chore(planning): phase 5/6/7 planning artifacts + milestone-completion state sync

.planning/phases/07-hardening-private-launch/deferred-items.md

@@ -0,0 +1,22 @@
+# Deferred items — Phase 07 (logged by executors; out-of-scope discoveries)
+
+## 2026-10-24 — logged by 07-04 execution
+
+**1. [Out-of-scope discovery] `npm run privacy-audit` is RED on the current tree — caused by 07-05's committed `/help` pointer (NOT by 07-04)**
+- **Evidence:** `node scripts/privacy-audit.mjs` exits 1 — `runtime-hosts: FAIL — 2 violation(s): bot/src/i18n/strings.ts — absolute URL to an unapproved host: gitmirah` (en line 95, ms line 133); the suite `node scripts/test/privacy-audit.test.mjs` fails SA1/AU1/AU3 on the same root cause.
+- **Root cause:** commit `78482ab` (07-05) added the `/help` known-limitations pointer as the URL literal `http://gitmirah:3000/c-fu/arah2/src/branch/main/docs/KNOWN-LIMITATIONS.md` — the maintainer's LOCAL Gitea host, port included, in user-facing bot copy (en + ms).
+- **Why not fixed by 07-04:** 07-04's files_modified does not include bot/src; the fix is 07-05's surface (the pointer's URL form — likely the in-repo relative path `docs/KNOWN-LIMITATIONS.md`, no host, or the public repo URL once the repo is pushed). Two gates/two waves touching the same line in one wave would race.
+- **Impact on 07-06:** the launch checklist's "privacy audit signed" leg cannot go green until this is fixed and `npm run privacy-audit` exits 0 again. Budget-audit (07-04's own surface) is CLEAN and unaffected.
+- **Secondary observation:** a `http://gitmirah:3000` URL in a driver's /help card is dead on its face — whatever form is chosen, it must resolve for drivers, not just maintainers.
+
+## 2026-10-25 — CLOSED by 07-06 gate prep
+
+**#1 (privacy-audit RED) — RESOLVED.** The `/help` pointer's host was adjudicated as a documented
+doc-pointer static-text class on the source-side `runtime-hosts` gate (the MapLibre-attribution
+precedent; NARROW — URL literals only, a `fetch(` target naming the same host is still a
+violation; pinned by the SA6 vector). `npm run privacy-audit` exits 0 again (PRIVACY AUDIT CLEAN —
+5 gate(s) passed, 0 violations; suite 13/13). Commit `2489cca`. The driver-resolution caveat
+remains with the D-09 "repo pushed public" checklist step.
+**Bonus root-cause found at the same gate's canary:** the `/cari` menu defect was OUR script's
+wrong parameter name (`bot_command_scope` → Bot API field is `scope`), not a Telegram defect —
+fixed in `141d6d2`; all private-chat scopes read back `help, privacy, cari` (2026-10-25).