[mikecerisano]

An older History entry can have verified-looking rows without a saved selected-file plan. BitMatch could then show a green whole-card verdict in one place and an uncertain result elsewhere. A new transfer could also continue into automatic reporting after its plan write failed, because the authoritative-results callback error was caught as if it were a recoverable project-finalizer error. The app could announce success before its final journal result was saved.

This PR requires a complete saved plan for whole-card safety claims in History, PDF, JSON/CSV, Finish, queue review, recent-result surfaces, Dock, and prior-backup hints. It keeps the original saved summary and file rows visible as provenance while labeling uncertain coverage plainly. New attempts fail closed if the plan is missing or does not match authoritative per-destination rows, and direct retries clear the previous attempt's plan. Automatic MHL, project finalization, and reports stop on that plan error. Live completion and notifications wait for the settled journal result. Reopening a saved transfer now gives the Dock the reviewed record's verdict.

A project card and report can contain independently saved verification evidence before the final History write. If that later write fails, this PR does not erase those artifacts; it keeps the live outcome in attention state, suppresses a safe notification/eject signal, and tells the operator that transfer results could not be saved. Cross-store finalization remains non-atomic.

Local validation

• Full engine suite: 143 XCTest with 17 expected skips, plus 181 Swift Testing cases passed. Seven focused engine tests passed again after the final direct-retry reset.
• Exact final head on merged main: Mac suite 1,214 passed, 14 skipped, 0 failed; iPad simulator build succeeded; iPad suite 65 passed, 9 skipped, 0 failed.
• git diff --check clean. No SFTP or camera-metadata files changed in this PR.
• A focused test reproduced automatic report publication after the authoritative plan callback threw. Moving that callback outside the recoverable project-finalizer catch made the test and the real coordinator fault-injection test pass.