,"subscriptions":1,"items":3,"browsePoints":1,"historyPoints":6}
+{"kind":"network-stall-recovered","cycle":3,"status":"BadRequestInterrupted","seconds":1.0434837}
+{"kind":"quiescent","cycleSeconds":2.3620647,"resources":{"Cycle":3,"Seconds":7.466919,"Sessions":0,"Subscriptions":0,"Items":0,"BrowsePoints":0,"HistoryPoints":0,"LiveDataItems":0,"LiveEventItems":0,"MonitoredNodes":0,"Variables":19,"Folders":4,"Conditions":1,"CachedCertificateStores":2,"Descriptors":188,"PkiDescriptors":0,"ManagedBytes":20404584,"RssBytes":212303872,"AllocatedBytes":52268352,"Gen0":7,"Gen1":6,"Gen2":6}}
+{"kind":"active","cycle":4,"sessions":2,"subscriptions":1,"items":3,"browsePoints":1,"historyPoints":6}
+{"kind":"network-stall-recovered","cycle":4,"status":"BadRequestInterrupted","seconds":1.0417759}
+{"kind":"quiescent","cycleSeconds":2.367273,"resources":{"Cycle":4,"Seconds":9.8310274,"Sessions":0,"Subscriptions":0,"Items":0,"BrowsePoints":0,"HistoryPoints":0,"LiveDataItems":0,"LiveEventItems":0,"MonitoredNodes":0,"Variables":19,"Folders":4,"Conditions":1,"CachedCertificateStores":2,"Descriptors":188,"PkiDescriptors":0,"ManagedBytes":20581856,"RssBytes":215437312,"AllocatedBytes":55331040,"Gen0":9,"Gen1":8,"Gen2":8}}
+{"kind":"restart","cycles":4,"restarts":1,"seconds":5.1579086}
+{"kind":"active","cycle":5,"sessions":2,"subscriptions":1,"items":3,"browsePoints":1,"historyPoints":6}
+{"kind":"network-stall-recovered","cycle":5,"status":"BadRequestInterrupted","seconds":1.0429156}
+{"kind":"quiescent","cycleSeconds":2.4248818,"resources":{"Cycle":5,"Seconds":17.4116445,"Sessions":0,"Subscriptions":0,"Items":0,"BrowsePoints":0,"HistoryPoints":0,"LiveDataItems":0,"LiveEventItems":0,"MonitoredNodes":0,"Variables":19,"Folders":4,"Conditions":1,"CachedCertificateStores":2,"Descriptors":187,"PkiDescriptors":0,"ManagedBytes":20117312,"RssBytes":244072448,"AllocatedBytes":97741368,"Gen0":12,"Gen1":10,"Gen2":10}}
+{"kind":"active","cycle":6,"sessions":2,"subscriptions":1,"items":3,"browsePoints":1,"historyPoints":6}
+{"kind":"network-stall-recovered","cycle":6,"status":"BadRequestInterrupted","seconds":1.0424929}
+{"kind":"quiescent","cycleSeconds":2.359121,"resources":{"Cycle":6,"Seconds":19.7704339,"Sessions":0,"Subscriptions":0,"Items":0,"BrowsePoints":0,"HistoryPoints":0,"LiveDataItems":0,"LiveEventItems":0,"MonitoredNodes":0,"Variables":19,"Folders":4,"Conditions":1,"CachedCertificateStores":2,"Descriptors":188,"PkiDescriptors":0,"ManagedBytes":20256216,"RssBytes":244867072,"AllocatedBytes":100833504,"Gen0":14,"Gen1":12,"Gen2":12}}
+{"kind":"active","cycle":7,"sessions":2,"subscriptions":1,"items":3,"browsePoints":1,"historyPoints":6}
+{"kind":"network-stall-recovered","cycle":7,"status":"BadRequestInterrupted","seconds":1.0036954}
+{"kind":"quiescent","cycleSeconds":2.4160967,"resources":{"Cycle":7,"Seconds":22.1874361,"Sessions":0,"Subscriptions":0,"Items":0,"BrowsePoints":0,"HistoryPoints":0,"LiveDataItems":0,"LiveEventItems":0,"MonitoredNodes":0,"Variables":19,"Folders":4,"Conditions":1,"CachedCertificateStores":2,"Descriptors":187,"PkiDescriptors":0,"ManagedBytes":20426992,"RssBytes":245751808,"AllocatedBytes":103924024,"Gen0":16,"Gen1":14,"Gen2":14}}
+{"kind":"active","cycle":8,"sessions":2,"subscriptions":1,"items":3,"browsePoints":1,"historyPoints":6}
+{"kind":"network-stall-recovered","cycle":8,"status":"BadRequestInterrupted","seconds":1.0523899}
+{"kind":"quiescent","cycleSeconds":2.3926737,"resources":{"Cycle":8,"Seconds":24.5842524,"Sessions":0,"Subscriptions":0,"Items":0,"BrowsePoints":0,"HistoryPoints":0,"LiveDataItems":0,"LiveEventItems":0,"MonitoredNodes":0,"Variables":19,"Folders":4,"Conditions":1,"CachedCertificateStores":2,"Descriptors":188,"PkiDescriptors":0,"ManagedBytes":20713008,"RssBytes":247889920,"AllocatedBytes":107102792,"Gen0":18,"Gen1":16,"Gen2":16}}
+{"kind":"restart","cycles":8,"restarts":2,"seconds":5.1120391}
+{"kind":"active","cycle":9,"sessions":2,"subscriptions":1,"items":3,"browsePoints":1,"historyPoints":6}
+{"kind":"network-stall-recovered","cycle":9,"status":"BadRequestInterrupted","seconds":1.0461218}
+{"kind":"quiescent","cycleSeconds":2.3757912,"resources":{"Cycle":9,"Seconds":32.0681461,"Sessions":0,"Subscriptions":0,"Items":0,"BrowsePoints":0,"HistoryPoints":0,"LiveDataItems":0,"LiveEventItems":0,"MonitoredNodes":0,"Variables":19,"Folders":4,"Conditions":1,"CachedCertificateStores":2,"Descriptors":187,"PkiDescriptors":0,"ManagedBytes":20283072,"RssBytes":256245760,"AllocatedBytes":149467600,"Gen0":21,"Gen1":18,"Gen2":18}}
+{"kind":"active","cycle":10,"sessions":2,"subscriptions":1,"items":3,"browsePoints":1,"historyPoints":6}
+{"kind":"network-stall-recovered","cycle":10,"status":"BadRequestInterrupted","seconds":1.0032768}
+{"kind":"quiescent","cycleSeconds":2.3840571,"resources":{"Cycle":10,"Seconds":34.4585736,"Sessions":0,"Subscriptions":0,"Items":0,"BrowsePoints":0,"HistoryPoints":0,"LiveDataItems":0,"LiveEventItems":0,"MonitoredNodes":0,"Variables":19,"Folders":4,"Conditions":1,"CachedCertificateStores":2,"Descriptors":187,"PkiDescriptors":0,"ManagedBytes":20400792,"RssBytes":256765952,"AllocatedBytes":152540856,"Gen0":23,"Gen1":20,"Gen2":20}}
