Update roadmap and release notes for merged reliability fixes

CHANGELOG.md

@@ -7,6 +7,10 @@ All notable changes to this project will be documented in this file.
 - Mac: The menu bar shows the current transfer and its destinations, or the most recent result when idle. The idle icon is a small copy-and-check mark. Closing the main window during a transfer hides it while the work continues; Open BitMatch brings the same window back. Quit still asks before stopping active work.
 - Expanded transfer details show bytes written and read back for each destination, with separate live rates. These are measurements of active file I/O, not a drive-health or verification verdict.
 - Optional local Apple crash and hang summaries can be added to a diagnostics export. This is off by default, never uploaded by BitMatch, and Apple may not deliver a report.
+- Remote backups now claim a new filename before upload and recover only files BitMatch can still identify as its own. Existing remote files are left alone; unsupported server setups stop with an issue.
+- Cancelling a remote backup now stops the SSH work it started, including child processes.
+- Camera hints skip oversized XML metadata instead of loading it all into memory. This does not change the transfer file list.
+- The finish screen describes the checks actually performed and acknowledges files that did verify even when the transfer as a whole needs attention.
 - Keep copy and verification failures below 100% in live progress; the engine emits “Complete” only when all selected files pass the chosen mode. The final safety verdict still includes later ASC MHL and report steps.
 - Ignore a disappearing root `.fseventsd` metadata directory during card scans without hiding ordinary files. A regular source file with that name now contributes to the source fingerprint.
 - Bound saved JSON, MHL and adjacent checksum-manifest reads during loading. Damaged, oversized, conflicting or empty adjacent records are reported instead of silently falling back to partial evidence, including when another companion looks valid.

docs/TODO.md

@@ -12,22 +12,22 @@ This is the order to **investigate or start a bounded slice**, not a promise to
 
 The two active reports come first as **casework**, but neither is a ready-to-ship fix: [#23](https://github.com/BitmatchApp/Bitmatch/issues/23) needs the reporter's version/phase or a reproduced memory path, and [#10](https://github.com/BitmatchApp/Bitmatch/issues/10) needs decisive diagnostics or a physical reproduction. Synthetic passes alone cannot close either report.
 
-Unreleased work on `main`: terminal/History presentation, Mac card-event reconciliation, the verification wording audit's first slice, unknown-drive Setup wording, SFTP interruption/stale-evidence checks, the expanded MHL corpus, the Mac menu bar companion and per-drive I/O detail have landed. The engine test runner now executes both test frameworks. First-upload and subprocess-cancellation SFTP fixes remain in draft while their race cases are resolved; the menu bar and speed display still need a signed-app walkthrough before release. None of this closes the active user reports or replaces the physical checks below.
+Unreleased work on `main`: terminal/History presentation, Mac card-event reconciliation, the verification wording audit's first slice, unknown-drive Setup wording, the expanded MHL corpus, the Mac menu bar companion and per-drive I/O detail have landed. SFTP first-upload and subprocess-cancellation fixes, a compact menu bar icon, bounded camera XML reads, finish-screen wording and opt-in local crash evidence have also merged. The engine test runner now executes both test frameworks. The menu bar and speed display still need a signed-app walkthrough, and crash evidence needs signed-app and device checks before release. None of this closes the active user reports or replaces the physical checks below.
 
