docs(roadmap): add #469 and #470 to the M1 row

docs/ROADMAP_V2.md

@@ -335,7 +335,7 @@ La asignación de una issue a un milestone expresa el objetivo de planificación
 
 | Milestone | Contenido y criterio de salida |
 |---|---|
-| [M1 — Safe, inspectable execution](https://github.com/datacas/code-cycle-toolkit/milestone/1) | #327–#330, #259/#261/#290/#294, presupuestos #262 y overrides #285; #326 coordina. Runtime fixes found while running #330: #385 (P0, manual checks restore and idempotent resume; blocks #330), #382 (host-attested verification evidence) and #383 (malformed stage questions), #388 (P2, manual-check name grammar and resume-history tests; follow-up to #387) and #389 (P1, quota-aware routing and controlled fallback handoff on resume; blocks resolving REV-001 on #384), #394 (P1, resume pending verification when a stored check has no authorized command binding) #395 (P2, quota recovery commands accept repository-registered models), #402 (P2, Orca Task-spec reader binding and stock-CLI documentation; follow-up to #330), #393 (P0, urgent, resume blocked on frozen check identity; fixed in #404) and #406 (P0, urgent, ask the user instead of blocking on any command outside a stage's command table; builds on #289; implemented in #409), plus the stops reported on 2026-11-04, all urgent: #410 (P1, execution plan receipt rejected without naming the field), #411 (P1, remote-ref inspection of the review workspace without retry), #412 (P1, stage report rejected on schema grounds ends BLOCKED after a push), #413 (P1, another rereview of the same head instead of the CI gate), #414 (P1, required verification a review stage cannot run loops on resume), #415 (P1, `cycle_status.py --line` mixes cycles of other repositories) and #416 (P1, `basedpyright` does not fit the verification limit); #383 and #364 are urgent as well. Follow-ups found while running them: #421 (P1, urgent, a base-branch advance by another actor fails running stages as a publication breach or read-only violation), #425 (P1, urgent, an accepted `not_verified` check ends a rereview as `HUMAN_INTERVENTION` instead of `VERIFICATION_INCOMPLETE`) and #422 (P2, `read_operands` misses file operands behind abbreviated grep long options and combined jq short flags; follow-up to #406) and #428 (P0, urgent, interim guidance for the `credential_reads` remedy when `issue_review` cannot read the gh store; docs, skills and test only; the runtime fix is #397), #397 (P0, urgent, `issue_review` reads private GitHub issue data through a runtime snapshot instead of the gh credential store), #398 (P0, urgent, ask for consent to run an authorized Docker Compose `run` verification command instead of refusing it) and #435 (P1, urgent, a `READY` issue review is rejected when the runtime adds `permission_outcomes` to its result; follow-up to #406), #426 (P2, how a cycle reacts to an external base-branch advance: branch update and revalidation; follow-up to #421), #432 (P2, a remote inspection failure after review masks a changed implementer HEAD or working tree; found in #411) and #433 (P2, a review report with an integer `checks[].attempts` is rejected after a completed approval; follow-up to #412) and #377 (P1, per-project and per-check verification timeouts; moved from M2 because the 10-minute limit stopped two consecutive stages on a passing `basedpyright` run that needs 12 min 25 s, see #416), #446 (P1, bounded re-read that confirms a review or rereview publication before retrying; split from #364), #450 (P0, urgent, core principle of agent capability parity: audit and remove the toolkit's own vetoes of what the agent can run) with its child issues for the vetoes no earlier issue tracked, listed in `docs/capability-parity-audit.md`: #455 (P1, consent for compound shell commands instead of a parse-time refusal), #456 (P1, consent for Git, gh and Docker table refusals), #457 (P1, the never-grant boundaries become consent with a risk warning and a record), #458 (P2, run with a disclosed reduced guarantee when the configuration defeats the hook) and #459 (P1, normalize report and receipt representations instead of rejecting them), and #187 (P1, split `CycleRecorder.stage` into typed helpers; moved from M7 because that one 755-line method makes the `basedpyright` check take more than 10 minutes, target 10 s or less, see #416 and #377) and #438 (P0, urgent, one malformed stage receipt in an accumulating comment hides every receipt next to it and blocks a clean review; receipts are read one by one, related to #409 and #412), and #460 (P2, clear a stale declined-check record on a later allow and disclose consented `$TMPDIR` prefixes; follow-up to #398) and #439 (P0, urgent, a grant covers its variants: pattern (regular expression) grants, reads outside the stage workspace and layer attribution of refusals; follow-up to #406) and #464 (P0, urgent, a finished stage ends `BLOCKED` on refused read-only commands and detached runs cannot answer consent; follow-up to #406 and #450). Cinco perfiles resolubles, plan inspeccionable, ejecución nativa/Orca coherente, controles obligatorios no reducibles y resume trazable. #147 es independiente y #189 recomendable. Correcciones operativas asignadas siguen condicionadas a reproducción. |