+{"kind":"active","cycle":11,"sessions":2,"subscriptions":1,"items":3,"browsePoints":1,"historyPoints":6}
+{"kind":"network-stall-recovered","cycle":11,"status":"BadRequestInterrupted","seconds":1.0055269}
+{"kind":"quiescent","cycleSeconds":2.3664136,"resources":{"Cycle":11,"Seconds":36.8250058,"Sessions":0,"Subscriptions":0,"Items":0,"BrowsePoints":0,"HistoryPoints":0,"LiveDataItems":0,"LiveEventItems":0,"MonitoredNodes":0,"Variables":19,"Folders":4,"Conditions":1,"CachedCertificateStores":2,"Descriptors":187,"PkiDescriptors":0,"ManagedBytes":20611944,"RssBytes":256458752,"AllocatedBytes":155681752,"Gen0":25,"Gen1":22,"Gen2":22}}
+{"kind":"active","cycle":12,"sessions":2,"subscriptions":1,"items":3,"browsePoints":1,"historyPoints":6}
+{"kind":"network-stall-recovered","cycle":12,"status":"BadRequestInterrupted","seconds":1.0483463}
+{"kind":"quiescent","cycleSeconds":2.4039892,"resources":{"Cycle":12,"Seconds":39.2211123,"Sessions":0,"Subscriptions":0,"Items":0,"BrowsePoints":0,"HistoryPoints":0,"LiveDataItems":0,"LiveEventItems":0,"MonitoredNodes":0,"Variables":19,"Folders":4,"Conditions":1,"CachedCertificateStores":2,"Descriptors":187,"PkiDescriptors":0,"ManagedBytes":20794472,"RssBytes":257134592,"AllocatedBytes":158746992,"Gen0":27,"Gen1":24,"Gen2":24}}
+{"kind":"restart","cycles":12,"restarts":3,"seconds":5.0988863}
+{"kind":"active","cycle":13,"sessions":2,"subscriptions":1,"items":3,"browsePoints":1,"historyPoints":6}
+{"kind":"network-stall-recovered","cycle":13,"status":"BadRequestInterrupted","seconds":1.0450081}
+{"kind":"quiescent","cycleSeconds":2.3795872,"resources":{"Cycle":13,"Seconds":46.7014719,"Sessions":0,"Subscriptions":0,"Items":0,"BrowsePoints":0,"HistoryPoints":0,"LiveDataItems":0,"LiveEventItems":0,"MonitoredNodes":0,"Variables":19,"Folders":4,"Conditions":1,"CachedCertificateStores":2,"Descriptors":189,"PkiDescriptors":0,"ManagedBytes":20332520,"RssBytes":261271552,"AllocatedBytes":199536496,"Gen0":30,"Gen1":26,"Gen2":26}}
+{"kind":"active","cycle":14,"sessions":2,"subscriptions":1,"items":3,"browsePoints":1,"historyPoints":6}
+{"kind":"network-stall-recovered","cycle":14,"status":"BadRequestInterrupted","seconds":1.0436713}
+{"kind":"quiescent","cycleSeconds":2.3497161,"resources":{"Cycle":14,"Seconds":49.0501604,"Sessions":0,"Subscriptions":0,"Items":0,"BrowsePoints":0,"HistoryPoints":0,"LiveDataItems":0,"LiveEventItems":0,"MonitoredNodes":0,"Variables":19,"Folders":4,"Conditions":1,"CachedCertificateStores":2,"Descriptors":190,"PkiDescriptors":0,"ManagedBytes":20431480,"RssBytes":261554176,"AllocatedBytes":202614280,"Gen0":32,"Gen1":28,"Gen2":28}}
+{"kind":"active","cycle":15,"sessions":2,"subscriptions":1,"items":3,"browsePoints":1,"historyPoints":6}
+{"kind":"network-stall-recovered","cycle":15,"status":"BadRequestInterrupted","seconds":1.04895}
+{"kind":"quiescent","cycleSeconds":2.371092,"resources":{"Cycle":15,"Seconds":51.4268968,"Sessions":0,"Subscriptions":0,"Items":0,"BrowsePoints":0,"HistoryPoints":0,"LiveDataItems":0,"LiveEventItems":0,"MonitoredNodes":0,"Variables":19,"Folders":4,"Conditions":1,"CachedCertificateStores":2,"Descriptors":189,"PkiDescriptors":0,"ManagedBytes":20505512,"RssBytes":264040448,"AllocatedBytes":205694824,"Gen0":34,"Gen1":30,"Gen2":30}}
+{"kind":"active","cycle":16,"sessions":2,"subscriptions":1,"items":3,"browsePoints":1,"historyPoints":6}
+{"kind":"network-stall-recovered","cycle":16,"status":"BadRequestInterrupted","seconds":1.0443525}
+{"kind":"quiescent","cycleSeconds":2.9848582,"resources":{"Cycle":16,"Seconds":53.9203748,"Sessions":0,"Subscriptions":0,"Items":0,"BrowsePoints":0,"HistoryPoints":0,"LiveDataItems":0,"LiveEventItems":0,"MonitoredNodes":0,"Variables":19,"Folders":4,"Conditions":1,"CachedCertificateStores":2,"Descriptors":189,"PkiDescriptors":0,"ManagedBytes":20622096,"RssBytes":264884224,"AllocatedBytes":208715944,"Gen0":36,"Gen1":32,"Gen2":32}}
+{"kind":"restart","cycles":16,"restarts":4,"seconds":5.454083}
+{"kind":"active","cycle":17,"sessions":2,"subscriptions":1,"items":3,"browsePoints":1,"historyPoints":6}
+{"kind":"network-stall-recovered","cycle":17,"status":"BadRequestInterrupted","seconds":1.0473067}
+{"kind":"quiescent","cycleSeconds":2.3818575,"resources":{"Cycle":17,"Seconds":62.2447867,"Sessions":0,"Subscriptions":0,"Items":0,"BrowsePoints":0,"HistoryPoints":0,"LiveDataItems":0,"LiveEventItems":0,"MonitoredNodes":0,"Variables":19,"Folders":4,"Conditions":1,"CachedCertificateStores":2,"Descriptors":189,"PkiDescriptors":0,"ManagedBytes":20191360,"RssBytes":259485696,"AllocatedBytes":249582344,"Gen0":39,"Gen1":34,"Gen2":34}}
+{"kind":"active","cycle":18,"sessions":2,"subscriptions":1,"items":3,"browsePoints":1,"historyPoints":6}
+{"kind":"network-stall-recovered","cycle":18,"status":"BadRequestInterrupted","seconds":1.0423094}
