docs(roadmap): reconcile root v2 status with native roadmap and Core migration ledger

[qnbs]

Context

WorldScript Studio intentionally has multiple planning/evidence documents with different scopes:

• root ROADMAP.md — high-level product/v2 direction;
• TODO.md — current operational/sprint/human tasks;
• docs/native/ROADMAP-QT-GPUI-DESKTOP.md — binding native renderer strategy/admission gates;
• docs/native/CORE-MIGRATION-LEDGER.md — living capability-by-capability Core authority state;
• focused ADRs/issues — detailed implementation authority.

The current root roadmap contains status wording that can drift behind the living native/Core documents. In particular, broad statements equivalent to Rust Core prerequisite work being “not yet started” are no longer precise once the Core Migration Ledger records multiple CI-proven or in-progress Rust proofs/adapters.

This issue owns documentation truth reconciliation only so roadmap readers do not infer a contradictory execution state.

Goal

Make planning documents form a hierarchy of truth rather than competing roadmaps:

ROOT ROADMAP
  = strategic product direction / milestone summary

NATIVE ROADMAP
  = binding Qt/GPUI admission sequence

CORE MIGRATION LEDGER
  = live capability authority/evidence state

GITHUB ISSUES
  = executable durable work owners

TODO
  = current operational/human checklist

Each higher-level document should link to the lower-level live authority instead of duplicating volatile details unnecessarily.

Required audit

Review at minimum:

• v2.0 Foundation status labels in ROADMAP.md;
• Rust Core wording versus CORE-MIGRATION-LEDGER.md;
• Qt/GPUI wording versus ROADMAP-QT-GPUI-DESKTOP.md;
• Local-First status versus ADR-0008 and local-first: migrate manuscript text to Y.Text and gate the source-of-truth flip #555;
• PWA wording versus pwa(first-class): harden offline reliability, lifecycle, performance, install/update UX & browser-native AI #478 and its subissues;
• security/privacy roadmap wording versus security(truth): consolidate user-visible security/privacy claims across storage, providers, PWA, collaboration & supply chain #549/security(core/R-15): renderer-neutral encrypted desktop storage, durable migration & identity binding #445;
• Local AI/Voice wording versus ai(local): harden Whisper/Kokoro model lifecycle, low-end performance, integrity & Eco-Mode #556;
• accessibility wording versus a11y: establish cross-surface accessibility acceptance matrix for editor, PWA and native renderers #557;
• i18n human-review wording versus i18n: complete native-speaker quality review for the 14 Beta/RTL locale trees #558;
• CI/coverage/bundle wording versus test(ci): expand coverage scope to executable api, workers, and contexts #446/ci(performance): make bundle budgets evidence-based regression budgets #450/ci(efficiency): reduce redundant cost and latency without weakening required quality/security gates #550;
• export parity wording versus export(docx): DOCX export omits characters/worlds/compile-profile and ignores the title toggle #521;
• supply-chain wording versus supply-chain: document trust-policy gaps across Docker/GHCR, Tauri release artifacts, and pnpm dependency provenance #529/chore(security): upstream y-webrtc diff check — vendor fork audit #60;
• TODO items that reference completed/merged predecessor work or stale execution anchors.

Issue/PR-number hygiene

Do not rely on historical shorthand like #NNN = topic without checking the live GitHub object.

Issue and PR numbers share the repository namespace and older planning notes can become misleading if a remembered number actually refers to a merged/closed PR or a different subject.

Where roadmap docs cite a numbered object, verify:

current title
issue vs pull request
open/closed/merged state
actual scope

Prefer descriptive link text plus the number when ambiguity matters.

Status vocabulary

Use a small consistent status vocabulary, for example:

PLANNED
PROOF / SHADOW
IN PROGRESS
ADMISSION GATED
PRODUCTION AUTHORITY
DEFERRED
DONE

Do not call a capability “implemented” merely because a shadow Rust proof exists, and do not call it “not started” when CI-proven migration work already exists.

