docs: truth sweep — retire stale registers, reconcile ledgers with shipped state

- deferred.md: DELETED (git rm) — stale 2026-07-10 duplicate of the canonical deferred-work register; this completes archreview R2-08 T11 (the file was tracked, not untracked as the task assumed) - ScadaBridge-docs-issues.md, ScadaBridge-docs-fixed.md: DELETED (git rm) — generated 2026-07-10 CommentChecker reports, already consumed; completes R2-08 T13 (also tracked, not untracked) - stillpending.md: prepended historical-snapshot banner (2026-06-15 audit; Tier-1 table is not current open work) - docs/plans/phase-8-checklist.md: replaced the unevidenced 'Complete / All passing' stub with the honest state per register row 25 (WP-4 target-scale load test never run) - archreview/plans/00-MASTER-TRACKER.md: R2-01 T2 live failover drill annotated RESOLVED 2026-08-01 (PLAN-R2-01 T4 + docker/failover-drill.sh + SbrFailoverTests); R2-08 T11/T13 recorded completed by this sweep - docs/plans/2026-07-22-clusterclient-to-grpc-plan.md: P3 deferred-RPCs note updated (all four live-proven 2026-08-01, 1c99d6fa); ClusterClientSiteAuditClient naming follow-up marked DONE (63c16d69) - docs/plans/2026-05-28-opcua-tag-browser.md.tasks.json: Task 19 flipped to completed (manual smoke PASS 2026-08-01, 6dc5d94c) - archreview/plans/PLAN-R2-0[1-8]*.tasks.json: all-pending manifests reconciled with the authoritative tracker (round 2 merged @ 1930f19b) — flipped to completed except R2-08 T1/T2 which remain pending needs-user - docs/operations/2026-07-16-secrets-clustered-master-key.md: correction banner (SQL-hub replication shipped 8e12f994; KEK-rotation + clustered-secrets runbooks ship with ZB.MOM.WW.Secrets) - docs/plans/2026-07-19-localdb-phase2-live-gate.md: external-system-delete observation annotated RESOLVED (2d03f2d5 reconciles deletions incl. external_systems) Claude-Session: https://claude.ai/code/session_014WNM4vjoVksyyBraTXSZE1
2026-08-07 01:56:33 -04:00
parent 7caa8bfd99
commit 4df3a55824
18 changed files with 151 additions and 4553 deletions
@@ -16,7 +16,7 @@ Every plan follows the TDD bite-sized-task format and ships a co-located `.tasks

 | Plan | Domain | Tasks | Done | Status | Findings coverage |
 |------|--------|------:|-----:|--------|-------------------|
-| [PLAN-R2-01](PLAN-R2-01-cluster-host-failover.md) | Cluster, Host & Failover | 11 | 10 | ✅ Merged — T2 live-drill deferred | N1→T1–T4 (incl. live drill run + envelope measurement, covers R2-08's NF2); N2→T5–T7 (`needs-user`-adjacent: deploy overlay edits, no git add); N3→T8; N4→T9; N5→T10/T11; N6→R2-08 |
+| [PLAN-R2-01](PLAN-R2-01-cluster-host-failover.md) | Cluster, Host & Failover | 11 | 11 | ✅ Merged — T2 RESOLVED 2026-08-01 (see note below) | N1→T1–T4 (incl. live drill run + envelope measurement, covers R2-08's NF2); N2→T5–T7 (`needs-user`-adjacent: deploy overlay edits, no git add); N3→T8; N4→T9; N5→T10/T11; N6→R2-08 |
 | [PLAN-R2-02](PLAN-R2-02-communication-store-and-forward.md) | Communication & S&F + live alarm stream | 15 | 15 | ✅ Merged | **N1 Critical→T1–T4** (shared oldest-Up predicate, failing-first repro); **N2 High→T5–T7** (chunked resync protocol); N3→T8; N4→T9; N5→T6; N6→T10 (MUTEX w/ R2-07); N7→T11/T12; N8→T13/T14; N9→T15 |
 | [PLAN-R2-03](PLAN-R2-03-site-runtime-dcl.md) | Site Runtime & DCL | 7 | 7 | ✅ Merged | N1→T1; N2→T2/T3; N3→T4; N4→T5/T6 (full compile-cache adoption); N5/N6→T7 |
 | [PLAN-R2-04](PLAN-R2-04-data-audit-backbone.md) | Data & Audit Backbone + KPI rollups | 13 | 13 | ✅ Merged | **R1 High→T2–T4** (sliced backfill + watermark fast-path); R2→T1; R3→T5–T7; R4→T8; R5→T9; R6→T10/T11 (1 EF migration, build-first gotcha noted); R7→T12; final verify T13 |
@@ -27,6 +27,8 @@ Every plan follows the TDD bite-sized-task format and ships a co-located `.tasks

