lmxopcua/archreview/07-client-tooling-engineering.md

Architecture Review 07 — Client Tooling, Analyzers, and the Cross-Cutting Engineering System

Date	2026-07-12
Commit	f6eaa267 (master, clean tree)
Reviewer	Architecture review agent (deep-review sweep, slice 07 — re-run)
Supersedes	The 2026-07-08 review of this domain at 9cad9ed0. All arch-review remediation branches have since merged to master (~40 commits), including the three squarely in this slice: f0082af5 (07/C-1 analyzer wiring + triage), 10b89830 (07/S-1,S-2,S-4 CI overhaul), and bacea1a4 (#10 dispatch-gap closure, which removed the C-1 triage pragmas). Also landed: the /fixdocs XML-doc sweep 3b5ef439 and the HistorianGateway client 0.1.0→0.2.0 bump f6eaa267.
Scope	src/Client/* (Client.CLI, Client.Shared, Client.UI) + tests/Client/*; src/Tooling/ZB.MOM.WW.OtOpcUa.Analyzers + tests/Tooling/*; cross-cutting: Directory.Build.props, Directory.Packages.props, NuGet.config, ZB.MOM.WW.OtOpcUa.slnx, .github/workflows/, ci/, scripts/, docker-dev/, overall test architecture, docs freshness, repo-root hygiene

---

Prior-finding status (9cad9ed0 → f6eaa267)

Verified against actual code/tree state, not remediation claims. src/Client production code is byte-identical to the prior baseline (zero commits touched it), so every client-code finding carries over verbatim.

