plan/docs: the M2 gate is not reachable as written either

Priced the 13 aggregate failures one by one instead of counting them. Six
cannot turn green in M2 whatever is built: three need $listLocalSessions (M4)
*and* $addFields (M2.5), two need the expression engine, one needs a collation
(M8). So the gate reads '0 fail among the seven reachable', with the other six
named and attributed.

Note what the three db.aggregate() cases actually need. Implementing
{aggregate: 1} moves none of them, because each then fails on
$listLocalSessions instead. The review priced that line 'orthogonal, and
cheap'; it was cheap and worth nothing.

The seven that remain are $out and $merge, and they need a decision the review
had no authority to take. They write to a collection the pipeline is not
reading, and three things stand against that: aggregate is declared .read and
the dispatch contract says only .write commands may mutate; dispatch acquires
locks from a static table keyed on the command name, before the handler runs;
and Collection.lock's own comment states the invariant that decides it -- never
more than one collection lock at a time.

That is the same objection that kept $lookup out of M2.5's first cut, and the
review failed to apply it to the write stages in the same breath. Recorded as
the review's own error rather than quietly corrected. Two options set out in
§7, plus the durability question neither of them answers: mongod's $out
replaces the target atomically and this engine has no cross-collection
atomicity.

Nothing past Tier 0 is implemented until one is chosen.

PLAN.md

@@ -434,6 +434,19 @@ the unevaluated expression, `$literal` is echoed back, and a `$match` after a
 answer `ok: 1` with a wrong result; only `$addFields` fails honestly. Doing the
 command surface first leaves those alive for a further milestone.
 
+*Measured after Tier 0 landed, and it corrects this amendment:* pricing the 13
+failures one by one shows **6 of them cannot turn green in M2 at all** — three
+need `$listLocalSessions` (M4) *and* `$addFields` (M2.5), two need the
+expression engine, one needs a collation. The gate reads "0 fail among the
+seven reachable", not "0 fail". And the seven that remain, `$out` and `$merge`,
+need a lock-model decision this amendment did not anticipate: they write to a
+collection the pipeline is not reading, which the dispatch contract, the static
+lock table and `Collection.lock`'s one-at-a-time invariant all stand against.
+It is the same objection that kept `$lookup` out of M2.5's first cut, and the
+review failed to apply it to the write stages. Both options are set out in
+`docs/M2_DESIGN_REVIEW.md` §7; nothing past Tier 0 is implemented until one is
+chosen.
+
 **Which is why M2 carries the refusals.** Every construct the engine does not
 implement stops answering `0` and starts answering an error, with the code
 measured against mongod: unknown accumulators, non-path expressions where a
@@ -452,7 +465,7 @@ answers, and the trade is only acceptable because the lie is removed first.
 |---|---|---|---|
 | M0 | **mmap + WAL foundation** | data file format, page/extent allocator, mmap slab + B+tree arena, copy-on-write + page free list (A1/A2), watermark/replay, checkpoint (= compaction repurposed), leaf payload → slab offset (A3), drop docs hashmap, churn measurement | D7 (6 items) |
 | M1 | **Cursors + wire polish** | getMore / killCursors / batchSize; server-side cursor state with idle timeout; sessions plumbing (lsid accepted) as drivers send it; hello advertisement updates; **`moreToCome` on requests** (see the bug below); command-monitoring assertions in the spec runner | crud spec suite green; e2e green |
-| M2 | **The `aggregate` command surface** | `$out`, `$merge`, `db.aggregate()` (`{aggregate: 1}`), collation, `let`; plus refusing every pipeline construct the engine does not implement instead of answering `0` (amendment A6) | `aggregate-*.json` in the crud corpus: 0 fail |
+| M2 | **The `aggregate` command surface** | `$out` and `$merge` (7 of the 13 failures), and refusing every pipeline construct the engine does not implement instead of answering `0` (amendment A6). The other 6 failures are blocked on M2.5, M4 and M8 — see `docs/M2_DESIGN_REVIEW.md` §7 | `aggregate-*.json`: 0 fail among the 7 reachable cases |
 | M2.5 | **The aggregation engine** | expression evaluator, per-stage document iterator, the accumulators, `$unwind`; `$lookup`/`$facet` explicitly out of the first cut (amendment A6) | a purpose-built stage corpus, every expectation measured against mongod |
 | M3 | **Update operators + index types** | $setOnInsert, $addToSet, $mul, $min/$max, $pop, $pullAll, $currentDate, pipeline updates; partial + hashed indexes | remaining crud coverage; e2e3/e2e4 green |
 | M4 | **Sessions + transactions** | logical sessions, snapshot isolation on the mmap engine, write concern at commit | sessions + transactions spec suites green |