Reviewed October 22, 2026. This is a list of bounded roadmap candidates, not a promised release scope. 0.2.11 is public (released October 22 after the gates in the 0.2.11 record; the October 21 draft and tag were retired unpublished). Record shipped work in the changelog and retain its evidence in the linked validation records.
Source media → trustworthy copies → independent verification → accurate evidence → safe-to-erase decision. The card stays untouched, destinations are never overwritten, and incomplete or unverified work never looks complete. Mac, iPad and iPhone share the same rules; platform limits stay explicit. See the thesis, architecture, and current release record.
Recent completed work is recorded in the 0.2.10 and 0.2.11 release records, the October 19–20 matrix, and focused validation links below. Engine, Mac, simulator, signed-app, synthetic and physical results are distinct evidence. GitHub Actions CI remains intentionally disabled. Native Dock behavior was not observed; physical iOS, real-device VoiceOver and power-loss behavior remain unproven. Field reports #10 and #23 are still open, and no fix is attributed to them without evidence.
October 21 implementation status: PRs #79–82 merged the reliability, PDF-memory and bounded drive-access work. The combined checks passed engine tests, 84 focused Mac tests, the full Mac suite (1,456 passed, 35 skipped), both iPhone/iPad simulator architecture builds, and an independently checked 40,000-row PDF. Later slices below add their own validation records; those counts describe their recorded sources, not every later commit. The ordinary launcher has 13 regressions, and the three-disk physical suite passed SD-to-T9/WheeDrive transfers across modes and reuse. The final-source 20,000-file app replay, 119.6 GB large-app case and signed/device walkthroughs remain open.
- Finish the native Mac menu and card-event walkthrough. Verify active-window hide/reopen, Quit settlement and Dock badge/icon behavior in the signed app, then check newly detected and removed cards with a real removable card. Automated hide/reopen checks and the earlier menu icon/status/Open walkthrough are recorded in the 0.2.10 release checks; the final candidate's native Dock and physical card checks remain open. October 21 slice on main adds idle-Quit, Dock-badge and card-retire coverage (record); The October 22 signed walkthrough (0.2.11 record) observed hide/reopen, idle Quit, a real SD card detected, copied, ejected and removed, and the attention banner. Still unobserved and carried as limits: the Dock badge count and Quit while a transfer is running.
- Audit blocked-drive discovery. Volume facts and capacity probes must not stall the main actor or hide a healthy selected drive. Bound outstanding work across rescans, use generation and mount-identity checks, report unknown capacity honestly, and never recursively survey unselected storage. Held/released tests should cover a second healthy drive, replacement/unmount, late results, responsiveness and worker/file-descriptor bounds. A display deadline does not cancel a blocked filesystem call. The bounded Mac discovery slice moves listing, identity and classification off the main actor, coalesces requests and serializes probes of one mount. Its initial focused suite passed 22 tests and two deliberate regressions were detected. A follow-up moves Mac auto-source readability behind another bounded worker and makes mount grouping lexical; 39 combined focused checks passed and both new boundary regressions were detected. The merged implementation also moves queue source-availability probes, selected-folder preparation, Setup admission, History reconnect/status and retry/requeue to bounded worker paths, with cached presentation hints and generation/identity checks. Engine and full Mac gates passed with held-worker, cancellation, original-identity and durable-admission checks; see the combined validation record. Physical blocked-drive responsiveness and descriptor measurements remain open. October 21 slice on main drops stale capacity on mount change and re-prepares selection on the bounded worker (record).
- Isolate ordinary Mac tests from real drives. Launcher filtering, owned temporary fixtures, checkout-specific build output and opt-in real-volume probes are implemented. The test-prompt audit records 13 runner regressions and completed engine/Mac runs without permission prompts; release entitlements were not weakened. This does not prove fresh-install signed-app permissions or the outstanding large physical app workflow. Those remain validation work, not missing test isolation.
- Add independent MHL fixtures. Expand beyond the current reference-checked classic and ASC examples with representative output from another implementation and remaining supported format/encoding cases. Record fixture provenance, licensing and expected outcomes; unsupported or contradictory evidence must fail closed. The current corpus and limits are in evidence compatibility validation. A separate classic MHL consistency fix rejects conflicting duplicate modification dates; it adds no custody guarantee. A second, separately authored classic writer has now produced a tiny padded-filename fixture, accepted by its verifier and the primary schema. Its BitMatch reader controls passed in the 26-test classic suite and the 258-test engine Swift Testing run; this is partial corpus progress, not completion of the format/encoding work. October 21 slice on main adds four MD5-only/SHA-1-only/size-only/XXH64 writer inventories with an offline validator (record).
- Measure History memory in the actual app. The engine probe retained up to 100,000 rows with a 226 MiB observed worker peak, but did not measure app loading, search or views and did not reproduce #23. The Mac app-host probe exercised 500 saved attempts and 50,000 rows through loading, recovery, search, exports and rendered History/queue views; the latest passing run observed a 367 MiB process peak. Revised timing/receipt instrumentation also passed; finer checkpoints found substantial time in attaching/showing the History window, without yet identifying a production hot path. October 21 slice on main profiles that interval (collapsed/empty attach stalls ~3.3 s on Mac, whole-probe peak 251 MiB; ~1.1 s stalls, 91 MiB on iPad simulator) (record). The follow-on attach fix defers collapsed-row details until expansion and shares one evidence scan per row: attachment ~2 s → ~0.3–0.5 s, max main-actor pulse 2,994 → 1,158 ms in the paired before/after probe (record). This does not reproduce #23 or establish device performance. Profile the remaining attachment stalls and measure physical iPhone/iPad behavior before designing bounded loading/persistence. Preserve IDs, outcomes, retries, exports, migrations and interrupted-attempt recovery; do not silently prune evidence. See History memory validation.
Diagnostic failure-stage/code persistence and dropped-event disclosure are implemented on main. The initial focused run, combined app/engine gates and later contention tests retain their exact source and scope. The original stress marker still has no established cause; these changes improve future evidence and do not explain either field report.
- Transfer interruption, #10. Later releases fixed reproduced exFAT handoff, cancellation-state and large-file verification defects, but the reporter's interruption has not been reproduced. Correlate any supplied diagnostic export, app version, saved outcome and macOS termination evidence with the original drive, dock, filesystem and phase. Keep disposable-drive reproduction distinct from the reporter's run. Close only with a reproduction or decisive evidence; otherwise record what was ruled out and leave the report open.
- Application memory exhaustion, #23. Keep the field report open; its version and failing phase remain unknown. The PDF-memory fix is merged: the all-wrapped 40,000-row probe fell from a 1,624 MiB guard failure to a 191 MiB pass. A later mixed 40,000-row report passed at 143 MiB, with every file/destination/status pair independently checked and representative pages inspected. The PDF record and combined validation distinguish earlier app/physical passes from these report-only results. Receipt-parser handling and final mixed-report review are complete. Remaining work: repeat the 20,000-file coordinator report-off/on probe on final source, run the affected iOS tests, and finish signed/device report checks. None of these synthetic fixes reproduces #23. Do not request another large user transfer solely to gather data.
- Intermittent physical exFAT empty-file rejection. On October 20 a Standard retry rejected a zero-byte file on both SSDs; strict repeats passed. The same untouched T9 destination file later showed a different inode between runs with size and timestamps unchanged, not a reproduced within-run change. The merged mitigation rereads successful reused zero-byte Standard files on actual exFAT when inode alone changed, proving uncached EOF against original digests before final source, destination and root checks. Structured rejection diagnostics, focused Debug/Release regressions, 18 SD-to-SSD operations and scoped integrated/signed checks passed; the original cause remains unknown. Retain that distinction, the replacement/cancellation protections and failed fixtures. See the 0.2.11 record; do not attribute this to #10 or #23 without evidence.