ID	One-liner (prior)	Verified status
S-1	CI gated ~15% of the test matrix (5-project hand-maintained matrix)	FIXED — v2-ci.yml:58-62 runs one whole-solution leg dotnet test ZB.MOM.WW.OtOpcUa.slnx --filter "Category!=E2E&Category!=LiveIntegration" (10b89830, merged 83fdf5fa). Self-maintaining; all 47 test csprojs in the slnx are covered, including Client (388) + Analyzers (32). Residual: the first actual CI run of this pipeline post-push was not observable from this review — YAML is statically well-formed; the mixed xunit v3/2.9.2 whole-solution run was verified locally per the commit, not on a runner.
S-2	Green CI == skipped integration tests, indistinguishable from pass	PARTIALLY FIXED — new scripts/ci/assert-not-all-skipped.sh gate: strict (MIN_EXECUTED=1) on the unit leg (v2-ci.yml:66-68), report-only (MIN_EXECUTED=0) on the fixtureless integration leg (v2-ci.yml:102-106) with a documented follow-up to run opc-plc as a workflow services: and flip it strict. All-skipped can no longer masquerade as green on the unit leg; the integration tier is still green-while-skipped by explicit, commented design. See new S-9 (threshold coarseness) and P-5 (the leg is now redundant).
S-3	Nightly E2E workflow is a permanent green no-op	STILL OPEN — v2-e2e.yml unchanged since baseline (git diff empty); zero tests carry Category=E2E (grep re-verified).
S-4	Fixed-sleep timing tests are the dominant wait style	PARTIALLY FIXED — the 11 Client.CLI.Tests startup sleeps were replaced with SubscribeInvoked/SubscribeAlarmsInvoked TaskCompletionSource readiness signals (FakeOpcUaClientService.cs:57,60, 10b89830); the one remaining Task.Delay(25) (SubscribeCommandSummaryTests.cs:262) is a bounded poll-until-predicate helper, not a fixed startup sleep — fine. Driver-suite fixed sleeps remain (see body) and are now CI-exercised by S-1's fix, so their flake risk is live.
S-5	Client.Shared subscription lock-discipline gaps	STILL OPEN — OpcUaClientService.cs:262 (unguarded null-check/create), :695-696 (failover nulls outside the lock), UnsubscribeAlarmsAsync not routed through the semaphore. File untouched since baseline.
S-6	Global Log.Logger swap per CLI command	STILL OPEN — CommandBase.cs:123,133 unchanged.
S-7	No global.json, but v2-ci.yml claims one pins the SDK	STILL OPEN — no global.json at root; notably the false claim survived the workflow rewrite (v2-ci.yml:10-12 still says "pinned via global.json"). The Roslyn 5.0.0 pin rationale in Directory.Packages.props still depends on an exact SDK band.
S-8	First-caller interval wins for the shared data subscription	STILL OPEN — OpcUaClientService.cs:262.
P-1	7 uncached restore+build passes per CI push	PARTIALLY FIXED — matrix collapse reduced it to 4 passes (build + unit + 2 integration legs); still no actions/cache for NuGet, and the build job's output is still discarded (every downstream job restores + rebuilds).
P-2	Recursive browse is N+1 over HasChildrenAsync	STILL OPEN — OpcUaClientService.cs:230-231, SubscribeCommand.cs serial walk; unchanged.
P-3	(positive) probe-once integration-fixture pattern	STILL VALID — unchanged; now doubly relevant since these fixtures probe (and skip) inside the CI unit leg.
P-4	Unbounded channel in CLI subscribe output	STILL OPEN (cosmetic) — unchanged.
C-1	Custom analyzer wired into zero projects	FIXED — Directory.Build.props:45-51 injects the analyzer as OutputItemType="Analyzer" into every project except the analyzer + its tests (f0082af5). Triage verified scoped and honest: 12 wire-level test/CLI csprojs carry commented NoWarn (6 driver CLIs, AbCip/S7 unit+integration suites, ScriptedAlarms/VirtualTags tests); 3 driver-internal-self-call pragmas + 1 test-only-scaffolding pragma (GenericDriverNodeManager.cs:71) remain, each with rationale. The 6 RESILIENCE-DISPATCH-GAP pragmas the wiring surfaced were removed by the follow-on bacea1a4, which actually wired CapabilityInvoker into dispatch via a Polly-free IDriverCapabilityInvoker seam — grep for RESILIENCE-DISPATCH-GAP now matches only the Runtime guard test. Negative control (unwrap → build error in Runtime) documented in both commits. Residual enforcement caveat: see new C-7.
C-2	TWE never reached Client/Tooling src (or most tests)	STILL OPEN — zero TreatWarningsAsErrors in src/Client/*/*.csproj or src/Tooling/*/*.csproj; still 9/47 test projects opted in. Now also weakens C-1's enforcement (C-7).
C-3	(positive) CPM discipline + valid audit carve-out	STILL VALID — NuGetAuditSuppress for GHSA-2m69-gcr7-jv3q still present and still accurate (Directory.Build.props:19-32); only package change since baseline is HistorianGateway Client/Contracts 0.1.0→0.2.0 (f6eaa267), pinned as before.
C-4	3 legacy xunit 2.9.2 holdouts	STILL OPEN — AdminUI.Tests, ControlPlane.Tests, Runtime.Tests still reference xunit 2.9.2 (Directory.Packages.props:108).
C-5	No .editorconfig; StyleGuide.md says "ScadaBridge"	STILL OPEN — no .editorconfig; StyleGuide.md:3 still reads "for all ScadaBridge documentation".
C-6	csproj boilerplate duplicates Directory.Build.props	STILL OPEN — unchanged.
U-1	(positive) Client.UI is real and maturing	STILL VALID — unchanged (126 headless tests); now actually run by CI.
U-2	Coverage matrix: Host has no unit tier	STILL OPEN, partially mitigated — no Host.Tests project exists. However the wiring-bug class U-2 worried about gained two targeted guards on master: ResilienceInvokerFactoryRegistrationTests (Host.IntegrationTests, 8a8b9ec5 — asserts prod DI binds the real invoker factory) and the reflection-exhaustive DeferredSinkForwardingReflectionTests (Commons.Tests, a65c2ced). A general Host DI-composition unit tier is still the right ask.
U-3	docs/Client.CLI.md documents 8 of 14 commands	STILL OPEN — ack/confirm/shelve/enable/disable still have zero sections in docs/Client.CLI.md (grep re-verified; the /fixdocs sweep 3b5ef439 touched only XML doc comments in S7/TwinCAT/Core, not this).
U-4	Root planning-file sprawl contradicts its own rules	STILL OPEN — looseends.md, pending.md, current.md, stillpending.md, HISTORIAN-GATEWAY-INTEGRATION-ISSUES.md all still tracked (git ls-files re-verified), including the two pending.md itself forbids staging.
U-5	7 orphaned proprietary AVEVA DLLs tracked in lib/	STILL OPEN — all 7 DLLs still in git ls-files lib/; still zero HintPath references.
U-6	sql_login.txt local-only; Wonderware husk dirs on disk	STILL OPEN (Low, local-only) — sql_login.txt still untracked+gitignored but present on disk; the 5 retired Driver.Historian.Wonderware* dirs still exist as ignored husks under src/Drivers/ + tests/Drivers/; export-clean-copy.bat still has no explicit sql_login exclusion.
U-7	Missing CI stages inventory	PARTIALLY FIXED — the two biggest items (analyzer enforcement, all unit suites) are now CI-gated via C-1 + S-1. Still absent: dotnet format/style, explicit NuGet-audit failing step, scripts/check-code-reviews-readme.ps1, docs link/freshness check, and the ci/ab-server.lock.json download step referenced by docs/v2/test-data-sources.md.
U-8	CLI security posture is dev-tool-grade	STILL OPEN — ConnectionSettings.AutoAcceptCertificates still defaults true (Models/ConnectionSettings.cs:41), -P still argv-visible; undocumented in Client.CLI.md.