For Qt/GPUI preserve the binding native-roadmap distinction:

• Qt = primary native target after Core admission gates;
• GPUI = deferred/exploratory, not a current numbered implementation commitment;
• Tauri = transitional until acceptance/retirement gates are met;
• PWA = independent first-class product surface.

TODO relationship

TODO.md may intentionally contain operational or human-only actions that do not deserve durable engineering issues, such as manual release checks or external badge/account registration.

Do not mechanically convert every TODO checkbox into a GitHub issue. Instead, ensure durable architecture/product work points to an issue/roadmap owner and transient operational work remains clearly classified.

Acceptance criteria

• Root roadmap status is consistent with the current native roadmap and Core Migration Ledger.
• Rust Core work is described by actual authority maturity rather than binary started/not-started wording.
• Qt/GPUI/Tauri/PWA strategic roles are consistent across current planning docs.
• Major v2 roadmap bullets link to durable issue owners where execution tracking is appropriate.
• Local-First, Local AI/Voice, accessibility and i18n-human-review roadmap bullets point to their current owners (local-first: migrate manuscript text to Y.Text and gate the source-of-truth flip #555–i18n: complete native-speaker quality review for the 14 Beta/RTL locale trees #558).
• S10/S12 integration work points to security(truth): consolidate user-visible security/privacy claims across storage, providers, PWA, collaboration & supply chain #549/ci(efficiency): reduce redundant cost and latency without weakening required quality/security gates #550.
• Core migration remainders point to core(diagnostics): finish renderer-neutral structured logging authority and sink parity #551–core(project-boundary): finish persisted schema/version verdict and retire observation-only shadow authority #553 where appropriate.
• Accepted filesystem structural debt points to refactor(fs): decompose projectFsStore preservation/recovery orchestration without changing authority semantics #554.
• Numbered GitHub references are verified against their live objects; stale/misattributed references are corrected.
• TODO.md distinguishes durable engineering work from operational/human-only tasks without creating issue spam.
• No documentation edit falsely advances an implementation/authority state.

Non-goals

• implementing any roadmap capability in this docs issue;
• starting Qt or GPUI;
• rewriting all historical handoff/archive documents;
• converting every TODO item into an issue;
• using documentation edits to declare unresolved issues complete;
• creating a second master roadmap that would itself drift.

[qnbs]

Issue-landscape truth reconciliation — 2026-09-05

The live open-issue queue has now been normalized into an explicit priority hierarchy instead of leaving execution priority only in prose.

State correction

The queue initially had 67 open issues. Three S5 design children were stale-open despite merged completion and are now closed completed:

• S5-B1: Canonical Migration Source & Payload Evidence (R-15 child contract) #577 → S5-B1 design admitted via PR docs(core): admit S5-B1 canonical migration source & payload evidence #581
• S5-B2: AuthoritySnapshot Lifetime / Reclamation (R-15 child contract) #578 → S5-B2 design admitted via PR docs(core): admit S5-B2 race-free AuthoritySnapshot acquisition #580
• S5-B3: Chunked Large-Object Envelope (R-15 child contract) #579 → S5-B3 design admitted via PR docs(core): admit S5-B3 chunked large-object envelope #582

PR #584 remains the terminal cross-contract R-15 design audit; #445 remains open because implementation/authority evidence is still outstanding.

Current open-queue priority model

64 open issues are now all assigned exactly one operational priority label:

• P0: 13
• P1: 6
• P2: 26
• P3: 19

No open issue remains without a P0/P1/P2/P3 label.

Meaning: these labels encode current execution priority, not CVSS/severity. A narrow residual can be P0 because the maintainer explicitly scheduled it in the next closure program; a severe-looking architectural concern can remain P1/P2 if it is not the current admitted frontier.

Active sequencing truth

release truth → P0-B #553/#445 R-15 path → P0-C #480/#485/#518/#525/#526/#532/#614 → recompute normal roadmap frontier from live truth.

