Complete management API and CLI command parity

docs/requirements/Component-CLI.md

@@ -447,7 +447,7 @@ Configuration is resolved in the following priority order (highest wins):
 ## Error Handling
 
 - **Connection failure**: If the CLI cannot connect to the management URL (e.g., DNS failure, connection refused), it exits with code 1 and a descriptive error message.
-- **Command timeout**: If the server does not respond within 30 seconds, the command fails with a timeout error (HTTP 504).
+- **Command timeout**: Ordinary CLI commands use a 30-second client deadline. All instance/artifact/site deployment aliases defer the overall deadline to the server, retaining a bounded socket-connect timeout. Server Ask expiry returns HTTP 504; a client deadline is reported locally. Bundle and Flow Debugger commands retain their explicit timeout policies.
 - **Authentication failure**: If the server returns HTTP 401 (LDAP bind failed), the CLI exits with code 1.
 - **Authorization failure**: If the server returns HTTP 403, the CLI exits with code 2.
 
@@ -472,3 +472,24 @@ deploy site preserves the returned summary in JSON/table output and exits 1 when
 is nonzero or the summary is malformed, even when HTTP returned 2xx. A zero failure count exits
 0; HTTP authorization failures retain exit 2. The server owns the bounded bulk operation deadline;
 the client does not impose a shorter total timer on this command.
+
+
+## Management parity (2026-09-10)
+
+The CLI exposes all 149 HTTP-eligible management contracts. The production root
+is constructed by `CliApplication.BuildRoot`; the test suite invokes that tree
+against a loopback HTTP recorder and requires every registered contract to be
+sent, with a negative control for a removed group. Actor dispatch coverage uses
+the same HTTP eligibility boundary with no unhandled-command exemptions.
+
+Added operations include the five `shared-schema` CRUD commands, secured-write
+submit/approve/reject, notification rename and individual recipient add/delete,
+SMTP/SMS create, effective template member inspection, template folder moves,
+native alarm source updates, individual attribute-override deletion, native alarm
+override listing, and data-connection moves. SMS timeout/retry settings are also
+exposed. Their exact syntax and omission semantics are maintained in the
+[CLI command reference](../../src/ZB.MOM.WW.ScadaBridge.CLI/README.md#management-parity-additions-2026-09-10).
+
+All additions retain server-owned roles, scope restrictions, validation, and audit
+handling. In particular, secured-write approval requires a different verifier
+identity and exits with failure when the returned device execution failed.