Net: 2 FIXED (S-1, C-1 — the two Highs), 4 PARTIALLY FIXED (S-2, S-4, P-1, U-7), 17 still open/unchanged (all Medium/Low), 3 positives still valid. Every remediation claim in archreview/plans/STATUS.md that touches this slice checked out against the code, including the adversarial checks (suppressions are scoped and commented; the skip-gate is genuinely strict on the unit leg; the dispatch-gap pragmas are genuinely gone, not relocated).

---

Architecture Overview

Client stack

Three projects form a clean layered client stack, all .NET 10 — unchanged since the prior review (zero src/Client commits in the window):

• Client.Shared — the OPC UA client library. OpcUaClientService (src/Client/ZB.MOM.WW.OtOpcUa.Client.Shared/OpcUaClientService.cs, 975 lines) implements IOpcUaClientService behind five adapter seams (IApplicationConfigurationFactory, IEndpointDiscovery, ISessionFactory, ISessionAdapter, ISubscriptionAdapter under Adapters/) so the OPC Foundation SDK is fully fakeable. The service owns connect/disconnect, read/write with string→typed coercion, browse with continuation points, data + alarm subscriptions with failover replay, Part 9 alarm method calls, HistoryRead (raw + aggregate), and redundancy-info reads.
• Client.CLI — CliFx-based terminal client (otopcua-cli), 14 commands, session-per- invocation. CommandBase centralises connection options and (still) swaps the global Serilog Log.Logger per execution (S-6).
• Client.UI — Avalonia 11.2 desktop app (CommunityToolkit.Mvvm), ~2.9 k LOC C# + 551 lines AXAML, 126 headless tests. Real, not vestigial (U-1).

Tooling

src/Tooling/ZB.MOM.WW.OtOpcUa.Analyzers ships OTOPCUA0001 UnwrappedCapabilityCallAnalyzer — and it is now wired into every project in the tree via Directory.Build.props:45-51 (OutputItemType="Analyzer", excluding only the analyzer and its own test project). The rule it enforces is also now true: bacea1a4 wired CapabilityInvoker into production dispatch through a new IDriverCapabilityInvoker/IDriverCapabilityInvokerFactory seam in Core.Abstractions (mirroring IDriverFactory, because Runtime is deliberately Polly-free), routed all 6 DriverInstanceActor dispatch sites through it, taught the analyzer that the interface is a valid wrapper home, and deleted the 6 tracked-gap pragmas. 32 analyzer tests. The prior review's headline failure mode for this slice — "built and tested but plugged into nothing" — is closed, with the analyzer itself as the standing regression guard (error-severity where TWE is on; see C-7).

Test architecture map

47 test projects (verified: git ls-files 'tests/**/*.csproj' | wc -l = 47) mirror src/ under tests/<module>/ in three tiers:

1. *.Tests — pure unit suites, 40 projects; xunit.v3 + Shouldly except three xunit 2.9.2 holdouts (AdminUI.Tests, ControlPlane.Tests, Runtime.Tests).
2. *.IntegrationTests — 10 projects, probe-once collection fixtures defaulting to the shared Docker host 10.100.0.35, Assert.Skip when unreachable.
3. Category=LiveIntegration — env-gated live suites (skip-clean offline).
4. Category=E2E — still reserved; still zero tests carry it (S-3).

