lmxopcua/scripts/validation/opcua-lifecycle-memory/baseline-canonical/OWNERSHIP.md

# Original close semantics and bounded retention controls

These are separately reviewed short controls against the unchanged 83ed880e
publication, SDK 1.5.378.182. They do not replace the historical `(1 browse,
6 history)` held-list port comparison, change an oracle, approve a memory
baseline, or claim an unbounded leak. The operation deadline is 120 seconds;
normal shutdown/private-directory cleanup has independent 20/20/5/5-second
bounds, and the semantic runner has a final 180-second process bound.

## What was tested

A fresh fixture creates the original production host, encrypted opc.tcp client,
one abandoned browse point and six event-history points. After normal client
CloseAsync, the control verifies removal from the same running SessionManager.
The old closed object still exposes `(1,6)` while explicitly held, as previously
recorded; that observation is not treated as live protocol ownership.

A fresh valid session supplies the same open raw transport for all following
requests. `ITransportChannel.SendRequestAsync` receives explicit request headers;
no closed Session client guard or ClientBase header substitution can satisfy the
negative checks. Each response must carry the exact sent RequestHandle.

| Request | Verified outcome |
|---|---|
| Fresh raw read before old-token request | Good service/item status |
| Read with old authentication token | Correlated ServiceFault, BadSessionIdInvalid (2149908480) |
| Fresh raw read after the fault, same transport | Good service/item status |
| Fresh browse point creation | Good, nonempty point |
| Old browse point from the fresh session | BadContinuationPointInvalid (2152333312) |
| Fresh own browse point resume and release | Good; resume returns references and another point |
| Fresh history page | Good; nonempty point; backend dispatched |
| Old history point from the fresh session | BadContinuationPointInvalid; backend counter remains 7 to 7 |
| Fresh own history point resume and release | Good; resume dispatches backend and returns another point |

All 11 raw responses were correlated. Generic transport failures/timeouts are not
accepted as token denial. The exact .182 ClientBase independently preserves a
nonnull AuthenticationToken in UpdateRequestHeader; the raw path bypasses that
method entirely. The protected token getter is read through an exact-type-checked
diagnostic accessor before close; tokens and payloads are never logged.

## Two distinct weak-reference boundaries

A NoInlining synchronous helper completes the async closed-session scope from a
thread-pool context, returning only weak references and primitive/type metadata.
No Session, point, response, token array or backend is returned as a strong
reference. The first GC phase runs while the SAME original host/configuration
remain alive. Their weak targets are explicitly expected alive. A second
NoInlining fixture boundary completes normal host shutdown, private-directory
cleanup and the complete async fixture scope before the outer GC phase.

Each phase records round 0 followed by exactly five forced blocking/compacting
collections with fixed 50/100/250/500/1000 ms delays. Each GC/finalizer worker is
bounded at five seconds. Observers use WeakReference.IsAlive rather than keeping
TryGetTarget values across collections. A deliberately retained positive object
must stay alive and an isolated collectible negative must disappear. No delay is
extended to obtain collection.

In the ordinary run all **16 old client/server Session, browse point/Data,
history-slot wrapper and history-value targets** disappeared during the first
live-host forced collection. This separates the held-list implementation detail
from those objects' actual reclamation in this fixture. After normal stop and
all fixture boundaries, five server-graph targets remained across all five
observations: server, node manager, backend, server validator and server cached
store. Rig/client configuration/client application/client validator/client cached
store targets disappeared. Positive and negative controls behaved correctly.
PKI descriptors were zero in live-host and stopped-but-harness-held observations.
The ordinary run preserves **exit 1**, with unsupported SDK2 manager-disposal
observables still explicit.

For this single fixture, live-host final managed bytes were 94,550,728 and timers
10; after-stop final managed bytes were 7,774,200 and timers 7. This drop does not
establish that the earlier multi-restart managed/timer growth disappears, nor is
it a usable performance denominator. Full process/framework parity remains open.

## Exact point-resource ownership

Runtime inspection identifies browse `ContinuationPoint.Data` as **Opc.Ua.NodeBrowser**
from the original Opc.Ua.Types binary. Its exact Dispose(bool) implementation is
empty. Its declared storage is managed IReference/List/HashSet/index state plus
managed context/view properties, with no owned IDisposable field. The containing
ContinuationPoint.Dispose delegates to Data, so omission of that call on this
exact browser does not skip a direct cleanup action. This is not a statement
about every INodeBrowser implementation or arbitrary driver browser resources.