 | Rank | Build or decision work | Usefulness | Difficulty | Blast radius | Shippability |
 | ---: | --- | --- | --- | --- | --- |
 | 1 | Terminal progress and outcome parity (merged; signed-app release check open) | High | Low–medium | Medium | Quick |
 | 2 | Verification coverage and wording audit (first mode/fault slice merged; wider audit open) | High | Medium | Medium | Scoped |
 | 3 | Honest claims when physical drive identity is unknown (Setup note merged; verdict decision open) | High | Medium | Medium | Scoped |
-| 4 | Distinguish local-source, local-backup and SFTP assurance (evidence tests merged; upload edge cases open) | High | Low–medium | Low–medium | Quick |
+| 4 | Distinguish local-source, local-backup and SFTP assurance (upload guards merged; broader assurance audit open) | High | Low–medium | Low–medium | Quick |
 | 5 | Expand the MHL interoperability corpus (rename/move fixture merged; classic interop open) | High | Medium | Low | Scoped |
 | 6 | Reconcile missed Mac card events (merged; physical check open) | Medium–high | Low | Low | Quick |
 | 7 | Eliminate the exFAT/FAT publication race | Very high | High | High | Long; protected safety work |
 | 8 | Mark failed readback output unmistakably on disk | High | High | High | After publication ownership |
-| 9 | Mac menu bar companion (merged; signed-app walkthrough open) | High | Medium | Medium | Scoped |
+| 9 | Mac menu bar companion and icon (merged; signed-app walkthrough open) | High | Medium | Medium | Scoped |
 | 10 | Per-drive copy/readback speed (merged; signed-app walkthrough open) | Medium–high | Medium | Low–medium | Scoped |
 | 11 | Honest byte-weighted transfer and queue progress | High | High | Medium | After terminal parity |
-| 12 | Local, opt-in crash and hang evidence | Medium–high | Medium | Low–medium | Scoped |
+| 12 | Local, opt-in crash and hang evidence (merged; signed-app and device checks open) | Medium–high | Medium | Low–medium | Scoped |
 | 13 | History discovered from connected authorized drives | High | High | Medium | Long |
 | 14 | Investigate a macOS 15.0 minimum | Medium | Low–medium | Medium | Scoped; older OS test |
 | 15 | Portable settings and workflow import/export | Medium | Medium | Medium | Scoped |
@@ -92,7 +92,7 @@ The priority buckets are not a strict implementation sequence: investigate P0 re
 
 - [ ] **Verification coverage and default-policy audit.** Standard is the fresh-install default; a previously saved mode stays selected. Setup, History and PDF/CSV/JSON wording have been aligned with recorded checks, and Compare has its own check-plan wording. Still map Quick, Standard, Thorough and Paranoid to copy-stream source hashing, independent source rereads, destination readback, byte comparison, source-change checks, ASC MHL/report evidence and the actual safe-to-erase verdict. Include a one-time transient source misread and a repeatably wrong read: a second read can catch differing bytes, but cannot prove the original camera bytes or detect every stable fault. Treat the recommended default as a product choice informed by safety, user workflows and measured time; it may move up or down the assurance ladder, but every verdict must name the checks actually performed and the selected-file scope. **Acceptance:** finish-screen, README and Guide mode claims need a final check against the engine and fault-injection tests; Quick and intentionally excluded-file transfers stay unsafe; injected source and destination faults produce honest outcomes. Any default change has explicit behavior for fresh versus saved preferences, release notes and Mac/iPad/iPhone validation.
 
-- [ ] **Separate local-source and remote-destination assurance.** A local source can be independently re-read before a later SFTP upload; the current Mac SFTP queue uploads an already verified local backup, not the card. Its SHA-256 readback downloads the remote file, while upload-only remains **Uploaded · Unverified**. The screen and report labels landed in #26; contract, interruption and stale-local-evidence tests have since landed. Keep local source reread, local backup verification, remote upload and remote readback as distinct facts in diagnostics and future changes. Do not infer source assurance from a remote readback or deny source assurance merely because a later destination is remote. **Acceptance:** no remote result becomes a whole-card safe verdict without the required local checks; the first-upload and child-cancellation drafts must also pass adversarial and live-server tests before merging. Apply the same evidence separation to any future cloud provider, with Mac-only SFTP scope explicit on iPad/iPhone.
+- [ ] **Separate local-source and remote-destination assurance.** A local source can be independently re-read before a later SFTP upload; the current Mac SFTP queue uploads an already verified local backup, not the card. Its SHA-256 readback downloads the remote file, while upload-only remains **Uploaded · Unverified**. The screen and report labels landed in #26. First-upload exclusivity and subprocess-group cancellation landed in #35/#36 after adversarial and localhost tests; broader server and filesystem compatibility remains unproven. Keep local source reread, local backup verification, remote upload and remote readback as distinct facts in diagnostics and future changes. Do not infer source assurance from a remote readback or deny source assurance merely because a later destination is remote. **Acceptance:** no remote result becomes a whole-card safe verdict without the required local checks; unsupported server setups fail closed, and broader support requires representative server tests. Apply the same evidence separation to any future cloud provider, with Mac-only SFTP scope explicit on iPad/iPhone.
 
