Reject missing prepared requests

docs/roadmap/audit/catalog.md

@@ -1,6 +1,6 @@
 # Consolidated audit catalog
 
-Status: **24 distinct open findings: two P2 and 22 P3**, consolidated from 30
+Status: **23 distinct open findings: one P2 and 22 P3**, consolidated from 30
 numbered entries in seven audit documents. Reviewed audit state:
 `db732e3a1de55c844f77870e1c6db683c2685d5d`.
 
@@ -104,6 +104,11 @@ Also noted in the [documentation cross-references](13-documentation.md#previousl
 
 ## F04 — P2: Prepared-request preview can succeed without a prepared result
 
+**Complete.** The command rejects a missing prepared request after provider and
+cancellation checks, preserving acquired evidence. Its public-command regression
+failed against the original behavior; focused preparation tests pass with valid,
+missing, provider-error and canceled acquisitions.
+
 The ckprompt prepared-request handler accepts an empty `Acquired` value with a
 nil error from `PrepareRequest`. It renders `null` and reports success despite
 having no prepared request.

docs/roadmap/implementation.md

@@ -1,6 +1,6 @@
 # Audit remediation implementation plan
 
-Status: in progress; Stages 1–3 complete.
+Status: in progress; Stages 1–4 complete.
 
 Baseline: `d492c7747175c01a53261206c2b4356e53453621`. Before this sprint,
 intervening changes recorded decisions and retired the completed older
@@ -200,6 +200,12 @@ open for the remaining parsing and binding wrappers.
 
 ## Stage 4 — Reject missing prepared-request results
 
+**Complete.** Missing prepared requests produce an operational failure while
+retaining diagnostics and explanations. The public-command regression reproduced
+the original successful null preview; focused preparation tests now pass in the
+offline aligned workspace with Go 1.27.0 and read-only module resolution, covering
+valid results, provider errors, and cancellation as well.
+
 Findings: F04. Source: ckprompt `preparation.go`.
 
 1. After the existing provider-error and cancellation handling in