diff --git a/README.md b/README.md
index 8f33985..4f46c88 100644
--- a/README.md
+++ b/README.md
@@ -47,7 +47,7 @@ The choice and configuration of each tool above is the result of deliberate trad
 - **`check:tsc` runs first** in the `npm run check` chain so a type error short-circuits the rest (faster feedback than letting oxlint/oxfmt run and then failing on tsc at the end).
 - **The pre-commit hook sets the `LEFTHOOK_FILES` env var** to the staged-files list, and the affected scripts use `${LEFTHOOK_FILES:-<default>}` to default to the whole project when invoked manually. This keeps `package.json#scripts` as the single source of truth for the underlying commands — `lefthook.yml` only describes _what to run on which files_.
 - **`tslib` and `type-fest` are deliberately not used.** `tslib` is a runtime helper for old ES3/ES5 targets (the project targets ES2024); `type-fest` was never imported. knip caught both.
-- **`@spences10/pi-lsp` is pinned to `0.0.46` and is read-only by design.** The package inspects `node_modules/typescript`, sees major ≥ 7 with no `lib/tsserver.js` (true of the `typescript-go` / `tsgo` port), and spawns the repo's own `tsc --lsp --stdio` binary — no `typescript-language-server` dependency is required. Earlier releases (`≤ 0.0.10`) hard-wire to `typescript-language-server --stdio` and are TS6-only. The tool is _intermediate_ agent feedback (hover, references, definition, symbols, diagnostics); it has no rename / code-action / apply-edit surface, and never a correctness gate — `npm run check` / `verify` remain that.
+- **`@spences10/pi-lsp` is pinned to `0.0.46` and is read-only by design.** The package inspects `node_modules/typescript`, sees major ≥ 7 with no `lib/tsserver.js` (true of the `typescript-go` / `tsgo` port), and spawns the repo's own `tsc --lsp --stdio` binary — no `typescript-language-server` dependency is required. Earlier releases (`≤ 0.0.10`) hard-wire to `typescript-language-server --stdio` and are TS6-only. The tool is _intermediate_ agent feedback (hover, references, definition, symbols, diagnostics); it has no rename / code-action / apply-edit surface, and never a correctness gate — `npm run check` / `verify` remain that. `.pi/settings.json` is the shared, committed declaration; `.pi/npm/` is a gitignored install cache that pi recreates automatically on a trusted startup (it runs `npm install` for any missing project package), so the cache is deliberately not tracked.
 
 ### Requirements
 
diff --git a/backlog.tasks b/backlog.tasks
index 51592d7..64c4c61 100644
--- a/backlog.tasks
+++ b/backlog.tasks
@@ -8,11 +8,10 @@ Setup:
 ✔ Establish release CI workflow: post-tag checks + npm publish after release tag push => pi --session 01a06e72-e61e-7327-b3e9-3e11749a523f @high @done (9/11/2026, 12:37:35 AM)
 ☐ Add gitea release page in CI @high
 ☐ Split off template into separate package => pi --session 01a07dde-7050-7054-bb36-1606d7eb2bc3 @high
-☐ Make the pi-lsp install reproducible
+✔ Make the pi-lsp install reproducible @done
     - `.pi/npm/.gitignore` is `*` / `!.gitignore`, so only `.gitignore` is committed; `.pi/npm/package.json` and `package-lock.json` are untracked
     - the README insists `@spences10/pi-lsp` is "pinned to 0.0.46", but the lockfile that pins the transitive tree does not survive a fresh clone
-    ☐ Commit `.pi/npm/package.json` + `package-lock.json` (recommended: treat it as a dev-environment lockfile, same class as the root one)
-    ☐ Or document that pi self-installs the extension and the pin is advisory — decide which
+    ✔ Resolved by design, no change: `.pi/settings.json` is the shared committed declaration (`npm:@spences10/pi-lsp@0.0.46`), and `.pi/npm/` is a gitignored install cache pi recreates on a trusted startup (settings.md: trusting a project allows pi to "install missing project packages"). The .gitignore is intentional; the exact pin lives in the committed settings file. README clarified @done
 ✔ Gate the emit path in `npm run verify` @done
     - `verify = check + test:unit`; `check:tsc` uses the root config (`noEmit: true`), so `tsconfig.build.json` is only exercised by `build`
     - a broken build config (bad `rootDir`, emit-option typo) passes `verify` and only fails in CI