 - [ ] **Storage-aware verification scheduling.** Replace the CPU-derived default with scheduling informed by physical storage identity and measured behavior. Avoid competing large sequential reads on one HDD; permit useful concurrency across independent SSD/NVMe devices. Account for shared devices and buses only where reliably identifiable. Preserve diagnostic worker-count overrides and benchmark actual throughput and memory use on physical hardware, including the two-drive test below. **Acceptance:** independent destination readback remains complete, cancellation still stops the run, and unknown topology gets a conservative policy rather than invented independence.
 
@@ -114,7 +114,7 @@ The priority buckets are not a strict implementation sequence: investigate P0 re
 
 - [x] **Finish local terminal progress/outcome parity.** The engine withholds `.completed` and 100% when selected rows fail. The merged local slice adds an active Finishing state while MHL/report/journal evidence settles, keeps cancelled and unexpectedly interrupted wording distinct, and refuses a safe History/Finish verdict for missing, duplicated or copied-but-unverified selected results. Mac/iPhone/iPad shared presentation and focused cancellation/terminal tests cover this local slice; a percentage alone is never a success verdict. Future remote presentation and the signed-app fault walkthrough remain separate release gates.
 
-- [ ] **Opt-in crash reports.** A first bounded MetricKit summary is being validated: off by default on Mac/iPhone/iPad, local only, a small allowlisted export, deletion on opt-out and no automatic sending. It may arrive later or never; it cannot establish every cause of process disappearance, including an OS memory kill or force quit. Developer ID delivery is unproven: before treating this as released, validate a signed/notarized Mac delivery, physical iPhone/iPad behavior and the Settings/export walkthrough. This does not close #10 or #23. Existing transfer diagnostics still record phases, cancellations, verification breadcrumbs and memory use; neither source alone proves why a process disappeared.
+- [ ] **Opt-in crash reports.** The first bounded MetricKit summary is merged: off by default on Mac/iPhone/iPad, local only, a small allowlisted export, deletion on opt-out and no automatic sending. It may arrive later or never; it cannot establish every cause of process disappearance, including an OS memory kill or force quit. Developer ID delivery is unproven: before treating this as released, validate a signed/notarized Mac delivery, physical iPhone/iPad behavior and the Settings/export walkthrough. This does not close #10 or #23. Existing transfer diagnostics still record phases, cancellations, verification breadcrumbs and memory use; neither source alone proves why a process disappeared.
 
 ## P2 — Evidence and interoperability
 
@@ -136,7 +136,7 @@ October 14 cloud progress: the independent ASC corpus added SHA-1/XXH128 unsuppo
 
 Keep the existing universal iPhone/iPad app's three local modes—Copy & Verify, Check and Master Report—fully functional, including standalone USB-C offloading. Add **Remote Mac** as a fourth mode in that same app, starting with read-only monitoring; choose a host inside Remote rather than adding a host selector to every local screen. Optimize iPad for a persistent DIT-cart control surface and iPhone for compact monitoring. The Mac remains the sole authority for its storage, transfers, verification, queue, journal, reports and safe-to-erase verdicts. Reuse `SharedAppCoordinator`, shared readiness and presentation models; do not create a second transfer engine or simulate UI clicks. Remote hosting remains free and open source on Mac. A **$5.99 lifetime** universal iOS/iPadOS price is a hypothesis to test, not a settled release decision; avoid subscriptions, feature tiers, accounts and an internet requirement, and use TestFlight before release.
 
