diff --git a/docs/PLAY_RELEASE_CHECKLIST.md b/docs/PLAY_RELEASE_CHECKLIST.md
index 959e7ae..db37720 100644
--- a/docs/PLAY_RELEASE_CHECKLIST.md
+++ b/docs/PLAY_RELEASE_CHECKLIST.md
@@ -125,8 +125,11 @@ action except the items marked **[code]**.
   - *Is all user data encrypted in transit?* → N/A (no transmission).
   - *Do you provide a way for users to request data deletion?* → Uninstalling
     removes all app data.
-- [ ] Confirm the **permission set** the Console will show. Read it from the *merged*
-      release manifest, not the source one, so nothing a library quietly adds slips past:
+- [x] Confirm the **permission set** the Console will show. **[code]** done 2026-10-13: `aapt2 dump
+      badging` on the release APK reports exactly the table below (plus
+      `…DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION`) — and **no `INTERNET`**. Re-check from the
+      *merged* release manifest rather than the source one after any dependency change, so nothing
+      a library quietly adds slips past:
 
       | Declared permission | Why | From |
       |---|---|---|
@@ -210,7 +213,9 @@ action except the items marked **[code]**.
   - [ ] Move to trash (Android 11+).
   - [ ] Permanent delete (Android 11+).
   - [ ] Refuse the system dialog — nothing is deleted, the app says so.
-- [ ] Test with a library of several thousand photos to sanity-check scan time.
+- [x] Test with a library of several thousand photos to sanity-check scan time. **[code]** done on
+      the test device: the 5,363-photo library scans in **20.2 s cold / 11.0 s warm**, and the
+      screenshot run over 5,385 photos finished in **11.1 s** (6 unreadable files skipped).
 - [ ] Verify no crashes in *Play Console > Quality > Android vitals* after rollout.
 
 ## 7. Release notes ("What's new") and rollout
diff --git a/docs/ROADMAP.md b/docs/ROADMAP.md
index ee955fa..8f458b5 100644
--- a/docs/ROADMAP.md
+++ b/docs/ROADMAP.md
@@ -30,7 +30,7 @@ Legend: ✅ done · 🚧 in progress · ⏳ not started · 💡 candidate (propo
 | ~~Large-library scan stall~~ ✅ **fixed — verified on device** | The 5,363-photo library used to freeze at *“74 / 100 · Comparing file signatures…”* (a **blocked syscall**: zero CPU, workers sleeping). `BoundedCall` now abandons a stuck provider call **and** trips a stall breaker after three consecutive timeouts. **Verified on the real test device (Android 12 / MIUI): the scan completes — 20.2 s cold, 11.0 s warm, 15 groups, 6 unreadable — where it used to hang.** Covered by `BoundedCallTest` and `ScanEngineEndToEndTest` |
 | ~~Unreleased `BoundedCall` fix~~ ✅ | The provider-call deadline shipped in **1.0.1** (`versionCode` 2) |
 | **Play Console: foreground-service declaration** | Declaring the `dataSync` type (App content › Foreground service permissions) is release-blocking. **[code]** the manifest already declares it; the ready-to-paste justification is in [PLAY_RELEASE_CHECKLIST](PLAY_RELEASE_CHECKLIST.md) step 5 — this is a Console action, not a code change |
-| **Remaining Play paperwork** | Keystore / Play App Signing, Data Safety form, hosted privacy policy and store listing — see [PLAY_RELEASE_CHECKLIST](PLAY_RELEASE_CHECKLIST.md) |
+| **Remaining Play paperwork** | Console actions only, no code: the **first upload + Play App Signing enrolment**, the **hosted privacy policy URL** (the one item with no home yet — the repo still has no git remote), **Data safety**, the **Photo/video permissions** declaration, the **content rating / audience / app access / ads / export** questions, and the **listing copy + four screenshots**. Keystore, `versionCode`, listing copy, graphics, permission audit and the signed `.aab` (`sha256 f8e6a29a…`) are all in place; rollout goes internal → closed → production. Step-by-step: [PLAY_RELEASE_CHECKLIST](PLAY_RELEASE_CHECKLIST.md) |
 | ~~Store screenshots need one re-shoot~~ ✅ **done — verified on device** | The old captures showed the *Photo access needed* banner (an app-op is not a grant) and `03-results.png` showed the developer's own library. After a real grant the set was re-shot over the generated demo library: **01-empty** (no tap needed — results and selection live in `ScannerViewModel`, so force-stop + relaunch returns to the empty state with the grant still in place), **02-scanning** (`5353 / 5385`), **03-results** (**17 groups, 54 of 5385 photos, 83.5 MB reclaimable**; the headline group's 43.1 MB out-ranks the device's own 39.8 MB, so no real photo is in frame) and **04-options**. Captures are taken by watching for UI **text** changes, because MIUI refuses synthetic taps (`INJECT_EVENTS`). The demo library is deleted from the test device afterwards — MediaStore **5,386 → 5,364** rows, and the 22 stale rows it leaves in the hash index are pruned by `PhotoIndexStore.pruneTo` on the next scan. Deliberately not captured: the staged state and the system confirmation dialog, because staging clears the demo group and would put real photos back in frame. Details: [STORE_LISTING](STORE_LISTING.md) |
 | **Device-only verifications** | RAW/DNG files, a *real* iPhone HEIC with a non-upright EXIF orientation, permission revoked mid-scan, and the Android 14 “Selected photos” flow. ✅ The **index-reuse** check is done: after a scan the index holds **5,363 rows, 5,357 with a perceptual hash**, and a second scan runs in **11.0 s vs 20.2 s** cold |