docs: record the SonarCloud backlog and the What's cooking task

Two additions to Phase 3.

SonarCloud, with the breakdown rather than the headline: 51 open issues are 0
bugs, 0 vulnerabilities and 51 code smells, and 35 of those are hardcoded-URI
warnings against a deep-link mapper's test fixtures and a one-forge client's
endpoint constants. Those want triaging as Won't Fix, not refactoring. The part
worth real thought is the 3 hotspots — the sr.ht token is stored without a
SecAccessControl, so an unlocked phone hands it over, which is a product
decision rather than a lint nit.

Ingesting sr.ht's quarterly "What's cooking" posts, because nothing here tracks
the API's evolution and this repo's assumptions rot silently. Already proven
worthwhile: SCOPE.md claimed pronouns were not in the schema while AppState
queries them and UserProfileView displays them. That entry is struck through and
kept as evidence. Q2 2026 also reports a writable hub.sr.ht API and finished
deploy keys, both of which contradict what is written here.

1 files changed, 58 insertions, 0 deletions

diff --git a/ROADMAP.md b/ROADMAP.md
index 2436877..c6575b5 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -169,6 +169,64 @@ implies.
 Labels and hints appear in 17 of 89 view files. Mechanical and low-risk, but it
 cannot be verified from a build — it needs VoiceOver driven on a device.
 
+### SonarCloud backlog
+
+51 open issues: **0 bugs, 0 vulnerabilities, 51 code smells**, plus 3 security
+hotspots. The headline number is misleading, so trust the breakdown before
+budgeting:
+
+- **35× `swift:S1075` (hardcoded URI)** — 28 of them in
+  `SourceHutWebDeepLinkMapperTests`, 5 in `Shared/HutchDeepLinkURLs`. A deep-link
+  mapper's tests exist precisely to assert against literal URLs, and a client for
+  one forge has fixed endpoints by definition. These want triaging as *Won't
+  Fix* in SonarCloud, not refactoring. "Fixing" them would make the code worse.
+- **5× `swift:S1135`** — TODO comments. Two are in `HutchIntents` and name real
+  gaps.
+- **3× `swift:S1186` (empty closure)** — all three CRITICAL, all three trivial:
+  `Button("Cancel", role: .cancel) {}` needs no body. A comment settles it.
+- **2× `javascript:S4624`** in the Safari extension; **2× `swift:S1172`** unused
+  parameters.
+
+The 3 hotspots are the part actually worth thought:
+
+- `KeychainHelper:33` and `:80` (**HIGH**) — the token is stored
+  `kSecAttrAccessibleWhenUnlockedThisDeviceOnly` with no
+  `SecAccessControl`, so it does not require biometric or passcode
+  authentication to read. That is a genuine product decision — should a stolen,
+  unlocked phone hand over a sr.ht token? — not a lint nit.
+- `ReadmeView:1922` (**LOW**) — unrestricted WebView navigation. Probably a false
+  positive: `isAllowedReadmeNavigationURL` enforces a scheme allowlist. Verify,
+  then annotate.
+
+Query it with:
+`https://sonarcloud.io/api/issues/search?componentKeys=zerolabsco_hutch&resolved=false`
+
+### Ingest "What's cooking on SourceHut?"
+
+sr.ht posts a quarterly update to `~sircmpwn/sr.ht-announce`, mirrored at
+<https://sourcehut.org/blog/>. Nothing in Hutch tracks it, so the API grows and
+this repo's assumptions quietly rot. Read each quarter's post, diff it against
+`Docs/API`, `SCOPE.md`, and the call sites, and file what changed.
+
+That this is worth doing is already proven: **`SCOPE.md` claims pronouns are
+"not in GraphQL schema", while `AppState` queries `pronouns` and
+`UserProfileView` displays them.** sr.ht shipped it, the doc never caught up,
+and it has been discouraging work that is in fact already done.
+
+[Q2 2026](https://sourcehut.org/blog/2026-05-28-whats-cooking-q2-2026/) alone
+flags two openings:
+
+- **hub.sr.ht gained a writable GraphQL API** for managing projects and project
+  resources. Hutch's projects are read-only, and `SCOPE.md` still rules out
+  discovery on the grounds that hub has no public API. Both claims need
+  rechecking — this may also unblock `mailingListSubscribe`, which Phase 1 left
+  out for exactly that reason.
+- **git.sr.ht deploy keys are complete** (`createDeployKey` / `deleteDeployKey`
+  are in the SDL). Hutch never calls them.
+
+Start from Q1 2026 forward — that is roughly when the current `Docs/API` dumps
+were captured.
+
 ### Swift 6 language mode
 
 The project builds in Swift 5 language mode with