diff --git a/ROADMAP.md b/ROADMAP.md
index 22aedbd..c814cbf 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -6,25 +6,20 @@ it exists. Checkboxes track status.
 
 ## Phase A — Safety net & correctness (do first)
 
-- [ ] **A1. Automated test suite (pytest).** The project has no tests today;
-      every change is hand-verified. Start with the pure logic that already
-      isolates cleanly:
-      - `plan_disc_split`, `_movie_chapter_seconds`, `_nearest_chapter_before`
-      - `compute_high_profile_bitrate`
-      - ffmpeg/avconv command generation (`convert_file` → `command_var`) with
-        mock `file_project` objects, asserting flags for each profile,
-        text/image hardsub, 2-pass, even pad/crop, AC3 448k.
-      Add a `tests/` dir and a CI workflow (Codeberg Actions/Woodpecker). This
-      would have caught the 448k→384k clamp bug automatically.
+- [x] **A1. Automated test suite (pytest).** DONE — `tests/` with 43 headless
+      tests covering the split planner + chapter helpers,
+      `compute_high_profile_bitrate`, ffmpeg command generation (profiles,
+      text/image hardsub, 2-pass, even pad/crop, AC3 448k, progress-to-file,
+      `-ss`), ffprobe subtitle detection, and executor I/O. CI in
+      `.forgejo/workflows/tests.yml`. Caught/guards the 448k→384k clamp bug.
 
-- [ ] **A2. Harden subprocess I/O (kills the deadlock class).** `executor`
-      reads child stdout/stderr via blocking `GLib.IOChannel` watches; a stalled
-      consumer can backpressure-deadlock the child (this bit us — ffmpeg froze
-      on a full progress pipe when the GUI wedged). The progress-file fix only
-      covers ffmpeg progress; dvdauthor/spumux/mkisofs stdout/stderr still use
-      the fragile pattern. Build one hardened helper (non-blocking reads,
-      drain-on-close, bounded buffers, never let a child block on a pipe we own)
-      and route every backend through it.
+- [x] **A2. Harden subprocess I/O (kills the deadlock class).** DONE — the
+      executor now drains child stdout/stderr with background reader threads
+      into thread-safe buffers, consumed by a GLib timer on the main thread, so
+      a stalled/wedged main loop can never backpressure-deadlock a child on a
+      full pipe. stdout can go straight to a file, stdin is fed from a thread,
+      the retained log is bounded, and `wait_end` runs once. Verified a 2MB-
+      output child completes with the main loop never running.
 
 - [ ] **A3. Surface real errors to the user.** Failures show a generic error
       window; the actual failing command + stderr is buried in the log. On