docs(plan): record peer-auth decisions and evidence

Record the completed protocol-8 implementation, its security and lifecycle decisions, and the final local acceptance evidence. Mark protocol-7 Call to Play relay reviews as historical so they cannot be mistaken for current design. Keep production acceptance honest by recording the unavailable canonical 186-game manifest corpus, real Windows/NTFS confinement and durability proof, and representative physical-LAN evidence as external release prerequisites. Test Plan: - `just fmt` (passed) - `just test` (passed; 708 workspace tests, including peer 480 and Tauri 56) - `just clippy` (passed) - `just frontend-test` (passed; 91/91) - `just build` (passed; fixture-backed no-bundle build) - `LANSPREAD_S37_MIN_MIB_PER_S=100 just peer-cli-tests` (passed; S1-S49) - `git diff --cached --check` (passed)
2026-08-10 14:05:26 +02:00
parent e0eafa6e33
commit 0fbf589dc5
9 changed files with 1048 additions and 29 deletions
@@ -1,5 +1,12 @@
 # Finish Call to Play’s replication seam

+> **Historical / superseded:** This plan describes the removed protocol-v7
+> client-authored, relayed event and acknowledgement model. The current protocol
+> accepts local intents, generates identity and time fields in the core, pulls
+> author-owned snapshots directly, and publishes full replacement views. Retain
+> this document only as design history, not current architecture or acceptance
+> guidance.
+
 ## Summary

 Keep the existing architecture: immutable events, deterministic reduction, live
@@ -1,5 +1,11 @@
 # Call to Play review — Fable 5 (xhigh)

+> **Historical / superseded:** This review assesses the removed protocol-v7
+> client-authored, relayed event and acknowledgement model. The current protocol
+> accepts local intents, generates identity and time fields in the core, pulls
+> author-owned snapshots directly, and publishes full replacement views. Its
+> conclusions and test counts are not current acceptance evidence.
+
 ## Verdict

 The plan is faithfully implemented — all five commits match the planned
@@ -119,8 +125,9 @@ installed) would remove the most awkward step in the happy path. Worth a
 follow-up commit if you agree.

 Two nits: `design/launcher/SPEC.md` still describes the ticker sort as "ready →
-starting-soon → the rest (TICKER_RANK = ready 0, soon 1…)" while the code ranks
-`expired` first — that mismatch predates this branch, but since the spec section
-was touched anyway it could have been corrected. And the ticker's "waiting to
-start" line for Ready calls doesn't say _who_ everyone is waiting for, while the
-card note does name the creator — a tiny inconsistency, fine as is.
+starting-soon → the rest (`TICKER_RANK` = ready 0, soon 1…)" while the code
+ranks `expired` first — that mismatch predates this branch, but since the spec
+section was touched anyway it could have been corrected. And the ticker's
+"waiting to start" line for Ready calls doesn't say _who_ everyone is waiting
+for, while the card note does name the creator — a tiny inconsistency, fine as
+is.
@@ -1,5 +1,14 @@
 # Call to Play Code & Architecture Review Report

+<!-- This historical review preserves its original HTML table and flow lines. -->
+<!-- rumdl-disable MD013 MD033 -->
+
+> **Historical / superseded:** This review assesses the removed protocol-v7
+> client-authored, relayed event and acknowledgement model. The current protocol
+> accepts local intents, generates identity and time fields in the core, pulls
+> author-owned snapshots directly, and publishes full replacement views. Its
+> conclusions are not current architecture or acceptance evidence.
+
 I have conducted a thorough review of the commits (`e141229` through `2c204ac`)
 on branch `calltoplay`, referencing
 [`FABLE_5_FINDINGS.md`](file:///pantheon/pfs/git/rust/pfs/lanspread/FABLE_5_FINDINGS.md)
@@ -1,5 +1,11 @@
 # Review: Call to Play fix series (`872692e..2c204ac`)

+> **Historical / superseded:** This review assesses the removed protocol-v7
+> client-authored, relayed event and acknowledgement model. The current protocol
+> accepts local intents, generates identity and time fields in the core, pulls
+> author-owned snapshots directly, and publishes full replacement views. Its
+> conclusions are not current architecture or acceptance evidence.
+
 ## a) Faithfulness to the plan — high, with only minor test-plan gaps

 **Commit mapping is 1:1 with the planned sequence**, same titles, and every
@@ -1,5 +1,11 @@
 # Fable 5 findings

+> **Historical / superseded:** These findings assess the removed protocol-v7
+> shared-certificate, client-authored, relayed event model. The current protocol
+> authenticates typed peer identities, accepts local intents, generates event
+> authority in the core, and pulls author-owned snapshots directly. Retain this
+> document only as historical review context, not a current issue list.
+
 Review of the issues Fable found after the Call to Play follow-up fixes. This
 document records the assessment only; it is not an implementation plan.

@@ -28,10 +28,10 @@ The previous four findings have landed in code and tests:
  startup recovery remove only exact downloader-owned paths and preserve unknown
  root files, instead of leaving crashed partial archives or broadly deleting
  the game root.
- `update_game` now uses `PeerCommand::FetchLatestFromPeers` to skip local
-  manifest serving and fetch fresh peer metadata. Covered by
-  `update_fetch_emits_fresh_manifest_from_latest_peer` and
-  `update_request_skips_local_manifest_even_when_download_exists`.
+- Historical, superseded by the protocol-v8 cutover: `update_game` once used
+  `PeerCommand::FetchLatestFromPeers` and fresh peer metadata. That command and
+  its cited tests no longer exist; updates now use the local catalog manifest
+  and authenticated peers advertising its exact `ContentId`.
 - Download-to-install handoff no longer relies on `OperationGuard::Drop` for
  ordered state transitions. Covered by
  `download_handoff_waits_for_readers_and_auto_installs` and the liveness