docs(plan): perf follow-ups close-out — outcomes, live-gate evidence, register annotations

CLAUDE.md

@@ -763,9 +763,10 @@ Two things to know before relying on any of this:
     `TriePermissionEvaluator`'s, so **any divergence between the two clocks denies every request** with a
     verdict indistinguishable from "no grant matched". Found by a test clock two hours ahead.
   - **Stage 6's hot seams (read/browse/subscribe) go through a per-`(session, node, operation, realm)`
-    decision cache**, cleared wholesale when the generation advances. It is **sharded per session**, so a
-    single client crawling a large tree past the per-session ceiling evicts only its own shard and not
-    every other session's decisions. ⚠️ It caches the **grant walk only** — key revocation and expiry are
+    decision cache**, cleared wholesale when the generation advances. It is **sharded per API key**
+    (`ApiKeyId ?? Principal` — despite the type name, sessions sharing one key share one shard and one
+    budget), so a client crawling a large tree past the per-key ceiling evicts only that key's shard and
+    not every other key's decisions. ⚠️ It caches the **grant walk only** — key revocation and expiry are
     re-checked **before** the cache lookup on every call, because expiry moves with the clock rather than
     with a deployment.
   - **Browse needs ancestor visibility, and it must NOT be a synthesized grant on the ancestors.** A