diff --git a/docs/plans/2026-05-29-native-alarms.RESUME.md b/docs/plans/2026-05-29-native-alarms.RESUME.md
index 6bc2a4f0..194a4dee 100644
--- a/docs/plans/2026-05-29-native-alarms.RESUME.md
+++ b/docs/plans/2026-05-29-native-alarms.RESUME.md
@@ -8,10 +8,20 @@
 - Do all work here; `main` checkout stays untouched. Build: `dotnet build ZB.MOM.WW.ScadaBridge.slnx`.
 - The shared MS SQL container `scadabridge-mssql` is up (the ConfigDB MsSql migration-fixture tests use it).
 
-## Progress: Tasks 1–24 done & committed; 25–28 pending
-Commits (oldest→newest): `696da92` T1 … `3bf1d26` T21, `a6dcbf6` T22, `1f6c420` T23, (T24 next). (Full list in git log.)
+## Progress: Tasks 1–27 done & committed; only T28 pending
+Commits (oldest→newest): `696da92` T1 … `3bf1d26` T21, `a6dcbf6` T22, `1f6c420` T23, T24, `046797e` T25, `2b7c765` T26, `003e54c` T27. (Full list in git log.)
 
-**Cadence is batches of 3 (user choice on resume).** Batch 4 = T13–15 ✅, Batch 5 = T16–18 ✅, Batch 6 = T19–21 ✅, Batch 7 = T22–24 ✅. Greens: SiteRuntime 313/313, Communication 200/200, ManagementService 111/111, CentralUI 581/581, CLI CommandTree 21/21. Next: **Batch 8 = T25 (instance override panel) → T26 (docker-env2 seed) → T27 (docs)**, then T28 (live integration).
+**Cadence is batches of 3 (user choice on resume).** Batches 4–8 (T13–27) all ✅. Greens: SiteRuntime 313/313, Communication 200/200, ManagementService 111/111, CentralUI 581/581, Commons registry 8/8, CLI CommandTree 21/21. **Next & final: T28 (integration / live verification).**
+
+## Decisions / deviations — Batch 8 (T25–27)
+- **T25:** InstanceConfigure "Native Alarm Source Overrides" card — inline per-row override (connection dropdown / source-ref / filter; blank=inherited), repo-direct upsert/clear + SaveChangesAsync (same rationale as T24). **Structural test** (source assertions) — InstanceConfigure is heavy (7 services incl. InstanceService + IFlatteningPipeline); CRUD behavior covered by T21. Lists the *template's direct* native sources (mirrors how the Alarm Overrides card uses `GetAlarmsByTemplateIdAsync`, not full flatten).
+- **T26:** seed-sites.sh adds a `MxAlarmDemo` template + `GalaxyAlarms` native source (connection "ScadaBridge Site X", source-ref `$Area_001`) + deployed `MxAlarmDemo-1` instance. **bash -n valid.** Live-verified the CLI→cluster path: `template create` works against the running env2 (:9100); `AddTemplateNativeAlarmSource` returns "Unknown command" because the **running env2 image is pre-T21** — proves the seed/commands are correct but full live run needs a cluster rebuild (`docker-env2/deploy.sh`), which is **T28's** job. Cleaned up the test template afterward (env2 templates back to []).
+- **T27:** CLAUDE.md (Native Alarms bullet under Data & Communication) + README (Template Engine row) inline; 7 component docs (DCL/SiteRuntime/TemplateEngine/CentralUI/CLI/Communication/ConfigurationDatabase) via 7 parallel `documenter` subagents. All landed (+265 lines).
+
+## T28 plan (final)
+- Add `OpcUaAlarmLiveSmokeTests` SkippableFact (skips when no alarm-capable OPC UA endpoint) mirroring the existing live OPC UA smoke pattern; note infra OPC UA A&C support in `docs/test_infra/test_infra.md`.
+- Full `dotnet build` + `dotnet test ZB.MOM.WW.ScadaBridge.slnx`. Watch known-flaky: 5 StaleTagMonitor*Tests (Commons.Tests) + `CliConfigTests.Load_MalformedConfigFile` (parallelism race) — NOT regressions.
+- Rebuild cluster: `bash docker-env2/deploy.sh` (or docker/deploy.sh), then re-run `docker-env2/seed-sites.sh` and confirm native alarms appear in the Central UI Debug View with severity + condition badges.
 
 ## Decisions / deviations — Batch 7 (T22–24)
 - **T22:** CLI `template native-alarm-source add/list/remove` + `instance native-alarm-source set/clear` + README. **Known-flaky:** `CliConfigTests.Load_MalformedConfigFile…` fails ~deterministically in the FULL CLI suite (passes in isolation) due to process-global `HOME`/`Console.SetError` racing under xUnit parallelism — **confirmed pre-existing** (baseline fails 3/3 full runs; my added tests merely perturbed scheduling). Not my regression; treat as known-flaky like the StaleTagMonitor set.
diff --git a/docs/plans/2026-05-29-native-alarms.md.tasks.json b/docs/plans/2026-05-29-native-alarms.md.tasks.json
index 70ba8e69..b3466d1b 100644
--- a/docs/plans/2026-05-29-native-alarms.md.tasks.json
+++ b/docs/plans/2026-05-29-native-alarms.md.tasks.json
@@ -25,10 +25,10 @@
     {"id": 22, "subject": "Task 22: CLI commands", "status": "completed", "blockedBy": [20]},
     {"id": 23, "subject": "Task 23: DebugView alarm table enrichment", "status": "completed", "blockedBy": [2, 19]},
     {"id": 24, "subject": "Task 24: Template editor Native Alarm Sources subsection", "status": "completed", "blockedBy": [20]},
-    {"id": 25, "subject": "Task 25: Instance Configure native alarm source override panel", "status": "pending", "blockedBy": [20]},
-    {"id": 26, "subject": "Task 26: docker-env2 seed sample native alarm source", "status": "pending", "blockedBy": [22]},
-    {"id": 27, "subject": "Task 27: Documentation sync", "status": "pending", "blockedBy": [16, 19, 22, 23, 24, 25]},
+    {"id": 25, "subject": "Task 25: Instance Configure native alarm source override panel", "status": "completed", "blockedBy": [20]},
+    {"id": 26, "subject": "Task 26: docker-env2 seed sample native alarm source", "status": "completed", "blockedBy": [22]},
+    {"id": 27, "subject": "Task 27: Documentation sync", "status": "completed", "blockedBy": [16, 19, 22, 23, 24, 25]},
     {"id": 28, "subject": "Task 28: Integration / live verification", "status": "pending", "blockedBy": [10, 11, 12, 16, 19]}
   ],
-  "lastUpdated": "2026-05-31 batch-7-complete"
+  "lastUpdated": "2026-05-31 batch-8-complete"
 }