The line about a prototype quietly becoming production without a decision describes most of the rescues we get asked to look at. Nobody chose the schema or the auth model. They were simply whatever the first version happened to use, and later work had to fit around them.

Your list of the missing layer is a good checklist: requirements, architecture, schema, API contracts, tests and a deployment target. I would add one step before it, which you hint at near the end. Write down what the prototype actually proved. Usually it proved that users want the workflow and that the core logic is possible. It rarely proved anything about scale, data shape or security.

On client builds that short note becomes the scope for the production version. Whatever the prototype proved is kept as a requirement, and everything else is decided again on purpose. It also makes the price easier to agree, because the unknowns are named.

Do you see teams keep the prototype code, or rebuild once the plan exists?