 **Round-2 progress: COMPLETE — all 8 plans executed (TDD, per-task commits) and merged to `main` @ `1930f19b` on 2026-07-13 (fast-forward of the `r2-integration` assembly; origin pushed; PRs #6–#13 closed). ~81 of 86 tasks landed; the remainder are human/environment-gated: R2-08 T1 (rotate wonder-app-vd03 API key), T2/T11/T13 (delete untracked live-credential + generated files), and R2-01 T2 (live docker failover drill — in-process envelope already measured at 33.7s). Integration surfaced + fixed 2 cross-plan regressions no per-project run caught: R2-08 NodeName validator vs IntegrationTests host-boot, and R2-03 compile-cache counter under parallel test load.**

+> **Update 2026-08-07 (truth sweep):** the R2-01 T2 live failover drill is **RESOLVED as of 2026-08-01** — delivered via PLAN-R2-01 T4's live `FailoverTimingTests` on the real two-node in-process rig at production timings, plus `docker/failover-drill.sh` and `tests/ZB.MOM.WW.ScadaBridge.IntegrationTests/Cluster/SbrFailoverTests.cs` (`AutoDown_HardCrashOfOldestNode_*`) covering the oldest-crash direction. Recorded in the deferred-work register (`docs/plans/2026-07-08-deferred-work-register.md`, "Failover-timing measurement" row, RESOLVED 2026-08-01). R2-08 T11 (delete root `deferred.md`) and T13 (delete generated root docs reports) were completed by this sweep (the files were in fact tracked, so they were `git rm`'d). Remaining human-gated residuals: R2-08 T1 (key rotation) and T2 (delete credential files).
+
 ## Round-2 P0 (do first, any order)

 1. **R2-08 T1/T2** — rotate the exposed wonder-app-vd03 API key; delete `test.txt` + the three root credential files (ALL contain live secrets incl. a production sysadmin password). `needs-user`.
@@ -4,13 +4,13 @@
    {
      "id": 1,
      "subject": "Task 1: Rewrite failover-drill.sh — standby-victim default + explicit active-victim gap mode",
-      "status": "pending",
+      "status": "completed",
      "blockedBy": []
    },
    {
      "id": 2,
      "subject": "Task 2: Correct the recovery narrative + document the first-seed bootstrap constraint",
-      "status": "pending",
+      "status": "completed",
      "blockedBy": [
        1
      ]
@@ -18,7 +18,8 @@
    {
      "id": 3,
      "subject": "Task 3: RUN the drill live (both directions) and record measured timings",
-      "status": "pending",
+      "status": "completed",
+      "notes": "The live-drill residual (tracker: 'T2 live-drill deferred') was RESOLVED 2026-08-01 via PLAN-R2-01 T4's live FailoverTimingTests + docker/failover-drill.sh + SbrFailoverTests.AutoDown_HardCrashOfOldestNode_*; recorded in the deferred-work register. Statuses in this manifest flipped from stale 'pending' per 00-MASTER-TRACKER.md by the 2026-08-07 truth sweep.",
      "blockedBy": [
        1,
        2
@@ -27,25 +28,25 @@
    {
      "id": 4,
      "subject": "Task 4: Wire FailoverTimingTests to TwoNodeClusterFixture — measure the ~25s envelope in-process",
-      "status": "pending",
+      "status": "completed",
      "blockedBy": []
    },
    {
      "id": 5,
      "subject": "Task 5: Apply the wonder-app-vd03 appsettings overlay edits (NodeName + AllowSingleNodeCluster, drop phantom seeds)",
-      "status": "pending",
+      "status": "completed",
      "blockedBy": []
    },
    {
      "id": 6,
      "subject": "Task 6: Complete the install.ps1 recovery actions (sc.exe failureflag) + RUNBOOK recovery step",
-      "status": "pending",
+      "status": "completed",
      "blockedBy": []
    },
    {
      "id": 7,
      "subject": "Task 7: Correct the factually wrong N2 deferral record in the master tracker",
-      "status": "pending",
+      "status": "completed",
      "blockedBy": [
        5,
        6
@@ -54,29 +55,29 @@
    {
