chore(plan): close the record — prior follow-ups annotated, closeout as-built noted

The prior plan's "Follow-ups recorded, not started" block described pre-branch
behavior; every item is now closed, narrowed, or restated with its evidence, so
the block no longer misleads a reader who lands on it first. The stale Rust-guard
bullet is corrected in place rather than deleted: Check 3 always existed, and
saying so is the only way the reader learns what the real (one-directional) gap was.

Also fixes the CLAUDE.md apikey sample, which named a verb the parser has never
accepted ('create'; only 'create-key' exists, no alias), omitted the required
--key-id, and listed non-canonical scope strings that GatewayScopes now rejects
at create time — the sample could not have run.

docs/plans/2026-08-17-deferred-closeout.md

@@ -416,22 +416,44 @@ gateway 1123/1123, live MXAccess smoke 8/8 — green first try, no stale-obj qui
   had diverged from Contracts (masked by the in-repo build path); refreshed byte-identical,
   and the client protoset descriptors were regenerated.
 
-Follow-ups recorded, not started:
-- `IGatewayAlarmService.StreamAsync` / `AlarmFeedMessage` does not carry the truncation
-  signal — live central-feed consumers (lmxopcua, ScadaBridge) cannot see snapshot
-  degradation; add if those consumers need completeness reasoning.
-- No guard keeps `clients/rust/protos/` in sync with Contracts (a `diff` check in
-  `scripts/check-codegen.ps1` would close it).
-- `EffectiveDashboardConfiguration` (dashboard settings page) doesn't display
-  `GroupToTag` / `UntaggedSessionVisibility`, though it shows `GroupToRole`.
-- ApiKeysPage's `ConstraintText` neither offers tag input nor lists `DashboardTags`,
-  and since `IsEmpty` now counts tags, a tags-only key renders `-` where a truly
-  unconstrained key renders `unconstrained` — two spellings of one meaning.
-- `AlarmsHubPublisher` broadcasts alarm transitions with `current_value`/`limit_value`
-  unredacted — the `ShowTagValues` redaction covers only the events hub mirror
-  (pre-existing; now noted in `docs/GatewayConfiguration.md`).
-- The alarm probes' remaining questions (ack-leg GUID stability, `@COUNT` semantics)
-  unblock via the paths in `docs/AlarmProbeFindings.md`.
+Follow-ups recorded here — all closed or narrowed on 2026-08-18 (branch
+`feat/followup-closeout`, plan `docs/plans/2026-08-17-followup-closeout.md`).
+Each bullet states what it said when written, then its closure:
+
+- `IGatewayAlarmService.StreamAsync` / `AlarmFeedMessage` did not carry the truncation
+  signal — live central-feed consumers (lmxopcua, ScadaBridge) could not see snapshot
+  degradation. **Closed 2026-08-18 — shipped.** `AlarmSnapshotStatus` with
+  `snapshot_status = 5` on the feed: gateway-side edge emission plus open-time priming
+  (`fccf753`, `312e072`), rolled out to all five clients (`c748361`, `4d4f443`).
+- "No guard keeps `clients/rust/protos/` in sync with Contracts." **Was stale when
+  written.** `scripts/check-codegen.ps1` Check 3 already existed and already byte-compared
+  by SHA-256 in CI. The real gap was narrower — the sweep ran in one direction only, so a
+  canonical proto with no vendored copy passed. **Closed 2026-08-18** by `711793f`: Check 3
+  now sweeps both directions and a canonical proto missing its vendored copy fails.
+- `EffectiveDashboardConfiguration` (dashboard settings page) didn't display
+  `GroupToTag` / `UntaggedSessionVisibility`, though it showed `GroupToRole`.
+  **Closed 2026-08-18 — shipped** (`094f2ff`; comparer propagation fixed in `ff16c69`).
+- ApiKeysPage's `ConstraintText` neither offered tag input nor listed `DashboardTags`,
+  and since `IsEmpty` counts tags, a tags-only key rendered `-` where a truly
+  unconstrained key rendered `unconstrained`. **Closed 2026-08-18 — shipped** (`c037d99`),
+  with the create form de-duplicating typed tags ordinal-ignore-case to match the CLI
+  (`fab600d`).
+- `AlarmsHubPublisher` broadcast alarm transitions with `current_value`/`limit_value`
+  unredacted — the `ShowTagValues` redaction covered only the events hub mirror.
+  **Closed 2026-08-18** together with the `/browse` residual: `ShowTagValues` now gates
+  all three seams (`eff17d1`, `1ea6f60`, `e50ec49`).
+- The alarm probes' remaining questions (ack-leg GUID stability, `@COUNT` semantics).
+  **Narrowed 2026-08-18** by a second probe attempt that used the secured-write verb the
+  first attempt lacked (`90331b6`, `540a118`):
+  - `@COUNT` — **answered.** It reports records in the reply, not matching records in the
+    provider, so exact truncation detection through it is permanently refuted; the
+    heuristic in `IsTruncatedFetch` stays as the only available signal.
+  - clear-then-re-raise GUID — **answered.** The re-raise carries a new GUID that replaces
+    the record rather than coexisting with it, which makes the existing `Clear`+`Raise`
+    handling correct as written.
+  - ack leg — **still blocked**, now with a sharper cause: the ack returns `rc=0` and is
+    accepted but inert, so the GUID never moves. Remaining unblock paths are recorded in
+    `docs/AlarmProbeFindings.md`.
 
 ---