+{"kind":"quiescent","cycleSeconds":2.3561291,"resources":{"Cycle":18,"Seconds":64.6095248,"Sessions":0,"Subscriptions":0,"Items":0,"BrowsePoints":0,"HistoryPoints":0,"LiveDataItems":0,"LiveEventItems":0,"MonitoredNodes":0,"Variables":19,"Folders":4,"Conditions":1,"CachedCertificateStores":2,"Descriptors":189,"PkiDescriptors":0,"ManagedBytes":20373376,"RssBytes":255721472,"AllocatedBytes":252706544,"Gen0":41,"Gen1":36,"Gen2":36}}
+{"kind":"active","cycle":19,"sessions":2,"subscriptions":1,"items":3,"browsePoints":1,"historyPoints":6}
+{"kind":"network-stall-recovered","cycle":19,"status":"BadRequestInterrupted","seconds":1.0436178}
+{"kind":"quiescent","cycleSeconds":2.3444876,"resources":{"Cycle":19,"Seconds":66.9546586,"Sessions":0,"Subscriptions":0,"Items":0,"BrowsePoints":0,"HistoryPoints":0,"LiveDataItems":0,"LiveEventItems":0,"MonitoredNodes":0,"Variables":19,"Folders":4,"Conditions":1,"CachedCertificateStores":2,"Descriptors":189,"PkiDescriptors":0,"ManagedBytes":20552264,"RssBytes":254763008,"AllocatedBytes":255808392,"Gen0":43,"Gen1":38,"Gen2":38}}
+{"kind":"active","cycle":20,"sessions":2,"subscriptions":1,"items":3,"browsePoints":1,"historyPoints":6}
+{"kind":"network-stall-recovered","cycle":20,"status":"BadRequestInterrupted","seconds":1.0451534}
+{"kind":"quiescent","cycleSeconds":2.3495591,"resources":{"Cycle":20,"Seconds":69.2963186,"Sessions":0,"Subscriptions":0,"Items":0,"BrowsePoints":0,"HistoryPoints":0,"LiveDataItems":0,"LiveEventItems":0,"MonitoredNodes":0,"Variables":19,"Folders":4,"Conditions":1,"CachedCertificateStores":2,"Descriptors":189,"PkiDescriptors":0,"ManagedBytes":20702232,"RssBytes":255512576,"AllocatedBytes":258843576,"Gen0":45,"Gen1":40,"Gen2":40}}
+{"kind":"restart","cycles":20,"restarts":5,"seconds":5.1129163}
+{"kind":"active","cycle":21,"sessions":2,"subscriptions":1,"items":3,"browsePoints":1,"historyPoints":6}
+{"kind":"network-stall-recovered","cycle":21,"status":"BadRequestInterrupted","seconds":1.049048}
+{"kind":"quiescent","cycleSeconds":2.4246867,"resources":{"Cycle":21,"Seconds":76.8338727,"Sessions":0,"Subscriptions":0,"Items":0,"BrowsePoints":0,"HistoryPoints":0,"LiveDataItems":0,"LiveEventItems":0,"MonitoredNodes":0,"Variables":19,"Folders":4,"Conditions":1,"CachedCertificateStores":2,"Descriptors":190,"PkiDescriptors":0,"ManagedBytes":20221440,"RssBytes":262025216,"AllocatedBytes":299637616,"Gen0":48,"Gen1":42,"Gen2":42}}
+{"kind":"active","cycle":22,"sessions":2,"subscriptions":1,"items":3,"browsePoints":1,"historyPoints":6}
+{"kind":"network-stall-recovered","cycle":22,"status":"BadRequestInterrupted","seconds":1.0419365}
+{"kind":"quiescent","cycleSeconds":2.404919,"resources":{"Cycle":22,"Seconds":79.246374,"Sessions":0,"Subscriptions":0,"Items":0,"BrowsePoints":0,"HistoryPoints":0,"LiveDataItems":0,"LiveEventItems":0,"MonitoredNodes":0,"Variables":19,"Folders":4,"Conditions":1,"CachedCertificateStores":2,"Descriptors":189,"PkiDescriptors":0,"ManagedBytes":20324024,"RssBytes":262062080,"AllocatedBytes":302774600,"Gen0":50,"Gen1":44,"Gen2":44}}
+{"kind":"active","cycle":23,"sessions":2,"subscriptions":1,"items":3,"browsePoints":1,"historyPoints":6}
+{"kind":"network-stall-recovered","cycle":23,"status":"BadRequestInterrupted","seconds":1.0409262}
+{"kind":"quiescent","cycleSeconds":2.3874906,"resources":{"Cycle":23,"Seconds":81.6319445,"Sessions":0,"Subscriptions":0,"Items":0,"BrowsePoints":0,"HistoryPoints":0,"LiveDataItems":0,"LiveEventItems":0,"MonitoredNodes":0,"Variables":19,"Folders":4,"Conditions":1,"CachedCertificateStores":2,"Descriptors":189,"PkiDescriptors":0,"ManagedBytes":20478784,"RssBytes":260964352,"AllocatedBytes":305840432,"Gen0":52,"Gen1":46,"Gen2":46}}
+{"kind":"active","cycle":24,"sessions":2,"subscriptions":1,"items":3,"browsePoints":1,"historyPoints":6}
+{"kind":"network-stall-recovered","cycle":24,"status":"BadRequestInterrupted","seconds":1.0526128}
+{"kind":"quiescent","cycleSeconds":2.4292523,"resources":{"Cycle":24,"Seconds":84.060344,"Sessions":0,"Subscriptions":0,"Items":0,"BrowsePoints":0,"HistoryPoints":0,"LiveDataItems":0,"LiveEventItems":0,"MonitoredNodes":0,"Variables":19,"Folders":4,"Conditions":1,"CachedCertificateStores":2,"Descriptors":189,"PkiDescriptors":0,"ManagedBytes":20663008,"RssBytes":261554176,"AllocatedBytes":308902736,"Gen0":54,"Gen1":48,"Gen2":48}}
+{"kind":"restart","cycles":24,"restarts":6,"seconds":5.0922583}
+{"kind":"active","cycle":25,"sessions":2,"subscriptions":1,"items":3,"browsePoints":1,"historyPoints":6}
+{"kind":"network-stall-recovered","cycle":25,"status":"BadRequestInterrupted","seconds":1.0433366}
+{"kind":"quiescent","cycleSeconds":2.4269109,"resources":{"Cycle":25,"Seconds":91.5753658,"Sessions":0,"Subscriptions":0,"Items":0,"BrowsePoints":0,"HistoryPoints":0,"LiveDataItems":0,"LiveEventItems":0,"MonitoredNodes":0,"Variables":19,"Folders":4,"Conditions":1,"CachedCertificateStores":2,"Descriptors":190,"PkiDescriptors":0,"ManagedBytes":20259504,"RssBytes":266043392,"AllocatedBytes":349723432,"Gen0":57,"Gen1":50,"Gen2":50}}
+{"kind":"complete","utc":"2026-11-10T18:07:35.7007963+00:00","mode":"diagnostic","cycles":25,"restarts":6,"seconds":91.6023965,"satisfiesTwoHourDuration":false}

scripts/validation/opcua-server-lifecycle-linux/evidence/2026-11-10-diagnostic/soak.log

@@ -0,0 +1,7 @@
+VSTest version 18.0.1 (arm64)
+
+Starting test execution, please wait...
+A total of 1 test files matched the specified pattern.
+Results File: /task/results/soak.trx
+
+Passed!  - Failed:     0, Passed:     1, Skipped:     0, Total:     1, Duration: 1 m 33 s - ZB.MOM.WW.OtOpcUa.OpcUaServer.IntegrationTests.dll (net10.0)

scripts/validation/opcua-server-lifecycle-linux/evidence/2026-11-10-diagnostic/soak.trx

@@ -0,0 +1,34 @@
+<?xml version="1.0" encoding="utf-8"?>
+<TestRun id="d79bf095-24b8-47e5-8bf9-bb794d432137" name="@8c898f464f50 2026-11-10 18:07:35" xmlns="http://microsoft.com/schemas/VisualStudio/TeamTest/2010">
+  <Times creation="2026-11-10T18:07:35.7508628+00:00" queuing="2026-11-10T18:07:35.7508628+00:00" start="2026-11-10T18:06:02.1473749+00:00" finish="2026-11-10T18:07:35.7545626+00:00" />
+  <TestSettings name="default" id="68e934f0-45b1-46c2-93b4-062f7d8f2596">
+    <Deployment runDeploymentRoot="_8c898f464f50_2026-11-10_18_07_35" />
+  </TestSettings>
+  <Results>
+    <UnitTestResult executionId="dbfea690-8558-4eb5-96a6-b0d19015f837" testId="3a3639bf-5159-da35-0b1a-0a6c89f03e2c" testName="ZB.MOM.WW.OtOpcUa.OpcUaServer.IntegrationTests.Sdk2LifecycleSoakTests.Repeated_lifecycles_return_resources_to_a_steady_baseline" computerName="8c898f464f50" duration="00:01:33.0080309" startTime="2026-11-10T18:06:02.6943262+00:00" endTime="2026-11-10T18:07:35.7059381+00:00" testType="13cdc9d9-ddb5-4fa4-a97d-d965ccfc6d4b" outcome="Passed" testListId="8c84fa94-04c1-424b-9868-57a2d4851a1d" relativeResultsDirectory="dbfea690-8558-4eb5-96a6-b0d19015f837" />
+  </Results>
+  <TestDefinitions>
+    <UnitTest name="ZB.MOM.WW.OtOpcUa.OpcUaServer.IntegrationTests.Sdk2LifecycleSoakTests.Repeated_lifecycles_return_resources_to_a_steady_baseline" storage="/app/zb.mom.ww.otopcua.opcuaserver.integrationtests.dll" id="3a3639bf-5159-da35-0b1a-0a6c89f03e2c">
+      <Execution id="dbfea690-8558-4eb5-96a6-b0d19015f837" />
+      <TestMethod codeBase="/app/ZB.MOM.WW.OtOpcUa.OpcUaServer.IntegrationTests.dll" adapterTypeName="executor://xunit/VsTestRunner3/netcore/" className="ZB.MOM.WW.OtOpcUa.OpcUaServer.IntegrationTests.Sdk2LifecycleSoakTests" name="Repeated_lifecycles_return_resources_to_a_steady_baseline" />
+    </UnitTest>
+  </TestDefinitions>
+  <TestEntries>
+    <TestEntry testId="3a3639bf-5159-da35-0b1a-0a6c89f03e2c" executionId="dbfea690-8558-4eb5-96a6-b0d19015f837" testListId="8c84fa94-04c1-424b-9868-57a2d4851a1d" />
+  </TestEntries>
+  <TestLists>
+    <TestList name="Results Not in a List" id="8c84fa94-04c1-424b-9868-57a2d4851a1d" />
+    <TestList name="All Loaded Results" id="19431567-8539-422a-85d7-44ee4e166bda" />
+  </TestLists>
+  <ResultSummary outcome="Completed">
+    <Counters total="1" executed="1" passed="1" failed="0" error="0" timeout="0" aborted="0" inconclusive="0" passedButRunAborted="0" notRunnable="0" notExecuted="0" disconnected="0" warning="0" completed="0" inProgress="0" pending="0" />
+    <Output>
+      <StdOut>[xUnit.net 00:00:00.00] xUnit.net VSTest Adapter v3.0.2+dd36e86129 (64-bit .NET 10.0.14)
+[xUnit.net 00:00:00.10]   Discovering: ZB.MOM.WW.OtOpcUa.OpcUaServer.IntegrationTests
+[xUnit.net 00:00:00.25]   Discovered:  ZB.MOM.WW.OtOpcUa.OpcUaServer.IntegrationTests
+[xUnit.net 00:00:00.33]   Starting:    ZB.MOM.WW.OtOpcUa.OpcUaServer.IntegrationTests
+[xUnit.net 00:01:33.38]   Finished:    ZB.MOM.WW.OtOpcUa.OpcUaServer.IntegrationTests
+</StdOut>
+    </Output>
+  </ResultSummary>
+</TestRun>

scripts/validation/opcua-server-lifecycle-linux/evidence/2026-11-10-diagnostic/source.json

