Update docs

docs/roadmap.md

@@ -38,13 +38,28 @@ exists from M1 so the protocol can be exercised long before any GUI.
 - **Exit:** a user shares mic + desktop audio; listeners control each independently.
 
 ### M4 — Native clients
-- **Windows (C#/WinUI):** connect, saved-server list, channel tree, voice, text, device
-  pickers, meters, VAD/PTT + per-user NR controls.
-- **macOS (Swift/SwiftUI):** same.
-- **iOS (Swift):** AVAudioSession integration, mic permission, foreground voice; ReplayKit
-  broadcast extension for `SCREEN_AUDIO`.
-- In-app **admin interface** (account provisioning, bans) for admin users.
-- **Exit:** non-technical user installs a client, saves a server, and joins.
+
+**Windows (C#/WinForms, .NET 10) ✓ complete 2026-06-17:**
+- Connect, saved-server list (JSON, DPAPI-encrypted passwords), TOFU identity dialog.
+- Channel tree (`TreeView`), user list, join (incl. password-protected channels).
+- Voice: mic start/stop, mute/deafen, VAD/PTT/**always-on** mode, **VAD sensitivity slider**
+  (live threshold update via `vc_set_vad_threshold`), device picker, level meter.
+- Per-user gain/mute/NR tuning (`PerUserTuningDialog`).
+- Channel + private text chat. Activity log (screen-reader primary path).
+- Explicit `AccessibleName`/`AccessibleDescription` on every control; `&` mnemonics;
+  `AutomationNotification` curated live announcements.
+- Focus-scoped PTT (documented limitation — no system-wide hook in v1).
+- Admin/moderation UI **out of scope** — needs server-side dispatch first (M5).
+
+**macOS (Swift/SwiftUI) — pending:**
+- Same feature set as Windows over the same C ABI (now stable and complete).
+- AVAudioSession, mic permission, interruption/route-change handling.
+
+**iOS (Swift) — pending:**
+- AVAudioSession, mic permission, foreground voice.
+- ReplayKit broadcast extension for `SCREEN_AUDIO`.
+
+**Exit:** non-technical user installs a client, saves a server, and joins.
 
 ### M5 — Moderation, polish, and beyond
 - Permissions/roles, kick/ban/server-mute, channel passwords UI.
@@ -84,6 +99,25 @@ Settled and reflected throughout the docs:
   the same `ApmProcessor` interface; there is **no AEC/NS/AGC implementation at all** yet. Real
   `webrtc-audio-processing` stays a tracked future swap (e.g. if/when a Linux build target
   exists). (voice.md §8, §11)
+- **Windows client UI framework (2026-06-17):** **WinForms** (.NET 10), not WinUI 3 or
+  Avalonia. Reason: Win32 HWND controls have the most mature, predictable screen-reader
+  (NVDA/JAWS/Narrator) support of any current .NET UI stack. WinUI 3's accessibility UIA
+  tree has known rough edges on .NET 10; Avalonia's accessibility story is thinner still.
+  This overrides the earlier WinUI/Avalonia mention in `docs/tech-stack.md §2` and
+  `docs/architecture.md §4`. (clients/windows/)
+- **TOFU pins TLS leaf cert, not Ed25519 (2026-06-17):** the original design said to pin the
+  server's declared Ed25519 identity fingerprint from `ServerHello`. This is circular — the
+  Ed25519 key and the TLS cert are generated independently with no cryptographic binding, so
+  accepting/rejecting based on a value sent *inside* the channel being trust-decided is
+  meaningless. **Decision:** pin the TLS leaf certificate's own SHA-256 fingerprint, which is
+  verifiable directly from the TLS handshake before any application data is trusted. The Ed25519
+  value is still shown in the identity dialog for human-readable display only (informational).
+  See `docs/security.md §1.1`. (core/src/crypto/tofu_store.*, vc_confirm_server_identity)
+- **PTT is focus-scoped in v1 (2026-06-17):** PTT hotkey capture uses `Form.KeyDown`/`KeyUp`
+  (works only while the VoiceCat window has focus), not a system-wide `WH_KEYBOARD_LL` hook.
+  Reason: a low-level keyboard hook requires escalated permissions, risks AV flagging, and is
+  disproportionate complexity for a v1 client. Documented in the UI as a known limitation.
+  Can be revisited for v2 if users request it. (clients/windows/VoiceCat.App/Forms/MainForm.cs)
 
 ## 3. Open questions