Keep roadmap status aligned with main

docs/TODO.md

@@ -12,16 +12,16 @@ This is the order to **investigate or start a bounded slice**, not a promise to
 
 The two active reports come first as **casework**, but neither is a ready-to-ship fix: [#23](https://github.com/BitmatchApp/Bitmatch/issues/23) needs the reporter's version/phase or a reproduced memory path, and [#10](https://github.com/BitmatchApp/Bitmatch/issues/10) needs decisive diagnostics or a physical reproduction. Synthetic passes alone cannot close either report.
 
-Unreleased branch progress: terminal/History presentation and Mac card-event reconciliation have bounded implementations; an SFTP contract test checks downloaded remote bytes, and the buffer benchmark requests uncached writes. Setup, History and report wording have landed, while the broader assurance audit, physical measurements and signed-app walkthrough remain open below.
+Unreleased work on `main`: terminal/History presentation, Mac card-event reconciliation, the verification wording audit's first slice, unknown-drive Setup wording, SFTP interruption/stale-evidence checks and the expanded MHL corpus have landed. The engine test runner now executes both test frameworks. First-upload and subprocess-cancellation SFTP fixes remain in draft while their race cases are resolved; the Mac menu bar companion is also still in review. None of this closes the active user reports or replaces the physical and signed-app walkthroughs below.
 
 | Rank | Build or decision work | Usefulness | Difficulty | Blast radius | Shippability |
 | ---: | --- | --- | --- | --- | --- |
-| 1 | Terminal progress and outcome parity (branch implementation; release check open) | High | Low–medium | Medium | Quick |
-| 2 | Verification coverage and wording audit (setup, History and reports aligned; mode/fault audit open) | High | Medium | Medium | Scoped |
-| 3 | Honest claims when physical drive identity is unknown | High | Medium | Medium | Scoped |
-| 4 | Distinguish local-source, local-backup and SFTP assurance (labels shipped; interruption/stale-evidence tests open) | High | Low–medium | Low–medium | Quick |
-| 5 | Expand the MHL interoperability corpus | High | Medium | Low | Scoped |
-| 6 | Reconcile missed Mac card events (branch implementation; physical check open) | Medium–high | Low | Low | Quick |
+| 1 | Terminal progress and outcome parity (merged; signed-app release check open) | High | Low–medium | Medium | Quick |
+| 2 | Verification coverage and wording audit (first mode/fault slice merged; wider audit open) | High | Medium | Medium | Scoped |
+| 3 | Honest claims when physical drive identity is unknown (Setup note merged; verdict decision open) | High | Medium | Medium | Scoped |
+| 4 | Distinguish local-source, local-backup and SFTP assurance (evidence tests merged; upload edge cases open) | High | Low–medium | Low–medium | Quick |
+| 5 | Expand the MHL interoperability corpus (rename/move fixture merged; classic interop open) | High | Medium | Low | Scoped |
+| 6 | Reconcile missed Mac card events (merged; physical check open) | Medium–high | Low | Low | Quick |
 | 7 | Eliminate the exFAT/FAT publication race | Very high | High | High | Long; protected safety work |
 | 8 | Mark failed readback output unmistakably on disk | High | High | High | After publication ownership |
 | 9 | Mac menu bar companion, first Remote phase | High | Medium | Medium | Scoped |
@@ -63,7 +63,7 @@ These eight supporting tasks are not competing features. Do them when their evid
 | ---: | --- | --- | --- | --- | --- |
 | 1 | Confirm the buffer benchmark's first read reaches physical storage (uncached-write request added) | High | Low | Low | Quick |
 | 2 | Run the end-to-end two-drive physical benchmark | High | Medium | Low | Hardware-dependent |
-| 3 | Remove permission prompts from automated tests | Medium–high | Medium | Low | Scoped |
+| 3 | Keep automated tests free of drive-access prompts (Mac unit slice merged) | Medium–high | Medium | Low | Scoped |
 | 4 | Keep release walkthroughs and synthetic/physical results separate | High | Ongoing | Low | Every relevant release |
 | 5 | Collect physical hardware reports | High | Ongoing | Low | Field-dependent |
 | 6 | Run a VoiceOver pass on real devices | High | Medium | Low | Device-dependent |
@@ -92,7 +92,7 @@ The priority buckets are not a strict implementation sequence: investigate P0 re
 
