Extend managed macOS client toward feature parity

PROGRESS.md

@@ -10,6 +10,31 @@ up instantly. Newest status at the top.
 
 ## ▶ Where we left off / next action
 
+- **In progress (2026-09-19): managed macOS functional-parity checkpoint.** Extended the
+  .NET AppKit client across the remaining Swift desktop surface: persistent audio and
+  notification settings; VAD, focus-scoped configurable PTT and always-on modes; input,
+  output and auxiliary-device selection; input/output/auxiliary gain; stereo microphone;
+  RNNoise; self mute/deafen; event sounds and speech; modeless private conversations;
+  speaking and mute state; moderation, permissions, channel configuration and account
+  administration. Added typed administration helpers to `VoiceCat.Core` and per-local-stream
+  gain to `VoiceCat.Audio`. ScreenCaptureKit now publishes desktop audio with entire-desktop,
+  application-only and application-exclusion scopes, including optional VoiceOver/speech
+  exclusion, without introducing a native protocol dependency. The managed client imports
+  Swift profiles, TOFU pins and Keychain passwords, preserving a one-time JSON backup when it
+  converts profile storage. Added a Release publishing script with an ad-hoc validation path
+  and Developer ID/notarization path; consistently re-signing the nested .NET runtime fixed a
+  hardened-runtime Team-ID launch failure. Signing now operates on a separate distribution
+  copy so it cannot corrupt MSBuild's incremental app bundle or signing cache. **Verified:**
+  the ad-hoc Release app passes strict deep signature verification and remains running after
+  launch; Debug and Release Apple builds
+  succeed; 190/198 managed tests pass with eight optional native/published-server oracles
+  skipped; native `dev` CTest passes 29/29. The administration protocol test exercises typed
+  result round trips and the profile test proves Swift import plus backup. **Next:** manually
+  exercise ScreenCaptureKit selection and a real multi-human call, complete the VoiceOver
+  navigation/announcement matrix, and run the credentialed Developer ID notarization path.
+  Keep the Swift macOS app as the release oracle until all three gates pass; only then remove
+  its replaceable app/UI code.
+
 - **In progress (2026-09-18): managed macOS client and selectable audio path.** Added a
   separate .NET 10 AppKit solution with application/menu lifecycle, guest/account connection,
   explicit TOFU approval, channel selection, roster/chat, disconnect state, accessibility
@@ -50,9 +75,8 @@ up instantly. Newest status at the top.
   clean sustained peer tone in the DTX-disabled Music Room. Lobby's later hiss was confirmed as
   expected Opus DTX comfort noise for a synthetic sine, not playback corruption. Per user
   direction, final listen quality will be exercised in real multi-human calls after feature
-  completion rather than an artificial ten-minute tone. **Next:** add moderation/settings,
-  ScreenCaptureKit,
-  VoiceOver verification, signing and notarization.
+  completion rather than an artificial ten-minute tone. This checkpoint is superseded by the
+  2026-09-19 functional-parity entry above.
 
 - **Done (2026-09-16): Linux production packaging checkpoint.** Added a real TLS 1.3
   `--health-check` with optional certificate pin verification. Linux x64 now has separate