docs+test(closeout): final-review reservations — stale ACL prose, worker test gaps, config sample fix

docs/DesignDecisions.md

@@ -256,11 +256,19 @@ decisions rather than one open backlog.
   shipped as **TST-01** (`GatewayEndToEndReconnectReplayTests`). Task 14 (client
   `ReplayGap` handling) shipped as **CLI-15** for four of five clients
   (.NET/Go/Rust/Python); the Java client is the only remainder.
-- **Phase 4 (per-session dashboard ACL)** — scoped, not yet built. Tracked as archreview
-  **TST-15**. The Viewer-default decision is settled: admin-sees-all, Viewer strictly
-  scoped to sessions it owns or is granted — matching the gRPC owner-binding decision in
-  [Session Reconnect](#session-reconnect) above, for consistency between the gRPC and
-  dashboard surfaces.
+- **Phase 4 (per-session dashboard ACL)** — shipped 2026-08-17 (branch
+  `feat/deferred-closeout`), tracked as archreview **TST-15**. The Viewer default is
+  admin-sees-all, Viewer strictly scoped — but the scope is the session **tag**, not
+  session ownership. The dashboard authenticates LDAP users while sessions are owned by
+  API keys, two disjoint identity domains, so there is no "sessions it owns" branch to
+  write: `GatewaySession.Tags` is inherited from the owning key's `DashboardTags`, a
+  dashboard group grants tags via `MxGateway:Dashboard:GroupToTag`, and
+  `IDashboardSessionAcl.CanViewSession` allows a Viewer iff the two sets intersect.
+  Administrators bypass the intersection; an untagged session is Admin-only under the
+  default `MxGateway:Dashboard:UntaggedSessionVisibility=AdminOnly`. The decision is
+  taken at both subscribe seams (`EventsHub.SubscribeSession` and the in-process
+  `IDashboardSessionEventSubscriber.Subscribe`), never per event. See
+  `docs/plans/2026-07-10-dashboard-session-acl-tst15.md` and `docs/Authorization.md`.
 - **Phase 5 (orphan-worker reattach)** — deferred, not planned. It would reverse the
   "Gateway restart does not reattach orphan workers" invariant (see CLAUDE.md), adding a
   stable gateway-instance id, an adoption-manifest SQLite store, a worker phone-home
@@ -270,7 +278,7 @@ decisions rather than one open backlog.
   if it does** until that task actually lands.
 
 `docs/plans/2026-06-15-session-resilience.md.tasks.json` remains the sole resume state
-for the still-pending Phase 4 tasks (16-19) and the deferred Phase 5 tasks (20-28) — one
+for the Phase 4 tasks (16-19, now shipped) and the deferred Phase 5 tasks (20-28) — one
 authority, no mirror.
 
 ## Authentication