docs: audit missing plan implementation

[SuPuHe]

Summary

Adds a point-in-time audit of plan.md that identifies remaining delivery work, dependencies, blockers, and immediate priorities without changing the approved plan.

Scope and acceptance criteria

• The change is limited to a documentation-only implementation-gap audit.
• Missing work is grouped into Not Started and In Progress.
• Dependencies/blockers and immediate priorities are recorded.
• plan.md, product behavior, and configuration are unchanged.

Product and security invariants

• No settlement, authorization, provider, or runtime behavior changed.
• No secret, token, production credential, or personal data was added.

Invariant notes:

The report preserves the fail-closed requirements: Graph-blocked recovery retains UNKNOWN and does not retry payment; Arc Mainnet remains disabled pending official values and human authorization.

Validation

npx markdownlint-cli2@0.18.1 **/*.md #node_modules: PASS (110 files, 0 errors)

Independent review evidence

Gate A — exact candidate tree before push

• Base commit SHA: 0291b684e187557e13c47869359cbab445ee4148

• Candidate tree SHA: 1c5648b67bb6f2da2fd7fc9b9086f2d82be460e1

• Candidate commit SHA: 1eeb22ca4260f056aa24f6a631b718667817e8a6

• Reviewer tool: free-pi-cli

• Reviewer model: glm-5.3-flash

• Verdict: VERDICT: PASS

• Findings or residual risks: report is a point-in-time snapshot; owner/timeline assignment for externally dependent Graph work remains a project-tracking follow-up.

• The reviewed tree equals the pushed tree.

Gate B — exact remote PR head

• Pull request URL/number: pending

• Remote head commit SHA: 1eeb22ca4260f056aa24f6a631b718667817e8a6

• Remote head tree SHA: 1c5648b67bb6f2da2fd7fc9b9086f2d82be460e1

• Reviewer tool: free-pi-cli

• Reviewer model: pending

• Verdict: pending

• Findings or residual risks: CI and Gate B are pending.

• Gate B reviewed the current remote head and matches Gate A's approved tree.

• Agent policy / repository-policy and all applicable CI checks pass.

Risk and rollback

• Residual risks: the audit requires refresh when P4/P5/P6 evidence changes.
• Rollback or recovery plan: revert this documentation-only PR; no runtime state or settlement behavior is affected.

Human merge

• A human owner has reviewed the evidence and will perform the merge.