Three engine changes that share the copy loop, so they land together.

--paranoid reads every source file a second time and compares. The gap it
closes is a read that returns wrong bytes without raising: the checksum is
taken from whatever came back, so the destination faithfully matches a
corrupted source and verifies clean at every level. A disagreement is not
adjudicated — there is no basis for deciding which read was true — so it is
retried, and a source that will not read the same twice fails that file and
leaves nothing behind. The page cache is dropped first, and the job says so
when it could not be, since a second read served from memory compares the
first read against itself. It is opt-in because it costs a full extra pass.

A transient read failure is now retried at the chunk that failed rather than by
restarting the file: recovering a bad sector near the end of a 79 GB clip cost
79 GB and now costs 8 MiB. This needed no hasher rewind after all — a chunk is
only hashed once it has arrived whole, so a failed read has produced no state
to unwind. The source is reopened and sought back to the offset, because a
reader that dropped off the bus needs its handle re-established. Writes still
restart the whole file: a partial write leaves the destination at a length the
copy loop does not know. retry.Exhausted stops the outer retry from repeating
the same attempts against the same fault.

Sidecars and proxies are matched to their clip by stem. A .sidecar carries a
BRAW's grade; delivered without its clip it is nothing, and the clip delivered
without it has silently lost the grade. An ambiguous stem — two takes of the
same name in different folders — is left unlinked rather than guessed at. A
clip that copies while a file belonging to it does not is now a job warning
instead of two rows twenty lines apart.

Also fixes a deadlock introduced while doing the above: closing the source
moved out of a `with` block into a `finally`, and a close that raised skipped
the end-of-file sentinel and hung the consumer forever. Closing now swallows
everything, and there is a regression test for a source whose close() raises.

The editor had sixteen fields in one flat column, four of them checkboxes
sitting on blank labels. The two or three that bear on any given change were
never next to each other. They are now three sections — Preset, Copying,
Reports — with the checkboxes stacked under a single Options label.

"Job name" is now "Job name template", because Simple mode has a field of the
same name that takes a literal one. "Skip files already present at matching
size" gained a tooltip saying what it does not compare, since it is the one
place the tool takes something on trust.

--paranoid was reachable from the CLI and from Preset.to_options but exposed
nowhere in the interface, which makes it a field nobody can use. It is now a
checkbox in both the preset editor and Simple mode, worded and explained the
same way in each, and it persists with the preset.

`offloader verify` prints directory-hash failures alongside the file ones, and
`offloader offload` takes --paranoid. The run summary says when a second source
read was done, kept out of the PDF's header string because that is pinned to
the reference report's wording.

The roadmap's Next section is emptied by this branch, so three gaps already
documented in docs/ are promoted into it rather than new ideas invented:
--skip-existing by checksum, previousPath, and a lock file between instances.

docs/data-safety.md had a paragraph stating that a retry restarts the whole
file "because a partial read leaves the running checksum meaningless" — the
opposite of what the copy loop now does for reads. Corrected, and the limit it
listed for unrepeatable source reads now points at --paranoid.

434 tests, 86% line coverage.

Verifying the directory hashes recomputes them from what is on disk, which
means hashing the files the manifest does not list — that is what proves a
rename is only a rename. But the job's own reports are written into the
destination after the manifest, so they are on disk when a verifier recomputes
and were never in what it recomputes against. A card that had just been copied
reported its own JobReport.pdf as a change to the tree, and `offloader verify`
exited non-zero on the path the README says a format script can gate on.

The format already has the mechanism: `ignore`, which the verifier honoured and
the writer only ever used for `ascmhl`. The report directory goes in the same
list for the same reason — neither is managed data. The path is recorded rather
than the conventional name, because `--report-dir` moves it, and both are
recorded because they can differ: thumbnails land in `<name>_Reports` wherever
the PDF goes.

A history written before this says nothing about its reports, so `*_Reports` is
allowed for when recomputing, keyed off the absence of any recorded pattern but
`ascmhl` — it stops applying the moment a manifest describes its own layout.
Deliberately not applied to the unlisted list, which still names those files,
and scoped to that one directory: a stray file anywhere else still moves the
hash it belongs to.

The tests that missed this built their destination with `write_manifest`
directly, so it never had a reports folder in it. The new ones go through the
CLI, which is what writes the reports.

The app section described a drive panel, a preset list and a queue without
showing any of them. Three screenshots: preset mode with a job running, simple
mode, and the preset editor.

Generated rather than captured, because a screenshot taken by hand is wrong the
next time the interface moves and nobody notices. `tools/screenshots.py` drives
the real app — nothing is mocked but the two things that would otherwise leak
this machine into a public README: the config directory is a throwaway, so real
presets, settings and history are neither read nor written, and the drive panel
is fed invented volumes rather than whatever is mounted. The queue items are
built directly instead of enqueued, so no job runs and nothing is copied.

The window is opened wider than it starts and the queue splitter pushed down:
the default split leaves the queue a row and a half tall, which is the one part
of that screen a reader needs to see.

Two things the directory-hash and chunk-retry work reported badly.

A report where every file matched and a directory hash did not opened
"3 checked: 3 ok", which reads as a pass to anyone scanning — on the one
verdict where the file hashes agreeing is the point rather than the
reassurance. That case now leads with the directories and says what the
combination means. A report with file failures is unchanged: it already
opened with them.

Recovered reads were one warning each, so a card failing over a contiguous
stretch produced one line per 8 MiB and buried every other warning in the job.
Now one line per file: a single bad sector still names its offset exactly,
because there the byte is the useful fact; a run of them is bounded by first
and last, because there it is not.

Also documents what recomputing directory hashes actually reads. Proving a
rename is only a rename means hashing what the manifest does not list, so a
destination root holding anything besides this job is read too.

Neither branch could see this on its own. Companion grouping matches a sidecar
to its clip by stem, which is the only relationship a camera records. The data
profile's whole claim is that nothing is treated as a clip — so on a dataset it
would announce that `capture.xmp` belongs to `capture.h5` on no evidence beyond
a shared name, and warn when one copied without the other.

Gated on the same `probes_media` the CLI summary already uses, at both call
sites: `run` and `rescan`.

The data profile and this branch landed independently, so three things were
describing a tool that no longer exists in that shape.

`CONTRIBUTING.md` still claimed 434 tests; the merged suite collects 453. Both
files now say so, and neither claims a wall-clock figure any more — two runs of
identical code here differed by three and a half minutes, so the number was
measuring the machine rather than the suite.

The changelog gained the two reporting changes it was missing, and the sidecar
entry now says the grouping is media-profile only.

The README's generic-transfer section claimed nothing is treated as a clip
while companion grouping was still doing exactly that; it now says what that
means for a dataset.

…ares

…ache

A cancel during a second destination's full-verification reread recorded only
the destinations already promoted. A file's status is its weakest recorded
copy, so the copy that was never made could not lower it, and the entry read
as Verified while that destination held nothing. This and every later
destination are now recorded as cancelled, so the entry is Cancelled.

offloader verify discarded the result of the page-cache eviction. The offload
warns that a read-back may have come from memory; verify now carries the same
warning on its report and the CLI prints it.