- Classify diagnostic-recording failures under stress. Owned 20,000-file app probes produced a separate recorder-error marker during copy/verification, before PDF generation. Its cause is not recorded. Reproduce with deterministic slow-sync/concurrent-writer tests and retain closed failure stage/code diagnostics without names or paths. Verify event retention and explicit dropped-event disclosure; do not silently raise timeouts or call contention confirmed without evidence. October 21 slice on main: deterministic held-lock tests classify the shape (
directoryLock/EWOULDBLOCK), exports now count dropped events per instance, and the marker sidecar (v2, v1 readable) carries the claimant's lower-bound count; the 250 ms budget is unchanged (record). - Classify the separate Thorough source-stability rejection. The October 21 run stopped with two source-changed rows after five successful SD-to-two-SSD operations. Four retained-source Thorough operations and a later nine-operation matrix passed, without identifying the earlier cause. Preserve that failure, recover its available evidence after reboot and identify the guard stage/changed fields before changing a check. Byte corruption and a relationship to earlier exFAT failures are not established; keep source identity checks strict.
- Verification default, hashes and scheduling. Standard remains the fresh-install default; saved preferences remain honored. The decision needs a representative two-drive physical benchmark through final verdict, with source read, hashing, destination write/readback, MHL/report time, overlap, per-drive rates, peak memory, CPU and warm/cold-cache conditions recorded. Repeat to expose variance and retain failures. The buffer probe observed OS storage-driver reads but did not establish a cold device cache or app-only attribution. Do not change defaults based on a microbenchmark. A future pre-Start time estimate remains a deferred product decision: require representative recent measured speeds and label insufficient evidence honestly; keep Setup estimate-free meanwhile. Preserve the current Standard SHA-256 verdict; Thorough's MD5 is a verdict digest. A cheaper hash helps only if it replaces measured work, and must not silently weaken the SHA-256 verdict. Standard also computes MD5 during existing reads for its default ASC MHL output. Decide whether compatibility-only digests should become an explicit option where the chosen format does not require them; do not describe that proposal as an existing setting. Every digest required by an enabled MHL format stays present. Preserve independent readback and the deliberate fresh destination read on exFAT. Any algorithm or default change needs reference checks, old-evidence compatibility, explicit fresh/saved preference behavior, release notes and Mac/iPad/iPhone validation. Scheduling should avoid competing large reads on one HDD, allow useful concurrency on known independent SSD/NVMe devices, and treat unknown topology conservatively. See hardware testing and the overnight matrix.
- Unknown physical-drive identity presentation. Setup may list unresolved destinations separately, but required-copy safety gates now count only proven-distinct resolved groups (assurance fix). Remaining work is consistent wording across Setup, staged queues, completion, History and reports: distinguish verified copies from known independent devices. Cover unresolved, shared, RAID/composite, network and mobile-provider storage without treating unknown identity as proof of independence or silently refusing valid transfers. Scheduling must respect the same evidence limit.
- Repair from a verified sibling. Ownership-checked failed-readback marking, explicit History/CSV/JSON outcomes and one-time re-copy/re-verification are implemented. A checksum mismatch on owned output can trigger recovery; a read error does not establish corruption, and failed marking/retry never becomes success. The remaining sibling-repair design must revalidate the sibling, independently verify the repaired destination, retain source/repair/new-attempt evidence, and reject stale evidence or same-device copies. Never overwrite, delete or relabel another writer's file. See marking and outcome disclosure.
- Transient source faults and card health. Model source changes and read instability separately from destination failures. Any source retry must be small and bounded, record each reason, preserve source identity/hash continuity, and warn against formatting or reusing an unstable card even if a backup recovered. Exhaustion never becomes success. Chunk retry requires proven continuity. Existing recovery reuses only fully verified files, keeps the old attempt and never claims byte-offset resume. Distinguish “media verified; requested MHL/report could not be saved” from a media mismatch, and reveal existing evidence or offer an authorized export location. Any later handoff-only retry must revalidate backing media and publish new evidence without overwriting the old attempt.
- Per-destination out-of-space handling. First ENOSPC pauses that destination for the rest of the attempt; later files fail fast with recorded rows while other destinations finish. Resume is a new attempt with fresh space and identity preflight, not a timed in-attempt retry. Synthetic fault tests cover bounded attempts and healthy-backup completion; no overall safe verdict is possible while a required backup failed (record). Physical fault walkthroughs remain separate validation work.
