lmxopcua/scripts/validation/opcua-lifecycle-memory/RESOLUTION.md

Issue #799 resolution gates

Status: prospective procedure under review, not approved for launch. The retained cold failures remain failures. This document does not change the plan's resource budgets, establish a replacement baseline, or authorize release.

Separate the evidence

Question	Evidence required	Current boundary
Finite generated-code startup	Fixed canonical operation sequence and bounded, lossless trace windows	Candidate saturation met the selected factory criterion. Summed native MethodSize does not explain all RSS.
Cross-version lifecycle ownership and memory	Equivalent operations, token invalidation, dropped harness roots, resource-owner checks and matched executable hosts	Original closed objects retain continuation lists while held by the harness; usable steady-state comparison is not established.
Continuing macOS native retention	Private-key import attribution, bounded native inventory, supported ownership correction and verification	Balanced managed disposal alone has not stopped Apple Security object accumulation. Linux results cannot close this component.

The coordinator owns integration and long executions. Two independent Sol agent lanes own baseline-canonical/ and native-retention/ respectively; use high effort for control implementation and ownership analysis. Astra at xhigh reviews each control design, its result, any production correction, and the complete acceptance procedure before execution. No worker changes the other lane's files, production factory architecture, immutable baseline, or acceptance denominator.

Short controls before a new long run

The original-SDK lane must demonstrate removal from SessionManager, rejection of the old authentication token, and rejection of old browse/history continuation tokens from a fresh session. A helper boundary must drop all strong Session, continuation and harness references before bounded GC/weak-reference observations. Observe closed-session/point weak references while the same host remains live, then separately observe application/validator/store roots after normal host stop; teardown must not hide retention of closed sessions. Inventory separately identifies which resource owner releases each object. Retain the earlier held-object failure. Do not explicitly dispose abandoned objects or clear caches merely to make the baseline pass. Unsupported original ownership probes remain unsupported, rather than being reported as zero.

The native lane must attribute configured-store private-key loads separately from public certificate and shared-handle operations using fixed counts and identical certificates. Include a separate bounded store-update semantic control so registry reuse cannot silently bypass configured-store rotation. Review exact SDK 2.0.1 public ownership seams before any application correction. A supported correction needs a failing-before/passing- after ownership control and preserved trust, private-key availability, reconnect and shutdown behavior. Custom crypto, copied transport negotiation, SDK forks, factory substitution and certificate-policy changes require a separate design; they are not fixes authorized by this procedure. Keep private PKI out of Git.

Prerequisites for reviewing warmed acceptance

1. Establish operation/status/order parity and semantically valid close/ownership checks across versions. Match executable host, runtime, architecture and instrumentation. A growing original process is not an accepted denominator.
2. Freeze source commits, all artifact hashes, runtime/image identities, private PKI identity, fixtures and the serial same-host schedule before launch.
3. Submit the actual harness change, negative controls and immutable artifact receipts to Astra. Approval of diagnostics is not approval of acceptance.
4. Resolve continuing macOS native growth independently. A Linux acceptance run cannot waive it, even if the Linux resource guard passes.

Before this draft becomes executable, define version-appropriate standard-node loading/factory trace coverage for the original binary. The absence of SDK2's Opc.Ua.OpcUaExtensions type must not let the original pass an irrelevant zero counter. Also predeclare identical retained-managed/GC and RSS sampling cadence and statistics, including exactly which samples feed the relative 15% comparison. These details remain pending; observed results cannot select them retroactively.

Proposed fixed warmup and measurement

This section is a review proposal only. If the prerequisites and Astra gate pass, qualification uses exactly 384 canonical cycles / 96 restarts plus one settling cycle within 1,800 seconds. The fixed trace windows are cycles 321–352 and 353–384, with the continuous veto across their boundary. Require zero generated- factory JIT/load events, zero new SDK assembly loads and zero lost events. Reject missing markers, wrong identity or observer faults. Do not extend or retry the qualification until a favorable sample appears.

Prospectively select exactly the post-cycle-385 sample as the measurement baseline; do not choose a minimum, median or later sample from observed RSS. Retain all cold, peak and rejected rows. Measurement must then last at least 7,200 actual seconds after warmup, retaining the +64 MiB managed, +128 MiB RSS and +32 descriptor caps, all canonical operations and semantic/native/ ownership guards. Latch the first failure permanently. No resource resets, skipped operations or completion claim on a rejected run. Setup, warmup and final cleanup do not count toward measurement duration. Final shutdown and ownership checks are mandatory after that duration completes.

For uninstrumented acceptance, first perform an identical fresh paired qualification rehearsal, then use the fixed warmup without EventPipe or allocation StackTrace tracking. The earlier tracked candidate run cannot be relabelled as this evidence. Predefine sampling and statistics for at least three matched representative runs to assess the separate plan-relative throughput, latency, allocation and RSS budgets. A two-hour absolute-cap pass alone does not satisfy those comparisons.

Only verified results meeting these distinct requirements can support closing #799. Keep #782 G4 and draft PR #802 on hold until their remaining gates also pass; Windows/runtime and licensed interoperability evidence remain separate.