Reconcile the roadmap and current report benchmark evidence

Benchmarks/EventReportRendering/README.md

@@ -22,3 +22,26 @@ The email change limits projection to the rows actually displayed. Its allocatio
 The HTML renderer still projects and renders every event. Its allocation improvement is small, and the 10,000-event output is about 16.6 MB. These measurements do not establish an HTML throughput improvement or a bound on large interactive reports. Timing results are observations from a potentially busy development host, not release performance guarantees.
 
 The before snapshot uses the unchanged renderer at commit `7793aa5997bf016b0f56c33e8ae01abd68846ccd`. The after snapshot includes bounded email projection, single-pass constant-column classification, and HtmlForgeX 1.1.0 for descriptive dashboard captions. The email dependency remains HtmlForgeX.Email 1.6.0 in both measurements.
+
+## Current mobile email baseline
+
+`after-mobile.json` records the same fixture with published HtmlForgeX.Email
+2.0.0 and mobile stacked records at commit
+`2c4904dff24deb130c4da5fa1fa3e5fc4f79ca67`. All twelve measured samples pass.
+The runner uses one warmup, three measured iterations and rotated case order,
+with processor affinity `0xFFFF` and BelowNormal priority requested.
+
+| Case | Mean renderer allocated bytes | Output bytes |
+| --- | ---: | ---: |
+| Email, 1,000 events | 11,899,384 | 215,215 |
+| Email, 10,000 events | 11,899,581 | 215,219 |
+| HTML, 1,000 events | 147,577,709 | 2,961,045 |
+| HTML, 10,000 events | 1,156,132,952 | 16,569,102 |
+
+Email allocation stays approximately constant as the input grows because the
+digest still displays 25 records. The newer dependency and stacked presentation
+produce more markup and allocate more than the historical 1.6 fixture above.
+Use this baseline when measuring the current presentation; the two dependency
+versions and output layouts do not form a comparison of projection changes alone.
+Full-detail HTML still renders every retained record and needs explicit input
+bounds for large investigations.

Benchmarks/EventReportRendering/after-mobile.json

@@ -0,0 +1,53 @@
+{
+  "Contract": "Deterministic generic rows; fixture generation excluded; HTML retains all rows; email displays the first 25.",
+  "Phase": "Published Email 2.0.0 with mobile stacked layout",
+  "SourceRevision": "2c4904dff24deb130c4da5fa1fa3e5fc4f79ca67",
+  "SourceWorktreeClean": true,
+  "HtmlForgeXVersion": "1.1.0",
+  "HtmlForgeXEmailVersion": "2.0.0",
+  "ConfiguredSdkVersion": "10.0.112",
+  "Runtime": ".NET 10.0.12",
+  "OSArchitecture": "X64",
+  "ProcessArchitecture": "X64",
+  "ProcessorAffinityRequested": "0xFFFF",
+  "PriorityRequested": "BelowNormal",
+  "WarmupCount": 1,
+  "IterationCount": 3,
+  "RunOrder": "Rotated",
+  "SampleCount": 12,
+  "FailureCount": 0,
+  "Metrics": [
+    {
+      "Scenario": "Email-1000",
+      "Metrics": {
+        "RenderMs": 11.871733333333333,
+        "RendererAllocatedBytes": 11899384.0,
+        "OutputBytes": 215215.0
+      }
+    },
+    {
+      "Scenario": "Email-10000",
+      "Metrics": {
+        "RenderMs": 25.666633333333333,
+        "RendererAllocatedBytes": 11899581.333333334,
+        "OutputBytes": 215219.0
+      }
+    },
+    {
+      "Scenario": "Html-1000",
+      "Metrics": {
+        "RenderMs": 84.9825,
+        "RendererAllocatedBytes": 147577709.33333334,
+        "OutputBytes": 2961045.0
+      }
+    },
+    {
+      "Scenario": "Html-10000",
+      "Metrics": {
+        "RenderMs": 540.5117333333334,
+        "RendererAllocatedBytes": 1156132952.0,
+        "OutputBytes": 16569102.0
+      }
+    }
+  ]
+}

Docs/Legacy-Issue-Triage.md

@@ -35,9 +35,9 @@ permissions, retained input and current result.
 | [#17](https://github.com/EvotecIT/EventViewerX/issues/17), table success/failure detail | Current reports expose source coverage, failure diagnostics, scan bounds and completion evidence; readiness distinguishes unavailable proof. | Demonstrate complete, empty, failed-source and capped examples. An empty table alone is not proof of successful exhaustive collection. |
 
 The package checks validate installed module/tool behavior independently of
-development imports. The history, streaming and evidence-export changes in the
-active roadmap carry additional completion and occurrence guarantees; their
-source candidates and published delivery state must be assessed separately.
+development imports. History, streaming and evidence exports preserve completion
+and occurrence guarantees. Assess the installed package separately from current
+source when reproducing a legacy report.
 
