mikecerisano · Oct 17, 2026 · Oct 17, 2026 · Oct 17, 2026
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -4,6 +4,8 @@ All notable changes to this project will be documented in this file.
 
 ## [Unreleased]
 
+- Mac: The menu bar shows the current transfer and its destinations, or the most recent result when idle. Closing the main window during a transfer hides it while the work continues; Open BitMatch brings the same window back. Quit still asks before stopping active work.
+- Expanded transfer details show bytes written and read back for each destination, with separate live rates. These are measurements of active file I/O, not a drive-health or verification verdict.
 - Keep copy and verification failures below 100% in live progress; the engine emits “Complete” only when all selected files pass the chosen mode. The final safety verdict still includes later ASC MHL and report steps.
 - Ignore a disappearing root `.fseventsd` metadata directory during card scans without hiding ordinary files. A regular source file with that name now contributes to the source fingerprint.
 - Bound saved JSON, MHL and adjacent checksum-manifest reads during loading. Damaged, oversized, conflicting or empty adjacent records are reported instead of silently falling back to partial evidence, including when another companion looks valid.

diff --git a/docs/GUIDE.md b/docs/GUIDE.md
@@ -8,11 +8,15 @@ On iPhone and iPad, keep BitMatch open while it works. iOS can interrupt a trans
 
 Notifications say when a card is safe to erase, when something needs you, and when the queue is done. Change them in Settings.
 
+On Mac, the menu bar shows a running transfer's stage and destination status. Close the main window if you need it out of the way; the transfer keeps going. **Open BitMatch** in the menu brings that same window back. Quitting still asks before stopping active work. The idle menu shows the most recent transfer, but open the app to review its full result.
+
+Expand a running transfer to see how much each backup has written and read back. Its live rates measure active file I/O, so use them to spot which part of the work is taking time; they aren't a drive-health test or the final verification result.
+
 ## How Verification Works
 
 Copying a new file and checking it are separate jobs. In the verified modes, BitMatch reads the card, writes each backup, then reads the destination bytes back. A matching checksum is evidence that those bytes matched when they were checked; a copy finishing or a filename appearing isn't enough.
 
-- **Quick** copies and checks sizes. It doesn't verify contents and never marks the card safe to erase.
+- **Quick** copies and checks sizes. It doesn't verify contents, won't reuse a file already at a destination, and never marks the card safe to erase.
 - **Standard** hashes new files while copying and reads every backup back with SHA-256. Existing files are checked against a fresh source read before reuse.
 - **Thorough** also reads the source again, using SHA-256 and MD5 to check for changes during the transfer.
 - **Paranoid** adds a byte-by-byte comparison with the source as well as SHA-256.

diff --git a/docs/TODO.md b/docs/TODO.md
@@ -12,7 +12,7 @@ This is the order to **investigate or start a bounded slice**, not a promise to
 
 The two active reports come first as **casework**, but neither is a ready-to-ship fix: [#23](https://github.com/BitmatchApp/Bitmatch/issues/23) needs the reporter's version/phase or a reproduced memory path, and [#10](https://github.com/BitmatchApp/Bitmatch/issues/10) needs decisive diagnostics or a physical reproduction. Synthetic passes alone cannot close either report.
 
-Unreleased work on `main`: terminal/History presentation, Mac card-event reconciliation, the verification wording audit's first slice, unknown-drive Setup wording, SFTP interruption/stale-evidence checks and the expanded MHL corpus have landed. The engine test runner now executes both test frameworks. First-upload and subprocess-cancellation SFTP fixes remain in draft while their race cases are resolved; the Mac menu bar companion is also still in review. None of this closes the active user reports or replaces the physical and signed-app walkthroughs below.
+Unreleased work on `main`: terminal/History presentation, Mac card-event reconciliation, the verification wording audit's first slice, unknown-drive Setup wording, SFTP interruption/stale-evidence checks, the expanded MHL corpus, the Mac menu bar companion and per-drive I/O detail have landed. The engine test runner now executes both test frameworks. First-upload and subprocess-cancellation SFTP fixes remain in draft while their race cases are resolved; the menu bar and speed display still need a signed-app walkthrough before release. None of this closes the active user reports or replaces the physical checks below.
 
