docs(plans): bookkeeping sync — reconcile stale trackers with merged code

A verified audit of all ~90 plan documents (2026-08-01) found ~30 .tasks.json
trackers and several plan headers still reporting 'pending'/'draft' for work
fully merged to main. Sync them so future audits don't re-litigate closed work:

- Flip ~380 stale task statuses to completed across March/May/June/July
  trackers (audit-log series, milestones M5-M10, playwright waves, stillpending,
  LocalDb, ClusterClient->gRPC DoD rows, and more), each verified against
  code/git evidence before flipping.
- Annotate obsolete-not-done rows: ClusterClient CLI transport (never built,
  HTTP shipped), TreeView Areas/Instances pages (replaced by Topology),
  template-tree drag-drop (dropped for M9 menu reorder), otopcua item C
  (premise superseded by #17).
- Flip stale headers: aggregated-live-alarm + kpi-rollups 'Draft not executed'
  -> Delivered 2026-07-10; otopcua cutover-scope SCOPING -> DECIDED;
  scadabridge-rename -> Implemented; LocalDb phase1/2 status strings ->
  merged 28ca04d7.
- Fix doc drift: T9/T10 'deferred' -> shipped as SMS (Teams dropped); waitfor
  sandbox follow-up shipped; followups #52/#53/#54/#162/#207 resolved; purge
  TODO closed by PendingDeploymentPurgeActor; live-gate pre-existing failures
  #28/#29/#31 fixed; auto-down boot-alone residual superseded by self-first
  seeds; supersession banners on keep-oldest SBR + ClusterClient-era designs;
  requirements-traceability 'Pending' clarified as frozen plan-generation
  status.

Deliberately left pending (genuinely open, tracked in the pending-work list):
opcua-tag-browser task 19 (live smoke), ipsen tasks 7-8 (vd03 verification),
selfform task 7 (vd03 overlay, user-held), live-gate observation 1
(external-system delete orphan bug), otopcua item A + maxDepth calibration.

docs/plans/2026-07-22-clusterclient-to-grpc-live-gate.md

@@ -118,6 +118,9 @@ Server's retrying strategy refuses to run a split query inside a caller's transa
 **bundle import fails against real MS SQL**. The fix is the one the exception names: wrap the
 transaction in `Database.CreateExecutionStrategy().ExecuteAsync(...)`.
 
+> **FIXED (Gitea #28, commit `c4dcd9bc`)** — bundle import now runs inside the execution
+> strategy, with a regression test.
+
 Why the whole unit/integration suite is green on it: those tests use the in-memory EF provider,
 which has no retrying execution strategy — and `BeginTransactionAsync` is a no-op there. The
 comment directly above line 1298 documents that divergence without drawing the conclusion. Only
@@ -134,13 +137,18 @@ This has been failing since 2026-07-10, and it matters more than a red line: eve
 the toast assertion — including **the secret-non-leak assertion that the Auth Token value never
 reaches the page HTML** — has not executed since. Fix is a valid 32-hex SID in the fixture.
 
+> **FIXED (Gitea #29, commit `8524a7f7`)** — the fixture now uses a valid 32-hex Twilio SID, so
+> the create path (and the secret-non-leak assertion behind it) executes again.
+
 ### Not covered by this gate
 
 - Streaming subscriptions were exercised in-process (TestServer), not over the rig. The
   interceptor is path-scoped, not method-scoped, so the rig's `PullAuditEvents` evidence covers
   the same code path — but a live `SubscribeInstance` under load is untested here.
 - Key **rotation** on a live pair.
-- `docker-env2` was updated with its own key but not redeployed or gated.
+- `docker-env2` was updated with its own key but not redeployed or gated. — **CLOSED
+  (Gitea #31, commit `e0f105c3`)**: `docker-env2` was rebuilt on the PSK build and gated,
+  **PASS 3/3**; see the "Env2 gate" section at the end of this document.
 
 ---