Build / CI pipeline shape (changed since 2026-07-08)

• Directory.Build.props — global net10.0/nullable/implicit-usings/latest, the CVE-2025-6965 NuGetAuditSuppress carve-out (still valid, C-3), and new: the tree-wide OTOPCUA0001 analyzer injection (lines 34-51). TWE remains opt-in per project.
• Directory.Packages.props — CPM, all versions pinned; only delta since baseline is the HistorianGateway Client/Contracts 0.1.0→0.2.0 bump (f6eaa267).
• CI (v2-ci.yml, rewritten by 10b89830): build → one whole-solution unit leg (dotnet test ZB.MOM.WW.OtOpcUa.slnx --filter "Category!=E2E&Category!=LiveIntegration", trx logger, strict fail-on-skip gate) → the old 2-project integration matrix (same filter, report-only skip gate). New scripts/ci/assert-not-all-skipped.sh parses trx <Counters> and fails when executed < MIN_EXECUTED.
• v2-e2e.yml — untouched; still the documented nightly green no-op (S-3).
• docker-dev/ — the compose gained a real fix in the window (7233e2ba): the retired Wonderware ServerHistorian keys were replaced with the gateway shape (Endpoint/ApiKey/UseTls, disabled by default) after they were found to crash the Host at bring-up — a live-gate catch, exactly the failure mode this review series exists for.

---

Findings

Severity scale: Critical (broken now, corrupts trust) / High (material gap, fix soon) / Medium (real debt) / Low (polish).

Fixed prior findings (S-1, C-1) live only in the status table above. Still-open findings keep their IDs; new findings continue each scheme's numbering.

1. STABILITY

S-3 (Medium) — the nightly E2E workflow is still a permanent green no-op

v2-e2e.yml:6-10 unchanged: the E2E test project "does not yet exist… this workflow is a green no-op", and no test in the tree carries Category=E2E. Now that the unit tier is genuinely gated (S-1 fixed), this is the largest remaining "always-green" surface. Recommendation: land the minimal E2E round-trip project (the scripts/e2e/test-*.ps1 harnesses show what to assert) or disable the schedule until it exists.

S-4 (Medium, narrowed) — driver-suite fixed sleeps are now CI-exposed flake risk

The Client.CLI half of this finding is fixed (readiness signals, 10b89830). What remains: Driver.Galaxy.Tests (30 Task.Delay/Thread.Sleep occurrences), Driver.Modbus.Tests (22), Driver.AbCip.Tests (20), Driver.FOCAS.Tests (18), Host.IntegrationTests (15), Driver.TwinCAT.Tests (7). Before S-1's fix these never ran in CI; now they run on every push, so their fixed-delay assumptions will meet loaded shared runners for the first time. Recommendation: watch the first weeks of whole-solution CI for flaky suites and apply the same readiness-signal pattern (the FakeOpcUaClientService.SubscribeInvoked TCS is the template) to whichever driver suites actually flake — don't pre-emptively rewrite all ~112 sites.

S-5 (Medium) — Client.Shared subscription bookkeeping still has lock-discipline gaps

Unchanged from the prior review (src/Client had zero commits in the window):

• SubscribeAsync checks/creates the shared _dataSubscription outside the lock (OpcUaClientService.cs:262) — two concurrent first-subscribers can leak an SDK subscription.
• RunFailoverAsync nulls _dataSubscription/_alarmSubscription without the lock (lines 695-696), contradicting DisconnectAsync's stated assumption (lines 138-140).
• UnsubscribeAlarmsAsync does not take _alarmSubscribeSemaphore.
• Keep-alive failover remains fire-and-forget with an unobserved exception path out of TransitionState. Near-unhittable for the session-per-command CLI; real for long-lived Client.UI usage. Recommendation unchanged: small async gate around the data-subscription create, take the lock in RunFailoverAsync, route alarm-unsubscribe through the semaphore.

S-6 (Medium) — global Log.Logger swap per CLI command

Unchanged: CommandBase.cs:123 (Log.CloseAndFlush()) + :133 (static Log.Logger replacement) per command execution. Race for parallel test collections; hostile to embedding. Recommendation: per-execution instance ILogger.

S-7 (Low) — no global.json, and the workflow's claim survived its own rewrite

Still no global.json; v2-ci.yml:10-12 — a file otherwise rewritten in this window — still asserts "The .NET 10 SDK is pinned via global.json at the repo root". The Microsoft.CodeAnalysis.CSharp 5.0.0 pin (Directory.Packages.props) still assumes an exact SDK band. Recommendation: add global.json (rollForward: latestFeature) or fix the comment.

S-8 (Low) — first-caller interval wins for the shared data subscription

Unchanged (OpcUaClientService.cs:262). Document or create per-interval subscriptions.

