This isolated process references the real ScadaBridge OpcUaDataConnection and RealOpcUaClient, with their own dependency graph. It never loads the candidate SDK into that process. The verified consumer source is 0e89966da670e289bd875166295bb0e85d8cf8b2, pinned to SDK 1.5.378.106.

Build with an explicit clean consumer checkout:

dotnet build scripts/validation/scadabridge-sdk-compatibility/Probe.csproj \
  -c Release -p:ScadaBridgeSourceRoot=/absolute/ScadaBridge

First build the separate application hosts with the parent scripts/e2e/test-opcua-sdk-compatibility.ps1 harness. Then choose a new output directory and pass its original and candidate ProcessHost.dll paths:

python3 scripts/validation/scadabridge-sdk-compatibility/run.py \
  --baseline-host /absolute/matrix/build-baseline/bin/Release/net10.0/ProcessHost.dll \
  --candidate-host /absolute/matrix/build-candidate/bin/Release/net10.0/ProcessHost.dll \
  --probe scripts/validation/scadabridge-sdk-compatibility/bin/Release/net10.0/Probe.dll \
  --results /absolute/fresh-consumer-evidence

The helper runs four separate consumer/server pairs: each application version with None and SignAndEncrypt. None is enabled only in its own test fixture; the ordinary compatibility host remains strict SignAndEncrypt. The task key is generated per process pair, issuer/trusted/rejected stores are task-local, and server public certificates are explicitly copied. Autoaccept remains false. Never commit an entire output directory: it contains the fixture's private PKI.

The consumed subset covers API-key activation, raw/UNS scalar and Int32[] roundtrips, durable hierarchical browse including the native alarm, data quality and timestamps, alarm filter/ConditionRefresh and disconnect/reconnect. History and Part 9 acknowledgment are not exposed by the inspected consumer interfaces; the parent Shared/CLI matrix covers those application services instead.

ScadaBridge#121 is a reproduced preexisting limitation: SignAndEncrypt fails against both original and candidate servers because the consumer does not configure an application certificate. A matching baseline failure is evidence, not a secure-channel pass. The runner retains the nonzero result and each actual failure; it does not loosen trust or change expected results to return success. The current None subset and the missing secure identity must be reported separately. No ScadaBridge production source or user PKI is modified.