#478 remains a P2 program umbrella; its children have independent priorities. Provider/informational/contract-ambiguity work such as #606/#607/#611 remains P3. #602 is P1 because its encryption-remanence subfinding is P1 while its other two subfindings remain P2/P3 in the issue's new triage note.

Roadmap/TODO documentation should consume this queue as executable ownership, not duplicate volatile priority prose that can drift again.

[qnbs]

2026-09-11 truth-sync addendum — current sprint / AI owner graph / Core ledger drift

A fresh live read shows this documentation-truth issue is now even more necessary.

1. TODO.md current-sprint header is stale relative to live execution

TODO.md still presents:

Current Sprint — v1.28.6 corrected release cut ... (2026-09-09)
Status: done

while the repository has since moved into substantial AI correctness/testing work (#704, #708–#714) and continuing Core/compatibility work.

The release history should be preserved, but a completed 2026-09-09 release cut should no longer read as the active operational sprint if live execution has moved on.

2. Row-9 wording must be synchronized with the living ledger, not summarized from older TODO text

Current CORE-MIGRATION-LEDGER.md row 9 now records materially more progress than a generic “adapter remains open” statement:

• IMPLEMENTATION_STARTED = YES;
• persisted-version classification + TS/Rust parity implemented;
• first observation-only IDB ingress wired;
• original JSON retained alongside bounded typed projection at canonical parser/import boundary;
• explicit non-destructive LEGACY_TO_V1 in-memory admission primitive;
• persisted-version authority and staged unknown-field policy maintainer-admitted;
• remaining work narrowed to durable source-generation fencing, writer integration, universal ingress/egress and authority switch.

TODO.md should link to this live state rather than duplicate a shorter snapshot that will drift again.

3. Add the current AI execution-owner graph

The durable AI work graph is now:

#704  AI/model/provider umbrella
#708  direct/persistent/stream project authority
#713  Writer/Copilot/deferred apply-later project authority
#714  Stop Generation/cancellation/supersession lifecycle
#709  feature/test coverage authority
#710  deterministic functional AI E2E
#711  default-off Settings/admission/network safety
#712  selected production-bundle functional canaries

The roadmap/TODO/docs should not describe all of this merely as one broad #704 task or leave the new child owners absent.

4. Preserve the authority hierarchy

Please retain this hierarchy from the issue body:

ROADMAP.md
= strategic product direction / milestone summary

docs/native/ROADMAP-QT-GPUI-DESKTOP.md
= binding native admission sequence

docs/native/CORE-MIGRATION-LEDGER.md
= current capability-by-capability Core authority/evidence

GitHub Issues
= durable executable work owners

TODO.md
= current operational/human checklist

Volatile implementation details should be linked downward instead of copied into multiple planning files.

5. Required reconciliation targets for the next #559 implementation slice

Audit at minimum:

• TODO.md current-sprint heading/status and release-cut material;
• root ROADMAP.md AI/model/provider/testing status against ai: requalify current model catalog, defaults and end-to-end AI functionality across all providers #704/ai(project): bind asynchronous image and interview side effects to originating project #708–ai(lifecycle): unify Stop Generation, cancellation, supersession and duplicate-request semantics #714;
• Core/Rust status against the current ledger, especially rows 5, 9 and 10;
• R-15 language against the actual row-10/S5 state at execution time;
• Qt/GPUI/Tauri/PWA role wording against the binding native roadmap;
• test(feature-flags): establish exhaustive coverage authority and prevent opt-in E2E blind spots #709–test(prod-e2e): add risk-based functional canaries against the built production bundle #712 testing-governance layers so “covered/tested” claims distinguish dev E2E, admission E2E, production canaries and advisory deep evidence;
• stale issue/PR references and completed predecessor anchors;
• TODO.md items that now have durable issue owners and therefore should link rather than restate changing acceptance detail.

6. Anti-drift requirement

Where a status can be read from a living authority, prefer wording such as:

See #553 / Core Migration Ledger row 9 for current implementation state.

instead of copying exact slice counts/temporary gate values into TODO.md or root roadmap.

7. Do not falsely advance maturity

This addendum does not authorize declaring unfinished work complete:

• core(project-boundary): finish persisted schema/version verdict and retire observation-only shadow authority #553 remains open until its actual acceptance gates close;
• ai(project): bind asynchronous image and interview side effects to originating project #708/ai(project): bind Writer, Copilot and deferred AI results to originating project incarnation #713 are source-correctness owners;
• ai(lifecycle): unify Stop Generation, cancellation, supersession and duplicate-request semantics #714 is lifecycle convergence, not a substitute for project authority;
• test(feature-flags): establish exhaustive coverage authority and prevent opt-in E2E blind spots #709–test(prod-e2e): add risk-based functional canaries against the built production bundle #712 are evidence/governance layers, not proof that source defects are already fixed;
• Qt/GPUI work remains governed by the native roadmap/admission gates.

The objective is documentation truth, not optimistic status inflation.

[qnbs]

2026-09-11 truth-sync addendum — Export, DuckDB and Compute Shaders

The follow-up issue-landscape audit added three durable owners that should be reflected in the next roadmap/TODO/feature-parity reconciliation:

• export(formats): establish cross-format parity and artifact-level qualification for PDF, EPUB and compile outputs #715 — Export/Compile cross-format parity + artifact qualification for PDF/EPUB, with export(docx): DOCX export omits characters/worlds/compile-profile and ignores the title toggle #521 remaining the concrete DOCX parity bug owner. Current repository search finds no KPF/Kindle export implementation/product claim; do not invent one in roadmap prose.
• analytics(duckdb): requalify default-on DuckDB-WASM runtime, privacy, persistence and recovery semantics #716 — default-on DuckDB-WASM runtime/privacy/persistence/recovery hardening.
• perf(webgpu): reconcile enableComputeShaders with reachable production GPU paths and truthful fallback/coverage #717 — default-on Compute Shaders/WebGPU reachability, fallback and truth reconciliation.

docs/FEATURE-PARITY.md is demonstrably stale

The current document should not be treated as live authority until reconciled. At minimum:

1. It still states 23 flags / 7 opt-in default-off and omits enableRustCompute from that default-off count; the current slice has eight default-off flags.
2. It still contains an enableWebnnInference row although that flag is no longer present in the current FeatureFlagsState.
3. It labels enableComputeShaders 🟢 OK and describes computeShaderFactory.ts / localRagService.ts / useAdaptiveAi as a complete runtime gate. Current source review does not support that conclusion: useAdaptiveAi currently exposes the boolean, while the actual RAG custom-GPU path requires retrieveContext(..., useGpuSimilarity=true) and inspected production callers leave that final argument at its default false.
4. features/featureCatalog.ts currently lists nonexistent services/ai/computeShaderService.ts under Compute Shaders, another direct truth-drift signal owned by perf(webgpu): reconcile enableComputeShaders with reachable production GPU paths and truthful fallback/coverage #717.

Reconcile these against live source and #709 rather than manually updating only counts. The desired hierarchy remains:

featureFlagsSlice / live source
→ FEATURE_CATALOG production truth
→ #709 test-coverage disposition
→ docs/FEATURE-PARITY explanatory view

Documentation must not advance DuckDB/ComputeShader qualification ahead of #716/#717 evidence.

[qnbs]

2026-09-11 queue-truth refresh — 81 open issues, all priority-classified

Fresh live GitHub search after the current audit/curation run supersedes the older queue-count snapshot in this thread.

Current issue-only queue

open Issues: 81
P0: 12
P1: 14
P2: 33
P3: 22
unclassified by P0/P1/P2/P3: 0

The audit snapshot that reported 82 open issues was already stale by one issue at re-fetch time. The P0 count of 12 is confirmed live.

#711 had been the sole open issue without an operational priority label; it is now classified P1, consistent with its default-off Settings/network/privacy admission contract and its place beside #709/#710.

