chore(plan): followups-and-tickets as-built record; prior follow-ups closed

docs/plans/2026-08-17-followup-closeout.md

@@ -480,22 +480,40 @@ design; they need only a cheap tip re-build there.
   rig shows the new GUID replaces the record. The prose that implied coexistence was
   corrected rather than the code.
 
-Follow-ups recorded, not started:
+Follow-ups recorded, not started — **all closed 2026-08-18 on `feat/followups-tickets`**
+(plan `docs/plans/2026-08-18-followups-and-tickets.md`; per-bullet closing commits below):
 
 - `WorkerPipeSessionTests.RunAsync_LongInFlightCommandThatKeepsPumping_DoesNotFaultAndDeliversReply`
   fails deterministically on windev **and on `main`** — pre-existing, needs its own
-  investigation.
+  investigation. *Closed (`7da52b6`, `462850a`, `aaeb86b`): test-harness defect — the fake
+  runtime session stamped STA activity only at construction, so the watchdog correctly
+  faulted `StaHung` pre-dispatch. Test-only fix; windev worker suite fully green (524/11
+  skipped) for the first time.*
 - `check-codegen.ps1` Check 4 is unrunnable on Windows: the `protoc-gen-go` version banner
   carries a `.exe` suffix that the exact-string compare in
-  `clients/go/generate-proto.ps1:10,55` does not tolerate.
-- Windev has `protoc-gen-go-grpc` 1.6.1 against the repo's pinned 1.6.2.
+  `clients/go/generate-proto.ps1:10,55` does not tolerate. *Closed (`c94c4d4`, plus
+  `8ae0c2f` for a second Windows-only blocker found during verification: PS 5.1 strips
+  embedded double quotes from the Python probe's `-c` argument). Check 4 verified 4/4 on
+  windev under both PowerShell 5.1 and pwsh 7.*
+- Windev has `protoc-gen-go-grpc` 1.6.1 against the repo's pinned 1.6.2. *Closed: 1.6.2
+  installed on windev; `docs/ToolchainLinks.md` corrected from `@latest` to the pinned
+  install commands (`6b5c737`).*
 - `clients/java`'s `checkGeneratedClean` is dead under Gradle 9 (`Project.exec` was
-  removed); it needs `ExecOperations` injection to work again.
+  removed); it needs `ExecOperations` injection to work again. *Closed (`df45cb4`) via
+  `ProviderFactory.exec`; verified on Gradle 9.5.1 (macOS) and 9.4.1 (windev), including
+  a configuration-cache ordering proof.*
 - `SettingsPage` renders every `EffectiveDashboardConfiguration` member except
   `RecentFaultLimit` / `RecentSessionLimit` (pre-existing, predates this branch).
+  *Closed (`a390fe1`, test tightened in `fb68bdb`).*
 - The ack-leg probe stays blocked; unblock paths are in `docs/AlarmProbeFindings.md`.
+  *Closed as answered-why (`d1ae43d`, `bc22792`, `1605f54`): the ack is unavailable by
+  configuration — the test attributes carry `MxSecurityOperate` and no `AlarmAckByName`
+  overload can carry a credential (inferred, caveated). The GUID-across-ack question
+  itself stays assumed; the remaining paths need a human at an interactive client.*
 - The dashboard `AlarmsPage` truncation banner is still poll-driven — it could consume
-  the new `snapshot_status` feed frame instead.
+  the new `snapshot_status` feed frame instead. *Closed (`7b6dfba`, `f57a6ae`): the
+  page's status feed loop now consumes `snapshot_status`; the poll stays as reconcile
+  baseline.*
 - **A closed code-review finding regressed, or was never applied.** Server-012
   (`code-reviews/Server/findings.md:405-412`) is recorded *Resolved 2026-05-18* and claims
   it corrected two scope lists to the canonical `*:*` strings — the `CLAUDE.md`
@@ -504,7 +522,9 @@ Follow-ups recorded, not started:
   with a third instance the finding never covered (`docs/Authentication.md`'s `ops.alice`
   example). The bookkeeping is the follow-up: other `Server-0xx` entries marked Resolved
   with documentation-only fixes should be spot-checked for the same pattern, since a
-  finding that reads Resolved is not otherwise re-examined.
+  finding that reads Resolved is not otherwise re-examined. *Closed (`d3ac527`): 20
+  doc-only resolutions audited; two more regressions found and re-fixed (Server-040,
+  Server-009); four moot (target files deleted); annotations recorded in findings.md.*
 