S-9 (Low, NEW) — the strict skip-gate threshold is MIN_EXECUTED=1, which only catches total outage

scripts/ci/assert-not-all-skipped.sh:19 defaults the floor to 1 executed test, and the unit leg uses that default (v2-ci.yml:66-68). A whole-solution run currently executes thousands of tests; a partial discovery outage (e.g. an adapter regression that silently drops the xunit 2.9.2 or the xunit.v3 population, or a filter typo that matches one project) would still pass the gate while losing 95%+ of coverage. The gate as shipped converts "green == nothing ran" into red — genuinely valuable — but "green == almost nothing ran" is still possible. Recommendation: raise the unit-leg floor to a conservative constant (e.g. MIN_EXECUTED=1500 today, revised occasionally), which costs nothing and catches the partial-outage class too.

2. PERFORMANCE

P-1 (Medium, narrowed) — CI still does 4 independent uncached restore+build passes per push

Improved from 7 legs to 4 (build, unit-tests, 2× integration), but each job still checks out, restores, and rebuilds from scratch; the dedicated build job's output is still discarded; there is still no actions/cache for ~/.nuget/packages. Recommendation: cache the NuGet folder keyed on Directory.Packages.props; consider dropping the redundant integration matrix (P-5), which removes half the remaining waste for free.

P-2 (Low) — recursive browse is N+1 over HasChildrenAsync

Unchanged (OpcUaClientService.cs:230-231; SubscribeCommand serial tree walk). Acceptable for a diagnostic tool.

P-3 (Low, positive) — integration-fixture cost is well-engineered

Unchanged and now more load-bearing: the probe-once collection-fixture pattern is what makes the whole-solution CI leg viable at all (10 IntegrationTests projects probe 10.100.0.35 once each and skip, rather than timing out per test).

P-4 (Low) — CLI subscription output path is allocation-sane

Unchanged; the unbounded channel remains a cosmetic cap-it-later.

P-5 (Low, NEW) — the CI integration matrix is now fully redundant with the unit leg

The whole-solution unit leg (v2-ci.yml:58-62) already builds and runs Host.IntegrationTests and OpcUaServer.IntegrationTests under the identical filter — so the integration job (v2-ci.yml:77-106) re-restores, re-builds, and re-runs the same two projects in the same fixtureless environment, producing the same skips, twice per push. Its only unique output is a per-project skip tally that the unit leg's trx already contains. (Note Host.IntegrationTests is not pure skip — its in-process 2-node Akka harness tests, e.g. HardKillFailoverTests and ResilienceInvokerFactoryRegistrationTests, actually execute — but they execute in both jobs.) Recommendation: either delete the matrix, or make it earn its keep by becoming the S-2 option-#2 leg: add the mcr.microsoft.com/iotedge/opc-plc services: block, set OPCUA_SIM_ENDPOINT=localhost:50000, and flip its gate to strict — then it covers something the unit leg cannot.

3. CONVENTIONS

C-2 (Medium) — TreatWarningsAsErrors still never reached the Client/Tooling slice (or most tests)

Unchanged: Client.CLI.csproj, Client.Shared.csproj, Client.UI.csproj, and Analyzers.csproj still lack TWE; still 9/47 test projects opted in. The prior argument stands (the client stack is v2-era code with no xUnit1051 legacy), and the stakes rose slightly: TWE is now also the mechanism that gives OTOPCUA0001 teeth (C-7). Recommendation: add TWE to the four src projects now; burn down test debt per module.

C-3 (Low, positive) — central package management discipline remains exemplary

Re-verified at f6eaa267: CPM pinned throughout, packageSourceMapping intact, the GHSA-2m69-gcr7-jv3q NuGetAuditSuppress still present/scoped/accurate with its removal condition (Directory.Build.props:19-32), the OpenTelemetry + Tmds.DBus.Protocol surgical pins unchanged. The only version delta in the window (HistorianGateway 0.1.0→0.2.0) followed the pattern. Keep the removal reminders alive.

C-4 (Low) — three xunit 2.9.2 holdouts remain

Unchanged: AdminUI.Tests, ControlPlane.Tests, Runtime.Tests still on xunit 2.9.2 (Directory.Packages.props:108). Now mildly riskier than before: the whole-solution CI leg runs a mixed v3/2.x population through one dotnet test invocation, so the holdouts are a moving part in the new pipeline. Finish the migration and drop the pin.

