docs(plans): record the Task 8 live finding — self-form races the join handshake

Corrects the plan's behavior table (the mid-join-handshake row was FALSE) and
notes the mesh-program Phase 6 convergence on ScadaBridge's self-first seed
ordering, which retires the watchdog + guard entirely.

Claude-Session: https://claude.ai/code/session_01GASWkNEi68FSCtvr6rLoEW

docs/plans/2026-07-22-per-cluster-mesh-program.md

@@ -143,8 +143,12 @@ observability).
 kill-and-reconnect of the central dialer recovers every stream.
 
 ### Phase 6 — Mesh partition + co-location topology
-**Scope:** per-cluster seed nodes (each pair node lists itself + partner — the `SelfFormAfter`
-fallback then covers both), cluster-scoped roles `cluster-{ClusterId}` + singleton re-scoping,
+**Scope:** per-cluster seed nodes — **adopt ScadaBridge's self-first ordering (each node lists
+ITSELF as `seed-nodes[0]`, partner second) and RETIRE the `SelfFormAfter` watchdog + TCP
+reachability guard** (2026-07-22 execution finding: the watchdog races Akka's join handshake —
+`Join(self)` during an in-flight join islands the node, hit live here and fixed with the guard;
+ScadaBridge proved self-first ordering is the race-free form of the same semantics, enforced by
+a startup-validator rule — port that rule too); cluster-scoped roles `cluster-{ClusterId}` + singleton re-scoping,
 central pair keeps the admin singletons; **docker-dev rig rewritten** to model the real topology —
 including the co-location port table above (both products' compose files on shared per-site
 networks, real LocalDb sync ports); remove the ClusterRedundancy page's mesh-scope caveat (the