chore(plan): followups-and-tickets as-built record; prior follow-ups closed

docs/plans/2026-08-17-followup-closeout.md

@@ -480,22 +480,40 @@ design; they need only a cheap tip re-build there.
   rig shows the new GUID replaces the record. The prose that implied coexistence was
   corrected rather than the code.
 
-Follow-ups recorded, not started:
+Follow-ups recorded, not started — **all closed 2026-08-18 on `feat/followups-tickets`**
+(plan `docs/plans/2026-08-18-followups-and-tickets.md`; per-bullet closing commits below):
 
 - `WorkerPipeSessionTests.RunAsync_LongInFlightCommandThatKeepsPumping_DoesNotFaultAndDeliversReply`
   fails deterministically on windev **and on `main`** — pre-existing, needs its own
-  investigation.
+  investigation. *Closed (`7da52b6`, `462850a`, `aaeb86b`): test-harness defect — the fake
+  runtime session stamped STA activity only at construction, so the watchdog correctly
+  faulted `StaHung` pre-dispatch. Test-only fix; windev worker suite fully green (524/11
+  skipped) for the first time.*
 - `check-codegen.ps1` Check 4 is unrunnable on Windows: the `protoc-gen-go` version banner
   carries a `.exe` suffix that the exact-string compare in
-  `clients/go/generate-proto.ps1:10,55` does not tolerate.
-- Windev has `protoc-gen-go-grpc` 1.6.1 against the repo's pinned 1.6.2.
+  `clients/go/generate-proto.ps1:10,55` does not tolerate. *Closed (`c94c4d4`, plus
+  `8ae0c2f` for a second Windows-only blocker found during verification: PS 5.1 strips
+  embedded double quotes from the Python probe's `-c` argument). Check 4 verified 4/4 on
+  windev under both PowerShell 5.1 and pwsh 7.*
+- Windev has `protoc-gen-go-grpc` 1.6.1 against the repo's pinned 1.6.2. *Closed: 1.6.2
+  installed on windev; `docs/ToolchainLinks.md` corrected from `@latest` to the pinned
+  install commands (`6b5c737`).*
 - `clients/java`'s `checkGeneratedClean` is dead under Gradle 9 (`Project.exec` was
-  removed); it needs `ExecOperations` injection to work again.
+  removed); it needs `ExecOperations` injection to work again. *Closed (`df45cb4`) via
+  `ProviderFactory.exec`; verified on Gradle 9.5.1 (macOS) and 9.4.1 (windev), including
+  a configuration-cache ordering proof.*
 - `SettingsPage` renders every `EffectiveDashboardConfiguration` member except
   `RecentFaultLimit` / `RecentSessionLimit` (pre-existing, predates this branch).
+  *Closed (`a390fe1`, test tightened in `fb68bdb`).*
 - The ack-leg probe stays blocked; unblock paths are in `docs/AlarmProbeFindings.md`.
+  *Closed as answered-why (`d1ae43d`, `bc22792`, `1605f54`): the ack is unavailable by
+  configuration — the test attributes carry `MxSecurityOperate` and no `AlarmAckByName`
+  overload can carry a credential (inferred, caveated). The GUID-across-ack question
+  itself stays assumed; the remaining paths need a human at an interactive client.*
 - The dashboard `AlarmsPage` truncation banner is still poll-driven — it could consume
-  the new `snapshot_status` feed frame instead.
+  the new `snapshot_status` feed frame instead. *Closed (`7b6dfba`, `f57a6ae`): the
+  page's status feed loop now consumes `snapshot_status`; the poll stays as reconcile
+  baseline.*
 - **A closed code-review finding regressed, or was never applied.** Server-012
   (`code-reviews/Server/findings.md:405-412`) is recorded *Resolved 2026-05-18* and claims
   it corrected two scope lists to the canonical `*:*` strings — the `CLAUDE.md`
@@ -504,7 +522,9 @@ Follow-ups recorded, not started:
   with a third instance the finding never covered (`docs/Authentication.md`'s `ops.alice`
   example). The bookkeeping is the follow-up: other `Server-0xx` entries marked Resolved
   with documentation-only fixes should be spot-checked for the same pattern, since a
-  finding that reads Resolved is not otherwise re-examined.
+  finding that reads Resolved is not otherwise re-examined. *Closed (`d3ac527`): 20
+  doc-only resolutions audited; two more regressions found and re-fixed (Server-040,
+  Server-009); four moot (target files deleted); annotations recorded in findings.md.*
 
 Explicitly decided, not an omission: **`../scadaproj/CLAUDE.md` needs no update.** The
 umbrella index records the *set* of `.proto` files this repo owns, and that set is