docs: truth sweep — retire stale registers, reconcile ledgers with shipped state

- deferred.md: DELETED (git rm) — stale 2026-07-10 duplicate of the canonical
  deferred-work register; this completes archreview R2-08 T11 (the file was
  tracked, not untracked as the task assumed)
- ScadaBridge-docs-issues.md, ScadaBridge-docs-fixed.md: DELETED (git rm) —
  generated 2026-07-10 CommentChecker reports, already consumed; completes
  R2-08 T13 (also tracked, not untracked)
- stillpending.md: prepended historical-snapshot banner (2026-06-15 audit;
  Tier-1 table is not current open work)
- docs/plans/phase-8-checklist.md: replaced the unevidenced 'Complete / All
  passing' stub with the honest state per register row 25 (WP-4 target-scale
  load test never run)
- archreview/plans/00-MASTER-TRACKER.md: R2-01 T2 live failover drill
  annotated RESOLVED 2026-08-01 (PLAN-R2-01 T4 + docker/failover-drill.sh +
  SbrFailoverTests); R2-08 T11/T13 recorded completed by this sweep
- docs/plans/2026-07-22-clusterclient-to-grpc-plan.md: P3 deferred-RPCs note
  updated (all four live-proven 2026-08-01, 1c99d6fa); ClusterClientSiteAuditClient
  naming follow-up marked DONE (63c16d69)
- docs/plans/2026-05-28-opcua-tag-browser.md.tasks.json: Task 19 flipped to
  completed (manual smoke PASS 2026-08-01, 6dc5d94c)
- archreview/plans/PLAN-R2-0[1-8]*.tasks.json: all-pending manifests reconciled
  with the authoritative tracker (round 2 merged @ 1930f19b) — flipped to
  completed except R2-08 T1/T2 which remain pending needs-user
- docs/operations/2026-07-16-secrets-clustered-master-key.md: correction banner
  (SQL-hub replication shipped 8e12f994; KEK-rotation + clustered-secrets
  runbooks ship with ZB.MOM.WW.Secrets)
- docs/plans/2026-07-19-localdb-phase2-live-gate.md: external-system-delete
  observation annotated RESOLVED (2d03f2d5 reconciles deletions incl.
  external_systems)

Claude-Session: https://claude.ai/code/session_014WNM4vjoVksyyBraTXSZE1

archreview/plans/PLAN-R2-07-ui-management-security.md.tasks.json

@@ -4,19 +4,19 @@
     {
       "id": 1,
       "subject": "Task 1: Route the DebugStreamHub LDAP bind through ManagementAuthenticator (throttled) + fix the false doc claim",
-      "status": "pending",
+      "status": "completed",
       "blockedBy": []
     },
     {
       "id": 2,
       "subject": "Task 2: ForwardedHeadersSetup — trusted-proxy client-IP resolution for the throttle keys",
-      "status": "pending",
+      "status": "completed",
       "blockedBy": []
     },
     {
       "id": 3,
       "subject": "Task 3: Ship the ForwardedHeaders config to the Traefik topologies + document the lockout-DoS trade-off",
-      "status": "pending",
+      "status": "completed",
       "blockedBy": [
         2
       ]
@@ -24,19 +24,19 @@
     {
       "id": 4,
       "subject": "Task 4: Enforce site scope on secured-write submit / approve / reject",
-      "status": "pending",
+      "status": "completed",
       "blockedBy": []
     },
     {
       "id": 5,
       "subject": "Task 5: ISecuredWriteRepository — additive permitted-sites filter for scoped listing",
-      "status": "pending",
+      "status": "completed",
       "blockedBy": []
     },
     {
       "id": 6,
       "subject": "Task 6: Scope-filter HandleListSecuredWrites + amend Component-Security.md:141 + matrix verification",
-      "status": "pending",
+      "status": "completed",
       "blockedBy": [
         4,
         5
@@ -45,13 +45,13 @@
     {
       "id": 7,
       "subject": "Task 7: AlarmSummary.RefreshAsync stale-site guard — never display cross-site data",
-      "status": "pending",
+      "status": "completed",
       "blockedBy": []
     },
     {
       "id": 8,
       "subject": "Task 8: While live, the poll updates only _notReporting — never regresses live rows",
-      "status": "pending",
+      "status": "completed",
       "blockedBy": [
         7
       ]
@@ -59,7 +59,7 @@
     {
       "id": 9,
       "subject": "Task 9: House disposal guard on the live callback",
-      "status": "pending",
+      "status": "completed",
       "blockedBy": [
         8
       ]
@@ -67,19 +67,19 @@
     {
       "id": 10,
       "subject": "Task 10: Un-stick IsLive — deathwatch resets liveness when the aggregator terminates (MUTEX with PLAN-R2-02 SiteAlarmLiveCacheService task)",
-      "status": "pending",
+      "status": "completed",
       "blockedBy": []
     },
     {
       "id": 11,
       "subject": "Task 11: Amortize LoginThrottle.Prune off the failure hot path",
-      "status": "pending",
+      "status": "completed",
       "blockedBy": []
     },
     {
       "id": 12,
       "subject": "Task 12: Lock in the scrubber's fragment coverage + document the array-merge limitation",
-      "status": "pending",
+      "status": "completed",
       "blockedBy": []
     }
   ],