docs(archreview): file R3-05 residuals R1/R2 (Gitea #562/#563); execution notes

archreview/plans/R3-05-acl-hot-path-expiry-plan.md

@@ -749,3 +749,35 @@ for the orchestrator.
 - **Beyond the plan's file list:** `docs/Configuration.md` gained rows for all three new keys. It carries
   the field-by-field tables for `Security:ApiKeys` and `Security:Acl`, so shipping the knobs without them
   would have been the exact doc drift this plan's cross-cutting requirement is about.
+
+### T12 — residuals filed
+
+- **R1** → Gitea **#562** — *ACL: event/alarm monitored items are revalidated by neither trigger*
+  (`https://gitea.dohertylan.com/dohertj2/lmxopcua/issues/562`).
+- **R2** → Gitea **#563** — *ACL: an expired API key keeps its session's roles while
+  `Security:Acl:Enabled` is false* (`https://gitea.dohertylan.com/dohertj2/lmxopcua/issues/563`).
+- **R3** (activation-time revocation now bounded by `StoreCacheSeconds`) needs no issue — it is documented
+  behaviour after T10, in both `docs/security.md` and `docs/Configuration.md`.
+
+### T11 — LIVE GATE
+
+**Left `pending` for the orchestrator**, per the execution brief. Nothing in this branch has been run
+against the docker-dev rig; the nine-step recipe in Finding 2 → Live gate is unchanged and still applies.
+Two notes for whoever runs it:
+
+- `Security:Acl:RevalidationIntervalSeconds` defaults to 60, so step 6's "within one revalidation
+  interval" is ≤ 60 s unless the rig overrides it. Setting it to `15` shortens the wall-clock wait without
+  changing what is proven.
+- Step 8's cache-hit leg reads `otopcua.opcua.apikey_store.bounded{outcome=cache_hit}`; the instrument only
+  exists on an **admin/fused** node, since the artifact store is not wrapped.
+
+### Summary of what a reviewer should look at
+
+1. **`Program.cs` → `DataPlaneAuthRegistration`** (T1): a verbatim move of the authorizer + key-store
+   branches out of top-level statements so they could be guarded. Confirm no branch changed.
+2. **`OtOpcUaServerHostedServiceRevalidationTests`** (T8): the plan's dispose-**before**-`SetDataPlaneAuthorizer(null)`
+   ordering is guaranteed structurally but **not asserted** — see T8's notes for why it is unobservable.
+3. **`BoundedApiKeyStore.IsExpired`** (T3): a two-line fail-closed addition beyond the plan, so the TTL
+   cannot resurrect a clock-expired key.
+4. New public members added purely so wiring could be pinned by reference: `DataPlaneAuthorizer.Clock`,
+   `BoundedApiKeyStore.Inner` / `.Clock`.

archreview/plans/R3-05-acl-hot-path-expiry-plan.md.tasks.json

@@ -94,7 +94,7 @@
     {
       "id": "T12",
       "subject": "File residuals R1 (event monitored items revalidated by nothing) and R2 (expired key retains roles while Security:Acl:Enabled=false)",
-      "status": "pending",
+      "status": "done",
       "blockedBy": []
     }
   ]