Plan the rest of the usable app to commit level

M3-FINISH-PLAN.md turns the remainder of T10-T17, the W8 leftovers, and the
defects found in the shipped UI slice into nine commit-sized work items with
the design decided in advance, so the driver works V1 to V9 without asking.

The starting state was verified against the live tree rather than recalled,
and it found more than the known gaps: the project detail link 404s into an
empty directory, --max-budget-usd is plumbed and never set anywhere, nothing
calls removeReviewWorktrees on any terminal transition, rules.enabled is
written and never read, SETTING_KEYS is referenced nowhere, and the review
page grows its activity state without bound.

Two problems shape the ordering. Spend safety goes first, V1, because of the
2026-07-31 incident where a manual test silently used the real CLI: a budget
ceiling on every engine call, a run note naming the engine binary, and a
policy that nothing spends usage without an explicit user action. The
confirmation loop goes second, V2 and V5, because a human confirming every
finding before the report exists is the product's founding requirement and it
is not yet drivable: confirm and dismiss routes, the keyboard-driven
confirmation screen, the complete transition that refuses undecided findings,
then the report renderer and export.

The rest in usage order: project detail with links and delete, pre-flight and
the linked toggle, lifecycle polish with merged detection and a settings
editor, the rulesets manager slice over the already-present enabled flag, an
e2e journey with both-theme screenshots and CI running --e2e, and finally the
records and FG-2 evidence, with the real-model runs explicitly gated on the
maintainer's go-ahead.

Fifteen decisions, D-30 to D-44, are fixed in the plan so they are appended
to the decision log as the work lands rather than re-litigated mid-item.

Author: Poolchaos

docs/README.md

@@ -30,6 +30,7 @@ then `GATES.md`, then only what the active gate needs.
 | [plans/BUILD-PLAN.md](plans/BUILD-PLAN.md)       | Work packages WP-A..L, milestones, founder gates, standing rails. |
 | [plans/EXECUTION-ORDER.md](plans/EXECUTION-ORDER.md) | STANDING EXECUTION ORDER: remaining work T1-T19, dependencies, founder gates, pre-resolved decisions D-1..D-20. |
 | [plans/M2-FINISH-PLAN.md](plans/M2-FINISH-PLAN.md) | Implementation plan for T8, T9 and the FG-2 demo: commit map W1-W8, the resume design, decisions D-21..D-26. |
+| [plans/M3-FINISH-PLAN.md](plans/M3-FINISH-PLAN.md) | Implementation plan for the usable app (T10-T17 remainder plus W8 leftovers): commit map V1-V9, spend-safety and confirmation-loop design, decisions D-30..D-44. |
 | [plans/PLAN-TEMPLATE.md](plans/PLAN-TEMPLATE.md) | Template for multi-step plan docs (work packages, decision gates, done tracking).            |
 | [plans/idea-inbox.md](plans/idea-inbox.md)       | One-line dated idea capture. Ideas are not expanded until the active gate passes.            |
 

docs/plans/EXECUTION-ORDER.md

@@ -431,8 +431,8 @@ T19 last. FG-2 after T9; FG-3 after T15; FG-4 after T18.
 | T5   | T4         | DONE   |
 | T6   | -          | DONE   |
 | T7   | T1-T6      | DONE   |
-| T8   | T5         | TODO   |
-| T9   | T8         | TODO   |
+| T8   | T5         | DONE   |
+| T9   | T8         | DONE   |
 | FG-2 | T9 (+T7)   | GATE   |
 | T10  | T9         | TODO   |
 | T11  | T8         | TODO   |
@@ -446,3 +446,10 @@ T19 last. FG-2 after T9; FG-3 after T15; FG-4 after T18.
 | T18  | T7, T9     | TODO   |
 | T19  | T17, T18   | TODO   |
 | FG-4 | T18, T19   | GATE   |
+
+T10 and T12 are partially built (routes for projects, branches, reviews,
+rulesets, models, events; screens for projects, new review, live review,
+reviews list, rulesets import, settings). The remainder of T10-T17, the FG-2
+evidence, and the defects found in the shipped slice are planned to commit
+level in [M3-FINISH-PLAN.md](M3-FINISH-PLAN.md) (V1-V9, decisions
+D-30..D-44). That plan is the driver's working order for M3.