As established earlier in this thread, these labels encode execution priority, not CVSS/severity. Do not mechanically promote/demote an issue merely because an audit uses P0/P1 as a severity adjective.

Current in-flight exception / execution frontier

The active source-correctness incident is the #718 → #708/#713 convergence. Treat the immediate chain as:

#708 direct/persistent/stream project authority
+
#713 Writer/Copilot/deferred authority
        ↓
#714 request lifecycle / cancellation / supersession
        ↓
#709 coverage authority foundation

This is an in-flight data-integrity frontier and may temporarily preempt older queued P0 programme work; it does not mean relabel every AI child P0 or erase the existing P0-B/P0-C programme.

After that source/lifecycle/testing admission point, re-read the live P0 queue and the Core/PWA owner state rather than relying on this static sequence.

Documentation owner routing from the latest audit

• stale TODO.md "Current Sprint — v1.28.6 corrected release cut" remains a docs(roadmap): reconcile root v2 status with native roadmap and Core migration ledger #559 documentation-truth item already recorded in the prior addendum;
• stale .github/SECURITY.md supported-version language (main (v1.27.0)) is now explicitly carried by security(truth): consolidate user-visible security/privacy claims across storage, providers, PWA, collaboration & supply chain #549, not duplicated here;
• release-source/SAST/signing evidence is refined under release(native): establish platform code signing, notarization, artifact identity & rollback trust #574;
• Tauri parity / v1.28.5 incident learnings are already reconciled under toolchain(tauri): align JS/CLI/Rust Tauri 2.x versions and establish a bounded transitional update policy #573;
• core(project-boundary): finish persisted schema/version verdict and retire observation-only shadow authority #553 already contains real ingress/admission implementation evidence and remains the gate before security(core/R-15): renderer-neutral encrypted desktop storage, durable migration & identity binding #445/R-15 authority can advance.

P2 execution order already admitted elsewhere

Do not let docs accidentally imply #715/#716/#717 are the current frontier. Their current bounded order remains:

#716 DuckDB runtime/privacy/persistence
→ #717 ComputeShaders reachability/truth
→ #715 export parity/artifact qualification

only after the required P1 predecessors / #709 foundation.

Anti-drift rule

Do not put the 81 / 12 / 14 / 33 / 22 numbers into durable roadmap prose unless explicitly marked as a dated snapshot. Prefer links to live GitHub labels/owners; this comment is evidence of why copied queue counts age quickly.

[qnbs]

2026-09-11 doc-truth finding — IDB encryption TODO text is stale in the opposite direction

A live re-audit against current source/docs found another concrete roadmap/TODO drift.

Current docs/IDB-ENCRYPTION.md states the browser/IDB encryption lifecycle is now materially implemented:

• journal-backed disable;
• journal-backed passphrase rotation;
• cross-tab protected-write admission;
• interrupted-migration recovery via EncryptionRecoveryModal / resumeEncryptionMigration();
• fail-closed locked writes.

However current TODO/history-facing text still contains an older 2026-08-11 status saying disable, forgot-passphrase deletion and passphrase rotation are intentionally blocked until conversion/verification/cross-tab recovery/recovery UX exist.

That sentence is now stale and can send a future session back into already-landed Phase-4 work.

Required reconciliation under #559

Update only current/live planning truth; do not rewrite historical handoff/archive evidence merely because it reflects its own date correctly.

Current operational documentation should distinguish:

LANDED
- normal IDB disable/rekey migration
- durable journal/checkpoints
- protected-write admission
- interrupted migration resume UX

REMAINING
- explicit test disposition / missing Playwright lifecycle journey (#709)
- terminal `recovery-required` preserve-first/manual recovery owner (#722)
- DuckDB/OPFS residual truth (#716 / current security owner as applicable)
- Tauri filesystem/native R-15 encryption remains separate and open (#445/#359)

Do not collapse browser IDB lifecycle completion into a claim that desktop project files are encrypted.

This is exactly the hierarchy-of-truth problem #559 already owns: current TODO/roadmap status must follow current source + dedicated docs/issues, while dated archive documents remain historical evidence.

