# Independent scripted-alarm scope baseline

This SDK 1.5.378.182-only source probe records the existing opaque-ID behavior
tracked by [#797](https://gitea.dohertylan.com/dohertj2/lmxopcua/issues/797).
It is deliberately outside the candidate solution and is not a runtime adapter.

Use a clean, separate checkout at original application commit
`83ed880e4471344deaf008da9bd028c7e170bdc7`. Confirm its package pins before
running. Copy **only** `ScriptedScopeProbe.cs` temporarily into that checkout's
`tests/Server/ZB.MOM.WW.OtOpcUa.OpcUaServer.IntegrationTests/`, refusing to
overwrite an existing file. Run:

```sh
dotnet test tests/Server/ZB.MOM.WW.OtOpcUa.OpcUaServer.IntegrationTests \
  -c Release --filter FullyQualifiedName~BaselineScriptedScopeProbe \
  --logger trx --results-directory /absolute/fresh-baseline-evidence
```

Preserve the test exit and run the baseline checkout's
`scripts/ci/assert-not-all-skipped.sh` with `MIN_EXECUTED=1` against the fresh TRX.
Remove only the temporary probe you copied after the run, keeping the source
and TRX evidence here/outside the checkout. Verify baseline tracked files remain
unchanged. Never load this assembly or old SDK into the candidate process.

The real session has no application-wide roles. The production-valid opaque
scripted ID is denied by an Equipment grant, routes nothing, and is then allowed
by an explicit Cluster grant. A passing probe pins **both** outcomes; it does not
claim narrow equipment authorization works. The independent candidate counterpart
is `Sdk2OpaqueScriptedScopeBaselineTests`.

Do not make the ID slash-qualified to get a positive result: the current UI
rejects `/`, and that would hide the production scope-resolution defect. A future
fix requires reviewed ownership/scope binding without changing opaque IDs or
widening permissions. This upgrade preserves the baseline denial and links the
separate defect.