chore(plan): close the record — prior follow-ups annotated, closeout as-built noted

The prior plan's "Follow-ups recorded, not started" block described pre-branch
behavior; every item is now closed, narrowed, or restated with its evidence, so
the block no longer misleads a reader who lands on it first. The stale Rust-guard
bullet is corrected in place rather than deleted: Check 3 always existed, and
saying so is the only way the reader learns what the real (one-directional) gap was.

Also fixes the CLAUDE.md apikey sample, which named a verb the parser has never
accepted ('create'; only 'create-key' exists, no alias), omitted the required
--key-id, and listed non-canonical scope strings that GatewayScopes now rejects
at create time — the sample could not have run.

docs/plans/2026-08-17-followup-closeout.md

@@ -448,3 +448,56 @@ clear obj/bin and rebuild, not a regression. Record all counts.
   payload-case row), closeout-plan follow-ups→Task 9 only.
 - Task 7/8 run against windev over `ssh windev` (PowerShell); psbridge is fallback.
 - Do not merge to `main` without user instruction.
+
+---
+
+## As-built notes (execution record, 2026-08-18)
+
+All 9 tasks completed on `feat/followup-closeout`; every classification-driven review
+chain resolved **Approved**. The final integration review came back *Ready with
+reservations* — all of its non-blocking findings were fixed in `c3c603f`, leaving no
+open review item.
+
+Verification: macOS `NonWindows.slnx` 0W/0E; gateway filtered suites green (dashboard
+276/276, alarm suites green); `scripts/check-codegen.ps1` 4/4 on macOS. **The full
+five-language client matrix ran locally for the first time** — dotnet 133 passed /1
+skipped, Go clean, Rust 108, Python 168 passed /1 skipped, Java 131. Windev at `90331b6`:
+full `slnx` 0W/0E (one transient MSB4166 node crash, clean on retry), worker x86 523
+passed / 11 skipped plus **one pre-existing deterministic failure that reproduces on
+`main`** (`WorkerPipeSessionTests.RunAsync_LongInFlightCommandThatKeepsPumping_DoesNotFaultAndDeliversReply`),
+gateway 1151/1151 on rerun (the known windev load flake), live MXAccess smoke 8/8. The
+comment- and prose-only commits landed after `90331b6` are unverified on windev by
+design; they need only a cheap tip re-build there.
+
+- **A session-limit outage interrupted four reviewers mid-run.** All four resumed
+  cleanly on retry; no review was lost or silently truncated.
+- **Task 2 surfaced two plan defects, both absorbed rather than deferred.** The spec
+  claimed the Java CLI renders alarm frames as generic JSON; it is in fact an exhaustive
+  `switch` that does not compile without an arm for the new case. The spec's work list
+  also omitted the Java generated-bindings tree.
+- **A reviewer's Minor-2 was refuted, and the doc defect behind it fixed instead.** The
+  finding assumed alarm records coexist after a re-raise; fetch evidence from the probe
+  rig shows the new GUID replaces the record. The prose that implied coexistence was
+  corrected rather than the code.
+
+Follow-ups recorded, not started:
+
+- `WorkerPipeSessionTests.RunAsync_LongInFlightCommandThatKeepsPumping_DoesNotFaultAndDeliversReply`
+  fails deterministically on windev **and on `main`** — pre-existing, needs its own
+  investigation.
+- `check-codegen.ps1` Check 4 is unrunnable on Windows: the `protoc-gen-go` version banner
+  carries a `.exe` suffix that the exact-string compare in
+  `clients/go/generate-proto.ps1:10,55` does not tolerate.
+- Windev has `protoc-gen-go-grpc` 1.6.1 against the repo's pinned 1.6.2.
+- `clients/java`'s `checkGeneratedClean` is dead under Gradle 9 (`Project.exec` was
+  removed); it needs `ExecOperations` injection to work again.
+- `SettingsPage` renders every `EffectiveDashboardConfiguration` member except
+  `RecentFaultLimit` / `RecentSessionLimit` (pre-existing, predates this branch).
+- The ack-leg probe stays blocked; unblock paths are in `docs/AlarmProbeFindings.md`.
+- The dashboard `AlarmsPage` truncation banner is still poll-driven — it could consume
+  the new `snapshot_status` feed frame instead.
+
+Explicitly decided, not an omission: **`../scadaproj/CLAUDE.md` needs no update.** The
+umbrella index records the *set* of `.proto` files this repo owns, and that set is
+unchanged — Task 1 added a message and a field inside an existing proto, not a new
+contract file.