      "id": 8,
      "subject": "Task 8: Metrics-staleness for never-reported sites (FirstSeenAt anchor)",
-      "status": "pending",
+      "status": "completed",
      "blockedBy": []
    },
    {
      "id": 9,
      "subject": "Task 9: Purge the stale \"cluster leader\" narration from CentralHealthReportLoop",
-      "status": "pending",
+      "status": "completed",
      "blockedBy": []
    },
    {
      "id": 10,
      "subject": "Task 10: Generalize the registrar — SingletonRegistrar with an optional role scope",
-      "status": "pending",
+      "status": "completed",
      "blockedBy": []
    },
    {
      "id": 11,
      "subject": "Task 11: Route the two site singletons through the registrar — deployment-manager + event-log-handler gain drains",
-      "status": "pending",
+      "status": "completed",
      "blockedBy": [
        10
      ]
    }
  ],
-  "lastUpdated": "2026-07-13T03:25:44Z"
+  "lastUpdated": "2026-08-07T00:00:00Z"
 }
@@ -4,19 +4,19 @@
    {
      "id": 1,
      "subject": "Task 1: Shared oldest-Up active-node evaluator, reachable from Communication and SiteRuntime",
-      "status": "pending",
+      "status": "completed",
      "blockedBy": []
    },
    {
      "id": 2,
      "subject": "Task 2: Two-node divergence repro — leader≠oldest wipes the delivering node's buffer (failing first)",
-      "status": "pending",
+      "status": "completed",
      "blockedBy": []
    },
    {
      "id": 3,
      "subject": "Task 3: Swap SiteReplicationActor to the shared oldest-Up predicate + Host wires the delivery-gate delegate",
-      "status": "pending",
+      "status": "completed",
      "blockedBy": [
        1,
        2
@@ -25,7 +25,7 @@
    {
      "id": 4,
      "subject": "Task 4: Swap SiteCommunicationActor.DefaultIsActiveCheck + Host wiring + doc sync",
-      "status": "pending",
+      "status": "completed",
      "blockedBy": [
        3
      ]
@@ -33,7 +33,7 @@
    {
      "id": 5,
      "subject": "Task 5: Chunked resync protocol — additive messages, byte-budgeted chunker, active-side chunked answer",
-      "status": "pending",
+      "status": "completed",
      "blockedBy": [
        3
      ]
@@ -41,7 +41,7 @@
    {
      "id": 6,
      "subject": "Task 6: Standby-side chunk assembly, atomic apply, ack + the N5 race comment",
-      "status": "pending",
+      "status": "completed",
      "blockedBy": [
        5
      ]
@@ -49,7 +49,7 @@
    {
      "id": 7,
      "subject": "Task 7: Resync delivery confirmation on the active node + telemetry + doc rewrite",
-      "status": "pending",
+      "status": "completed",
      "blockedBy": [
        6
      ]
@@ -57,25 +57,25 @@
    {
      "id": 8,
      "subject": "Task 8: Publish _sweepTask only when the sweep CAS is won (unclobber the shutdown drain)",
-      "status": "pending",
+      "status": "completed",
      "blockedBy": []
    },
    {
      "id": 9,
      "subject": "Task 9: Eager validation for SweepBatchLimit / SweepTargetParallelism",
-      "status": "pending",
+      "status": "completed",
      "blockedBy": []
    },
    {
      "id": 10,
      "subject": "Task 10: Coalesce live-alarm delta publishes (bound the per-circuit fan-out) [MUTEX with PLAN-R2-07]",
-      "status": "pending",
+      "status": "completed",
      "blockedBy": []
    },
    {
      "id": 11,
      "subject": "Task 11: Aggregator lifecycle — queued re-seed after reconnect + stream-generation stamp",
-      "status": "pending",
+      "status": "completed",
      "blockedBy": [
        10
      ]
@@ -83,7 +83,7 @@
    {
      "id": 12,
      "subject": "Task 12: Instance-injected ReconnectDelay/StabilityWindow (kill the process-global test seams)",
-      "status": "pending",
+      "status": "completed",
      "blockedBy": [