 Use [the roadmap](../ROADMAP.md) for central storage, branding and extension
 decisions. Use a current retained fixture and focused regression proof for a

ROADMAP.md

@@ -9,11 +9,12 @@ belong in the repository's releases, pull requests and capability guides.
 
 | Capability | Owner | User path |
 | --- | --- | --- |
-| Local, remote, WEC and saved-EVTX queries; typed definitions and normalization | EventViewerX core | C#, `Get-EVXEvent`, `evx query` |
+| Local, remote, WEC and saved-EVTX queries; streaming, typed definitions and normalization | EventViewerX core | C#, `Get-EVXEvent`, `evx query` |
 | Native packs, Sigma compilation, bounded correlation and finding provenance | Core and EventViewerX.Detection | `Invoke-EVXDetection`, CLI detection, shared plans |
 | Aggregation, occurrence grouping, timelines and Group Policy context | Core contracts | `Measure-EVXEvent`, report pipelines and context stores |
 | Durable SQLite history, findings, checkpoints and retention | EventViewerX.Storage over DbaClientX | `Show-EVXEvent -StorePath`, store query and integrity commands |
 | HTML, Excel, CSV and compact email | EventViewerX.Reporting over HtmlForgeX and OfficeIMO | `Show-EVXEvent`, reusable snapshots and renderers |
+| Export privacy profiles and verifiable evidence bundles | EventViewerX core reporting contracts | Detached exports, pseudonyms and bundle manifests |
 | PowerShell and CLI hosting | Thin PSEventViewer and EventViewerX.Cli adapters | Consistent bounded queries and operational evidence |
 | Build, packages, release qualification and performance orchestration | PowerForge/PSPublishModule | Build configurations, artifact checks and benchmark gates |
 | Portable saved-EVTX parsing | EventViewerX.Evtx | Explicit portable file mode; live Windows channels retain native APIs |
@@ -26,39 +27,21 @@ grouping and normalization add views without silently deleting observations.
 
 ## Active improvement backlog
 
-The 2026-10-04 assessment produced the following reviewable changes. Open PRs
-represent source candidates; they do not establish a published package or an
-installed runtime. Merge and release gates apply separately.
-
-- [ ] Settle historical replay, occurrence multiplicity and completion evidence
-  ([#131](https://github.com/EvotecIT/EventViewerX/pull/131)).
-- [ ] Settle source-query streaming and read-mode parity
-  ([#132](https://github.com/EvotecIT/EventViewerX/pull/132), depends on #131).
-- [ ] Settle checkpoint lookup allocation
-  ([#134](https://github.com/EvotecIT/EventViewerX/pull/134)).
-- [ ] Settle archive resource handling, cancellation and atomic publication
-  ([#135](https://github.com/EvotecIT/EventViewerX/pull/135)).
-- [ ] Settle distinct-value correlation state and its comparable performance
-  proof ([#136](https://github.com/EvotecIT/EventViewerX/pull/136)).
-- [ ] Settle portable EVTX fidelity and allocation
-  ([#137](https://github.com/EvotecIT/EventViewerX/pull/137)).
-- [ ] Settle export privacy policies and verifiable evidence bundles
-  ([#138](https://github.com/EvotecIT/EventViewerX/pull/138), depends on #132).
-- [ ] Settle packed CLI and PowerShell ZIP qualification in ordinary CI
-  ([#139](https://github.com/EvotecIT/EventViewerX/pull/139)).
-- [ ] Qualify compact email presentation work and full-report column analysis
-  against comparable workloads and rendered output.
-- [ ] Qualify standalone CLI archives on their declared platform and architecture
-  matrix before publication. Normal tool-install proof covers Windows/Linux;
-  it does not replace ARM64 or macOS runtime qualification.
+Current source includes historical replay and occurrence guarantees, visible
+completion evidence, streaming and read modes, indexed checkpoints, bounded
+distinct correlation, portable EVTX allocation improvements, export privacy and
+evidence bundles, packed-artifact CI, and responsive compact email. The remaining
+work concerns release delivery, further full-report measurement and legacy
+conversations.
+
+- [ ] Profile full-detail HTML reports on representative large investigations.
+  Preserve snapshot behavior and measure rendering allocation separately from
+  bounded email digests.
 - [ ] Publish approved artifacts only after signing, package identity,
   installation and runtime checks pass and publication is authorized.
 - [ ] Reconcile [legacy issue dispositions](Docs/Legacy-Issue-Triage.md) with
   current reports before closing or transferring conversations.
 
-Remove settled PR items after their behavior is integrated. Keep current user
-paths in guides and contracts, rather than retaining completed milestone lists.
-
 ## Quality and performance gates
 
 A successful empty result is useful only when its selected input was complete.
@@ -77,6 +60,12 @@ Keep allocation and scale evidence separate from noisy workstation timing.
 [Performance gates](Docs/Performance-Gates.md) describe the controlled suites;
 timing-sensitive gates do not belong in an uncontrolled CI smoke test.
 
+Qualify each standalone CLI archive on its declared operating system and
+architecture before publication. A successful build or a tool installation on
+another architecture does not establish native archive runtime behavior.
+Keep archive hashes and source identity with the query, ingestion, reload and
+integrity evidence for the release candidate.
+
 Interactive full-detail reports retain their selected rows. Use explicit
 collection limits, aggregation and bounded snapshots for large investigations;
 a compact email should format only its allocated digest rows. Streaming queries