docs(archreview): R3-03 execution notes — final verification + deviation summary

archreview/plans/R3-03-restart-resubscribe-watchdog-plan.md

@@ -653,3 +653,35 @@ After restoring the hook: **6/6 pass**, and the class was run **20× in isolatio
 - §"The comms-loss watchdog": conjunct 2 restated as the max, plus a new paragraph on the
   per-connection grace — why `??` was wrong, that it **paces** rather than ends the half-broken-device
   cycle, that the watchdog is not disabled by the change, and the two tests that pin each half.
+
+### Final verification
+
+- `dotnet build ZB.MOM.WW.OtOpcUa.slnx` → **0 errors** (904 warnings, all pre-existing analyzer
+  `OTOPCUA0001` noise in unrelated driver test projects).
+- **Full `Runtime.Tests`: 645 passed, 3 skipped, 0 failed** (1 m 9 s). Baseline on the branch point was
+  637 + 3 skipped; the +8 are this plan's new tests (T1 ×2, T5 ×4, T7 ×2). The 3 skips are pre-existing
+  `DeploymentArtifact*` parity tests.
+- The two other test projects that reference `ZB.MOM.WW.OtOpcUa.Runtime` were run as well, since T3
+  changes what every driver child receives at spawn: `ControlPlane.Tests` **262/262**, `Host.Tests`
+  **106/106**.
+- T9 (live gate) deliberately left **pending** — run by the orchestrator.
+
+### Summary of deviations (for the reviewer)
+
+1. **The plan's "the transient spawn-time set is never acted on" is false** — measured, corrected in
+   both the production comment and the docs, and accepted with its cost stated (T5, deviation 1). This
+   is the one behavioural claim in the plan that did not survive contact with the code.
+2. `A_child_spawned_by_a_fresh_deploy_ends_with_the_NEW_refs` re-shaped — revision B *does* respawn the
+   child (raw tags fold into the merged `DriverConfig`) (T5, deviation 2).
+3. `Restart_of_a_driver_with_no_authored_tags_sends_an_empty_set_not_nothing` renamed +
+   re-based on an alarm-only driver, because an all-empty set has no driver-side observable and the
+   planned test would have been vacuous; the `_children.Keys` union arm remains untested (T5,
+   deviation 3).
+4. Seeder gained a second optional parameter (`tagConfigByTag`) — the only way to seed an alarm-bearing
+   raw tag, which one of the plan's own tests needs (T4).
+5. The supervision test gained a preceding `ShutdownCount >= 1` assertion, because the plan's red
+   observation was ambiguous with "the child never crashed" (T7).
+6. `Force_reconnect_keeps_the_desired_set_and_re_subscribes` uses a 30 s budget, not `PresenceBudget` —
+   `SpawnChild` gives the child the production 10 s `DefaultReconnectInterval` (T7).
+7. `_lastComposition` and `_desiredByDriver` coexist for one commit (T2) so T2 stays compilable; the
+   deletion lands in T3, as T3's own step text specifies.