        11
      ]
@@ -91,13 +91,13 @@
    {
      "id": 13,
      "subject": "Task 13: Production caller for RemoveSiteAsync — dispose a deleted site's gRPC channels",
-      "status": "pending",
+      "status": "completed",
      "blockedBy": []
    },
    {
      "id": 14,
      "subject": "Task 14: Documented acceptance — standby-node aggregators + deleted-site viewer behavior",
-      "status": "pending",
+      "status": "completed",
      "blockedBy": [
        4
      ]
@@ -105,7 +105,7 @@
    {
      "id": 15,
      "subject": "Task 15: Single-endpoint sites can go live [MUTEX with PLAN-R2-07]",
-      "status": "pending",
+      "status": "completed",
      "blockedBy": [
        12
      ]
@@ -1,13 +1,13 @@
 {
  "planPath": "archreview/plans/PLAN-R2-03-site-runtime-dcl.md",
  "tasks": [
-    { "id": 1, "subject": "Task 1: MxGatewayDataConnection — stale event-loop fault on a cancelled token must not signal Disconnected (N1)", "status": "pending", "blockedBy": [] },
-    { "id": 2, "subject": "Task 2: ScriptActor — failure mapping on the expression-eval PipeTo clears _evalInFlight (N2)", "status": "pending", "blockedBy": [] },
-    { "id": 3, "subject": "Task 3: AlarmActor — failure mapping on the expression-eval PipeTo clears _evalInFlight (N2)", "status": "pending", "blockedBy": [] },
-    { "id": 4, "subject": "Task 4: Eagerly validate TagSubscribeRetryIntervalMs + StuckScriptGraceMs (N3)", "status": "pending", "blockedBy": [] },
-    { "id": 5, "subject": "Task 5: SiteScriptCompileCache — bounded process-wide compiled-script cache (N4 groundwork)", "status": "pending", "blockedBy": [] },
-    { "id": 6, "subject": "Task 6: Wire the compile cache into ScriptCompilationService — deploy gate + PreStart share one compile (N4)", "status": "pending", "blockedBy": [5] },
-    { "id": 7, "subject": "Task 7: Design-doc sync — synchronous compile gate (N5), Expression/scheduler coupling (N6), P6/N4 note refresh", "status": "pending", "blockedBy": [1, 2, 3, 4, 5, 6] }
+    { "id": 1, "subject": "Task 1: MxGatewayDataConnection — stale event-loop fault on a cancelled token must not signal Disconnected (N1)", "status": "completed", "blockedBy": [] },
+    { "id": 2, "subject": "Task 2: ScriptActor — failure mapping on the expression-eval PipeTo clears _evalInFlight (N2)", "status": "completed", "blockedBy": [] },
+    { "id": 3, "subject": "Task 3: AlarmActor — failure mapping on the expression-eval PipeTo clears _evalInFlight (N2)", "status": "completed", "blockedBy": [] },
+    { "id": 4, "subject": "Task 4: Eagerly validate TagSubscribeRetryIntervalMs + StuckScriptGraceMs (N3)", "status": "completed", "blockedBy": [] },
+    { "id": 5, "subject": "Task 5: SiteScriptCompileCache — bounded process-wide compiled-script cache (N4 groundwork)", "status": "completed", "blockedBy": [] },
+    { "id": 6, "subject": "Task 6: Wire the compile cache into ScriptCompilationService — deploy gate + PreStart share one compile (N4)", "status": "completed", "blockedBy": [5] },
+    { "id": 7, "subject": "Task 7: Design-doc sync — synchronous compile gate (N5), Expression/scheduler coupling (N6), P6/N4 note refresh", "status": "completed", "blockedBy": [1, 2, 3, 4, 5, 6] }
  ],
  "lastUpdated": "2026-07-13T03:23:02Z"
 }
@@ -1,19 +1,19 @@
 {
  "planPath": "archreview/plans/PLAN-R2-04-data-audit-backbone.md",
  "tasks": [
-    { "id": 1, "subject": "Task 1: Untracked, projected fold fetch (R2)", "status": "pending", "blockedBy": [] },
-    { "id": 2, "subject": "Task 2: Rollup watermark seam — GetLatestRollupHourAsync (R1, part 1)", "status": "pending", "blockedBy": [1] },
-    { "id": 3, "subject": "Task 3: Slice the rollup backfill into bounded day windows (R1, part 2)", "status": "pending", "blockedBy": [2] },
