docs(adr): /runda DA cleanup — reflect Phases 1-3 done, pin Bucket C

Surfaces from a Devil's-Advocate audit of the DSL → SQL teaching echo
(ADR-0038) after Phases 1-3 landed: three doc-drift bugs introduced
by the earlier handoff-47 / ADR-promotion commits — requirements.md
M4 and both ADR-0038 README index entry + Status block still said
"Phase 2 / Phase 3 remain," but `275c726` and `e6ad1ae` shipped them.
Updated to reflect actual state: Buckets A + B complete plus the
category-3 prose; only the §4 styled-runs polish remains. ADR-0037's
README entry also touched to note all four shipping commits of its
consumer.

Plus a missing test slice the DA flagged: explicit no-echo coverage
for the Bucket C cases that flow through command_to_sql's catch-all
(show table, explain, replay, every Command::App variant). The
contract — ADR-0030 §10 / ADR-0038 §7 Bucket C — forbids echoes for
these; a future renderer arm added at the wrong place could silently
leak one. The new bucket_c_no_echo_commands_all_return_none pins
that.

Tests: 2015 passed / 0 failed / 1 ignored (pre-existing); clippy
clean. Nothing to escalate.

src/echo.rs

@@ -1118,6 +1118,80 @@ mod tests {
         );
     }
 
+    #[test]
+    fn bucket_c_no_echo_commands_all_return_none() {
+        // ADR-0038 §7 Bucket C: pin the no-echo cases that flow through
+        // the `command_to_sql` catch-all (alongside the already-tested
+        // `Sql*`/`Select` and column-level UNIQUE/CHECK drop). A drift
+        // here — say, a renderer arm grown into a Bucket C command —
+        // would silently leak echoes the §10 / §13 contract forbids.
+        use crate::dsl::command::AppCommand;
+
+        // `show table T` — structure display, no SQL spelling in the
+        // surface (ADR-0038 §7 Bucket C).
+        assert!(
+            command_to_sql(&Command::ShowTable {
+                name: "T".to_string(),
+            })
+            .is_none(),
+            "show table is Bucket C — no echo"
+        );
+
+        // `explain …` — EXPLAIN of advanced SQL is the deferred OOS-2
+        // follow-up (ADR-0039); the DSL `explain` wrapper itself echoes
+        // nothing (ADR-0038 §7).
+        assert!(
+            command_to_sql(&Command::Explain {
+                query: Box::new(Command::ShowData {
+                    name: "T".to_string(),
+                    filter: None,
+                    limit: None,
+                }),
+            })
+            .is_none(),
+            "explain is Bucket C — no echo"
+        );
+
+        // `replay <path>` — app-lifecycle, no SQL form (ADR-0038 §7).
+        // (Also: replay bypasses the echo-bearing spawn entirely, so it
+        // never reaches command_to_sql in practice — but pinning the
+        // catch-all here guards against a future arm sneaking in.)
+        assert!(
+            command_to_sql(&Command::Replay {
+                path: "history.log".to_string(),
+            })
+            .is_none(),
+            "replay is Bucket C — no echo"
+        );
+
+        // `Command::App(_)` — every app-lifecycle command, regardless of
+        // verb. ADR-0030 §10: "app-level commands have no SQL form and
+        // are not echoed." Sample two: `quit` (verb-only) and `mode
+        // advanced` (verb + payload).
+        for app in [
+            AppCommand::Quit,
+            AppCommand::Help,
+            AppCommand::Rebuild,
+            AppCommand::Save,
+            AppCommand::New,
+            AppCommand::Load,
+            AppCommand::Undo,
+            AppCommand::Redo,
+            AppCommand::Mode {
+                value: crate::dsl::command::ModeValue::Advanced,
+            },
+        ] {
+            assert!(
+                command_to_sql(&Command::App(app.clone())).is_none(),
+                "Command::App({app:?}) is Bucket C — no echo"
+            );
+            // Also confirm echo_for gates the same in advanced mode.
+            assert!(
+                echo_for(&Command::App(app), EffectiveMode::AdvancedPersistent).is_none(),
+            );
+        }
+    }
+
     #[test]
     fn sql_entered_command_is_not_echoed() {
         // A command the user typed as SQL (SqlCreateTable) is not echoed