docs: close the plan items that already shipped, record the D86 gap

PLAN.md still listed Q3b and Q3c as open. Both shipped on 2026-08-08 as
one PR (ADR D83): the maintainer generated the production signing pair
locally and vaulted the private half, and release.yml now pushes the
three Pro packages to nuget.org on a v*.*.* tag with no human step in the
publish path. A plan that claims shipped work is pending is worse than no
plan — it is the first thing read at the start of a session.

The backlog's live-items summary had the same drift: it named the
CA1068 next-major bundling (§1) and the CI hardening (§2) as open, and
both are done — §1 went out in v2.0.0 and §2 is DockerGate. §1 is marked
as shipped rather than deleted, since the entry explains WHY those
signatures changed.

Added §1b for the one thing D86 knowingly did not fix: report editing has
no optimistic concurrency, so between GET .../config and PUT another
editor can reorder the destinations and the carried address then resolves
to the wrong section's credential. The fix is an ETag/If-Match contract —
new API surface, so it wants a decision rather than being folded into the
ADR that shipped the round-trip.

That leaves exactly two open items, both needing the maintainer: §1b and
the PostgreSQL timetz zone loss in §5.

Docs only — no code, no test changes.

Author: thiagoluga

PLAN.md

@@ -1376,12 +1376,14 @@ maintainer during Q1) — `LicenseToken` deliberately has no per-product field.
   issue a license**: `LicenseSigner` existed as a library API that nothing called, so the maintainer
   could not produce a key at all. Reuses `LicenseToken`/`LicenseSigner` rather than restating the
   token shape, so an issued key can't drift from what the validator accepts.
-- [ ] **Q3b — Rotate to a production signing key.** Q1's embedded `ProLicense.PublicKeyBase64` is a
-  **placeholder whose private half was generated in a chat session** — plaintext, unrotatable,
-  unaudited. Run `keygen` locally, move the private key straight into a vault, embed the new public
-  key, and ship it **before** any customer license is issued. Blocks Q3c.
-- [ ] **Q3c — Publish the Pro packages.** Lift D30's "not published" posture: the three Pro projects
-  are `IsPackable=false` with `PackageLicenseExpression` cleared, so `release.yml` (which packs the
-  whole solution) skips them today. Needs a decision on the mechanism — extend `release.yml`, or make
-  `pack-pro.yml` push instead of only uploading artifacts — plus the feed/registry choice.
-  `NeoReports.Licensing` itself is already packable and MIT, so it rides the normal OSS release.
+- [x] **Q3b — Rotate to a production signing key.** **Done (ADR D83, 2026-08-08.)** Q1's embedded
+  `ProLicense.PublicKeyBase64` was a **placeholder whose private half was generated in a chat
+  session** — plaintext, unrotatable, unaudited. The maintainer generated the production pair locally
+  and vaulted the private half; the public key shipped before any customer license was issued.
+  Re-rotating is now a breaking change for issued keys.
+- [x] **Q3c — Publish the Pro packages.** **Done (ADR D83, 2026-08-08.)** D30's "not published"
+  posture is lifted: the three Pro projects are packable and `release.yml` pushes them to nuget.org on
+  a `v*.*.*` tag, with no human step in the publish path — a guard test is the gate. Shipped together
+  with Q3b in one PR because the halves are unsafe apart (publishing under the placeholder key would
+  have made the placeholder permanent). `NeoReports.Licensing` is MIT and rides the normal OSS
+  release.

docs/STATUS-AND-BACKLOG.md

@@ -71,17 +71,41 @@ enterprise-readiness and test coverage, and shipped everything actionable.
 >    as a *different, plausible* date rather than being unrepresentable. Measuring also turned up
 >    `DateTime.MinValue` silently becoming `1899-12-30`, and a year below 100 throwing out of
 >    `ToOADate` and **aborting the whole workbook**. One range check closes all four.
-> 4. **CA1068-style next-major bundling** (§1) and the CI hardening in §2.
+> 4. ~~**CA1068-style next-major bundling** (§1) and the CI hardening in §2.~~ — **both SHIPPED**:
+>    §1 went out in **v2.0.0** (2026-08-08) and §2 is done (`DockerGate`, hard-fail under
+>    `NEOREPORTS_REQUIRE_DOCKER=1`).
+>
+> **State as of 2026-08-18.** With §1–§4 and §6 closed, exactly two things remain open, and each needs
+> the maintainer:
+>
+> - **§1b — no optimistic concurrency on report editing.** New API surface (`ETag` / `If-Match` /
+>   `412`); the concurrent-editor window can restore the wrong section's credential.
+> - **§5 — PostgreSQL `timetz` drops its zone.** Needs a `Time`/`TimeTz` split in the frozen
+>   `ColumnType` enum plus its own cursor-encoding decision, so it is a next-major item with a design
+>   question attached, not a cast.
 
 
-### 1. Next-major breaking cleanup (needs a 2.0 line)
+### 1. Next-major breaking cleanup — **SHIPPED in v2.0.0 (2026-08-08)**
 - **Remove the never-thrown ABI exceptions** — already done in #228, tagged for the next major.
 - **CA1068: `CancellationToken` not last** in three **public** health signatures — **done**: the
   token was moved to last (after `pingSql`/`content`, both defaulted) in `AdoSourceHealth.PingAsync`,
   `AdoSourceHealth.CheckConnectionStringAsync` and `HttpHealthProbe.SendAsync`, and all callers
   updated. Source-breaking for positional callers, so tagged **next-major** in `CHANGELOG.md`
   (Changed → breaking, public API) alongside the #228 removal.
 
+### 1b. Report editing: no optimistic concurrency on PUT (ADR D86, 2026-08-18)
+
+Two editors open the same report; the second reorders its destinations and saves; the first then saves
+a placeholder addressed `destinations[0]`, which resolves against the **reordered** stored document and
+restores the wrong section's credential. The carried address is exactly what makes a *single*-editor
+reorder safe, and it cannot see a change made on the stored side between the `GET .../config` and the
+`PUT`.
+
+Not fixed with D86 because the fix is new API surface — an `ETag` on `GET /reports/{name}/config` and
+`If-Match` on `PUT /reports/{name}`, answering `412` when they disagree — and that ADR was already the
+secrets round-trip. Single-worker, single-maintainer v1 (architecture rule 6) makes concurrent editors
+unlikely, not impossible. Recorded so the next change to these endpoints starts from it.
+
 ### 2. CI hardening
 - **Fail (not skip) the Testcontainers integration tests when Docker is absent in CI.** — **done**:
   the five container `ServerFixture`s now swallow a start failure only through an exception filter,