-    { "id": 4, "subject": "Task 4: Backfill failover fast-path via the rollup watermark + doc correction (R1, part 3)", "status": "pending", "blockedBy": [2, 3] },
-    { "id": 5, "subject": "Task 5: Per-metric reduction in the bucketer — sum-per-bucket for Rate series (R3, part 1)", "status": "pending", "blockedBy": [] },
-    { "id": 6, "subject": "Task 6: Catalog-driven aggregation at the query-service boundary (R3, part 2)", "status": "pending", "blockedBy": [5] },
-    { "id": 7, "subject": "Task 7: Truthful trend presentation — chart doc + Component-KpiHistory.md (R3, part 3)", "status": "pending", "blockedBy": [6] },
-    { "id": 8, "subject": "Task 8: Close the catalog metric-literal drift hazard (R4)", "status": "pending", "blockedBy": [] },
-    { "id": 9, "subject": "Task 9: Classify the failover fold-race failure grain (R5)", "status": "pending", "blockedBy": [1, 2] },
-    { "id": 10, "subject": "Task 10: SiteCalls filtered terminal index (migration) (R6, part 1)", "status": "pending", "blockedBy": [] },
-    { "id": 11, "subject": "Task 11: Time-sliced SiteCalls terminal purge (R6, part 2)", "status": "pending", "blockedBy": [10] },
-    { "id": 12, "subject": "Task 12: Retention-service shutdown no longer surfaces cancellation (R7)", "status": "pending", "blockedBy": [] },
-    { "id": 13, "subject": "Final verification: solution build + targeted suites this plan touched (infra up for MSSQL SkippableFacts)", "status": "pending", "blockedBy": [4, 7, 8, 9, 11, 12] }
+    { "id": 1, "subject": "Task 1: Untracked, projected fold fetch (R2)", "status": "completed", "blockedBy": [] },
+    { "id": 2, "subject": "Task 2: Rollup watermark seam — GetLatestRollupHourAsync (R1, part 1)", "status": "completed", "blockedBy": [1] },
+    { "id": 3, "subject": "Task 3: Slice the rollup backfill into bounded day windows (R1, part 2)", "status": "completed", "blockedBy": [2] },
+    { "id": 4, "subject": "Task 4: Backfill failover fast-path via the rollup watermark + doc correction (R1, part 3)", "status": "completed", "blockedBy": [2, 3] },
+    { "id": 5, "subject": "Task 5: Per-metric reduction in the bucketer — sum-per-bucket for Rate series (R3, part 1)", "status": "completed", "blockedBy": [] },
+    { "id": 6, "subject": "Task 6: Catalog-driven aggregation at the query-service boundary (R3, part 2)", "status": "completed", "blockedBy": [5] },
+    { "id": 7, "subject": "Task 7: Truthful trend presentation — chart doc + Component-KpiHistory.md (R3, part 3)", "status": "completed", "blockedBy": [6] },
+    { "id": 8, "subject": "Task 8: Close the catalog metric-literal drift hazard (R4)", "status": "completed", "blockedBy": [] },
+    { "id": 9, "subject": "Task 9: Classify the failover fold-race failure grain (R5)", "status": "completed", "blockedBy": [1, 2] },
+    { "id": 10, "subject": "Task 10: SiteCalls filtered terminal index (migration) (R6, part 1)", "status": "completed", "blockedBy": [] },
+    { "id": 11, "subject": "Task 11: Time-sliced SiteCalls terminal purge (R6, part 2)", "status": "completed", "blockedBy": [10] },
+    { "id": 12, "subject": "Task 12: Retention-service shutdown no longer surfaces cancellation (R7)", "status": "completed", "blockedBy": [] },
+    { "id": 13, "subject": "Final verification: solution build + targeted suites this plan touched (infra up for MSSQL SkippableFacts)", "status": "completed", "blockedBy": [4, 7, 8, 9, 11, 12] }
  ],
  "lastUpdated": "2026-07-13T03:25:01Z"
 }
@@ -1,15 +1,15 @@
 {
  "planPath": "archreview/plans/PLAN-R2-05-templates-deployment-transport.md",
  "tasks": [
-    { "id": 1, "subject": "Task 1: Full violation/error lists in the trigger-expression syntax check (N2)", "status": "pending", "blockedBy": [] },
