lmxopcua/scripts/validation/opcua-lifecycle-memory/RESOLUTION.md

# Issue #799 resolution gates

Status: prospective procedure under review, **not approved for launch**. The
retained cold failures remain failures. This document does not change the plan's
resource budgets, establish a replacement baseline, or authorize release.

## Separate the evidence

| Question | Evidence required | Current boundary |
|---|---|---|
| Finite generated-code startup | Fixed canonical operation sequence and bounded, lossless trace windows | Candidate saturation met the selected factory criterion. Summed native MethodSize does not explain all RSS. |
| Cross-version lifecycle ownership and memory | Equivalent operations, token invalidation, dropped harness roots, resource-owner checks and matched executable hosts | Original closed objects retain continuation lists while held by the harness; usable steady-state comparison is not established. |
| Continuing macOS native retention | Private-key import attribution, bounded native inventory, supported ownership correction and verification | Balanced managed disposal alone has not stopped Apple Security object accumulation. Linux results cannot close this component. |

The coordinator owns integration and long executions. Two independent Sol agent
lanes own `baseline-canonical/` and `native-retention/` respectively; use high
effort for control implementation and ownership analysis. Astra at xhigh reviews
each control design, its result, any production correction, and the complete
acceptance procedure before execution. No worker changes the other lane's files,
production factory architecture, immutable baseline, or acceptance denominator.

## Short controls before a new long run

The original-SDK lane must demonstrate removal from SessionManager, rejection of
the old authentication token, and rejection of old browse/history continuation
tokens from a fresh session. A helper boundary must drop all strong Session,
continuation and harness references before bounded GC/weak-reference observations.
Observe closed-session/point weak references while the same host remains live,
then separately observe application/validator/store roots after normal host stop;
teardown must not hide retention of closed sessions. Inventory separately
identifies which resource owner releases each object.
Retain the earlier held-object failure. Do not explicitly dispose abandoned
objects or clear caches merely to make the baseline pass. Unsupported original
ownership probes remain unsupported, rather than being reported as zero.

The native lane must attribute configured-store private-key loads separately
from public certificate and shared-handle operations using fixed counts and
identical certificates. Include a separate bounded store-update semantic control
so registry reuse cannot silently bypass configured-store rotation. Review exact
SDK 2.0.1 public ownership seams before any
application correction. A supported correction needs a failing-before/passing-
after ownership control and preserved trust, private-key availability, reconnect
and shutdown behavior. Custom crypto, copied transport negotiation, SDK forks,
factory substitution and certificate-policy changes require a separate design;
they are not fixes authorized by this procedure. Keep private PKI out of Git.

## Prerequisites for reviewing warmed acceptance

1. Establish operation/status/order parity and semantically valid close/ownership
   checks across versions. Match executable host, runtime, architecture and
   instrumentation. A growing original process is not an accepted denominator.
2. Freeze source commits, all artifact hashes, runtime/image identities, private
   PKI identity, fixtures and the serial same-host schedule before launch.
3. Submit the actual harness change, negative controls and immutable artifact
   receipts to Astra. Approval of diagnostics is not approval of acceptance.
4. Resolve continuing macOS native growth independently. A Linux acceptance run
   cannot waive it, even if the Linux resource guard passes.

Before this draft becomes executable, define version-appropriate standard-node
loading/factory trace coverage for the original binary. The absence of SDK2's
`Opc.Ua.OpcUaExtensions` type must not let the original pass an irrelevant zero
counter. Also predeclare identical retained-managed/GC and RSS sampling cadence
and statistics, including exactly which samples feed the relative 15% comparison.
These details remain pending; observed results cannot select them retroactively.

## Proposed fixed warmup and measurement

This section is a review proposal only. If the prerequisites and Astra gate pass,
qualification uses exactly 384 canonical cycles / 96 restarts plus one settling
cycle within 1,800 seconds. The fixed trace windows are cycles 321–352 and
353–384, with the continuous veto across their boundary. Require zero generated-
factory JIT/load events, zero new SDK assembly loads and zero lost events. Reject
missing markers, wrong identity or observer faults. Do not extend or retry the
qualification until a favorable sample appears.

Prospectively select exactly the post-cycle-385 sample as the measurement
baseline; do not choose a minimum, median or later sample from observed RSS.
Retain all cold, peak and rejected rows. Measurement must then last at least
7,200 actual seconds **after** warmup, retaining the +64 MiB managed, +128 MiB
RSS and +32 descriptor caps, all canonical operations and semantic/native/
ownership guards. Latch the first failure permanently. No resource resets,
skipped operations or completion claim on a rejected run.
Setup, warmup and final cleanup do not count toward measurement duration. Final
shutdown and ownership checks are mandatory after that duration completes.

For uninstrumented acceptance, first perform an identical fresh paired
qualification rehearsal, then use the fixed warmup without EventPipe or
allocation StackTrace tracking. The earlier tracked candidate run cannot be
relabelled as this evidence. Predefine sampling and statistics for at least three
matched representative runs to assess the separate plan-relative throughput,
latency, allocation and RSS budgets. A two-hour absolute-cap pass alone does not
satisfy those comparisons.

Only verified results meeting these distinct requirements can support closing
#799. Keep #782 G4 and draft PR #802 on hold until their remaining gates also
pass; Windows/runtime and licensed interoperability evidence remain separate.