docs(limits): two limits are conceded for 1.x, and the last 'pending' is retired

D3: :492 (Severity carries disposition intent) and :460 (the input-cap
asymmetry) are the two limits that can only be closed by changing an
exported symbol. Both now say 'conceded for 1.x', with the 2.0.0
consequence spelled out, instead of 'deferred deliberately'.

D5: :88's 'a calibration fix is pending' is gone. The concession is
narrower than the other two -- no fix is promised, but it is calibration,
so one may land in any 1.x release without breaking the contract.

SECURITY.md carries the part an outsider acts on: the support window is
rewritten off 'pre-1.0', the freeze is stated as a promise about the
Python surface and explicitly NOT about detection behaviour, and the two
permanent concessions join the documented-boundaries list.

docs/LIMITATIONS.md

@@ -89,7 +89,13 @@ items; this is the full list, each with the mechanism.
   `homoglyph:cyrillic-latin-mix` (MEDIUM) flags a Latin letter adjacent to a
   Cyrillic look-alike, so genuine bilingual prose → MEDIUM → under untrusted →
   QUARANTINE_REVIEW — a real false positive for an inbox that expects multilingual
-  content. A calibration fix is pending.
+  content. **Conceded for 1.x: no fix is promised.** The rule fires on codepoint
+  adjacency, which genuine bilingual prose produces as readily as a substitution
+  attack does. Narrowing it is a calibration question, not an API one, so a fix
+  may land in any 1.x release without breaking the contract — but none is
+  scheduled, and a caller that ingests multilingual prose should raise its
+  untrusted-tier threshold rather than wait for one. `SECURITY.md` lists this as a
+  documented boundary, not a vulnerability.
 - **Insider in-place edits** by a trusted author are out of the untrusted-content
   threat model.
 - **Text-only.** The core is `text -> findings`: it parses no files (no
@@ -475,7 +481,13 @@ items; this is the full list, each with the mechanism.
   an `oversize-input` finding (`active:oversize-input`, OWASP LLM10), and
   `link_graph` records `(from_id, body_length)` in `LinkGraphResult.truncated`,
   which is what lets a caller tell "no links past here" apart from "no links
-  *read* past here".
+  *read* past here". **The split itself is conceded for 1.x, not deferred.** It is
+  a surface property, not calibration: making the two halves agree later means
+  either raising where a caller gets a value today, or returning a truncated value
+  where one raises — a change to an exported symbol's contract in either
+  direction, therefore `2.0.0`. 1.x keeps the rule as stated: a surface that
+  returns *content* rejects at the cap, a surface that returns *findings*
+  truncates and says so.
 
 ## The six documented gaps (tracked by the coverage matrix)
 
@@ -505,8 +517,13 @@ fails the test, forcing this doc to be updated:
   capability, because the detector already decided it did not matter. Closing
   this means giving detectors a channel that says what was seen separately from
   how bad it is, which changes the grading and therefore fires the
-  consumer-notification promise in `docs/PLAN-v1.md`. Deferred deliberately, not
-  overlooked.
+  consumer-notification promise in `docs/PLAN-v1.md`. **Conceded for the whole of
+  1.x, not deferred.** That channel changes `Finding` and `Severity`, which is a
+  `2.0.0` change under the version contract, so 1.x ships with the coupling intact
+  by decision rather than by omission. A caller that needs the capability
+  separately from the grade must read the finding `id` — `active:markdown-image`
+  names the outward fetch whatever severity it carries — and must not infer
+  "nothing was seen" from a low `Severity`.
 
 - **A ZWJ hidden between two emoji is exempt, and ZWNJ's own false-positive
   class is untouched.** U+200D composes emoji (👩‍💻 is WOMAN + ZWJ + PERSONAL