docs(index): OtOpcUa batches #815-#847 (credential lockout, scoped credential references) at d1b6cad2

.claude/skills/sister-project-history/otopcua.md

@@ -422,3 +422,13 @@ AddRoute of the dev Mac (`oee-tagdump-mac`, `10.181.206.245.1.1`) on the two tes
   - **#803 — new driver: Heidenhain LSV2 (read-only, native TCP 19000).** Payload-aware outbound allowlist (logins + reads only), no writable nodes, credentials only `secret:heidenhain/…` / `env:OTOPCUA_HEIDENHAIN_…` (closes a Test-Connect credential-exfiltration path; same class for Galaxy/OpcUaClient → #815). Simulator + Java golden vectors only; real-control commissioning #829. The docker-dev gate caught an eager `ISecretResolver` resolution in the probe that crash-looped every central node at boot — fixed in `5bbe1e3c` before push.
   - **#804** MTConnect parity vs the ignitionoee Java driver: 9 gaps closed, notably cppagent 2.x HTTP 400/404 error documents were treated as network failures (buffer-overrun recovery never ran), silent Agent-restart adoption, unbounded XML recursion (process stack overflow). `IWritable` writes only the Agent's AllowPut surface (no controller path).
   - **#812–#814** Client CLI/UI share the endpoint rewriter; shared rewriter no longer un-escapes percent-encoded paths. NAT opc-plc fixture on 10.100.0.35:50010 (`/opt/otopcua-opcuaclient-nat`), CI wired. **#810** Uncertain/partial conformance data (no backend defects; new SDK TimeAverage/Total divergence #821, relates to #809). **#811** shadow-test flake root-caused (worker soft deadline under load; test budget 2 s).
+
+- **2026-11-11 issue batches #815–#833 and #835–#847 resolved (master `d1b6cad2`, not deployed).** Pushed and closed. Follow-ups #834 (blocked), #837 (owner decision), #838 (open: SDK reflection), #842 (blocked: Windows), #848–#854.
+  - **Credential lockout replaces the SDK lockout (#833, #844, #845) — ScadaBridge-visible.** `FailedCredentialLockout` applies to UserName/API-key sign-ins only; **anonymous is never locked out**. Parallel keyed activations **wait for a slot** (`OpcUa:CredentialLockout:SlotWaitSeconds`, default 10; timeout = BadTimeout, not a failure) instead of being refused. Failures count per (client cert+IP, key id/username, canonicalised lower-case) — a success clears only that identity — plus a per-client cap (default 10) that a success never resets. Store/ConfigDb stalls and authenticator faults no longer count. On None endpoints NAT neighbours share an IP key (use a signed endpoint to separate).
+  - **Credential references (#815, #835, #836).** Galaxy/OpcUaClient/Heidenhain credential references are confined to driver-type namespaces and, for `secret:<ns>/<instance>/…`, to the driver's own instance; refused at save, deploy, Test Connect and browse (Test Connect/browse only treat a driver as owner when the submitted endpoint matches its stored config, and audit each use as `CredentialUse`). OpcUaClient `UserCertificatePath` must be relative inside `Drivers:OpcUaClient:UserCertificateDirectory`. Running drivers with legacy references keep working with a WARN (owner choice; removal #834). **Upgrade:** certificate-auth OpcUaClient drivers must move the PFX under that directory before their next deploy; the /raw preflight banner lists affected configs.
+  - **Per-folder event ACL (#826)** decides each folder event on the live condition. **Deadlock fixed (#838):** >4096 condition events under one node-manager lock froze the server (predates #826); overflow now defers per condition, keeps the newest (meters `otopcua.opcua.condition_events.deferred|discarded`) — under overload ScadaBridge may miss intermediate transitions on the event stream (history unaffected) and a ConditionRefresh may be followed by older queued events (#854).
+  - **Historian:** DurationGood/DurationBad on SqlServer/QuestDb (19 aggregates, #820, conformance #840). #821 (SDK TimeAverage/Total with Uncertain first sample) open: stock SDK 2.0.1 fixes #809 but not #821.
+  - **Drivers:** Heidenhain native Part 9 alarms (#831) with condition classes and browseable `ALARM:` selectors (#839, mapping unproven on hardware #853); MTConnect SampleCount vs `bufferSize` warning + clamp (#825/#846) and a refused Agent connection now marks values BadNoCommunication after 2 s (`CommsLossConfirmMs`) instead of ~90 s; OpcUaClient "Server host-name check" option (#816, default = owner decision #837), IPv6 zone index kept (#819).
+  - **Script runner (#827):** soft deadline is the worker's wall clock from run start; host keeps T+G transport deadline and a progress ceiling. `ScriptRunGuard` slot-release race fixed (#843: the next run of a just-finished script could be refused and published Bad).
+  - **AdminUI (#832, #847):** /hosts shows one row per driver per node (health snapshots carry the node id; telemetry proto optional field 15, backwards compatible).
+  - Live gates: docker-dev combined gate PASS on #815/#816/#823/#825/#826/#830–#833 (it caught the #815 preflight's SQL-untranslatable predicate). The #835–#847 changes are unit/integration-tested and independently reviewed; not yet live-gated.