C-5 (Low) — still no mechanical code-style enforcement; StyleGuide.md still says "ScadaBridge"

Unchanged: no .editorconfig, no dotnet format CI step, StyleGuide.md:3 still carries the sister-repo product name.

C-6 (Low) — csproj boilerplate still duplicates Directory.Build.props

Unchanged; strip TargetFramework/Nullable/ImplicitUsings restatements on next sweep.

C-7 (Low, NEW) — OTOPCUA0001 enforcement strength is TWE-dependent, so the analyzer is warning-only exactly where TWE is missing

The analyzer ships OTOPCUA0001 at Warning severity; it fails builds only in projects with TreatWarningsAsErrors (e.g. Runtime, where the bacea1a4 negative control proved unwrap→build-error). That covers the real dispatch surface today — Core/Server/Runtime/Driver src projects are TWE'd (63 src csprojs opted in). But in the C-2 gap set (Client/Tooling src, 38 test projects) a new unwrapped capability call surfaces as a non-failing warning that whole-solution CI output will bury. Low because no plausible dispatch code lives in those projects today; listed so the interaction is on record: closing C-2 is also what hardens C-1's guard, and if TWE promotion stalls, an alternative is escalating OTOPCUA0001 to error-by-default in the analyzer itself (its intentional-call story is now mature enough — scoped pragmas + documented NoWarn projects).

4. UNDERDEVELOPED AREAS

U-1 — Client.UI maturity: real product, adequately tested, current docs

Verdict unchanged: not vestigial (~2.9 k LOC, 126 headless tests, accurate docs/Client.UI.md). Upgrade since the prior review: those 126 tests now actually run in CI on every push. The AXAML-binding blind spot (headless tests can't catch binding regressions — the AdminUI "live-verify" lesson) still applies.

U-2 (Medium) — source → test coverage: Host still has no unit tier

The matrix is otherwise unchanged and nearly complete (Contracts projects remain DTO-only with consuming-suite coverage; Core.Scripting.Abstractions remains incidental). Host is still the one real hole — no tests/Server/*Host.Tests exists. Two mitigations landed in the window and narrow the risk without closing it: ResilienceInvokerFactoryRegistrationTests (tests/Server/ZB.MOM.WW.OtOpcUa.Host.IntegrationTests/ResilienceInvokerFactoryRegistrationTests.cs, asserts production DI binds the real invoker factory — precisely the PR-#423-class dormancy check this finding asked for, albeit living in the integration project) and the reflection-exhaustive deferred-sink forwarding guard (Commons.Tests). Recommendation stands: a lightweight Host.Tests asserting DI composition claims (ServerHistorian:Enabled ⇒ GatewayTagProvisioner, etc.) at unit speed.

U-3 (Medium) — docs drift: docs/Client.CLI.md still documents 8 of 14 commands

Re-verified: ack, confirm, shelve, enable, disable still have zero sections (the only grep hits are incidental words in the alarms section), while CLAUDE.md still points readers at this doc for those commands. The window's doc work (3b5ef439) was XML-comment-only and did not touch this. The "104 unit tests" claim remains accurate (re-counted: 104). Recommendation: add the five missing command sections — they are the operator-facing alarm workflow.

U-4 (Medium) — repo-root planning-file sprawl still contradicts its own rules

Unchanged: looseends.md, pending.md, current.md, stillpending.md, HISTORIAN-GATEWAY-INTEGRATION-ISSUES.md all still tracked at the root, and pending.md still declares the hard rule against staging pending.md/current.md — which remain tracked. No remediation branch addressed this (as expected — it had none). Recommendation unchanged: move under docs/plans/ with dated names, or delete + gitignore.

U-5 (Medium) — orphaned proprietary AVEVA DLLs still tracked in lib/

Unchanged: all 7 vendor binaries (aahClient*.dll, ArchestrA.MXAccess.dll, ArchestrA.CloudHistorian.Contract.dll, Historian.CBE.dll, Historian.DPAPI.dll) still in git ls-files lib/, still zero HintPath references repo-wide. Redistribution/licence risk in every clone. Recommendation: git rm -r lib/.

U-6 (Low) — local-only hygiene: sql_login.txt and Wonderware husk dirs

Unchanged: sql_login.txt remains untracked + gitignored (.gitignore:47) but is still a plaintext credential on disk at the root; export-clean-copy.bat still lacks an explicit exclusion for it. The five retired Driver.Historian.Wonderware* directories still exist on disk as ignored bin/obj husks — safe to delete locally.