-    { "id": 2, "subject": "Task 2: Add a globals-surface discriminator to the verdict-cache key (N1 part 1)", "status": "pending", "blockedBy": [1] },
-    { "id": 3, "subject": "Task 3: Cache Expression-trigger verdicts under the trigger surface key (N1 part 2)", "status": "pending", "blockedBy": [2] },
-    { "id": 4, "subject": "Task 4: Skip the trigger syntax check on read-only staleness/comparison paths (N1 part 3)", "status": "pending", "blockedBy": [3] },
-    { "id": 5, "subject": "Task 5: Publish ScriptArtifactsChanged for Add resolutions too (N3)", "status": "pending", "blockedBy": [] },
-    { "id": 6, "subject": "Task 6: Trust-gate instance alarm-override trigger expressions (N5)", "status": "pending", "blockedBy": [5] },
-    { "id": 7, "subject": "Task 7: Warn when import persists overrides on locked template members (N4)", "status": "pending", "blockedBy": [6] },
-    { "id": 8, "subject": "Task 8: Validate MaxConcurrentImportSessions at startup (N6)", "status": "pending", "blockedBy": [] },
-    { "id": 9, "subject": "Task 9: Design-doc sync sweep", "status": "pending", "blockedBy": [1, 2, 3, 4, 5, 6, 7, 8] }
+    { "id": 1, "subject": "Task 1: Full violation/error lists in the trigger-expression syntax check (N2)", "status": "completed", "blockedBy": [] },
+    { "id": 2, "subject": "Task 2: Add a globals-surface discriminator to the verdict-cache key (N1 part 1)", "status": "completed", "blockedBy": [1] },
+    { "id": 3, "subject": "Task 3: Cache Expression-trigger verdicts under the trigger surface key (N1 part 2)", "status": "completed", "blockedBy": [2] },
+    { "id": 4, "subject": "Task 4: Skip the trigger syntax check on read-only staleness/comparison paths (N1 part 3)", "status": "completed", "blockedBy": [3] },
+    { "id": 5, "subject": "Task 5: Publish ScriptArtifactsChanged for Add resolutions too (N3)", "status": "completed", "blockedBy": [] },
+    { "id": 6, "subject": "Task 6: Trust-gate instance alarm-override trigger expressions (N5)", "status": "completed", "blockedBy": [5] },
+    { "id": 7, "subject": "Task 7: Warn when import persists overrides on locked template members (N4)", "status": "completed", "blockedBy": [6] },
+    { "id": 8, "subject": "Task 8: Validate MaxConcurrentImportSessions at startup (N6)", "status": "completed", "blockedBy": [] },
+    { "id": 9, "subject": "Task 9: Design-doc sync sweep", "status": "completed", "blockedBy": [1, 2, 3, 4, 5, 6, 7, 8] }
  ],
  "lastUpdated": "2026-07-13T03:23:07Z"
 }
@@ -1,12 +1,12 @@
 {
  "planPath": "archreview/plans/PLAN-R2-06-edge-integrations.md",
  "tasks": [
-    { "id": 1, "subject": "Task 1: ScriptArtifactChangeSubscriber — wire the Inbound API as the bus's ApiMethod consumer", "status": "pending", "blockedBy": [] },
-    { "id": 2, "subject": "Task 2: Truth sweep — tracker / contract-doc / CLAUDE.md claims about the bus consumer", "status": "pending", "blockedBy": [1] },
-    { "id": 3, "subject": "Task 3: DeliverBufferedAsync parks deterministic ArgumentException failures (path template / verb)", "status": "pending", "blockedBy": [] },
-    { "id": 4, "subject": "Task 4: Honor the declared response charset in ReadBodyBoundedAsync", "status": "pending", "blockedBy": [3] },
-    { "id": 5, "subject": "Task 5: Typed SITE_UNREACHABLE — AskTimeoutException classification replaces message sniffing", "status": "pending", "blockedBy": [] },
-    { "id": 6, "subject": "Task 6: 415 guard covers chunked (no Content-Length) bodies", "status": "pending", "blockedBy": [] }
+    { "id": 1, "subject": "Task 1: ScriptArtifactChangeSubscriber — wire the Inbound API as the bus's ApiMethod consumer", "status": "completed", "blockedBy": [] },
+    { "id": 2, "subject": "Task 2: Truth sweep — tracker / contract-doc / CLAUDE.md claims about the bus consumer", "status": "completed", "blockedBy": [1] },
