docs(plan): record peer-auth decisions and evidence

Record the completed protocol-8 implementation, its security and lifecycle
decisions, and the final local acceptance evidence. Mark protocol-7 Call to
Play relay reviews as historical so they cannot be mistaken for current design.

Keep production acceptance honest by recording the unavailable canonical
186-game manifest corpus, real Windows/NTFS confinement and durability proof,
and representative physical-LAN evidence as external release prerequisites.

Test Plan:
- `just fmt` (passed)
- `just test` (passed; 708 workspace tests, including peer 480 and Tauri 56)
- `just clippy` (passed)
- `just frontend-test` (passed; 91/91)
- `just build` (passed; fixture-backed no-bundle build)
- `LANSPREAD_S37_MIN_MIB_PER_S=100 just peer-cli-tests` (passed; S1-S49)
- `git diff --cached --check` (passed)

organize/planning/PEER_AUTH_PLAN.md

@@ -2,7 +2,18 @@
 
 ## Status
 
-Revised implementation plan; not yet implemented.
+The code and local test surface described by Phases 1-5 are implemented in this
+checkout. The standard Rust, Tauri, and frontend gates pass, and the current
+fresh-image S1-S49 Docker matrix is recorded in
+`organize/testing/PEER_CLI_SCENARIOS.md`. This is not yet full
+production-release acceptance because three external evidence gates remain:
+
+- the canonical 186-game package corpus and production manifests are absent, so
+  the production catalog and bundle gates remain fail-closed;
+- no run on a supported Windows/NTFS system yet proves reparse-point confinement
+  and file/directory durability; and
+- no representative physical-LAN three-peer and throughput run has been
+  recorded. Docker-host throughput is local acceptance evidence only.
 
 This plan deliberately treats Lanspread as what it is: a desktop utility for
 friends and other attendees at a LAN party to discover each other, share a known
@@ -48,7 +59,8 @@ bundled content manifest -> validated local download plan
                          -> version.ini commit only after complete success
 
 local Call to Play change -> cheap invalidation hint to known peers
-                          -> each peer pulls the author's current state over pinned TLS
+                          -> each peer pulls the author's current state
+                             over pinned TLS
 
 pinned liveness ping -> responder's own current revisions
                      -> pull that one responder only on mismatch
@@ -99,8 +111,8 @@ The following are explicit non-goals:
 
 ### 3.1 Confine download preparation first
 
-This remains the first implementation task because it fixes a live local
-data-loss path without depending on authentication or a wire change.
+This was implemented first because it fixed a live local data-loss path without
+depending on authentication or a wire change.
 
 The peer core constructs a `ValidatedDownloadManifest` before
 `begin_version_ini_transaction`, `prepare_game_storage`, directory creation,
@@ -136,13 +148,10 @@ the authoritative manifest before committing `version.ini`. Preserve `local/`,
 install staging/backup state, and user-owned files in all success, failure,
 cancellation, and recovery paths.
 
-For the current protocol, this validator safely contains the existing remote
-descriptions. A narrow protocol-7 adapter requires and removes exactly one
-matching leading `game_id/` component (and discards only the current exact
-redundant game-root directory entry) before constructing root-relative paths; it
-rejects a missing/different/doubled prefix. After the protocol cutover, the same
-validated type is constructed directly from the bundled content manifest and
-remote descriptions cease to define local paths at all.
+Historically, this validator contained protocol-7 remote descriptions through a
+narrow adapter that required and removed exactly one matching leading `game_id/`
+component. The current protocol constructs the same validated type directly from
+the bundled content manifest; remote descriptions no longer define local paths.
 
 Required proof includes hostile descriptors placed after valid descriptors,
 cross-game paths, both requested and other-game `local/` sentinels, reserved
@@ -459,9 +468,8 @@ Do not ask the user to solve a cryptographic implementation problem.
 
 ## 4. One protocol cutover
 
-Develop the pieces behind internal APIs, then replace protocol 7 with one new
-current protocol (protocol 8 if the version has not moved). Do not ship
-intermediate protocol 8/9/10 designs and do not add compatibility decoding.
+The coordinated cutover replaced protocol 7 with current protocol 8. There is no
+intermediate 8/9/10 design and no compatibility decoding.
 
 The cutover includes: