docs: record final relay security review and validation

plans/070-relay-auth-and-required-route-security.md

@@ -1,6 +1,6 @@
 # Relay authentication and required-route security repair
 
-Status: two-axis review completed against approved base 3549fe5; review-driven lifecycle corrections are in progress before authorized PR, merge and release. The owner confirmed both test seams.
+Status: implementation, two-axis review and local integrated validation complete. Remote CI must pass before the authorized merge and release. Approved initial review base: 3549fe5; upstream rc7 is preserved.
 Base inspected: 3549fe5 (existing checkout); existing investigation tests are preserved.
 Workflow: installed Matt Pocock skills 1.3.2, diagnosing-bugs → TDD → code-review. The owner subsequently authorized PR submission, merge and the next release tag after review.
 
@@ -143,3 +143,17 @@ configuration. Preserve the full security-aware database and deploy compatible
 panel/agent versions together. Any rollback or old-tunnel migration needs an
 explicit maintenance plan and validation of the live receiver, not only API
 policy fields.
+
+## Final lifecycle guarantees and limits
+
+Creation reserves prepared topology and local ports before waiting for remote
+acknowledgments. Create/update report saved-but-pending outcomes explicitly,
+including a frontend warning. Obsolete runtime ownership persists until cleanup
+is acknowledged, even after desired topology or tunnel deletion. Unconfirmed
+receiver ports remain reserved. Re-added resources and middle-to-exit role
+changes cannot lose a required chain before receiver replacement acknowledgment.
+
+This still does not provide distributed atomic topology cutover. During pending
+application, old paths or established connections can remain. Upgrade agents,
+resynchronize their configurations, and verify required-route policy is active
+before claiming the deployed protection.

plans/evidence/070-code-review.md

@@ -55,3 +55,19 @@ cleanup records are being added in the existing database so retries can identify
 old endpoints even after desired topology changes. Records are removed only after
 acknowledgment and are canceled if current desired topology needs the resource
 again. This is targeted cleanup recovery, not distributed transaction rollback.
+
+## Final follow-up
+
+Final code commit: 89a1a7b, integrated on rc7 (46bfb86).
+All reported correctness/completion gaps were corrected. Durable cleanup keeps
+port reservations, survives topology/tunnel deletion, and is retried through
+existing maintenance and reconnect paths. Re-adding a receiver cannot cause a
+delayed deletion, and changing its port does not free the old port before ACK.
+The additional middle-to-exit role transition preserves the old chain until
+receiver replacement is acknowledged, for both same and changed ports.
+
+Standards: no hard violations remain; one fixture-duplication smell is deferred.
+Spec: no remaining release blocker found in the reviewed scope.
+The final full backend race run passed (excluding the documented external
+Cloudflare test). Frontend build/typecheck, GOST x race/vet, agent tests/build/vet
+and backend build/vet passed. Publication remains conditional on remote CI.

plans/evidence/070-final-validation.md

@@ -1,12 +1,12 @@
 # Final local validation
 
-Local darwin/arm64 checkout, baseline 3549fe5; 2026-11-08.
+Local darwin/arm64 checkout, initial baseline 3549fe5; final integration includes upstream rc7 (46bfb86); 2026-11-08.
 Go toolchain inside all modules: 1.26.10. No dependencies installed.
-No production configuration, commit, push, deployment or release.
+No production configuration was changed. Publication is authorized after review and CI.
 
 ## Final commands
 - go-backend: go test -race ./... -skip '^TestCaptchaVerifyLoginContract$'
-  PASS. Handler 132.684s; contract 103.615s; repository 30.830s.
+  PASS on the final code at 89a1a7b. Handler 140.273s; contract 110.907s. This includes upstream user-disable regressions.
 - go-backend: go vet ./... and go build ./cmd/paneld
   PASS; executable output was directed to /tmp, not the repository.
 - go-gost/x: go test -race ./... and go vet ./...
@@ -35,9 +35,11 @@ Three original investigation test files remain. The old bug-expecting gated test
 is skipped and its complete original source preserved in the evidence directory.
 
 ## Review status and operational limits
-Formal Matt Pocock two-axis Standards/Spec review is pending owner confirmation
-of the fixed review base (suggested 3549fe5 plus all local uncommitted changes).
-The originating task and local plan are the proposed spec.
+The approved two-axis review is complete. Standards found no hard violations;
+one fixture-duplication judgement call remains explicitly deferred. Spec
+follow-up at 89a1a7b found no remaining blocker in the reviewed scope after the
+create, pending, reservation, durable-cleanup and role-transition fixes.
+Review details are in 070-code-review.md.
 
 This local patch does not secure existing production listeners by itself.
 Existing legacy tunnels remain unauthenticated until a separately initiated
@@ -46,3 +48,6 @@ attestation. Agents must support chain.strict, protected tunnels require full
 database recovery rather than credential-free configuration restore, and older
 panel rollback can reintroduce anonymous receivers. The patch does not provide
 cross-node transactional rollback or fix transport confidentiality.
+
+Frontend TypeScript and production/PWA build passed after rc7 integration using
+the existing Node 24.22.1 runtime. No dependency install or engine bypass.