docs+test(closeout): final-review reservations — stale ACL prose, worker test gaps, config sample fix

docs/plans/2026-07-10-dashboard-session-acl-tst15.md

@@ -87,7 +87,8 @@ public sealed record ApiKeyConstraints(
 
 At `OpenSession`, the resolved `ApiKeyIdentity.EffectiveConstraints.DashboardTags`
 is copied onto the new `GatewaySession.Tags`. The `apikey` admin CLI gains
-`--dashboard-tags team-a,team-b` on `create`/`update`.
+`--dashboard-tags team-a,team-b` on `create-key` (there is no `update`
+subcommand — see `docs/Authentication.md`).
 
 Semantic note: `ApiKeyConstraints` today scopes *data-access* authorization
 (read/write subtrees, globs, classification). A dashboard *visibility* tag is a

docs/plans/2026-08-17-deferred-closeout.md

@@ -171,7 +171,7 @@ Task 10/11 gates it → commit
 **Files:**
 - Modify: `src/ZB.MOM.WW.MxGateway.Server/Security/Authentication/ApiKeyConstraints.cs` (add `IReadOnlyList<string> DashboardTags`, default empty)
 - Modify: `src/ZB.MOM.WW.MxGateway.Server/Security/Authentication/ApiKeyConstraintSerializer.cs` (round-trip the new field; absent-in-JSON → empty — old rows keep deserializing)
-- Modify: `src/ZB.MOM.WW.MxGateway.Server/Security/Authentication/ApiKeyAdminCommandLineParser.cs` + `ApiKeyAdminCliRunner.cs` + `ApiKeyAdminCommand.cs` + `ApiKeyAdminListedKey.cs` (CLI `--dashboard-tags team-a,team-b` on create/update; shown in list output)
+- Modify: `src/ZB.MOM.WW.MxGateway.Server/Security/Authentication/ApiKeyAdminCommandLineParser.cs` + `ApiKeyAdminCliRunner.cs` + `ApiKeyAdminCommand.cs` + `ApiKeyAdminListedKey.cs` (CLI `--dashboard-tags team-a,team-b` on `create-key` — there is no `update` subcommand; shown in list output)
 - Modify: `src/ZB.MOM.WW.MxGateway.Server/Sessions/GatewaySession.cs` (new `public IReadOnlySet<string> Tags { get; }`, set at construction from the owner key's effective constraints; empty = untagged)
 - Modify: `src/ZB.MOM.WW.MxGateway.Server/Sessions/SessionManager.cs` (`OpenSession` path copies `ApiKeyIdentity.EffectiveConstraints.DashboardTags` onto the session)
 - Test: serializer round-trip incl. legacy-JSON-without-field; CLI parse; session tag inheritance via the fake-worker harness

docs/plans/2026-08-17-deferred-closeout.md.tasks.json

@@ -11,7 +11,7 @@
     { "id": 8, "subject": "Task 8: Alarm-truncation degraded-status signal — proto + worker + gateway + dashboard", "status": "completed", "blockedBy": [3] },
     { "id": 9, "subject": "Task 9: Client regeneration + rebuild for new alarm fields", "status": "completed", "blockedBy": [8] },
     { "id": 10, "subject": "Task 10: Phase gate — full gateway suite on macOS", "status": "completed", "blockedBy": [1, 4, 5, 6, 7, 8, 9] },
-    { "id": 11, "subject": "Task 11: windev gate — full Windows verification", "status": "pending", "blockedBy": [2, 10] },
+    { "id": 11, "subject": "Task 11: windev gate — full Windows verification", "status": "completed", "blockedBy": [2, 10] },
     { "id": 12, "subject": "Task 12: Wrap-up — closure notes, umbrella check, final review", "status": "pending", "blockedBy": [11] }
   ],
   "lastUpdated": "2026-08-17T00:00:00Z"