 Explicitly decided, not an omission: **`../scadaproj/CLAUDE.md` needs no update.** The
 umbrella index records the *set* of `.proto` files this repo owns, and that set is

docs/plans/2026-08-18-followups-and-tickets.md

@@ -459,3 +459,68 @@ accepted-but-inert (`rc=0`, state stays `UNACK_ALM`), and `.Acked` is write-reje
   Wave 4 = Task 10, final integration review, then hold for the user's merge decision.
 - **Push cadence:** controller pushes the branch before any windev task needs its code
   there (Task 7 investigates on-branch; Tasks 8–9 need the wave-1/2 tips).
+
+---
+
+## As-built record (2026-08-18)
+
+All 10 tasks completed on `feat/followups-tickets`; every classification-driven review
+chain resolved **Approved** (Tasks 5, 7, and 8 after fix rounds; Task 7's high-risk chain
+took two rounds, ending with the mid-window auto-release race made structurally
+unreachable — 30 s `BlockedDispatchSafetyNet` > every test's 20 s cancellation). The
+final integration review returned *Ready with reservations*; every reservation was fixed
+on-branch: I-2 (`6b5c737` — `ToolchainLinks.md` recorded `@latest` for plugins the
+regeneration script hard-pins), I-3 (`db7b1db` — three doc sites claimed full-DN
+`GroupToRole`/`GroupToTag` keys work; the Server-040 restoration proves they never match
+the pre-stripped groups; rows were pre-existing on `main`), M-2/M-5 (`1605f54`), M-3
+(`fb68bdb`), M-4 (`753d070`), and M-1 was discharged by evidence (a
+`--configuration-cache --rerun-tasks` discriminator proved `providers.exec` evaluates at
+execution time after `generateProto`; no change needed).
+
+Verification (Task 9, windev CI clone at `5417222`, post-fix commits re-verified
+individually by their owners at their pushed tips): full `slnx` 0W/0E; worker x86 **524
+passed / 11 skipped / 0 failed** — the suite's first fully green windev run; gateway
+1155/1155 with no reruns; `check-codegen.ps1` **4/4 on Windows** under pwsh 7, and after
+`8ae0c2f` also end-to-end under Windows PowerShell 5.1; Gradle 9.4.1
+`checkGeneratedClean` green on windev (and 9.5.1 on macOS); live MXAccess smoke 8/8;
+toolchain pins now real on windev (`protoc-gen-go v1.36.11`, `protoc-gen-go-grpc 1.6.2`).
+
+Notable findings made along the way:
+
+- **Check 4 had a second Windows-only blocker** behind the `.exe` banner: Windows
+  PowerShell 5.1 strips embedded double quotes when marshaling native-exe args, breaking
+  the Python `grpcio-tools` version probe (`clients/python/generate-proto.ps1:39`).
+  Fixed (`8ae0c2f`) by swapping quote nesting; no other native-exe invocation in the
+  codegen scripts carries the pattern.
+- **The ack leg is blocked by galaxy security configuration**, not a missing verb: the
+  probe fixtures carry `MxSecurityOperate`, and no `AlarmAckByName` overload can convey
+  an authenticated identity (inferred from mechanism, honestly caveated). `gateway.md`
+  and `docs/Grpc.md` now carry the "acceptance is not application" caveat on the
+  acknowledge RPC.
+- **The `fca978d` tracking-marker sweep deleted substantive prose** along with markers in
+  at least one place (Server-040's precedence comment plus an operator-facing RDN
+  paragraph that was never part of the finding). A targeted re-read of that commit's
+  larger comment deletions is ticket-worthy (203 files swept; only the audited file was
+  examined).
+- **`generateProto`'s up-to-date check does not notice an out-of-band deletion** of a
+  single generated file (protobuf-gradle-plugin behavior, orthogonal to this branch) — a
+  manually deleted generated file stays missing until a `.proto` change or
+  `--rerun-tasks` invalidates the task.
+- Windev process notes: the CI clone sat on a detached HEAD, so bare `git pull` silently
+  no-ops (use `git pull origin <branch>`); concurrent MSBuilds on the clone can kill each
+  other's child nodes (MSB4166) — `-m:1` avoids it; ssh can transiently refuse with "Too
+  many authentication failures" under agent concurrency (back off and retry).
+
+Follow-ups recorded, not started (deliberately small):
+
+- The `fca978d` sweep re-read (above) — the one genuinely ticket-worthy item.
+- `DashboardGroupTagMapping`'s class-level `<summary>` still describes the lookup as
+  "full DN first, leading-RDN fallback" — accurate mechanics, but it could point at the
+  short-name-keys consequence the inline comment now records.
+- wwtools `mxa read` human-readable formatter throws `RuntimeBinderException` on a failed
+  read (`ReadCommand.cs:137`); `--llm-json` works. Different repo, noted here so it isn't
+  lost.
+
+Explicitly decided, not an omission: **`../scadaproj/CLAUDE.md` needs no update** — no
+`.proto`, contract, command, or architecture fact the umbrella index records changed on
+this branch.