- Finer reused-file progress. Transfer and queue progress include extra source-hashing/comparison passes on reused files. Mixed fresh/reused-destination tests cover monotone accounting and reserve 100% for an authoritative outcome. Implementation is complete; the native physical fault walkthrough remains open. Estimates stay separate from verification evidence (record).
- Assurance wording. The assurance audit maps source/destination reads, digests, evidence and wording. Keep source reread, local backup verification, SFTP upload and remote readback as separate facts: an SFTP upload-only result is “Uploaded · Unverified,” and remote readback cannot establish source assurance. Unsupported server setups fail closed. Apply the same distinction to future cloud evidence. On every platform, clearly distinguish selected plan, recorded scope, Quick's unverified result, exclusions, and safe-to-erase limits. Keep genuinely unknown legacy scope explicit; reject contradictory scope/counts and unsupported or contradictory supplied digests. Preserve supported legacy records with missing algorithm fields. A second read can catch differing bytes but cannot prove original camera bytes or detect every stable fault. Keep narrow-device wording and transient-source, repeatably wrong-source and destination-fault regressions current. October 21 Wonder audit on main fixed the code-provable mismatches: safety gates count only proven-distinct storage (unresolved identity no longer satisfies required copy counts), swapped-not-restored marking reports the real marked path, final evidence requires verified status, completed-with-no-rows resolves to issues, and the marking note reaches CSV/JSON reports (record). Narrow-device signed-app wording checks remain open.
Independent classic-MHL coverage now includes the padded-path fixture plus MD5-only, SHA-1-only, size-only and XXH64 inventories from a separately authored writer. The padded-fixture validator pins bytes and provenance; the single-algorithm record records actual upstream verifier/XSD checks, negative controls and BitMatch reader results. Supported digests pass; unsupported shapes fail closed. Writer-backed empty-file and BOM coverage, further independent ASC output and other encoding cases remain open.
- Upstream media provenance. Check can read ASC inventories and standalone classic MHL 1.1 content evidence. A future source check should report “Matches the supplied manifest” within explicit digest/history/authenticity limits. An unsigned manifest cannot prove the camera's original correctness; an older BitMatch record can show unchanged-since-recorded content but is not independent pre-arrival provenance. Reuse source-read digests only after proving identity and unchanged ordering. Malformed, incomplete, mismatched or unsupported evidence gets a separate honest verdict and never blocks preserving damaged-but-irreplaceable media.
- ASC MHL structure and history extension. The implemented read-only slice checks inventory digests, ordered generations, safe paths, exact coverage and unchanged evidence during Check. Add supported root/directory hashes and rename/move lineage before extending histories. Keep file contents, chain records and directory structure as distinct scopes; unsupported records stay explicit. A valid chain does not authenticate custody or prove an unanchored historical tail was never removed. Continue refusing to write a new history generation until interruption cannot expose a partial generation as complete and independent validation succeeds. Preserve existing histories.
- History imported from drives. Read saved reports from connected, authorized destinations incrementally and within bounds, so a shuttle filled on another Mac can show prior offloads. Deduplicate attempts; treat malformed/partial records as untrusted. Imported evidence is a record of a previous result, never fresh verification or an automatic safe-to-erase verdict. Keep large drives and disconnect/reconnect responsive; do not scan an entire NAS whenever History opens.
- Portable workflow settings. Versioned Settings export/import already covers verification, ASC MHL, global AppleDouble, report/thumbnail switches and basic naming. It previews changes, rejects unsupported/oversized files and blocks Apply during active, queued or prepared work. Remaining design: portable folder recipes and reusable destination configuration. Never serialize existing job/preset records, credentials, bookmarks, paths, identities, history or private report fields, and never activate imported destinations automatically. Revalidate destinations on the receiving machine.