U-7 (Low, narrowed) — missing CI stages inventory

The two biggest gaps closed (analyzer enforcement via C-1's fix; all unit suites via S-1's). Still not gated anywhere: dotnet format/style (blocked on C-5's missing .editorconfig), an explicit failing NuGet-audit step, scripts/check-code-reviews-readme.ps1, docs link/freshness checks, and the ci/ab-server.lock.json fixture-download step that docs/v2/test-data-sources.md still describes as an existing "GitHub Actions step".

U-8 (Low) — CLI security posture is dev-tool-grade by construction

Unchanged: ConnectionSettings.AutoAcceptCertificates defaults true (Models/ConnectionSettings.cs:41, flowed through DefaultApplicationConfigurationFactory.cs:53,63), -P is argv-visible, and the Galaxy-specific alarm attribute names remain baked into the generic Client.Shared fallback path. Document the posture; add a --strict-certs opt-in.

U-9 (Low, NEW) — archreview/plans/STATUS.md merged to master still claims nothing is merged

The remediation handoff doc now lives on pushed master, but its topology header still reads "Branch topology (all LOCAL — nothing pushed, nothing on master)" (STATUS.md:6) and the resume facts still assert "Nothing is pushed. 8 local branches" (STATUS.md:109) — both now false (all listed branches are merged; master is pushed). Same class as the S-7 comment drift: a bookkeeping doc that contradicts observable reality erodes trust in the parts that are still accurate (e.g. the genuinely-pending #10 live behavioral gate). Recommendation: one-paragraph update to STATUS.md marking the topology section historical and recording the merge date.

---

Maturity Ratings (1 = ad hoc, 5 = exemplary)

Dimension	2026-07-08	2026-07-12	Justification
Stability	2.5	3.5	The two structural holes are closed: CI now runs the whole solution (S-1) and all-skipped can't masquerade as green on the unit leg (S-2 strict gate); the newly-CI'd CLI suite was deflaked in the same change. Held below 4 by the still-no-op nightly E2E (S-3), the now-CI-exposed driver-suite fixed sleeps (S-4), the untouched Client.Shared lock gaps (S-5), and a first post-push CI run not yet observed.
Performance	3.5	3.5	Net wash: matrix collapse cut CI legs 7→4, but restore/build remains uncached, the build job's output is still discarded, and the integration matrix now duplicates work the unit leg already does (P-5). Client-side perf posture unchanged.
Conventions	3	4	The flagship convention tool went from wired-into-nothing to enforced tree-wide with a proven negative control — and the gap it surfaced (RESILIENCE-DISPATCH-GAP) was actually fixed rather than pragma'd away, with the analyzer left as the standing guard. Suppressions are scoped and commented. Held below 4.5 by the TWE gap that leaves the analyzer warning-only outside the TWE'd projects (C-2/C-7), three xunit 2.x holdouts, and still no .editorconfig.
Underdeveloped areas	3	3	Nothing in this bucket moved: lib/ DLLs, root planning-file sprawl, the 5-command docs drift, and the missing Host unit tier are all exactly as found (none had a remediation branch), and the merged STATUS.md added a new small drift (U-9). Partial credit for the two Host-wiring guard tests that landed en route.

---

Top recommendations (ordered)

1. Delete the tracked lib/ vendor DLLs (U-5) and resolve the root planning-file contradiction (U-4) — the two remaining findings with licence/trust implications, both zero-risk removals.
2. Add the five missing alarm-command sections to docs/Client.CLI.md (U-3).
3. Make the CI integration matrix earn its keep or delete it: add the opc-plc services: fixture + flip its skip-gate strict (P-5, completing S-2), and raise the unit-leg MIN_EXECUTED floor above 1 (S-9).
4. Add TWE to the four Client/Tooling src projects (C-2) — this is also what gives OTOPCUA0001 build-breaking teeth there (C-7).
5. Add global.json and fix the workflow comment (S-7); update the stale STATUS.md topology claims (U-9).
6. Fix the three OpcUaClientService lock-discipline gaps before Client.UI grows long-lived multi-thread usage (S-5); land Host.Tests (U-2).
7. Watch the first weeks of whole-solution CI for driver-suite sleep flakes (S-4) and either land a real E2E project or disable the nightly no-op (S-3).