docs: reframe novelty claim to composite write-time contract (review MAJOR #3)

Replace the unverified/absolute novelty statement with the defensible
four-part-contract form, verified against a focused adversarial PyPI+GitHub
survey (2026-07-15):

- BRIEF §11: 'assumed, not verified' -> verified survey with sources. Names
  aig-guardian (real, query-time; blurs only the minimal-dep-library
  differentiator), GuardLLM (nearest neighbour, runtime hardening, no
  scan-before-persist / capability isolation / fail-secure), and ipi-scanner
  (orphaned placeholder repo, recorded for honesty not as prior art).
- README: differentiator moved from 'library vs hosted/model' to the full
  four-part write-time contract.
- PLAN §27-31: drop the unverifiable 'the first' superlative.

Also promotes the v1.0 session plan (PLAN-v1.md) and the cross-model review
(review-2026-07.md) into docs/ on the open/ mirror, referenced by PLAN.md's
re-sequencing addendum.

docs/PLAN.md

@@ -24,11 +24,16 @@ Lead with the **contract + placement** (write-path, pre-persist) + **failure-sem
 (fail-secure toward the artifact, not fail-open toward a user). Detection is the weakest,
 most-evadable layer — defense-in-depth, not the pitch.
 
-Defensible claim, every qualifier load-bearing: *the first dependency-light,
-framework-agnostic **library** that packages the write-time injection-**containment**
-contract with fail-secure disposition, for unattended pipelines.* Cite OWASP LLM08:2025 /
-RAG Security Cheat Sheet for legitimacy; reference Dual-LLM (Willison 2023) and CaMeL
-(DeepMind 2025) as architecture lineage — inspiration, **not** equivalence.
+Defensible claim, every qualifier load-bearing: *a dependency-light,
+framework-agnostic **library** that packages the full write-time
+injection-**containment** contract (quarantine → per-stage capability isolation →
+scan-before-persist → fail-secure disposition) as composable code — the part
+query-time tooling and single-stage detectors leave to the integrator.* Not "the
+first" (an unverifiable temporal claim); the load-bearing qualifier is the *full
+four-part contract*, verified against the 2026-07-15 survey (`docs/BRIEF.md` §11).
+Cite OWASP LLM08:2025 / RAG Security Cheat Sheet for legitimacy; reference Dual-LLM
+(Willison 2023) and CaMeL (DeepMind 2025) as architecture lineage — inspiration,
+**not** equivalence.
 
 ### Claims we will NOT make (verified overclaim risks)
 
@@ -209,6 +214,22 @@ Revised streams:
    the "painless" guarantee: it grounds both the Node port's contract and any
    consumer-specific seams before they are locked.
 
+### Re-sequenced toward v1.0 (Fable cross-model review, 2026-07-09)
+
+An independent cross-model review re-sequenced the forward path. Stream 2 is extended
+with a set of review-injected hardening + coverage sessions (output-gate coverage,
+OKF adapter hardening, egress decode-rescan, calibration-threshold consolidation,
+docs/version-sync, and a novelty-claim verification) that land **before** a **v1.0
+freeze**. The Node/TS port (stream 3) starts only **after** that freeze — porting a
+frozen, scan-clean surface, never a moving target — over the shared JSON lexicon
+(never split). Streams 4 + consumer integration are operator-timed "ambitious
+extensions", not part of the v1.0 sequence.
+
+The session-by-session plan and the review record live in `docs/` on the Forgejo
+`open/` mirror alongside the other design docs — `docs/PLAN-v1.md` (the v1.0 + Node
+session plan) and `docs/review-2026-07.md` (the review) — `open/` being the sole
+sanctioned public surface (never GitHub).
+
 ### The OKF inbox showcase (next concrete build, TDD)
 
 The flagship artifact we hand a consumer later — an in-repo end-to-end