- Say why a backup ran out of space. Done October 22 (plan): result rows carry a canonical reason (
outOfSpace,companionConflict) and the queue row, Review, History and the journal summary word it. The exFAT hidden-companion conflict with AppleDouble exclusion off is worded the same way and explained under the setting. - History memory and persistence. After the actual-app measurements above, design bounded load/persistence if evidence supports it. Startup already skips unchanged journal rewrites; mutations still encode saved results, and the app loads the journal on the main actor. Any paging/archive boundary must preserve IDs, outcomes, retries, exports, legacy ID migration and interrupted recovery; malformed records stay fail-closed and derived caches invalidate on evidence revisions. On-demand History search and cached completed-card summaries are implemented; their scope and limits are linked in the search probe, journal probe, and queue summary probe.
Remote is a proposed fourth mobile mode, after transfer reliability and evidence work. Keep the existing iPhone/iPad Copy & Verify, Check and Master Report modes fully functional, including standalone USB-C offload. The Mac menu bar companion is implemented; its remaining native checks are listed above. Remote starts read-only and monitors a Mac that remains sole authority for storage, queue, transfers, verification, journal, reports and verdicts. Reuse the shared coordinator, rules and presentation models; no second engine, UI-click simulation, helper or daemon. Mac hosting stays free and open source, with no accounts, subscriptions or internet requirement. $5.99 lifetime is a pricing hypothesis only, not a decision. Physical iOS local offload is separate from Remote and from later TestFlight/App Store distribution.
- Read-only monitoring. Use Bonjour discovery and authenticated encrypted local-network pairing, with explicit Mac opt-in, one-time code/QR, persistent device identity, connected-client visibility and revocation. Use an explicit privacy-safe station alias instead of silently exporting the Mac network name; minimize names/paths and consider display-only privacy. Send an authoritative initial snapshot, bounded/coalesced updates and paginated on-demand history, bound to host/session identity and revisions. Reconnect fetches fresh state; never attach a cached safe verdict to a new card. Keep connection freshness—live, delayed or unknown—separate from transfer phase and show the actual operator-needed reason. Stale 100% and timeouts never imply completion. Client disconnect/background suspension does not affect Mac work; Mac sleep/quit makes the view stale. No unauthenticated controls or automatic diagnostic/report uploads. Handle networks that block discovery or peer traffic.
- Setup, queue and Start. Show Mac-attached sources, authorized destinations, capacity and Mac readiness. Commands use opaque host-validated identities, current operation/queue revisions and stable idempotent request IDs. The Mac obtains any needed folder permission and revalidates source, destination and device identity at execution. Preserve preflight, no-overwrite and independence rules. Disconnected clients cannot submit commands.
- Controls and outcomes. Add pause/resume, retry, queue management and confirmed cancellation. Show engine stages, per-destination progress, measured throughput/ETA when available, warnings and authoritative outcomes. Reject or reconcile stale mutations; retries retain the prior attempt and cannot bypass Mac rules.
- Connectivity and release gates. Core support is Wi-Fi and wired Ethernet. Test powered USB-C Ethernet hubs and network changes. Prove direct USB app networking with public APIs before promising it; cable attachment alone is not proof. Bluetooth is deferred. Validate disconnect/restart/suspension, missed events, duplicate and out-of-order commands, stale/replaced media, failed preflight, overlap/overwrite attempts, revoked clients, cancel/retry, bounded event queues, large history, sandbox/file-provider limits, local-network declarations, layouts and physical-device background limits. Synthetic, simulator and device evidence stay distinct. No screen sharing, filesystem browsing, shell, cloud relay, automatic eject/format, facility management or multi-host coordination.
- Find and organize files. Finder “Offload with BitMatch” and Shortcuts/App Intents need the same validation and verdict rules. Extend current recipes with naming patterns and organize-by-date only with clear demand; test collisions and preserve card contents.
- Optional destination self-test. Consider a Help/Settings support check using the production engine, generated scratch source data and exclusive ownership-marked output under an explicitly selected destination. Cover empty, boundary, Unicode, many-small and moderate files, independent readback and requested evidence handoffs. Show expected versus actual coverage and offer privacy-safe diagnostics; cancelled or failed tests retain honest results. Clean up only pinned, proven-owned fixture roots. Generate source fixtures internally, never on a camera card. An internal source does not test the SD reader; a small pass cannot certify hardware, power-loss durability or large-transfer memory bounds. Keep larger fault tests separate.
