docs: mark W7 P1 complete + screenshot-verified

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docs/contacts-plan.md

@@ -70,28 +70,27 @@ peerspeak?") stays on Signal/Telegram — peerspeak is not a messenger.
 
 ## Core primitives to build
 
-### P1 — Persistent identity (+ regenerate) — Small, foundational
-**Foundation DONE (`d157d78`, 2026-06-15):** `src/identity.rs` (`load_or_create` /
-`regenerate` / `save` over a `0600` hex key file at `~/.config/peerspeak/identity.key`,
-atomic write, malformed = hard error, path-injectable fs seam + 8 unit tests incl.
-create/persist/regenerate/perms). Core loop now loads the stable key instead of
-`generate()` (falls back to ephemeral only if the file can't be read/written). The
-key file is raw hex (a secret, not structured config — JSON/TOML only matters for
-the friends store). 238 lib tests green, clippy clean, release builds.
-**Remaining in P1:**
-- **Settings "Regenerate identity" control** (confirm + warn) — `regenerate()`
-  exists; UI + a `CoreCommand` that rebuilds the live endpoint with the new key
-  still to wire.
-- **Visual warning when the key can't be read/written** (user, 2026-06-15). Today
-  the ephemeral fallback only logs — it must surface a **persistent** UI indicator,
-  because running unsaved is a real degraded state (your id won't survive the next
-  launch → friends stop recognising you). Plan: a dedicated `UiEvent`
-  (`IdentityNotPersisted(reason)`, distinct from the transient `Error` →
-  `status_message`), an `identity_degraded: Option<String>` flag in app state, and
-  a standing badge + a fuller explainer in the identity Settings section ("Identity
-  couldn't be saved to `~/.config/peerspeak/identity.key` — friends won't recognise
-  you next launch; check disk/permissions"). Build alongside the regenerate UI
-  slice (same identity Settings section + `CoreCommand` path).
+### P1 — Persistent identity (+ regenerate) — ✅ DONE 2026-06-15
+- **Foundation (`d157d78`):** `src/identity.rs` (`load_or_create` / `regenerate` /
+  `save` over a `0600` hex key file at `~/.config/peerspeak/identity.key`, atomic
+  write, malformed = hard error, path-injectable fs seam + 8 unit tests incl.
+  create/persist/regenerate/perms). Core loop loads the stable key instead of
+  `generate()`, falling back to ephemeral only if the file can't be read/written.
+  Key file is raw hex (a secret, not structured config).
+- **Regenerate + degraded warning (`a99c789`):** `UiEvent::IdentityStatus
+  { node_id, persisted, error }` (startup + after regenerate);
+  `CoreCommand::RegenerateIdentity` (mints+persists a fresh key, swaps the core's
+  live key for the next join); Settings "Identity" section showing the permanent
+  ID, a Regenerate button behind a destructive-action confirm modal, and a standing
+  red "Identity not saved" banner when `persisted == false`.
+- **Verified:** 238 lib tests green, clippy clean, release builds. **Screenshot-
+  verified** — Identity section, confirm modal, and the degraded banner (`chmod 000`
+  the key → "Permission denied (os error 13)" warning; Regenerate clears it).
+- **Deferred (small, optional):** an always-visible degraded badge *outside*
+  Settings (today the warning lives in the Identity section only). The
+  relay-locatability spike (a saved `EndpointAddr` resolving by node ID without
+  discovery while on the same relay) still wants confirming during 2-machine
+  testing — it underpins the P4 presence story.
 - **Spike:** verify same-relay reachability by node ID without discovery on
   `iroh = 1.0.0-rc.0` (a saved `EndpointAddr` should resolve while the peer stays
   on the same relay). Underpins the whole presence story; do during 2-machine