docs/plans/2026-08-18-followups-and-tickets.md.tasks.json

@@ -9,8 +9,8 @@
     {"id": 6, "subject": "Task 6: Server-0xx doc-only resolution audit", "status": "completed", "commit": "d3ac527", "review": "Spec compliant; code review Approved (controller verified DashboardGroupRoleMapping change comment-only). 20 entries audited; 2 regressions re-fixed (Server-040 swept comment block incl. RDN pre-strip paragraph; Server-009 WAL/busy-timeout prose); 4 moot (target deleted); Server-038 closed-not-regressed. Systemic finding: fca978d tracking-marker sweep deleted substantive prose in at least one place"},
     {"id": 7, "subject": "Task 7: WorkerPipeSessionTests deterministic failure — investigate + fix (windev)", "status": "completed", "commits": ["7da52b6", "462850a", "aaeb86b"], "review": "High-risk chain: spec compliant; code review Approved after two fix rounds (doc-comment attachment; watchdog-window headroom 200ms/1s + 2s window/30-frame floor; 30s BlockedDispatchSafetyNet > 20s CTS makes the mid-window auto-release race structurally unreachable). Root cause: test-harness defect — FakeRuntimeSession stamped LastStaActivityUtc only at construction, watchdog correctly faulted StaHung pre-dispatch. Test-only fix; windev worker suite 524 passed/11 skipped (was 523+1 fail)"},
     {"id": 8, "subject": "Task 8: Ack-leg probe bounded unblock attempt (windev rig)", "status": "completed", "commits": ["d1ae43d", "bc22792"], "review": "Spec compliant; code review Approved after fixes (superseded bullet closed, summary hedged, gobject_id evidenced, ack-caveat added to gateway.md + Grpc.md as authorized scope extension). Outcome: ack unavailable-by-configuration (MxSecurityOperate classification, no credential-bearing AlarmAckByName overload — inferred, honestly caveated); no .Ack attribute exists; no non-interactive platform-side surface; GUID-across-ack row stays Open with reason updated"},
-    {"id": 9, "subject": "Task 9: Windev toolchain pin + full verification", "status": "in_progress", "blockedBy": [1, 2, 3, 4, 5, 6, 7, 8]},
-    {"id": 10, "subject": "Task 10: Bookkeeping — close the follow-ups record", "status": "pending", "blockedBy": [9]}
+    {"id": 9, "subject": "Task 9: Windev toolchain pin + full verification", "status": "completed", "verifiedAt": "5417222", "commit": "6b5c737", "result": "protoc-gen-go-grpc 1.6.2 installed; slnx 0W/0E; worker x86 524/11/0; gateway 1155/1155; check-codegen 4/4 (pwsh 7; and under PS 5.1 after 8ae0c2f fixed the quote-stripping probe bug it surfaced); Gradle 9.4.1 checkGeneratedClean green; live smoke 8/8; ToolchainLinks @latest rows corrected to pins (integration-review I-2)"},
+    {"id": 10, "subject": "Task 10: Bookkeeping — close the follow-ups record", "status": "completed", "review": "None (trivial); closes the 2026-08-17 plan's follow-ups block with per-bullet commits, appends the as-built record (integration-review resolution: I-2 6b5c737, I-3 db7b1db, M-2/M-5 1605f54, M-3 fb68bdb, M-4 753d070, M-1 discharged by evidence; plus 8ae0c2f PS5.1 fix), final statuses here"}
   ],
   "lastUpdated": "2026-08-18"
 }