docs: drop finished work from TODO.md

[bernardladenthin]

Summary

• TODO.md was 781 lines, of which 357 recorded work that is done. Docs only.
• The largest removal is a whole section whose every bullet was already marked resolved — and that is asserted, not assumed: the script refuses to cut the section unless every - ** in it starts with [FIXED], [SUPERSEDED] or [ANSWERED].

What went

Block	Lines
## Done (kept for history)	154
### Model-backed tests that the CI-skip fix newly exposed (b10618 PR #403) — all 8 bullets resolved	~180
ServerMetrics.getCumulativeTimings() truncation — a claim verified false, with the real fix landed elsewhere	10
SpotBugs effort=Max + threshold=Low — re-checked: llama/pom.xml carries both, bound to verify	10

That b10618 section also carried a "How to read the CI evidence" preamble — diagnostic scaffolding for a closed investigation, down to a "two items were fixed, four are open" count that had been wrong for a while. It goes with the section.

The four see the Done section cross-references are rewritten rather than left pointing at nothing.

One thing in there was not history, and it is kept

The SpotBugs entry ended with a live warning: spotbugs:check binds to verify, so neither mvn test nor mvn package runs it.

That gap reddened main this week. The design-intent OCP_OVERLY_CONCRETE_PARAMETER suppression in llama/spotbugs-exclude.xml lists methods by name, so renaming setTensorReadLazy to setLazyMode in #408 left a dead entry while the new setLazyMode and setFlashAttn were never covered — #408 passed every local gate and still broke the pipeline (fixed in #409).

So the warning moves into CLAUDE.md, where guidance for working in this repo belongs, with the exact command the failing CI job runs and the rule that renaming or adding an enum-valued ModelParameters setter means updating that suppression list in the same commit — the same "FQN not updated after a rename" class as the stale PIT targetClasses and CMakeLists.txt OSInfo repairs.

Test plan

• Every removed bullet asserted to carry [FIXED] / [SUPERSEDED] / [ANSWERED] by the script, not by eye
• No dangling Done section references left (asserted after rewriting)
• Remaining structure reviewed section by section: all 50 surviving bullets are genuinely open work
• Diff is TODO.md + CLAUDE.md only — no source, test or build file touched
• CI is green on this branch — docs-only, but let it run

Related issues / PRs

Follows #409. Part of a four-repo pass; siblings are the matching claude/todo-cleanup branches in BitcoinAddressFinder, srcmorph and streambuffer.

Checklist

• I have read CONTRIBUTING.md and CODE_OF_CONDUCT.md
• My commits follow Conventional Commits
• No security-sensitive changes

---

Generated by Claude Code

[claude]

Documentation cleanup reviewed. This PR removes completed work from TODO.md and moves SpotBugs guidance to CLAUDE.md. Changes are well-executed:

• Script-driven validation ensures only completed items were removed
• SpotBugs guidance appropriately moved to CLAUDE.md for developer reference
• All cross-references updated correctly
• Documentation-only changes (no source code modifications)
• spotbugs-exclude.xml exists and is referenced correctly

No issues found. Recommendation: Ready to merge.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud