test: add isolated Linux server lifecycle soak launcher

scripts/validation/opcua-client-lifecycle/.gitignore

@@ -0,0 +1 @@
+__pycache__/

scripts/validation/opcua-client-lifecycle/Lifecycle.cs

@@ -0,0 +1,249 @@
+#pragma warning disable OTOPCUA0001
+using System.Collections;
+using System.Collections.Concurrent;
+using System.Diagnostics;
+using System.Reflection;
+using System.Security.Cryptography;
+using System.Text.Json;
+using Opc.Ua;
+using Opc.Ua.Configuration;
+using ZB.MOM.WW.OtOpcUa.Client.Shared;
+using ZB.MOM.WW.OtOpcUa.Client.Shared.Models;
+using ZB.MOM.WW.OtOpcUa.Core.Abstractions;
+using ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient;
+using ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.Browser;
+using ZB.MOM.WW.OtOpcUa.OpcUaServer;
+using WriteRequest = ZB.MOM.WW.OtOpcUa.Core.Abstractions.WriteRequest;
+using SharedSecurityMode = ZB.MOM.WW.OtOpcUa.Client.Shared.Models.SecurityMode;
+
+internal static partial class ProcessHost
+{
+    static object ServerCounts(OtOpcUaSdkServer server)
+    {
+        var sessions = server.CurrentInstance.SessionManager.GetSessions();
+        var subs = server.CurrentInstance.SubscriptionManager.GetSubscriptions();
+        return new { utc = DateTime.UtcNow, sessions = sessions.Count, subscriptions = subs.Count,
+            items = subs.Sum(s => s.MonitoredItemCount), serverProcess = Environment.ProcessId };
+    }
+}
+
+internal static class Lifecycle
+{
+    static string Root = "";
+    static string Password => Environment.GetEnvironmentVariable("OPCUA_MATRIX_PASSWORD") ?? throw new InvalidOperationException("Missing fixture credential");
+    static readonly JsonSerializerOptions Json = new() { WriteIndented = true };
+    static int managerChecks, sharedPasses, driverPasses, browserPasses;
+    static readonly List<WeakReference> Weak = [];
+    static void Require(bool pass, string message) { if (!pass) throw new InvalidOperationException(message); }
+    static object? FieldOrNull(object owner, string name)
+    {
+        var field = owner.GetType().GetField(name, BindingFlags.Instance | BindingFlags.NonPublic | BindingFlags.DeclaredOnly)
+            ?? throw new InvalidOperationException("Diagnostic layout changed: " + owner.GetType().FullName + "." + name);
+        return field.GetValue(owner);
+    }
+    static object Field(object owner, string name) => FieldOrNull(owner, name) ?? throw new InvalidOperationException("Diagnostic owner null: " + name);
+    static void Empty(object owner, string name) => Require(Field(owner, name) is ICollection items && items.Count == 0, "Retained collection: " + name);
+    static bool Disposed(object manager)
+    {
+        Require(manager.GetType().FullName == "Opc.Ua.CertificateManager", "Unexpected SDK certificate manager type");
+        Require(manager.GetType().Assembly.GetName().Version?.ToString() == "2.0.1.0", "Diagnostic requires SDK 2.0.1.0");
+        var field = manager.GetType().GetField("m_disposed", BindingFlags.NonPublic | BindingFlags.Instance | BindingFlags.DeclaredOnly);
+        Require(field?.FieldType == typeof(bool), "SDK 2.0.1 CertificateManager.m_disposed bool layout changed");
+        return (bool)field!.GetValue(manager)!;
+    }
+    static object SharedManager(OpcUaClientService shared) => Field(Field(shared, "_session"), "_certificateManager");
+    static object AppManager(object owner) => ((ApplicationInstance)Field(owner, "_ownedApplication")).ApplicationConfiguration!.CertificateManager;
+    static void CheckManager(object manager, bool disposed)
+    {
+        Require(Disposed(manager) == disposed, "Certificate manager disposal observation mismatch");
+        if (disposed) managerChecks++;
+    }
+    static ConnectionSettings Settings(string endpoint, string? password = null) => new()
+    {
+        EndpointUrl = endpoint, Username = "apikey", Password = password ?? Password,
+        SecurityMode = SharedSecurityMode.SignAndEncrypt, AutoAcceptCertificates = false,
+        CertificateStorePath = Path.Combine(Root, "data", "shared-pki"), SessionTimeoutSeconds = 30
+    };
+    static OpcUaClientDriverOptions Options(string endpoint) => new()
+    {
+        EndpointUrl = endpoint, SecurityPolicy = OpcUaSecurityPolicy.Basic256Sha256,
+        SecurityMode = OpcUaSecurityMode.SignAndEncrypt, AuthType = OpcUaAuthType.Username,
+        Username = "apikey", Password = Password, AutoAcceptCertificates = false,
+        SessionName = "ClientLifecycle", ApplicationUri = "urn:localhost:ClientLifecycle",
+        RawTags = [new("scalar", "{\"nodeId\":\"nsu=https://zb.com/otopcua/raw;s=Matrix/dev/Scalar\"}", true),
+                   new("vector", "{\"nodeId\":\"nsu=https://zb.com/otopcua/raw;s=Matrix/dev/Vector\"}", true)]
+    };
+    static async Task Wait(Func<bool> condition, CancellationToken ct)
+    {
+        while (!condition()) await Task.Delay(25, ct);
+    }
+    static object? Clr(DataValue value) => ZB.MOM.WW.OtOpcUa.Client.Shared.Helpers.ValueConverter.ToClrObject(value.WrappedValue);
+    static async Task Prepare()
+    {
+        // Public connection failures create and release the same production applications as a live attempt.
+        // No production private method is invoked and no SDK state is written by diagnostics.
+        using var ct = new CancellationTokenSource(TimeSpan.FromSeconds(15));
+        using (var shared = new OpcUaClientService())
+        { try { await shared.ConnectAsync(Settings("opc.tcp://127.0.0.1:1"), ct.Token); } catch { } }
+        await using (var driver = new OpcUaClientDriver(Options("opc.tcp://127.0.0.1:1"), "lifecycle"))
+        { try { await driver.InitializeAsync("{}", ct.Token); } catch { } }
+        var browser = new OpcUaClientDriverBrowser();
+        try { await using var session = await browser.OpenAsync(JsonSerializer.Serialize(Options("opc.tcp://127.0.0.1:1")), ct.Token); } catch { }
+        foreach (var folder in new[] { "data/shared-pki", "data/OtOpcUa/pki", "data/OtOpcUa/adminui-browse-pki" })
+            Require(Directory.GetFiles(Path.Combine(Root, folder, "own", "certs")).Length == 1, "Expected one reusable application DER certificate: " + folder);
+    }
+    static async Task Cycle(string endpoint, int cycle)
+    {
+        using var budget = new CancellationTokenSource(TimeSpan.FromSeconds(30));
+        var ct = budget.Token;
+        using var shared = new OpcUaClientService(); Weak.Add(new(shared));
+        await using var driver = new OpcUaClientDriver(Options(endpoint), "lifecycle"); Weak.Add(new(driver));
+        var browser = new OpcUaClientDriverBrowser(); Weak.Add(new(browser));
+        // Two connections on the same Shared service and two initializations on the same driver.
+        for (var pass = 0; pass < 2; pass++)
+        {
+            var seen = new ConcurrentQueue<int>();
+            EventHandler<DataChangedEventArgs> handler = (_, e) => { if (Clr(e.Value) is int n) seen.Enqueue(n); };
+            shared.DataChanged += handler;
+            var info = await shared.ConnectAsync(Settings(endpoint), ct);
+            Require(info.SecurityMode == "SignAndEncrypt" && info.SecurityPolicyUri == SecurityPolicies.Basic256Sha256, "Shared policy downgrade");
+            object? manager = SharedManager(shared); CheckManager(manager, false);
+            var nss = (string[])Clr(await shared.ReadValueAsync(VariableIds.Server_NamespaceArray, ct))!;
+            var ns = (ushort)Array.IndexOf(nss, "https://zb.com/otopcua/raw"); Require(ns > 0, "Raw namespace missing");
+            var scalar = new NodeId("Matrix/dev/Scalar", ns); var vector = new NodeId("Matrix/dev/Vector", ns);
+            await shared.SubscribeAsync(scalar, 100, ct); await shared.SubscribeAsync(vector, 100, ct);
+            var target = cycle * 10 + pass;
+            Require(StatusCode.IsGood(await shared.WriteValueAsync(scalar, target, ct)), "Shared scalar write failed");
+            Require(StatusCode.IsGood(await shared.WriteValueAsync(vector, new[] { target, 2, 3 }, ct)), "Shared vector write failed");
+            await Wait(() => seen.Contains(target), ct);
+            Require(Equals(Clr(await shared.ReadValueAsync(scalar, ct)), target), "Shared scalar roundtrip mismatch");
+            Require(((int[])Clr(await shared.ReadValueAsync(vector, ct))!).SequenceEqual(new[] { target, 2, 3 }), "Shared vector mismatch");
+            Require((await shared.BrowseAsync(new NodeId("Matrix/dev", ns), ct)).Count > 0, "Shared browse empty");
+            await shared.UnsubscribeAsync(scalar, ct); await shared.UnsubscribeAsync(vector, ct);
+            await shared.DisconnectAsync(ct);
+            Require(!shared.IsConnected && shared.CurrentConnectionInfo is null, "Shared public connection state retained");
+            Require(FieldOrNull(shared, "_session") is null, "Shared session retained"); Empty(shared, "_activeDataSubscriptions");
+            CheckManager(manager, true); manager = null; shared.DataChanged -= handler; sharedPasses++;
+
+            if (pass == 0) await driver.InitializeAsync("{}", ct);
+            else await driver.ReinitializeAsync("{}", ct);
+            Require(driver.GetHealth().State == DriverState.Healthy, "Driver initialize health");
+            manager = AppManager(driver); CheckManager(manager, false);
+            var values = new ConcurrentQueue<int>();
+            EventHandler<DataChangeEventArgs> driverHandler = (_, e) => { if (e.Snapshot.Value is int n) values.Enqueue(n); };
+            driver.OnDataChange += driverHandler;
+            var sub = await driver.SubscribeAsync(["scalar", "vector"], TimeSpan.FromMilliseconds(100), ct);
+            target++;
+            var writes = await driver.WriteAsync([new WriteRequest("scalar", target), new WriteRequest("vector", new[] { target, 4, 5 })], ct);
+            Require(writes.Count == 2 && writes.All(w => w.StatusCode == 0), "Driver write failed");
+            await Wait(() => values.Contains(target), ct);
+            var reads = await driver.ReadAsync(["scalar", "vector"], ct);
+            Require(reads.Count == 2 && reads.All(r => r.StatusCode == 0) && Equals(reads[0].Value, target)
+                && ((int[])reads[1].Value!).SequenceEqual(new[] { target, 4, 5 }), "Driver roundtrip mismatch");
+            await driver.UnsubscribeAsync(sub, ct); sub = null!;
+            // Reinitialize a live connection with an active replacement subscription, as the watchdog does.
+            sub = await driver.SubscribeAsync(["scalar", "vector"], TimeSpan.FromMilliseconds(100), ct);
+            await driver.ReinitializeAsync("{}", ct); sub = null!;
+            CheckManager(manager, true); manager = null;
+            manager = AppManager(driver); CheckManager(manager, false);
+            Require(driver.GetHealth().State == DriverState.Healthy, "Live reinitialize failed");
+            var reinitialized = await driver.ReadAsync(["scalar"], ct);
+            Require(reinitialized.Count == 1 && reinitialized[0].StatusCode == 0 && Equals(reinitialized[0].Value, target), "Live reinitialize read failed");
+            await driver.ShutdownAsync(ct); driver.OnDataChange -= driverHandler;
+            Require(driver.GetHealth().State == DriverState.Unknown, "Driver shutdown public state retained");
+            Require(FieldOrNull(driver, "<Session>k__BackingField") is null, "Driver session retained");
+            Empty(driver, "_subscriptions"); Empty(driver, "_alarmSubscriptions");
+            CheckManager(manager, true); manager = null; driverPasses++;
+
+            var browse = await browser.OpenAsync(JsonSerializer.Serialize(Options(endpoint)), ct); Weak.Add(new(browse));
+            manager = AppManager(browse); CheckManager(manager, false);
+            Require((await browse.RootAsync(ct)).Count > 0, "Browser root empty");
+            await browse.DisposeAsync().AsTask().WaitAsync(ct); CheckManager(manager, true); manager = null; browserPasses++;
+        }
+    }
+    static object Resources(int cycle, double elapsed)
+    {
+        GC.Collect(); GC.WaitForPendingFinalizers(); GC.Collect();
+        var survivors = Weak.Count(w => w.IsAlive); Weak.RemoveAll(w => !w.IsAlive);
+        Require(survivors == 0, "Disposed production client/driver/browser object retained after full GC");
+        var fd = Directory.GetFiles("/proc/self/fd");
+        var owned = 0; var pki = 0;
+        foreach (var path in fd)
+        {
+            var target = new FileInfo(path).LinkTarget;
+            if (target is null || !Path.IsPathFullyQualified(target)) continue;
+            target = Path.GetFullPath(target);
+            if (target.StartsWith(Path.GetFullPath(Root) + Path.DirectorySeparatorChar, StringComparison.Ordinal)) owned++;
+            if (target.StartsWith(Path.Combine(Path.GetFullPath(Root), "data") + Path.DirectorySeparatorChar, StringComparison.Ordinal)) pki++;
+        }
+        using var p = Process.GetCurrentProcess();
+        return new { cycle, elapsedSeconds = elapsed, utc = DateTime.UtcNow, p.WorkingSet64, p.PrivateMemorySize64,
+            managedBytes = GC.GetTotalMemory(false), allocatedBytes = GC.GetTotalAllocatedBytes(),
+            gc = new[] { GC.CollectionCount(0), GC.CollectionCount(1), GC.CollectionCount(2) },
+            fdCount = fd.Length, ownedRootFdCount = owned, ownedPkiFdCount = pki, survivingProductionObjects = survivors,
+            managerDisposalsVerified = managerChecks, sharedPasses, driverPasses, browserPasses };
+    }
+    static async Task Run(string endpoint, int seconds, bool full)
+    {
+        Require(!full || seconds >= 7200, "Full soak requires >=7200 requested seconds");
+        // Deliberate owned-manager positive control proves the exact-tag read-only diagnostic sees both states.
+        var control = CertificateManagerFactory.Create(new SecurityConfiguration(), DefaultTelemetry.Create(_ => { }));
+        Require(!Disposed(control), "Disposal diagnostic control false-state failure");
+        await control.DisposeAsync(); Require(Disposed(control), "Disposal diagnostic control true-state failure");
+        control = null!;
+        var originalCerts = CertificateHashes();
+        var elapsed = Stopwatch.StartNew(); var cycle = 0;
+        File.AppendAllText(Path.Combine(Root, "resources.jsonl"), JsonSerializer.Serialize(Resources(0, 0)) + "\n");
+        while (elapsed.Elapsed.TotalSeconds < seconds)
+        {
+            await Cycle(endpoint, ++cycle).WaitAsync(TimeSpan.FromSeconds(65));
+            // The async cycle has returned, dropping its strong manager/session/item/event references.
+            await Task.Delay(300);
+            var serverPath = Path.Combine(Root, "server", "live-resources.json");
+            var settledOk = false;
+            for (var attempt = 0; attempt < 30; attempt++)
+            {
+                using var settled = JsonDocument.Parse(await File.ReadAllTextAsync(serverPath));
+                settledOk = new[] { "sessions", "subscriptions", "items" }.All(name => settled.RootElement.GetProperty(name).GetInt32() == 0);
+                if (settledOk) break;
+                await Task.Delay(100);
+            }
+            Require(settledOk, "Server sessions/subscriptions/items retained after bounded settling");
+            if (cycle % 10 == 0 || elapsed.Elapsed.TotalSeconds >= seconds)
+                File.AppendAllText(Path.Combine(Root, "resources.jsonl"), JsonSerializer.Serialize(Resources(cycle, elapsed.Elapsed.TotalSeconds)) + "\n");
+        }
+        Require(elapsed.Elapsed.TotalSeconds >= seconds && (!full || elapsed.Elapsed.TotalSeconds >= 7200), "Real elapsed duration gate failed");
+        Require(managerChecks == cycle * 8 && sharedPasses == cycle * 2 && driverPasses == cycle * 2 && browserPasses == cycle * 2, "Incomplete lifecycle accounting");
+        Require(CertificateHashes().SequenceEqual(originalCerts), "Application certificate unexpectedly rotated or PKI changed");
+        var summary = new { status = "passed", diagnosticPositiveControl = "exact SDK2 manager false-before/true-after DisposeAsync", applicationCertificateHashes = originalCerts, requestedSeconds = seconds, elapsedSeconds = elapsed.Elapsed.TotalSeconds,
+            fullTwoHourLifecycle = full && elapsed.Elapsed.TotalSeconds >= 7200, cycles = cycle, sharedPasses, driverPasses, browserPasses,
+            managerDisposalsVerified = managerChecks, finalResources = Resources(cycle, elapsed.Elapsed.TotalSeconds),
+            scope = "Production Shared connect/disconnect/reconnect; production driver Initialize/Reinitialize/Shutdown/dispose; production browser open/browse/dispose; scalar and Int32[3] read/write/subscribe/unsubscribe; strict mutual trusted DER/Basic256Sha256 SignAndEncrypt/API-key fixture. No network stalls, revocation, surgical edits/rebuild, CP abandonment or Windows/AVEVA/performance G4 claim." };
+        File.WriteAllText(Path.Combine(Root, "summary.json"), JsonSerializer.Serialize(summary, Json));
+    }
+    static string[] CertificateHashes() => Directory.GetFiles(Path.Combine(Root, "data"), "*.der", SearchOption.AllDirectories)
+        .Where(p => p.Contains(Path.DirectorySeparatorChar + "own" + Path.DirectorySeparatorChar + "certs" + Path.DirectorySeparatorChar, StringComparison.Ordinal))
+        .Order().Select(p => Path.GetRelativePath(Root, p) + ":" + Convert.ToHexString(SHA256.HashData(File.ReadAllBytes(p))).ToLowerInvariant()).ToArray();
+    public static async Task<int> Main(string[] args)
+    {
+        if (args[0] == "server") return await ProcessHost.HelperMain(args);
+        Root = Path.GetFullPath(args[1]); Directory.CreateDirectory(Root);
+        try
+        {
+            var local = Path.GetFullPath(Environment.GetFolderPath(Environment.SpecialFolder.LocalApplicationData));
+            Require(local == Path.Combine(Root, "data"), "XDG task PKI isolation failed");
+            if (args[0] == "prepare") { await Prepare(); return 0; }
+            Require(args[0] == "run", "Unknown mode");
+            await Run(args[2], int.Parse(args[3]), args[4] == "full");
+            var sdk = AppDomain.CurrentDomain.GetAssemblies().Where(a => a.GetName().Name!.StartsWith("Opc.Ua", StringComparison.Ordinal))
+                .Select(a => new { name = a.GetName().Name, version = a.GetName().Version?.ToString(), sha256 = Convert.ToHexString(SHA256.HashData(File.ReadAllBytes(a.Location))).ToLowerInvariant() });
+            File.WriteAllText(Path.Combine(Root, "sdk-assemblies.json"), JsonSerializer.Serialize(sdk, Json));
+            return 0;
+        }
+        catch (Exception error)
+        {
+            File.WriteAllText(Path.Combine(Root, "failure.txt"), error.ToString().Replace(Password, "<fixture-secret>"));
+            return 1;
+        }
+    }
+}

scripts/validation/opcua-client-lifecycle/Lifecycle.csproj

@@ -0,0 +1,9 @@
+<Project Sdk="Microsoft.NET.Sdk">
+<PropertyGroup><OutputType>Exe</OutputType><StartupObject>Lifecycle</StartupObject><DefineConstants>SDK2</DefineConstants></PropertyGroup>
+<ItemGroup>
+<FrameworkReference Include="Microsoft.AspNetCore.App" />
+<ProjectReference Include="../../../src/Server/ZB.MOM.WW.OtOpcUa.Host/ZB.MOM.WW.OtOpcUa.Host.csproj" />
+<ProjectReference Include="../../../src/Client/ZB.MOM.WW.OtOpcUa.Client.Shared/ZB.MOM.WW.OtOpcUa.Client.Shared.csproj" />
+<ProjectReference Include="../../../src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.csproj" />
+<ProjectReference Include="../../../src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.Browser/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.Browser.csproj" />
+</ItemGroup></Project>

scripts/validation/opcua-client-lifecycle/ProcessHost.cs

@@ -0,0 +1,360 @@
+// Copy of compatibility ProcessHost at 7b353d7b; lifecycle-owned changes only.
+#pragma warning disable OTOPCUA0001 // This wire harness deliberately exercises public driver capabilities directly.
+using System.Collections.Concurrent;
+using System.Net;
+using System.Net.Sockets;
+using System.Reflection;
+using System.Text.Json;
+using Microsoft.Extensions.Logging.Abstractions;
+using Opc.Ua;
+using Opc.Ua.Client;
+using ZB.MOM.WW.OtOpcUa.Client.Shared;
+using ZB.MOM.WW.OtOpcUa.Client.Shared.Models;
+using ZB.MOM.WW.OtOpcUa.Commons.OpcUa;
+using ZB.MOM.WW.OtOpcUa.Configuration.Entities;
+using ZB.MOM.WW.OtOpcUa.Configuration.Enums;
+using ZB.MOM.WW.OtOpcUa.Core.Abstractions;
+using ZB.MOM.WW.OtOpcUa.Core.Authorization;
+using ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient;
+using ZB.MOM.WW.OtOpcUa.OpcUaServer;
+using ZB.MOM.WW.OtOpcUa.OpcUaServer.Security;
+using AlarmEventArgs = ZB.MOM.WW.OtOpcUa.Client.Shared.Models.AlarmEventArgs;
+using WriteRequest = ZB.MOM.WW.OtOpcUa.Core.Abstractions.WriteRequest;
+using SharedSecurityMode = ZB.MOM.WW.OtOpcUa.Client.Shared.Models.SecurityMode;
+using CoreHistory = ZB.MOM.WW.OtOpcUa.Core.Abstractions.HistoryReadResult;
+
+internal static partial class ProcessHost
+{
+    static readonly DateTime Epoch = new(2026, 10, 1, 0, 0, 0, DateTimeKind.Utc);
+    const string RawUri = "https://zb.com/otopcua/raw", UnsUri = "https://zb.com/otopcua/uns";
+    const string Folder = "Matrix/dev", Scalar = Folder + "/Scalar", Vector = Folder + "/Vector", Alarm = Folder + "/Alarm";
+    static readonly CancellationToken Ct = new CancellationTokenSource(TimeSpan.FromSeconds(int.Parse(Environment.GetEnvironmentVariable("OPCUA_LIFECYCLE_SERVER_SECONDS") ?? "240"))).Token;
+    static string Password => Environment.GetEnvironmentVariable("OPCUA_MATRIX_PASSWORD") ?? throw new InvalidOperationException("Missing ephemeral credential");
+    static readonly List<object> Cases = [];
+    static readonly List<object> Observations = [];
+    static int Failures;
+    static string Root = "";
+    static object? Clr(DataValue v)
+    {
+#if SDK2
+        return ZB.MOM.WW.OtOpcUa.Client.Shared.Helpers.ValueConverter.ToClrObject(v.WrappedValue);
+#else
+        return v.Value;
+#endif
+    }
+    static DateTime SourceTime(DataValue value)
+    {
+#if SDK2
+        return value.SourceTimestamp.ToDateTime();
+#else
+        return value.SourceTimestamp;
+#endif
+    }
+    static DateTime ServerTime(DataValue value)
+    {
+#if SDK2
+        return value.ServerTimestamp.ToDateTime();
+#else
+        return value.ServerTimestamp;
+#endif
+    }
+    static void Require(bool yes, string message) { if (!yes) throw new InvalidOperationException(message); }
+    static async Task Case(string name, Func<Task> action)
+    {
+        try { await action(); Cases.Add(new { name, status = "passed" }); }
+        catch (Exception e) { Failures++; Cases.Add(new { name, status = "failed", error = e.ToString() }); }
+    }
+    static async Task Wait(Func<bool> predicate)
+    {
+        for (int i = 0; i < 200; i++) { if (predicate()) return; await Task.Delay(50, Ct); }
+        Require(false, "Notification deadline exceeded");
+    }
+    static ConnectionSettings Settings(string endpoint) => new()
+    {
+        EndpointUrl = endpoint,
+        Username = "apikey",
+        Password = Password,
+        SecurityMode = SharedSecurityMode.SignAndEncrypt,
+        AutoAcceptCertificates = false,
+        CertificateStorePath = Environment.GetEnvironmentVariable("OPCUA_MATRIX_CLIENT_PKI") ?? Path.Combine(Root, "client-pki")
+    };
+    public static async Task<int> HelperMain(string[] args)
+    {
+        Root = Path.GetFullPath(args[1]); Directory.CreateDirectory(Root);
+        try
+        {
+            switch (args[0])
+            {
+                case "local-data-path": Console.WriteLine(Environment.GetFolderPath(Environment.SpecialFolder.LocalApplicationData)); return 0;
+                case "driver": await Driver(args[2]); break;
+                case "server": await Serve(); return 0;
+                case "client": await Client(args[2]); break;
+                case "performance": await Performance(args[2]); break;
+                default: throw new ArgumentException("Expected prepare/server/client");
+            }
+        }
+        catch (Exception e) { Failures++; Cases.Add(new { name = "process", status = "failed", error = e.ToString() }); }
+        File.WriteAllText(Path.Combine(Root, "result.json"), JsonSerializer.Serialize(new { sdk = typeof(NodeId).Assembly.GetName().Version?.ToString(), process = Environment.ProcessId, cases = Cases, observations = Observations, failures = Failures, loadedSdkAssemblies = AppDomain.CurrentDomain.GetAssemblies().Where(a => a.GetName().Name!.StartsWith("Opc.Ua", StringComparison.Ordinal)).Select(a => new { name = a.GetName().Name, version = a.GetName().Version?.ToString(), path = a.Location }) }, new JsonSerializerOptions { WriteIndented = true }));
+        return Failures == 0 ? 0 : 1;
+    }
+    static async Task Serve()
+    {
+        var options = new OpcUaApplicationHostOptions
+        {
+            ApplicationName = "OtOpcUa.Matrix",
+            ApplicationUri = "urn:OtOpcUa.Matrix.ClientLifecycle",
+            PublicHostname = "127.0.0.1",
+            PkiStoreRoot = Path.Combine(Root, "server-pki"),
+            AllowAnonymous = false,
+            AutoAcceptUntrustedClientCertificates = false,
+            EnabledSecurityProfiles = Environment.GetEnvironmentVariable("OPCUA_MATRIX_SERVER_SECURITY") == "none"
+                ? [OpcUaSecurityProfile.None] : [OpcUaSecurityProfile.Basic256Sha256SignAndEncrypt]
+        };
+        using (var listener = new TcpListener(IPAddress.Loopback, 0)) { listener.Start(); options.OpcUaPort = ((IPEndPoint)listener.LocalEndpoint).Port; }
+        var server = new OtOpcUaSdkServer();
+        await using var host = new OpcUaApplicationHost(options, NullLogger<OpcUaApplicationHost>.Instance, new Auth());
+        await host.StartAsync(server, Ct);
+        var nm = server.NodeManager!; var sink = new SdkAddressSpaceSink(nm);
+        var authority = new DataPlaneAuthorityState();
+        authority.Apply("matrix", "rev1", [new ApiKey { ApiKeyId = "matrix", Name = "matrix", SecretHash = "fixture", Principal = "matrix", Enabled = true, CreatedUtc = DateTime.UtcNow.AddDays(-1) }],
+            [new NodeAcl { NodeAclId = "all", ClusterId = "matrix", Principal = "matrix", ScopeKind = NodeAclScopeKind.Cluster, PermissionFlags = (NodePermissions)int.MaxValue }], new Dictionary<AclScopeRef, IReadOnlyList<NodeAclPath>>());
+        nm.DataPlaneAuthority = authority;
+        nm.Authorizer = new DataPlaneAuthorizer(authority, new TriePermissionEvaluator(authority.Tries), true, NullLogger.Instance, TimeProvider.System);
+        var history = new Source(Root); nm.HistorianDataSource = history;
+        sink.EnsureFolder(Folder, null, "dev", AddressSpaceRealm.Raw);
+        sink.EnsureFolder("Eq", null, "Eq", AddressSpaceRealm.Uns);
+        foreach (var realm in new[] { AddressSpaceRealm.Raw, AddressSpaceRealm.Uns })
+        {
+            var scalar = realm == AddressSpaceRealm.Raw ? Scalar : "Eq/Scalar";
+            var vector = realm == AddressSpaceRealm.Raw ? Vector : "Eq/Vector";
+            var parent = realm == AddressSpaceRealm.Raw ? Folder : "Eq";
+            sink.EnsureVariable(scalar, parent, "Scalar", "Int32", true, realm, "matrix.scalar");
+            sink.EnsureVariable(vector, parent, "Vector", "Int32", true, realm, isArray: true, arrayLength: 3);
+            sink.WriteValue(scalar, 17, 0, Epoch, realm); sink.WriteValue(vector, new[] { 1, 2, 3 }, 0, Epoch, realm);
+        }
+        sink.AddReference("Eq/Scalar", AddressSpaceRealm.Uns, Scalar, AddressSpaceRealm.Raw);
+        sink.MaterialiseAlarmCondition(Alarm, Folder, "Alarm", "OffNormalAlarm", 800, AddressSpaceRealm.Raw, isNative: true);
+        sink.WireAlarmNotifiers(Alarm, AddressSpaceRealm.Raw, ["Eq"], AddressSpaceRealm.Uns);
+        sink.EnsureVariable(Folder + "/UnsetTimestamp", Folder, "UnsetTimestamp", "Int32", false, AddressSpaceRealm.Raw);
+        sink.WriteValue(Folder + "/UnsetTimestamp", 3, 0, DateTime.MinValue, AddressSpaceRealm.Raw);
+        nm.NodeWriteGateway = new Gateway();
+        var state = new AlarmConditionSnapshot(true, false, true, true, AlarmShelvingKind.Unshelved, 800, "matrix-alarm");
+        nm.NativeAlarmAckRouter = _ => Task.Run(() => { state = state with { Acknowledged = true }; sink.WriteAlarmCondition(Alarm, state, DateTime.UtcNow, AddressSpaceRealm.Raw); });
+        File.WriteAllText(Path.Combine(Root, "endpoint.txt"), $"opc.tcp://127.0.0.1:{options.OpcUaPort}/OtOpcUa");
+        File.WriteAllText(Path.Combine(Root, "ready.json"), JsonSerializer.Serialize(new { endpoint = $"opc.tcp://127.0.0.1:{options.OpcUaPort}/OtOpcUa", process = Environment.ProcessId, sdk = typeof(NodeId).Assembly.GetName().Version?.ToString(), rawUri = RawUri, unsUri = UnsUri }));
+        int tick = 0;
+        while (!File.Exists(Path.Combine(Root, "stop")))
+        {
+            sink.WriteAlarmCondition(Alarm, state with { Message = ++tick % 2 == 0 ? "matrix-alarm" : "matrix-tick" }, DateTime.UtcNow, AddressSpaceRealm.Raw);
+            var counts = ServerCounts(server);
+            File.WriteAllText(Path.Combine(Root, "live-resources.tmp"), JsonSerializer.Serialize(counts));
+            File.Move(Path.Combine(Root, "live-resources.tmp"), Path.Combine(Root, "live-resources.json"), true);
+            await Task.Delay(250, Ct);
+        }
+        using var process = System.Diagnostics.Process.GetCurrentProcess();
+        File.WriteAllText(Path.Combine(Root, "server-resources.json"), JsonSerializer.Serialize(new { process.WorkingSet64, process.PrivateMemorySize64, process.HandleCount, threads=process.Threads.Count, cpuMilliseconds=process.TotalProcessorTime.TotalMilliseconds, allocatedBytes=GC.GetTotalAllocatedBytes(), collections=new[]{GC.CollectionCount(0),GC.CollectionCount(1),GC.CollectionCount(2)} }, new JsonSerializerOptions {WriteIndented=true}));
+    }
+    static async Task Client(string endpoint)
+    {
+        using var client = new OpcUaClientService();
+        await Case("trusted-SignAndEncrypt-API-key", async () => { var info = await client.ConnectAsync(Settings(endpoint), Ct); Require(info.SecurityMode == "SignAndEncrypt" && info.SecurityPolicyUri == SecurityPolicies.Basic256Sha256, "Unexpected negotiated policy"); Observations.Add(new { info.SecurityMode, info.SecurityPolicyUri }); });
+        if (!client.IsConnected) return;
+        var namespaces = (string[])Clr(await client.ReadValueAsync(VariableIds.Server_NamespaceArray, Ct))!;
+        var raw = (ushort)Array.IndexOf(namespaces, RawUri); var uns = (ushort)Array.IndexOf(namespaces, UnsUri);
+        NodeId ScalarId(ushort ns) => new(ns == raw ? Scalar : "Eq/Scalar", ns);
+        NodeId VectorId(ushort ns) => new(ns == raw ? Vector : "Eq/Vector", ns);
+        await Case("raw-UNS-URI-browse", async () =>
+        {
+            Require(raw > 0 && uns > 0, "Missing namespace URI");
+            var rawChildren = await client.BrowseAsync(new NodeId(Folder, raw), Ct);
+            var unsChildren = await client.BrowseAsync(new NodeId("Eq", uns), Ct);
+            Observations.Add(new { rawChildren, unsChildren });
+            // Supplement the production Shared results with unfiltered wire-reference metadata.
+            var adapter = typeof(OpcUaClientService).GetField("_session", BindingFlags.Instance | BindingFlags.NonPublic)!.GetValue(client)!;
+            var sdkSession = (Opc.Ua.Client.Session)adapter.GetType().GetField("_session", BindingFlags.Instance | BindingFlags.NonPublic)!.GetValue(adapter)!;
+            var (_, _, rawReferences) = await sdkSession.BrowseAsync(null, null, new NodeId(Folder, raw), 0u,
+                BrowseDirection.Forward, ReferenceTypeIds.References, true, 0u);
+            Observations.Add(new { rawReferences = (rawReferences.ToArray() ?? []).Select(reference => new { nodeId = reference.NodeId.ToString(), browseName = reference.BrowseName.ToString(), nodeClass = reference.NodeClass.ToString(), typeDefinition = reference.TypeDefinition.ToString(), referenceType = reference.ReferenceTypeId.ToString(), reference.IsForward }).ToArray() });
+            var expectedRaw = new[] { Scalar, Vector, Alarm, Folder + "/UnsetTimestamp" }.Select(id => new NodeId(id, raw).ToString());
+            Require(expectedRaw.All(id => rawChildren.Any(child => child.NodeId == id)), "Missing raw children: " + string.Join(",", expectedRaw.Where(id => !rawChildren.Any(child => child.NodeId == id))));
+            Require(new[] { "Eq/Scalar", "Eq/Vector" }.Select(id => new NodeId(id, uns).ToString()).All(id => unsChildren.Any(child => child.NodeId == id)), "Missing UNS scalar/array children");
+        });
+        await Case("initial-quality-explicit-source-and-server-timestamps", async () => { var initial = await client.ReadValueAsync(ScalarId(raw), Ct); Require(StatusCode.IsGood(initial.StatusCode), "Bad initial quality"); Require(SourceTime(initial) == Epoch && ServerTime(initial) > Epoch, "Lost explicit initial timestamps"); Observations.Add(new { sourceTimestamp = SourceTime(initial).ToString("O"), serverTimestamp = ServerTime(initial).ToString("O"), contract = "Source supplied as 2026-10-01T00:00:00Z; server timestamp observed without normalization or historian algorithm changes" }); });
+        foreach (var ns in new[] { raw, uns })
+        {
+            await Case($"scalar-read-write-ns-{ns}", async () => { Require(Clr(await client.ReadValueAsync(ScalarId(ns), Ct)) is int, "Scalar lost Int32 type"); Require(StatusCode.IsGood(await client.WriteValueAsync(ScalarId(ns), 42, Ct)), "Scalar write failed"); Require((int)Clr(await client.ReadValueAsync(ScalarId(ns), Ct))! == 42, "Scalar round trip failed"); });
+            await Case($"typed-array-read-write-ns-{ns}", async () => { Require(Clr(await client.ReadValueAsync(VectorId(ns), Ct)) is int[], "Array lost Int32[] type"); Require(StatusCode.IsGood(await client.WriteValueAsync(VectorId(ns), new[] { 7, 8, 9 }, Ct)), "Array write failed"); Require(((int[])Clr(await client.ReadValueAsync(VectorId(ns), Ct))!).SequenceEqual(new[] { 7, 8, 9 }), "Array round trip failed"); });
+        }
+        await Case("monitor-quality-timestamps", async () => { var seen = new ConcurrentQueue<DataValue>(); client.DataChanged += (_, e) => seen.Enqueue(e.Value); await client.SubscribeAsync(ScalarId(raw), 100, Ct); await client.WriteValueAsync(ScalarId(raw), 73, Ct); await Wait(() => seen.Any(v => Equals(Clr(v), 73))); var v = seen.Last(v => Equals(Clr(v), 73)); Require(StatusCode.IsGood(v.StatusCode) && SourceTime(v) > Epoch && ServerTime(v) > Epoch, "Bad monitor quality or missing timestamps"); Observations.Add(new { sourceTimestamp = SourceTime(v).ToString("O"), serverTimestamp = ServerTime(v).ToString("O"), status = v.StatusCode.ToString() }); await client.UnsubscribeAsync(ScalarId(raw), Ct); });
+        await Case("event-filter-and-native-ack", async () => { var alarms = new ConcurrentQueue<AlarmEventArgs>(); client.AlarmEvent += (_, a) => alarms.Enqueue(a); await client.SubscribeAlarmsAsync(ObjectIds.Server, 100, Ct); await Wait(() => alarms.Any(a => a.Message == "matrix-alarm" && a.ActiveState && a.Severity == 800)); var alarm = alarms.Last(a => a.Message == "matrix-alarm"); Require(alarm.EventId?.Length > 0, "Missing event ID"); Require(StatusCode.IsGood(await client.AcknowledgeAlarmAsync(new NodeId(Alarm, raw).ToString(), alarm.EventId!, "matrix-ack", Ct)), "Ack refused"); await Wait(() => alarms.Any(a => a.Message == "matrix-alarm" && a.AckedState)); await client.UnsubscribeAlarmsAsync(Ct); });
+        await Case("raw-history-CP-paging", async () => { var values = await client.HistoryReadRawAsync(ScalarId(raw), Epoch, Epoch.AddMinutes(1), 100, Ct); Require(values.Count == 25, "Expected 25 raw samples, got " + values.Count); Require(values.Select(v => Convert.ToInt32(Clr(v))).SequenceEqual(Enumerable.Range(0, 25)), "Raw page loss/duplicates/order"); });
+        await Case("event-history-CP-paging", async () =>
+        {
+            var filter = new EventFilter();
+#if SDK2
+            filter.SelectClauses += new SimpleAttributeOperand(ObjectTypeIds.BaseEventType, new QualifiedName("EventId")) { AttributeId = Attributes.Value };
+#else
+            filter.SelectClauses.Add(new SimpleAttributeOperand {TypeDefinitionId=ObjectTypeIds.BaseEventType,BrowsePath=new QualifiedNameCollection {new QualifiedName("EventId")},AttributeId=Attributes.Value});
+#endif
+            var events = await client.HistoryReadEventsAsync(new NodeId(Folder, raw), Epoch, Epoch.AddMinutes(1), filter, 100, Ct); Require(events.Count == 25, "Expected 25 event samples, got " + events.Count);
+#if SDK2
+            var ids = events.Select(e => System.Text.Encoding.UTF8.GetString((byte[])ZB.MOM.WW.OtOpcUa.Client.Shared.Helpers.ValueConverter.ToClrObject(e.Fields[0])!));
+#else
+            var ids=events.Select(e=>System.Text.Encoding.UTF8.GetString((byte[])e.Fields[0].Value));
+#endif
+            Require(ids.SequenceEqual(Enumerable.Range(0, 25).Select(i => $"e{i:00}")), "Event history loss/duplicates/order across timestamp ties");
+        });
+        await Case("event-history-where-filter-positive-and-negative", async () =>
+        {
+            foreach (var type in new[] { ObjectTypeIds.BaseEventType, ObjectTypeIds.AuditEventType })
+            {
+                var filter = new EventFilter();
+#if SDK2
+                filter.SelectClauses += new SimpleAttributeOperand(ObjectTypeIds.BaseEventType, new QualifiedName("EventId")) { AttributeId = Attributes.Value };
+                filter.WhereClause.Push(FilterOperator.OfType, Variant.From(type));
+#else
+                filter.SelectClauses.Add(new SimpleAttributeOperand(ObjectTypeIds.BaseEventType,new QualifiedName("EventId")){AttributeId=Attributes.Value});
+                filter.WhereClause.Push(FilterOperator.OfType,new LiteralOperand(new Variant(type)));
+#endif
+                var events = await client.HistoryReadEventsAsync(new NodeId(Folder, raw), Epoch, Epoch.AddMinutes(1), filter, 100, Ct);
+                Require(events.Count == (type == ObjectTypeIds.BaseEventType ? 25 : 0), $"Where filter for {type} expected {(type == ObjectTypeIds.BaseEventType ? 25 : 0)} got {events.Count}");
+            }
+        });
+        var unset = await client.ReadValueAsync(new NodeId(Folder + "/UnsetTimestamp", raw), Ct);
+        Observations.Add(new { sourceTimestamp = SourceTime(unset).ToString("O"), serverTimestamp = ServerTime(unset).ToString("O"), timestampObservation = "Fixture source supplied DateTime.MinValue (unset). These are unmodified application/SDK wire observations; no historian algorithm or expected timestamp was changed." });
+        await Benchmark(client, ScalarId(raw), VectorId(raw));
+        await client.DisconnectAsync(Ct);
+    }
+    static OpcUaClientDriverOptions DriverOptions(string endpoint) => new()
+    {
+        EndpointUrl = endpoint,
+        SecurityPolicy = OpcUaSecurityPolicy.Basic256Sha256,
+        SecurityMode = OpcUaSecurityMode.SignAndEncrypt,
+        AuthType = OpcUaAuthType.Username,
+        Username = "apikey",
+        Password = Password,
+        AutoAcceptCertificates = false,
+        RawTags = [new("scalar",JsonSerializer.Serialize(new {nodeId=$"nsu={RawUri};s={Scalar}"}),true),
+            new("vector",JsonSerializer.Serialize(new {nodeId=$"nsu={RawUri};s={Vector}"}),true),
+            new("uns",JsonSerializer.Serialize(new {nodeId=$"nsu={UnsUri};s=Eq/Scalar"}),true)],
+        SessionName = "MatrixDriver",
+        ApplicationUri = "urn:localhost:MatrixDriver"
+    };
+    static string IsolatedLocalData()
+    {
+        var local = Path.GetFullPath(Environment.GetFolderPath(Environment.SpecialFolder.LocalApplicationData));
+        Require(local.StartsWith(Path.GetFullPath(Root) + Path.DirectorySeparatorChar, StringComparison.Ordinal), "Driver/CLI canonical PKI must be in task-owned root: " + local);
+        return local;
+    }
+    static async Task Driver(string endpoint)
+    {
+        IsolatedLocalData();
+        await using var driver = new OpcUaClientDriver(DriverOptions(endpoint), "matrix");
+        await Case("driver-trusted-encrypted-API-key-connect", () => driver.InitializeAsync("{}", Ct));
+        await Case("driver-raw-UNS-URI-scalar-and-array-read", async () =>
+        {
+            var values = await driver.ReadAsync(["scalar", "vector", "uns"], Ct);
+            Require(values.Count == 3 && values.All(x => x.StatusCode == 0), "Read failure");
+            Require(values[0].Value is int && values[1].Value is int[] && values[2].Value is int, "Lost scalar/array type");
+        });
+        await Case("driver-scalar-array-write-roundtrip", async () =>
+        {
+            var writes = await driver.WriteAsync([new WriteRequest("scalar", 91), new WriteRequest("vector", new[] { 11, 12, 13 })], Ct);
+            Require(writes.All(x => x.StatusCode == 0), "Write failed");
+            var values = await driver.ReadAsync(["scalar", "vector"], Ct);
+            Require(Equals(values[0].Value, 91) && ((int[])values[1].Value!).SequenceEqual(new[] { 11, 12, 13 }), "Write round trip mismatch");
+        });
+        await Case("driver-monitor-quality-timestamps", async () =>
+        {
+            var seen = new ConcurrentQueue<DataValueSnapshot>();
+            driver.OnDataChange += (_, e) => seen.Enqueue(e.Snapshot);
+            var subscription = await driver.SubscribeAsync(["scalar"], TimeSpan.FromMilliseconds(100), Ct);
+            await driver.WriteAsync([new WriteRequest("scalar", 92)], Ct);
+            await Wait(() => seen.Any(x => Equals(x.Value, 92)));
+            var value = seen.Last(x => Equals(x.Value, 92));
+            Require(value.StatusCode == 0 && value.SourceTimestampUtc.HasValue && value.ServerTimestampUtc > Epoch, "Missing monitor quality/timestamps");
+            Observations.Add(new { value.SourceTimestampUtc, value.ServerTimestampUtc, value.StatusCode });
+            await driver.UnsubscribeAsync(subscription, Ct);
+        });
+        Observations.Add(new { capability = "driver-history", status = "not-applicable", evidence = "Driver has no IHistoryProvider/HistoryRead capability; .claude/rules/drivers.md #655. Shared/CLI own history." });
+        await driver.ShutdownAsync(Ct);
+    }
+    static async Task Performance(string endpoint)
+    {
+        using var client = new OpcUaClientService();
+        var info = await client.ConnectAsync(Settings(endpoint), Ct);
+        Require(info.SecurityMode == "SignAndEncrypt" && info.SecurityPolicyUri == SecurityPolicies.Basic256Sha256, "Unexpected benchmark endpoint policy");
+        var namespaces = (string[])Clr(await client.ReadValueAsync(VariableIds.Server_NamespaceArray, Ct))!;
+        var raw = (ushort)Array.IndexOf(namespaces, RawUri);
+        Require(raw > 0, "Missing benchmark raw namespace");
+        Observations.Add(new {info.SecurityMode, info.SecurityPolicyUri, tieredCompilation=Environment.GetEnvironmentVariable("DOTNET_TieredCompilation"), scope="Two scalar/Int32[3] variables; zero data monitors during measurement; five fixture variables and one native condition"});
+        await Case("warmed-production-client-read-write-measurement", () => Benchmark(client, new NodeId(Scalar, raw), new NodeId(Vector, raw)));
+        await client.DisconnectAsync(Ct);
+    }
+    static async Task Benchmark(OpcUaClientService client, NodeId scalar, NodeId vector)
+    {
+        // Local diagnostic subset; excludes reconnect, history and load.
+        var rounds = int.Parse(Environment.GetEnvironmentVariable("OPCUA_MATRIX_PERF_ROUNDS") ?? "3");
+        var warmups = int.Parse(Environment.GetEnvironmentVariable("OPCUA_MATRIX_PERF_WARMUPS") ?? "10");
+        var measured = int.Parse(Environment.GetEnvironmentVariable("OPCUA_MATRIX_PERF_MEASURED") ?? "50");
+        Require(rounds > 0 && warmups >= 0 && measured > 0, "Invalid performance sample counts");
+        for (int round = 1; round <= rounds; round++)
+        {
+            for (int warmup = 0; warmup < warmups; warmup++)
+            {
+                await client.ReadValueAsync(scalar, Ct); await client.WriteValueAsync(scalar, warmup, Ct);
+                await client.ReadValueAsync(vector, Ct); await client.WriteValueAsync(vector, new[] { warmup, warmup + 1, warmup + 2 }, Ct);
+            }
+            var samples = new Dictionary<string, List<double>>();
+            var before = System.Diagnostics.Process.GetCurrentProcess(); var cpu = before.TotalProcessorTime;
+            var allocated = GC.GetTotalAllocatedBytes(); var gc = new[] { GC.CollectionCount(0), GC.CollectionCount(1), GC.CollectionCount(2) };
+            foreach (var operation in new[] { "scalar-read", "scalar-write", "array-read", "array-write" })
+            {
+                var times = new List<double>();
+                for (int i = 0; i < measured; i++)
+                {
+                    var start = System.Diagnostics.Stopwatch.GetTimestamp();
+                    if (operation == "scalar-read") await client.ReadValueAsync(scalar, Ct);
+                    else if (operation == "scalar-write") Require(StatusCode.IsGood(await client.WriteValueAsync(scalar, i, Ct)), "Benchmark scalar write");
+                    else if (operation == "array-read") await client.ReadValueAsync(vector, Ct);
+                    else Require(StatusCode.IsGood(await client.WriteValueAsync(vector, new[] { i, i + 1, i + 2 }, Ct)), "Benchmark array write");
+                    times.Add(System.Diagnostics.Stopwatch.GetElapsedTime(start).TotalMilliseconds);
+                }
+                samples[operation] = times;
+            }
+            before.Refresh();
+            Observations.Add(new
+            {
+                benchmarkRound = round,
+                warmupOperationsPerKind = 10,
+                operationsPerKind = 50,
+                latencyMilliseconds = samples.ToDictionary(x => x.Key, x => new { p50 = x.Value.Order().ElementAt((int)Math.Ceiling(measured * 0.50) - 1), p95 = x.Value.Order().ElementAt((int)Math.Ceiling(measured * 0.95) - 1), p99 = x.Value.Order().ElementAt((int)Math.Ceiling(measured * 0.99) - 1), throughputOperationsPerSecond = measured * 1000.0 / x.Value.Sum() }),
+                clientCpuMilliseconds = (before.TotalProcessorTime - cpu).TotalMilliseconds,
+                clientAllocatedBytes = GC.GetTotalAllocatedBytes() - allocated, clientAllocatedBytesPerOperation = (GC.GetTotalAllocatedBytes() - allocated) / (4.0 * measured),
+                clientWorkingSetBytes = before.WorkingSet64,
+                clientPrivateBytes = before.PrivateMemorySize64,
+                clientThreads = before.Threads.Count,
+                clientHandles = before.HandleCount,
+                collections = new[] { GC.CollectionCount(0) - gc[0], GC.CollectionCount(1) - gc[1], GC.CollectionCount(2) - gc[2] }
+            });
+        }
+    }
+    sealed class Auth : IOpcUaUserAuthenticator
+    {
+        public Task<OpcUaUserAuthResult> AuthenticateUserNameAsync(string username, string password, CancellationToken ct) => Task.FromResult(username == "apikey" && password == Password ? OpcUaUserAuthResult.AllowKey("matrix", [OpcUaDataPlaneRoles.WriteOperate, OpcUaDataPlaneRoles.AlarmAck], "matrix") : OpcUaUserAuthResult.Deny("Invalid ephemeral fixture key"));
+    }
+    sealed class Gateway : IOpcUaNodeWriteGateway { public Task<NodeWriteOutcome> WriteAsync(string id, object? value, AddressSpaceRealm realm, CancellationToken ct) => Task.FromResult(new NodeWriteOutcome(true, null)); }
+    sealed class Source(string root) : IHistorianDataSource
+    {
+        void Log(string operation, int rows) => File.AppendAllText(Path.Combine(root, "history-requests.jsonl"), JsonSerializer.Serialize(new { operation, rows }) + "\n");
+        public int MaxRawValuesPerRead => 7;
+        public Task<CoreHistory> ReadRawAsync(string r, DateTime s, DateTime e, uint m, CancellationToken ct)
+        { var all = Enumerable.Range(0, 25).Select(i => new DataValueSnapshot(i, 0, Epoch.AddSeconds(i), Epoch.AddSeconds(i))).Where(v => v.SourceTimestampUtc >= s && v.SourceTimestampUtc < e).ToList(); var rows = all.Take((int)(m == 0 ? 7 : m)).ToArray(); Log("raw", rows.Length); return Task.FromResult(new CoreHistory(rows, all.Count > rows.Length ? [1] : null)); }
+        public Task<HistoricalEventsResult> ReadEventsAsync(string? source, DateTime s, DateTime e, int max, CancellationToken ct)
+        { var all = Enumerable.Range(0, 25).Select(i => new HistoricalEvent($"e{i:00}", "matrix", Epoch.AddSeconds(i / 2), Epoch, "matrix-history", 500)).Where(v => v.EventTimeUtc >= s && v.EventTimeUtc < e).ToList(); var rows = all.Take(Math.Min(7, max <= 0 ? 7 : max)).ToArray(); Log("events", rows.Length); return Task.FromResult(new HistoricalEventsResult(rows, all.Count > rows.Length ? [1] : null)); }
+        public Task<CoreHistory> ReadProcessedAsync(string r, DateTime s, DateTime e, TimeSpan i, HistoryAggregateType a, CancellationToken ct) => NullHistorianDataSource.Instance.ReadProcessedAsync(r, s, e, i, a, ct);
+        public Task<CoreHistory> ReadAtTimeAsync(string r, IReadOnlyList<DateTime> t, CancellationToken ct) => NullHistorianDataSource.Instance.ReadAtTimeAsync(r, t, ct);
+        public HistorianHealthSnapshot GetHealthSnapshot() => NullHistorianDataSource.Instance.GetHealthSnapshot();
+        public void Dispose() { }
+    }
+}

scripts/validation/opcua-client-lifecycle/README.md

@@ -0,0 +1,96 @@
+# Production OPC UA client lifecycle diagnostic
+
+This standalone harness runs the unchanged production `OpcUaClientService`,
+`OpcUaClientDriver`, and `OpcUaClientDriverBrowser` in one persistent Linux client
+process against a separate process using the production SDK server and node
+manager. Both processes load OPC Foundation SDK 2.0.1. The server fixture is a
+local copy of the compatibility harness at commit `7b353d7b`; only this directory's
+copy has configurable lifetime and atomic public resource snapshots.
+
+Run a short diagnostic from a checkout containing the SDK 2.0.1 changes:
+
+```sh
+python3 scripts/validation/opcua-client-lifecycle/run.py \
+  --duration 90 --output /tmp/otopcua-client-lifecycle-diagnostic-unique
+```
+
+The coordinator must launch and own the full process separately:
+
+```sh
+python3 scripts/validation/opcua-client-lifecycle/run.py \
+  --full --duration 7200 --output /tmp/otopcua-client-lifecycle-full-unique
+```
+
+The output path must not exist. `--full` rejects a duration below 7200 seconds;
+`fullTwoHourLifecycle` is true only after the client monotonic clock has actually
+elapsed at least 7200 seconds and every final check completes. A diagnostic pass
+cannot satisfy that gate. The outer process also has a duration plus 300-second
+hard deadline and forcibly removes its own container on timeout.
+
+The launcher publishes this standalone project, then uses the locally cached
+official `mcr.microsoft.com/dotnet/sdk:10.0.103-noble` Linux arm64 image with
+`--network none`, no host ports and fresh task-owned PKI. `XDG_DATA_HOME` is the
+only storage environment override; it never changes `HOME`. A generated
+credential stays in the child process environment. The output root is mode 0700
+and contains generated private keys: **never commit the entire output directory**.
+Commit only the selected redacted JSON/log receipts under `evidence/`.
+
+Preparation invokes bounded failing connections through each product's public
+API to create its own application certificate. It does not reflectively invoke
+configuration builders or replace the store. Before the live session, public DER
+certificates are exchanged explicitly among the three clients and server.
+Autoaccept is disabled on both ends. Negotiation must be Basic256Sha256
+SignAndEncrypt and API-key-shaped credentials must pass the fixture authenticator
+and production authority/ACL path. Existing own DER hashes must remain unchanged
+across all loop iterations.
+
+Every cycle performs two Shared connect/read/write/subscribe/unsubscribe/
+disconnect rounds on the same object. It performs two driver initialize/read/
+write/subscribe/unsubscribe rounds, each followed by a live reinitialize with an
+active subscription, then shutdown. It opens, browses and disposes two production
+AdminUI browser sessions. Scalar Int32 and Int32[3] writes must roundtrip exactly,
+and both Shared and driver scalar data notifications must arrive.
+
+The external harness reads ownership fields for diagnostics only. Fields are
+looked up by exact name, with missing/null layouts failing the run. It does not
+write reflected fields or change SDK state. For SDK 2.0.1.0 only, each captured
+`CertificateManager.m_disposed` boolean must be false while connected and true
+after release. An independently created, deliberately disposed SDK manager proves
+the before/after probe. All strong manager references are dropped each pass.
+Eight released managers are checked per cycle: two Shared, four driver (including
+live reinitialization), and two browser. Production session and data subscription
+collections must clear, and public Shared connection information and driver health
+must return to disconnected/Unknown. Collected weak references to disposed client,
+driver, browser and browse-session objects must have no survivors at samples.
+
+After every cycle the server's public session/subscription/monitored-item counts
+must return to zero within a bounded settle period. Resource samples capture GC,
+managed allocation/retained bytes, RSS/private bytes, global FDs and task/PKI FDs.
+Owned-path FD matching canonicalizes absolute paths and uses a path-separator
+boundary. Sampling starts cold, then every ten cycles and at completion. RSS and
+FD observations require interpretation after warmup; they are not performance
+budgets or an automatic G4 acceptance decision.
+
+Artifacts are `result.json`, `source.json`, `command.json`, `build.log`,
+`container.log`, and `task/{summary.json,resources.jsonl,sdk-assemblies.json,
+client.log,server.log,prepare.log,server/live-resources.json}`. A failure additionally
+writes a redacted `task/failure.txt`. The server uses a fixed application URI and
+the three client certificate stores are reused for the entire process lifetime.
+
+This is a small local lifecycle gate, not the entire Task 12 gate. It does not
+cover certificate revocation, network stalls, node surgical edits/rebuild,
+continuation-point abandonment/churn, representative driver fanout/load,
+Windows install/publish, ScadaBridge or AVEVA interoperability. It makes no
+baseline/candidate performance or full G4 claim. The coordinator's separate server
+lifecycle harness supplies complementary SDK session/CP/server mutation coverage.
+
+The checked-in 2026-11-10 diagnostic completed **91.104 seconds**, 68 cycles,
+136 Shared rounds, 136 driver rounds (plus 136 live driver reinitializations),
+136 browser sessions, and 544 verified released certificate managers. The final
+sample had zero surviving weak product objects and zero owned PKI FDs; server
+sessions/subscriptions/items returned to zero after every cycle. Warm samples
+showed 146–148 total FDs; the final managed heap was 4,737,536 bytes and RSS was
+181,018,624 bytes. The deliberate manager before/after control passed and
+`--full --duration 90` exited 2 before creating artifacts. This is diagnostic
+coverage only; the two-hour gate remains pending until a coordinator-owned full
+run completes. Receipts are under `evidence/2026-11-10-diagnostic/`.

scripts/validation/opcua-client-lifecycle/container.sh

@@ -0,0 +1,35 @@
+#!/usr/bin/env bash
+# Disposable network-isolated container only. All PKI is owned by this fresh task root.
+set -euo pipefail
+mkdir -p /task/data /task/server
+export XDG_DATA_HOME=/task/data
+export OPCUA_LIFECYCLE_SERVER_SECONDS=$((LIFECYCLE_SECONDS + 300))
+dotnet /app/Lifecycle.dll prepare /task > /task/prepare.log 2>&1
+mkdir -p /task/server/server-pki/trusted/certs
+for pki in /task/data/shared-pki /task/data/OtOpcUa/pki /task/data/OtOpcUa/adminui-browse-pki; do
+    cp "$pki"/own/certs/* /task/server/server-pki/trusted/certs/
+done
+dotnet /app/Lifecycle.dll server /task/server > /task/server.log 2>&1 &
+server_pid=$!
+cleanup() {
+    touch /task/server/stop
+    for attempt in $(seq 1 150); do
+        kill -0 "$server_pid" 2>/dev/null || break
+        sleep 0.1
+    done
+    kill "$server_pid" 2>/dev/null || true
+    wait "$server_pid" || true
+}
+trap cleanup EXIT
+for attempt in $(seq 1 600); do
+    test ! -f /task/server/ready.json || break
+    kill -0 "$server_pid" || exit 1
+    sleep 0.1
+done
+test -f /task/server/ready.json
+for pki in /task/data/shared-pki /task/data/OtOpcUa/pki /task/data/OtOpcUa/adminui-browse-pki; do
+    mkdir -p "$pki/trusted/certs"
+    cp /task/server/server-pki/own/certs/* "$pki/trusted/certs/"
+done
+endpoint=$(cat /task/server/endpoint.txt)
+dotnet /app/Lifecycle.dll run /task "$endpoint" "$LIFECYCLE_SECONDS" "$LIFECYCLE_MODE" > /task/client.log 2>&1

scripts/validation/opcua-client-lifecycle/evidence/2026-11-10-diagnostic/build.log

@@ -0,0 +1,63 @@
+
+  Determining projects to restore...
+  All projects are up-to-date for restore.
+  ZB.MOM.WW.OtOpcUa.Analyzers -> /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Tooling/ZB.MOM.WW.OtOpcUa.Analyzers/bin/Release/netstandard2.0/ZB.MOM.WW.OtOpcUa.Analyzers.dll
+  ZB.MOM.WW.OtOpcUa.Core.Abstractions -> /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Core/ZB.MOM.WW.OtOpcUa.Core.Abstractions/bin/Release/net10.0/ZB.MOM.WW.OtOpcUa.Core.Abstractions.dll
+  ZB.MOM.WW.OtOpcUa.Commons -> /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Core/ZB.MOM.WW.OtOpcUa.Commons/bin/Release/net10.0/ZB.MOM.WW.OtOpcUa.Commons.dll
+  ZB.MOM.WW.OtOpcUa.Cluster -> /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Core/ZB.MOM.WW.OtOpcUa.Cluster/bin/Release/net10.0/ZB.MOM.WW.OtOpcUa.Cluster.dll
+  ZB.MOM.WW.OtOpcUa.Core.Scripting.Abstractions -> /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Core/ZB.MOM.WW.OtOpcUa.Core.Scripting.Abstractions/bin/Release/net10.0/ZB.MOM.WW.OtOpcUa.Core.Scripting.Abstractions.dll
+  ZB.MOM.WW.OtOpcUa.Core.Scripting -> /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Core/ZB.MOM.WW.OtOpcUa.Core.Scripting/bin/Release/net10.0/ZB.MOM.WW.OtOpcUa.Core.Scripting.dll
+  ZB.MOM.WW.OtOpcUa.Core.VirtualTags -> /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Core/ZB.MOM.WW.OtOpcUa.Core.VirtualTags/bin/Release/net10.0/ZB.MOM.WW.OtOpcUa.Core.VirtualTags.dll
+  ZB.MOM.WW.OtOpcUa.Driver.Sql.Contracts -> /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Sql.Contracts/bin/Release/net10.0/ZB.MOM.WW.OtOpcUa.Driver.Sql.Contracts.dll
+  ZB.MOM.WW.OtOpcUa.Configuration -> /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Core/ZB.MOM.WW.OtOpcUa.Configuration/bin/Release/net10.0/ZB.MOM.WW.OtOpcUa.Configuration.dll
+  ZB.MOM.WW.OtOpcUa.Core -> /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Core/ZB.MOM.WW.OtOpcUa.Core/bin/Release/net10.0/ZB.MOM.WW.OtOpcUa.Core.dll
+  ZB.MOM.WW.OtOpcUa.Core.Scripting.Protocol -> /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Core/ZB.MOM.WW.OtOpcUa.Core.Scripting.Protocol/bin/Release/net10.0/ZB.MOM.WW.OtOpcUa.Core.Scripting.Protocol.dll
+  ZB.MOM.WW.OtOpcUa.Core.Scripting.OutOfProcess -> /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Core/ZB.MOM.WW.OtOpcUa.Core.Scripting.OutOfProcess/bin/Release/net10.0/ZB.MOM.WW.OtOpcUa.Core.Scripting.OutOfProcess.dll
+  ZB.MOM.WW.OtOpcUa.Core.ScriptedAlarms -> /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Core/ZB.MOM.WW.OtOpcUa.Core.ScriptedAlarms/bin/Release/net10.0/ZB.MOM.WW.OtOpcUa.Core.ScriptedAlarms.dll
+  ZB.MOM.WW.OtOpcUa.Security -> /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Server/ZB.MOM.WW.OtOpcUa.Security/bin/Release/net10.0/ZB.MOM.WW.OtOpcUa.Security.dll
+  ZB.MOM.WW.OtOpcUa.Driver.Modbus.Addressing -> /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Modbus.Addressing/bin/Release/net10.0/ZB.MOM.WW.OtOpcUa.Driver.Modbus.Addressing.dll
+  ZB.MOM.WW.OtOpcUa.Driver.Modbus.Contracts -> /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Modbus.Contracts/bin/Release/net10.0/ZB.MOM.WW.OtOpcUa.Driver.Modbus.Contracts.dll
+  ZB.MOM.WW.OtOpcUa.Driver.S7.Contracts -> /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.S7.Contracts/bin/Release/net10.0/ZB.MOM.WW.OtOpcUa.Driver.S7.Contracts.dll
+  ZB.MOM.WW.OtOpcUa.Driver.AbCip.Contracts -> /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.AbCip.Contracts/bin/Release/net10.0/ZB.MOM.WW.OtOpcUa.Driver.AbCip.Contracts.dll
+  ZB.MOM.WW.OtOpcUa.Driver.AbLegacy.Contracts -> /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.AbLegacy.Contracts/bin/Release/net10.0/ZB.MOM.WW.OtOpcUa.Driver.AbLegacy.Contracts.dll
+  ZB.MOM.WW.OtOpcUa.Driver.TwinCAT.Contracts -> /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.TwinCAT.Contracts/bin/Release/net10.0/ZB.MOM.WW.OtOpcUa.Driver.TwinCAT.Contracts.dll
+  ZB.MOM.WW.OtOpcUa.Driver.FOCAS.Contracts -> /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.FOCAS.Contracts/bin/Release/net10.0/ZB.MOM.WW.OtOpcUa.Driver.FOCAS.Contracts.dll
+  ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Contracts -> /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Contracts/bin/Release/net10.0/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Contracts.dll
+  ZB.MOM.WW.OtOpcUa.Driver.MTConnect.Contracts -> /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.MTConnect.Contracts/bin/Release/net10.0/ZB.MOM.WW.OtOpcUa.Driver.MTConnect.Contracts.dll
+  ZB.MOM.WW.OtOpcUa.Driver.Calculation.Contracts -> /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Calculation.Contracts/bin/Release/net10.0/ZB.MOM.WW.OtOpcUa.Driver.Calculation.Contracts.dll
+  ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.Contracts -> /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.Contracts/bin/Release/net10.0/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.Contracts.dll
+  ZB.MOM.WW.OtOpcUa.ControlPlane -> /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Server/ZB.MOM.WW.OtOpcUa.ControlPlane/bin/Release/net10.0/ZB.MOM.WW.OtOpcUa.ControlPlane.dll
+  ZB.MOM.WW.OtOpcUa.OpcUaServer -> /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Server/ZB.MOM.WW.OtOpcUa.OpcUaServer/bin/Release/net10.0/ZB.MOM.WW.OtOpcUa.OpcUaServer.dll
+  ZB.MOM.WW.OtOpcUa.Core.AlarmHistorian -> /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Core/ZB.MOM.WW.OtOpcUa.Core.AlarmHistorian/bin/Release/net10.0/ZB.MOM.WW.OtOpcUa.Core.AlarmHistorian.dll
+  ZB.MOM.WW.OtOpcUa.Runtime -> /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Server/ZB.MOM.WW.OtOpcUa.Runtime/bin/Release/net10.0/ZB.MOM.WW.OtOpcUa.Runtime.dll
+  ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Contracts -> /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Contracts/bin/Release/net10.0/ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Contracts.dll
+  ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.Session -> /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.Session/bin/Release/net10.0/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.Session.dll
+  ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.Browser -> /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.Browser/bin/Release/net10.0/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.Browser.dll
+  ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Browser -> /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Browser/bin/Release/net10.0/ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Browser.dll
+  ZB.MOM.WW.OtOpcUa.Driver.Sql.Dialect -> /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Sql.Dialect/bin/Release/net10.0/ZB.MOM.WW.OtOpcUa.Driver.Sql.Dialect.dll
+  ZB.MOM.WW.OtOpcUa.Driver.Sql.Browser -> /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Sql.Browser/bin/Release/net10.0/ZB.MOM.WW.OtOpcUa.Driver.Sql.Browser.dll
+  ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Transport -> /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Transport/bin/Release/net10.0/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Transport.dll
+  ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Browser -> /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Browser/bin/Release/net10.0/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Browser.dll
+  ZB.MOM.WW.OtOpcUa.AdminUI -> /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Server/ZB.MOM.WW.OtOpcUa.AdminUI/bin/Release/net10.0/ZB.MOM.WW.OtOpcUa.AdminUI.dll
+  ZB.MOM.WW.OtOpcUa.Driver.Ab.Transport -> /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Ab.Transport/bin/Release/net10.0/ZB.MOM.WW.OtOpcUa.Driver.Ab.Transport.dll
+  ZB.MOM.WW.OtOpcUa.Driver.AbCip -> /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.AbCip/bin/Release/net10.0/ZB.MOM.WW.OtOpcUa.Driver.AbCip.dll
+  ZB.MOM.WW.OtOpcUa.Driver.AbLegacy -> /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.AbLegacy/bin/Release/net10.0/ZB.MOM.WW.OtOpcUa.Driver.AbLegacy.dll
+  ZB.MOM.WW.OtOpcUa.Driver.Calculation -> /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Calculation/bin/Release/net10.0/ZB.MOM.WW.OtOpcUa.Driver.Calculation.dll
+  ZB.MOM.WW.OtOpcUa.Driver.FOCAS -> /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.FOCAS/bin/Release/net10.0/ZB.MOM.WW.OtOpcUa.Driver.FOCAS.dll
+  ZB.MOM.WW.OtOpcUa.Driver.Galaxy -> /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Galaxy/bin/Release/net10.0/ZB.MOM.WW.OtOpcUa.Driver.Galaxy.dll
+  ZB.MOM.WW.OtOpcUa.Driver.Historian.Sql.Common -> /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Historian.Sql.Common/bin/Release/net10.0/ZB.MOM.WW.OtOpcUa.Driver.Historian.Sql.Common.dll
+  ZB.MOM.WW.OtOpcUa.Driver.Historian.Gateway -> /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Historian.Gateway/bin/Release/net10.0/ZB.MOM.WW.OtOpcUa.Driver.Historian.Gateway.dll
+  ZB.MOM.WW.OtOpcUa.Driver.Historian.SqlServer -> /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Historian.SqlServer/bin/Release/net10.0/ZB.MOM.WW.OtOpcUa.Driver.Historian.SqlServer.dll
+  ZB.MOM.WW.OtOpcUa.Driver.Historian.QuestDb -> /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Historian.QuestDb/bin/Release/net10.0/ZB.MOM.WW.OtOpcUa.Driver.Historian.QuestDb.dll
+  ZB.MOM.WW.OtOpcUa.Driver.Modbus -> /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Modbus/bin/Release/net10.0/ZB.MOM.WW.OtOpcUa.Driver.Modbus.dll
+  ZB.MOM.WW.OtOpcUa.Driver.Mqtt -> /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt/bin/Release/net10.0/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.dll
+  ZB.MOM.WW.OtOpcUa.Driver.MTConnect -> /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.MTConnect/bin/Release/net10.0/ZB.MOM.WW.OtOpcUa.Driver.MTConnect.dll
+  ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient -> /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient/bin/Release/net10.0/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.dll
+  ZB.MOM.WW.OtOpcUa.Driver.S7 -> /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.S7/bin/Release/net10.0/ZB.MOM.WW.OtOpcUa.Driver.S7.dll
+  ZB.MOM.WW.OtOpcUa.Driver.Sql -> /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Sql/bin/Release/net10.0/ZB.MOM.WW.OtOpcUa.Driver.Sql.dll
+  ZB.MOM.WW.OtOpcUa.Driver.TwinCAT -> /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.TwinCAT/bin/Release/net10.0/ZB.MOM.WW.OtOpcUa.Driver.TwinCAT.dll
+  ZB.MOM.WW.OtOpcUa.ScriptWorker -> /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Server/ZB.MOM.WW.OtOpcUa.ScriptWorker/bin/Release/net10.0/ZB.MOM.WW.OtOpcUa.ScriptWorker.dll
+  ZB.MOM.WW.OtOpcUa.Host -> /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Server/ZB.MOM.WW.OtOpcUa.Host/bin/Release/net10.0/OtOpcUa.Host.dll
+  ZB.MOM.WW.OtOpcUa.Client.Shared -> /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Client/ZB.MOM.WW.OtOpcUa.Client.Shared/bin/Release/net10.0/ZB.MOM.WW.OtOpcUa.Client.Shared.dll
+  Lifecycle -> /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/scripts/validation/opcua-client-lifecycle/bin/Release/net10.0/Lifecycle.dll
+  Lifecycle -> /private/tmp/opcua2-production-client-diagnostic-20261110c/app/

scripts/validation/opcua-client-lifecycle/evidence/2026-11-10-diagnostic/command.json

@@ -0,0 +1,25 @@
+{
+  "argv": [
+    "docker",
+    "run",
+    "--rm",
+    "--name",
+    "otopcua-client-lifecycle-a2c271bbeb54",
+    "--network",
+    "none",
+    "-e",
+    "OPCUA_MATRIX_PASSWORD",
+    "-e",
+    "LIFECYCLE_SECONDS",
+    "-e",
+    "LIFECYCLE_MODE",
+    "-v",
+    "/private/tmp/opcua2-production-client-diagnostic-20261110c/app:/app:ro",
+    "-v",
+    "/private/tmp/opcua2-production-client-diagnostic-20261110c/task:/task",
+    "mcr.microsoft.com/dotnet/sdk:10.0.103-noble",
+    "bash",
+    "/task/container.sh"
+  ],
+  "timeoutSeconds": 390
+}

scripts/validation/opcua-client-lifecycle/evidence/2026-11-10-diagnostic/full-duration-guard.log

@@ -0,0 +1,3 @@
+usage: run.py [-h] --output OUTPUT [--duration DURATION] [--full]
+              [--image IMAGE]
+run.py: error: --full requires duration >=7200; diagnostic duration must be positive

scripts/validation/opcua-client-lifecycle/evidence/2026-11-10-diagnostic/resources.jsonl

@@ -0,0 +1,8 @@
+{"cycle":0,"elapsedSeconds":0,"utc":"2026-11-10T17:39:34.5140163Z","WorkingSet64":50884608,"PrivateMemorySize64":87019520,"managedBytes":243384,"allocatedBytes":307688,"gc":[2,2,2],"fdCount":66,"ownedRootFdCount":4,"ownedPkiFdCount":0,"survivingProductionObjects":0,"managerDisposalsVerified":0,"sharedPasses":0,"driverPasses":0,"browserPasses":0}
+{"cycle":10,"elapsedSeconds":13.7816334,"utc":"2026-11-10T17:39:48.307566Z","WorkingSet64":168873984,"PrivateMemorySize64":210952192,"managedBytes":4622440,"allocatedBytes":53385048,"gc":[5,4,4],"fdCount":146,"ownedRootFdCount":4,"ownedPkiFdCount":0,"survivingProductionObjects":0,"managerDisposalsVerified":80,"sharedPasses":20,"driverPasses":20,"browserPasses":20}
+{"cycle":20,"elapsedSeconds":26.955914,"utc":"2026-11-10T17:40:01.4729188Z","WorkingSet64":181080064,"PrivateMemorySize64":230060032,"managedBytes":4716120,"allocatedBytes":100286768,"gc":[8,6,6],"fdCount":146,"ownedRootFdCount":4,"ownedPkiFdCount":0,"survivingProductionObjects":0,"managerDisposalsVerified":160,"sharedPasses":40,"driverPasses":40,"browserPasses":40}
+{"cycle":30,"elapsedSeconds":40.3288294,"utc":"2026-11-10T17:40:14.8512936Z","WorkingSet64":181923840,"PrivateMemorySize64":230674432,"managedBytes":4624608,"allocatedBytes":146998480,"gc":[11,8,8],"fdCount":146,"ownedRootFdCount":4,"ownedPkiFdCount":0,"survivingProductionObjects":0,"managerDisposalsVerified":240,"sharedPasses":60,"driverPasses":60,"browserPasses":60}
+{"cycle":40,"elapsedSeconds":53.6437668,"utc":"2026-11-10T17:40:28.1646671Z","WorkingSet64":183074816,"PrivateMemorySize64":232931328,"managedBytes":4503968,"allocatedBytes":193703712,"gc":[14,10,10],"fdCount":148,"ownedRootFdCount":4,"ownedPkiFdCount":0,"survivingProductionObjects":0,"managerDisposalsVerified":320,"sharedPasses":80,"driverPasses":80,"browserPasses":80}
+{"cycle":50,"elapsedSeconds":66.9338459,"utc":"2026-11-10T17:40:41.4571518Z","WorkingSet64":184758272,"PrivateMemorySize64":232972288,"managedBytes":4503736,"allocatedBytes":240424880,"gc":[17,12,12],"fdCount":148,"ownedRootFdCount":4,"ownedPkiFdCount":0,"survivingProductionObjects":0,"managerDisposalsVerified":400,"sharedPasses":100,"driverPasses":100,"browserPasses":100}
+{"cycle":60,"elapsedSeconds":80.254683,"utc":"2026-11-10T17:40:54.7806201Z","WorkingSet64":180539392,"PrivateMemorySize64":233132032,"managedBytes":4504072,"allocatedBytes":287112440,"gc":[20,14,14],"fdCount":148,"ownedRootFdCount":4,"ownedPkiFdCount":0,"survivingProductionObjects":0,"managerDisposalsVerified":480,"sharedPasses":120,"driverPasses":120,"browserPasses":120}
+{"cycle":68,"elapsedSeconds":91.0947059,"utc":"2026-11-10T17:41:05.614513Z","WorkingSet64":180760576,"PrivateMemorySize64":233250816,"managedBytes":4739896,"allocatedBytes":324761520,"gc":[23,16,16],"fdCount":148,"ownedRootFdCount":4,"ownedPkiFdCount":0,"survivingProductionObjects":0,"managerDisposalsVerified":544,"sharedPasses":136,"driverPasses":136,"browserPasses":136}

scripts/validation/opcua-client-lifecycle/evidence/2026-11-10-diagnostic/result.json

@@ -0,0 +1,50 @@
+{
+  "exitCode": 0,
+  "containerElapsedSeconds": 93.73282008292153,
+  "summary": {
+    "status": "passed",
+    "diagnosticPositiveControl": "exact SDK2 manager false-before/true-after DisposeAsync",
+    "applicationCertificateHashes": [
+      "data/OtOpcUa/adminui-browse-pki/own/certs/OtOpcUa AdminUI Browse [14579B861300836A2A96549E307DB4123778B0C5].der:89e21ac01a5582dd04df77add2fad19495c695b69f4a48a05d2c71283325503b",
+      "data/OtOpcUa/pki/own/certs/ClientLifecycle [AF2D40052FCDDC9A8C09686E6E8E0F17CFF5A979].der:e9bdc63bc2cc0b7901389f958b2fd6bfaf5369f439dc996e152668a3fa3c381c",
+      "data/shared-pki/own/certs/OtOpcUaClient [91C87A8D0AC11919E0AFD44457BF932F3587F1B0].der:b4f2018a43f161e18d25f7b8bb80590ccec13afcf7b9189f6d97e10a68b55602"
+    ],
+    "requestedSeconds": 90,
+    "elapsedSeconds": 91.1041217,
+    "fullTwoHourLifecycle": false,
+    "cycles": 68,
+    "sharedPasses": 136,
+    "driverPasses": 136,
+    "browserPasses": 136,
+    "managerDisposalsVerified": 544,
+    "finalResources": {
+      "cycle": 68,
+      "elapsedSeconds": 91.1041218,
+      "utc": "2026-11-10T17:41:05.6187359Z",
+      "WorkingSet64": 181018624,
+      "PrivateMemorySize64": 233250816,
+      "managedBytes": 4737536,
+      "allocatedBytes": 324891240,
+      "gc": [
+        25,
+        18,
+        18
+      ],
+      "fdCount": 148,
+      "ownedRootFdCount": 4,
+      "ownedPkiFdCount": 0,
+      "survivingProductionObjects": 0,
+      "managerDisposalsVerified": 544,
+      "sharedPasses": 136,
+      "driverPasses": 136,
+      "browserPasses": 136
+    },
+    "scope": "Production Shared connect/disconnect/reconnect; production driver Initialize/Reinitialize/Shutdown/dispose; production browser open/browse/dispose; scalar and Int32[3] read/write/subscribe/unsubscribe; strict mutual trusted DER/Basic256Sha256 SignAndEncrypt/API-key fixture. No network stalls, revocation, surgical edits/rebuild, CP abandonment or Windows/AVEVA/performance G4 claim."
+  },
+  "applicationCertificates": {
+    "data/OtOpcUa/adminui-browse-pki/own/certs/OtOpcUa AdminUI Browse [14579B861300836A2A96549E307DB4123778B0C5].der": "89e21ac01a5582dd04df77add2fad19495c695b69f4a48a05d2c71283325503b",
+    "data/OtOpcUa/pki/own/certs/ClientLifecycle [AF2D40052FCDDC9A8C09686E6E8E0F17CFF5A979].der": "e9bdc63bc2cc0b7901389f958b2fd6bfaf5369f439dc996e152668a3fa3c381c",
+    "data/shared-pki/own/certs/OtOpcUaClient [91C87A8D0AC11919E0AFD44457BF932F3587F1B0].der": "b4f2018a43f161e18d25f7b8bb80590ccec13afcf7b9189f6d97e10a68b55602",
+    "server/server-pki/own/certs/OtOpcUa.Matrix [29412ADF65A3E370B5CDCABE9386217B43E1C1C1].der": "c3beb0f1c0536635c7ceb0dcfc42c6220d78d4a38c00ef199c137a6ba36bb04c"
+  }
+}

scripts/validation/opcua-client-lifecycle/evidence/2026-11-10-diagnostic/sdk-assemblies.json

@@ -0,0 +1,32 @@
+[
+  {
+    "name": "Opc.Ua.Core",
+    "version": "2.0.1.0",
+    "sha256": "9d0857aa6b7f3c49037d4ea557b4da8edf07e146069464481783e66c5c9cd35a"
+  },
+  {
+    "name": "Opc.Ua.Types",
+    "version": "2.0.1.0",
+    "sha256": "c542f69882f4e8a4ebd5ccc28a3881d6967c7ffb6dcc3c56dc6c776f39c2ede1"
+  },
+  {
+    "name": "Opc.Ua.Security.Certificates",
+    "version": "2.0.1.0",
+    "sha256": "7f4969aceb2f0db5328c6882cb4b117342f3b18905c38acdba600683860c4fd0"
+  },
+  {
+    "name": "Opc.Ua.Core.Types",
+    "version": "2.0.1.0",
+    "sha256": "a7dd141b8dabe8848ff28c2fb8e16a85a0508e6a49e6b1a1c1e267175b99af96"
+  },
+  {
+    "name": "Opc.Ua.Client",
+    "version": "2.0.1.0",
+    "sha256": "620da406fabdbc75d11f9827ea7e39d2d3c762471bd2264b0d11f1d6cd9247cd"
+  },
+  {
+    "name": "Opc.Ua.Configuration",
+    "version": "2.0.1.0",
+    "sha256": "6ed6a594c93c3ff35d1a16539a9fe87c1e2640549cc2f48ed6bae333dc8bf0e7"
+  }
+]

scripts/validation/opcua-client-lifecycle/evidence/2026-11-10-diagnostic/server-live-resources.json

@@ -0,0 +1 @@
+{"utc":"2026-11-10T17:41:05.3943073Z","sessions":0,"subscriptions":0,"items":0,"serverProcess":26}

scripts/validation/opcua-client-lifecycle/evidence/2026-11-10-diagnostic/server-ready.json

@@ -0,0 +1 @@
+{"endpoint":"opc.tcp://127.0.0.1:36237/OtOpcUa","process":26,"sdk":"2.0.1.0","rawUri":"https://zb.com/otopcua/raw","unsUri":"https://zb.com/otopcua/uns"}

scripts/validation/opcua-client-lifecycle/evidence/2026-11-10-diagnostic/server-server-resources.json

@@ -0,0 +1,13 @@
+{
+  "WorkingSet64": 232546304,
+  "PrivateMemorySize64": 263188480,
+  "HandleCount": 151,
+  "threads": 17,
+  "cpuMilliseconds": 11661.139,
+  "allocatedBytes": 334834272,
+  "collections": [
+    9,
+    1,
+    0
+  ]
+}

scripts/validation/opcua-client-lifecycle/evidence/2026-11-10-diagnostic/source.json

@@ -0,0 +1,17 @@
+{
+  "commit": "7b353d7bae5311a2f0a33c0a82c88d2c5b49d76f",
+  "root": "/Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa",
+  "durationSeconds": 90,
+  "mode": "diagnostic",
+  "image": {
+    "Id": "sha256:b04611ee9e1b7d36797012ed921962c57189cb4dbb3dff12afb8e158110f293b",
+    "RepoDigests": [
+      "mcr.microsoft.com/dotnet/sdk@sha256:e362a8dbcd691522456da26a5198b8f3ca1d7641c95624fadc5e3e82678bd08a"
+    ],
+    "Architecture": "arm64",
+    "Os": "linux"
+  },
+  "network": "none",
+  "startedUtc": "2026-11-10T17:39:26Z",
+  "scope": "actual unchanged production Shared/OpcUaClientDriver/AdminUI browser in a repeated same-process loop; SDK 2.0.1 only"
+}

scripts/validation/opcua-client-lifecycle/evidence/2026-11-10-diagnostic/summary.json

@@ -0,0 +1,40 @@
+{
+  "status": "passed",
+  "diagnosticPositiveControl": "exact SDK2 manager false-before/true-after DisposeAsync",
+  "applicationCertificateHashes": [
+    "data/OtOpcUa/adminui-browse-pki/own/certs/OtOpcUa AdminUI Browse [14579B861300836A2A96549E307DB4123778B0C5].der:89e21ac01a5582dd04df77add2fad19495c695b69f4a48a05d2c71283325503b",
+    "data/OtOpcUa/pki/own/certs/ClientLifecycle [AF2D40052FCDDC9A8C09686E6E8E0F17CFF5A979].der:e9bdc63bc2cc0b7901389f958b2fd6bfaf5369f439dc996e152668a3fa3c381c",
+    "data/shared-pki/own/certs/OtOpcUaClient [91C87A8D0AC11919E0AFD44457BF932F3587F1B0].der:b4f2018a43f161e18d25f7b8bb80590ccec13afcf7b9189f6d97e10a68b55602"
+  ],
+  "requestedSeconds": 90,
+  "elapsedSeconds": 91.1041217,
+  "fullTwoHourLifecycle": false,
+  "cycles": 68,
+  "sharedPasses": 136,
+  "driverPasses": 136,
+  "browserPasses": 136,
+  "managerDisposalsVerified": 544,
+  "finalResources": {
+    "cycle": 68,
+    "elapsedSeconds": 91.1041218,
+    "utc": "2026-11-10T17:41:05.6187359Z",
+    "WorkingSet64": 181018624,
+    "PrivateMemorySize64": 233250816,
+    "managedBytes": 4737536,
+    "allocatedBytes": 324891240,
+    "gc": [
+      25,
+      18,
+      18
+    ],
+    "fdCount": 148,
+    "ownedRootFdCount": 4,
+    "ownedPkiFdCount": 0,
+    "survivingProductionObjects": 0,
+    "managerDisposalsVerified": 544,
+    "sharedPasses": 136,
+    "driverPasses": 136,
+    "browserPasses": 136
+  },
+  "scope": "Production Shared connect/disconnect/reconnect; production driver Initialize/Reinitialize/Shutdown/dispose; production browser open/browse/dispose; scalar and Int32[3] read/write/subscribe/unsubscribe; strict mutual trusted DER/Basic256Sha256 SignAndEncrypt/API-key fixture. No network stalls, revocation, surgical edits/rebuild, CP abandonment or Windows/AVEVA/performance G4 claim."
+}

scripts/validation/opcua-client-lifecycle/evidence/2026-11-10-diagnostic/verification.json

@@ -0,0 +1,36 @@
+{
+  "diagnosticExitCode": 0,
+  "fullDurationGuardExitCode": 2,
+  "rawArtifactRoot": "/private/tmp/opcua2-production-client-diagnostic-20261110c",
+  "shortRunDoesNotMeetTwoHourGate": true,
+  "harnessFiles": [
+    {
+      "path": "scripts/validation/opcua-client-lifecycle/.gitignore",
+      "sha256": "32dae3052f331ee34d628ef535709b301259a45df7c7522c4d35dcf49873f00b"
+    },
+    {
+      "path": "scripts/validation/opcua-client-lifecycle/Lifecycle.cs",
+      "sha256": "609b73b55c4ad2ed7dcd70f42dbc702cc233cd2f9ace8c686f8fe1cbb8471f3a"
+    },
+    {
+      "path": "scripts/validation/opcua-client-lifecycle/Lifecycle.csproj",
+      "sha256": "379ce48ae014f4a52c9e9096a3fce5046689475a08408f279e430463f5f19085"
+    },
+    {
+      "path": "scripts/validation/opcua-client-lifecycle/ProcessHost.cs",
+      "sha256": "89b6f518c9706753e7f62bda4f8312e3390cf8d0ced99d847e8df52d935720d6"
+    },
+    {
+      "path": "scripts/validation/opcua-client-lifecycle/README.md",
+      "sha256": "05cc5b39f58abd7381b3eec51e0fe18bc6de6f525430810ef21b4679fe1e5d20"
+    },
+    {
+      "path": "scripts/validation/opcua-client-lifecycle/container.sh",
+      "sha256": "899cea38d6a7e21448308dea8931a3d2fe0986d736eaf96e4769ef1637ed5aae"
+    },
+    {
+      "path": "scripts/validation/opcua-client-lifecycle/run.py",
+      "sha256": "8da86e2215fcaa883a9212b6dde0e897795efd5d75307af6318345b61c965ad8"
+    }
+  ]
+}

scripts/validation/opcua-client-lifecycle/run.py

@@ -0,0 +1,76 @@
+#!/usr/bin/env python3
+"""Build and run isolated actual production Shared/driver/browser lifecycle loops."""
+import argparse
+import hashlib
+import json
+import os
+from pathlib import Path
+import secrets
+import shutil
+import subprocess
+import time
+import uuid
+
+HERE = Path(__file__).resolve().parent
+ROOT = HERE.parents[2]
+
+
+def write(path, value):
+    path.write_text(json.dumps(value, indent=2) + '\n')
+
+
+def certs(root):
+    return {str(p.relative_to(root)): hashlib.sha256(p.read_bytes()).hexdigest()
+            for p in sorted(root.rglob('*.der')) if '/own/certs/' in str(p)}
+
+
+def main():
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument('--output', required=True, type=Path, help='Fresh nonexistent task evidence root, includes private PKI; never commit entire output')
+    parser.add_argument('--duration', type=int, default=90)
+    parser.add_argument('--full', action='store_true', help='Requires >=7200 seconds of real completed client runtime')
+    parser.add_argument('--image', default='mcr.microsoft.com/dotnet/sdk:10.0.103-noble')
+    args = parser.parse_args()
+    if args.duration <= 0 or (args.full and args.duration < 7200):
+        parser.error('--full requires duration >=7200; diagnostic duration must be positive')
+    output = args.output.resolve()
+    output.mkdir(parents=True, exist_ok=False)
+    os.chmod(output, 0o700)
+    build = output / 'app'
+    task = output / 'task'
+    task.mkdir()
+    image = json.loads(subprocess.check_output(['docker', 'image', 'inspect', args.image, '--format', '{{json .}}'], text=True))
+    if image['Architecture'] != 'arm64' or image['Os'] != 'linux':
+        raise RuntimeError('Expected cached official Linux arm64 SDK image')
+    write(output / 'source.json', {'commit': subprocess.check_output(['git', '-C', str(ROOT), 'rev-parse', 'HEAD'], text=True).strip(),
+          'root': str(ROOT), 'durationSeconds': args.duration, 'mode': 'full' if args.full else 'diagnostic',
+          'image': {k: image.get(k) for k in ('Id', 'RepoDigests', 'Architecture', 'Os')}, 'network': 'none',
+          'startedUtc': time.strftime('%Y-%m-%dT%H:%M:%SZ', time.gmtime()),
+          'scope': 'actual unchanged production Shared/OpcUaClientDriver/AdminUI browser in a repeated same-process loop; SDK 2.0.1 only'})
+    with (output / 'build.log').open('w') as log:
+        subprocess.run(['dotnet', 'publish', str(HERE / 'Lifecycle.csproj'), '-c', 'Release', '-m:1', '--nologo', '-o', str(build)], stdout=log, stderr=subprocess.STDOUT, check=True, timeout=300)
+    shutil.copy2(HERE / 'container.sh', task / 'container.sh')
+    name = 'otopcua-client-lifecycle-' + uuid.uuid4().hex[:12]
+    env = dict(os.environ, OPCUA_MATRIX_PASSWORD='otua_lifecycle_' + secrets.token_urlsafe(32),
+               LIFECYCLE_SECONDS=str(args.duration), LIFECYCLE_MODE='full' if args.full else 'diagnostic')
+    command = ['docker', 'run', '--rm', '--name', name, '--network', 'none',
+               '-e', 'OPCUA_MATRIX_PASSWORD', '-e', 'LIFECYCLE_SECONDS', '-e', 'LIFECYCLE_MODE',
+               '-v', str(build) + ':/app:ro', '-v', str(task) + ':/task', args.image, 'bash', '/task/container.sh']
+    write(output / 'command.json', {'argv': command, 'timeoutSeconds': args.duration + 300})
+    started = time.monotonic()
+    try:
+        with (output / 'container.log').open('w') as log:
+            result = subprocess.run(command, stdout=log, stderr=subprocess.STDOUT, env=env, timeout=args.duration + 300)
+    except BaseException:
+        subprocess.run(['docker', 'rm', '-f', name], stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL, timeout=20)
+        raise
+    summary = json.loads((task / 'summary.json').read_text()) if (task / 'summary.json').exists() else None
+    write(output / 'result.json', {'exitCode': result.returncode, 'containerElapsedSeconds': time.monotonic() - started,
+          'summary': summary, 'applicationCertificates': certs(task)})
+    if result.returncode or not summary or (args.full and not summary['fullTwoHourLifecycle']):
+        raise RuntimeError('Lifecycle run failed; inspect task/failure.txt, client.log and server.log: ' + str(output))
+    print(json.dumps({'output': str(output), 'summary': summary}, indent=2))
+
+
+if __name__ == '__main__':
+    main()

scripts/validation/opcua-lifecycle-memory/.gitignore

@@ -1,7 +0,0 @@
-__pycache__/
-bin/
-obj/
-private-fixture/
-*.pfx
-*.der
-*.nettrace

scripts/validation/opcua-lifecycle-memory/CertificateControl.cs

@@ -1,39 +0,0 @@
-using System.Diagnostics;
-using System.Runtime;
-using System.Security.Cryptography;
-using System.Security.Cryptography.X509Certificates;
-using System.Text.Json;
-using Opc.Ua.Security.Certificates;
-var mode = args[0];
-var directory = args[1];
-Directory.CreateDirectory(directory);
-using var key = RSA.Create(2048);
-var request = new CertificateRequest("CN=NativeMemoryControl", key, HashAlgorithmName.SHA256, RSASignaturePadding.Pkcs1);
-var original = request.CreateSelfSigned(DateTimeOffset.UtcNow.AddDays(-1), DateTimeOffset.UtcNow.AddDays(1));
-var pfx = original.Export(X509ContentType.Pfx);
-// Certificate.From takes ownership of original; only wrapped disposes that native certificate.
-using var wrapped = Certificate.From(original);
-void Sample(int i, string kind)
-{
-    var live = GC.GetTotalMemory(true);
-    GC.WaitForPendingFinalizers();
-    using var p = Process.GetCurrentProcess();
-    p.Refresh();
-    Console.WriteLine(JsonSerializer.Serialize(new { kind, i, pid = Environment.ProcessId, mode, live, rss = p.WorkingSet64, methods = JitInfo.GetCompiledMethodCount(), gc = GC.GetGCMemoryInfo().TotalCommittedBytes }));
-    Console.Out.Flush();
-}
-Sample(0, "ready");
-while (!File.Exists(Path.Combine(directory, "go"))) Thread.Sleep(50);
-for (int i = 1; i <= 1000; i++)
-{
-    using X509Certificate2 copy = mode switch
-    {
-        "pfx" => System.Security.Cryptography.X509Certificates.X509CertificateLoader.LoadPkcs12(pfx, null, X509KeyStorageFlags.Exportable),
-        "sdk-copy" => wrapped.AsX509Certificate2(),
-        "shared-copy" => (X509Certificate2)typeof(X509Certificate2).GetConstructor(new[] { typeof(X509Certificate) })!.Invoke(new object[] { original }),
-        _ => System.Security.Cryptography.X509Certificates.X509CertificateLoader.LoadCertificate(original.RawData)
-    };
-    if (i % 100 == 0) Sample(i, "sample");
-}
-Sample(1000, "done");
-while (!File.Exists(Path.Combine(directory, "stop"))) Thread.Sleep(50);

scripts/validation/opcua-lifecycle-memory/EventPipeCapture.cs

@@ -1,15 +0,0 @@
-// Read-only temporary diagnostic attachment. Requires Microsoft.Diagnostics.NETCore.Client from dotnet-trace.
-using System.Diagnostics.Tracing;
-using Microsoft.Diagnostics.NETCore.Client;
-
-var seconds = int.Parse(args[1]);
-if (seconds < 1 || seconds > 300) throw new ArgumentOutOfRangeException(nameof(seconds), "Use a bounded 1..300 second diagnostic attachment");
-var client = new DiagnosticsClient(int.Parse(args[0]));
-var providers = new[] { new EventPipeProvider("Microsoft-Windows-DotNETRuntime", EventLevel.Verbose, 0x18) };
-// Match the recorded experiment's API default (256 MiB capacity, not measured resident allocation).
-using var session = client.StartEventPipeSession(providers, requestRundown: false, circularBufferMB: 256);
-await using var file = File.Create(args[2]);
-var copy = session.EventStream.CopyToAsync(file);
-await Task.Delay(TimeSpan.FromSeconds(seconds));
-session.Stop();
-await copy;

scripts/validation/opcua-lifecycle-memory/LifecycleControl.cs

@@ -1,208 +0,0 @@
-using System.Diagnostics;
-using System.Collections;
-using System.Reflection;
-using System.Net;
-using System.Net.Sockets;
-using System.Runtime;
-using System.Text;
-using System.Text.Json;
-using Microsoft.Extensions.Logging.Abstractions;
-using Opc.Ua;
-using Opc.Ua.Client;
-using Opc.Ua.Configuration;
-using ZB.MOM.WW.OtOpcUa.Commons.OpcUa;
-using ZB.MOM.WW.OtOpcUa.OpcUaServer;
-using ZB.MOM.WW.OtOpcUa.OpcUaServer.Security;
-var root = Path.GetFullPath(args[0]);
-Directory.CreateDirectory(root);
-var seconds = int.Parse(args[1]);
-using var timeout = new CancellationTokenSource(TimeSpan.FromSeconds(seconds + 120));
-var ct = timeout.Token;
-var clientPki = Path.Combine(root, "client-pki");
-var telemetry = DefaultTelemetry.Create(_ => { });
-var config = new ApplicationConfiguration(telemetry);
-config.ApplicationName = "NativeLifecycleControl";
-config.ApplicationUri = "urn:NativeLifecycleControl:" + Guid.NewGuid();
-config.ApplicationType = ApplicationType.Client;
-config.SecurityConfiguration = new SecurityConfiguration
-{
-    ApplicationCertificate = new CertificateIdentifier { StoreType = CertificateStoreType.Directory, StorePath = Path.Combine(clientPki, "own"), SubjectName = "CN=NativeLifecycleControl" },
-    TrustedIssuerCertificates = new CertificateTrustList { StoreType = CertificateStoreType.Directory, StorePath = Path.Combine(clientPki, "issuer") },
-    TrustedPeerCertificates = new CertificateTrustList { StoreType = CertificateStoreType.Directory, StorePath = Path.Combine(clientPki, "trusted") },
-    RejectedCertificateStore = new CertificateTrustList { StoreType = CertificateStoreType.Directory, StorePath = Path.Combine(clientPki, "rejected") },
-    AutoAcceptUntrustedCertificates = true
-};
-config.ClientConfiguration = new ClientConfiguration { DefaultSessionTimeout = 15000 };
-var app = new ApplicationInstance(telemetry) { ApplicationConfiguration = config };
-await config.ValidateAsync(ApplicationType.Client, ct);
-await app.CheckApplicationInstanceCertificatesAsync(true, null, ct);
-int port;
-using (var listener = new TcpListener(IPAddress.Loopback, 0))
-{
-    listener.Start();
-    port = ((IPEndPoint)listener.LocalEndpoint).Port;
-}
-var options = new OpcUaApplicationHostOptions { ApplicationName = "NativeLifecycleServer", ApplicationUri = "urn:NativeLifecycleServer:" + Guid.NewGuid(), OpcUaPort = port, PublicHostname = "127.0.0.1", PkiStoreRoot = Path.Combine(root, "server-pki"), AllowAnonymous = false, AutoAcceptUntrustedClientCertificates = true, EnabledSecurityProfiles = [OpcUaSecurityProfile.Basic256Sha256SignAndEncrypt] };
-OpcUaApplicationHost host = null!;
-OtOpcUaSdkServer server = null!;
-async Task Boot()
-{
-    server = new OtOpcUaSdkServer();
-    host = new OpcUaApplicationHost(options, NullLogger<OpcUaApplicationHost>.Instance, new Auth());
-    await host.StartAsync(server, ct);
-    var n = server.NodeManager!;
-    n.NodeWriteGateway = new Gateway();
-    n.EnsureFolder("Control", null, "Control", AddressSpaceRealm.Raw);
-    n.EnsureFolder("Equipment", null, "Equipment", AddressSpaceRealm.Uns);
-    n.EnsureVariable("Control/Scalar", "Control", "Scalar", "Int32", true, AddressSpaceRealm.Raw);
-    n.EnsureVariable("Control/Array", "Control", "Array", "Int16", true, AddressSpaceRealm.Raw, isArray: true, arrayLength: 4);
-    n.EnsureVariable("Equipment/Scalar", "Equipment", "Scalar", "Int32", true, AddressSpaceRealm.Uns);
-    for (var i = 0; i < 16; i++) n.EnsureVariable("Control/Browse" + i, "Control", "Browse" + i, "Int32", false, AddressSpaceRealm.Raw);
-    n.MaterialiseAlarmCondition("Control/Alarm", "Control", "Alarm", "OffNormalAlarm", 500, AddressSpaceRealm.Raw, isNative: true);
-    n.WriteValue("Control/Scalar", 0, 0, DateTime.UtcNow, AddressSpaceRealm.Raw);
-    n.WriteValue("Control/Array", new short[] { 0, 1, 2, 3 }, 0, DateTime.UtcNow, AddressSpaceRealm.Raw);
-    n.WriteValue("Equipment/Scalar", 0, 0, DateTime.UtcNow, AddressSpaceRealm.Uns);
-}
-async Task<ISession> Connect()
-{
-    var t = DefaultTelemetry.Create(_ => { });
-    var endpoint = await CoreClientUtils.SelectEndpointAsync(config, $"opc.tcp://127.0.0.1:{port}/OtOpcUa", true, t, ct);
-    var factory = new DefaultSessionFactory(t);
-    var identity = new UserIdentity("control", Encoding.UTF8.GetBytes(FixtureCredential.Value));
-    return await factory.CreateAsync(config, new ConfiguredEndpoint(null, endpoint ?? throw new Exception("Missing endpoint"), EndpointConfiguration.Create(config)), false, false, "NativeLifecycleControl", 15000, identity, default, ct);
-}
-static DataValue Value(object v)
-{
-#if SDK2
-    if (!VariantHelper.TryCastFrom(v, out var variant)) throw new Exception("Unsupported control value");
-    return new DataValue(variant);
-#else
-    return new DataValue(new Variant(v));
-#endif
-}
-static object? Clr(DataValue v)
-{
-#if SDK2
-    return v.WrappedValue.AsBoxedObject(Variant.BoxingBehavior.Legacy);
-#else
-    return v.Value;
-#endif
-}
-object? CertificateStats()
-{
-#if SDK2
-    return new { created = Opc.Ua.Security.Certificates.Certificate.InstancesCreated, disposed = Opc.Ua.Security.Certificates.Certificate.InstancesDisposed, outstanding = Opc.Ua.Security.Certificates.Certificate.InstancesLeaked };
-#else
-    return null;
-#endif
-}
-void Sample(int cycle, string kind)
-{
-    var live = GC.GetTotalMemory(true);
-    using var p = Process.GetCurrentProcess();
-    p.Refresh();
-    var m = GC.GetGCMemoryInfo();
-    Console.WriteLine(JsonSerializer.Serialize(new { kind, cycle, pid = Environment.ProcessId, live, rss = p.WorkingSet64, gcCommitted = m.TotalCommittedBytes, gcHeap = m.HeapSizeBytes, fragmented = m.FragmentedBytes, jit = JitInfo.GetCompiledMethodCount(), jitIl = JitInfo.GetCompiledILBytes(), sdk = typeof(NodeId).Assembly.GetName().Version?.ToString(), scope = "matched encrypted public lifecycle subset; no history/revocation/proxy", assemblies = AppDomain.CurrentDomain.GetAssemblies().Length, dynamicAssemblies = AppDomain.CurrentDomain.GetAssemblies().Count(a => a.IsDynamic), certificate = CertificateStats(), timers = Timer.ActiveCount, threads = p.Threads.Count, sessions = server.CurrentInstance.SessionManager.GetSessions().Count, subscriptions = server.CurrentInstance.SubscriptionManager.GetSubscriptions().Count }));
-    Console.Out.Flush();
-}
-int cycles = 0, restarts = 0;
-await Boot();
-var watch = Stopwatch.StartNew();
-Sample(0, "start");
-try
-{
-    while (watch.Elapsed.TotalSeconds < seconds)
-    {
-        using (var owner = await Connect()) using (var other = await Connect())
-        {
-            var ns = (ushort)owner.NamespaceUris.GetIndex("https://zb.com/otopcua/raw");
-            var scalar = new NodeId("Control/Scalar", ns);
-            var array = new NodeId("Control/Array", ns);
-            using var subscription = new Subscription(owner.DefaultSubscription) { PublishingInterval = 100 };
-            owner.AddSubscription(subscription);
-            await subscription.CreateAsync(ct);
-            subscription.AddItem(new MonitoredItem(subscription.DefaultItem) { StartNodeId = scalar, AttributeId = Attributes.Value, SamplingInterval = 50 });
-            subscription.AddItem(new MonitoredItem(subscription.DefaultItem) { StartNodeId = array, AttributeId = Attributes.Value, SamplingInterval = 50 });
-            await subscription.ApplyChangesAsync(ct);
-            var response = await owner.WriteAsync(null, [new WriteValue { NodeId = scalar, AttributeId = Attributes.Value, Value = Value(++cycles) }, new WriteValue { NodeId = array, AttributeId = Attributes.Value, Value = Value(new short[] { 1, 2, 3, 4 }) }], ct);
-            if (response.Results.ToList().Any(s => StatusCode.IsBad(s))) throw new Exception("Control write denied");
-            if (!Equals(Clr(await owner.ReadValueAsync(scalar, ct)), cycles)) throw new Exception("Scalar changed");
-            if (!((short[])Clr(await owner.ReadValueAsync(array, ct))!).SequenceEqual(new short[] { 1, 2, 3, 4 })) throw new Exception("Array changed");
-            var browse = await owner.BrowseAsync(null, null, 1, [new BrowseDescription { NodeId = new NodeId("Control", ns), BrowseDirection = BrowseDirection.Forward, ReferenceTypeId = ReferenceTypeIds.HierarchicalReferences, IncludeSubtypes = true, ResultMask = (uint)BrowseResultMask.All }], ct);
-            await Task.Delay(1000, ct);
-            await subscription.DeleteAsync(true, ct);
-            await owner.CloseAsync(ct);
-            await other.CloseAsync(ct);
-        }
-        if (server.CurrentInstance.SessionManager.GetSessions().Count != 0 || server.CurrentInstance.SubscriptionManager.GetSubscriptions().Count != 0) throw new Exception("Control retained sessions/subscriptions");
-        Sample(cycles, "sample");
-        if (cycles % 4 == 0)
-        {
-            using var parked = await Connect();
-            using var sub = new Subscription(parked.DefaultSubscription) { PublishingInterval = 100 };
-            parked.AddSubscription(sub);
-            await sub.CreateAsync(ct);
-            sub.AddItem(new MonitoredItem(sub.DefaultItem) { StartNodeId = new NodeId("Control/Scalar", (ushort)parked.NamespaceUris.GetIndex("https://zb.com/otopcua/raw")), AttributeId = Attributes.Value, SamplingInterval = 50 });
-            await sub.ApplyChangesAsync(ct);
-            await host.DisposeAsync();
-            await Boot();
-            restarts++;
-        }
-    }
-    Console.WriteLine(JsonSerializer.Serialize(new { kind = "complete", cycles, restarts, seconds = watch.Elapsed.TotalSeconds, fullGate = false }));
-}
-finally
-{
-    await host.DisposeAsync();
-#if SDK2
-    await app.DisposeAsync();
-#endif
-}
-#if SDK2
-GC.Collect();
-GC.WaitForPendingFinalizers();
-GC.Collect();
-var certificateType = typeof(Opc.Ua.Security.Certificates.Certificate);
-var report = new Dictionary<string, object>();
-var trackingEnabled = Environment.GetEnvironmentVariable("OPCUA_CERTIFICATE_LEAK_TRACKING") == "1";
-if (trackingEnabled)
-{
-    foreach (var name in new[] { "EnumerateLiveCertificates", "EnumerateUnreachableUndisposedCertificates" })
-    {
-        var method = certificateType.GetMethod(name, BindingFlags.Static | BindingFlags.NonPublic)
-            ?? throw new InvalidOperationException("SDK2 diagnostic method missing: " + name);
-        var values = method.Invoke(null, null) as IEnumerable
-            ?? throw new InvalidOperationException("SDK2 diagnostic method return type changed: " + name);
-        var stacks = new List<string>();
-        foreach (var value in values)
-        {
-            var field = value!.GetType().GetField(name.Contains("Unreachable") ? "Item2" : "Item4")
-                ?? throw new InvalidOperationException("SDK2 diagnostic tuple field missing: " + name);
-            if (field.FieldType != typeof(string))
-                throw new InvalidOperationException("SDK2 diagnostic stack field type changed");
-            // Deliberately omit tuple Item1 (certificate identity).
-            stacks.Add((string)field.GetValue(value)!);
-        }
-        report[name] = new
-        {
-            count = stacks.Count,
-            allocations = stacks.GroupBy(x => x).OrderByDescending(g => g.Count()).Take(15)
-                .Select(g => new { count = g.Count(), stack = g.Key }).ToArray()
-        };
-    }
-}
-Console.WriteLine(JsonSerializer.Serialize(new { kind = "certificate-final-diagnostics", trackingEnabled, stats = CertificateStats(), report }));
-#endif
-class Auth : IOpcUaUserAuthenticator
-{
-    public Task<OpcUaUserAuthResult> AuthenticateUserNameAsync(string user, string password, CancellationToken ct) => Task.FromResult(user == "control" && password == FixtureCredential.Value ? OpcUaUserAuthResult.Allow("control", [OpcUaDataPlaneRoles.WriteOperate]) : OpcUaUserAuthResult.Deny("Control credential refused"));
-}
-class Gateway : IOpcUaNodeWriteGateway
-{
-    public Task<NodeWriteOutcome> WriteAsync(string n, object? v, AddressSpaceRealm r, CancellationToken ct) => Task.FromResult(new NodeWriteOutcome(true, null));
-}
-
-static class FixtureCredential
-{
-    internal static string Value { get; } = Environment.GetEnvironmentVariable("OPCUA_MEMORY_PASSWORD") ?? throw new InvalidOperationException("Set OPCUA_MEMORY_PASSWORD for the task-owned fixture.");
-}

scripts/validation/opcua-lifecycle-memory/README.md

@@ -1,286 +0,0 @@
-# SDK 2 lifecycle memory investigation
-
-The required two-hour server lifecycle gate failed on macOS and Linux. The RSS
-limit remains **cycle-3 baseline + 128 MiB**; retained managed memory remains
-+64 MiB and descriptors +32. No threshold, production code, certificate provider,
-or session factory was changed by this investigation. These controls do not
-replace the full gate. Issue #799 remains open.
-
-## Preserved full-workload failures
-
-| Run | Cycles / restarts | Observation time | RSS / limit (bytes) | Outcome |
-|---|---:|---:|---:|---|
-| macOS `fa823378` | 250 / 62 | 1045.53 s | 365,215,744 / 363,331,584 | Failed |
-| macOS `e135b7c9` profile reproduction | 245 / 61 | 1024.14 s | 368,656,384 / 363,053,056 | Failed |
-| Linux full harness, recorded build `38098ce142ab8c382825aa754e0758071dd3a46b` | 248 / 61 | 903.508 s | 353,931,264 / 351,850,496 | Failed |
-| macOS `6b2d4b81` bounded profile | 432 / 108 | 1807.479 s | First rejection: 364,199,936 / 363,266,048 | Failed; first assertion rethrown |
-
-The last macOS row requested 1,800 seconds. It first rejected RSS at cycle 253 /
-1055.482 seconds, continued recording explicitly rejected observations, then
-threw the original assertion before any completion record. Its final observation
-was RSS 380,059,648, live managed 41,364,096, GC committed 37,060,608, JIT
-compilations 81,535, descriptors 200, and zero sessions, subscriptions, monitored
-items, browse/history continuation points, and PKI descriptors. SDK cached stores
-remained two during operation. The runner and skip guard returned exit 1 with one
-executed test and zero skipped tests. There is no passing two-hour result here.
-
-The first macOS run's reported PKI descriptor zero is invalid: `/var` and
-`/private/var` aliases were not canonicalized. Corrected positive-handle and timeout
-controls passed before subsequent profiles. Global descriptor counts and the RSS
-failure itself were independent of that defect. A Shouldly source-expression
-message incorrectly names `Descriptors` in the RSS failure; the actual numeric
-comparison is RSS, as retained before the assertion.
-
-## What the controls demonstrate
-
-`LifecycleControl.cs` uses unchanged published product DLLs and public APIs for
-both SDK generations. It opens two real encrypted **opc.tcp** sessions with
-Basic256Sha256 / SignAndEncrypt, resolves namespace URIs, reads/writes Int32 and
-Int16[] values, creates/deletes two data monitored items, abandons a browse
-continuation, closes sessions, and restarts a server with an active subscription
-every four cycles against the same task-owned PKI. Public session/subscription
-counts must return to zero. It has no historian, revocation, surgical-rebuild,
-paused-network, or private continuation-store coverage. It is a diagnostic subset,
-not TLS and not the full soak workload.
-
-The original DLLs are the immutable 1.5.378.182 baseline publication associated
-with `83ed880e`; its assembly version alone is 1.5.378.0 and does not identify the
-patch. The candidate uses SDK 2.0.1 and the server implementation from `fa823378`.
-Neither baseline nor candidate product code was rebuilt for these controls.
-The controls were compiled once for each reference set, then those exact control
-artifacts were used on both operating systems. Selected DLL and input-artifact
-hashes are in `evidence.json`. Neither reference set's principal SDK/server DLLs
-has a managed native/ReadyToRun header.
-
-| Ten-minute matched subset | Cycles / restarts | Final RSS | Change from cycle 3 | Final managed / change | Final JIT compilations |
-|---|---:|---:|---:|---:|---:|
-| macOS original | 212 / 53 | 330,301,440 | +121,683,968 | 271,168,424 / +169,990,456 | 28,066 |
-| macOS SDK2 | 200 / 50 | 302,170,112 | +95,862,784 | 44,569,584 / +295,120 | 62,608 |
-| Linux original | 249 / 62 | 384,950,272 | +176,836,608 | 147,139,568 / +99,356,752 | 28,321 |
-| Linux SDK2 | 259 / 64 | 390,844,416 | +194,183,168 | 19,561,120 / +736 | 71,529 |
-
-Both ten-minute controls exited zero because their lifecycle checks passed;
-`fullGate=false` is explicit. They do **not** enforce the full harness memory
-assertions. In particular, both Linux subset RSS deltas exceed 128 MiB and the
-original retains managed memory/timers. These observations do not waive either
-failed full gate. They are not proof of an SDK1 defect or an SDK2 improvement.
-Both control branches explicitly delete subscriptions, close normal sessions,
-and dispose sessions/subscriptions. Parked resources intentionally encounter
-server shutdown and are then disposed. Each version calls its unchanged product
-host's DisposeAsync. The baseline host only calls ApplicationInstance.StopAsync;
-that original ApplicationInstance exposes no disposal interface. The SDK2 branch
-also uses its new ApplicationInstance.DisposeAsync ownership API. Per-connection
-DefaultTelemetry factories are left to the same ownership pattern on both
-branches, separately probed above. Thus measured original growth belongs to this
-published-product/fixture lifecycle combination; its allocation owner has not
-been isolated. These are one matched run per platform, concurrent processes,
-with different runtime versions; they are not performance distributions.
-
-The thirty-minute Linux comparison uses the same immutable artifacts and image,
-fresh independent fixtures, and SDK2 certificate allocation tracking enabled
-before the first certificate (the same environment is passed to both versions).
-Both finished with exit zero and `fullGate=false`:
-
-| Thirty-minute Linux subset | Cycles / restarts | Final RSS | Final live managed | GC committed | JIT compilations | Active timers |
-|---|---:|---:|---:|---:|---:|---:|
-| Original | 736 / 184 | 540,057,600 | 342,626,200 | 408,399,872 | 29,177 | 926 |
-| SDK2 | 768 / 192 | 334,180,352 | 19,248,984 | 42,983,424 | 72,087 | 19 |
-
-Observed runtime was 1802.542 seconds original / 1804.523 seconds SDK2. The SDK2
-RSS fell from 390,782,976 at the 632.7-second checkpoint to 334,180,352 at the last
-observation; live managed stayed near 20 MB. After disposal and final collection,
-SDK2 wrapper counters were 19,272 created = 19,272 disposed, with zero live or
-unreachable-undisposed wrappers under enabled tracking. These finite results
-support post-transition saturation of this subset, not a two-hour full-workload
-pass or a guarantee of indefinite stability.
-
-### Native and runtime observations
-
-- During the macOS bounded profile, `Security::AppleDatabase` counts increased
-  from 278 at cycle 52 / 211 seconds to 1,953 at cycle 370 / 1546 seconds. These
-  native objects continued accumulating while managed memory stayed near 40 MiB.
-- The single-owner certificate probe makes a self-signed RSA fixture in memory,
-  then disposes each of 1,000 copies/imports. On macOS, public-only and
-  shared-handle copies leave AppleDatabase at 2; PFX imports and SDK
-  `Certificate.AsX509Certificate2` private-key copies grow it from 2 to 1,002.
-  A separate PFX process retained that count through a 180-second idle hold.
-  `Certificate.From(original)` owns the original; the checked-in control has no
-  second owner. All four corrected single-owner modes were rerun successfully.
-- The same isolated Linux probe ended at approximately 49 MB RSS for public or
-  shared copies, 61 MB for PFX imports, and 69 MB for the SDK copy. Those are
-  endpoint RSS observations including different JIT/GC costs, not evidence of a
-  Linux native-object leak or a complete attribution.
-- SDK2 public certificate counters after the Linux ten-minute lifecycle run were
-  6,495 created = 6,495 disposed. A separate stack-tracked macOS lifecycle run
-  ended 591 = 591, zero live and zero unreachable-undisposed wrappers. Allocation
-  tracking is opt-in; empty internal reports without that opt-in are not proof.
-- The Linux ten-minute native snapshots show SDK2 JIT `doublemapper` resident
-  mappings increasing from about 65.4 to 106.7 MiB, anonymous writable mappings
-  from 84.6 to 121.3 MiB, and `[heap]` around 19.2 MiB. Original JIT mappings were
-  about 33.3 to 37.7 MiB. Mapping totals are descriptive categories, not exclusive
-  object allocations: anonymous memory also contains GC regions, stacks, and
-  native allocator arenas. RSS includes file/shared pages and can fall with
-  reclamation. JIT counters are cumulative compilations, not unique live methods.
-- 10,000 disposed versus undisposed `DefaultTelemetry` factories ended at similar
-  RSS (~63.4 MB) and live managed memory (~0.43 MB), with no timer growth. This
-  does not justify changing host telemetry ownership to fix this failure.
-
-Exact SDK tag source shows private-key PFX copying in nonvirtual
-`Certificate.AsX509Certificate2`. A 60-second macOS sampled-thread-time trace
-instead found the dominant sampled import path through
-`CertificateIdentifierResolver.LoadPrivateKeyCoreAsync` →
-`DirectoryCertificateStore.LoadPrivateKeyAsync` → `X509CertificateLoader.LoadPkcs12`.
-Inclusive sampled thread-time was about 4.79 seconds for store load and 2.99 seconds
-for PKCS12, versus 8.5 milliseconds for AsX509. These are neither exclusive CPU
-costs nor call counts. ApplicationInstance already normalizes its validation
-input to public DER. The validation copy delegate is internal, the manager sealed,
-and no safe narrow application copy-policy seam was identified. Changing session
-factory, certificate exportability, or key storage would alter behavior and was
-not used as a workaround.
-
-A major JIT/RSS step appeared near 60–64 restarts in several workloads. This is a
-hypothesis about runtime/code-cache warmup, not a finding that all RSS growth is
-benign. A separate read-only EventPipe attachment observed the thirty-minute
-Linux candidate around that transition using `Microsoft-Windows-DotNETRuntime`,
-Verbose, keywords `0x18` (Loader + JIT), no rundown, 180 seconds. The transition was UTC 18:51:02.049–18:54:02.062. Factory JIT events
-occurred UTC 18:52:48.249–18:53:21.434: 6,690 distinct method tokens from one
-module, each once. The module is Opc.Ua.Core.Types.dll; metadata declares 8,442
-static methods on OpcUaExtensions. The observed set is a subset, so this does
-not prove every possible factory or the complete canonical workload is warmed.
-Method-load events totalled 51,327,536 native code bytes, including 51,161,724
-OptimizedTier1 bytes and 49,141,484 bytes in generated factories. Only 50
-reflection InvokeStub JIT starts occurred; the transition trace reports zero lost events. MethodSize sums count loaded code
-versions, not resident/PSS allocation bytes. An additional 180-second attachment
-after the transition checks continuing factory compilation. The second attachment (UTC 19:01:44.116–19:04:44.127) recorded 85 JIT starts,
-zero lost events, zero Opc.Ua starts, zero generated-factory starts, and zero generated-factory
-loaded bytes. Only 18 ordinary Tier1 method loads (5,720 bytes) and 20
-instrumented Tier1 loads (5,800 bytes) occurred. This supports a finite generated
-factory burst in the observed subset; it does not prove complete canonical
-workload saturation. The capture API's default circular-buffer capacity was 256 MiB; that is a
-capacity setting, not measured resident overhead. Attachments can allocate event
-buffers and perturb execution. Both prior full failures and the ten-minute
-control were uninstrumented by these JIT attachments, and the thirty-minute final
-interval is unattached. No captured native-code byte total is claimed to equal an
-RSS delta. Raw traces/heaps are not committed.
-
-## Reproduce the diagnostic subset
-
-Requires Python 3 and .NET 10. `run.py` references existing DLL directories,
-compiles only the control, records SHA-256 provenance, and creates a fresh local
-artifact directory. First reference directory wins duplicate filenames. Use the
-actual baseline publications, rather than restoring a different package version.
-No production project or package file is changed.
-
-```bash
-python3 scripts/validation/opcua-lifecycle-memory/run.py lifecycle \
-  --references "$baselineHostDlls" --references "$baselineClientDlls" \
-  --output /tmp/opcua-memory-original --seconds 600
-python3 scripts/validation/opcua-lifecycle-memory/run.py lifecycle --sdk2 \
-  --references "$candidateDlls" --output /tmp/opcua-memory-sdk2 --seconds 600 \
-  --certificate-tracking
-```
-
-Fixture credentials are generated in the runner environment and not logged.
-PKI material stays under each local `private-fixture` directory. Do not publish
-those directories or unredacted process/native logs. These controls grant a
-fixture user WriteOperate and auto-accept task-owned certificates; they are
-local test fixtures, not deployment configurations.
-
-For a matched Linux pair, first build both with `--build-only` into fresh
-`/tmp/opcua-memory-original` and `/tmp/opcua-memory-sdk2` output directories, then:
-
-```bash
-python3 scripts/validation/opcua-lifecycle-memory/linux_pair.py \
-  --baseline /tmp/opcua-memory-original/bin/Release/net10.0 \
-  --candidate /tmp/opcua-memory-sdk2/bin/Release/net10.0 \
-  --output /tmp/opcua-memory-linux-pair --seconds 1800 \
-  --image sha256:b04611ee9e1b7d36797012ed921962c57189cb4dbb3dff12afb8e158110f293b
-```
-
-The runner uses separate task-owned `--network none` containers, fresh PKI,
-read-only executable mounts, bounded shutdown, and periodic read-only `/proc`
-snapshots. It records child and container exit statuses independently. The image
-is Ubuntu 24.04 arm64, .NET SDK 10.0.103 / runtime 10.0.3. The Mac runs used
-macOS 26.5.2 arm64, SDK 10.0.403 / runtime 10.0.14. Runtime and OS differences are
-explicit; do not attribute all cross-platform differences to SDK code.
-
-On macOS, run each certificate mode with a fresh output directory:
-
-```bash
-python3 scripts/validation/opcua-lifecycle-memory/run.py certificate --sdk2 \
-  --references "$candidateDlls" --output /tmp/opcua-memory-pfx --mode pfx
-```
-
-Other modes are `sdk-copy`, `public`, and `shared-copy`. The last intentionally
-uses the old copy constructor by reflection as a diagnostic control. It is not
-proposed production code. The control exports no fixture key/certificate data.
-`TelemetryControl.cs` is available through `run.py telemetry --sdk2` with modes
-`dispose` or `undisposed`. `summarize.py` emits Linux mapping categories without
-file paths from local `*-smaps.txt` files. All controls are opt-in and outside the
-ordinary solution/test graph.
-
-Optional trace reproduction uses the installed dotnet-trace 9.0.661903 managed
-libraries, without adding a product dependency:
-
-```bash
-python3 scripts/validation/opcua-lifecycle-memory/build_trace_tools.py \
-  --libraries "$diagnosticToolLibraries" --output /tmp/opcua-memory-trace-tools
-# Run capture in the same process namespace / user as the task-owned target.
-dotnet /tmp/opcua-memory-trace-tools/capture/bin/Release/net10.0/capture.dll \
-  "$targetPid" 180 /tmp/opcua-memory-local.nettrace
-dotnet /tmp/opcua-memory-trace-tools/summary/bin/Release/net10.0/summary.dll \
-  /tmp/opcua-memory-local.nettrace > /tmp/opcua-memory-method-summary.json
-```
-
-Capture is read-only and opt-in; raw traces remain local. The summary exports
-static method names and aggregate counts rather than certificate identities,
-arguments, or process mappings. The original transition parser also retained
-method tokens/modules locally to cross-check name-key uniqueness.
-
-## Prospective saturation experiment (not executed)
-
-The observed finite factory burst supports a separately labeled readiness
-experiment; it does not authorize moving the acceptance baseline. A reviewed
-candidate proposal is exactly 384 canonical lifecycle cycles / 96 every-four-cycle
-restarts, then one fixed settling cycle, all within 1,800 seconds. No early finish,
-extension, or RSS-selected endpoint is permitted. Both fixed readiness windows
-321–352 and 353–384 must contain zero generated-factory JIT/method-load events, zero SDK assembly
-loads, and zero lost events. Other JIT/native-code totals remain review evidence,
-not a claim that every runtime path is warmed. Trace capture is bounded and identical for both versions, then
-detached/drained before the settling cycle. Ownership, FD, PKI, store, and logical
-resource checks remain active throughout; original cold budget rejections remain
-recorded. Any later full gate requires at least 7,200 additional seconds after a
-prospectively approved baseline. No such warmed full gate has been run here.
-
-The count is beyond the observed 60–64-restart transition and projects to about
-1,606 seconds from the Mac canonical run, but completion within the fixed cutoff
-is not guaranteed under load. Failure to complete or satisfy readiness is a failed
-experiment, not permission to extend. The full canonical test currently depends
-on SDK2 value APIs and read-only private SDK2 continuation/store instrumentation.
-An original-SDK adapter proving identical history, revocation, surgical-edit,
-and stalled-network operation counts is a prerequisite for a matched canonical
-experiment; the public subset does not provide that proof. Continued Mac native
-inventory growth remains an independent unresolved gate, even if JIT saturates.
-
-## Evidence and limits
-
-`evidence.json` contains sanitized numeric endpoints, native inventory counts,
-and hashes of retained diagnostic inputs. Full artifacts remain in the originating
-worktrees or `/tmp/opcua2-rss-investigation`; no PKI, certificate identifiers,
-credentials, raw traces, unredacted heap/process dumps, or complete test logs are
-checked in. Existing failures were preserved untouched.
-
-Supported progress is a reproduced RSS failure, bounded logical/managed
-inventories in SDK2, demonstrated macOS PFX native retention, and measured
-cross-platform JIT/anonymous-memory growth. A complete allocation attribution and
-safe production correction remain unresolved. The server two-hour gate remains
-failed; a separate long-running client-only process is a different scope.
-
-Package verification: baseline and candidate control builds, both optional trace
-tools, and certificate/telemetry controls built with zero warnings/errors. Local
-control smoke runs and the fresh Linux pair smoke exited zero. Python compilation
-and whitespace checks passed. One reused-output smoke failed because a manual
-incremental build used a different `/tmp` path alias and its runtimeconfig was
-missing; fresh canonical outputs passed, and the Linux runner now rejects an
-incomplete output directory before launch. These smoke checks validate tooling
-only and do not substitute for either long run.

scripts/validation/opcua-lifecycle-memory/TelemetryControl.cs

@@ -1,22 +0,0 @@
-using System.Diagnostics;
-using System.Runtime;
-using System.Text.Json;
-using Microsoft.Extensions.Logging;
-using Opc.Ua;
-var dispose = args[0] == "dispose";
-for (int i = 0; i <= 10000; i++)
-{
-    if (i > 0)
-    {
-        var t = DefaultTelemetry.Create(_ => { });
-        t.LoggerFactory.CreateLogger("TelemetryControl").LogDebug("control");
-        if (dispose) ((IDisposable)t).Dispose();
-    }
-    if (i % 250 == 0)
-    {
-        var live = GC.GetTotalMemory(true);
-        using var p = Process.GetCurrentProcess();
-        p.Refresh();
-        Console.WriteLine(JsonSerializer.Serialize(new { i, dispose, live, rss = p.WorkingSet64, methods = JitInfo.GetCompiledMethodCount(), il = JitInfo.GetCompiledILBytes(), gc = GC.GetGCMemoryInfo().TotalCommittedBytes, threads = p.Threads.Count, timers = Timer.ActiveCount }));
-    }
-}

scripts/validation/opcua-lifecycle-memory/TraceSummary.cs

@@ -1,62 +0,0 @@
-// Redacted aggregate summary. Keep raw traces local.
-using Microsoft.Diagnostics.Tracing;
-using System.Text.Json;
-
-var starts = new Dictionary<string, int>();
-var tiers = new Dictionary<string, int>();
-var nativeBytes = new Dictionary<string, long>();
-var factoryNames = new Dictionary<string, int>();
-var factoryTokens = new HashSet<int>();
-var factoryModules = new HashSet<long>();
-var firstFactoryMs = double.PositiveInfinity;
-var lastFactoryMs = 0d;
-var factoryNativeBytes = 0L;
-var sdkAssemblyLoads = 0;
-using var source = new EventPipeEventSource(args[0]);
-source.Clr.MethodJittingStarted += data =>
-{
-    var name = data.MethodNamespace + "." + data.MethodName;
-    starts[name] = starts.GetValueOrDefault(name) + 1;
-    if (!name.StartsWith("Opc.Ua.OpcUaExtensions.", StringComparison.Ordinal)) return;
-    factoryNames[name] = factoryNames.GetValueOrDefault(name) + 1;
-    factoryTokens.Add(data.MethodToken);
-    factoryModules.Add(data.ModuleID);
-    firstFactoryMs = Math.Min(firstFactoryMs, data.TimeStampRelativeMSec);
-    lastFactoryMs = Math.Max(lastFactoryMs, data.TimeStampRelativeMSec);
-};
-source.Clr.MethodLoadVerbose += data =>
-{
-    var tier = data.OptimizationTier.ToString();
-    tiers[tier] = tiers.GetValueOrDefault(tier) + 1;
-    nativeBytes[tier] = nativeBytes.GetValueOrDefault(tier) + data.MethodSize;
-    if (data.MethodNamespace == "Opc.Ua.OpcUaExtensions") factoryNativeBytes += data.MethodSize;
-};
-source.Clr.LoaderAssemblyLoad += data =>
-{
-    if (data.FullyQualifiedAssemblyName.StartsWith("Opc.Ua.", StringComparison.Ordinal)) sdkAssemblyLoads++;
-};
-source.Process();
-Console.WriteLine(JsonSerializer.Serialize(new
-{
-    traceStartUtc = source.SessionStartTime.ToUniversalTime(),
-    traceEndUtc = source.SessionEndTime.ToUniversalTime(),
-    eventsLost = source.EventsLost,
-    sdkAssemblyLoads,
-    jittingStarts = starts.Values.Sum(),
-    // Name keys omit generic signatures; token/module counts independently identify the factory set.
-    distinctNameKeys = starts.Count,
-    opcUaJittingStarts = starts.Where(x => x.Key.StartsWith("Opc.Ua.", StringComparison.Ordinal)).Sum(x => x.Value),
-    invokeStubStarts = starts.Where(x => x.Key.StartsWith("dynamicClass.InvokeStub", StringComparison.Ordinal)).Sum(x => x.Value),
-    tiers,
-    summedLoadedNativeMethodBytes = nativeBytes,
-    factory = new
-    {
-        starts = factoryNames.Values.Sum(), distinctNames = factoryNames.Count,
-        distinctTokens = factoryTokens.Count, moduleCount = factoryModules.Count,
-        everyNameOnce = factoryNames.Values.All(x => x == 1),
-        firstMs = double.IsFinite(firstFactoryMs) ? (double?)firstFactoryMs : null,
-        lastMs = factoryNames.Count == 0 ? (double?)null : lastFactoryMs,
-        summedLoadedNativeMethodBytes = factoryNativeBytes,
-        examples = factoryNames.Keys.Take(10).ToArray()
-    }
-}, new JsonSerializerOptions { WriteIndented = true }));

scripts/validation/opcua-lifecycle-memory/build_trace_tools.py

@@ -1,38 +0,0 @@
-#!/usr/bin/env python3
-"""Build optional local capture/summary tools using the user's installed dotnet-trace libraries."""
-import argparse
-from pathlib import Path
-import subprocess
-import xml.etree.ElementTree as ET
-
-parser = argparse.ArgumentParser(description=__doc__)
-parser.add_argument("--libraries", required=True, type=Path, help="dotnet-trace tools/net8.0/any directory")
-parser.add_argument("--output", required=True, type=Path, help="Fresh local output directory")
-args = parser.parse_args()
-args.output = args.output.resolve()
-args.output.mkdir(parents=True, exist_ok=False)
-for name, source, references in [
-    ("capture", "EventPipeCapture.cs", ["Microsoft.Diagnostics.NETCore.Client"]),
-    ("summary", "TraceSummary.cs", ["Microsoft.Diagnostics.Tracing.TraceEvent", "Microsoft.Diagnostics.FastSerialization", "Microsoft.Diagnostics.NETCore.Client"])
-]:
-    output = args.output / name
-    output.mkdir()
-    project = ET.Element("Project", Sdk="Microsoft.NET.Sdk")
-    properties = ET.SubElement(project, "PropertyGroup")
-    for key, value in {"OutputType": "Exe", "TargetFramework": "net10.0", "ImplicitUsings": "enable",
-                       "EnableDefaultCompileItems": "false"}.items():
-        ET.SubElement(properties, key).text = value
-    items = ET.SubElement(project, "ItemGroup")
-    ET.SubElement(items, "FrameworkReference", Include="Microsoft.AspNetCore.App")
-    ET.SubElement(items, "Compile", Include=str(Path(__file__).resolve().parent / source))
-    for reference in references:
-        dll = (args.libraries / (reference + ".dll")).resolve(strict=True)
-        item = ET.SubElement(items, "Reference", Include=reference)
-        ET.SubElement(item, "HintPath").text = str(dll)
-    path = output / (name + ".csproj")
-    ET.indent(project)
-    ET.ElementTree(project).write(path, encoding="unicode")
-    with (output / "build.log").open("w") as log:
-        result = subprocess.run(["dotnet", "build", str(path), "-c", "Release", "-m:2"], stdout=log, stderr=subprocess.STDOUT)
-    if result.returncode:
-        raise SystemExit(result.returncode)

scripts/validation/opcua-lifecycle-memory/linux_pair.py

@@ -1,113 +0,0 @@
-#!/usr/bin/env python3
-"""Run two already-built public lifecycle controls in isolated, offline Linux containers."""
-import argparse
-from datetime import datetime, timezone
-import hashlib
-import json
-import os
-from pathlib import Path
-import secrets
-import subprocess
-import time
-import uuid
-
-
-def latest_sample(path):
-    # A concurrently-written final line may be incomplete. All complete rows remain in the source log.
-    for row in reversed(path.read_text().splitlines()):
-        try:
-            value = json.loads(row)
-        except json.JSONDecodeError:
-            continue
-        if value.get("kind") == "sample":
-            return value
-    return None
-
-
-def run(options):
-    options.output = options.output.resolve()
-    options.output.mkdir(parents=True, exist_ok=False)
-    processes = []
-    environment = os.environ.copy()
-    environment["OPCUA_MEMORY_PASSWORD"] = secrets.token_urlsafe(32)
-    # Both receive the same environment. SDK1 ignores the SDK2 diagnostic opt-in.
-    environment["OPCUA_CERTIFICATE_LEAK_TRACKING"] = "1"
-    started = time.monotonic()
-    try:
-        for label, directory in [("baseline", options.baseline), ("candidate", options.candidate)]:
-            directory = directory.resolve(strict=True)
-            for required in ["control.dll", "control.deps.json", "control.runtimeconfig.json"]:
-                if not (directory / required).is_file():
-                    raise FileNotFoundError("Use a complete, canonically-built control output: missing " + required)
-            output = options.output / label
-            output.mkdir()
-            container = "opcua-memory-" + label + "-" + uuid.uuid4().hex[:10]
-            shell = ('dotnet /app/control.dll /task/private-fixture ' + str(options.seconds) +
-                     ' > /task/samples.jsonl 2>&1 & child=$!; echo "$child" > /task/dotnet.pid; '
-                     'wait "$child"; status=$?; echo "$status" > /task/exit-status.txt; exit "$status"')
-            command = ["docker", "run", "--rm", "--name", container, "--network", "none",
-                       "--env", "OPCUA_MEMORY_PASSWORD", "--env", "OPCUA_CERTIFICATE_LEAK_TRACKING",
-                       "-v", str(directory) + ":/app:ro", "-v", str(output) + ":/task",
-                       options.image, "bash", "-c", shell]
-            manifest = {"argv": command, "fullGate": False, "seconds": options.seconds,
-                        "environmentNamesOnly": ["OPCUA_MEMORY_PASSWORD", "OPCUA_CERTIFICATE_LEAK_TRACKING"],
-                        "startedUtc": datetime.now(timezone.utc).isoformat(),
-                        "runtimeFiles": {p.name: hashlib.sha256(p.read_bytes()).hexdigest()
-                                         for p in sorted(directory.iterdir()) if p.is_file()}}
-            (output / "command.json").write_text(json.dumps(manifest, indent=2) + "\n")
-            stream = (output / "container.log").open("w")
-            process = subprocess.Popen(command, env=environment, stdout=stream, stderr=subprocess.STDOUT)
-            processes.append((label, container, output, stream, process))
-        next_sample = started + 60
-        while any(process.poll() is None for _, _, _, _, process in processes):
-            if time.monotonic() - started > options.seconds + 240:
-                raise TimeoutError("Diagnostic controls exceeded bounded shutdown allowance")
-            if time.monotonic() >= next_sample:
-                for label, container, output, _, process in processes:
-                    pid_file = output / "dotnet.pid"
-                    if process.poll() is not None or not pid_file.exists():
-                        continue
-                    pid = pid_file.read_text().strip()
-                    if not pid.isdecimal():
-                        raise RuntimeError("Unexpected task-owned process id")
-                    stamp = str(int(time.time()))
-                    latest = latest_sample(output / "samples.jsonl")
-                    with (output / "observations.jsonl").open("a") as observed:
-                        observed.write(json.dumps({"utc": datetime.now(timezone.utc).isoformat(),
-                                                   "seconds": time.monotonic() - started,
-                                                   "sample": latest}) + "\n")
-                    for name in ["smaps", "smaps_rollup", "status"]:
-                        with (output / (stamp + "-" + name + ".txt")).open("w") as destination:
-                            result = subprocess.run(["docker", "exec", container, "cat", "/proc/" + pid + "/" + name],
-                                                    stdout=destination, stderr=subprocess.STDOUT, timeout=15)
-                        if result.returncode and process.poll() is None:
-                            raise RuntimeError(label + " live process diagnostic read failed")
-                next_sample += 60
-            time.sleep(.5)
-        statuses = []
-        for label, _, output, _, process in processes:
-            status = process.wait()
-            (output / "docker-exit-status.txt").write_text(str(status) + "\n")
-            print(label + " exit " + str(status), flush=True)
-            statuses.append(status)
-        return 0 if all(status == 0 for status in statuses) else 1
-    finally:
-        for _, container, _, stream, process in processes:
-            if process.poll() is None:
-                subprocess.run(["docker", "stop", "--time", "10", container], stdout=subprocess.DEVNULL,
-                               stderr=subprocess.DEVNULL, timeout=20)
-                process.wait(timeout=20)
-            stream.close()
-
-
-if __name__ == "__main__":
-    parser = argparse.ArgumentParser(description=__doc__)
-    parser.add_argument("--baseline", type=Path, required=True, help="Already-built control output directory")
-    parser.add_argument("--candidate", type=Path, required=True, help="Already-built control output directory")
-    parser.add_argument("--output", type=Path, required=True, help="New local diagnostic directory")
-    parser.add_argument("--image", required=True, help="Immutable Linux .NET10 image digest")
-    parser.add_argument("--seconds", type=int, default=1800)
-    options = parser.parse_args()
-    if not 1 <= options.seconds <= 1800 or not options.image.startswith("sha256:"):
-        parser.error("Use an immutable image digest and duration 1..1800; never a full-soak gate")
-    raise SystemExit(run(options))

scripts/validation/opcua-lifecycle-memory/run.py

@@ -1,134 +0,0 @@
-#!/usr/bin/env python3
-"""Build opt-in controls against existing published DLLs; never rebuild product code."""
-import argparse
-import hashlib
-import json
-import os
-from pathlib import Path
-import secrets
-import subprocess
-import sys
-import time
-import xml.etree.ElementTree as ET
-
-
-def digest(path):
-    return hashlib.sha256(path.read_bytes()).hexdigest()
-
-
-def main():
-    parser = argparse.ArgumentParser(description=__doc__)
-    parser.add_argument("kind", choices=["lifecycle", "certificate", "telemetry"])
-    parser.add_argument("--references", type=Path, action="append", required=True,
-                        help="Existing published DLL directory; first directory wins duplicate names")
-    parser.add_argument("--output", type=Path, required=True, help="New local artifact directory")
-    parser.add_argument("--sdk2", action="store_true")
-    parser.add_argument("--seconds", type=int, default=600)
-    parser.add_argument("--mode", help="Certificate: public/pfx/shared-copy/sdk-copy; telemetry: dispose/undisposed")
-    parser.add_argument("--build-only", action="store_true")
-    parser.add_argument("--certificate-tracking", action="store_true", help="SDK2 opt-in allocation-stack diagnostics")
-    options = parser.parse_args()
-    if options.kind != "lifecycle" and not options.sdk2:
-        parser.error("certificate and telemetry controls require --sdk2")
-    if not 1 <= options.seconds <= 1800:
-        parser.error("Diagnostic duration must be 1..1800 seconds; this is never a full soak")
-    options.output = options.output.resolve()
-    options.output.mkdir(parents=True, exist_ok=False)
-    names = {"lifecycle": "LifecycleControl.cs", "certificate": "CertificateControl.cs", "telemetry": "TelemetryControl.cs"}
-    source = Path(__file__).resolve().parent / names[options.kind]
-    references = {}
-    for directory in options.references:
-        directory = directory.resolve(strict=True)
-        for dll in sorted(directory.glob("*.dll")):
-            references.setdefault(dll.name, dll)
-    if "Opc.Ua.Core.dll" not in references:
-        parser.error("References must contain actual OPC UA managed assemblies")
-    project = ET.Element("Project", Sdk="Microsoft.NET.Sdk")
-    properties = ET.SubElement(project, "PropertyGroup")
-    for key, value in {"OutputType": "Exe", "TargetFramework": "net10.0", "ImplicitUsings": "enable",
-                       "Nullable": "enable", "EnableDefaultCompileItems": "false",
-                       "DefineConstants": "SDK2" if options.sdk2 else ""}.items():
-        ET.SubElement(properties, key).text = value
-    items = ET.SubElement(project, "ItemGroup")
-    ET.SubElement(items, "FrameworkReference", Include="Microsoft.AspNetCore.App")
-    ET.SubElement(items, "Compile", Include=str(source))
-    for name, path in references.items():
-        reference = ET.SubElement(items, "Reference", Include=path.stem)
-        ET.SubElement(reference, "HintPath").text = str(path)
-    project_path = options.output / "control.csproj"
-    ET.indent(project)
-    ET.ElementTree(project).write(project_path, encoding="unicode")
-    manifest = {"kind": options.kind, "sdk2": options.sdk2, "seconds": options.seconds,
-                "fullSoakGate": False, "source": {source.name: digest(source)},
-                "referencePrecedence": "first directory wins duplicate names",
-                "references": {name: digest(path) for name, path in references.items()}}
-    (options.output / "provenance.json").write_text(json.dumps(manifest, indent=2) + "\n")
-    with (options.output / "build.log").open("w") as log:
-        result = subprocess.run(["dotnet", "build", str(project_path), "-c", "Release", "-m:2"],
-                                stdout=log, stderr=subprocess.STDOUT)
-    if result.returncode:
-        return result.returncode
-    if options.build_only:
-        return 0
-    executable = options.output / "bin/Release/net10.0/control.dll"
-    environment = os.environ.copy()
-    environment["OPCUA_MEMORY_PASSWORD"] = secrets.token_urlsafe(32)
-    if options.certificate_tracking:
-        environment["OPCUA_CERTIFICATE_LEAK_TRACKING"] = "1"
-    if options.kind == "lifecycle":
-        command = ["dotnet", str(executable), str(options.output / "private-fixture"), str(options.seconds)]
-        with (options.output / "samples.jsonl").open("w") as log:
-            result = subprocess.run(command, env=environment, stdout=log, stderr=subprocess.STDOUT,
-                                    timeout=options.seconds + 180)
-        status = result.returncode
-    elif options.kind == "telemetry":
-        if options.mode not in ["dispose", "undisposed"]:
-            parser.error("Telemetry mode must be dispose or undisposed")
-        with (options.output / "samples.jsonl").open("w") as log:
-            result = subprocess.run(["dotnet", str(executable), options.mode], env=environment,
-                                    stdout=log, stderr=subprocess.STDOUT, timeout=180)
-        status = result.returncode
-    else:
-        if sys.platform != "darwin":
-            parser.error("Native certificate control currently requires macOS heap/vmmap")
-        if options.mode not in ["public", "pfx", "shared-copy", "sdk-copy"]:
-            parser.error("Certificate mode must be public, pfx, shared-copy or sdk-copy")
-        status = certificate_control(executable, options.output, options.mode, environment)
-    (options.output / "exit-status.txt").write_text(str(status) + "\n")
-    return status
-
-
-def certificate_control(executable, output, mode, environment):
-    # Native snapshots contain process metadata; retain locally, do not publish them unredacted.
-    with (output / "samples.jsonl").open("w") as log:
-        process = subprocess.Popen(["dotnet", str(executable), mode, str(output)], env=environment,
-                                   stdout=log, stderr=subprocess.STDOUT)
-        try:
-            deadline = time.monotonic() + 180
-            while not (output / "samples.jsonl").stat().st_size:
-                if process.poll() is not None or time.monotonic() > deadline:
-                    raise RuntimeError("Certificate control failed before ready")
-                time.sleep(.05)
-            for label in ["before", "after"]:
-                if label == "after":
-                    (output / "go").touch()
-                    while True:
-                        rows = (output / "samples.jsonl").read_text().splitlines()
-                        if rows and json.loads(rows[-1]).get("kind") == "done":
-                            break
-                        if process.poll() is not None or time.monotonic() > deadline:
-                            raise RuntimeError("Certificate control did not finish")
-                        time.sleep(.1)
-                with (output / ("heap-" + label + ".txt")).open("w") as log_heap:
-                    subprocess.run(["/usr/bin/heap", "--noContent", "-s", str(process.pid)],
-                                   stdout=log_heap, stderr=subprocess.STDOUT, timeout=20, check=True)
-            (output / "stop").touch()
-            return process.wait(timeout=10)
-        finally:
-            if process.poll() is None:
-                process.terminate()
-                process.wait(timeout=10)
-
-
-if __name__ == "__main__":
-    raise SystemExit(main())

scripts/validation/opcua-lifecycle-memory/summarize.py

@@ -1,45 +0,0 @@
-#!/usr/bin/env python3
-"""Emit mapping-category totals without path names from local Linux /proc/PID/smaps."""
-import argparse
-from collections import defaultdict
-import json
-from pathlib import Path
-import re
-
-HEADER = re.compile(r"^[0-9a-f]+-[0-9a-f]+\s+(\S+)\s+\S+\s+\S+\s+\S+\s*(.*)$")
-METRIC = re.compile(r"^(Size|Rss|Pss|Private_Dirty|Private_Clean|Anonymous):\s+(\d+) kB$")
-
-
-def summarize(path):
-    groups = defaultdict(lambda: defaultdict(int))
-    group = None
-    for line in path.read_text().splitlines():
-        header = HEADER.match(line)
-        if header:
-            permissions, name = header.groups()
-            if "doublemapper" in name:
-                group = "jit-doublemapper"
-            elif name == "[heap]":
-                group = "native-heap"
-            elif name.startswith("[stack"):
-                group = "stack"
-            elif not name:
-                group = "anonymous-exec" if "x" in permissions else "anonymous-write" if "w" in permissions else "anonymous-read"
-            elif name.endswith(".dll"):
-                group = "managed-assembly-files"
-            elif ".so" in name:
-                group = "native-library-files"
-            elif name.startswith("["):
-                group = "other-kernel-mappings"
-            else:
-                group = "other-files"
-        elif group and (metric := METRIC.match(line)):
-            groups[group][metric[1]] += int(metric[2]) * 1024
-    return dict(groups)
-
-
-if __name__ == "__main__":
-    parser = argparse.ArgumentParser(description=__doc__)
-    parser.add_argument("files", nargs="+", type=Path)
-    args = parser.parse_args()
-    print(json.dumps([{"sample": index, "groups": summarize(path)} for index, path in enumerate(args.files)], indent=2))

scripts/validation/opcua-server-lifecycle-linux/.gitignore

@@ -0,0 +1 @@
+__pycache__/

scripts/validation/opcua-server-lifecycle-linux/README.md

@@ -0,0 +1,107 @@
+# Linux SDK 2 server lifecycle soak
+
+This launcher publishes and runs the existing
+`Sdk2LifecycleSoakTests.Repeated_lifecycles_return_resources_to_a_steady_baseline`
+without copying, rewriting, suppressing or changing its test logic. It imports the
+canonical descriptor fixes from `642aefe3`: physical symlink resolution, path
+separator boundaries, open/closed PKI positive controls, and bounded probe process
+and stream cleanup. The same test still owns the production server, node manager,
+sessions, subscriptions, continuation points, revocation, stalled TCP proxy,
+surgical changes/rebuild and same-PKI restarts.
+
+A diagnostic run:
+
+```sh
+python3 scripts/validation/opcua-server-lifecycle-linux/run.py \
+  --duration 90 --output /tmp/otopcua-server-linux-diagnostic-unique
+```
+
+The coordinator must launch and own a full run in its persistent execution
+session. A diagnostic cannot satisfy the full gate:
+
+```sh
+python3 scripts/validation/opcua-server-lifecycle-linux/run.py \
+  --full --duration 7200 --output /tmp/otopcua-server-linux-full-unique
+```
+
+An already published artifact can be reused with
+`--published-app /absolute/path/to/app`. Its parent must contain the launcher's
+`publish-receipt.json`; the test source, apphost and test assembly hashes must
+match. The recorded diagnostic artifact can be reused with:
+
+```sh
+python3 /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/scripts/validation/opcua-server-lifecycle-linux/run.py \
+  --full --duration 7200 \
+  --published-app /tmp/opcua2-server-linux-diagnostic-20261110a/app \
+  --output /tmp/opcua2-server-linux-full-20261110
+```
+
+The output directory must be fresh. It is mode 0700 and can contain task-owned
+private PKI under `task/tmp` during a run or after a failure. Never commit the
+entire output. The existing successful test removes its own stores. Only selected
+redacted receipt/log/JSONL/TRX files belong under this directory's `evidence/`.
+
+The exact publish command uses the host .NET SDK (recorded as 10.0.403 for the
+verified diagnostic), RID `linux-arm64`, self-contained runtime 10.0.14, explicit
+`UseAppHost=true`, `PublishSingleFile=false`, `PublishTrimmed=false`, one MSBuild
+node, and an external task-owned artifacts directory. All runtime packs were
+already cached. No production or test source is patched during publish. The
+launcher requires an empty production/package source diff against `7b353d7b` and
+records the actual published revision separately from the launcher revision.
+That is source equivalence, not a claim that separately built Linux and macOS
+assemblies have identical hashes. The full publish file hashes, exact test source
+hash, runtimeconfig and SDK dependency versions are retained.
+
+The cached official SDK image
+`mcr.microsoft.com/dotnet/sdk:10.0.103-noble` is resolved to its immutable local
+image ID and must be Linux arm64. The container has `--network none`, no host
+ports and only a read-only application mount plus its fresh task volume.
+`TMPDIR=/task/tmp` and `XDG_DATA_HOME=/task/data` isolate temporary files and PKI;
+`HOME` is not changed. Nothing targets fleet instances, production stores or
+other task fixtures.
+
+The image's VSTest runner first executes exactly the two existing descriptor
+controls. A separate invocation executes exactly one lifecycle test. Both TRX
+files must contain the expected exact executed/passed counts, no skips and no
+failure/error/abort/timeout. The published xUnit v3 application must be ELF64
+AArch64. During the live test, `/proc/<testpid>/exe` must point to the published
+application and the mapped CLR must be `/app/libcoreclr.so`, proving that the
+out-of-process test host is the self-contained Linux publish rather than an
+accidentally copied macOS host.
+
+The original test resource limits remain **64 MiB retained managed growth,
+128 MiB RSS growth, and 32 additional FDs**, using its original third-cycle
+baseline and original managed trend check. Quiescent sessions, subscriptions,
+items, browse/history points, monitored-node/live-item counts and PKI FDs must be
+zero. Cached certificate stores and address-space shape must remain at baseline.
+The original exact-tag read-only diagnostics and manager/store disposal assertions
+are unchanged. The wrapper verifies the same limits in the header and requires
+one start, one completion, no failed row, one active/stall/quiescent row per
+completed cycle and one restart per four cycles. Full mode requires both requested
+and actual monotonic observation time of at least 7200 seconds and a true final
+`satisfiesTwoHourDuration`. The outer container deadline is duration plus 300
+seconds. Its own container is forcibly removed on timeout/interruption.
+
+Artifacts include `publish.log`, `publish-receipt.json`, `source.json`,
+`artifact-manifest.json`, `command.json`, `result.json`, `container.log`, and
+`task/{soak.jsonl,soak.log,descriptor-controls.log,linux-precheck.txt,
+linux-runtime-process.txt,container-dotnet-info.txt,results/*.trx}`. A reused
+artifact keeps its original publish receipt; `source.json` identifies both source
+revisions. `result.json` is passing only after TRX and completion validation.
+
+This supplies supported Linux runtime evidence. It does not resolve the observed
+macOS RSS failure or establish its cause. A short Linux pass is not a two-hour
+pass, and a later Linux pass alone cannot explain away the macOS failure. This
+lane makes no Windows, AVEVA, interoperability or complete G4 performance claim.
+
+The final checked-in diagnostic completed **91.602 seconds**, 25 cycles, six
+actual server restarts, 25 recovered network stalls, and one passing lifecycle
+TRX result. Both descriptor tests passed: the symlink control observed
+`before=0, opened=1, closed=0`, excluded the sibling path, and the timed-out probe
+was reaped in 267 ms. All quiescent logical-resource counts and PKI FDs were zero.
+Third-cycle to final deltas were **−145,080 managed bytes, +53,739,520 RSS bytes,
+and +2 FDs**, within the unchanged diagnostic limits. These short observations do
+not establish a two-hour resource trend. The full Linux gate remains pending.
+CLI rejection of `--full --duration 90`, rejection of a short completion as a full
+run, and rejection of the wrong TRX executed count were also verified. Selected
+receipts are in `evidence/2026-11-10-diagnostic/`.

scripts/validation/opcua-server-lifecycle-linux/container.sh

@@ -0,0 +1,41 @@
+#!/usr/bin/env bash
+# Task-owned Linux namespace only. Existing test logic and limits are unchanged.
+set -euo pipefail
+mkdir -p /task/tmp /task/data /task/results
+export TMPDIR=/task/tmp
+export XDG_DATA_HOME=/task/data
+export OTOPCUA_SDK2_SOAK=1
+export OTOPCUA_SDK2_SOAK_OUTPUT=/task/soak.jsonl
+export DOTNET_CLI_TELEMETRY_OPTOUT=1
+export DOTNET_NOLOGO=1
+[[ $(uname -s) == Linux && $(uname -m) == aarch64 ]]
+[[ -d /proc/self/fd ]]
+printf 'kernel=%s machine=%s tmp=%s procfs=yes\n' "$(uname -s)" "$(uname -m)" "$(readlink -f "$TMPDIR")" > /task/linux-precheck.txt
+dotnet --info > /task/container-dotnet-info.txt
+dotnet vstest /app/ZB.MOM.WW.OtOpcUa.OpcUaServer.IntegrationTests.dll \
+  --TestCaseFilter:'FullyQualifiedName~Sdk2LifecycleSoakTests.Descriptor_probe_' \
+  --ResultsDirectory:/task/results '--Logger:trx;LogFileName=descriptor-controls.trx' > /task/descriptor-controls.log 2>&1
+# VSTest launches the published xUnit v3 self-contained Linux ELF apphost.
+# A distinct invocation gives the soak its own otherwise idle test process.
+dotnet vstest /app/ZB.MOM.WW.OtOpcUa.OpcUaServer.IntegrationTests.dll \
+  --TestCaseFilter:'FullyQualifiedName=ZB.MOM.WW.OtOpcUa.OpcUaServer.IntegrationTests.Sdk2LifecycleSoakTests.Repeated_lifecycles_return_resources_to_a_steady_baseline' \
+  --ResultsDirectory:/task/results '--Logger:trx;LogFileName=soak.trx' > /task/soak.log 2>&1 &
+vstest_pid=$!
+observed=0
+for attempt in $(seq 1 600); do
+    if [[ -s /task/soak.jsonl ]]; then
+        test_pid=$(head -n 1 /task/soak.jsonl | sed -n 's/.*"processId":\([0-9]*\),.*/\1/p')
+        [[ -n "$test_pid" ]]
+        test_exe=$(readlink "/proc/$test_pid/exe")
+        [[ "$test_exe" == /app/ZB.MOM.WW.OtOpcUa.OpcUaServer.IntegrationTests ]]
+        printf 'testProcessId=%s\nactualExecutable=%s\n' "$test_pid" "$test_exe" > /task/linux-runtime-process.txt
+        awk '$6 ~ /\/(libcoreclr.so|libhostfxr.so|libhostpolicy.so|System.Private.CoreLib.dll)$/ {print $6}' "/proc/$test_pid/maps" | sort -u >> /task/linux-runtime-process.txt
+        grep -Fx /app/libcoreclr.so /task/linux-runtime-process.txt > /dev/null
+        observed=1
+        break
+    fi
+    kill -0 "$vstest_pid" 2>/dev/null || break
+    sleep 0.1
+done
+[[ "$observed" == 1 ]]
+wait "$vstest_pid"

scripts/validation/opcua-server-lifecycle-linux/evidence/2026-11-10-diagnostic/command.json

@@ -0,0 +1,25 @@
+{
+  "argv": [
+    "docker",
+    "run",
+    "--rm",
+    "--name",
+    "otopcua-server-linux-soak-fb2c804a7d01",
+    "--network",
+    "none",
+    "-e",
+    "OTOPCUA_SDK2_SOAK_MODE=diagnostic",
+    "-e",
+    "OTOPCUA_SDK2_SOAK_SECONDS=90",
+    "-e",
+    "OTOPCUA_SOAK_BUILD_SHA=74c938f37cbb9cf08b6ca72e4effc511120dc274",
+    "-v",
+    "/private/tmp/opcua2-server-linux-diagnostic-20261110a/app:/app:ro",
+    "-v",
+    "/private/tmp/opcua2-server-linux-diagnostic-20261110c/task:/task",
+    "sha256:b04611ee9e1b7d36797012ed921962c57189cb4dbb3dff12afb8e158110f293b",
+    "bash",
+    "/task/container.sh"
+  ],
+  "timeoutSeconds": 390
+}

scripts/validation/opcua-server-lifecycle-linux/evidence/2026-11-10-diagnostic/container-dotnet-info.txt

@@ -0,0 +1,51 @@
+.NET SDK:
+ Version:           10.0.103
+ Commit:            c2435c3e0f
+ Workload version:  10.0.100-manifests.a62d7899
+ MSBuild version:   18.0.11+c2435c3e0
+
+Runtime Environment:
+ OS Name:     ubuntu
+ OS Version:  24.04
+ OS Platform: Linux
+ RID:         linux-arm64
+ Base Path:   /usr/share/dotnet/sdk/10.0.103/
+
+.NET workloads installed:
+There are no installed workloads to display.
+Configured to use workload sets when installing new manifests.
+No workload sets are installed. Run "dotnet workload restore" to install a workload set.
+
+Host:
+  Version:      10.0.3
+  Architecture: arm64
+  Commit:       c2435c3e0f
+
+.NET SDKs installed:
+  10.0.103 [/usr/share/dotnet/sdk]
+
+.NET runtimes installed:
+  Microsoft.AspNetCore.App 10.0.3 [/usr/share/dotnet/shared/Microsoft.AspNetCore.App]
+  Microsoft.NETCore.App 10.0.3 [/usr/share/dotnet/shared/Microsoft.NETCore.App]
+
+Other architectures found:
+  None
+
+Environment variables:
+  DOTNET_CLI_TELEMETRY_OPTOUT              [1]
+  DOTNET_GENERATE_ASPNET_CERTIFICATE       [false]
+  DOTNET_NOLOGO                            [1]
+  DOTNET_ROLL_FORWARD                      [Major]
+  DOTNET_RUNNING_IN_CONTAINER              [true]
+  DOTNET_SDK_VERSION                       [10.0.103]
+  DOTNET_USE_POLLING_FILE_WATCHER          [true]
+  DOTNET_VERSION                           [10.0.3]
+
+global.json file:
+  Not found
+
+Learn more:
+  https://aka.ms/dotnet/info
+
+Download .NET:
+  https://aka.ms/dotnet/download

scripts/validation/opcua-server-lifecycle-linux/evidence/2026-11-10-diagnostic/descriptor-controls.log

@@ -0,0 +1,7 @@
+VSTest version 18.0.1 (arm64)
+
+Starting test execution, please wait...
+A total of 1 test files matched the specified pattern.
+Results File: /task/results/descriptor-controls.trx
+
+Passed!  - Failed:     0, Passed:     2, Skipped:     0, Total:     2, Duration: 297 ms - ZB.MOM.WW.OtOpcUa.OpcUaServer.IntegrationTests.dll (net10.0)

scripts/validation/opcua-server-lifecycle-linux/evidence/2026-11-10-diagnostic/descriptor-controls.trx

@@ -0,0 +1,48 @@
+<?xml version="1.0" encoding="utf-8"?>
+<TestRun id="a4046507-6b54-4afc-b1d6-dbb3ad85db1c" name="@8c898f464f50 2026-11-10 18:06:02" xmlns="http://microsoft.com/schemas/VisualStudio/TeamTest/2010">
+  <Times creation="2026-11-10T18:06:02.0288408+00:00" queuing="2026-11-10T18:06:02.0288408+00:00" start="2026-11-10T18:06:01.1322717+00:00" finish="2026-11-10T18:06:02.0312051+00:00" />
+  <TestSettings name="default" id="bfdcc811-3a6d-455f-9eda-152573bdc6d9">
+    <Deployment runDeploymentRoot="_8c898f464f50_2026-11-10_18_06_02" />
+  </TestSettings>
+  <Results>
+    <UnitTestResult executionId="5dae5583-2c39-479e-9715-2339d7f6593d" testId="02aca891-6c73-5df6-4396-20f20d6490ce" testName="ZB.MOM.WW.OtOpcUa.OpcUaServer.IntegrationTests.Sdk2LifecycleSoakTests.Descriptor_probe_times_out_and_reaps_a_process_that_keeps_both_streams_open" computerName="8c898f464f50" duration="00:00:00.2676070" startTime="2026-11-10T18:06:01.6988716+00:00" endTime="2026-11-10T18:06:01.9669755+00:00" testType="13cdc9d9-ddb5-4fa4-a97d-d965ccfc6d4b" outcome="Passed" testListId="8c84fa94-04c1-424b-9868-57a2d4851a1d" relativeResultsDirectory="5dae5583-2c39-479e-9715-2339d7f6593d">
+      <Output>
+        <StdOut>Descriptor timeout control: deadlineMs=250, elapsedMs=267, childExited=True</StdOut>
+      </Output>
+    </UnitTestResult>
+    <UnitTestResult executionId="b05a5663-eb92-4c4c-993a-7236c459b1ce" testId="1d78597f-0424-4abc-5484-1d1084deba0d" testName="ZB.MOM.WW.OtOpcUa.OpcUaServer.IntegrationTests.Sdk2LifecycleSoakTests.Descriptor_probe_observes_an_open_PKI_file_through_a_symlink_alias_and_its_close" computerName="8c898f464f50" duration="00:00:00.0235426" startTime="2026-11-10T18:06:01.6695099+00:00" endTime="2026-11-10T18:06:01.6964907+00:00" testType="13cdc9d9-ddb5-4fa4-a97d-d965ccfc6d4b" outcome="Passed" testListId="8c84fa94-04c1-424b-9868-57a2d4851a1d" relativeResultsDirectory="b05a5663-eb92-4c4c-993a-7236c459b1ce">
+      <Output>
+        <StdOut>PKI descriptor control: before=0, opened=1, closed=0; siblingExcluded=true; aliasResolved=true</StdOut>
+      </Output>
+    </UnitTestResult>
+  </Results>
+  <TestDefinitions>
+    <UnitTest name="ZB.MOM.WW.OtOpcUa.OpcUaServer.IntegrationTests.Sdk2LifecycleSoakTests.Descriptor_probe_observes_an_open_PKI_file_through_a_symlink_alias_and_its_close" storage="/app/zb.mom.ww.otopcua.opcuaserver.integrationtests.dll" id="1d78597f-0424-4abc-5484-1d1084deba0d">
+      <Execution id="b05a5663-eb92-4c4c-993a-7236c459b1ce" />
+      <TestMethod codeBase="/app/ZB.MOM.WW.OtOpcUa.OpcUaServer.IntegrationTests.dll" adapterTypeName="executor://xunit/VsTestRunner3/netcore/" className="ZB.MOM.WW.OtOpcUa.OpcUaServer.IntegrationTests.Sdk2LifecycleSoakTests" name="Descriptor_probe_observes_an_open_PKI_file_through_a_symlink_alias_and_its_close" />
+    </UnitTest>
+    <UnitTest name="ZB.MOM.WW.OtOpcUa.OpcUaServer.IntegrationTests.Sdk2LifecycleSoakTests.Descriptor_probe_times_out_and_reaps_a_process_that_keeps_both_streams_open" storage="/app/zb.mom.ww.otopcua.opcuaserver.integrationtests.dll" id="02aca891-6c73-5df6-4396-20f20d6490ce">
+      <Execution id="5dae5583-2c39-479e-9715-2339d7f6593d" />
+      <TestMethod codeBase="/app/ZB.MOM.WW.OtOpcUa.OpcUaServer.IntegrationTests.dll" adapterTypeName="executor://xunit/VsTestRunner3/netcore/" className="ZB.MOM.WW.OtOpcUa.OpcUaServer.IntegrationTests.Sdk2LifecycleSoakTests" name="Descriptor_probe_times_out_and_reaps_a_process_that_keeps_both_streams_open" />
+    </UnitTest>
+  </TestDefinitions>
+  <TestEntries>
+    <TestEntry testId="02aca891-6c73-5df6-4396-20f20d6490ce" executionId="5dae5583-2c39-479e-9715-2339d7f6593d" testListId="8c84fa94-04c1-424b-9868-57a2d4851a1d" />
+    <TestEntry testId="1d78597f-0424-4abc-5484-1d1084deba0d" executionId="b05a5663-eb92-4c4c-993a-7236c459b1ce" testListId="8c84fa94-04c1-424b-9868-57a2d4851a1d" />
+  </TestEntries>
+  <TestLists>
+    <TestList name="Results Not in a List" id="8c84fa94-04c1-424b-9868-57a2d4851a1d" />
+    <TestList name="All Loaded Results" id="19431567-8539-422a-85d7-44ee4e166bda" />
+  </TestLists>
+  <ResultSummary outcome="Completed">
+    <Counters total="2" executed="2" passed="2" failed="0" error="0" timeout="0" aborted="0" inconclusive="0" passedButRunAborted="0" notRunnable="0" notExecuted="0" disconnected="0" warning="0" completed="0" inProgress="0" pending="0" />
+    <Output>
+      <StdOut>[xUnit.net 00:00:00.00] xUnit.net VSTest Adapter v3.0.2+dd36e86129 (64-bit .NET 10.0.14)
+[xUnit.net 00:00:00.08]   Discovering: ZB.MOM.WW.OtOpcUa.OpcUaServer.IntegrationTests
+[xUnit.net 00:00:00.22]   Discovered:  ZB.MOM.WW.OtOpcUa.OpcUaServer.IntegrationTests
+[xUnit.net 00:00:00.30]   Starting:    ZB.MOM.WW.OtOpcUa.OpcUaServer.IntegrationTests
+[xUnit.net 00:00:00.64]   Finished:    ZB.MOM.WW.OtOpcUa.OpcUaServer.IntegrationTests
+</StdOut>
+    </Output>
+  </ResultSummary>
+</TestRun>

scripts/validation/opcua-server-lifecycle-linux/evidence/2026-11-10-diagnostic/full-duration-guard.log

@@ -0,0 +1,3 @@
+usage: run.py [-h] --output OUTPUT [--duration DURATION] [--full]
+              [--published-app PUBLISHED_APP] [--image IMAGE]
+run.py: error: full requires duration >=7200; diagnostic requires 60..120 seconds

scripts/validation/opcua-server-lifecycle-linux/evidence/2026-11-10-diagnostic/linux-precheck.txt

@@ -0,0 +1 @@
+kernel=Linux machine=aarch64 tmp=/task/tmp procfs=yes

scripts/validation/opcua-server-lifecycle-linux/evidence/2026-11-10-diagnostic/linux-runtime-process.txt

@@ -0,0 +1,6 @@
+testProcessId=196
+actualExecutable=/app/ZB.MOM.WW.OtOpcUa.OpcUaServer.IntegrationTests
+/app/System.Private.CoreLib.dll
+/app/libcoreclr.so
+/app/libhostfxr.so
+/app/libhostpolicy.so

scripts/validation/opcua-server-lifecycle-linux/evidence/2026-11-10-diagnostic/publish-receipt.json

@@ -0,0 +1,29 @@
+{
+  "sourceRevision": "74c938f37cbb9cf08b6ca72e4effc511120dc274",
+  "command": [
+    "dotnet",
+    "publish",
+    "/Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/tests/Server/ZB.MOM.WW.OtOpcUa.OpcUaServer.IntegrationTests/ZB.MOM.WW.OtOpcUa.OpcUaServer.IntegrationTests.csproj",
+    "-c",
+    "Release",
+    "-r",
+    "linux-arm64",
+    "--self-contained",
+    "true",
+    "-p:RuntimeFrameworkVersion=10.0.14",
+    "-p:PublishSingleFile=false",
+    "-p:PublishTrimmed=false",
+    "-p:UseAppHost=true",
+    "--artifacts-path",
+    "/tmp/opcua2-server-linux-diagnostic-20261110a/build-artifacts",
+    "-o",
+    "/tmp/opcua2-server-linux-diagnostic-20261110a/app",
+    "-m:1",
+    "--nologo"
+  ],
+  "hostDotnet": ".NET SDK:\n Version:           10.0.403\n Commit:            5a2162bea6\n Workload version:  10.0.400-manifests.a00bebb6\n MSBuild version:   18.9.15+5a2162bea\n\nRuntime Environment:\n OS Name:     Mac OS X\n OS Version:  26.5\n OS Platform: Darwin\n RID:         osx-arm64\n Base Path:   /opt/homebrew/Cellar/dotnet/10.0.403/libexec/sdk/10.0.403/\n\n.NET workloads installed:\nThere are no installed workloads to display.\nConfigured to use workload sets when installing new manifests.\nNo workload sets are installed. Run \"dotnet workload restore\" to install a workload set.\n\nHost:\n  Version:      10.0.14\n  Architecture: arm64\n  Commit:       0427b9abbe\n\n.NET SDKs installed:\n  10.0.403 [/opt/homebrew/Cellar/dotnet/10.0.403/libexec/sdk]\n\n.NET runtimes installed:\n  Microsoft.AspNetCore.App 10.0.14 [/opt/homebrew/Cellar/dotnet/10.0.403/libexec/shared/Microsoft.AspNetCore.App]\n  Microsoft.NETCore.App 10.0.14 [/opt/homebrew/Cellar/dotnet/10.0.403/libexec/shared/Microsoft.NETCore.App]\n\nOther architectures found:\n  None\n\nEnvironment variables:\n  DOTNET_ROOT                              [/opt/homebrew/Cellar/dotnet/10.0.403/libexec]\n\nglobal.json file:\n  /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/global.json\n\nLearn more:\n  https://aka.ms/dotnet/info\n\nDownload .NET:\n  https://aka.ms/dotnet/download\n",
+  "testSourceSha256": "e695783e05787d94bf5d167b25b1c48b446b800c28259f023c28ed6012d737d1",
+  "apphostSha256": "97531b8005df9dc8b129d2b22ba2049cf572d5d970046f7e8644ec632e860032",
+  "testAssemblySha256": "9d64b5b3dd9bf7eff38f6fabe10382c107ab824485a309ba9649bfee9bbd843a",
+  "publishExitCode": 0
+}

scripts/validation/opcua-server-lifecycle-linux/evidence/2026-11-10-diagnostic/publish.log

@@ -0,0 +1,121 @@
+
+  Determining projects to restore...
+  Restored /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Core/ZB.MOM.WW.OtOpcUa.Core.Abstractions/ZB.MOM.WW.OtOpcUa.Core.Abstractions.csproj (in 490 ms).
+  Restored /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.TwinCAT.Contracts/ZB.MOM.WW.OtOpcUa.Driver.TwinCAT.Contracts.csproj (in 494 ms).
+  Restored /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.MTConnect.Contracts/ZB.MOM.WW.OtOpcUa.Driver.MTConnect.Contracts.csproj (in 494 ms).
+  Restored /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Modbus.Contracts/ZB.MOM.WW.OtOpcUa.Driver.Modbus.Contracts.csproj (in 2 ms).
+  Restored /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Modbus.Addressing/ZB.MOM.WW.OtOpcUa.Driver.Modbus.Addressing.csproj (in 4 ms).
+  Restored /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.Session/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.Session.csproj (in 569 ms).
+  Restored /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Tooling/ZB.MOM.WW.OtOpcUa.Analyzers/ZB.MOM.WW.OtOpcUa.Analyzers.csproj (in 574 ms).
+  Restored /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Calculation.Contracts/ZB.MOM.WW.OtOpcUa.Driver.Calculation.Contracts.csproj (in 1 ms).
+  Restored /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Core/ZB.MOM.WW.OtOpcUa.Core.Scripting.OutOfProcess/ZB.MOM.WW.OtOpcUa.Core.Scripting.OutOfProcess.csproj (in 591 ms).
+  Restored /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Server/ZB.MOM.WW.OtOpcUa.ScriptWorker/ZB.MOM.WW.OtOpcUa.ScriptWorker.csproj (in 589 ms).
+  Restored /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Ab.Transport/ZB.MOM.WW.OtOpcUa.Driver.Ab.Transport.csproj (in 6 ms).
+  Restored /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.AbCip.Contracts/ZB.MOM.WW.OtOpcUa.Driver.AbCip.Contracts.csproj (in 6 ms).
+  Restored /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Server/ZB.MOM.WW.OtOpcUa.Security/ZB.MOM.WW.OtOpcUa.Security.csproj (in 605 ms).
+  Restored /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.Contracts/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.Contracts.csproj (in 2 ms).
+  Restored /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.AbLegacy/ZB.MOM.WW.OtOpcUa.Driver.AbLegacy.csproj (in 36 ms).
+  Restored /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Calculation/ZB.MOM.WW.OtOpcUa.Driver.Calculation.csproj (in 101 ms).
+  Restored /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Galaxy/ZB.MOM.WW.OtOpcUa.Driver.Galaxy.csproj (in 107 ms).
+  Restored /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.AbCip/ZB.MOM.WW.OtOpcUa.Driver.AbCip.csproj (in 31 ms).
+  Restored /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Server/ZB.MOM.WW.OtOpcUa.OpcUaServer/ZB.MOM.WW.OtOpcUa.OpcUaServer.csproj (in 613 ms).
+  Restored /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Contracts/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Contracts.csproj (in 9 ms).
+  Restored /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Transport/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Transport.csproj (in 10 ms).
+  Restored /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Core/ZB.MOM.WW.OtOpcUa.Core.Scripting.Protocol/ZB.MOM.WW.OtOpcUa.Core.Scripting.Protocol.csproj (in 6 ms).
+  Restored /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Browser/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Browser.csproj (in 19 ms).
+  Restored /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Core/ZB.MOM.WW.OtOpcUa.Core/ZB.MOM.WW.OtOpcUa.Core.csproj (in 30 ms).
+  Restored /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.Browser/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.Browser.csproj (in 27 ms).
+  Restored /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Core/ZB.MOM.WW.OtOpcUa.Core.Scripting.Abstractions/ZB.MOM.WW.OtOpcUa.Core.Scripting.Abstractions.csproj (in 2 ms).
+  Restored /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Server/ZB.MOM.WW.OtOpcUa.Runtime/ZB.MOM.WW.OtOpcUa.Runtime.csproj (in 651 ms).
+  Restored /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Core/ZB.MOM.WW.OtOpcUa.Core.VirtualTags/ZB.MOM.WW.OtOpcUa.Core.VirtualTags.csproj (in 12 ms).
+  Restored /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Core/ZB.MOM.WW.OtOpcUa.Core.Scripting/ZB.MOM.WW.OtOpcUa.Core.Scripting.csproj (in 12 ms).
+  Restored /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Core/ZB.MOM.WW.OtOpcUa.Commons/ZB.MOM.WW.OtOpcUa.Commons.csproj (in 4 ms).
+  Restored /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.MTConnect/ZB.MOM.WW.OtOpcUa.Driver.MTConnect.csproj (in 33 ms).
+  Restored /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Historian.QuestDb/ZB.MOM.WW.OtOpcUa.Driver.Historian.QuestDb.csproj (in 656 ms).
+  Restored /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Historian.Gateway/ZB.MOM.WW.OtOpcUa.Driver.Historian.Gateway.csproj (in 655 ms).
+  Restored /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Historian.SqlServer/ZB.MOM.WW.OtOpcUa.Driver.Historian.SqlServer.csproj (in 144 ms).
+  Restored /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Mqtt/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.csproj (in 36 ms).
+  Restored /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Core/ZB.MOM.WW.OtOpcUa.Core.ScriptedAlarms/ZB.MOM.WW.OtOpcUa.Core.ScriptedAlarms.csproj (in 11 ms).
+  Restored /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Sql.Contracts/ZB.MOM.WW.OtOpcUa.Driver.Sql.Contracts.csproj (in 6 ms).
+  Restored /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Client/ZB.MOM.WW.OtOpcUa.Client.Shared/ZB.MOM.WW.OtOpcUa.Client.Shared.csproj (in 11 ms).
+  Restored /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.AbLegacy.Contracts/ZB.MOM.WW.OtOpcUa.Driver.AbLegacy.Contracts.csproj (in 2 ms).
+  Restored /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.S7.Contracts/ZB.MOM.WW.OtOpcUa.Driver.S7.Contracts.csproj (in 2 ms).
+  Restored /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Core/ZB.MOM.WW.OtOpcUa.Core.AlarmHistorian/ZB.MOM.WW.OtOpcUa.Core.AlarmHistorian.csproj (in 44 ms).
+  Restored /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Core/ZB.MOM.WW.OtOpcUa.Cluster/ZB.MOM.WW.OtOpcUa.Cluster.csproj (in 45 ms).
+  Restored /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Contracts/ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Contracts.csproj (in 6 ms).
+  Restored /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Sql.Browser/ZB.MOM.WW.OtOpcUa.Driver.Sql.Browser.csproj (in 36 ms).
+  Restored /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Historian.Sql.Common/ZB.MOM.WW.OtOpcUa.Driver.Historian.Sql.Common.csproj (in 10 ms).
+  Restored /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Sql/ZB.MOM.WW.OtOpcUa.Driver.Sql.csproj (in 50 ms).
+  Restored /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Sql.Dialect/ZB.MOM.WW.OtOpcUa.Driver.Sql.Dialect.csproj (in 66 ms).
+  Restored /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Server/ZB.MOM.WW.OtOpcUa.ControlPlane/ZB.MOM.WW.OtOpcUa.ControlPlane.csproj (in 53 ms).
+  Restored /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.FOCAS.Contracts/ZB.MOM.WW.OtOpcUa.Driver.FOCAS.Contracts.csproj (in 3 ms).
+  Restored /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Modbus/ZB.MOM.WW.OtOpcUa.Driver.Modbus.csproj (in 41 ms).
+  Restored /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Browser/ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Browser.csproj (in 9 ms).
+  Restored /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.S7/ZB.MOM.WW.OtOpcUa.Driver.S7.csproj (in 49 ms).
+  Restored /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Core/ZB.MOM.WW.OtOpcUa.Configuration/ZB.MOM.WW.OtOpcUa.Configuration.csproj (in 92 ms).
+  Restored /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.csproj (in 51 ms).
+  Restored /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.TwinCAT/ZB.MOM.WW.OtOpcUa.Driver.TwinCAT.csproj (in 86 ms).
+  Restored /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.FOCAS/ZB.MOM.WW.OtOpcUa.Driver.FOCAS.csproj (in 24 ms).
+  Restored /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Server/ZB.MOM.WW.OtOpcUa.AdminUI/ZB.MOM.WW.OtOpcUa.AdminUI.csproj (in 89 ms).
+  Restored /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/src/Server/ZB.MOM.WW.OtOpcUa.Host/ZB.MOM.WW.OtOpcUa.Host.csproj (in 784 ms).
+  Restored /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/tests/Server/ZB.MOM.WW.OtOpcUa.OpcUaServer.IntegrationTests/ZB.MOM.WW.OtOpcUa.OpcUaServer.IntegrationTests.csproj (in 793 ms).
+  ZB.MOM.WW.OtOpcUa.Analyzers -> /tmp/opcua2-server-linux-diagnostic-20261110a/build-artifacts/bin/ZB.MOM.WW.OtOpcUa.Analyzers/release/ZB.MOM.WW.OtOpcUa.Analyzers.dll
+  ZB.MOM.WW.OtOpcUa.Core.Abstractions -> /tmp/opcua2-server-linux-diagnostic-20261110a/build-artifacts/bin/ZB.MOM.WW.OtOpcUa.Core.Abstractions/release/ZB.MOM.WW.OtOpcUa.Core.Abstractions.dll
+  ZB.MOM.WW.OtOpcUa.Commons -> /tmp/opcua2-server-linux-diagnostic-20261110a/build-artifacts/bin/ZB.MOM.WW.OtOpcUa.Commons/release/ZB.MOM.WW.OtOpcUa.Commons.dll
+  ZB.MOM.WW.OtOpcUa.Core.Scripting.Abstractions -> /tmp/opcua2-server-linux-diagnostic-20261110a/build-artifacts/bin/ZB.MOM.WW.OtOpcUa.Core.Scripting.Abstractions/release/ZB.MOM.WW.OtOpcUa.Core.Scripting.Abstractions.dll
+  ZB.MOM.WW.OtOpcUa.Core.Scripting -> /tmp/opcua2-server-linux-diagnostic-20261110a/build-artifacts/bin/ZB.MOM.WW.OtOpcUa.Core.Scripting/release/ZB.MOM.WW.OtOpcUa.Core.Scripting.dll
+  ZB.MOM.WW.OtOpcUa.Core.VirtualTags -> /tmp/opcua2-server-linux-diagnostic-20261110a/build-artifacts/bin/ZB.MOM.WW.OtOpcUa.Core.VirtualTags/release/ZB.MOM.WW.OtOpcUa.Core.VirtualTags.dll
+  ZB.MOM.WW.OtOpcUa.Driver.Sql.Contracts -> /tmp/opcua2-server-linux-diagnostic-20261110a/build-artifacts/bin/ZB.MOM.WW.OtOpcUa.Driver.Sql.Contracts/release/ZB.MOM.WW.OtOpcUa.Driver.Sql.Contracts.dll
+  ZB.MOM.WW.OtOpcUa.Configuration -> /tmp/opcua2-server-linux-diagnostic-20261110a/build-artifacts/bin/ZB.MOM.WW.OtOpcUa.Configuration/release/ZB.MOM.WW.OtOpcUa.Configuration.dll
+  ZB.MOM.WW.OtOpcUa.Core -> /tmp/opcua2-server-linux-diagnostic-20261110a/build-artifacts/bin/ZB.MOM.WW.OtOpcUa.Core/release/ZB.MOM.WW.OtOpcUa.Core.dll
+  ZB.MOM.WW.OtOpcUa.OpcUaServer -> /tmp/opcua2-server-linux-diagnostic-20261110a/build-artifacts/bin/ZB.MOM.WW.OtOpcUa.OpcUaServer/release/ZB.MOM.WW.OtOpcUa.OpcUaServer.dll
+  ZB.MOM.WW.OtOpcUa.Cluster -> /tmp/opcua2-server-linux-diagnostic-20261110a/build-artifacts/bin/ZB.MOM.WW.OtOpcUa.Cluster/release/ZB.MOM.WW.OtOpcUa.Cluster.dll
+  ZB.MOM.WW.OtOpcUa.Core.Scripting.Protocol -> /tmp/opcua2-server-linux-diagnostic-20261110a/build-artifacts/bin/ZB.MOM.WW.OtOpcUa.Core.Scripting.Protocol/release/ZB.MOM.WW.OtOpcUa.Core.Scripting.Protocol.dll
+  ZB.MOM.WW.OtOpcUa.Core.Scripting.OutOfProcess -> /tmp/opcua2-server-linux-diagnostic-20261110a/build-artifacts/bin/ZB.MOM.WW.OtOpcUa.Core.Scripting.OutOfProcess/release/ZB.MOM.WW.OtOpcUa.Core.Scripting.OutOfProcess.dll
+  ZB.MOM.WW.OtOpcUa.Core.ScriptedAlarms -> /tmp/opcua2-server-linux-diagnostic-20261110a/build-artifacts/bin/ZB.MOM.WW.OtOpcUa.Core.ScriptedAlarms/release/ZB.MOM.WW.OtOpcUa.Core.ScriptedAlarms.dll
+  ZB.MOM.WW.OtOpcUa.Security -> /tmp/opcua2-server-linux-diagnostic-20261110a/build-artifacts/bin/ZB.MOM.WW.OtOpcUa.Security/release/ZB.MOM.WW.OtOpcUa.Security.dll
+  ZB.MOM.WW.OtOpcUa.Driver.Modbus.Addressing -> /tmp/opcua2-server-linux-diagnostic-20261110a/build-artifacts/bin/ZB.MOM.WW.OtOpcUa.Driver.Modbus.Addressing/release/ZB.MOM.WW.OtOpcUa.Driver.Modbus.Addressing.dll
+  ZB.MOM.WW.OtOpcUa.Driver.Modbus.Contracts -> /tmp/opcua2-server-linux-diagnostic-20261110a/build-artifacts/bin/ZB.MOM.WW.OtOpcUa.Driver.Modbus.Contracts/release/ZB.MOM.WW.OtOpcUa.Driver.Modbus.Contracts.dll
+  ZB.MOM.WW.OtOpcUa.Driver.S7.Contracts -> /tmp/opcua2-server-linux-diagnostic-20261110a/build-artifacts/bin/ZB.MOM.WW.OtOpcUa.Driver.S7.Contracts/release/ZB.MOM.WW.OtOpcUa.Driver.S7.Contracts.dll
+  ZB.MOM.WW.OtOpcUa.Driver.AbCip.Contracts -> /tmp/opcua2-server-linux-diagnostic-20261110a/build-artifacts/bin/ZB.MOM.WW.OtOpcUa.Driver.AbCip.Contracts/release/ZB.MOM.WW.OtOpcUa.Driver.AbCip.Contracts.dll
+  ZB.MOM.WW.OtOpcUa.Driver.AbLegacy.Contracts -> /tmp/opcua2-server-linux-diagnostic-20261110a/build-artifacts/bin/ZB.MOM.WW.OtOpcUa.Driver.AbLegacy.Contracts/release/ZB.MOM.WW.OtOpcUa.Driver.AbLegacy.Contracts.dll
+  ZB.MOM.WW.OtOpcUa.Driver.TwinCAT.Contracts -> /tmp/opcua2-server-linux-diagnostic-20261110a/build-artifacts/bin/ZB.MOM.WW.OtOpcUa.Driver.TwinCAT.Contracts/release/ZB.MOM.WW.OtOpcUa.Driver.TwinCAT.Contracts.dll
+  ZB.MOM.WW.OtOpcUa.Driver.FOCAS.Contracts -> /tmp/opcua2-server-linux-diagnostic-20261110a/build-artifacts/bin/ZB.MOM.WW.OtOpcUa.Driver.FOCAS.Contracts/release/ZB.MOM.WW.OtOpcUa.Driver.FOCAS.Contracts.dll
+  ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Contracts -> /tmp/opcua2-server-linux-diagnostic-20261110a/build-artifacts/bin/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Contracts/release/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Contracts.dll
+  ZB.MOM.WW.OtOpcUa.Driver.MTConnect.Contracts -> /tmp/opcua2-server-linux-diagnostic-20261110a/build-artifacts/bin/ZB.MOM.WW.OtOpcUa.Driver.MTConnect.Contracts/release/ZB.MOM.WW.OtOpcUa.Driver.MTConnect.Contracts.dll
+  ZB.MOM.WW.OtOpcUa.Driver.Calculation.Contracts -> /tmp/opcua2-server-linux-diagnostic-20261110a/build-artifacts/bin/ZB.MOM.WW.OtOpcUa.Driver.Calculation.Contracts/release/ZB.MOM.WW.OtOpcUa.Driver.Calculation.Contracts.dll
+  ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.Contracts -> /tmp/opcua2-server-linux-diagnostic-20261110a/build-artifacts/bin/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.Contracts/release/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.Contracts.dll
+  ZB.MOM.WW.OtOpcUa.ControlPlane -> /tmp/opcua2-server-linux-diagnostic-20261110a/build-artifacts/bin/ZB.MOM.WW.OtOpcUa.ControlPlane/release/ZB.MOM.WW.OtOpcUa.ControlPlane.dll
+  ZB.MOM.WW.OtOpcUa.Core.AlarmHistorian -> /tmp/opcua2-server-linux-diagnostic-20261110a/build-artifacts/bin/ZB.MOM.WW.OtOpcUa.Core.AlarmHistorian/release/ZB.MOM.WW.OtOpcUa.Core.AlarmHistorian.dll
+  ZB.MOM.WW.OtOpcUa.Runtime -> /tmp/opcua2-server-linux-diagnostic-20261110a/build-artifacts/bin/ZB.MOM.WW.OtOpcUa.Runtime/release/ZB.MOM.WW.OtOpcUa.Runtime.dll
+  ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Contracts -> /tmp/opcua2-server-linux-diagnostic-20261110a/build-artifacts/bin/ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Contracts/release/ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Contracts.dll
+  ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.Session -> /tmp/opcua2-server-linux-diagnostic-20261110a/build-artifacts/bin/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.Session/release/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.Session.dll
+  ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.Browser -> /tmp/opcua2-server-linux-diagnostic-20261110a/build-artifacts/bin/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.Browser/release/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.Browser.dll
+  ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Browser -> /tmp/opcua2-server-linux-diagnostic-20261110a/build-artifacts/bin/ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Browser/release/ZB.MOM.WW.OtOpcUa.Driver.Galaxy.Browser.dll
+  ZB.MOM.WW.OtOpcUa.Driver.Sql.Dialect -> /tmp/opcua2-server-linux-diagnostic-20261110a/build-artifacts/bin/ZB.MOM.WW.OtOpcUa.Driver.Sql.Dialect/release/ZB.MOM.WW.OtOpcUa.Driver.Sql.Dialect.dll
+  ZB.MOM.WW.OtOpcUa.Driver.Sql.Browser -> /tmp/opcua2-server-linux-diagnostic-20261110a/build-artifacts/bin/ZB.MOM.WW.OtOpcUa.Driver.Sql.Browser/release/ZB.MOM.WW.OtOpcUa.Driver.Sql.Browser.dll
+  ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Transport -> /tmp/opcua2-server-linux-diagnostic-20261110a/build-artifacts/bin/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Transport/release/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Transport.dll
+  ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Browser -> /tmp/opcua2-server-linux-diagnostic-20261110a/build-artifacts/bin/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Browser/release/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.Browser.dll
+  ZB.MOM.WW.OtOpcUa.AdminUI -> /tmp/opcua2-server-linux-diagnostic-20261110a/build-artifacts/bin/ZB.MOM.WW.OtOpcUa.AdminUI/release/ZB.MOM.WW.OtOpcUa.AdminUI.dll
+  ZB.MOM.WW.OtOpcUa.Driver.Ab.Transport -> /tmp/opcua2-server-linux-diagnostic-20261110a/build-artifacts/bin/ZB.MOM.WW.OtOpcUa.Driver.Ab.Transport/release/ZB.MOM.WW.OtOpcUa.Driver.Ab.Transport.dll
+  ZB.MOM.WW.OtOpcUa.Driver.AbCip -> /tmp/opcua2-server-linux-diagnostic-20261110a/build-artifacts/bin/ZB.MOM.WW.OtOpcUa.Driver.AbCip/release/ZB.MOM.WW.OtOpcUa.Driver.AbCip.dll
+  ZB.MOM.WW.OtOpcUa.Driver.AbLegacy -> /tmp/opcua2-server-linux-diagnostic-20261110a/build-artifacts/bin/ZB.MOM.WW.OtOpcUa.Driver.AbLegacy/release/ZB.MOM.WW.OtOpcUa.Driver.AbLegacy.dll
+  ZB.MOM.WW.OtOpcUa.Driver.Calculation -> /tmp/opcua2-server-linux-diagnostic-20261110a/build-artifacts/bin/ZB.MOM.WW.OtOpcUa.Driver.Calculation/release/ZB.MOM.WW.OtOpcUa.Driver.Calculation.dll
+  ZB.MOM.WW.OtOpcUa.Driver.FOCAS -> /tmp/opcua2-server-linux-diagnostic-20261110a/build-artifacts/bin/ZB.MOM.WW.OtOpcUa.Driver.FOCAS/release/ZB.MOM.WW.OtOpcUa.Driver.FOCAS.dll
+  ZB.MOM.WW.OtOpcUa.Driver.Galaxy -> /tmp/opcua2-server-linux-diagnostic-20261110a/build-artifacts/bin/ZB.MOM.WW.OtOpcUa.Driver.Galaxy/release/ZB.MOM.WW.OtOpcUa.Driver.Galaxy.dll
+  ZB.MOM.WW.OtOpcUa.Driver.Historian.Sql.Common -> /tmp/opcua2-server-linux-diagnostic-20261110a/build-artifacts/bin/ZB.MOM.WW.OtOpcUa.Driver.Historian.Sql.Common/release/ZB.MOM.WW.OtOpcUa.Driver.Historian.Sql.Common.dll
+  ZB.MOM.WW.OtOpcUa.Driver.Historian.Gateway -> /tmp/opcua2-server-linux-diagnostic-20261110a/build-artifacts/bin/ZB.MOM.WW.OtOpcUa.Driver.Historian.Gateway/release/ZB.MOM.WW.OtOpcUa.Driver.Historian.Gateway.dll
+  ZB.MOM.WW.OtOpcUa.Driver.Historian.SqlServer -> /tmp/opcua2-server-linux-diagnostic-20261110a/build-artifacts/bin/ZB.MOM.WW.OtOpcUa.Driver.Historian.SqlServer/release/ZB.MOM.WW.OtOpcUa.Driver.Historian.SqlServer.dll
+  ZB.MOM.WW.OtOpcUa.Driver.Historian.QuestDb -> /tmp/opcua2-server-linux-diagnostic-20261110a/build-artifacts/bin/ZB.MOM.WW.OtOpcUa.Driver.Historian.QuestDb/release/ZB.MOM.WW.OtOpcUa.Driver.Historian.QuestDb.dll
+  ZB.MOM.WW.OtOpcUa.Driver.Modbus -> /tmp/opcua2-server-linux-diagnostic-20261110a/build-artifacts/bin/ZB.MOM.WW.OtOpcUa.Driver.Modbus/release/ZB.MOM.WW.OtOpcUa.Driver.Modbus.dll
+  ZB.MOM.WW.OtOpcUa.Driver.Mqtt -> /tmp/opcua2-server-linux-diagnostic-20261110a/build-artifacts/bin/ZB.MOM.WW.OtOpcUa.Driver.Mqtt/release/ZB.MOM.WW.OtOpcUa.Driver.Mqtt.dll
+  ZB.MOM.WW.OtOpcUa.Driver.MTConnect -> /tmp/opcua2-server-linux-diagnostic-20261110a/build-artifacts/bin/ZB.MOM.WW.OtOpcUa.Driver.MTConnect/release/ZB.MOM.WW.OtOpcUa.Driver.MTConnect.dll
+  ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient -> /tmp/opcua2-server-linux-diagnostic-20261110a/build-artifacts/bin/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient/release/ZB.MOM.WW.OtOpcUa.Driver.OpcUaClient.dll
+  ZB.MOM.WW.OtOpcUa.Driver.S7 -> /tmp/opcua2-server-linux-diagnostic-20261110a/build-artifacts/bin/ZB.MOM.WW.OtOpcUa.Driver.S7/release/ZB.MOM.WW.OtOpcUa.Driver.S7.dll
+  ZB.MOM.WW.OtOpcUa.Driver.Sql -> /tmp/opcua2-server-linux-diagnostic-20261110a/build-artifacts/bin/ZB.MOM.WW.OtOpcUa.Driver.Sql/release/ZB.MOM.WW.OtOpcUa.Driver.Sql.dll
+  ZB.MOM.WW.OtOpcUa.Driver.TwinCAT -> /tmp/opcua2-server-linux-diagnostic-20261110a/build-artifacts/bin/ZB.MOM.WW.OtOpcUa.Driver.TwinCAT/release/ZB.MOM.WW.OtOpcUa.Driver.TwinCAT.dll
+  ZB.MOM.WW.OtOpcUa.ScriptWorker -> /tmp/opcua2-server-linux-diagnostic-20261110a/build-artifacts/bin/ZB.MOM.WW.OtOpcUa.ScriptWorker/release_linux-arm64/ZB.MOM.WW.OtOpcUa.ScriptWorker.dll
+  ZB.MOM.WW.OtOpcUa.Host -> /tmp/opcua2-server-linux-diagnostic-20261110a/build-artifacts/bin/ZB.MOM.WW.OtOpcUa.Host/release_linux-arm64/OtOpcUa.Host.dll
+  ZB.MOM.WW.OtOpcUa.Client.Shared -> /tmp/opcua2-server-linux-diagnostic-20261110a/build-artifacts/bin/ZB.MOM.WW.OtOpcUa.Client.Shared/release/ZB.MOM.WW.OtOpcUa.Client.Shared.dll
+  ZB.MOM.WW.OtOpcUa.OpcUaServer.IntegrationTests -> /tmp/opcua2-server-linux-diagnostic-20261110a/build-artifacts/bin/ZB.MOM.WW.OtOpcUa.OpcUaServer.IntegrationTests/release_linux-arm64/ZB.MOM.WW.OtOpcUa.OpcUaServer.IntegrationTests.dll
+  ZB.MOM.WW.OtOpcUa.OpcUaServer.IntegrationTests -> /tmp/opcua2-server-linux-diagnostic-20261110a/app/

scripts/validation/opcua-server-lifecycle-linux/evidence/2026-11-10-diagnostic/result.json

@@ -0,0 +1,160 @@
+{
+  "status": "passed",
+  "containerExitCode": 0,
+  "containerElapsedSeconds": 95.26570125005674,
+  "descriptorControls": {
+    "counts": {
+      "total": "2",
+      "executed": "2",
+      "passed": "2",
+      "failed": "0",
+      "error": "0",
+      "timeout": "0",
+      "aborted": "0",
+      "inconclusive": "0",
+      "passedButRunAborted": "0",
+      "notRunnable": "0",
+      "notExecuted": "0",
+      "disconnected": "0",
+      "warning": "0",
+      "completed": "0",
+      "inProgress": "0",
+      "pending": "0"
+    },
+    "tests": [
+      "ZB.MOM.WW.OtOpcUa.OpcUaServer.IntegrationTests.Sdk2LifecycleSoakTests.Descriptor_probe_times_out_and_reaps_a_process_that_keeps_both_streams_open",
+      "ZB.MOM.WW.OtOpcUa.OpcUaServer.IntegrationTests.Sdk2LifecycleSoakTests.Descriptor_probe_observes_an_open_PKI_file_through_a_symlink_alias_and_its_close"
+    ]
+  },
+  "soakTest": {
+    "counts": {
+      "total": "1",
+      "executed": "1",
+      "passed": "1",
+      "failed": "0",
+      "error": "0",
+      "timeout": "0",
+      "aborted": "0",
+      "inconclusive": "0",
+      "passedButRunAborted": "0",
+      "notRunnable": "0",
+      "notExecuted": "0",
+      "disconnected": "0",
+      "warning": "0",
+      "completed": "0",
+      "inProgress": "0",
+      "pending": "0"
+    },
+    "tests": [
+      "ZB.MOM.WW.OtOpcUa.OpcUaServer.IntegrationTests.Sdk2LifecycleSoakTests.Repeated_lifecycles_return_resources_to_a_steady_baseline"
+    ]
+  },
+  "evidence": {
+    "start": {
+      "kind": "start",
+      "utc": "2026-11-10T18:06:04.0984012+00:00",
+      "processId": 196,
+      "mode": "diagnostic",
+      "requestedSeconds": 90,
+      "minimumFullSeconds": 7200,
+      "build": "74c938f37cbb9cf08b6ca72e4effc511120dc274",
+      "sdk": "2.0.1+07e62f72500cc0923a2bab940653c8c1116fa286",
+      "diagnosticInstrumentation": "SDK2.0.1 CP lists and certificate-validation cached stores; read-only",
+      "limits": {
+        "retainedManagedGrowthBytes": 67108864,
+        "rssGrowthBytes": 134217728,
+        "fdGrowth": 32
+      },
+      "coverage": "encrypted sessions; scalar/Int16[] Raw+UNS; subscription removal; browse abandonment; history release/cross-session/close; surgical changes/rebuild; revocation; paused TCP read/recovery; same-PKI restart"
+    },
+    "complete": {
+      "kind": "complete",
+      "utc": "2026-11-10T18:07:35.7007963+00:00",
+      "mode": "diagnostic",
+      "cycles": 25,
+      "restarts": 6,
+      "seconds": 91.6023965,
+      "satisfiesTwoHourDuration": false
+    },
+    "rowCounts": {
+      "active": 25,
+      "complete": 1,
+      "network-stall-recovered": 25,
+      "quiescent": 25,
+      "restart": 6,
+      "start": 1
+    },
+    "firstResources": {
+      "Cycle": 1,
+      "Seconds": 2.6710051,
+      "Sessions": 0,
+      "Subscriptions": 0,
+      "Items": 0,
+      "BrowsePoints": 0,
+      "HistoryPoints": 0,
+      "LiveDataItems": 0,
+      "LiveEventItems": 0,
+      "MonitoredNodes": 0,
+      "Variables": 19,
+      "Folders": 4,
+      "Conditions": 1,
+      "CachedCertificateStores": 2,
+      "Descriptors": 187,
+      "PkiDescriptors": 0,
+      "ManagedBytes": 19828144,
+      "RssBytes": 207749120,
+      "AllocatedBytes": 45697696,
+      "Gen0": 3,
+      "Gen1": 2,
+      "Gen2": 2
+    },
+    "baselineResources": {
+      "Cycle": 3,
+      "Seconds": 7.466919,
+      "Sessions": 0,
+      "Subscriptions": 0,
+      "Items": 0,
+      "BrowsePoints": 0,
+      "HistoryPoints": 0,
+      "LiveDataItems": 0,
+      "LiveEventItems": 0,
+      "MonitoredNodes": 0,
+      "Variables": 19,
+      "Folders": 4,
+      "Conditions": 1,
+      "CachedCertificateStores": 2,
+      "Descriptors": 188,
+      "PkiDescriptors": 0,
+      "ManagedBytes": 20404584,
+      "RssBytes": 212303872,
+      "AllocatedBytes": 52268352,
+      "Gen0": 7,
+      "Gen1": 6,
+      "Gen2": 6
+    },
+    "lastResources": {
+      "Cycle": 25,
+      "Seconds": 91.5753658,
+      "Sessions": 0,
+      "Subscriptions": 0,
+      "Items": 0,
+      "BrowsePoints": 0,
+      "HistoryPoints": 0,
+      "LiveDataItems": 0,
+      "LiveEventItems": 0,
+      "MonitoredNodes": 0,
+      "Variables": 19,
+      "Folders": 4,
+      "Conditions": 1,
+      "CachedCertificateStores": 2,
+      "Descriptors": 190,
+      "PkiDescriptors": 0,
+      "ManagedBytes": 20259504,
+      "RssBytes": 266043392,
+      "AllocatedBytes": 349723432,
+      "Gen0": 57,
+      "Gen1": 50,
+      "Gen2": 50
+    }
+  }
+}

scripts/validation/opcua-server-lifecycle-linux/evidence/2026-11-10-diagnostic/soak.jsonl

@@ -0,0 +1,83 @@
+{"kind":"start","utc":"2026-11-10T18:06:04.0984012+00:00","processId":196,"mode":"diagnostic","requestedSeconds":90,"minimumFullSeconds":7200,"build":"74c938f37cbb9cf08b6ca72e4effc511120dc274","sdk":"2.0.1\u002B07e62f72500cc0923a2bab940653c8c1116fa286","diagnosticInstrumentation":"SDK2.0.1 CP lists and certificate-validation cached stores; read-only","limits":{"retainedManagedGrowthBytes":67108864,"rssGrowthBytes":134217728,"fdGrowth":32},"coverage":"encrypted sessions; scalar/Int16[] Raw\u002BUNS; subscription removal; browse abandonment; history release/cross-session/close; surgical changes/rebuild; revocation; paused TCP read/recovery; same-PKI restart"}
+{"kind":"active","cycle":1,"sessions":2,"subscriptions":1,"items":3,"browsePoints":1,"historyPoints":6}
+{"kind":"network-stall-recovered","cycle":1,"status":"BadRequestInterrupted","seconds":1.0480969}
+{"kind":"quiescent","cycleSeconds":2.6930539,"resources":{"Cycle":1,"Seconds":2.6710051,"Sessions":0,"Subscriptions":0,"Items":0,"BrowsePoints":0,"HistoryPoints":0,"LiveDataItems":0,"LiveEventItems":0,"MonitoredNodes":0,"Variables":19,"Folders":4,"Conditions":1,"CachedCertificateStores":2,"Descriptors":187,"PkiDescriptors":0,"ManagedBytes":19828144,"RssBytes":207749120,"AllocatedBytes":45697696,"Gen0":3,"Gen1":2,"Gen2":2}}
+{"kind":"active","cycle":2,"sessions":2,"subscriptions":1,"items":3,"browsePoints":1,"historyPoints":6}
+{"kind":"network-stall-recovered","cycle":2,"status":"BadRequestInterrupted","seconds":1.0446531}
+{"kind":"quiescent","cycleSeconds":2.4080887,"resources":{"Cycle":2,"Seconds":5.1027619,"Sessions":0,"Subscriptions":0,"Items":0,"BrowsePoints":0,"HistoryPoints":0,"LiveDataItems":0,"LiveEventItems":0,"MonitoredNodes":0,"Variables":19,"Folders":4,"Conditions":1,"CachedCertificateStores":2,"Descriptors":187,"PkiDescriptors":0,"ManagedBytes":20236624,"RssBytes":209514496,"AllocatedBytes":49129448,"Gen0":5,"Gen1":4,"Gen2":4}}
+{"kind":"active","cycle":3,"sessions":2,"subscriptions":1,"items":3,"browsePoints":1,"historyPoints":6}
+{"kind":"network-stall-recovered","cycle":3,"status":"BadRequestInterrupted","seconds":1.0434837}
+{"kind":"quiescent","cycleSeconds":2.3620647,"resources":{"Cycle":3,"Seconds":7.466919,"Sessions":0,"Subscriptions":0,"Items":0,"BrowsePoints":0,"HistoryPoints":0,"LiveDataItems":0,"LiveEventItems":0,"MonitoredNodes":0,"Variables":19,"Folders":4,"Conditions":1,"CachedCertificateStores":2,"Descriptors":188,"PkiDescriptors":0,"ManagedBytes":20404584,"RssBytes":212303872,"AllocatedBytes":52268352,"Gen0":7,"Gen1":6,"Gen2":6}}
+{"kind":"active","cycle":4,"sessions":2,"subscriptions":1,"items":3,"browsePoints":1,"historyPoints":6}
+{"kind":"network-stall-recovered","cycle":4,"status":"BadRequestInterrupted","seconds":1.0417759}
+{"kind":"quiescent","cycleSeconds":2.367273,"resources":{"Cycle":4,"Seconds":9.8310274,"Sessions":0,"Subscriptions":0,"Items":0,"BrowsePoints":0,"HistoryPoints":0,"LiveDataItems":0,"LiveEventItems":0,"MonitoredNodes":0,"Variables":19,"Folders":4,"Conditions":1,"CachedCertificateStores":2,"Descriptors":188,"PkiDescriptors":0,"ManagedBytes":20581856,"RssBytes":215437312,"AllocatedBytes":55331040,"Gen0":9,"Gen1":8,"Gen2":8}}
+{"kind":"restart","cycles":4,"restarts":1,"seconds":5.1579086}
+{"kind":"active","cycle":5,"sessions":2,"subscriptions":1,"items":3,"browsePoints":1,"historyPoints":6}
+{"kind":"network-stall-recovered","cycle":5,"status":"BadRequestInterrupted","seconds":1.0429156}
+{"kind":"quiescent","cycleSeconds":2.4248818,"resources":{"Cycle":5,"Seconds":17.4116445,"Sessions":0,"Subscriptions":0,"Items":0,"BrowsePoints":0,"HistoryPoints":0,"LiveDataItems":0,"LiveEventItems":0,"MonitoredNodes":0,"Variables":19,"Folders":4,"Conditions":1,"CachedCertificateStores":2,"Descriptors":187,"PkiDescriptors":0,"ManagedBytes":20117312,"RssBytes":244072448,"AllocatedBytes":97741368,"Gen0":12,"Gen1":10,"Gen2":10}}
+{"kind":"active","cycle":6,"sessions":2,"subscriptions":1,"items":3,"browsePoints":1,"historyPoints":6}
+{"kind":"network-stall-recovered","cycle":6,"status":"BadRequestInterrupted","seconds":1.0424929}
+{"kind":"quiescent","cycleSeconds":2.359121,"resources":{"Cycle":6,"Seconds":19.7704339,"Sessions":0,"Subscriptions":0,"Items":0,"BrowsePoints":0,"HistoryPoints":0,"LiveDataItems":0,"LiveEventItems":0,"MonitoredNodes":0,"Variables":19,"Folders":4,"Conditions":1,"CachedCertificateStores":2,"Descriptors":188,"PkiDescriptors":0,"ManagedBytes":20256216,"RssBytes":244867072,"AllocatedBytes":100833504,"Gen0":14,"Gen1":12,"Gen2":12}}
+{"kind":"active","cycle":7,"sessions":2,"subscriptions":1,"items":3,"browsePoints":1,"historyPoints":6}
+{"kind":"network-stall-recovered","cycle":7,"status":"BadRequestInterrupted","seconds":1.0036954}
+{"kind":"quiescent","cycleSeconds":2.4160967,"resources":{"Cycle":7,"Seconds":22.1874361,"Sessions":0,"Subscriptions":0,"Items":0,"BrowsePoints":0,"HistoryPoints":0,"LiveDataItems":0,"LiveEventItems":0,"MonitoredNodes":0,"Variables":19,"Folders":4,"Conditions":1,"CachedCertificateStores":2,"Descriptors":187,"PkiDescriptors":0,"ManagedBytes":20426992,"RssBytes":245751808,"AllocatedBytes":103924024,"Gen0":16,"Gen1":14,"Gen2":14}}
+{"kind":"active","cycle":8,"sessions":2,"subscriptions":1,"items":3,"browsePoints":1,"historyPoints":6}
+{"kind":"network-stall-recovered","cycle":8,"status":"BadRequestInterrupted","seconds":1.0523899}
+{"kind":"quiescent","cycleSeconds":2.3926737,"resources":{"Cycle":8,"Seconds":24.5842524,"Sessions":0,"Subscriptions":0,"Items":0,"BrowsePoints":0,"HistoryPoints":0,"LiveDataItems":0,"LiveEventItems":0,"MonitoredNodes":0,"Variables":19,"Folders":4,"Conditions":1,"CachedCertificateStores":2,"Descriptors":188,"PkiDescriptors":0,"ManagedBytes":20713008,"RssBytes":247889920,"AllocatedBytes":107102792,"Gen0":18,"Gen1":16,"Gen2":16}}
+{"kind":"restart","cycles":8,"restarts":2,"seconds":5.1120391}
+{"kind":"active","cycle":9,"sessions":2,"subscriptions":1,"items":3,"browsePoints":1,"historyPoints":6}
+{"kind":"network-stall-recovered","cycle":9,"status":"BadRequestInterrupted","seconds":1.0461218}
+{"kind":"quiescent","cycleSeconds":2.3757912,"resources":{"Cycle":9,"Seconds":32.0681461,"Sessions":0,"Subscriptions":0,"Items":0,"BrowsePoints":0,"HistoryPoints":0,"LiveDataItems":0,"LiveEventItems":0,"MonitoredNodes":0,"Variables":19,"Folders":4,"Conditions":1,"CachedCertificateStores":2,"Descriptors":187,"PkiDescriptors":0,"ManagedBytes":20283072,"RssBytes":256245760,"AllocatedBytes":149467600,"Gen0":21,"Gen1":18,"Gen2":18}}
+{"kind":"active","cycle":10,"sessions":2,"subscriptions":1,"items":3,"browsePoints":1,"historyPoints":6}
+{"kind":"network-stall-recovered","cycle":10,"status":"BadRequestInterrupted","seconds":1.0032768}
+{"kind":"quiescent","cycleSeconds":2.3840571,"resources":{"Cycle":10,"Seconds":34.4585736,"Sessions":0,"Subscriptions":0,"Items":0,"BrowsePoints":0,"HistoryPoints":0,"LiveDataItems":0,"LiveEventItems":0,"MonitoredNodes":0,"Variables":19,"Folders":4,"Conditions":1,"CachedCertificateStores":2,"Descriptors":187,"PkiDescriptors":0,"ManagedBytes":20400792,"RssBytes":256765952,"AllocatedBytes":152540856,"Gen0":23,"Gen1":20,"Gen2":20}}
+{"kind":"active","cycle":11,"sessions":2,"subscriptions":1,"items":3,"browsePoints":1,"historyPoints":6}
+{"kind":"network-stall-recovered","cycle":11,"status":"BadRequestInterrupted","seconds":1.0055269}
+{"kind":"quiescent","cycleSeconds":2.3664136,"resources":{"Cycle":11,"Seconds":36.8250058,"Sessions":0,"Subscriptions":0,"Items":0,"BrowsePoints":0,"HistoryPoints":0,"LiveDataItems":0,"LiveEventItems":0,"MonitoredNodes":0,"Variables":19,"Folders":4,"Conditions":1,"CachedCertificateStores":2,"Descriptors":187,"PkiDescriptors":0,"ManagedBytes":20611944,"RssBytes":256458752,"AllocatedBytes":155681752,"Gen0":25,"Gen1":22,"Gen2":22}}
+{"kind":"active","cycle":12,"sessions":2,"subscriptions":1,"items":3,"browsePoints":1,"historyPoints":6}
+{"kind":"network-stall-recovered","cycle":12,"status":"BadRequestInterrupted","seconds":1.0483463}
+{"kind":"quiescent","cycleSeconds":2.4039892,"resources":{"Cycle":12,"Seconds":39.2211123,"Sessions":0,"Subscriptions":0,"Items":0,"BrowsePoints":0,"HistoryPoints":0,"LiveDataItems":0,"LiveEventItems":0,"MonitoredNodes":0,"Variables":19,"Folders":4,"Conditions":1,"CachedCertificateStores":2,"Descriptors":187,"PkiDescriptors":0,"ManagedBytes":20794472,"RssBytes":257134592,"AllocatedBytes":158746992,"Gen0":27,"Gen1":24,"Gen2":24}}
+{"kind":"restart","cycles":12,"restarts":3,"seconds":5.0988863}
+{"kind":"active","cycle":13,"sessions":2,"subscriptions":1,"items":3,"browsePoints":1,"historyPoints":6}
+{"kind":"network-stall-recovered","cycle":13,"status":"BadRequestInterrupted","seconds":1.0450081}
+{"kind":"quiescent","cycleSeconds":2.3795872,"resources":{"Cycle":13,"Seconds":46.7014719,"Sessions":0,"Subscriptions":0,"Items":0,"BrowsePoints":0,"HistoryPoints":0,"LiveDataItems":0,"LiveEventItems":0,"MonitoredNodes":0,"Variables":19,"Folders":4,"Conditions":1,"CachedCertificateStores":2,"Descriptors":189,"PkiDescriptors":0,"ManagedBytes":20332520,"RssBytes":261271552,"AllocatedBytes":199536496,"Gen0":30,"Gen1":26,"Gen2":26}}
+{"kind":"active","cycle":14,"sessions":2,"subscriptions":1,"items":3,"browsePoints":1,"historyPoints":6}
+{"kind":"network-stall-recovered","cycle":14,"status":"BadRequestInterrupted","seconds":1.0436713}
+{"kind":"quiescent","cycleSeconds":2.3497161,"resources":{"Cycle":14,"Seconds":49.0501604,"Sessions":0,"Subscriptions":0,"Items":0,"BrowsePoints":0,"HistoryPoints":0,"LiveDataItems":0,"LiveEventItems":0,"MonitoredNodes":0,"Variables":19,"Folders":4,"Conditions":1,"CachedCertificateStores":2,"Descriptors":190,"PkiDescriptors":0,"ManagedBytes":20431480,"RssBytes":261554176,"AllocatedBytes":202614280,"Gen0":32,"Gen1":28,"Gen2":28}}
+{"kind":"active","cycle":15,"sessions":2,"subscriptions":1,"items":3,"browsePoints":1,"historyPoints":6}
+{"kind":"network-stall-recovered","cycle":15,"status":"BadRequestInterrupted","seconds":1.04895}
+{"kind":"quiescent","cycleSeconds":2.371092,"resources":{"Cycle":15,"Seconds":51.4268968,"Sessions":0,"Subscriptions":0,"Items":0,"BrowsePoints":0,"HistoryPoints":0,"LiveDataItems":0,"LiveEventItems":0,"MonitoredNodes":0,"Variables":19,"Folders":4,"Conditions":1,"CachedCertificateStores":2,"Descriptors":189,"PkiDescriptors":0,"ManagedBytes":20505512,"RssBytes":264040448,"AllocatedBytes":205694824,"Gen0":34,"Gen1":30,"Gen2":30}}
+{"kind":"active","cycle":16,"sessions":2,"subscriptions":1,"items":3,"browsePoints":1,"historyPoints":6}
+{"kind":"network-stall-recovered","cycle":16,"status":"BadRequestInterrupted","seconds":1.0443525}
+{"kind":"quiescent","cycleSeconds":2.9848582,"resources":{"Cycle":16,"Seconds":53.9203748,"Sessions":0,"Subscriptions":0,"Items":0,"BrowsePoints":0,"HistoryPoints":0,"LiveDataItems":0,"LiveEventItems":0,"MonitoredNodes":0,"Variables":19,"Folders":4,"Conditions":1,"CachedCertificateStores":2,"Descriptors":189,"PkiDescriptors":0,"ManagedBytes":20622096,"RssBytes":264884224,"AllocatedBytes":208715944,"Gen0":36,"Gen1":32,"Gen2":32}}
+{"kind":"restart","cycles":16,"restarts":4,"seconds":5.454083}
+{"kind":"active","cycle":17,"sessions":2,"subscriptions":1,"items":3,"browsePoints":1,"historyPoints":6}
+{"kind":"network-stall-recovered","cycle":17,"status":"BadRequestInterrupted","seconds":1.0473067}
+{"kind":"quiescent","cycleSeconds":2.3818575,"resources":{"Cycle":17,"Seconds":62.2447867,"Sessions":0,"Subscriptions":0,"Items":0,"BrowsePoints":0,"HistoryPoints":0,"LiveDataItems":0,"LiveEventItems":0,"MonitoredNodes":0,"Variables":19,"Folders":4,"Conditions":1,"CachedCertificateStores":2,"Descriptors":189,"PkiDescriptors":0,"ManagedBytes":20191360,"RssBytes":259485696,"AllocatedBytes":249582344,"Gen0":39,"Gen1":34,"Gen2":34}}
+{"kind":"active","cycle":18,"sessions":2,"subscriptions":1,"items":3,"browsePoints":1,"historyPoints":6}
+{"kind":"network-stall-recovered","cycle":18,"status":"BadRequestInterrupted","seconds":1.0423094}
+{"kind":"quiescent","cycleSeconds":2.3561291,"resources":{"Cycle":18,"Seconds":64.6095248,"Sessions":0,"Subscriptions":0,"Items":0,"BrowsePoints":0,"HistoryPoints":0,"LiveDataItems":0,"LiveEventItems":0,"MonitoredNodes":0,"Variables":19,"Folders":4,"Conditions":1,"CachedCertificateStores":2,"Descriptors":189,"PkiDescriptors":0,"ManagedBytes":20373376,"RssBytes":255721472,"AllocatedBytes":252706544,"Gen0":41,"Gen1":36,"Gen2":36}}
+{"kind":"active","cycle":19,"sessions":2,"subscriptions":1,"items":3,"browsePoints":1,"historyPoints":6}
+{"kind":"network-stall-recovered","cycle":19,"status":"BadRequestInterrupted","seconds":1.0436178}
+{"kind":"quiescent","cycleSeconds":2.3444876,"resources":{"Cycle":19,"Seconds":66.9546586,"Sessions":0,"Subscriptions":0,"Items":0,"BrowsePoints":0,"HistoryPoints":0,"LiveDataItems":0,"LiveEventItems":0,"MonitoredNodes":0,"Variables":19,"Folders":4,"Conditions":1,"CachedCertificateStores":2,"Descriptors":189,"PkiDescriptors":0,"ManagedBytes":20552264,"RssBytes":254763008,"AllocatedBytes":255808392,"Gen0":43,"Gen1":38,"Gen2":38}}
+{"kind":"active","cycle":20,"sessions":2,"subscriptions":1,"items":3,"browsePoints":1,"historyPoints":6}
+{"kind":"network-stall-recovered","cycle":20,"status":"BadRequestInterrupted","seconds":1.0451534}
+{"kind":"quiescent","cycleSeconds":2.3495591,"resources":{"Cycle":20,"Seconds":69.2963186,"Sessions":0,"Subscriptions":0,"Items":0,"BrowsePoints":0,"HistoryPoints":0,"LiveDataItems":0,"LiveEventItems":0,"MonitoredNodes":0,"Variables":19,"Folders":4,"Conditions":1,"CachedCertificateStores":2,"Descriptors":189,"PkiDescriptors":0,"ManagedBytes":20702232,"RssBytes":255512576,"AllocatedBytes":258843576,"Gen0":45,"Gen1":40,"Gen2":40}}
+{"kind":"restart","cycles":20,"restarts":5,"seconds":5.1129163}
+{"kind":"active","cycle":21,"sessions":2,"subscriptions":1,"items":3,"browsePoints":1,"historyPoints":6}
+{"kind":"network-stall-recovered","cycle":21,"status":"BadRequestInterrupted","seconds":1.049048}
+{"kind":"quiescent","cycleSeconds":2.4246867,"resources":{"Cycle":21,"Seconds":76.8338727,"Sessions":0,"Subscriptions":0,"Items":0,"BrowsePoints":0,"HistoryPoints":0,"LiveDataItems":0,"LiveEventItems":0,"MonitoredNodes":0,"Variables":19,"Folders":4,"Conditions":1,"CachedCertificateStores":2,"Descriptors":190,"PkiDescriptors":0,"ManagedBytes":20221440,"RssBytes":262025216,"AllocatedBytes":299637616,"Gen0":48,"Gen1":42,"Gen2":42}}
+{"kind":"active","cycle":22,"sessions":2,"subscriptions":1,"items":3,"browsePoints":1,"historyPoints":6}
+{"kind":"network-stall-recovered","cycle":22,"status":"BadRequestInterrupted","seconds":1.0419365}
+{"kind":"quiescent","cycleSeconds":2.404919,"resources":{"Cycle":22,"Seconds":79.246374,"Sessions":0,"Subscriptions":0,"Items":0,"BrowsePoints":0,"HistoryPoints":0,"LiveDataItems":0,"LiveEventItems":0,"MonitoredNodes":0,"Variables":19,"Folders":4,"Conditions":1,"CachedCertificateStores":2,"Descriptors":189,"PkiDescriptors":0,"ManagedBytes":20324024,"RssBytes":262062080,"AllocatedBytes":302774600,"Gen0":50,"Gen1":44,"Gen2":44}}
+{"kind":"active","cycle":23,"sessions":2,"subscriptions":1,"items":3,"browsePoints":1,"historyPoints":6}
+{"kind":"network-stall-recovered","cycle":23,"status":"BadRequestInterrupted","seconds":1.0409262}
+{"kind":"quiescent","cycleSeconds":2.3874906,"resources":{"Cycle":23,"Seconds":81.6319445,"Sessions":0,"Subscriptions":0,"Items":0,"BrowsePoints":0,"HistoryPoints":0,"LiveDataItems":0,"LiveEventItems":0,"MonitoredNodes":0,"Variables":19,"Folders":4,"Conditions":1,"CachedCertificateStores":2,"Descriptors":189,"PkiDescriptors":0,"ManagedBytes":20478784,"RssBytes":260964352,"AllocatedBytes":305840432,"Gen0":52,"Gen1":46,"Gen2":46}}
+{"kind":"active","cycle":24,"sessions":2,"subscriptions":1,"items":3,"browsePoints":1,"historyPoints":6}
+{"kind":"network-stall-recovered","cycle":24,"status":"BadRequestInterrupted","seconds":1.0526128}
+{"kind":"quiescent","cycleSeconds":2.4292523,"resources":{"Cycle":24,"Seconds":84.060344,"Sessions":0,"Subscriptions":0,"Items":0,"BrowsePoints":0,"HistoryPoints":0,"LiveDataItems":0,"LiveEventItems":0,"MonitoredNodes":0,"Variables":19,"Folders":4,"Conditions":1,"CachedCertificateStores":2,"Descriptors":189,"PkiDescriptors":0,"ManagedBytes":20663008,"RssBytes":261554176,"AllocatedBytes":308902736,"Gen0":54,"Gen1":48,"Gen2":48}}
+{"kind":"restart","cycles":24,"restarts":6,"seconds":5.0922583}
+{"kind":"active","cycle":25,"sessions":2,"subscriptions":1,"items":3,"browsePoints":1,"historyPoints":6}
+{"kind":"network-stall-recovered","cycle":25,"status":"BadRequestInterrupted","seconds":1.0433366}
+{"kind":"quiescent","cycleSeconds":2.4269109,"resources":{"Cycle":25,"Seconds":91.5753658,"Sessions":0,"Subscriptions":0,"Items":0,"BrowsePoints":0,"HistoryPoints":0,"LiveDataItems":0,"LiveEventItems":0,"MonitoredNodes":0,"Variables":19,"Folders":4,"Conditions":1,"CachedCertificateStores":2,"Descriptors":190,"PkiDescriptors":0,"ManagedBytes":20259504,"RssBytes":266043392,"AllocatedBytes":349723432,"Gen0":57,"Gen1":50,"Gen2":50}}
+{"kind":"complete","utc":"2026-11-10T18:07:35.7007963+00:00","mode":"diagnostic","cycles":25,"restarts":6,"seconds":91.6023965,"satisfiesTwoHourDuration":false}

scripts/validation/opcua-server-lifecycle-linux/evidence/2026-11-10-diagnostic/soak.log

@@ -0,0 +1,7 @@
+VSTest version 18.0.1 (arm64)
+
+Starting test execution, please wait...
+A total of 1 test files matched the specified pattern.
+Results File: /task/results/soak.trx
+
+Passed!  - Failed:     0, Passed:     1, Skipped:     0, Total:     1, Duration: 1 m 33 s - ZB.MOM.WW.OtOpcUa.OpcUaServer.IntegrationTests.dll (net10.0)

scripts/validation/opcua-server-lifecycle-linux/evidence/2026-11-10-diagnostic/soak.trx

@@ -0,0 +1,34 @@
+<?xml version="1.0" encoding="utf-8"?>
+<TestRun id="d79bf095-24b8-47e5-8bf9-bb794d432137" name="@8c898f464f50 2026-11-10 18:07:35" xmlns="http://microsoft.com/schemas/VisualStudio/TeamTest/2010">
+  <Times creation="2026-11-10T18:07:35.7508628+00:00" queuing="2026-11-10T18:07:35.7508628+00:00" start="2026-11-10T18:06:02.1473749+00:00" finish="2026-11-10T18:07:35.7545626+00:00" />
+  <TestSettings name="default" id="68e934f0-45b1-46c2-93b4-062f7d8f2596">
+    <Deployment runDeploymentRoot="_8c898f464f50_2026-11-10_18_07_35" />
+  </TestSettings>
+  <Results>
+    <UnitTestResult executionId="dbfea690-8558-4eb5-96a6-b0d19015f837" testId="3a3639bf-5159-da35-0b1a-0a6c89f03e2c" testName="ZB.MOM.WW.OtOpcUa.OpcUaServer.IntegrationTests.Sdk2LifecycleSoakTests.Repeated_lifecycles_return_resources_to_a_steady_baseline" computerName="8c898f464f50" duration="00:01:33.0080309" startTime="2026-11-10T18:06:02.6943262+00:00" endTime="2026-11-10T18:07:35.7059381+00:00" testType="13cdc9d9-ddb5-4fa4-a97d-d965ccfc6d4b" outcome="Passed" testListId="8c84fa94-04c1-424b-9868-57a2d4851a1d" relativeResultsDirectory="dbfea690-8558-4eb5-96a6-b0d19015f837" />
+  </Results>
+  <TestDefinitions>
+    <UnitTest name="ZB.MOM.WW.OtOpcUa.OpcUaServer.IntegrationTests.Sdk2LifecycleSoakTests.Repeated_lifecycles_return_resources_to_a_steady_baseline" storage="/app/zb.mom.ww.otopcua.opcuaserver.integrationtests.dll" id="3a3639bf-5159-da35-0b1a-0a6c89f03e2c">
+      <Execution id="dbfea690-8558-4eb5-96a6-b0d19015f837" />
+      <TestMethod codeBase="/app/ZB.MOM.WW.OtOpcUa.OpcUaServer.IntegrationTests.dll" adapterTypeName="executor://xunit/VsTestRunner3/netcore/" className="ZB.MOM.WW.OtOpcUa.OpcUaServer.IntegrationTests.Sdk2LifecycleSoakTests" name="Repeated_lifecycles_return_resources_to_a_steady_baseline" />
+    </UnitTest>
+  </TestDefinitions>
+  <TestEntries>
+    <TestEntry testId="3a3639bf-5159-da35-0b1a-0a6c89f03e2c" executionId="dbfea690-8558-4eb5-96a6-b0d19015f837" testListId="8c84fa94-04c1-424b-9868-57a2d4851a1d" />
+  </TestEntries>
+  <TestLists>
+    <TestList name="Results Not in a List" id="8c84fa94-04c1-424b-9868-57a2d4851a1d" />
+    <TestList name="All Loaded Results" id="19431567-8539-422a-85d7-44ee4e166bda" />
+  </TestLists>
+  <ResultSummary outcome="Completed">
+    <Counters total="1" executed="1" passed="1" failed="0" error="0" timeout="0" aborted="0" inconclusive="0" passedButRunAborted="0" notRunnable="0" notExecuted="0" disconnected="0" warning="0" completed="0" inProgress="0" pending="0" />
+    <Output>
+      <StdOut>[xUnit.net 00:00:00.00] xUnit.net VSTest Adapter v3.0.2+dd36e86129 (64-bit .NET 10.0.14)
+[xUnit.net 00:00:00.10]   Discovering: ZB.MOM.WW.OtOpcUa.OpcUaServer.IntegrationTests
+[xUnit.net 00:00:00.25]   Discovered:  ZB.MOM.WW.OtOpcUa.OpcUaServer.IntegrationTests
+[xUnit.net 00:00:00.33]   Starting:    ZB.MOM.WW.OtOpcUa.OpcUaServer.IntegrationTests
+[xUnit.net 00:01:33.38]   Finished:    ZB.MOM.WW.OtOpcUa.OpcUaServer.IntegrationTests
+</StdOut>
+    </Output>
+  </ResultSummary>
+</TestRun>

scripts/validation/opcua-server-lifecycle-linux/evidence/2026-11-10-diagnostic/source.json

@@ -0,0 +1,57 @@
+{
+  "launcherSourceRevision": "74c938f37cbb9cf08b6ca72e4effc511120dc274",
+  "publishedSourceRevision": "74c938f37cbb9cf08b6ca72e4effc511120dc274",
+  "productionEquivalentTo": "7b353d7bae5311a2f0a33c0a82c88d2c5b49d76f",
+  "productionDiffEmpty": true,
+  "canonicalDescriptorProbeCommit": "642aefe3",
+  "testSourceSha256": "e695783e05787d94bf5d167b25b1c48b446b800c28259f023c28ed6012d737d1",
+  "publishCommand": "reused self-contained artifact: /private/tmp/opcua2-server-linux-diagnostic-20261110a/app",
+  "appPath": "/private/tmp/opcua2-server-linux-diagnostic-20261110a/app",
+  "apphost": {
+    "format": "ELF64 AArch64",
+    "sha256": "97531b8005df9dc8b129d2b22ba2049cf572d5d970046f7e8644ec632e860032"
+  },
+  "runtimeConfig": {
+    "runtimeOptions": {
+      "tfm": "net10.0",
+      "includedFrameworks": [
+        {
+          "name": "Microsoft.NETCore.App",
+          "version": "10.0.14"
+        },
+        {
+          "name": "Microsoft.AspNetCore.App",
+          "version": "10.0.14"
+        }
+      ],
+      "configProperties": {
+        "System.Reflection.Metadata.MetadataUpdater.IsSupported": false,
+        "System.Reflection.NullabilityInfoContext.IsSupported": true,
+        "System.Runtime.Serialization.EnableUnsafeBinaryFormatterSerialization": false
+      }
+    }
+  },
+  "sdkDependencies": [
+    "OPCFoundation.NetStandard.Opc.Ua.Client/2.0.1",
+    "OPCFoundation.NetStandard.Opc.Ua.Configuration/2.0.1",
+    "OPCFoundation.NetStandard.Opc.Ua.Core.Schema/2.0.1",
+    "OPCFoundation.NetStandard.Opc.Ua.Core.Types/2.0.1",
+    "OPCFoundation.NetStandard.Opc.Ua.Core/2.0.1",
+    "OPCFoundation.NetStandard.Opc.Ua.Security.Certificates/2.0.1",
+    "OPCFoundation.NetStandard.Opc.Ua.Server/2.0.1",
+    "OPCFoundation.NetStandard.Opc.Ua.Types/2.0.1"
+  ],
+  "image": {
+    "Id": "sha256:b04611ee9e1b7d36797012ed921962c57189cb4dbb3dff12afb8e158110f293b",
+    "RepoDigests": [
+      "mcr.microsoft.com/dotnet/sdk@sha256:e362a8dbcd691522456da26a5198b8f3ca1d7641c95624fadc5e3e82678bd08a"
+    ],
+    "Architecture": "arm64",
+    "Os": "linux"
+  },
+  "hostDotnet": ".NET SDK:\n Version:           10.0.403\n Commit:            5a2162bea6\n Workload version:  10.0.400-manifests.a00bebb6\n MSBuild version:   18.9.15+5a2162bea\n\nRuntime Environment:\n OS Name:     Mac OS X\n OS Version:  26.5\n OS Platform: Darwin\n RID:         osx-arm64\n Base Path:   /opt/homebrew/Cellar/dotnet/10.0.403/libexec/sdk/10.0.403/\n\n.NET workloads installed:\nThere are no installed workloads to display.\nConfigured to use workload sets when installing new manifests.\nNo workload sets are installed. Run \"dotnet workload restore\" to install a workload set.\n\nHost:\n  Version:      10.0.14\n  Architecture: arm64\n  Commit:       0427b9abbe\n\n.NET SDKs installed:\n  10.0.403 [/opt/homebrew/Cellar/dotnet/10.0.403/libexec/sdk]\n\n.NET runtimes installed:\n  Microsoft.AspNetCore.App 10.0.14 [/opt/homebrew/Cellar/dotnet/10.0.403/libexec/shared/Microsoft.AspNetCore.App]\n  Microsoft.NETCore.App 10.0.14 [/opt/homebrew/Cellar/dotnet/10.0.403/libexec/shared/Microsoft.NETCore.App]\n\nOther architectures found:\n  None\n\nEnvironment variables:\n  DOTNET_ROOT                              [/opt/homebrew/Cellar/dotnet/10.0.403/libexec]\n\nglobal.json file:\n  /Users/dohertj2/.codex/worktrees/opcua2-client-lifecycle/OtOpcUa/global.json\n\nLearn more:\n  https://aka.ms/dotnet/info\n\nDownload .NET:\n  https://aka.ms/dotnet/download\n",
+  "network": "none",
+  "mode": "diagnostic",
+  "durationSeconds": 90,
+  "startedUtc": "2026-11-10T18:06:00Z"
+}

scripts/validation/opcua-server-lifecycle-linux/evidence/2026-11-10-diagnostic/validation-controls.json

@@ -0,0 +1,12 @@
+[
+  {
+    "control": "short_diagnostic_cannot_satisfy_full",
+    "status": "passed",
+    "observedRejection": "Duration header mismatch"
+  },
+  {
+    "control": "wrong_executed_test_count_rejected",
+    "status": "passed",
+    "observedRejection": "TRX expected exact passed/executed count 1: /tmp/opcua2-server-linux-diagnostic-20261110b/task/results/descriptor-controls.trx"
+  }
+]

scripts/validation/opcua-server-lifecycle-linux/evidence/2026-11-10-diagnostic/verification.json

@@ -0,0 +1,29 @@
+{
+  "diagnosticExitCode": 0,
+  "descriptorControlTestsExecuted": 2,
+  "lifecycleTestsExecuted": 1,
+  "fullDurationCliGuardExitCode": 2,
+  "currentLauncherRevalidatedExistingEvidence": true,
+  "rawArtifactRoot": "/private/tmp/opcua2-server-linux-diagnostic-20261110c",
+  "publishArtifactRoot": "/private/tmp/opcua2-server-linux-diagnostic-20261110a/app",
+  "noFullRunPerformed": true,
+  "sourceProductionDiffFrom7b353d7bEmpty": true,
+  "harnessFiles": [
+    {
+      "path": "scripts/validation/opcua-server-lifecycle-linux/.gitignore",
+      "sha256": "32dae3052f331ee34d628ef535709b301259a45df7c7522c4d35dcf49873f00b"
+    },
+    {
+      "path": "scripts/validation/opcua-server-lifecycle-linux/README.md",
+      "sha256": "1a67d8a6bb4b604bad0f6772ea450306a1e5313723a755e9985d1a739b77f72c"
+    },
+    {
+      "path": "scripts/validation/opcua-server-lifecycle-linux/container.sh",
+      "sha256": "2a27d66e36d61431e6d413afe9d9d5d22959e82d9bf520767140b5d738487b31"
+    },
+    {
+      "path": "scripts/validation/opcua-server-lifecycle-linux/run.py",
+      "sha256": "770f164588e90df2c4a4fcc883ca82fc17a1037c80f62fa2b40e92ce511d6f15"
+    }
+  ]
+}

scripts/validation/opcua-server-lifecycle-linux/run.py

@@ -0,0 +1,183 @@
+#!/usr/bin/env python3
+"""Run the unchanged SDK2 server lifecycle test in isolated Linux ARM64."""
+import argparse
+import hashlib
+import json
+import os
+from pathlib import Path
+import shutil
+import struct
+import subprocess
+import time
+import uuid
+import xml.etree.ElementTree as ET
+
+HERE = Path(__file__).resolve().parent
+ROOT = HERE.parents[2]
+PROJECT = ROOT / 'tests/Server/ZB.MOM.WW.OtOpcUa.OpcUaServer.IntegrationTests/ZB.MOM.WW.OtOpcUa.OpcUaServer.IntegrationTests.csproj'
+APPNAME = 'ZB.MOM.WW.OtOpcUa.OpcUaServer.IntegrationTests'
+TARGET = 'Repeated_lifecycles_return_resources_to_a_steady_baseline'
+BASE = '7b353d7bae5311a2f0a33c0a82c88d2c5b49d76f'
+
+
+def write(path, value):
+    path.write_text(json.dumps(value, indent=2) + '\n')
+
+
+def sha(path):
+    return hashlib.sha256(path.read_bytes()).hexdigest()
+
+
+def command(argv, log, timeout, **kwargs):
+    with log.open('w') as stream:
+        result = subprocess.run([str(x) for x in argv], stdout=stream, stderr=subprocess.STDOUT, timeout=timeout, **kwargs)
+    return result.returncode
+
+
+def trx(path, count):
+    doc = ET.parse(path)
+    ns = {'t': 'http://microsoft.com/schemas/VisualStudio/TeamTest/2010'}
+    counts = doc.find('.//t:Counters', ns)
+    results = doc.findall('.//t:UnitTestResult', ns)
+    if counts is None or any(int(counts.attrib[k]) != count for k in ('total', 'executed', 'passed')):
+        raise RuntimeError('TRX expected exact passed/executed count ' + str(count) + ': ' + str(path))
+    if len(results) != count or any(r.attrib['outcome'] != 'Passed' for r in results):
+        raise RuntimeError('TRX missing or non-passing result: ' + str(path))
+    for key in ('failed', 'error', 'timeout', 'aborted', 'notExecuted'):
+        if int(counts.attrib.get(key, '0')):
+            raise RuntimeError('TRX has nonzero ' + key)
+    return {'counts': counts.attrib, 'tests': [r.attrib['testName'] for r in results]}
+
+
+def validate_evidence(task, seconds, full):
+    rows = [json.loads(line) for line in (task / 'soak.jsonl').read_text().splitlines()]
+    starts = [r for r in rows if r['kind'] == 'start']
+    complete = [r for r in rows if r['kind'] == 'complete']
+    if len(starts) != 1 or len(complete) != 1 or any(r['kind'] == 'failed' for r in rows):
+        raise RuntimeError('Expected one start and one complete with no failed evidence row')
+    start, done = starts[0], complete[0]
+    if start['requestedSeconds'] != seconds or start['minimumFullSeconds'] != 7200:
+        raise RuntimeError('Duration header mismatch')
+    expected_mode = 'full' if full else 'diagnostic'
+    if start['mode'] != expected_mode or done['mode'] != expected_mode or done['seconds'] < seconds:
+        raise RuntimeError('Real duration/completion mode mismatch')
+    if start['limits'] != {'retainedManagedGrowthBytes': 64 << 20, 'rssGrowthBytes': 128 << 20, 'fdGrowth': 32}:
+        raise RuntimeError('Canonical test resource budgets changed')
+    if done['satisfiesTwoHourDuration'] != full or (full and done['seconds'] < 7200):
+        raise RuntimeError('Two-hour gate mismatch')
+    samples = [r for r in rows if r['kind'] == 'quiescent']
+    active = [r for r in rows if r['kind'] == 'active']
+    stalls = [r for r in rows if r['kind'] == 'network-stall-recovered']
+    restarts = [r for r in rows if r['kind'] == 'restart']
+    if done['cycles'] < 4 or done['restarts'] != done['cycles'] // 4:
+        raise RuntimeError('Missing actual lifecycle/restart coverage')
+    if not (len(samples) == len(active) == len(stalls) == done['cycles']) or len(restarts) != done['restarts']:
+        raise RuntimeError('Incomplete cycle/stall/restart evidence counts')
+    if not start['sdk'].startswith('2.0.1+'):
+        raise RuntimeError('Runtime SDK header mismatch')
+    return {'start': start, 'complete': done, 'rowCounts': {k: sum(r['kind'] == k for r in rows) for k in sorted({r['kind'] for r in rows})},
+            'firstResources': samples[0]['resources'], 'baselineResources': samples[2]['resources'], 'lastResources': samples[-1]['resources']}
+
+
+def main():
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument('--output', required=True, type=Path, help='Fresh output including task private PKI; do not commit the whole directory')
+    parser.add_argument('--duration', type=int, default=90)
+    parser.add_argument('--full', action='store_true')
+    parser.add_argument('--published-app', type=Path, help='Reuse immutable self-contained publish from this launcher/recorded matching build')
+    parser.add_argument('--image', default='mcr.microsoft.com/dotnet/sdk:10.0.103-noble')
+    args = parser.parse_args()
+    if (args.full and args.duration < 7200) or (not args.full and not 60 <= args.duration <= 120):
+        parser.error('full requires duration >=7200; diagnostic requires 60..120 seconds')
+    output = args.output.resolve()
+    output.mkdir(parents=True, exist_ok=False)
+    os.chmod(output, 0o700)
+    task = output / 'task'
+    task.mkdir()
+    revision = subprocess.check_output(['git', '-C', str(ROOT), 'rev-parse', 'HEAD'], text=True).strip()
+    production_diff = subprocess.check_output(['git', '-C', str(ROOT), 'diff', BASE, 'HEAD', '--', 'src', 'Directory.Packages.props', 'Directory.Build.props'], text=True)
+    if production_diff:
+        raise RuntimeError('Production/package source differs from recorded 7b353d7b compatibility build; review required')
+    image = json.loads(subprocess.check_output(['docker', 'image', 'inspect', args.image, '--format', '{{json .}}'], text=True))
+    if image['Architecture'] != 'arm64' or image['Os'] != 'linux':
+        raise RuntimeError('Expected cached official Linux ARM64 image')
+    app = args.published_app.resolve() if args.published_app else output / 'app'
+    build_cmd = ['dotnet', 'publish', str(PROJECT), '-c', 'Release', '-r', 'linux-arm64', '--self-contained', 'true',
+                 '-p:RuntimeFrameworkVersion=10.0.14', '-p:PublishSingleFile=false', '-p:PublishTrimmed=false', '-p:UseAppHost=true',
+                 '--artifacts-path', str(output / 'build-artifacts'), '-o', str(app), '-m:1', '--nologo']
+    if not args.published_app:
+        status = command(build_cmd, output / 'publish.log', 600)
+        if status:
+            raise RuntimeError('Self-contained Linux publish failed: ' + str(status))
+    receipt_path = app.parent / 'publish-receipt.json'
+    receipt = json.loads(receipt_path.read_text()) if args.published_app else {
+        'sourceRevision': revision, 'command': build_cmd,
+        'hostDotnet': subprocess.check_output(['dotnet', '--info'], text=True),
+        'testSourceSha256': sha(PROJECT.parent / 'Sdk2LifecycleSoakTests.cs')}
+    if receipt['testSourceSha256'] != sha(PROJECT.parent / 'Sdk2LifecycleSoakTests.cs'):
+        raise RuntimeError('Reused publish test source differs from current canonical source')
+    apphost = app / APPNAME
+    magic = apphost.read_bytes()[:20]
+    if magic[:4] != b'\x7fELF' or magic[4] != 2 or struct.unpack('<H', magic[18:20])[0] != 183:
+        raise RuntimeError('xUnit v3 apphost must be Linux AArch64 ELF64, not macOS Mach-O')
+    runtime = json.loads((app / (APPNAME + '.runtimeconfig.json')).read_text())
+    frameworks = runtime['runtimeOptions'].get('includedFrameworks', [])
+    if not any(f['name'] == 'Microsoft.NETCore.App' and f['version'] == '10.0.14' for f in frameworks):
+        raise RuntimeError('Test app must carry self-contained runtime 10.0.14')
+    deps = json.loads((app / (APPNAME + '.deps.json')).read_text())
+    sdkdeps = {k: v for k, v in deps['libraries'].items() if k.startswith('OPCFoundation.')}
+    if not sdkdeps or any(k.rsplit('/', 1)[-1] != '2.0.1' for k in sdkdeps):
+        raise RuntimeError('Expected only OPC Foundation SDK 2.0.1 dependencies')
+    manifest = [{'name': p.name, 'bytes': p.stat().st_size, 'sha256': sha(p)} for p in sorted(app.glob('*')) if p.is_file()]
+    if args.published_app and (receipt['apphostSha256'] != sha(apphost)
+                              or receipt['testAssemblySha256'] != sha(app / (APPNAME + '.dll'))):
+        raise RuntimeError('Reused publish has changed since its receipt')
+    if not args.published_app:
+        receipt.update({'apphostSha256': sha(apphost), 'testAssemblySha256': sha(app / (APPNAME + '.dll'))})
+        write(receipt_path, receipt)
+    write(output / 'publish-receipt.json', receipt)
+    write(output / 'artifact-manifest.json', manifest)
+    source = {'launcherSourceRevision': revision, 'publishedSourceRevision': receipt['sourceRevision'],
+              'productionEquivalentTo': BASE, 'productionDiffEmpty': True,
+              'canonicalDescriptorProbeCommit': '642aefe3', 'testSourceSha256': sha(PROJECT.parent / 'Sdk2LifecycleSoakTests.cs'),
+              'publishCommand': build_cmd if not args.published_app else 'reused self-contained artifact: ' + str(app),
+              'appPath': str(app), 'apphost': {'format': 'ELF64 AArch64', 'sha256': sha(apphost)}, 'runtimeConfig': runtime,
+              'sdkDependencies': sorted(sdkdeps), 'image': {k: image.get(k) for k in ('Id', 'RepoDigests', 'Architecture', 'Os')},
+              'hostDotnet': subprocess.check_output(['dotnet', '--info'], text=True),
+              'network': 'none', 'mode': 'full' if args.full else 'diagnostic', 'durationSeconds': args.duration,
+              'startedUtc': time.strftime('%Y-%m-%dT%H:%M:%SZ', time.gmtime())}
+    write(output / 'source.json', source)
+    shutil.copy2(HERE / 'container.sh', task / 'container.sh')
+    name = 'otopcua-server-linux-soak-' + uuid.uuid4().hex[:12]
+    cmd = ['docker', 'run', '--rm', '--name', name, '--network', 'none',
+           '-e', 'OTOPCUA_SDK2_SOAK_MODE=' + ('full' if args.full else 'diagnostic'),
+           '-e', 'OTOPCUA_SDK2_SOAK_SECONDS=' + str(args.duration), '-e', 'OTOPCUA_SOAK_BUILD_SHA=' + revision,
+           '-v', str(app) + ':/app:ro', '-v', str(task) + ':/task', image['Id'], 'bash', '/task/container.sh']
+    write(output / 'command.json', {'argv': cmd, 'timeoutSeconds': args.duration + 300})
+    started = time.monotonic()
+    try:
+        status = command(cmd, output / 'container.log', args.duration + 300)
+    except BaseException:
+        subprocess.run(['docker', 'rm', '-f', name], stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL, timeout=20)
+        raise
+    write(output / 'result.json', {'status': 'failed', 'containerExitCode': status,
+                                  'containerElapsedSeconds': time.monotonic() - started,
+                                  'validation': 'pending TRX and completion validation'})
+    try:
+        controls = trx(task / 'results' / 'descriptor-controls.trx', 2)
+        test = trx(task / 'results' / 'soak.trx', 1)
+        if TARGET not in test['tests'][0] or status:
+            raise RuntimeError('Soak test did not complete successfully; container exit=' + str(status))
+        evidence = validate_evidence(task, args.duration, args.full)
+    except Exception as error:
+        write(output / 'result.json', {'status': 'failed', 'containerExitCode': status,
+                                      'containerElapsedSeconds': time.monotonic() - started,
+                                      'validationError': str(error)})
+        raise
+    write(output / 'result.json', {'status': 'passed', 'containerExitCode': status, 'containerElapsedSeconds': time.monotonic() - started,
+                                  'descriptorControls': controls, 'soakTest': test, 'evidence': evidence})
+    print(json.dumps({'output': str(output), 'status': 'passed', 'complete': evidence['complete']}, indent=2))
+
+
+if __name__ == '__main__':
+    main()

src/Client/ZB.MOM.WW.OtOpcUa.Client.Shared/Adapters/DefaultApplicationConfigurationFactory.cs

@@ -71,7 +71,9 @@ internal sealed class DefaultApplicationConfigurationFactory : IApplicationConfi
                     ApplicationType = ApplicationType.Client,
                     ApplicationConfiguration = config
                 };
-                await app.CheckApplicationInstanceCertificatesAsync(false, lifeTimeInMonths: 2048, ct: ct);
+                // Key size is configured separately; this argument is a lifetime in months.
+                // Keep the SDK creation default and reuse any valid certificate already in the store.
+                await app.CheckApplicationInstanceCertificatesAsync(false, ct: ct);
             }
         }
         catch

tests/Client/ZB.MOM.WW.OtOpcUa.Client.Shared.Tests/Adapters/DefaultApplicationConfigurationFactoryTests.cs

@@ -1,4 +1,7 @@
 using Opc.Ua;
+using Opc.Ua.Configuration;
+using System.Security.Cryptography;
+using System.Security.Cryptography.X509Certificates;
 using Shouldly;
 using Xunit;
 using ZB.MOM.WW.OtOpcUa.Client.Shared.Adapters;
@@ -9,6 +12,61 @@ namespace ZB.MOM.WW.OtOpcUa.Client.Shared.Tests.Adapters;
 /// <summary>Uses the real configuration factory so fake sessions cannot conceal SDK initialization failures.</summary>
 public sealed class DefaultApplicationConfigurationFactoryTests
 {
+    [Theory]
+    [InlineData(false)]
+    [InlineData(true)]
+    public async Task New_certificates_use_the_default_lifetime_and_existing_private_keys_are_reused(bool seedLongerCertificate)
+    {
+        var ct = TestContext.Current.CancellationToken;
+        var root = Path.Combine(Path.GetTempPath(), $"otopcua-certificate-lifetime-{Guid.NewGuid():N}");
+        var settings = new ConnectionSettings
+        {
+            EndpointUrl = "opc.tcp://localhost:4840", CertificateStorePath = root,
+            SecurityMode = SecurityMode.None, AutoAcceptCertificates = false,
+        };
+        var factory = new DefaultApplicationConfigurationFactory();
+        ApplicationConfiguration? current = null;
+        try
+        {
+            if (seedLongerCertificate)
+            {
+                var seed = await factory.CreateAsync(settings, ct);
+                await using var application = new ApplicationInstance(DefaultTelemetry.Create(_ => { })) { ApplicationConfiguration = seed };
+                (await application.CheckApplicationInstanceCertificatesAsync(true, lifeTimeInMonths: 60, ct)).ShouldBeTrue();
+            }
+            settings.SecurityMode = SecurityMode.SignAndEncrypt;
+            current = await factory.CreateAsync(settings, ct);
+            var certPath = Directory.GetFiles(Path.Combine(root, "own", "certs"), "*.der").ShouldHaveSingleItem();
+            var privatePath = Directory.GetFiles(Path.Combine(root, "own", "private"), "*.pfx").ShouldHaveSingleItem();
+            using var certificate = X509CertificateLoader.LoadCertificateFromFile(certPath);
+            using var privateCertificate = X509CertificateLoader.LoadPkcs12FromFile(privatePath, null, OperatingSystem.IsMacOS() ? X509KeyStorageFlags.DefaultKeySet : X509KeyStorageFlags.EphemeralKeySet);
+            privateCertificate.HasPrivateKey.ShouldBeTrue();
+            certificate.Thumbprint.ShouldBe(privateCertificate.Thumbprint);
+            using var rsa = certificate.GetRSAPublicKey();
+            rsa.ShouldNotBeNull().KeySize.ShouldBeGreaterThanOrEqualTo(2048);
+            if (seedLongerCertificate)
+                certificate.NotAfter.ToUniversalTime().ShouldBeGreaterThan(DateTime.UtcNow.AddYears(4));
+            else
+            {
+                certificate.NotAfter.ToUniversalTime().ShouldBeGreaterThan(DateTime.UtcNow.AddMonths(CertificateFactory.DefaultLifeTime - 1));
+                certificate.NotAfter.ToUniversalTime().ShouldBeLessThan(DateTime.UtcNow.AddMonths(CertificateFactory.DefaultLifeTime).AddDays(2));
+            }
+            var originalKeyHash = SHA256.HashData(await File.ReadAllBytesAsync(privatePath, ct));
+            (current.CertificateManager as IDisposable)?.Dispose(); current = null;
+            current = await factory.CreateAsync(settings, ct);
+            using var reused = X509CertificateLoader.LoadCertificateFromFile(certPath);
+            reused.Thumbprint.ShouldBe(certificate.Thumbprint);
+            SHA256.HashData(await File.ReadAllBytesAsync(privatePath, ct)).ShouldBe(originalKeyHash,
+                "reinitializing with a shorter creation default must not rotate an existing certificate or private key");
+            Directory.GetFiles(Path.Combine(root, "own", "certs"), "*.der").Length.ShouldBe(1);
+        }
+        finally
+        {
+            (current?.CertificateManager as IDisposable)?.Dispose();
+            if (Directory.Exists(root)) Directory.Delete(root, true);
+        }
+    }
+
     [Theory]
     [InlineData(SecurityMode.None)]
     [InlineData(SecurityMode.SignAndEncrypt)]

tests/Server/ZB.MOM.WW.OtOpcUa.OpcUaServer.IntegrationTests/Sdk2LifecycleSoakTests.cs

@@ -5,7 +5,6 @@ using System.Globalization;
 using System.Net;
 using System.Net.Sockets;
 using System.Reflection;
-using System.Runtime.ExceptionServices;
 using System.Text;
 using System.Text.Json;
 using Opc.Ua;
@@ -43,11 +42,10 @@ public sealed class Sdk2LifecycleSoakTests
     public async Task Repeated_lifecycles_return_resources_to_a_steady_baseline()
     {
         var mode = Environment.GetEnvironmentVariable("OTOPCUA_SDK2_SOAK_MODE");
-        (mode is "diagnostic" or "profile" or "full").ShouldBeTrue("explicit diagnostic, profile or full mode is required");
+        (mode is "diagnostic" or "full").ShouldBeTrue("explicit diagnostic or full mode is required");
         var seconds = int.Parse(Environment.GetEnvironmentVariable("OTOPCUA_SDK2_SOAK_SECONDS")
             ?? (mode == "full" ? "7200" : "90"), CultureInfo.InvariantCulture);
         if (mode == "full") seconds.ShouldBeGreaterThanOrEqualTo(7200);
-        else if (mode == "profile") seconds.ShouldBeInRange(60, 1800); // Investigative only; never satisfies the full-duration flag.
         else seconds.ShouldBeInRange(60, 120);
         var output = Environment.GetEnvironmentVariable("OTOPCUA_SDK2_SOAK_OUTPUT")
             ?? throw new InvalidOperationException("An absolute, fresh OTOPCUA_SDK2_SOAK_OUTPUT JSONL path is required.");
@@ -65,7 +63,6 @@ public sealed class Sdk2LifecycleSoakTests
         var cycles = 0;
         var restarts = 0;
         Sample? baseline = null;
-        ExceptionDispatchInfo? firstRejectedBudget = null;
         var retained = new Queue<Sample>();
         try
         {
@@ -103,8 +100,6 @@ public sealed class Sdk2LifecycleSoakTests
                 await ExerciseAsync(rig, config, ++cycles, evidence, ct);
                 await EventuallyAsync(() => PublicCounts(rig) == (0, 0, 0), ct);
                 var sample = await CaptureAsync(rig, config.CertificateManager, watch.Elapsed, cycles, clientRoot, serverRoot, ct);
-                // Retain the failing observation too; rejected diagnostic rows never count as passing quiescent samples.
-                await LogAsync(evidence, new { kind = "resource-observation", resources = sample });
                 sample.Sessions.ShouldBe(0); sample.Subscriptions.ShouldBe(0); sample.Items.ShouldBe(0);
                 sample.BrowsePoints.ShouldBe(0); sample.HistoryPoints.ShouldBe(0);
                 sample.LiveDataItems.ShouldBe(0); sample.LiveEventItems.ShouldBe(0); sample.MonitoredNodes.ShouldBe(0);
@@ -115,22 +110,9 @@ public sealed class Sdk2LifecycleSoakTests
                     sample.CachedCertificateStores.ShouldBe(baseline.CachedCertificateStores);
                     sample.Variables.ShouldBe(baseline.Variables); sample.Folders.ShouldBe(baseline.Folders);
                     sample.Conditions.ShouldBe(baseline.Conditions);
-                    if (firstRejectedBudget is null)
-                    {
-                        try
-                        {
-                            sample.Descriptors.ShouldBeLessThanOrEqualTo(baseline.Descriptors + 32);
-                            sample.ManagedBytes.ShouldBeLessThanOrEqualTo(baseline.ManagedBytes + (64L << 20));
-                            sample.RssBytes.ShouldBeLessThanOrEqualTo(baseline.RssBytes + (128L << 20));
-                        }
-                        catch (ShouldAssertException error) when (mode == "profile")
-                        {
-                            // Investigative sampling may continue after rejection, but can never turn it into a pass.
-                            firstRejectedBudget = ExceptionDispatchInfo.Capture(error);
-                            await LogAsync(evidence, new { kind = "budget-rejected", cycle = cycles,
-                                seconds = watch.Elapsed.TotalSeconds, resources = sample, baseline, failure = error.ToString() });
-                        }
-                    }
+                    sample.Descriptors.ShouldBeLessThanOrEqualTo(baseline.Descriptors + 32);
+                    sample.ManagedBytes.ShouldBeLessThanOrEqualTo(baseline.ManagedBytes + (64L << 20));
+                    sample.RssBytes.ShouldBeLessThanOrEqualTo(baseline.RssBytes + (128L << 20));
                     retained.Enqueue(sample);
                     if (retained.Count > 24) retained.Dequeue();
                     if (retained.Count == 24)
@@ -141,8 +123,7 @@ public sealed class Sdk2LifecycleSoakTests
                             "retained managed memory must not grow monotonically across 24 quiescent cycles");
                     }
                 }
-                await LogAsync(evidence, new { kind = firstRejectedBudget is null ? "quiescent" : "quiescent-budget-rejected",
-                    cycleSeconds = cycle.Elapsed.TotalSeconds, resources = sample });
+                await LogAsync(evidence, new { kind = "quiescent", cycleSeconds = cycle.Elapsed.TotalSeconds, resources = sample });
                 if (cycles % 4 == 0)
                 {
                     var restart = Stopwatch.StartNew();
@@ -152,9 +133,6 @@ public sealed class Sdk2LifecycleSoakTests
                     await LogAsync(evidence, new { kind = "restart", cycles, restarts, seconds = restart.Elapsed.TotalSeconds });
                 }
             }
-            // Preserve the first assertion and its original stack even if later RSS samples decrease.
-            // This happens before any completion record; finally still releases the owned rig and client.
-            firstRejectedBudget?.Throw();
             cycles.ShouldBeGreaterThanOrEqualTo(4, "diagnostic mode must exercise at least one actual restart");
             restarts.ShouldBeGreaterThan(0);
             watch.Elapsed.TotalSeconds.ShouldBeGreaterThanOrEqualTo(seconds);
@@ -443,8 +421,7 @@ public sealed class Sdk2LifecycleSoakTests
         int BrowsePoints, int HistoryPoints, int LiveDataItems, int LiveEventItems, int MonitoredNodes,
         int Variables, int Folders, int Conditions, int CachedCertificateStores,
         int Descriptors, int PkiDescriptors, long ManagedBytes, long RssBytes, long AllocatedBytes,
-        int Gen0, int Gen1, int Gen2, long GcCommittedBytes, long GcHeapBytes, long GcFragmentedBytes,
-        long PinnedObjects, long PendingFinalizers, long JitMethods, long JitIlBytes, long ActiveTimers, int Threads);
+        int Gen0, int Gen1, int Gen2);
 
     private static async Task<Sample> CaptureAsync(ServerEventRig rig, object clientManager, TimeSpan elapsed, int cycle,
         string clientRoot, string serverRoot, CancellationToken ct)
@@ -453,7 +430,6 @@ public sealed class Sdk2LifecycleSoakTests
         var points = rig.Server.CurrentInstance.SessionManager.GetSessions().Select(ContinuationCounts).ToArray();
         var descriptors = await DescriptorCountsAsync(ct, clientRoot, serverRoot);
         var retained = GC.GetTotalMemory(forceFullCollection: true);
-        var memory = GC.GetGCMemoryInfo();
         using var process = Process.GetCurrentProcess();
         process.Refresh();
         return new Sample(cycle, elapsed.TotalSeconds, counts.Sessions, counts.Subscriptions, counts.Items,
@@ -461,10 +437,7 @@ public sealed class Sdk2LifecycleSoakTests
             rig.Nm.MonitoredNodeCount, rig.Nm.VariableCount, rig.Nm.FolderCount, rig.Nm.AlarmConditionCount,
             CertificateCores(rig.Server.CertificateManager!).Sum(CachedStores) + CertificateCores(clientManager).Sum(CachedStores),
             descriptors.Total, descriptors.Pki, retained, process.WorkingSet64, GC.GetTotalAllocatedBytes(),
-            GC.CollectionCount(0), GC.CollectionCount(1), GC.CollectionCount(2), memory.TotalCommittedBytes,
-            memory.HeapSizeBytes, memory.FragmentedBytes, memory.PinnedObjectsCount, memory.FinalizationPendingCount,
-            System.Runtime.JitInfo.GetCompiledMethodCount(), System.Runtime.JitInfo.GetCompiledILBytes(), Timer.ActiveCount,
-            process.Threads.Count);
+            GC.CollectionCount(0), GC.CollectionCount(1), GC.CollectionCount(2));
     }
 
     public static bool DescriptorProbeSupported => OperatingSystem.IsLinux() || OperatingSystem.IsMacOS();