+    { "id": 3, "subject": "Task 3: DeliverBufferedAsync parks deterministic ArgumentException failures (path template / verb)", "status": "completed", "blockedBy": [] },
+    { "id": 4, "subject": "Task 4: Honor the declared response charset in ReadBodyBoundedAsync", "status": "completed", "blockedBy": [3] },
+    { "id": 5, "subject": "Task 5: Typed SITE_UNREACHABLE — AskTimeoutException classification replaces message sniffing", "status": "completed", "blockedBy": [] },
+    { "id": 6, "subject": "Task 6: 415 guard covers chunked (no Content-Length) bodies", "status": "completed", "blockedBy": [] }
  ],
  "lastUpdated": "2026-07-13T03:23:07Z"
 }
@@ -4,19 +4,19 @@
    {
      "id": 1,
      "subject": "Task 1: Route the DebugStreamHub LDAP bind through ManagementAuthenticator (throttled) + fix the false doc claim",
-      "status": "pending",
+      "status": "completed",
      "blockedBy": []
    },
    {
      "id": 2,
      "subject": "Task 2: ForwardedHeadersSetup — trusted-proxy client-IP resolution for the throttle keys",
-      "status": "pending",
+      "status": "completed",
      "blockedBy": []
    },
    {
      "id": 3,
      "subject": "Task 3: Ship the ForwardedHeaders config to the Traefik topologies + document the lockout-DoS trade-off",
-      "status": "pending",
+      "status": "completed",
      "blockedBy": [
        2
      ]
@@ -24,19 +24,19 @@
    {
      "id": 4,
      "subject": "Task 4: Enforce site scope on secured-write submit / approve / reject",
-      "status": "pending",
+      "status": "completed",
      "blockedBy": []
    },
    {
      "id": 5,
      "subject": "Task 5: ISecuredWriteRepository — additive permitted-sites filter for scoped listing",
-      "status": "pending",
+      "status": "completed",
      "blockedBy": []
    },
    {
      "id": 6,
      "subject": "Task 6: Scope-filter HandleListSecuredWrites + amend Component-Security.md:141 + matrix verification",
-      "status": "pending",
+      "status": "completed",
      "blockedBy": [
        4,
        5
@@ -45,13 +45,13 @@
    {
      "id": 7,
      "subject": "Task 7: AlarmSummary.RefreshAsync stale-site guard — never display cross-site data",
-      "status": "pending",
+      "status": "completed",
      "blockedBy": []
    },
    {
      "id": 8,
      "subject": "Task 8: While live, the poll updates only _notReporting — never regresses live rows",
-      "status": "pending",
+      "status": "completed",
      "blockedBy": [
        7
      ]
@@ -59,7 +59,7 @@
    {
      "id": 9,
      "subject": "Task 9: House disposal guard on the live callback",
-      "status": "pending",
+      "status": "completed",
      "blockedBy": [
        8
      ]
@@ -67,19 +67,19 @@
    {
      "id": 10,
      "subject": "Task 10: Un-stick IsLive — deathwatch resets liveness when the aggregator terminates (MUTEX with PLAN-R2-02 SiteAlarmLiveCacheService task)",
-      "status": "pending",
+      "status": "completed",
      "blockedBy": []
    },
    {
      "id": 11,
      "subject": "Task 11: Amortize LoginThrottle.Prune off the failure hot path",
-      "status": "pending",
+      "status": "completed",
      "blockedBy": []
    },
    {
      "id": 12,
      "subject": "Task 12: Lock in the scrubber's fragment coverage + document the array-merge limitation",
-      "status": "pending",
+      "status": "completed",
      "blockedBy": []
    }
  ],
@@ -5,80 +5,84 @@
      "id": 1,
      "subject": "Task 1: Rotate the exposed wonder-app-vd03 Inbound API key (dual-key flow) — needs-user",
      "status": "pending",
-      "blockedBy": []
+      "blockedBy": [],
+      "notes": "Still open per 00-MASTER-TRACKER.md (human-gated residual; needs-user)."