@@ -0,0 +1,57 @@
+{
+  "launcherSourceRevision": "74c938f37cbb9cf08b6ca72e4effc511120dc274",
+  "publishedSourceRevision": "74c938f37cbb9cf08b6ca72e4effc511120dc274",
+  "productionEquivalentTo": "7b353d7bae5311a2f0a33c0a82c88d2c5b49d76f",
+  "productionDiffEmpty": true,
+  "canonicalDescriptorProbeCommit": "642aefe3",
+  "testSourceSha256": "e695783e05787d94bf5d167b25b1c48b446b800c28259f023c28ed6012d737d1",
+  "publishCommand": "reused self-contained artifact: /private/tmp/opcua2-server-linux-diagnostic-20261110a/app",
+  "appPath": "/private/tmp/opcua2-server-linux-diagnostic-20261110a/app",
+  "apphost": {
+    "format": "ELF64 AArch64",
+    "sha256": "97531b8005df9dc8b129d2b22ba2049cf572d5d970046f7e8644ec632e860032"
+  },
+  "runtimeConfig": {
+    "runtimeOptions": {
+      "tfm": "net10.0",
+      "includedFrameworks": [
+        {
+          "name": "Microsoft.NETCore.App",
+          "version": "10.0.14"
+        },
+        {
+          "name": "Microsoft.AspNetCore.App",
+          "version": "10.0.14"
+        }
+      ],
+      "configProperties": {
+        "System.Reflection.Metadata.MetadataUpdater.IsSupported": false,
+        "System.Reflection.NullabilityInfoContext.IsSupported": true,
+        "System.Runtime.Serialization.EnableUnsafeBinaryFormatterSerialization": false
+      }
+    }
+  },
+  "sdkDependencies": [
+    "OPCFoundation.NetStandard.Opc.Ua.Client/2.0.1",
+    "OPCFoundation.NetStandard.Opc.Ua.Configuration/2.0.1",
+    "OPCFoundation.NetStandard.Opc.Ua.Core.Schema/2.0.1",
+    "OPCFoundation.NetStandard.Opc.Ua.Core.Types/2.0.1",
+    "OPCFoundation.NetStandard.Opc.Ua.Core/2.0.1",
+    "OPCFoundation.NetStandard.Opc.Ua.Security.Certificates/2.0.1",
+    "OPCFoundation.NetStandard.Opc.Ua.Server/2.0.1",
+    "OPCFoundation.NetStandard.Opc.Ua.Types/2.0.1"
+  ],
+  "image": {
+    "Id": "sha256:b04611ee9e1b7d36797012ed921962c57189cb4dbb3dff12afb8e158110f293b",
+    "RepoDigests": [
+      "mcr.microsoft.com/dotnet/sdk@sha256:e362a8dbcd691522456da26a5198b8f3ca1d7641c95624fadc5e3e82678bd08a"
+    ],
+    "Architecture": "arm64",
+    "Os": "linux"
+  },
+  "hostDotnet": ".NET SDK:\n Version:           10.0.403\n Commit:            5a2162bea6\n Workload version:  10.0.400-manifests.a00bebb6\n MSBuild version:   18.9.15+5a2162bea\n\nRuntime Environment:\n OS Name:     Mac OS X\n OS Version:  26.5\n OS Platform: Darwin\n RID:         osx-arm64\n Base Path:   /opt/homebrew/Cellar/dotnet/10.0.403/libexec/sdk/10.0.403/\n\n.NET workloads installed:\nThere are no installed workloads to display.\nConfigured to use workload sets when installing new manifests.\nNo workload sets are installed. Run \"dotnet workload restore\" to install a workload set.\n\nHost:\n  Version:      10.0.14\n  Architecture: arm64\n  Commit:       0427b9abbe\n\n.NET SDKs installed:\n  10.0.403 [/opt/homebrew/Cellar/dotnet/10.0.403/libexec/sdk]\n\n.NET runtimes installed:\n  Microsoft.AspNetCore.App 10.0.14 [/opt/homebrew/Cellar/dotnet/10.0.403/libexec/shared/Microsoft.AspNetCore.App]\n  Microsoft.NETCore.App 10.0.14 [/opt/homebrew/Cellar/dotnet/10.0.403/libexec/shared/Microsoft.NETCore.App]\n\nOther architectures found:\n  None\n\nEnvironment variables:\n  DOTNET_ROOT                              [/opt/homebrew/Cellar/dotnet/10.0.403/libexec]\n\nglobal.json file:\n  /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/global.json\n\nLearn more:\n  https://aka.ms/dotnet/info\n\nDownload .NET:\n  https://aka.ms/dotnet/download\n",
+  "network": "none",
+  "mode": "diagnostic",
+  "durationSeconds": 90,
+  "startedUtc": "2026-11-10T18:06:00Z"
+}

scripts/validation/opcua-server-lifecycle-linux/evidence/2026-11-10-diagnostic/validation-controls.json

@@ -0,0 +1,12 @@
+[
+  {
+    "control": "short_diagnostic_cannot_satisfy_full",
+    "status": "passed",
+    "observedRejection": "Duration header mismatch"
+  },
+  {
+    "control": "wrong_executed_test_count_rejected",
+    "status": "passed",
+    "observedRejection": "TRX expected exact passed/executed count 1: /tmp/opcua2-server-linux-diagnostic-20261110b/task/results/descriptor-controls.trx"
+  }
+]

scripts/validation/opcua-server-lifecycle-linux/evidence/2026-11-10-diagnostic/verification.json

