docs(design): reconcile the TODO through 0.4.0

[HimanshuJanbandhu]

Docs only. Brings design/TODO.md up to date with everything shipped since the last reconcile.

Recorded:

• 0.4.0 released and the Marketplace listing republished from it, verified from the published wheel rather than the working tree — fresh venv, 11 packages, no torch, and the classic losses.append(loss) exiting 0 by default and 1 under --fail-on warning.
• pytorch/examples#1424 — the single upstream-reportable result out of 318 findings across 1,615 files. Notes why a second finding in the same directory was left out.
• fix: scope no_grad detachment to the loop it happened in #46, and the false negative I introduced on the way.
• Branches cleaned a third time, v0 moved unattended a third time.

The entry worth reading

Detachment first propagated whenever a binding was not provably grad-bearing — absence of proof treated as evidence. That silenced loss = compute_loss(...) followed by losses.append(loss), and silenced it even when loss.backward() was called on the name.

Neither check caught it. All 437 tests passed, because every TG001 fixture assigns from something resolvable like criterion(model(batch), y). And the seven-repo scan reported zero new findings, which is structurally blind: a true positive that stops firing is indistinguishable from a false positive that got fixed. I had reported 24 removals — 14 were findings being silenced, 8 of them genuine. The honest figure is 10.

So the note is methodological rather than a bug report: a wild scan is evidence about false positives only. False negatives need fixtures that deliberately exceed what the analysis can resolve, and there are now two.

One idea filed

The drifted pre-commit rev: pins (v0.1.0 in docs/ci.md, v0.2.0 in the README) are the third instance of one pattern — instructions we publish and never execute. The first was uses: highwaterlabs/torch-preflight@v0 resolving to nothing; the second was action.yml missing the Node 20 pin bump every workflow file got. A job that runs the documented hook the way action-smoke.yml runs the documented Action would close the class rather than the instance.