lmxopcua/scripts/validation/opcua-lifecycle-memory/native-retention/NATIVE_IMPORT_ATTEMPT.md

Installed native bridge diagnostic — attempt A stopped at its ownership guard

The approved fixed-200 diagnostic did not complete. One measured native child started; it stopped during its first operation because the harness required an identity keychain association that the installed .NET wrapper allows to be absent. This is a diagnostic model error. There is no repeated native retention result, no production mitigation or resource-budget decision, and no change to #799's status.

The separate SDK 2.0.1 seed completed with the expected RSA leaf/key pair, observed application manager disposal, and private fixture files. The measured C child loaded the pinned native bridge, checked its export image and rejected CLR and SDK images. The C build succeeded with six unsuppressed deprecation warnings for the exercised public keychain APIs; the seed build reported zero warnings and errors. This was macOS 26.5.2 build 25F84 arm64; installed managed cryptography was .NET 10.0.14. The inspected design records the exact native/managed binary paths and ABI.

Observation	Recorded result
Before snapshot	AppleDatabase 1 / 768 shallow bytes; Mach RSS 7,815,168 bytes; 3 numeric FDs
DER import, modern RSA creation, private keychain create/lock, external representation and legacy ephemeral import	All reached bridge calls succeeded
Move to private keychain	Bridge return 1, OSStatus 0; post-move certificate keychain copy returned a verified private association
Post-move identity keychain copy	Bridge-normalized OSStatus 0, no returned keychain reference
Stop	Before identity certificate copy; its uncalled status is the INT32_MIN sentinel, not a native OSStatus
Error-path cleanup	9 owned CF outputs / 9 releases; logical owners 0; verified private keychain native delete OSStatus 0; no fallback cleanup
Process and fixture	Native exit 1, reported elapsed 1.172310 s; both builds, seed and native process confirmed reaped; no remaining owned keychain files before collector cleanup; private task files overwritten and unlinked after reaping; root removed

Only four JSONL rows exist: before fingerprint, before checkpoint, partial operation 1, failure. No first/repeated/idle snapshot or after fingerprint was collected. The before-only default/search query succeeded; equality across the attempt was not measured. The measured child made no setter or restore call. No estimate of native heap growth can be drawn from its single before sample.

Why the guard did not match the installed wrapper

SafeTemporaryKeychainHandle.TrackItem obtains a copied keychain and returns without adding a logical owner when the copied handle is invalid. The installed native bridge AppleCryptoNative_SecKeychainItemCopyKeychain at 0x8a04 normalizes errSecNoSuchKeychain (-25294) and errSecInvalidItemRef (-25304) to success; the receipt records the bridge result, not the underlying raw Apple status. The installed move wrapper validates the move result and identity handle; it does not require the identity's TrackItem to add an owner. Attempt A incorrectly made that association mandatory before identity certificate copy.

Any separately reviewed follow-up should model ownership from actual validated associations: keep all nine expected native copy calls and their statuses; add a logical owner only when the returned keychain matches the generated private reference/path; record no association when it is null. Reject a disappearing association during Untrack of a previously tracked owner. Record the actual zero-owner deletion stage and which item/copy references remain alive, rather than requiring deletion at identity Untrack. A single partial attempt cannot predict the copied certificate's association or a fixed number of non-null copies. This correction concerns the diagnostic only, not production SDK ownership or certificate selection.

Selected receipts and verified raw/projection hashes are in evidence/2026-11-10-native-import-attempt-a. The unchanged raw directory is /tmp/opcua2-native-import-20261110a. It contains raw native snapshots but no retained private fixture. The native executable SHA-256 is e5c5caf2a8f882f82b738396156b378fd157ebd1a825d462449cd2a0497830fd; the seed DLL SHA-256 is 1fa7de542aee11acab18dcc8d4096b21fcbc16e4edc1fca2243159dd1176adc0. This was a single serialized execution. No retry or counterfactual arm ran.