@@ -0,0 +1,29 @@
+{
+  "diagnosticExitCode": 0,
+  "descriptorControlTestsExecuted": 2,
+  "lifecycleTestsExecuted": 1,
+  "fullDurationCliGuardExitCode": 2,
+  "currentLauncherRevalidatedExistingEvidence": true,
+  "rawArtifactRoot": "/private/tmp/opcua2-server-linux-diagnostic-20261110c",
+  "publishArtifactRoot": "/private/tmp/opcua2-server-linux-diagnostic-20261110a/app",
+  "noFullRunPerformed": true,
+  "sourceProductionDiffFrom7b353d7bEmpty": true,
+  "harnessFiles": [
+    {
+      "path": "scripts/validation/opcua-server-lifecycle-linux/.gitignore",
+      "sha256": "32dae3052f331ee34d628ef535709b301259a45df7c7522c4d35dcf49873f00b"
+    },
+    {
+      "path": "scripts/validation/opcua-server-lifecycle-linux/README.md",
+      "sha256": "1a67d8a6bb4b604bad0f6772ea450306a1e5313723a755e9985d1a739b77f72c"
+    },
+    {
+      "path": "scripts/validation/opcua-server-lifecycle-linux/container.sh",
+      "sha256": "2a27d66e36d61431e6d413afe9d9d5d22959e82d9bf520767140b5d738487b31"
+    },
+    {
+      "path": "scripts/validation/opcua-server-lifecycle-linux/run.py",
+      "sha256": "770f164588e90df2c4a4fcc883ca82fc17a1037c80f62fa2b40e92ce511d6f15"
+    }
+  ]
+}

