Update README, MEMORY, and TODO to reflect current prototype and track remaining PLAN gaps

MEMORY.md

@@ -30,10 +30,21 @@ Session memory for durable decisions, state, and gotchas. Keep concise, remove o
 
 - RefCounted reference cycle: `NPCController` holds an `FSM` that holds a back-reference to its owner, so test suites report "resources still in use at exit". Benign (process exit), but worth breaking later (e.g. `WeakRef` or explicit `dispose()`).
 - Headless (dummy renderer) logs "Parameter m is null" from `mesh_get_surface_count`; it does not occur with a real GL driver and does not affect logic.
-- Wand screening (Joke Shop) is policy-only; the interaction is not yet in the prototype (see TODO).
 
 ## Open Questions
 
-- Tone picker UI design and whether tones should be selectable per interaction.
 - Whether the responder avatar should be playable/controllable or purely scripted.
 - Localization target languages.
+
+## Plan vs TODO Gaps (2026-10-31 evaluation)
+
+PLAN.md describes features that are neither implemented nor tracked in TODO.md. Recorded here so they are not lost; promote to TODO.md when work begins.
+
+- **Protesters NPC type** — PLAN.md premise lists "protesters" among the crowd, but there is no `PROTESTER` archetype in `Rules.NpcType`, no profile, and no events.
+- **Door lock/secure mechanic** — PLAN.md Level 3 lists "Lock or secure the door" as an action; no door-lock mechanic exists.
+- **Flashlight interaction** — PLAN.md Level 3 lists "Use a flashlight or radio warning tone at night"; `flashlight` appears in scenario `equipment` lists but has no interaction.
+- **"Call someone else" NPC reaction** — PLAN.md Level 2 lists "Call someone else" as a possible NPC response; the `Rules.Reaction` enum has no such outcome.
+- **LATE shift phase never fires (bug)** — `violent_emergency_event` is tagged `Rules.Phase.LATE`, but no scenario defines a LATE entry in `shift_phases` (only EARLY/MIDDAY/EVENING). `EventScheduler.pull_due` filters by phase, so the violent-threat event can never spawn.
+- **Shift results not persisted** — `Save` autoload exposes `save_shift_result`/`load_shift_results`, but nothing calls them; PLAN.md says shift results use JSON in `user://`.
+- **Navigation not implemented** — PLAN.md says `NavigationRegion3D`/`NavigationAgent3D` drive movement; NPCs currently use direct `move_and_slide` toward waypoints (no navmesh).
+- **Localized text not in JSON** — PLAN.md says localized dialogue/text live in JSON files; the `Strings` table is currently a GDScript constant, not JSON.