The six history values are the original event HistoryContinuationState records;
the original store saves each record directly in the SDK slot. They have scalar,
string/date and managed paging/set state, no IDisposable contract or backend/store
handle ownership. This event fixture has no pending raw end-bound resource. Both
the SDK slot wrapper and its Value are weak-tracked; all collected while the
original host remained running.

## Stop is distinct from terminal Dispose

Read-only inspection of the pinned original product/SDK establishes:

1. Archived OtOpcUa OpcUaApplicationHost.DisposeAsync awaits only
   ApplicationInstance.StopAsync.
2. Original ApplicationInstance.StopAsync delegates to Server.StopAsync.
3. ServerBase.StopAsync stops listeners/service hosts and invokes the standard
   stopping hook. StandardServer's stopping hook DOES shut down subscriptions,
   sessions and node managers and dispose internal server data.
4. Terminal ServerBase.Dispose separately disposes its RequestQueue.
   RequestQueue owns a ServerBase reference and starts minimum worker tasks;
   those workers await SemaphoreSlim with a 15,000 ms timeout and cancellation
   token. At the minimum worker count they continue waiting. Queue.Dispose
   cancels that token, releases/disposes its signal and terminates its ownership.
5. StandardServer.Dispose also unregisters its CertificateUpdate callback and
   disposes remaining terminal resources. The SDK2 ApplicationInstance.DisposeAsync
   explicitly performs StopAsync THEN Server.Dispose; the archived original host
   never calls that terminal API.

This is a source-backed original application lifecycle gap and a plausible
retention path consistent with the observed server graph. It is not a measured
heap dominator/root chain or attribution of any particular timer. No original
production code was patched, and no extra disposal was added to ordinary mode.

A separate, gated `semantic-terminal-dispose` attribution mode first records the
ordinary result. Only afterward does a NoInlining helper briefly acquire the
known weak original server target, invoke its PUBLIC terminal Dispose once,
drop that strong reference, then repeat the same fixed GC schedule. No private
timer disposal, cache clearing, oracle adjustment or delay extension is used.
The original ordinary exit is returned even if terminal disposal clears all
observed targets. Its results are recorded separately in `semantic-evidence.json`.
It cannot turn the archived original behavior or failed RSS gates into a pass.

That separately approved run reproduced the same normal-stop five survivors and
returned **exit 1**. After the single public Dispose, all five disappeared at the
first next forced collection and remained absent through round 5. At the final
observations, timers changed from 7 to 2 and managed bytes from 7,692,144 to
4,513,760. Positive/negative GC controls remained valid. This controlled intervention
supports missing terminal server disposal as the ownership distinction; it does
not identify which queue task, timer or event subscription was the actual GC root.
It does not establish an unbounded leak from one fixture, eliminate unrelated
native retention, or make the original process a performance denominator.

Both immutable adapter builds completed with zero warnings/errors, using the
same 208 reference hashes. The ordinary run uses build 3 and the separate
counterfactual uses build 4; their exact source, binary, build-log and raw-result
hashes are retained in `semantic-evidence.json`. Raw evidence remains in private
external directories. No additional control was run to adjust these findings.

The exact original test seams are public virtual
`ServerBase.StopAsync(CancellationToken)`, protected virtual `Dispose(bool)`,
`OnServerStarting(ApplicationConfiguration)`,
`StartApplicationAsync(ApplicationConfiguration, CancellationToken)`, and
`OnServerStoppingAsync(CancellationToken)`. Public `Dispose()` and `StartAsync`
are nonvirtual. StandardServer overrides those protected lifecycle hooks and
also exposes protected virtual `OnServerStarted(IServerInternal)`. A separate
reviewed application repair can test stop failure/partial startup using these
supported seams; this diagnostic does not repair or rebuild the archived product.

## Smallest future matched-host path (proposal only)

A standalone SDK2 driver mirroring this original standalone driver is the smallest
path: same .NET runtime, assertions, telemetry/logging configuration, PKI/security,
operation recipe/counts, raw request/correlation probes, NoInlining boundaries,
weak controls, sampling schedule and module provenance. Keep SDK-specific value
representations and read-only ownership observers explicit. Both xUnit hosts
would require creating/porting a larger original test-host graph and introduce
more loader/framework differences. Neither path has been implemented or approved
as an acceptance protocol. The current candidate xUnit control is semantic
corroboration, not process-memory comparability.

Any correction of archived app ownership must be a separate reviewed change and
new provenance; these controls do not substitute a repaired baseline or use its
post-counterfactual memory as a denominator. Long original runs, reset baselines,
RSS caps and acceptance remain outside this work.