 - [ ] **Verification coverage and default-policy audit.** Standard is the fresh-install default; a previously saved mode stays selected. Setup, History and PDF/CSV/JSON wording have been aligned with recorded checks, and Compare has its own check-plan wording. Still map Quick, Standard, Thorough and Paranoid to copy-stream source hashing, independent source rereads, destination readback, byte comparison, source-change checks, ASC MHL/report evidence and the actual safe-to-erase verdict. Include a one-time transient source misread and a repeatably wrong read: a second read can catch differing bytes, but cannot prove the original camera bytes or detect every stable fault. Treat the recommended default as a product choice informed by safety, user workflows and measured time; it may move up or down the assurance ladder, but every verdict must name the checks actually performed and the selected-file scope. **Acceptance:** finish-screen, README and Guide mode claims need a final check against the engine and fault-injection tests; Quick and intentionally excluded-file transfers stay unsafe; injected source and destination faults produce honest outcomes. Any default change has explicit behavior for fresh versus saved preferences, release notes and Mac/iPad/iPhone validation.
 
-- [ ] **Separate local-source and remote-destination assurance.** A local source can be independently re-read before a later SFTP upload; the current Mac SFTP queue uploads an already verified local backup, not the card. Its SHA-256 readback downloads the remote file, while upload-only remains **Uploaded · Unverified**. The screen and report labels landed in #26; this branch adds a contract test that checks the downloaded bytes are hashed and a mismatch fails, without reading the card. Keep local source reread, local backup verification, remote upload and remote readback as distinct facts in diagnostics and future changes. Do not infer source assurance from a remote readback or deny source assurance merely because a later destination is remote. **Acceptance:** tests still need interruption and stale local evidence; no remote result becomes a whole-card safe verdict without the required local checks. Apply the same evidence separation to any future cloud provider, with Mac-only SFTP scope explicit on iPad/iPhone.
+- [ ] **Separate local-source and remote-destination assurance.** A local source can be independently re-read before a later SFTP upload; the current Mac SFTP queue uploads an already verified local backup, not the card. Its SHA-256 readback downloads the remote file, while upload-only remains **Uploaded · Unverified**. The screen and report labels landed in #26; contract, interruption and stale-local-evidence tests have since landed. Keep local source reread, local backup verification, remote upload and remote readback as distinct facts in diagnostics and future changes. Do not infer source assurance from a remote readback or deny source assurance merely because a later destination is remote. **Acceptance:** no remote result becomes a whole-card safe verdict without the required local checks; the first-upload and child-cancellation drafts must also pass adversarial and live-server tests before merging. Apply the same evidence separation to any future cloud provider, with Mac-only SFTP scope explicit on iPad/iPhone.
 
 - [ ] **Storage-aware verification scheduling.** Replace the CPU-derived default with scheduling informed by physical storage identity and measured behavior. Avoid competing large sequential reads on one HDD; permit useful concurrency across independent SSD/NVMe devices. Account for shared devices and buses only where reliably identifiable. Preserve diagnostic worker-count overrides and benchmark actual throughput and memory use on physical hardware, including the two-drive test below. **Acceptance:** independent destination readback remains complete, cancellation still stops the run, and unknown topology gets a conservative policy rather than invented independence.
 
@@ -112,7 +112,7 @@ The priority buckets are not a strict implementation sequence: investigate P0 re
 
 - [ ] **One destination out of space.** Investigate pausing only that destination while the others finish, then revalidate space and identity before continuing. Today the failed destination is reported while others can finish. **Acceptance:** partial work remains visibly incomplete, cancellation works, and the overall verdict cannot become safe until every required backup verifies.
 
-- [x] **Finish local terminal progress/outcome parity.** The engine withholds `.completed` and 100% when selected rows fail. This branch adds an active Finishing state while MHL/report/journal evidence settles, keeps cancelled and unexpectedly interrupted wording distinct, and refuses a safe History/Finish verdict for missing, duplicated or copied-but-unverified selected results. Mac/iPhone/iPad shared presentation and focused cancellation/terminal tests cover this local slice; a percentage alone is never a success verdict. Future remote presentation and the signed-app fault walkthrough remain separate release gates.
+- [x] **Finish local terminal progress/outcome parity.** The engine withholds `.completed` and 100% when selected rows fail. The merged local slice adds an active Finishing state while MHL/report/journal evidence settles, keeps cancelled and unexpectedly interrupted wording distinct, and refuses a safe History/Finish verdict for missing, duplicated or copied-but-unverified selected results. Mac/iPhone/iPad shared presentation and focused cancellation/terminal tests cover this local slice; a percentage alone is never a success verdict. Future remote presentation and the signed-app fault walkthrough remain separate release gates.
 
 - [ ] **Opt-in crash reports.** Investigate Apple's MetricKit crash/hang diagnostics, off by default, with no third-party service or automatic sending. Existing local diagnostic exports already record phases, cancellations, verification breadcrumbs and memory use; they cannot establish why a process disappeared.