diff --git a/.claude/skills/sister-project-history/otopcua.md b/.claude/skills/sister-project-history/otopcua.md
index ff68168..74c809e 100644
--- a/.claude/skills/sister-project-history/otopcua.md
+++ b/.claude/skills/sister-project-history/otopcua.md
@@ -50,3 +50,17 @@ AddRoute of the dev Mac (`oee-tagdump-mac`, `10.181.206.245.1.1`) on the two tes
   unrouted MicroLogix `ErrorBadData`). Native AbCip writes remain simulator-proven only; libplctag deletion is blocked on a bench
   controller. Follow-ups Gitea #564-#585. Details: OtOpcUa `docs/drivers/AbCip.md` §Transport,
   `docs/plans/2026-10-07-native-ab-transport-gate-results.md`.
+- **Gitea issue sweep #562-#591 (2026-10-08, OtOpcUa `master` merges `bd2bebed`..`d978573f`).** All open issues resolved, each
+  independently reviewed where it touched alarms/ACL. **ScadaBridge-visible:** (1) **#563** — an expired or disabled API key is now
+  refused `WriteOperate` value writes and `AlarmAck` methods (`BadUserAccessDenied`) even with `Security:Acl:Enabled=false`; a key
+  minted after the last deployment cannot write/ack until a deployment carries it; reads/subscriptions unchanged with the flag off.
+  (2) **#586/#588** — with ACL **on**, Server-object (`i=2253`) event subscriptions (ScadaBridge's default alarm feed) now receive only
+  alarms/model-changes the session's grants cover (previously every alarm, ungated); ACL off delivers exactly as before.
+  (3) **#587** — every method-driven condition transition (Acknowledge/Confirm/AddComment/Enable/Disable/Shelve/Unshelve) now emits
+  exactly one condition event (previously none); **native (driver) alarms support only Acknowledge + AddComment** — Confirm/Shelve
+  return `BadNotSupported`, and native `ConfirmedState` stays `true` as before; scripted TimedShelve now works over OPC UA.
+  (4) **#562** — revoking a grant/key now also stops live alarm subscriptions (reversibly). Also: `ClusterRoleInfo` role-leader race
+  (#590, a leader could stick at null), AbCip/AbLegacy AdminUI forms now write the `*Ms` timeout keys the drivers actually read and keep
+  unknown keys (#576), Client CLI ack/confirm/shelve/enable/disable target the condition node (previously nonexistent ids), plus
+  native-transport hardening (#564-#583). Residuals needing hardware: native wide-struct fragmented writes, mixed STRING/array MSP
+  packing and CIP-level close codes on a real controller.