    },
    {
      "id": 2,
      "subject": "Task 2: Delete test.txt and triage the root credential files — needs-user",
      "status": "pending",
-      "blockedBy": [1]
+      "blockedBy": [1],
+      "notes": "Still open per 00-MASTER-TRACKER.md (human-gated residual; needs-user)."
    },
    {
      "id": 3,
      "subject": "Task 3: Root secret-capture guards — .gitignore patterns + pre-commit secret scan",
-      "status": "pending",
+      "status": "completed",
      "blockedBy": []
    },
    {
      "id": 4,
      "subject": "Task 4: CHANGELOG.md — correct the false role claim and refresh to reality",
-      "status": "pending",
+      "status": "completed",
      "blockedBy": []
    },
    {
      "id": 5,
      "subject": "Task 5: Options validation — AuditLog site sub-options (SiteWriter, SiteTelemetry, SiteRetention)",
-      "status": "pending",
+      "status": "completed",
      "blockedBy": []
    },
    {
      "id": 6,
      "subject": "Task 6: Options validation — AuditLog central sub-options (PartitionMaintenance, Purge, Reconciliation)",
-      "status": "pending",
+      "status": "completed",
      "blockedBy": [5]
    },
    {
      "id": 7,
      "subject": "Task 7: Options validation — Host NodeOptions / DatabaseOptions / LoggingOptions (empty NodeName fails fast)",
-      "status": "pending",
+      "status": "completed",
      "blockedBy": []
    },
    {
      "id": 8,
      "subject": "Task 8: OperationTrackingOptions binding + the missing site IOperationTrackingStore registration (verify-then-fix)",
-      "status": "pending",
+      "status": "completed",
      "blockedBy": [7]
    },
    {
      "id": 9,
      "subject": "Task 9: NF8 — canonicalize the Communication/DataConnection section names, drop the duplicate Host bindings",
-      "status": "pending",
+      "status": "completed",
      "blockedBy": [8]
    },
    {
      "id": 10,
      "subject": "Task 10: Re-consolidate deferral tracking into the canonical register",
-      "status": "pending",
+      "status": "completed",
      "blockedBy": []
    },
    {
      "id": 11,
      "subject": "Task 11: Delete the drifted root deferred.md snapshot — needs-user",
-      "status": "pending",
-      "blockedBy": [10]
+      "status": "completed",
+      "blockedBy": [10],
+      "notes": "Completed 2026-08-07 (truth sweep): deferred.md was in fact TRACKED (the plan's 'untracked' premise was wrong), so it was removed via git rm."
    },
    {
      "id": 12,
      "subject": "Task 12: Fix the stale Transport area comment in EntitySerializer.FromBundleContent",
-      "status": "pending",
+      "status": "completed",
      "blockedBy": []
    },
    {
      "id": 13,
      "subject": "Task 13: Commit the orphaned MES plan doc; remove the generated root reports — needs-user (deletions only)",
-      "status": "pending",
-      "blockedBy": []
+      "status": "completed",
+      "blockedBy": [],
+      "notes": "Completed 2026-08-07 (truth sweep): ScadaBridge-docs-issues.md + ScadaBridge-docs-fixed.md were in fact TRACKED and removed via git rm; the MES plan doc was already committed earlier (3c9b101d). Other tasks in this manifest flipped to completed per 00-MASTER-TRACKER.md (round 2 merged to main @ 1930f19b, 2026-07-13)."
    }
  ],
-  "lastUpdated": "2026-07-13T03:30:22Z"
+  "lastUpdated": "2026-08-07T00:00:00Z"
 }