docs(plans): closeout as-built record; prior plan's out-of-scope table closed

docs/plans/2026-08-15-deferred-remediation.md

@@ -309,6 +309,15 @@ Push the branch to origin, then on windev (`ssh windev`, clone `C:\build\mxacces
 | SEC-25 per-session dashboard event ACL | Security roadmap item; Task 6 deliberately preserves the current posture. |
 | `MxAccessWriteCompletionCache` clone | Different lifecycle than the value cache; consciously kept (Task 12.5). |
 
+Closure (2026-08-17, [`docs/plans/2026-08-17-deferred-closeout.md`](2026-08-17-deferred-closeout.md),
+branch `feat/deferred-closeout`): the probes were **attempted** — the rig's alarm-condition
+writes are refused (`SecurityError` from the responding object), so GUID identity is confirmed
+for the active→returned leg only and `@COUNT` stays unverified; evidence and unblock paths in
+`docs/AlarmProbeFindings.md`. The truncation degraded-status signal **shipped** (additive proto
+fields, worker→gateway→dashboard, all five clients regenerated). SEC-25 **shipped** (per-session
+event ACL on both dashboard subscribe seams; design doc marked Implemented). The
+`MxAccessWriteCompletionCache` clone row remains consciously kept.
+
 ---
 
 ## As-built notes (execution record)

docs/plans/2026-08-17-deferred-closeout.md

@@ -386,6 +386,49 @@ skipped.
 
 ---
 
+## As-built notes (execution record, 2026-08-17)
+
+All 12 tasks completed on `feat/deferred-closeout`; every implement went through its
+classification's review chain to Approved. Verification: macOS build 0W/0E + gateway
+1123/1123; windev full slnx 0W/0E, worker x86 523/523 (11 standing opt-in skips),
+gateway 1123/1123, live MXAccess smoke 8/8 — green first try, no stale-obj quirk.
+
+- **Task 3 ended blocked, with evidence.** The rig refuses the alarm-condition writes
+  (`SecurityError` from the responding automation object — the test UDAs need
+  `AuthenticateUser`+`WriteSecured` or the in-engine flip script that drove the
+  2026-05-01 capture). `docs/AlarmProbeFindings.md` records what was tried, the
+  partial GUID answer (active→returned leg confirmed), and the unblock paths.
+- **Commit `693a78d` contains two tasks' work.** A concurrent implementer's `git commit`
+  without pathspecs swept Task 6's staged ACL files into Task 8's alarm commit. Nothing
+  was lost; both halves were reviewed separately and their fix rounds (`7ec0b35`,
+  `b9fb0dd`) are clean single-task commits. Process rule tightened mid-run: pathspecs
+  on the commit itself, not just the add.
+- **Task 8's atomicity fix went structural.** Review found the flag/snapshot pairing
+  relied on STA serialization while claiming a read-order guarantee; the fix made
+  `SnapshotActiveAlarms(out bool truncated)` the *only* accessor, so the unpaired read
+  is unexpressible.
+- **Task 6 review caught a real regression** (async attach re-entrancy under rapid
+  navigation) — closed with a generation guard and a mutation-verified interleaving test.
+- **Live-LDAP ACL tests ran green against the shared GLAuth** (7/7, plus 7/7 clean-skip
+  without the env gate). `multi-role` sits in both GLAuth groups, so the Admin-bypass
+  test asserts the sessions a dropped bypass would actually lose (team-b + untagged).
+- **Task 9 found and fixed pre-existing drift**: `clients/rust/protos/mxaccess_gateway.proto`
+  had diverged from Contracts (masked by the in-repo build path); refreshed byte-identical,
+  and the client protoset descriptors were regenerated.
+
+Follow-ups recorded, not started:
+- `IGatewayAlarmService.StreamAsync` / `AlarmFeedMessage` does not carry the truncation
+  signal — live central-feed consumers (lmxopcua, ScadaBridge) cannot see snapshot
+  degradation; add if those consumers need completeness reasoning.
+- No guard keeps `clients/rust/protos/` in sync with Contracts (a `diff` check in
+  `scripts/check-codegen.ps1` would close it).
+- `EffectiveDashboardConfiguration` (dashboard settings page) doesn't display
+  `GroupToTag` / `UntaggedSessionVisibility`, though it shows `GroupToRole`.
+- The alarm probes' remaining questions (ack-leg GUID stability, `@COUNT` semantics)
+  unblock via the paths in `docs/AlarmProbeFindings.md`.
+
+---
+
 ## Execution notes for the orchestrator
 
 - Branch `feat/deferred-closeout` off `main` before Task 1.