docs: source-verified deferment register + correct 17 drifted docs

Adds deferment.md — a source-verified inventory of new-driver status, all 17
open issues, in-code deferrals, open live gates and plan bookkeeping. Every
claim was checked against src/ and git, not against documentation.

Headline finding: three subsystems are authored, persisted and shipped but
never executed —
  * Node ACLs: IPermissionEvaluator/TriePermissionEvaluator have zero
    production consumers and OtOpcUaNodeManager never references them, yet
    ClusterAcls.razor authors NodeAcl rows and ConfigComposer.cs:51 ships them
    in every artifact. An authored deny rule has no effect.
  * IRediscoverable / IHostConnectivityProbe raise into the void (#518/#507);
    nothing ever writes a DriverHostStatus row.
  * DriverTypeRegistry is vestigial, so no factory passes a tier and every
    driver runs Tier A with the Tier-C protections dormant.

Also records the Calculation driver as picker-visible but unauthorable
(DriverConfigModal has no case) — the "registered but unauthorable" class
recurring after the Sql picker defect — and notes that no parity test guards
DriverConfigModal/DeviceModal, which is why it survived review.

Documentation corrections (source-verified):
  * ReadWriteOperations.md claimed "a denied read never hits the driver" via
    four types that do not exist in src/. Bannered + struck through; a security
    review reading that page would have concluded a per-node ACL gate exists.
  * CLAUDE.md: the Change Detection sentence was false (DriverHost consumes
    nothing); the mesh Phase 4 and Phase 5 live gates and the auto-down 1-vs-1
    gate had all PASSED; the ScriptedAlarmState table was already dropped.
  * driver-expansion tracking: Modbus RTU and SQL poll are merged, not
    pending — its command table would have made someone rebuild two shipped
    drivers in a fresh worktree.
  * drivers/README.md: dead DriverTypeRegistry paragraph, retired
    SystemPlatform namespace kind, missing Sql + Calculation rows, missing
    Modbus RTU-over-TCP transport.
  * TwinCAT.md/Galaxy.md promised an address-space rebuild that never happens.
  * Historian.md gained the #491 unproven-value-capture pointer.
  * IncrementalSync.md and AddressSpace.md bannered as wholesale v2-era (the
    rewrite is recorded as still owed, not done here); four v2 status docs
    bannered as historical; three wrong-name-for-a-live-type fixes.

Left deliberately untouched: the secrets NoOpSecretReplicator line, which
makes a security claim and needs the real behaviour identified rather than a
rename.

docs/drivers/TwinCAT.md

@@ -92,7 +92,7 @@ discovery.
 | `ISubscribable` | native ADS notifications (default), poll fallback | `UseNativeNotifications=true` registers device notifications so the PLC pushes changes; `false` uses the shared `PollGroupEngine` |
 | `IHostConnectivityProbe` | per-device probe loop | One `HostConnectivityStatus` per configured device; `Running`/`Stopped` transitions raise `OnHostStatusChanged` |
 | `IPerCallHostResolver` | `ResolveHost` lookup in the tag map | Routes each call to the device of the referenced tag; returns an empty-string sentinel when unresolved |
-| `IRediscoverable` | symbol-version-changed callback | A PLC re-download fires `OnRediscoveryNeeded` so the address space is rebuilt |
+| `IRediscoverable` | symbol-version-changed callback | A PLC re-download fires `OnRediscoveryNeeded`. ⚠️ **No consumer wires it today** ([#518](https://gitea.dohertylan.com/dohertj2/lmxopcua/issues/518), [#507](https://gitea.dohertylan.com/dohertj2/lmxopcua/issues/507)) — the address space does **not** rebuild; a config redeploy is required. Driver-side behaviour is log-observable only |
 
 ### Rediscovery on PLC re-download
 
@@ -100,8 +100,15 @@ discovery.
 `DeviceSymbolVersionInvalid` (1809 / 0x0711) — the documented TwinCAT
 symbol-version-changed signal, raised when a PLC program is re-downloaded —
 every symbol and notification handle is invalidated. The driver raises
-`OnRediscoveryNeeded` with a `TwinCAT` scope hint so Core rebuilds the address
-space rather than treating it as a transient connection error.
+`OnRediscoveryNeeded` with a `TwinCAT` scope hint, so that the signal is treated
+as an address-space change rather than a transient connection error.
+
+⚠️ **That is the intended design, not present behaviour.** No consumer subscribes
+to `OnRediscoveryNeeded` anywhere in `src/`, and the scope hint is read by nothing
+([#518](https://gitea.dohertylan.com/dohertj2/lmxopcua/issues/518),
+[#507](https://gitea.dohertylan.com/dohertj2/lmxopcua/issues/507)). Today the
+signal is observable only in the driver log; after a PLC re-download the served
+address space changes only on a config redeploy.
 
 ### Native notifications
 
@@ -148,7 +155,7 @@ fixture is down during normal dev.
 **Live-verify** — integration-fixture-gated (requires the TwinCAT Docker fixture / AMS router).
 
 **Deferrals** — array *writes* (`ADS WriteValueAsync` for an array), multi-dimensional
-arrays, per-element historization.  `IRediscoverable` still fires and rebuilds array nodes
+arrays, per-element historization.  `IRediscoverable` still fires (but is unconsumed — #518)
 on PLC re-download (unchanged semantics from scalar nodes).
 
 See [Uns.md §Array tags](../Uns.md#array-tags-1-d) for the cross-driver coverage matrix