scripts/validation/opcua-server-lifecycle-linux/run.py

@@ -0,0 +1,183 @@
+#!/usr/bin/env python3
+"""Run the unchanged SDK2 server lifecycle test in isolated Linux ARM64."""
+import argparse
+import hashlib
+import json
+import os
+from pathlib import Path
+import shutil
+import struct
+import subprocess
+import time
+import uuid
+import xml.etree.ElementTree as ET
+
+HERE = Path(__file__).resolve().parent
+ROOT = HERE.parents[2]
+PROJECT = ROOT / 'tests/Server/ZB.MOM.WW.OtOpcUa.OpcUaServer.IntegrationTests/ZB.MOM.WW.OtOpcUa.OpcUaServer.IntegrationTests.csproj'
+APPNAME = 'ZB.MOM.WW.OtOpcUa.OpcUaServer.IntegrationTests'
+TARGET = 'Repeated_lifecycles_return_resources_to_a_steady_baseline'
+BASE = '7b353d7bae5311a2f0a33c0a82c88d2c5b49d76f'
+
+
+def write(path, value):
+    path.write_text(json.dumps(value, indent=2) + '\n')
+
+
+def sha(path):
+    return hashlib.sha256(path.read_bytes()).hexdigest()
+
+
+def command(argv, log, timeout, **kwargs):
+    with log.open('w') as stream:
+        result = subprocess.run([str(x) for x in argv], stdout=stream, stderr=subprocess.STDOUT, timeout=timeout, **kwargs)
+    return result.returncode
+
+
+def trx(path, count):
+    doc = ET.parse(path)
+    ns = {'t': 'http://microsoft.com/schemas/VisualStudio/TeamTest/2010'}
+    counts = doc.find('.//t:Counters', ns)
+    results = doc.findall('.//t:UnitTestResult', ns)
+    if counts is None or any(int(counts.attrib[k]) != count for k in ('total', 'executed', 'passed')):
+        raise RuntimeError('TRX expected exact passed/executed count ' + str(count) + ': ' + str(path))
+    if len(results) != count or any(r.attrib['outcome'] != 'Passed' for r in results):
+        raise RuntimeError('TRX missing or non-passing result: ' + str(path))
+    for key in ('failed', 'error', 'timeout', 'aborted', 'notExecuted'):
+        if int(counts.attrib.get(key, '0')):
+            raise RuntimeError('TRX has nonzero ' + key)
+    return {'counts': counts.attrib, 'tests': [r.attrib['testName'] for r in results]}
+
+
+def validate_evidence(task, seconds, full):
+    rows = [json.loads(line) for line in (task / 'soak.jsonl').read_text().splitlines()]
+    starts = [r for r in rows if r['kind'] == 'start']
+    complete = [r for r in rows if r['kind'] == 'complete']
+    if len(starts) != 1 or len(complete) != 1 or any(r['kind'] == 'failed' for r in rows):
+        raise RuntimeError('Expected one start and one complete with no failed evidence row')
+    start, done = starts[0], complete[0]
+    if start['requestedSeconds'] != seconds or start['minimumFullSeconds'] != 7200:
+        raise RuntimeError('Duration header mismatch')
+    expected_mode = 'full' if full else 'diagnostic'
+    if start['mode'] != expected_mode or done['mode'] != expected_mode or done['seconds'] < seconds:
+        raise RuntimeError('Real duration/completion mode mismatch')
+    if start['limits'] != {'retainedManagedGrowthBytes': 64 << 20, 'rssGrowthBytes': 128 << 20, 'fdGrowth': 32}:
+        raise RuntimeError('Canonical test resource budgets changed')
+    if done['satisfiesTwoHourDuration'] != full or (full and done['seconds'] < 7200):
+        raise RuntimeError('Two-hour gate mismatch')
+    samples = [r for r in rows if r['kind'] == 'quiescent']
+    active = [r for r in rows if r['kind'] == 'active']
+    stalls = [r for r in rows if r['kind'] == 'network-stall-recovered']
+    restarts = [r for r in rows if r['kind'] == 'restart']
+    if done['cycles'] < 4 or done['restarts'] != done['cycles'] // 4:
+        raise RuntimeError('Missing actual lifecycle/restart coverage')
+    if not (len(samples) == len(active) == len(stalls) == done['cycles']) or len(restarts) != done['restarts']:
+        raise RuntimeError('Incomplete cycle/stall/restart evidence counts')
+    if not start['sdk'].startswith('2.0.1+'):
+        raise RuntimeError('Runtime SDK header mismatch')
+    return {'start': start, 'complete': done, 'rowCounts': {k: sum(r['kind'] == k for r in rows) for k in sorted({r['kind'] for r in rows})},
+            'firstResources': samples[0]['resources'], 'baselineResources': samples[2]['resources'], 'lastResources': samples[-1]['resources']}
+
+
+def main():
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument('--output', required=True, type=Path, help='Fresh output including task private PKI; do not commit the whole directory')
+    parser.add_argument('--duration', type=int, default=90)
+    parser.add_argument('--full', action='store_true')
+    parser.add_argument('--published-app', type=Path, help='Reuse immutable self-contained publish from this launcher/recorded matching build')
+    parser.add_argument('--image', default='mcr.microsoft.com/dotnet/sdk:10.0.103-noble')
+    args = parser.parse_args()
+    if (args.full and args.duration < 7200) or (not args.full and not 60 <= args.duration <= 120):
+        parser.error('full requires duration >=7200; diagnostic requires 60..120 seconds')
+    output = args.output.resolve()
+    output.mkdir(parents=True, exist_ok=False)
+    os.chmod(output, 0o700)
+    task = output / 'task'
+    task.mkdir()
+    revision = subprocess.check_output(['git', '-C', str(ROOT), 'rev-parse', 'HEAD'], text=True).strip()
+    production_diff = subprocess.check_output(['git', '-C', str(ROOT), 'diff', BASE, 'HEAD', '--', 'src', 'Directory.Packages.props', 'Directory.Build.props'], text=True)
+    if production_diff:
+        raise RuntimeError('Production/package source differs from recorded 7b353d7b compatibility build; review required')
+    image = json.loads(subprocess.check_output(['docker', 'image', 'inspect', args.image, '--format', '{{json .}}'], text=True))
+    if image['Architecture'] != 'arm64' or image['Os'] != 'linux':
+        raise RuntimeError('Expected cached official Linux ARM64 image')
+    app = args.published_app.resolve() if args.published_app else output / 'app'
+    build_cmd = ['dotnet', 'publish', str(PROJECT), '-c', 'Release', '-r', 'linux-arm64', '--self-contained', 'true',
+                 '-p:RuntimeFrameworkVersion=10.0.14', '-p:PublishSingleFile=false', '-p:PublishTrimmed=false', '-p:UseAppHost=true',
+                 '--artifacts-path', str(output / 'build-artifacts'), '-o', str(app), '-m:1', '--nologo']
+    if not args.published_app:
+        status = command(build_cmd, output / 'publish.log', 600)
+        if status:
+            raise RuntimeError('Self-contained Linux publish failed: ' + str(status))
+    receipt_path = app.parent / 'publish-receipt.json'
+    receipt = json.loads(receipt_path.read_text()) if args.published_app else {
+        'sourceRevision': revision, 'command': build_cmd,
+        'hostDotnet': subprocess.check_output(['dotnet', '--info'], text=True),
+        'testSourceSha256': sha(PROJECT.parent / 'Sdk2LifecycleSoakTests.cs')}
+    if receipt['testSourceSha256'] != sha(PROJECT.parent / 'Sdk2LifecycleSoakTests.cs'):
+        raise RuntimeError('Reused publish test source differs from current canonical source')
+    apphost = app / APPNAME
+    magic = apphost.read_bytes()[:20]
+    if magic[:4] != b'\x7fELF' or magic[4] != 2 or struct.unpack('<H', magic[18:20])[0] != 183:
+        raise RuntimeError('xUnit v3 apphost must be Linux AArch64 ELF64, not macOS Mach-O')
+    runtime = json.loads((app / (APPNAME + '.runtimeconfig.json')).read_text())
+    frameworks = runtime['runtimeOptions'].get('includedFrameworks', [])
+    if not any(f['name'] == 'Microsoft.NETCore.App' and f['version'] == '10.0.14' for f in frameworks):
+        raise RuntimeError('Test app must carry self-contained runtime 10.0.14')
+    deps = json.loads((app / (APPNAME + '.deps.json')).read_text())
+    sdkdeps = {k: v for k, v in deps['libraries'].items() if k.startswith('OPCFoundation.')}
+    if not sdkdeps or any(k.rsplit('/', 1)[-1] != '2.0.1' for k in sdkdeps):
+        raise RuntimeError('Expected only OPC Foundation SDK 2.0.1 dependencies')
+    manifest = [{'name': p.name, 'bytes': p.stat().st_size, 'sha256': sha(p)} for p in sorted(app.glob('*')) if p.is_file()]
+    if args.published_app and (receipt['apphostSha256'] != sha(apphost)
+                              or receipt['testAssemblySha256'] != sha(app / (APPNAME + '.dll'))):
+        raise RuntimeError('Reused publish has changed since its receipt')
+    if not args.published_app:
+        receipt.update({'apphostSha256': sha(apphost), 'testAssemblySha256': sha(app / (APPNAME + '.dll'))})
+        write(receipt_path, receipt)
+    write(output / 'publish-receipt.json', receipt)
+    write(output / 'artifact-manifest.json', manifest)
+    source = {'launcherSourceRevision': revision, 'publishedSourceRevision': receipt['sourceRevision'],
+              'productionEquivalentTo': BASE, 'productionDiffEmpty': True,
+              'canonicalDescriptorProbeCommit': '642aefe3', 'testSourceSha256': sha(PROJECT.parent / 'Sdk2LifecycleSoakTests.cs'),
+              'publishCommand': build_cmd if not args.published_app else 'reused self-contained artifact: ' + str(app),
+              'appPath': str(app), 'apphost': {'format': 'ELF64 AArch64', 'sha256': sha(apphost)}, 'runtimeConfig': runtime,
+              'sdkDependencies': sorted(sdkdeps), 'image': {k: image.get(k) for k in ('Id', 'RepoDigests', 'Architecture', 'Os')},
+              'hostDotnet': subprocess.check_output(['dotnet', '--info'], text=True),
+              'network': 'none', 'mode': 'full' if args.full else 'diagnostic', 'durationSeconds': args.duration,
+              'startedUtc': time.strftime('%Y-%m-%dT%H:%M:%SZ', time.gmtime())}
+    write(output / 'source.json', source)
+    shutil.copy2(HERE / 'container.sh', task / 'container.sh')
+    name = 'otopcua-server-linux-soak-' + uuid.uuid4().hex[:12]
+    cmd = ['docker', 'run', '--rm', '--name', name, '--network', 'none',
+           '-e', 'OTOPCUA_SDK2_SOAK_MODE=' + ('full' if args.full else 'diagnostic'),
+           '-e', 'OTOPCUA_SDK2_SOAK_SECONDS=' + str(args.duration), '-e', 'OTOPCUA_SOAK_BUILD_SHA=' + revision,
+           '-v', str(app) + ':/app:ro', '-v', str(task) + ':/task', image['Id'], 'bash', '/task/container.sh']
+    write(output / 'command.json', {'argv': cmd, 'timeoutSeconds': args.duration + 300})
+    started = time.monotonic()
+    try:
+        status = command(cmd, output / 'container.log', args.duration + 300)
+    except BaseException:
+        subprocess.run(['docker', 'rm', '-f', name], stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL, timeout=20)
+        raise
+    write(output / 'result.json', {'status': 'failed', 'containerExitCode': status,
+                                  'containerElapsedSeconds': time.monotonic() - started,
+                                  'validation': 'pending TRX and completion validation'})
+    try:
+        controls = trx(task / 'results' / 'descriptor-controls.trx', 2)
+        test = trx(task / 'results' / 'soak.trx', 1)
+        if TARGET not in test['tests'][0] or status:
+            raise RuntimeError('Soak test did not complete successfully; container exit=' + str(status))
+        evidence = validate_evidence(task, args.duration, args.full)
+    except Exception as error:
+        write(output / 'result.json', {'status': 'failed', 'containerExitCode': status,
+                                      'containerElapsedSeconds': time.monotonic() - started,
+                                      'validationError': str(error)})
+        raise
+    write(output / 'result.json', {'status': 'passed', 'containerExitCode': status, 'containerElapsedSeconds': time.monotonic() - started,
+                                  'descriptorControls': controls, 'soakTest': test, 'evidence': evidence})
+    print(json.dumps({'output': str(output), 'status': 'passed', 'complete': evidence['complete']}, indent=2))
+
+
+if __name__ == '__main__':
+    main()

