docs(index): record final SDK2 review and remaining release gates

.claude/skills/sister-project-history/otopcua.md

@@ -399,8 +399,10 @@ AddRoute of the dev Mac (`oee-tagdump-mac`, `10.181.206.245.1.1`) on the two tes
 
 - **2026-11-10 OPC UA SDK2 candidate (#782), pushed for review only.** `codex/opcua-sdk-2`, draft [lmxopcua PR#802](https://gitea.dohertylan.com/dohertj2/lmxopcua/pulls/802), targets exact SDK2.0.1; master remains SDK1.5.378.182 (master `230cef4e` consumes HistorianGateway Client/Contracts1.0.0, historiangw#131 closed; the preceding0.4.0 alignment closed#119). No deployment/master merge. Checked-in design/implementation plan, execution evidence, selected receipts and rollout/rollback runbook are under `docs/plans/2026-11-10-opcua-sdk-2-*`.
   - **Consumer contract:** raw/UNS namespace URIs and NodeIds, scalar numeric leniency, checked typed-array writes, API-key/role/ACL admission, denied-call/audit privacy, history continuation ownership and existing aggregate results remain the contract. Immutable SDK value boundaries detach retained buffers. A private source compatibility adapter retains37 original aggregate factories; 6,144 independent original1.5.378.182 vectors pass directly and through the booted manager. Existing certificates are retained; newly created Shared-client certificates use SDK's12-month lifetime, fixing the old accidental2048-month request.
-  - **Executed evidence:** Release solution builds0 warnings/errors; server wire187, server unit1,115 (+1 existing skip), Shared324 and final security17/17 pass. Separate-process old/new Shared plus actual driver/CLI compatibility62/62. Actual SQLServer195 and QuestDB233 (+1 existing opt-in skip) pass on both SDKs. Four self-contained Linux/Windows Host/CLI publishes pass; actual Linux Host starts/stops twice preserving PKI and passes real HMAC-key and strict peer checks. Full CI18,475 pass/11 fail/635 existing skips; failures independently match original baseline (#796 ten PercentGood oracle cases; #798 ScriptWorker timing). Failed assertions/thresholds were preserved.
+  - **Executed evidence:** Release solution builds0 warnings/errors; server wire187, server unit1,115 (+1 existing skip), Shared324 and final security17/17 pass. Separate-process old/new Shared plus actual driver/CLI compatibility62/62. Actual SQLServer195 and QuestDB233 (+1 existing opt-in skip) pass on both SDKs. Four self-contained Linux/Windows Host/CLI publishes pass; actual Linux Host starts/stops twice preserving PKI and passes real HMAC-key and strict peer checks. Final corrected CI18,478 pass/11 fail/635 existing skips; failures independently match original baseline (#796 ten PercentGood oracle cases; #798 ScriptWorker timing). Failed assertions/thresholds were preserved.
   - **ScadaBridge:** unchanged actual adapter (SDK1.5.378.106) passes18 None/API-key cases across original/candidate servers. Both encrypted connection attempts fail before activation because its own ApplicationCertificate is unconfigured; [ScadaBridge#121](https://gitea.dohertylan.com/dohertj2/ScadaBridge/issues/121) tracks this prerequisite. Do not call this a secure interoperability pass. Existing opaque scripted alarm IDs cannot use narrow equipment grants on either SDK (#797); compatibility preserved, separate ownership-binding design required.
   - **Review/release boundary:** parallel implementation lanes and Astra source/security review found no new must-fix migration finding at `aa9af0dc`; Astra explicitly withheld release approval. Combined client/server lifecycle RSS exceeds the unchanged +128MiB budget on macOS (~17min) and supported Linux (~15min), while managed/FD/logical counters remain bounded (#799). No cause/workaround/budget waiver is accepted. An independent actual Shared/driver/live-reinitialize/browser Linux run completed7,200.984seconds and5,420cycles with43,360verified manager disposals, zero surviving product objects and zero PKI descriptors; it is a client lifecycle pass, not a replacement for the failed server RSS workload. Windows runtime/service/reused-PKI gate#800 and approved live AVEVA/consumer/paired-cluster gate#801 remain pending. Wonder-box remote-execution hold remains binding. Gitea remains the status system; #782 stays open.
 
 - **2026-11-10 historiangw#131 completed independently on master `230cef4e`.** Consumes actual published Client/Contracts1.0.0 from gateway release commit `ea9f21c8`; the new direct `AllowUntrustedServerCertificate = UseTls && configuredOptOut` mapping preserves verified TLS defaults and ignores stale certificate options for h2c. Three real local gRPC tests prove strict self-signed rejection before RPC, explicit opt-out success, and h2c success. Whole consumer solution Release build0 warnings/errors; Gateway523pass/6existing live skips, Runtime1,002pass/3existing retired-fixture skips, zero failures; Astra source/security approved. Pushed to master, merged into SDK2 candidate and original checkout fast-forwarded; #131 closed with immutable package hashes/test receipt. No deployment/new gateway capabilities; #78 remains separate. ScadaBridge has no direct HistorianGateway dependency.
+
+  - **Final local verification (SDK2 candidate):** 18,489 executed across63 TRX; 18,478 passed,11 known baseline failures (#796/#798),635 existing skipped results. Test exit1/guard0 preserved. A baseline Runtime test race was causally repaired on master `52d1373e` (#805 closed); original browser different-port NAT limitation was independently reproduced on SDK1.5 (#806 open), and corrected direct fixtures pass5+5. Canonical candidate saturation completed384+1cycles/96restarts within1,425.242seconds with zero generated-factory events/newSDKassemblyloads/lostevents in both fixed windows, but original coldRSS rejection/exit1 remains. The original canonical adapter has only partial diagnostic proof and unsupported ownership/process-memory parity; no accepted RSS denominator. Astra source/security review is closed, release HOLD; #799/#800/#801/ScadaBridge#121 remain open. Latest runbook/evidence and draftPR#802 explicitly record these limits. No SDK2 master merge or deployment.