docs: source-verified deferment register + correct 17 drifted docs

Adds deferment.md — a source-verified inventory of new-driver status, all 17
open issues, in-code deferrals, open live gates and plan bookkeeping. Every
claim was checked against src/ and git, not against documentation.

Headline finding: three subsystems are authored, persisted and shipped but
never executed —
  * Node ACLs: IPermissionEvaluator/TriePermissionEvaluator have zero
    production consumers and OtOpcUaNodeManager never references them, yet
    ClusterAcls.razor authors NodeAcl rows and ConfigComposer.cs:51 ships them
    in every artifact. An authored deny rule has no effect.
  * IRediscoverable / IHostConnectivityProbe raise into the void (#518/#507);
    nothing ever writes a DriverHostStatus row.
  * DriverTypeRegistry is vestigial, so no factory passes a tier and every
    driver runs Tier A with the Tier-C protections dormant.

Also records the Calculation driver as picker-visible but unauthorable
(DriverConfigModal has no case) — the "registered but unauthorable" class
recurring after the Sql picker defect — and notes that no parity test guards
DriverConfigModal/DeviceModal, which is why it survived review.

Documentation corrections (source-verified):
  * ReadWriteOperations.md claimed "a denied read never hits the driver" via
    four types that do not exist in src/. Bannered + struck through; a security
    review reading that page would have concluded a per-node ACL gate exists.
  * CLAUDE.md: the Change Detection sentence was false (DriverHost consumes
    nothing); the mesh Phase 4 and Phase 5 live gates and the auto-down 1-vs-1
    gate had all PASSED; the ScriptedAlarmState table was already dropped.
  * driver-expansion tracking: Modbus RTU and SQL poll are merged, not
    pending — its command table would have made someone rebuild two shipped
    drivers in a fresh worktree.
  * drivers/README.md: dead DriverTypeRegistry paragraph, retired
    SystemPlatform namespace kind, missing Sql + Calculation rows, missing
    Modbus RTU-over-TCP transport.
  * TwinCAT.md/Galaxy.md promised an address-space rebuild that never happens.
  * Historian.md gained the #491 unproven-value-capture pointer.
  * IncrementalSync.md and AddressSpace.md bannered as wholesale v2-era (the
    rewrite is recorded as still owed, not done here); four v2 status docs
    bannered as historical; three wrong-name-for-a-live-type fixes.

Left deliberately untouched: the secrets NoOpSecretReplicator line, which
makes a security claim and needs the real behaviour identified rather than a
rename.

docs/plans/2026-07-24-driver-expansion-tracking.md

@@ -8,7 +8,7 @@
 > **Program design (architecture / shared contract / build order):**
 > [`2026-07-15-driver-expansion-program-design.md`](2026-07-15-driver-expansion-program-design.md)
 >
-> Last updated: 2026-07-24.
+> Last updated: 2026-07-27.
 
 ## Legend
 
@@ -30,8 +30,8 @@ it reaches 📝.
 | Wave | Deliverable | Design | Impl. plan | Status | Effort | Fixture / hardware |
 |---|---|---|---|---|---|---|
 | **0** | Universal Discover-backed browser | [design](2026-07-15-universal-discovery-browser-design.md) | [plan](2026-07-15-universal-discovery-browser-implementation.md) · [tasks](2026-07-15-universal-discovery-browser-implementation.md.tasks.json) | 🟡 **Live gate open** | S–M | none (retrofits shipped drivers) |
-| **1** | Modbus RTU (extend Modbus) | [design](2026-07-15-modbus-rtu-driver-design.md) | [plan](2026-07-24-modbus-rtu-driver.md) · [tasks](2026-07-24-modbus-rtu-driver.md.tasks.json) | 🟢 **Built — live gate PASSED** (11 tasks, branch `feat/modbus-rtu-driver`, pending merge) | **S (lowest)** | `pymodbus` `rtu_over_tcp` — CI-simulatable, no new infra |
-| **1** | SQL poll | [design](2026-07-15-sql-poll-driver-design.md) | [plan](2026-07-24-sql-poll-driver.md) · [tasks](2026-07-24-sql-poll-driver.md.tasks.json) | 📝 **Plan ready** (22 tasks) | S–M | **existing central SQL Server** `10.100.0.35,14330` + SQLite unit |
+| **1** | Modbus RTU (extend Modbus) | [design](2026-07-15-modbus-rtu-driver-design.md) | [plan](2026-07-24-modbus-rtu-driver.md) · [tasks](2026-07-24-modbus-rtu-driver.md.tasks.json) | ✅ **Done** — merged to master `0f38f486` (#495), 11 tasks, live gate PASSED | **S (lowest)** | `pymodbus` `rtu_over_tcp` — CI-simulatable, no new infra |
+| **1** | SQL poll | [design](2026-07-15-sql-poll-driver-design.md) | [plan](2026-07-24-sql-poll-driver.md) · [tasks](2026-07-24-sql-poll-driver.md.tasks.json) | ✅ **Done** — merged to master `4ad54037`, 22 tasks, live gate PASSED; follow-ups #496/#497/#498 closed in `28c28667` | S–M | **existing central SQL Server** `10.100.0.35,14330` + SQLite unit |
 | **2** | MTConnect Agent | [design](2026-07-15-mtconnect-driver-design.md) | [plan](2026-07-24-mtconnect-driver.md) · [tasks](2026-07-24-mtconnect-driver.md.tasks.json) | ✅ **COMPLETE** — P1 Agent MVP, all 23 tasks + the 5-leg live gate PASSED (branch `feat/mtconnect-driver`, PR #506) | S–M | Dockerized `mtconnect/agent:2.7.0.12` (not `cppagent`) — CI-simulatable, live at `10.100.0.35:5000` |
 | **2** | MQTT / Sparkplug B | [design](2026-07-15-mqtt-sparkplug-driver-design.md) | [plan](2026-07-24-mqtt-sparkplug-driver.md) · [tasks](2026-07-24-mqtt-sparkplug-driver.md.tasks.json) | ✅ **COMPLETE** — P1 + P2 shipped, both live-gated (Tasks 0–26) | M–L | Mosquitto TLS+auth **+ C# Sparkplug edge-node simulator**, live at `10.100.0.35:8883` |
 