+| [M1 — Safe, inspectable execution](https://github.com/datacas/code-cycle-toolkit/milestone/1) | #327–#330, #259/#261/#290/#294, presupuestos #262 y overrides #285; #326 coordina. Runtime fixes found while running #330: #385 (P0, manual checks restore and idempotent resume; blocks #330), #382 (host-attested verification evidence) and #383 (malformed stage questions), #388 (P2, manual-check name grammar and resume-history tests; follow-up to #387) and #389 (P1, quota-aware routing and controlled fallback handoff on resume; blocks resolving REV-001 on #384), #394 (P1, resume pending verification when a stored check has no authorized command binding) #395 (P2, quota recovery commands accept repository-registered models), #402 (P2, Orca Task-spec reader binding and stock-CLI documentation; follow-up to #330), #393 (P0, urgent, resume blocked on frozen check identity; fixed in #404) and #406 (P0, urgent, ask the user instead of blocking on any command outside a stage's command table; builds on #289; implemented in #409), plus the stops reported on 2026-11-04, all urgent: #410 (P1, execution plan receipt rejected without naming the field), #411 (P1, remote-ref inspection of the review workspace without retry), #412 (P1, stage report rejected on schema grounds ends BLOCKED after a push), #413 (P1, another rereview of the same head instead of the CI gate), #414 (P1, required verification a review stage cannot run loops on resume), #415 (P1, `cycle_status.py --line` mixes cycles of other repositories) and #416 (P1, `basedpyright` does not fit the verification limit); #383 and #364 are urgent as well. Follow-ups found while running them: #421 (P1, urgent, a base-branch advance by another actor fails running stages as a publication breach or read-only violation), #425 (P1, urgent, an accepted `not_verified` check ends a rereview as `HUMAN_INTERVENTION` instead of `VERIFICATION_INCOMPLETE`) and #422 (P2, `read_operands` misses file operands behind abbreviated grep long options and combined jq short flags; follow-up to #406) and #428 (P0, urgent, interim guidance for the `credential_reads` remedy when `issue_review` cannot read the gh store; docs, skills and test only; the runtime fix is #397), #397 (P0, urgent, `issue_review` reads private GitHub issue data through a runtime snapshot instead of the gh credential store), #398 (P0, urgent, ask for consent to run an authorized Docker Compose `run` verification command instead of refusing it) and #435 (P1, urgent, a `READY` issue review is rejected when the runtime adds `permission_outcomes` to its result; follow-up to #406), #426 (P2, how a cycle reacts to an external base-branch advance: branch update and revalidation; follow-up to #421), #432 (P2, a remote inspection failure after review masks a changed implementer HEAD or working tree; found in #411) and #433 (P2, a review report with an integer `checks[].attempts` is rejected after a completed approval; follow-up to #412) and #377 (P1, per-project and per-check verification timeouts; moved from M2 because the 10-minute limit stopped two consecutive stages on a passing `basedpyright` run that needs 12 min 25 s, see #416), #446 (P1, bounded re-read that confirms a review or rereview publication before retrying; split from #364), #450 (P0, urgent, core principle of agent capability parity: audit and remove the toolkit's own vetoes of what the agent can run) with its child issues for the vetoes no earlier issue tracked, listed in `docs/capability-parity-audit.md`: #455 (P1, consent for compound shell commands instead of a parse-time refusal), #456 (P1, consent for Git, gh and Docker table refusals), #457 (P1, the never-grant boundaries become consent with a risk warning and a record), #458 (P2, run with a disclosed reduced guarantee when the configuration defeats the hook) and #459 (P1, normalize report and receipt representations instead of rejecting them), and #187 (P1, split `CycleRecorder.stage` into typed helpers; moved from M7 because that one 755-line method makes the `basedpyright` check take more than 10 minutes, target 10 s or less, see #416 and #377) and #438 (P0, urgent, one malformed stage receipt in an accumulating comment hides every receipt next to it and blocks a clean review; receipts are read one by one, related to #409 and #412), and #460 (P2, clear a stale declined-check record on a later allow and disclose consented `$TMPDIR` prefixes; follow-up to #398) and #439 (P0, urgent, a grant covers its variants: pattern (regular expression) grants, reads outside the stage workspace and layer attribution of refusals; follow-up to #406) and #464 (P0, urgent, a finished stage ends `BLOCKED` on refused read-only commands and detached runs cannot answer consent; follow-up to #406 and #450)) and #469 (P1, `plan_projection` raises `AttributeError` on a non-object `evidence` item and a finished stage loses its report) and #470 (P1, urgent, the parallel CI gate ends `CI_UNREADABLE` when the plan has no branch-protection API; fall back to declared or SHA check runs; case of #450). Cinco perfiles resolubles, plan inspeccionable, ejecución nativa/Orca coherente, controles obligatorios no reducibles y resume trazable. #147 es independiente y #189 recomendable. Correcciones operativas asignadas siguen condicionadas a reproducción. |
 | [M2 — Evidence-based quality and verification](https://github.com/datacas/code-cycle-toolkit/milestone/2) | #146, #156–#159, #191, #260, #251, #331, #367 (condicionada a #329) y #237 refinada; verificación escalable a suites largas #376–#379 (#376 evalúa primero; #380, límite de concurrencia, condicionada a medición); apoyo de #144/#183, CI #145/#231 y trazabilidad #199. Reviews consumen evidencia comparable, behavioral funciona dentro del ciclo y legacy/desconocidos conservan su estado. #332 es opcional. |
 | [M3 — Supported execution surfaces and DevSecOps pilot](https://github.com/datacas/code-cycle-toolkit/milestone/3) | #219, #238-A y #238-B según su secuencia; #333/#334, #291 donde haga falta y #257; #246/#282 condicionadas. Matriz de ejecutores/proveedores declarada y validada, y piloto security sin nuevas vías de privilegio. |
 | [M4 — Measured cycle effectiveness](https://github.com/datacas/code-cycle-toolkit/milestone/4) | #185, #192, #180 y #127 (primera entrega: observabilidad descriptiva de revisiones). Tiempos, costes, rework, findings e intervenciones por cohortes con cobertura de datos visible. [#391](https://github.com/datacas/code-cycle-toolkit/issues/391), P2: benchmark offline de reviewers, A/B informativo por caso con etiquetas independientes; entrega experimental independiente, sin bloquear el candidato principal ni depender de #126/#331/#335. |