docs: expand independent three-coder milestone plan

[SuPuHe]

Summary

Expand the product delivery plan into a backend-first, three-coder roadmap designed for asynchronous execution. This adds a proposed frozen v1 contract pack, lane indexes, and 18 independently closable work packets (six per coder, 90 commit-sized subtasks total). Frontend packets remain held until project Gate P4.

Scope and acceptance criteria

• The change is limited to the stated milestone or issue.
• Acceptance criteria are listed and satisfied.
• No unrelated cleanup is included.

Acceptance criteria:

• Detailed master plan for three coders with explicit ownership and convergence gates.
• 18 independently closable packets, each with exactly five small tasks, acceptance evidence, handoff artifact, no-wait continuation, and non-goals.
• Backend packets depend only on the frozen contract pack and the same coder's previous packet.
• A05/B05/C05 remain blocked until project Gate P4 freezes the integrated backend seams.

Product and security invariants

• Tenant isolation remains fail-closed.
• Sponsor authorization, auditability, and daily caps remain enforced where applicable.
• Recipients cannot modify sponsor controls or access sponsor-only data.
• No secret, token, production identifier, or personal data is committed or pasted into review prompts.
• Any non-applicable invariant is explained below.

Invariant notes:

This is a planning-only change. It preserves and strengthens the documented one-intent/at-most-one-settlement rule, UNKNOWN reconciliation without blind retry, integer-string money representation, Graph non-authority, testnet-first operation, redaction, and human-only external configuration. No product code, runtime configuration, or dependency is changed.

Validation

Commands and results:

repository-policy checks: PASS
structural plan validator: PASS (18 packets; 90 subtasks; required packet sections present)
planning-set measurement: PASS (2,004 lines; 13,285 words)
git diff --check origin/develop...HEAD: PASS
conflict-marker scan: PASS
tracked-diff secret-shape scan: PASS
local Markdown link resolution: PASS
working tree cleanliness: PASS

Independent review evidence

Gate A — exact candidate tree before push

• Base commit SHA: 971e5108cb276eef9735ff4265e12972aa5c2240

• Candidate tree SHA: 47428c2932f426339e2ef8cf08aa5c4ce9556815

• Candidate commit SHA (if already committed but unpushed): a2a65fc6aad0a2b21065713fbaa7e5f0edd98c26

• Reviewer tool: free-pi-cli

• Reviewer model: deepseek-v4-flash (FreePi UI; verdict field reported not exposed by platform)

• Verdict: VERDICT: PASS

• Findings or residual risks: no blocking findings. Non-blocking notes: the historical context record reflects its pre-commit state; project execution still requires human P0 approval; live-testnet evidence remains dependent on human provisioning.

• The reviewed tree equals the committed tree.

Gate B — exact remote PR head

• Pull request URL/number: pending draft creation

• Remote head commit SHA: a2a65fc6aad0a2b21065713fbaa7e5f0edd98c26

• Remote head tree SHA: 47428c2932f426339e2ef8cf08aa5c4ce9556815

• Reviewer tool: free-pi-cli

• Reviewer model: pending required CI

• Verdict: pending required CI

• Findings or residual risks: pending

• Gate B reviewed the current remote head and matches Gate A's approved tree, or a fresh Gate A was run for the changed tree.

• Agent policy / repository-policy and all applicable CI checks pass.

Risk and rollback

• Residual risks: this is an unexecuted plan; P0 contract-pack approval and later live-testnet evidence are intentionally human-gated. The committed session context records its pre-commit state but does not affect plan correctness.
• Rollback or recovery plan: close the draft PR or revert the planning commit; no runtime state, deployment, data, or dependency requires rollback.

Human merge

• A human owner has reviewed the evidence and will perform the merge.