docs(roadmap): T-04-E is 95 of 129 after the Group E batch

Counts re-derived from docs/accuracysnes-coverage.md, which regenerates with
the ROM, rather than from the hand-maintained estimate the row carried.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: doublegate

to-dos/ROADMAP.md

@@ -445,7 +445,7 @@ constraints live in **`docs/accuracysnes-plan.md`**; this list is the citable ID
 | **T-04-B** | Group B — 5A22 bus, clock, timing. **Started:** access speed, `RDNMI` mechanics, IRQ timers, frame geometry, multiply/divide + power-on shipped (14 tests, 2 emulator defects found). Left: `B2` scanline geometry, `B3` DRAM refresh — **unblocked**, write as golden vectors per the `D3` precedent (see the plan §4) — and the rest of `B4` | ~16 | nothing |
 | **T-04-C** | The rest of register-observable Group C — `C1.07`/`C1.08`, the 9/10-bit `VMAIN` rotations, CGRAM-during-render, `C7.04`–`C7.09`, `C9.05`, `C11.07`/`C11.08` | ~20 | nothing |
 | **T-04-D** | Group D — DMA / HDMA. **Started:** 15 tests — GP-DMA (`D1.01`-`D1.07`, `D1.09`/`D1.15`, `D1.10`) and HDMA (`D2.03`-`D2.06`). Found two defects: the unmodelled `$43xB` scratch latch and a WRAM->`$2180` transfer that wrote when hardware does not. **The blocker below is over-broad — re-scoped 2026-07-21.** Most uncovered rows carry specific, actionable content and need no new research: `D1.08` (invalid A-bus addresses, `[ERRATA]`, with the address list enumerated), `D1.13` (DMA reads update open bus, writes never do), `D1.14` (`$2180` B->A asymmetry, quoted verbatim with its +4 clocks), `D2.07` (HDMA preempts GP-DMA, which pauses and resumes), `D2.08` (`$420C` mid-frame starts the channel next line). **Genuinely thin and still needing sources:** `D1.11` (power-on state — names a game, not a mechanism), `D1.12` (CPU timing before DMA start), `D2.01` (init at "H~6", an approximation no test can assert). | ~20 | **partial** — only `D1.11`/`D1.12`/`D2.01` are actually source-blocked; the rest are writable now |
-| **T-04-E** | Group E — APU (SPC700 + S-DSP). **Unblocked and started:** `apu_upload` implements the IPL boot handshake and `gen/src/spc.rs` assembles SPC700 programs, so the cart can upload code, run it and read results through the four ports. `E1.01` landed and is cross-validated | ~75 | an **on-cart APU harness** (IPL upload, results back through `$2140`–`$2143`) |
+| **T-04-E** | Group E — APU (SPC700 + S-DSP). **Unblocked and started:** `apu_upload` implements the IPL boot handshake and `gen/src/spc.rs` assembles SPC700 programs, so the cart can upload code, run it and read results through the four ports. `E1.01` landed and is cross-validated. **2026-08-01:** `E8.01`, `E9.02` and `E5.06` land (PR #298), taking the group to **95 of 129** enumerated assertions; `E8.01`'s two rejected drafts are recorded in `docs/accuracysnes-plan.md` as the reference case for why a *delay* cannot measure a poll period | ~34 | an **on-cart APU harness** (IPL upload, results back through `$2140`–`$2143`) |
 | **T-04-F** | Group F — input | ~22 | a decision on the **on-cart / host-driven split**: a cart cannot press its own buttons |
 | **T-04-G** | Group G — power-on / reset / cartridge, mostly golden vectors | ~18 | ~~boot-path ordering~~ **UNBLOCKED** — `capture_power_on` samples before `init_registers` into a documented capture block; `B5.05` is the first consumer |
 | **T-04-I** | The 256-opcode cycle sweep (`A5.01`–`A5.08`) | 1 mechanism | ~~an external timing table~~ **ORACLE ESTABLISHED** — `docs/accuracysnes-timing-oracle.md`. The 5A22 is a stock WDC core plus a wait-state generator, so WDC Table 5-7 (VDA/VPA cycle classification) + the SNES speed map is emulator-independent and sufficient. Remaining: safe-operand table + sandbox. `STP` excluded — it halts until reset |