chore(tasks): mark fwd16, fwd13, cli01 completed

tasks/adapters/review-002-fwd13-dot-segments.md

@@ -1,7 +1,7 @@
 ---
 id: review-002-fwd13-dot-segments
 name: Reject lone dot-dot path values that Url-set_path normalizes away (FWD-13)
-status: pending
+status: completed
 depends_on: []
 scope: narrow
 risk: medium
@@ -65,3 +65,7 @@ message style in `render_path_template`'s unbound-placeholder error).
 FWD-18 (object/array placeholder values double-routing to query) is
 tracked separately in review-002-fwd17-19-contract-decisions — do not
 fold it here, the mechanisms are adjacent but the decisions differ.
+
+## Summary
+
+Lone ./.. (and %2e spellings) path values rejected INVALID_INPUT at value_to_path_segment; post-set_path normalization invariant in assemble_request_url; url 2.5.8 normalization empirically pinned; dotted-value legitimacy + segment-survival corpus tests.

tasks/adapters/review-002-fwd16-missing-capability.md

@@ -1,7 +1,7 @@
 ---
 id: review-002-fwd16-missing-capability
 name: Loud error on missing capability instead of silent unauthenticated request (FWD-16)
-status: pending
+status: completed
 depends_on: []
 scope: narrow
 risk: low
@@ -68,3 +68,7 @@ runs authed-ops with *optionally*-present credentials (none known
 today), that would be a new config flag — do not preemptively add one;
 the invariant (ADR-014: credentials flow only via Capabilities) argues
 loud-and-closed.
+
+## Summary
+
+Silent missing-capability arm now fails with INTERNAL naming both key forms (api_key:/http_token:) and refusing the unauthenticated send; module doc loud-missing-matrix paragraph; 3 tests incl. a zero-upstream-requests wire test. Two pre-existing no-env-vars tests updated (they pinned the silent arm).

tasks/client/review-002-cli01-retry-after-budget.md

@@ -1,7 +1,7 @@
 ---
 id: review-002-cli01-retry-after-budget
 name: Budget-aware Retry-After sleep — stop re-arming a full ceiling per attempt (CLI-01)
-status: pending
+status: completed
 depends_on: []
 scope: narrow
 risk: medium
@@ -68,3 +68,7 @@ already fixed and correct). The natural seam is threading the budget
 handle into the middleware order so RetryAfter sees it — small,
 testable, no public API change (the budget is already a
 `HttpClientConfig` field).
+
+## Summary
+
+BudgetClock extension anchored per logical request; sleeps truncated to min(deadline, budget); record() keeps earliest deadline, refreshes clamped to hard stop (drop-on-exhaustion). No public API change; tests/retry_after_budget.rs wire tests added.