[mikecerisano]

Large destination verification reads retained temporary buffers on macOS. Put each read and hash inside an autorelease pool, keeping memory bounded by chunks rather than file size. Add privacy-safe memory, numbered-file, destination and verification outcome diagnostics, plus an optional worker-count override for investigation. Source identity checks, uncached destination readback, no-overwrite publication and fail-closed verdicts remain intact.

Prepares 0.2.4 (build 14). Issue #10 remains open: this fixes a reproduced memory defect, but does not establish why the reporter's process stopped.

Validation:

• Final engine suite: 110 XCTest (15 opt-in skips), 127 Swift Testing (3 opt-in skips), zero failures; opt-in stress cases run separately.
• Two overlapping 45 GB pinned readers: correct digests, footprint 16–20 MiB. Removing the pool reproduced memory growth in the smaller regression.
• Real exFAT→HFS+ transfer matrix, serial and concurrent verification; separate ASan and TSan checks passed.
• Signed/notarized universal Mac archive and iPhone/iPad Release simulator build passed.
• Final signed-app Standard transfer to exFAT and HFS+: independent hashes, unchanged source, ASC MHL and reports passed; Eject and relaunch passed.
• A Mac-added AppleDouble/quarantine metadata conflict correctly refused reuse and remained unsafe. Preserved as follow-up evidence, not bypassed.

Limit: full Mac app tests built but the test host stalled in dyld before app code; those tests are not claimed green. Local engine checks and the signed-app walkthrough provide the validation here. Sparse synthetic stress files do not reproduce the reporter's physical dock/HDD or camera media.