[mikecerisano]

A queued transfer could stop at review even when every selected file verified and its only exclusions were the AppleDouble metadata files the user had chosen to ignore. The next card can now start after that specific result.

The engine records which exclusions it actually recognized. Continuation requires exact selected-file and exclusion coverage at every destination, the requested verification mode, successful requested MHL/report handoff, and durable journal completion. Project transfers also require matching project/card identities, enough independent verified copies, and successful project persistence. Missing, stale or legacy evidence stays blocked. Real transfer errors, Quick mode, cancellation and interruption cannot earn this new permission. Quick retains its existing queue behavior.

Exclusions stay visible in History and reports. The transfer remains an issues/review result for whole-card safety; this change does not grant safe-to-erase or automatic eject permission. It adds no setting or main-window control.

Validation on the frozen revision:

• Engine Debug and Release, each: XCTest 205 passed, 43 skipped, 0 failed (248 scheduled); Swift Testing 217 passed, 6 skipped, 0 failed (223 reported across 40 suites). The 10 new policy regressions passed explicitly.
• Full Mac suite: 1,301 passed, 23 skipped, 0 failed (1,324 total). All 19 new app cases and the existing Quick queue control passed explicitly. Raw-log and structured runtime-warning checks were clear.
• Release builds: iOS device arm64 and universal Mac arm64/x86_64 passed. All 450 tracked source/config hashes were stable throughout the seven local gates.
• iPad and iPhone simulator suites, each: 75 passed, 10 skipped, 0 failed (85 total). The iPad result was accepted from the first attempt; the iPhone passed in a separate direct run. Three earlier mobile controllers failed auxiliary process-enumeration/settlement checks and remain recorded as failed.
• A local universal diagnostic archive passed deep, strict signature verification and executable/dSYM UUID matching. No release was published.
• One hosted import-review layout test passed, with four inspected PNGs. It does not validate the native picker, Cancel/Apply actions or import persistence. An initial wrapper rejected the wrong success-marker spelling; the existing actual result was revalidated without rerunning the test.

The real-pipeline queue cases cover next-card advancement, actual existing-MHL/report/selected-file conflicts, journal failure and legacy restore. They check source bytes, retained exclusions, the conservative saved safety verdict, MHL chain existence and nonempty requested PDF/JSON/CSV files. They do not constitute a new visual PDF review or an interactive device walkthrough. Project and scope cases cover failed persistence, insufficient independence, wrong/missing identities, malformed coverage and absent qualifiers.

Full results and limits: queue validation.

Stacked on #63; merge after #61 and #63. No merge or release is requested by this draft.