@@ -49,22 +49,28 @@ running the classification-driven review chain (`trivial` = implement only … `
 spec-review → code-review → integration review) between tasks. The `.tasks.json` next to each plan
 tracks progress and lets a later session resume.
 
-**Paste one of these into Claude Code to build a driver:**
+> ⚠️ **All four plans below have been executed and merged.** This table is retained as the *pattern*
+> for executing a future driver plan — do **not** run these four commands, they would rebuild shipped
+> drivers in a fresh worktree. (Their `.tasks.json` files still read `pending`; that is stale
+> bookkeeping, not backlog — see `deferment.md` §6.1.)
 
-| Deliverable | Command |
-|---|---|
-| Modbus RTU (Wave 1) | `Use superpowers-extended-cc:subagent-driven-development to execute docs/plans/2026-07-24-modbus-rtu-driver.md in a new git worktree` |
-| SQL poll (Wave 1) | `Use superpowers-extended-cc:subagent-driven-development to execute docs/plans/2026-07-24-sql-poll-driver.md in a new git worktree` |
-| MTConnect (Wave 2) | `Use superpowers-extended-cc:subagent-driven-development to execute docs/plans/2026-07-24-mtconnect-driver.md in a new git worktree` |
-| MQTT/Sparkplug (Wave 2) | `Use superpowers-extended-cc:subagent-driven-development to execute docs/plans/2026-07-24-mqtt-sparkplug-driver.md in a new git worktree` |
+| Deliverable | Status | Command (pattern only — do not re-run) |
+|---|---|---|
+| Modbus RTU (Wave 1) | ✅ merged `0f38f486` | ~~`… execute docs/plans/2026-07-24-modbus-rtu-driver.md …`~~ |
+| SQL poll (Wave 1) | ✅ merged `4ad54037` | ~~`… execute docs/plans/2026-07-24-sql-poll-driver.md …`~~ |
+| MTConnect (Wave 2) | ✅ merged `90bdaa44` (#506) | ~~`… execute docs/plans/2026-07-24-mtconnect-driver.md …`~~ |
+| MQTT/Sparkplug (Wave 2) | ✅ merged `c3a2b0f7` | ~~`… execute docs/plans/2026-07-24-mqtt-sparkplug-driver.md …`~~ |
+
+For a **new** driver the invocation shape is:
+`Use superpowers-extended-cc:subagent-driven-development to execute <plan-path> in a new git worktree`
 
 - **Slash-command form** (equivalent): `/superpowers-extended-cc:subagent-driven-development <plan-path>`.
 - **Parallel-session / resume form** (batch execution with checkpoints, no fresh-subagent-per-task):
   `/superpowers-extended-cc:executing-plans <plan-path>` — reads the same `.tasks.json` and continues
   from the first pending task.
-- **Recommended order:** Modbus RTU → SQL poll → MTConnect → MQTT/Sparkplug (lowest effort first;
-  see each wave below for the gating notes). Run one plan per worktree; the four plans are
-  independent, so separate worktrees may run concurrently.
+- **Order (historical):** the four were built lowest-effort-first — Modbus RTU → SQL poll → MTConnect
+  → MQTT/Sparkplug. All are merged; nothing in this list remains to schedule. Run one plan per
+  worktree; independent plans may run concurrently in separate worktrees.
 
 ---
 
@@ -87,12 +93,12 @@ marginal cost.
 
 ---
 
-## Wave 1 — low-effort / high-leverage pair 📝
+## Wave 1 — low-effort / high-leverage pair ✅
 
 Both are **fully CI-simulatable with zero new hardware**; Modbus RTU needs no new infra at all, and
-SQL poll reuses the always-on central SQL Server. This is the recommended next build.
+SQL poll reuses the always-on central SQL Server. **Both shipped.**
 
-### Modbus RTU — 🟢 Built, live gate PASSED (branch `feat/modbus-rtu-driver`, pending merge)
+### Modbus RTU — ✅ Done (merged `0f38f486` / #495, live gate PASSED)
 - **Design:** [`2026-07-15-modbus-rtu-driver-design.md`](2026-07-15-modbus-rtu-driver-design.md)
 - **Implementation plan:** [`2026-07-24-modbus-rtu-driver.md`](2026-07-24-modbus-rtu-driver.md) · [`.tasks.json`](2026-07-24-modbus-rtu-driver.md.tasks.json) — **11 tasks** (1 trivial / 5 small / 2 standard / 3 high-risk), all complete via subagent-driven-development.
 - **Scope:** extend the existing Modbus driver with a `Transport` selector (RTU CRC-16 + FC-aware
@@ -117,11 +123,14 @@ SQL poll reuses the always-on central SQL Server. This is the recommended next b
     → **5, Good**; **write** `ns=2;s=rtu-gate/Device1/HR200` = 4242 → readback **4242, Good**.
 - **Effort:** **S — the lowest on the roadmap.** Delivered first, as recommended.
 
-### SQL poll — 📝 Plan ready
+### SQL poll — ✅ Done (merged `4ad54037`, live gate PASSED)
 - **Design:** [`2026-07-15-sql-poll-driver-design.md`](2026-07-15-sql-poll-driver-design.md)
-- **Implementation plan:** [`2026-07-24-sql-poll-driver.md`](2026-07-24-sql-poll-driver.md) · [`.tasks.json`](2026-07-24-sql-poll-driver.md.tasks.json) — **22 tasks**. `ISqlDialect` seam in from day one; only the SQL Server dialect built in v1 (Postgres/ODBC deferred).
-- **Scope:** a bespoke schema-browser driver polling a SQL table into equipment tags (SQL Server P1;
-  Postgres/ODBC land in P2/P3 behind `ISqlDialect`).
+- **Implementation plan:** [`2026-07-24-sql-poll-driver.md`](2026-07-24-sql-poll-driver.md) · [`.tasks.json`](2026-07-24-sql-poll-driver.md.tasks.json) — **22 tasks, all done**. `ISqlDialect` + `SqlServerDialect` shipped; Postgres/ODBC remain deferred to P2/P3 behind the same seam.
+- **Post-merge follow-ups closed** in `28c28667`: #496 catalog identifier-validation gate
+  (`4dc2ad80`), #497 wrong status-code constants across six drivers, #498 deploy-gate rejection of a
+  persisted `connectionString` (`1919a8e5`).
+- **Scope:** a bespoke schema-browser driver polling a SQL table into equipment tags (SQL Server
+  shipped; Postgres/ODBC deferred behind `ISqlDialect`).
 - **Fixture:** SQLite unit fixture (primary) + an **env-gated integration fixture against the
   existing central SQL Server** (`10.100.0.35,14330`) with a seeded `SqlPollFixture` DB. The
   blackhole/timeout live-gate pauses a **dedicated** `mssql` container — **never** the shared
@@ -130,7 +139,7 @@ SQL poll reuses the always-on central SQL Server. This is the recommended next b
 
 ---
 
-## Wave 2 — strategic telemetry / UNS pair 📝
+## Wave 2 — strategic telemetry / UNS pair ✅
 
 Both CI-simulatable on the shared docker host, no hardware.
 
@@ -242,9 +251,10 @@ Both CI-simulatable on the shared docker host, no hardware.
 
 1. **Close the Wave-0 live gate** (Gitea #468) — unblocks browse verification for BACnet (MTConnect
    shipped its own Task-21 live `/run` gate independently — see the plan file).
-2. **Build Wave 1** — Modbus RTU first (lowest effort, no new infra), then SQL poll. Both plans are
-   📝 ready; run the command from the [Executing a plan](#executing-a-plan-git-worktree--subagent-per-task)
-   table (subagent-driven-development in a git worktree).
+2. **Wave 1 is done.** Both deliverables shipped and live-gated: **Modbus RTU-over-TCP** (merged
+   `0f38f486` / #495) and **SQL poll** (merged `4ad54037`; follow-ups #496/#497/#498 closed in
+   `28c28667`). Remaining SQL work is optional follow-on — Postgres/ODBC dialects behind
+   `ISqlDialect`, and `SqlTagModel.Query` (P3, currently rejected end-to-end by design).
 3. **Wave 2 is done.** Both deliverables shipped and live-gated: **MQTT / Sparkplug B** (P1 + P2) and **MTConnect Agent** (P1 Agent MVP, PR #506). Remaining work on both is optional follow-on — MQTT P3 write-through (`IWritable`: NCMD/DCMD + plain publish) plus its two browse-UI
    gaps, and MTConnect write-back (deliberately deferred; the Agent surface is read-only).