docs: sync STATUS / ROADMAP with three weeks of stealth-shipped work

The 2026-05-30 sync commit (fa659eb) only covered the vault-tab
management surfaces revamp. It missed three earlier merges that landed
2026-05-02..05-03 and have been on main since:

- Phase 2B polish foundation + form layout (5da1e52, 2026-05-02)
- v0.5.1 Stream A — 3-column vault layout + bottom sheet + toast +
  GLYPH_VAULT_TAB + emoji sweep (c16adc4, 2026-05-03)
- v0.5.1 Stream B — left-nav settings (Autofill / Display / Security /
  Generator / Retention / Backup / Import) (bd6a301, 2026-05-03)
- v0.5.1 Stream C — Recovery QR end-to-end (core + WASM + CLI +
  settings-security.ts + setup wizard banner) + setup wizard Style C
  redesign (934dfe0, 2026-05-03)

Also missing: 1C-γ (attachments + Document type + device registration
+ trash + history), Plan B multi-stream refactor (Cycles 1+2), and
the in-flight doc-structure redesign Tasks 1-4 (commits 36a59cd..bae3f7c
since spec 3209bfb).

STATUS now lists each train with merge SHA, spec/plan pointers, and
per-feature bullets. ROADMAP's "Up next" / "Medium-term" / "Long-term"
sections retrimmed: the only genuinely outstanding work is doc-structure
Task 5 verification, the lock-screen logo, the v0.5.x tag, and the
three 2026-05-04 architecture-review specs (CLI restructure, extension
restructure, security polish — none have plans yet).

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

ROADMAP.md

@@ -7,52 +7,38 @@
 
 | Version | Highlights |
 |---|---|
-| v0.5.0 train *(on main, untagged)* | Security audit fixes, device auth, backup/restore, LastPass import, fullscreen UX phases 1+2A, vault-tab management surfaces revamp |
+| v0.5.x train *(on main, untagged — tag pending)* | Security audit fixes; device authentication; backup/restore + LastPass import; fullscreen UX Phases 1+2A+2B; v0.5.1 Streams A/B/C (3-column vault layout + bottom-sheet picker + toast system; left-nav settings; Recovery QR end-to-end + setup wizard Style C); 1C-γ (attachments + Document type + device registration + trash + field history); Plan B multi-stream refactor (commands/ split, prompt_or_flag, core/WASM seam); vault-tab management surfaces revamp (settings synced/local split, devices fingerprint, trash purge countdown, field-history polish, item-history-index, `#history/<id>` routing); doc-structure redesign (rename to DESIGN/CRYPTO/docs/FORMATS, scope headers + Next: footers) |
 | v0.2.0 | Last tagged release — typed-item rewrite (Plans 1A/1B/1C-α/β₁/β₂) |
 
-Also shipped on main since the v0.5.0 version bump:
+See `CHANGELOG.md` for tagged-release detail and `STATUS.md` for the per-train commit list.
 
-- **Vault-tab management surfaces revamp** (2026-05-24 → 2026-05-30) — settings synced/local split with session-timeout UI, devices fingerprint + inline two-step revoke, trash per-item purge countdown, field-history visual polish, new item-history-index pane, `#history/<id>` route normalization. Shared `relative-time.ts` + `ssh-fingerprint.ts` utilities.  
-  Spec: `docs/superpowers/specs/2026-05-23-vault-tab-management-surfaces-revamp-design.md`  
-  Plan: `docs/superpowers/plans/2026-05-24-vault-tab-management-surfaces-revamp.md`
+## Up next
 
-See `CHANGELOG.md` for full details and `STATUS.md` for the current commit list.
+These are immediately queued:
 
-## Up next (v0.5.x)
-
-These are specced and either in progress or immediately queued:
-
-- **Vault lock screen logo** — small `<img>` insertion in the lock-screen render *(in progress, uncommitted)*
-- **Phase 2B: form layout** — spacing, section headers, attachment previews in detail pane  
-  Spec: `docs/superpowers/specs/2026-05-02-phase-2b-form-layout-design.md`  
-  Plan: `docs/superpowers/plans/2026-05-02-phase-2b-polish-and-form-layout.md`
-- **1C-γ: attachments + Document type** — attachment UI in popup + vault tab; Document item add/view/edit/extract  
-  Specs: `docs/superpowers/specs/2026-04-24-relicario-extension-1c-gamma1-design.md`,  
-         `docs/superpowers/specs/2026-04-26-relicario-extension-1c-gamma2-design.md`
-- **v0.5.x UX polish** — recovery QR display in extension, password coloring refinements  
-  Spec: `docs/superpowers/specs/2026-05-03-v0.5.x-ux-polish-and-recovery-qr-design.md`
+- **Vault lock-screen logo** *(in progress, uncommitted)* — single `<img>` insertion in `vault.ts` lock-screen render
+- **Doc-structure redesign Task 5** — final verification gate (grep for stale paths, confirm link integrity)
+- **Cut a tag for the v0.5.x train** — version was bumped to 0.5.0 on 2026-05-04 but never tagged; scope now exceeds the original v0.5.0 plan. `v0.5.1` or `v0.6.0` depending on how you read the breadth.
 
 ## Medium-term
 
-- **Phase 3: vault-tab shell** — fullscreen sidebar with nav sections, pane routing  
-  Spec: `docs/superpowers/specs/2026-04-27-relicario-vault-tab-design.md`
-- **Phase 4: command palette** — ⌘K global search + action dispatch across the vault tab
-- **CLI restructure** — subcommand reorganisation, interactive TUI mode  
+Specced; no plan yet:
+
+- **CLI restructure** — subcommand reorganization, interactive TUI mode
   Spec: `docs/superpowers/specs/2026-05-04-cli-restructure-design.md`
-- **Extension restructure** — bundle / message-routing cleanup  
+- **Extension restructure** — bundle / message-routing cleanup
   Spec: `docs/superpowers/specs/2026-05-04-extension-restructure-design.md`
-- **Security polish**  
+- **Security polish** — follow-up hardening from the architecture review
   Spec: `docs/superpowers/specs/2026-05-04-security-polish-design.md`
+- **Phase 4: command palette** — ⌘K global search + action dispatch across the vault tab (no spec yet)
 
 ## Long-term / backlog
 
-- **Relay server** — encrypted WebSocket relay for multi-device sync without a shared git server  
+- **Relay server** — encrypted WebSocket relay for multi-device sync without a shared git server
   Spec: `docs/superpowers/specs/2026-05-02-relay-server-design.md`
-- **Recovery QR** — QR code encoding of the reference-image secret for printed cold backup  
-  Spec: `docs/superpowers/specs/2026-05-01-recovery-qr-design.md`
+  Plan: `docs/superpowers/plans/2026-05-02-relay-server.md` (`c0921b1`)
+  Code skeleton: `crates/relicario-server/` exists but only houses the pre-receive hook today; the relay binary would either extend or replace it.
 - **Mobile** — Rust core compiles to ARM; JNI wrapper for Android, Swift wrapper for iOS
-- **Credential capture** — extension content-script form detection + autofill  
-  Spec: `docs/superpowers/specs/2026-04-12-relicario-credential-capture-design.md`
 
 ## Non-goals (explicitly deferred or cancelled)