 | Rank | Build or decision work | Usefulness | Difficulty | Blast radius | Shippability |
 | ---: | --- | --- | --- | --- | --- |
@@ -24,8 +24,8 @@ Unreleased work on `main`: terminal/History presentation, Mac card-event reconci
 | 6 | Reconcile missed Mac card events (merged; physical check open) | Medium–high | Low | Low | Quick |
 | 7 | Eliminate the exFAT/FAT publication race | Very high | High | High | Long; protected safety work |
 | 8 | Mark failed readback output unmistakably on disk | High | High | High | After publication ownership |
-| 9 | Mac menu bar companion, first Remote phase | High | Medium | Medium | Scoped |
-| 10 | Per-drive copy/readback speed in expanded details | Medium–high | Medium | Low–medium | Scoped |
+| 9 | Mac menu bar companion (merged; signed-app walkthrough open) | High | Medium | Medium | Scoped |
+| 10 | Per-drive copy/readback speed (merged; signed-app walkthrough open) | Medium–high | Medium | Low–medium | Scoped |
 | 11 | Honest byte-weighted transfer and queue progress | High | High | Medium | After terminal parity |
 | 12 | Local, opt-in crash and hang evidence | Medium–high | Medium | Low–medium | Scoped |
 | 13 | History discovered from connected authorized drives | High | High | Medium | Long |
@@ -136,7 +136,7 @@ October 14 cloud progress: the independent ASC corpus added SHA-1/XXH128 unsuppo
 
 Keep the existing universal iPhone/iPad app's three local modes—Copy & Verify, Check and Master Report—fully functional, including standalone USB-C offloading. Add **Remote Mac** as a fourth mode in that same app, starting with read-only monitoring; choose a host inside Remote rather than adding a host selector to every local screen. Optimize iPad for a persistent DIT-cart control surface and iPhone for compact monitoring. The Mac remains the sole authority for its storage, transfers, verification, queue, journal, reports and safe-to-erase verdicts. Reuse `SharedAppCoordinator`, shared readiness and presentation models; do not create a second transfer engine or simulate UI clicks. Remote hosting remains free and open source on Mac. A **$5.99 lifetime** universal iOS/iPadOS price is a hypothesis to test, not a settled release decision; avoid subscriptions, feature tiers, accounts and an internet requirement, and use TestFlight before release.
 
-- [ ] **Phase 1 — Mac menu bar companion.** Native menu bar presence (investigate `MenuBarExtra`), a stable-width progress ring, copy/verification and per-destination status, recent completion/failure summary, and Open BitMatch. Later show connected clients inside the menu; a lost remote connection is not a transfer failure. Reuse authoritative state with modest update frequency. Keep a normal Mac application, without a helper or daemon. Today's close-window guard asks to stop an active transfer, so define and test a new close-to-hide/continue behavior explicitly. **Acceptance:** transfers continue with the main window hidden or closed; reopening restores the same operation; Quit still retains active-transfer protections. A newly detected card remains reviewable whether the main window or menu bar is in front; the action opens the existing setup rather than maintaining a second pending-card state.
+- [ ] **Phase 1 — Mac menu bar companion.** The first implementation is merged: `MenuBarExtra` shows active stage, progress and per-destination status or the most recent result; closing the main window during a transfer hides it, Open BitMatch restores that window, and Quit retains the transfer guard. Local automated tests cover a transfer completing while hidden and reopening the intended window. Finish a signed-app walkthrough of the menu, window close/reopen, Quit, and a newly detected card before calling this release-ready. Later show connected clients inside the menu; a lost remote connection is not a transfer failure. Keep one normal Mac application, without a helper or daemon.
 - [ ] **Phase 2 — Read-only remote monitoring.** The fourth mobile mode discovers and selects a Mac over Bonjour, then uses an authenticated, encrypted local-network connection over Wi-Fi or wired Ethernet; explicit Mac opt-in, one-time code/QR pairing, persistent device identity, connected-client visibility and revocation. Handle networks that block discovery or device-to-device traffic explicitly. Send an authoritative initial snapshot, bounded/coalesced live updates and paginated/on-demand recent history. **Acceptance:** client disconnection or mobile background suspension never affects Mac work; Mac sleep/quit makes the remote view visibly stale, never falsely complete. Reconnect obtains a fresh snapshot, and host/session identity plus revisions prevent missed or old events from becoming current results. Never infer completion from 100% progress or attach a cached safe verdict to a newly connected card. No unauthenticated control or automatic diagnostic/report uploads; minimize private names and paths, and consider display-only privacy mode.
 - [ ] **Phase 3 — Remote setup, queue and Start.** Display Mac-attached sources, authorized destinations, capacity, availability and the Mac's readiness result. Select, enqueue and start through existing coordinator operations using opaque host-validated storage identities, not raw paths. Any required macOS folder authorization stays on the Mac. **Acceptance:** authenticated commands target the intended host and current operation/queue revision, revalidate source/destination and physical-device identities at execution, and preserve preflight, no-overwrite and independence rules. Stable request IDs make duplicate/delayed Start requests return the existing result rather than create work twice. Disconnected clients cannot submit commands.
 - [ ] **Phase 4 — Operational controls and outcomes.** Add supported pause/resume, retry, queue management and cancellation with explicit confirmation. Show actual engine stages, destination-specific progress, measured throughput/ETA where available, warnings and authoritative final outcomes. Browse recent history without automatically fetching PDFs. **Acceptance:** stale or out-of-order mutations are rejected or safely reconciled; retries preserve the old attempt, and remote controls cannot bypass any Mac safety rule.