docs(todo): record history cleanup outcome and pre-squash backup refs

TODO.md

@@ -1,12 +1,14 @@
 # TODO
 
-> Last updated: 2026-09-10
+> Last updated: 2026-09-18
 > Context: CSS waste strategy: run unusedSymbols report-only (10-14) first to get go/no-go reclaimable-byte data; per-page split (u-x) second, reusing template inventory in docs/css-split-analysis.md.
 
 ## In Progress
 
 ## Pending
 - [ ] #test-env-deploy-code-chown-regression test-env deploy-code --chown regression documented in README --context test-env
+- [ ] #decide-fate-of-stray [!low] Decide fate of stray tracked commits.txt (6268-line git log dump) — Fate: left tracked; out of scope for history cleanup
+- [ ] #history-cleanup-66-commits [!medium] History cleanup: 66 commits squashed to 29 on top of main; pre-squash backup at refs/backup/pre-squash-tip (tree 8649514e) + git bundle /tmp/xamxam-presquash.bundle
 
 ## Completed
 - [x] #audit-all-docs-and [!high] Audit all docs/ and classify accurate vs stale
@@ -66,6 +68,9 @@
 - [x] #fix-14-biome-check Fix 14 biome check errors: unsorted imports in scripts/css-*.mjs + unformatted CSS/JS files
 - [x] #fix-peertube-resumable-chunked-upload [!high] fix(peertube): resumable chunked upload to stop 504 on large A/V — Admin MP4 upload fails at 100%: PHP relays whole file to PeerTube via one blocking multipart POST; PeerTube edge nginx returns 504 Gateway Time-out (see xamxam-error log filepond_peertube). Migrate PeerTubeService::upload() to resumable upload protocol with chunked PATCH so no single request exceeds the proxy timeout.
 - [x] #fix-migrations-run-php-not-loading Fix migrations/run.php not loading composer autoloader (fresh-DB failure) — run.php loaded no autoloader; PHP subprocess migrations require src/ files whose sibling classes (Database->DatabaseMigrations) only resolve via composer classmap. Loaded autoloader in run.php and injected into subprocesses via -d auto_prepend_file, preserving $argv[1]=db contract. Verified: fresh schema.sql DB applies 47 migrations, exit 0, idempotent on 2nd run.
+- [x] #backup-branch-from-current [!high] Backup branch from current state (backup/pre-history-cleanup)
+- [x] #squash-main-history-into [!high] Squash main..@ history into logical commits — Groups: (1) session-timeout+GC; (2) env/provision+docs; (3) coverage/accents; (4) cover-images; (5) admin-cleanup-page; (6) test-env+deploy; (7) admin-index-css; (8) toc; (9) misc features; (10) migrations/justfile/biome. Fold TODO-only commits. Keep postlaunch intact.
+- [x] #verify-final-tree-identical [!medium] Verify final tree identical to backup
 
 ## Deferred / Blocked
 - [ ] #just-setup-backs-a [!medium] just setup backs a stale setup-dev.sh (clones php-live-reload, legacy admin/data/ dirs) — needs rewrite or removal