docs: align README with implemented features, move unimplemented to planned section

ober

8ea6627bfa90e4d25e11c57ba6f87881073ee23c

diff --git a/README.md b/README.md
index 138de39..acd131c 100644
--- a/README.md
+++ b/README.md
@@ -93,10 +93,11 @@ remote-to-local, and remote-to-remote encrypted copies. `check` and `sync`
 support simple `*` wildcards through repeated `--include PATTERN` and
 `--exclude PATTERN`.
 
-Decrypted remote names are validated again when a manifest is loaded. Recursive
-downloads use a retained destination-directory descriptor, no-follow component
-walks, and atomic file publication, so traversal components and concurrent
-symlink replacement cannot redirect output outside the selected local root.
+Decrypted remote names are validated again when a manifest is loaded. File
+output — single-file `get` and recursive downloads alike — uses a retained
+destination-directory descriptor, no-follow component walks, and atomic file
+publication, so traversal components and concurrent symlink replacement cannot
+redirect output outside the selected local root.
 
 ## Runtime Status
 
@@ -235,7 +236,8 @@ make run ARGS='drive mount-root-write --username you@example.com --mountpoint /t
 The product-level FUSE CLI surface also has a profile-aware mount command and
 local state inspection commands. `drive daemon start` currently runs the same
 FUSE daemon in the foreground so it can be supervised by a service manager; a
-background control socket is tracked as remaining work.
+background control socket is not implemented yet (see
+[Planned / Not Yet Implemented](#planned--not-yet-implemented)).
 
 ```sh
 make run ARGS='drive cache init --profile default'
@@ -347,12 +349,28 @@ Release dependency and provenance evidence is documented in
 writes the local evidence bundle under `dist/release-evidence/` and fails
 closed while upstream dependency gates remain blocked.
 
-## Remaining Work
+## Planned / Not Yet Implemented
+
+The following are **not** implemented yet. They are listed here so the README
+does not overstate current capability:
+
+- **Daemon control socket / background lifecycle.** `drive daemon start` runs
+  the FUSE daemon in the foreground only, so it can be supervised by a service
+  manager. There is no background daemon and no control socket.
+- **Durable operation queue.** Create/upload/rename/move/trash operations are
+  not journaled; there is no persistent queue that survives a crash or restart.
+- **Multi-writer merge.** Concurrent writers are handled fail-fast: manifest
+  commits use S3 conditional writes against the manifest ETag, so a conflicting
+  writer fails with a retryable error instead of being merged. There is no
+  merge/conflict-resolution policy beyond that.
+- **Indexed cache states.** On-demand cache-state tracking (online-only,
+  available, pinned, dirty, uploading) is not implemented. `drive cache init`
+  and `drive cache status` only create and report local cache/staging paths;
+  `metadata.db` and indexed cache state are planned persistence layers.
+
+Other remaining work:
 
 - Prove the encrypted S3 live integration against each target provider.
-- Add richer multi-writer merge/conflict-resolution policy beyond fail-fast
-  conditional manifest commits.
-- Finish daemon control socket/background lifecycle and durable operation queue.
 - Add richer metadata update operations beyond size-changing writes and
   rename/move.
 - Collapse the native dynamic library bundle further when Jerboa supports a