docs(mesh-phase5): telemetry stream — Telemetry.md, config keys, supersede §6.3, program status

Claude-Session: https://claude.ai/code/session_01GASWkNEi68FSCtvr6rLoEW

docs/plans/2026-07-21-per-cluster-mesh-design.md

@@ -285,6 +285,20 @@ trusted network. Recorded as an accepted risk rather than an oversight, with two
 it is revisited: `LocalDbSyncAuthInterceptor` is already in our tree as a fail-closed template, and
 the surface most worth gating first is any Pull-style RPC that returns historical rows.
 
+**SUPERSEDED 2026-07-23.** The Phase 5 telemetry stream (`TelemetryStreamService` — the four
+node→central observability channels) shipped **authenticated from day one**: a shared node bearer
+key (`Telemetry:ApiKey` == `TelemetryDial:ApiKey`), enforced by a fail-closed
+`TelemetryStreamAuthInterceptor` (`CryptographicOperations.FixedTimeEquals`, `PermissionDenied` on
+mismatch, and — load-bearing — an **unset** key rejects every call rather than allowing an open
+stream). This is exactly the `LocalDbSyncAuthInterceptor`/`ConfigServeAuthInterceptor` pattern this
+section flagged as the fail-closed template to reach for, applied immediately rather than deferred.
+ScadaBridge itself has since closed the same "unauthenticated inter-cluster transport" gap with this
+identical interceptor pattern, so this decision no longer matches ScadaBridge's current posture
+either — it matches where ScadaBridge moved to. See [`docs/Telemetry.md`](../Telemetry.md) §
+Authentication for the full detail. The "return historical rows" surface this section called out as
+worth gating first (Pull-style RPCs) remains open for `ConfigServe`/`ConfigSource` and any future
+such surface — only the telemetry stream is closed by this note.
+
 ## 7. Sequencing sketch
 
 Deliberately not a task plan — per-phase plans follow, one at a time.