[qnbs]

2026-09-16 roadmap-truth checkpoint — AI umbrella terminal, dedicated owners now authoritative

The 2026-09-11 addendum correctly captured the then-current AI graph, but it is now stale in two important ways: #704 and #708 have become terminal historical authorities, and several dedicated runtime/qualification owners now carry the remaining work.

For future ROADMAP/TODO/native-roadmap reconciliation, use this current graph rather than describing the programme as one continuing #704 task:

TERMINAL / HISTORICAL AUTHORITY
#704 = completed cloud model/provider umbrella lineage
#708 = completed predecessor direct-authority owner
#719 = terminal project-qualified image/storage foundation
#734 = terminal direct Character/World/Scene + Interview project authority
#718 = closed as superseded; historical evidence only

CURRENT EXECUTABLE OWNERS
#709 = exhaustive feature/test coverage authority
#710 = deterministic AI product E2E
#711 = Settings/default-off admission/network safety
#713 = deferred/apply-later project authority
#714 = cancellation/supersession/request lifecycle
#729 = Claude structured outputs runtime implementation
#731 = Claude budgets/timeouts + genuine streaming
#732 = provider usage/token accounting
#556 = Local-AI/Voice lifecycle/integrity/resources
#743 = v1.28.7 AI/local-AI release qualification gate

Planning/refactor maturity must remain truthful

• docs(proforge): plan real token accounting for the Claude path #727/docs(proforge): plan Claude max_tokens/timeout right-sizing #728/feat(proforge): plan Claude structured-outputs wiring #730 are now merged planning/evidence PRs only. ROADMAP/TODO must not mark structured outputs, larger Claude budgets/real SSE, or provider usage telemetry implemented merely because those docs landed.
• refactor(ai): extract provider request lifecycle #748/refactor(ai): extract provider adapters #759/refactor(ai): extract connection-diagnostics and local-model-discovery #761 are Strangler-pattern architecture extractions. They reduce monolith/ownership risk but do not by themselves advance user-facing provider/runtime qualification.
• refactor(ai): decompose ai provider service #747 remains frozen draft/reference only; do not present its XXL decomposition as an implementation still intended to merge wholesale.
• release(ai): gate v1.28.7 on curated local-model and runtime qualification #743 remains OPEN / NOT PASS. v1.28.7-facing roadmap language must not imply release readiness until its real local-runtime and lifecycle gates are terminal.

New developer-toolchain truth owner

#762 now owns the Node support-range mismatch introduced by the merged jsdom 30 upgrade. Public/developer roadmap/setup prose should consume #762/#724 once the intentional Node contract is resolved rather than hard-coding the currently stale >=22.19.0 promise.

Anti-drift rule

Prefer durable statements such as:

See #743 and its current owner map for v1.28.7 AI/local-runtime readiness.
See #713/#714/#729/#731/#732 for remaining AI runtime contracts.

rather than copying today's exact PR/commit progress into ROADMAP/TODO. Historical completed work may remain in changelog/archive material, but active-status headings must point to live owners.

This is a documentation-truth update only; it does not itself advance any implementation maturity.

[qnbs]

Current planning-truth drift — TODO “Current Sprint” is no longer current — 2026-09-16

Revalidated against current main 4137286887275ca03aa5b75906e6b529c68c786c.

TODO.md still opens with:

## Current Sprint — v1.28.6 corrected release cut: Tauri desktop release-build recovery (2026-09-09)
> Status: ✅ done.

That section is now historical rather than the repository's actual active programme. Since 2026-09-09, the repository has executed a large post-release AI/data-integrity/tooling programme (#706–#761 lineage), while the actual next-release authority is now the explicit v1.28.7 AI/local-AI release gate #743.