src/Client/ZB.MOM.WW.OtOpcUa.Client.Shared/Adapters/DefaultApplicationConfigurationFactory.cs

@@ -71,7 +71,9 @@ internal sealed class DefaultApplicationConfigurationFactory : IApplicationConfi
                     ApplicationType = ApplicationType.Client,
                     ApplicationConfiguration = config
                 };
-                await app.CheckApplicationInstanceCertificatesAsync(false, lifeTimeInMonths: 2048, ct: ct);
+                // Key size is configured separately; this argument is a lifetime in months.
+                // Keep the SDK creation default and reuse any valid certificate already in the store.
+                await app.CheckApplicationInstanceCertificatesAsync(false, ct: ct);
             }
         }
         catch

tests/Client/ZB.MOM.WW.OtOpcUa.Client.Shared.Tests/Adapters/DefaultApplicationConfigurationFactoryTests.cs

@@ -1,4 +1,7 @@
 using Opc.Ua;
+using Opc.Ua.Configuration;
+using System.Security.Cryptography;
+using System.Security.Cryptography.X509Certificates;
 using Shouldly;
 using Xunit;
 using ZB.MOM.WW.OtOpcUa.Client.Shared.Adapters;
@@ -9,6 +12,61 @@ namespace ZB.MOM.WW.OtOpcUa.Client.Shared.Tests.Adapters;
 /// <summary>Uses the real configuration factory so fake sessions cannot conceal SDK initialization failures.</summary>
 public sealed class DefaultApplicationConfigurationFactoryTests
 {
+    [Theory]
+    [InlineData(false)]
+    [InlineData(true)]
+    public async Task New_certificates_use_the_default_lifetime_and_existing_private_keys_are_reused(bool seedLongerCertificate)
+    {
+        var ct = TestContext.Current.CancellationToken;
+        var root = Path.Combine(Path.GetTempPath(), $"otopcua-certificate-lifetime-{Guid.NewGuid():N}");
+        var settings = new ConnectionSettings
+        {
+            EndpointUrl = "opc.tcp://localhost:4840", CertificateStorePath = root,
+            SecurityMode = SecurityMode.None, AutoAcceptCertificates = false,
+        };
+        var factory = new DefaultApplicationConfigurationFactory();
+        ApplicationConfiguration? current = null;
+        try
+        {
+            if (seedLongerCertificate)
+            {
+                var seed = await factory.CreateAsync(settings, ct);
+                await using var application = new ApplicationInstance(DefaultTelemetry.Create(_ => { })) { ApplicationConfiguration = seed };
+                (await application.CheckApplicationInstanceCertificatesAsync(true, lifeTimeInMonths: 60, ct)).ShouldBeTrue();
+            }
+            settings.SecurityMode = SecurityMode.SignAndEncrypt;
+            current = await factory.CreateAsync(settings, ct);
+            var certPath = Directory.GetFiles(Path.Combine(root, "own", "certs"), "*.der").ShouldHaveSingleItem();
+            var privatePath = Directory.GetFiles(Path.Combine(root, "own", "private"), "*.pfx").ShouldHaveSingleItem();
+            using var certificate = X509CertificateLoader.LoadCertificateFromFile(certPath);
+            using var privateCertificate = X509CertificateLoader.LoadPkcs12FromFile(privatePath, null, OperatingSystem.IsMacOS() ? X509KeyStorageFlags.DefaultKeySet : X509KeyStorageFlags.EphemeralKeySet);
+            privateCertificate.HasPrivateKey.ShouldBeTrue();
+            certificate.Thumbprint.ShouldBe(privateCertificate.Thumbprint);
+            using var rsa = certificate.GetRSAPublicKey();
+            rsa.ShouldNotBeNull().KeySize.ShouldBeGreaterThanOrEqualTo(2048);
+            if (seedLongerCertificate)
+                certificate.NotAfter.ToUniversalTime().ShouldBeGreaterThan(DateTime.UtcNow.AddYears(4));
+            else
+            {
+                certificate.NotAfter.ToUniversalTime().ShouldBeGreaterThan(DateTime.UtcNow.AddMonths(CertificateFactory.DefaultLifeTime - 1));
+                certificate.NotAfter.ToUniversalTime().ShouldBeLessThan(DateTime.UtcNow.AddMonths(CertificateFactory.DefaultLifeTime).AddDays(2));
+            }
+            var originalKeyHash = SHA256.HashData(await File.ReadAllBytesAsync(privatePath, ct));
+            (current.CertificateManager as IDisposable)?.Dispose(); current = null;
+            current = await factory.CreateAsync(settings, ct);
+            using var reused = X509CertificateLoader.LoadCertificateFromFile(certPath);
+            reused.Thumbprint.ShouldBe(certificate.Thumbprint);
+            SHA256.HashData(await File.ReadAllBytesAsync(privatePath, ct)).ShouldBe(originalKeyHash,
+                "reinitializing with a shorter creation default must not rotate an existing certificate or private key");
+            Directory.GetFiles(Path.Combine(root, "own", "certs"), "*.der").Length.ShouldBe(1);
+        }
+        finally
+        {
+            (current?.CertificateManager as IDisposable)?.Dispose();
+            if (Directory.Exists(root)) Directory.Delete(root, true);
+        }
+    }
+
     [Theory]
     [InlineData(SecurityMode.None)]
     [InlineData(SecurityMode.SignAndEncrypt)]