-- [ ] **Phase 1 — Mac menu bar companion.** The first implementation is merged: `MenuBarExtra` shows active stage, progress and per-destination status or the most recent result; closing the main window during a transfer hides it, Open BitMatch restores that window, and Quit retains the transfer guard. Local automated tests cover a transfer completing while hidden and reopening the intended window. Finish a signed-app walkthrough of the menu, window close/reopen, Quit, and a newly detected card before calling this release-ready. Later show connected clients inside the menu; a lost remote connection is not a transfer failure. Keep one normal Mac application, without a helper or daemon.
+- [ ] **Phase 1 — Mac menu bar companion.** The first implementation and compact copy-and-check icon are merged: `MenuBarExtra` shows active stage, progress and per-destination status or the most recent result; closing the main window during a transfer hides it, Open BitMatch restores that window, and Quit retains the transfer guard. Local automated tests cover a transfer completing while hidden and reopening the intended window. Finish a signed-app walkthrough of the menu and icon, window close/reopen, Quit, and a newly detected card before calling this release-ready. Later show connected clients inside the menu; a lost remote connection is not a transfer failure. Keep one normal Mac application, without a helper or daemon.
 - [ ] **Phase 2 — Read-only remote monitoring.** The fourth mobile mode discovers and selects a Mac over Bonjour, then uses an authenticated, encrypted local-network connection over Wi-Fi or wired Ethernet; explicit Mac opt-in, one-time code/QR pairing, persistent device identity, connected-client visibility and revocation. Handle networks that block discovery or device-to-device traffic explicitly. Send an authoritative initial snapshot, bounded/coalesced live updates and paginated/on-demand recent history. **Acceptance:** client disconnection or mobile background suspension never affects Mac work; Mac sleep/quit makes the remote view visibly stale, never falsely complete. Reconnect obtains a fresh snapshot, and host/session identity plus revisions prevent missed or old events from becoming current results. Never infer completion from 100% progress or attach a cached safe verdict to a newly connected card. No unauthenticated control or automatic diagnostic/report uploads; minimize private names and paths, and consider display-only privacy mode.
 - [ ] **Phase 3 — Remote setup, queue and Start.** Display Mac-attached sources, authorized destinations, capacity, availability and the Mac's readiness result. Select, enqueue and start through existing coordinator operations using opaque host-validated storage identities, not raw paths. Any required macOS folder authorization stays on the Mac. **Acceptance:** authenticated commands target the intended host and current operation/queue revision, revalidate source/destination and physical-device identities at execution, and preserve preflight, no-overwrite and independence rules. Stable request IDs make duplicate/delayed Start requests return the existing result rather than create work twice. Disconnected clients cannot submit commands.
 - [ ] **Phase 4 — Operational controls and outcomes.** Add supported pause/resume, retry, queue management and cancellation with explicit confirmation. Show actual engine stages, destination-specific progress, measured throughput/ETA where available, warnings and authoritative final outcomes. Browse recent history without automatically fetching PDFs. **Acceptance:** stale or out-of-order mutations are rejected or safely reconciled; retries preserve the old attempt, and remote controls cannot bypass any Mac safety rule.
@@ -185,7 +185,7 @@ These remain ongoing gates, not optional features. Use disposable data and retai
 
 ## Developer chores
 
-- [ ] **Tests without permission prompts.** Investigate drive-access prompts that stall Mac tests; prefer owned temporary fixtures and scoped test configuration without weakening release entitlements. The documented DerivedData-outside-Desktop workaround addresses a separate loader stall.
+- [ ] **Tests without permission prompts.** Investigate drive-access prompts that stall Mac tests; prefer owned temporary fixtures and scoped test configuration without weakening release entitlements. The documented DerivedData-outside-Desktop workaround addresses a separate loader stall. A separate close-window test-host crash was fixed in #46; that fix does not settle the permission-prompt audit.
 - [ ] **Buffer benchmark first run.** Source creation and timed reads now request `F_NOCACHE`, including the first run. That request does not prove physical I/O: confirm drive read counters or cold/warm behavior on the selected hardware before using the numbers for a buffer or verification-policy decision.
 - [x] **Reverse flight on Edit.** Mac Edit carries the queued card back to setup, respecting Reduce Motion. Compact mobile Edit dismisses the queue sheet. Settings, operator and notes remain snapshotted.