- Operator mode. Only on user demand; preconfigured destinations/naming/verification may simplify source → start → review, with warnings and validation still visible. No facility administration or permission system.
- Cloud destination. Only on user demand and after defining staging, exclusive publication, interruption recovery and independent readback. Upload acknowledgment/object metadata alone is not readback. Keep source provenance, local backup evidence and cloud-object evidence separate; a remote destination does not prevent an independent local-source reread when the selected plan requires one.
- SFTP connection reuse. Consider replacing one
sshprocess per file if SFTP becomes a headline feature; current Mac-only SFTP scope remains explicit. - Notifications. An optional no-account completion/failure service needs explicit disclosure before sending card names or results.
- Visual polish. The seven-step pass in the visual polish spec merged on October 21 (America/New_York; #83, #84, #86, #87, #88, #89, #90): repeated attempts collapse to one queue row and Remove from queue always answers; the safe-to-erase hero names backups by volume and folder and eject carries through to "Removed"; queue rows carry the card name, a state label that says what to do, a fixed meta line and running detail; the Mac keeps its tab strip in History, gains a bottom action bar and follows content height; card/backup vocabulary on every screen; one Motion file with a row-as-progress-bar and the commit choreography; spacing, radius, text-style and iOS light/contrast tokens. Mac tests/build and the iPhone/iPad simulator build are recorded in PR #90; the spec is a plan, not a validation receipt. Not yet observed in person: VoiceOver on waiting rows' Edit/Move/Remove, Return while a text field is focused but untyped, Return with a project card prepared, zoom/tiling/full-screen exit holding the window fit, the iPhone overflow hit area, motion during a live transfer, iOS light mode and Increase Contrast. Follow-ups: History's first-six stagger, the drive plug-in slide, per-destination verify fractions in the row.
- iPhone/iPad distribution and screenshots. Validate standalone USB-C offloading and Remote separately, then use experimental TestFlight before App Store distribution. Capture real workflows with private production details removed; device readiness and accurate limits come before broader distribution.
- macOS 15.0 support. A build-only 15.0 override succeeded for Apple Silicon and Intel, and appcast minimum derivation is handled by #62. The shipped minimum remains 15.5. A real 15.0 walkthrough and coordinated project/docs change are still required; do not go below 15.
For relevant behavior changes, run the required engine and Mac checks, build iPhone/iPad and exercise the affected signed-app workflow. Keep synthetic, simulator, signed-app, physical-device and field evidence separate; retain failures and skipped checks. Follow the hardware procedure and retain hardware reports when testing real setups. Remaining physical and accessibility checks include card events, narrow-screen wording, device storage access and real-device VoiceOver; schedule them for the affected workflow and record untested limits. A successful simulator or build does not establish device behavior or resolve a field report. Selected removable/NAS roots should request access before Start where possible; mid-copy access loss must report interruption rather than silently stall. Do not probe unselected volumes.
Publication guards are implemented; FAT32 image and exFAT physical checks passed within the publication design and recorded matrix. Sudden power loss remains untested: an OS flush is not a durability guarantee. The 0.2.11 record lists gates passed on main and those still open; the retired candidate's evidence is kept in its own record. The release is held pending fresh approval, and CI stays disabled.
- Opt-in crash-summary delivery: validate signed/notarized Mac delivery, physical iPhone/iPad behavior and Settings/export. The local, off-by-default implementation is merged; delivery may be delayed or absent and cannot explain every OS kill or force quit. This check does not resolve either field report.
Without clear user need, do not add proxy generation/transcoding, dailies/color workflows, P5/LTO archive management, media cataloging or playback, full project management, Final Cut relinking, facility administration, cloud dashboards, automatic card formatting, or general-purpose bidirectional synchronization. Existing lightweight project transfers, folder recipes and optional remote backups remain in scope. Setup keeps its current no-time-estimate design; progress estimates come from observed transfer speed.