plan-reviewlisted

# Plan Review Read the project plan (typically `plan.md` in the current directory or a path provided by the user) and produce a structured review covering gaps, risks, and forgotten items. ## Arguments | Arg | Required | Default | Description | |---|---|---|---| | `--autofix` | no | true (default ON) | Auto-apply fixes that don't need user judgment (operator+code splits, missing Done-when, missing Files, default Type: code, placeholder Condition:). Findings requiring judgment are still surfaced. | | `--no-autofix` | no | -- | Opt out of autofix. Surface ALL findings as recommendations; do not modify plan.md. For operators who want to review before applying. | ## What to check ### 1. Data persistence - Is there a defined store for every entity the app creates or tracks? - Is the store technology chosen (DB, SQLite, flat-file, in-memory)? - Is there a strategy for data corruption, partial writes, or concurrent access? ### 2. External dependencies and integrations - Are all third-party services identified with auth/API key strategy documented? - Are rate limits, ToS constraints, or bot-detection risks acknowledged? - Are fallback strategies defined for external service failures? ### 3. Authentication and secrets - Are secrets (API keys, tokens) kept out of source code? - Is there a documented pattern for loading secrets (env vars, config file)? - Are token expiry and refresh scenarios handled? ### 4. Async and concurrency - Are long-running tasks (crawlers, AI calls, fil