Change streams must unwind kApplyOpsAppliedAtomically applyOps entries into individual operation events, not transaction events. Container side write operations (ci/cu/cd on admin.$container) must be filtered out and never emitted as change stream events. Verify that exactly 3 user events (insert, update, delete) are emitted, that none carry lsid/txnNumber, and that resume tokens work across the boundary.