docs: align security roadmap status

Jaime Fournier <jaimef@linbsd.org>

29f3ff6ce6ae91fc8e3575f39d5a3a0a6ebe29eb

diff --git a/docs/kimi3-security-recommmendations.md b/docs/kimi3-security-recommmendations.md
index e420322..3d675dc 100644
--- a/docs/kimi3-security-recommmendations.md
+++ b/docs/kimi3-security-recommmendations.md
@@ -220,7 +220,7 @@ when" must be answerable from `dist/release-evidence/` in minutes.
 | Exec restricted worker facade | `(std security worker)` | exists; pure env, deadline, process-group kill, output caps, audit records, fail-closed refused axes, explicit `sandbox:` axis requests, egress proxy env wiring, and memory rlimits installed pre-exec on supported platforms; native kernel sandbox installation pending | security-reference §5 |
 | Native async exec launcher (collect-safe) | `(std os aproc)` | exists — the primitive P0-02 should build on | [aproc.md](aproc.md) |
 | Parser hardening (depth/size/backtrack budgets: reader, JSON, XML, YAML, DNS, HTTP/2, WS, zlib, base64, hex, CSV, pregexp, format) | various | phases 1–4 done, 42 tests; phase 5 FFI audit inventory has per-site provisional verdicts, with remediation rules still open | security-reference §7; [ffi-audit.md](ffi-audit.md) |
-| Safe deserialization (tagged-JSON envelope, no native FASL on untrusted paths) | `(std safe-fasl)`, `(std fasl)` (trusted-only) | exists; named raw-read/FASL paths have first triage; broader `load`/REPL/dev-surface classification remains | [safety-guide.md](safety-guide.md) §10 |
+| Safe deserialization (tagged-JSON envelope, no native FASL on untrusted paths) | `(std safe-fasl)`, `(std fasl)` (trusted-only) | exists; raw `read`/FASL/`load` sites are classified by manifest and gated by `make audit` | [safety-guide.md](safety-guide.md) §10 |
 | Crypto (Rust `ring`: AEAD, HMAC, PBKDF2, scrypt, ChaCha20, digests; CSPRNG from `/dev/urandom`; timing-safe compare; Argon2id via Rust `argon2`) | `(std crypto native-rust)`, `(std crypto password)` et al. | exists; high-level HMAC/AEAD/KDF/password APIs route through Rust native crypto | security-reference §10 |
 | Secure memory (mlock, guard pages, DONTDUMP/DONTFORK, explicit_bzero, checked secure bytevector view) | `(std crypto secure-mem)` | exists; high-level `secure-bytevector` API plus raw region escape hatch | security-reference §9 |
 | Lifetime-scoped secrets with auto-wipe | `(std security secret)` | exists; documented in the security module inventory | security-reference §12 |
@@ -304,7 +304,7 @@ when" must be answerable from `dist/release-evidence/` in minutes.
 
 | Goal | Where we stand | The gap |
 |---|---|---|
-| G1 shrink target | Managed core is memory-safe; parsers budgeted; safe prelude exists | FFI surface (91 files / 225 symbols / 432 `unsafe`) never systematically audited (phase 5); `vendor/jsqlite` is C in the TCB; safe prelude not the default entry; import conflict undermines "safe symbol wins" confidence |
+| G1 shrink target | Managed core is memory-safe; parsers budgeted; safe prelude exists; FFI audit inventory and per-site provisional verdicts exist | FFI remediation remains: null/width/bounds/GC-safety scanner rules, unsafe invariant comments, native export shrinking/justification, and the `vendor/jsqlite` decision |
 | G2 cap blast radius | Capabilities, taint, kernel sandbox, egress policy objects, worker facade, memory rlimit pre-exec path, egress proxy env wiring, and authenticated actor transport/envelopes all exist | **No native pre-exec worker backend yet for kernel sandbox controls before child input**; protocol/network taint source defaults and performance measurement remain open |
 | G3 find it first | 13 harnesses, scanner w/ rule DB, lint | No corpora, no crash regression, no scheduled fuzzing, no standing AI-red-team, no exploit-shaped regression suite |
 | G4 fail closed | Raw-fork launchers retired correctly; `allow-degraded?` explicit | New controls must keep the invariant; degraded-mode warnings must be test-locked |
@@ -1084,7 +1084,7 @@ Track these in `docs/status.md` per release:
 |---|---|---|
 | Build balance clean | `pattern.ss` repaired 2026-07-27; `source-balance` in `make audit` | always clean |
 | Confined worker exists | facade, audit lifecycle, output caps, deadline, process-group kill, memory rlimit pre-exec path, explicit sandbox-axis refusal, and egress proxy env wiring landed 2026-07-27; native kernel sandbox installation pending | yes, tested (P0-02) |
-| Unclassified raw `read`/FASL sites | first scanner-driven batch closed 2026-07-27; broader `load`/REPL/dev classification remains | 0 |
+| Unclassified raw `read`/FASL/`load` sites | scanner-driven manifest classification gate closed 2026-07-27; trusted build, compiler, REPL/dev, and test surfaces are centrally justified by exact source line | 0 |
 | FFI bindings audited | 0 / 91 files | 100% with verdicts |
 | Un-annotated Rust `unsafe` blocks | unknown / 432 matches | 0 |
 | Fuzz corpora / crash regressions | 0 / 0 | per-parser corpora + every crash a test |
@@ -1178,8 +1178,9 @@ fake confidence happens.
   HMAC/AEAD/KDF/password APIs route to Rust native crypto.
 - Secure memory has a checked `secure-bytevector` API; raw secure-region
   pointers remain for explicit FFI integration.
-- FFI audit (phase 5) unstarted until P1-01; `vendor/jsqlite` is C in the
-  TCB pending its decision.
+- FFI audit phase 5 has a reproducible inventory and per-site provisional
+  verdicts; null/width/bounds/GC-safety remediation and the `vendor/jsqlite`
+  TCB decision remain open.
 - No independent red-team evaluation yet (P2-04 starts the practice).
 - The confined exec worker facade exists as `(std security worker)`, with
   audit-log lifecycle events and native pre-exec memory rlimits on supported