Required reconciliation under #559

Do not append another giant hand-maintained chronology to the top of TODO.md. Instead make the document's hierarchy truthful and lower-drift:

CURRENT ACTIVE PROGRAMME
  → #743 v1.28.7 release gate
  → current executable owners (#713/#714/#729/#731/#732/#709/#710/#711 as applicable)
  → current toolchain/release blockers (#749/#762/#763 etc. as applicable)

LATEST SHIPPED RELEASE
  → v1.28.6, terminal historical release record

LONG-LIVED NATIVE/CORE PROGRAMME
  → native roadmap + Core Migration Ledger

Move/rename the completed v1.28.6 “Current Sprint” block so it is clearly archived/last-release provenance rather than active execution truth.

Prefer links to durable GitHub owners and short state summaries over duplicating every PR number into TODO. The recent #706–#761 chain should be summarized by terminal/current owners, not reconstructed as a second CHANGELOG.

Current owner-map corrections to preserve

• ai: requalify current model catalog, defaults and end-to-end AI functionality across all providers #704 is terminal historical umbrella evidence, not the active implementation owner.
• release(ai): gate v1.28.7 on curated local-model and runtime qualification #743 is the current v1.28.7 qualification/release gate.
• ai(project): bind Writer, Copilot and deferred AI results to originating project incarnation #713 = deferred/apply-later project-incarnation authority.
• ai(lifecycle): unify Stop Generation, cancellation, supersession and duplicate-request semantics #714 = request lifecycle/cancellation/supersession + current partial-stream fallback blocker.
• ai(proforge): use native Claude structured outputs for schema-bound pipeline stages #729/ai(claude): right-size ProForge response budgets and implement real end-to-end streaming #731/ai(proforge): replace character-count token metrics with provider usage telemetry #732 = ProForge/Claude runtime implementation owners; merged feat(proforge): plan Claude structured-outputs wiring #730/docs(proforge): plan Claude max_tokens/timeout right-sizing #728/docs(proforge): plan real token accounting for the Claude path #727 are planning authority only.
• refactor(ai): decompose ai provider service #747 is stale reference-only and should not appear as an active implementation branch after its residuals are reconciled.

This is exactly the drift class #559 exists to prevent: a document labeled “Current Sprint” must not remain anchored to a completed release while GitHub issues carry the actual active programme.

[qnbs]

Current planning-truth drift — TODO sprint anchor is still v1.28.6 while execution is under #743 — 2026-09-16

The current-main audit found a concrete operational-doc drift that belongs to this roadmap/TODO truth owner.

TODO.md's prominent Current Sprint framing still points at the older v1.28.6 / 2026-09-09 execution context, while the repository has since landed the #706–#761 AI/provider/data-integrity/tooling sequence and is now explicitly operating under the v1.28.7 pre-release gate #743.

Do not solve this by turning TODO into a chronological list of every merged PR. The correction should instead restore the hierarchy already defined by this issue:

TODO = current operational/human execution context
GitHub issues = durable implementation owners
#743 = current v1.28.7 AI/Local-AI release gate
ROADMAP/native docs = longer-term authority
historical sprint/audit docs = provenance only

Required reconciliation in the next bounded docs pass

• update/remove the stale v1.28.6 Current Sprint anchor;
• point current release work to release(ai): gate v1.28.7 on curated local-model and runtime qualification #743 and its live owner graph rather than duplicating rapidly changing subtask prose;
• mark terminal predecessors as terminal/superseded where TODO still presents them as future work;
• preserve genuinely outstanding human/manual release actions;
• avoid copying all fix(ai): close cloud-AI policy bypass in generateJson/generateImage/streamAiHelpResponse #706–fix(project): reject stale AI generations in Writer, Global Copilot, and Dashboard after a project switch #769 history into TODO just to make it look current;
• re-fetch the live issue/PR state immediately before editing because ai(project): bind Writer, Copilot and deferred AI results to originating project incarnation #713/ai(lifecycle): unify Stop Generation, cancellation, supersession and duplicate-request semantics #714 and the release(ai): gate v1.28.7 on curated local-model and runtime qualification #743 graph are actively moving.

This is documentation/planning truth only. Do not use the TODO edit to close #743 or any implementation owner.