chore(plan): followups-and-tickets as-built record; prior follow-ups closed

docs/plans/2026-08-18-followups-and-tickets.md

@@ -459,3 +459,68 @@ accepted-but-inert (`rc=0`, state stays `UNACK_ALM`), and `.Acked` is write-reje
   Wave 4 = Task 10, final integration review, then hold for the user's merge decision.
 - **Push cadence:** controller pushes the branch before any windev task needs its code
   there (Task 7 investigates on-branch; Tasks 8–9 need the wave-1/2 tips).
+
+---
+
+## As-built record (2026-08-18)
+
+All 10 tasks completed on `feat/followups-tickets`; every classification-driven review
+chain resolved **Approved** (Tasks 5, 7, and 8 after fix rounds; Task 7's high-risk chain
+took two rounds, ending with the mid-window auto-release race made structurally
+unreachable — 30 s `BlockedDispatchSafetyNet` > every test's 20 s cancellation). The
+final integration review returned *Ready with reservations*; every reservation was fixed
+on-branch: I-2 (`6b5c737` — `ToolchainLinks.md` recorded `@latest` for plugins the
+regeneration script hard-pins), I-3 (`db7b1db` — three doc sites claimed full-DN
+`GroupToRole`/`GroupToTag` keys work; the Server-040 restoration proves they never match
+the pre-stripped groups; rows were pre-existing on `main`), M-2/M-5 (`1605f54`), M-3
+(`fb68bdb`), M-4 (`753d070`), and M-1 was discharged by evidence (a
+`--configuration-cache --rerun-tasks` discriminator proved `providers.exec` evaluates at
+execution time after `generateProto`; no change needed).
+
+Verification (Task 9, windev CI clone at `5417222`, post-fix commits re-verified
+individually by their owners at their pushed tips): full `slnx` 0W/0E; worker x86 **524
+passed / 11 skipped / 0 failed** — the suite's first fully green windev run; gateway
+1155/1155 with no reruns; `check-codegen.ps1` **4/4 on Windows** under pwsh 7, and after
+`8ae0c2f` also end-to-end under Windows PowerShell 5.1; Gradle 9.4.1
+`checkGeneratedClean` green on windev (and 9.5.1 on macOS); live MXAccess smoke 8/8;
+toolchain pins now real on windev (`protoc-gen-go v1.36.11`, `protoc-gen-go-grpc 1.6.2`).
+
+Notable findings made along the way:
+
+- **Check 4 had a second Windows-only blocker** behind the `.exe` banner: Windows
+  PowerShell 5.1 strips embedded double quotes when marshaling native-exe args, breaking
+  the Python `grpcio-tools` version probe (`clients/python/generate-proto.ps1:39`).
+  Fixed (`8ae0c2f`) by swapping quote nesting; no other native-exe invocation in the
+  codegen scripts carries the pattern.
+- **The ack leg is blocked by galaxy security configuration**, not a missing verb: the
+  probe fixtures carry `MxSecurityOperate`, and no `AlarmAckByName` overload can convey
+  an authenticated identity (inferred from mechanism, honestly caveated). `gateway.md`
+  and `docs/Grpc.md` now carry the "acceptance is not application" caveat on the
+  acknowledge RPC.
+- **The `fca978d` tracking-marker sweep deleted substantive prose** along with markers in
+  at least one place (Server-040's precedence comment plus an operator-facing RDN
+  paragraph that was never part of the finding). A targeted re-read of that commit's
+  larger comment deletions is ticket-worthy (203 files swept; only the audited file was
+  examined).
+- **`generateProto`'s up-to-date check does not notice an out-of-band deletion** of a
+  single generated file (protobuf-gradle-plugin behavior, orthogonal to this branch) — a
+  manually deleted generated file stays missing until a `.proto` change or
+  `--rerun-tasks` invalidates the task.
+- Windev process notes: the CI clone sat on a detached HEAD, so bare `git pull` silently
+  no-ops (use `git pull origin <branch>`); concurrent MSBuilds on the clone can kill each
+  other's child nodes (MSB4166) — `-m:1` avoids it; ssh can transiently refuse with "Too
+  many authentication failures" under agent concurrency (back off and retry).
+
+Follow-ups recorded, not started (deliberately small):
+
+- The `fca978d` sweep re-read (above) — the one genuinely ticket-worthy item.
+- `DashboardGroupTagMapping`'s class-level `<summary>` still describes the lookup as
+  "full DN first, leading-RDN fallback" — accurate mechanics, but it could point at the
+  short-name-keys consequence the inline comment now records.
+- wwtools `mxa read` human-readable formatter throws `RuntimeBinderException` on a failed
+  read (`ReadCommand.cs:137`); `--llm-json` works. Different repo, noted here so it isn't
+  lost.
+
+Explicitly decided, not an omission: **`../scadaproj/CLAUDE.md` needs no update** — no
+`.proto`, contract, command, or architecture fact the umbrella index records changed on
+this branch.