📝 Track setup-phase review findings in the backlog

Record the tooling, CI and docs gaps found reviewing the setup phase
(src/ is placeholder code and was excluded from the review).

The entries cover pi-lsp install reproducibility, gating the emit path
in verify, .ts extensions left in emitted .d.ts, pi-lsp false-positive
diagnostics, CI packaging checks and artifact reuse, pre-push gate
strength, plus low-impact cleanups (clean target, redundant fields,
knip false positive, sourcemap sources, doc drift).

backlog.tasks

@@ -5,9 +5,52 @@ Backlog and tracking for tiny-pattern-ts. Managed in vscode-todotasks format.
 ---
 
 Setup:
-☐ Establish release CI workflow: post-tag checks + npm publish after release tag push => pi --session 01a06e72-e61e-7327-b3e9-3e11749a523f @high
+✔ Establish release CI workflow: post-tag checks + npm publish after release tag push => pi --session 01a06e72-e61e-7327-b3e9-3e11749a523f @high @done (9/11/2026, 12:37:35 AM)
 ☐ Add gitea release page in CI @high
 ☐ Split off template into separate package => pi --session 01a07dde-7050-7054-bb36-1606d7eb2bc3 @high
+☐ Make the pi-lsp install reproducible
+    - `.pi/npm/.gitignore` is `*` / `!.gitignore`, so only `.gitignore` is committed; `.pi/npm/package.json` and `package-lock.json` are untracked
+    - the README insists `@spences10/pi-lsp` is "pinned to 0.0.46", but the lockfile that pins the transitive tree does not survive a fresh clone
+    ☐ Commit `.pi/npm/package.json` + `package-lock.json` (recommended: treat it as a dev-environment lockfile, same class as the root one)
+    ☐ Or document that pi self-installs the extension and the pin is advisory — decide which
+☐ Gate the emit path in `npm run verify`
+    - `verify = check + test:unit`; `check:tsc` uses the root config (`noEmit: true`), so `tsconfig.build.json` is only exercised by `build`
+    - a broken build config (bad `rootDir`, emit-option typo) passes `verify` and only fails in CI
+    ☐ Add `build` to `verify` (or to `check`)
+☐ Fix `.ts` extensions in emitted `.d.ts`
+    - emitted JS rewrites `./pattern.ts` → `./pattern.js`, but `dist/*.d.ts` still imports `"./pattern.ts"` / `"./match.ts"`
+    - resolves under TS7, but a portability risk for older resolvers/bundlers; `attw` does not catch it
+    ☐ Fix the declaration emit (`.d.ts` post-step) or stop using relative `.ts` in the declaration surface
+    ☐ Reconcile the README/CONTRIBUTING claim that `rewriteRelativeImportExtensions` yields "conventional ESM imports"
+    ☐ Add a consumer-resolution test to the suite (durable guard; `attw` currently misses it)
+☐ Document pi-lsp false-positive diagnostics
+    - `lsp_diagnostics` reports TS1295/TS1287 "CommonJS file under `verbatimModuleSyntax`" errors that `check:tsc` never produces — the server is not picking up the repo's `tsconfig.json`
+    - AGENTS.md only warns that empty LSP output is inconclusive, not that it can emit false errors
+    ☐ Add a line to AGENTS.md: ignore LSP errors that `check:tsc` does not reproduce
+    ☐ Or fix the LSP server configuration so it picks up `tsconfig.json`
+☐ Run packaging checks in CI `build`
+    - `publish:publint` / `publish:attw` only run in the tag-triggered `publish` job, so a PR that breaks packaging stays green until release
+    ☐ At minimum add `publish:publint` to the `build` job (offline, fast); `attw` needs a pack
+☐ Publish the exact artifact CI tested
+    - `publish: needs: build`, then re-runs `npm ci` + `build` from scratch, discarding the tested output
+    - tag push pays a double build and the two builds could differ
+    ☐ Persist `dist/` as an artifact in `build` and consume it in `publish`
+☐ Confirm pre-push gate strength
+    - pre-push runs `npm test` (`check:tsc` + tests), not full `check`; oxlint/oxfmt/cspell drift on unstaged content is only caught per-staged-file at commit or whole-project in CI
+    ☐ Confirm this is intended per the feedback-tier table, or point pre-push at `verify`
+☐ Clean stale `coverage/` in `npm run clean`
+    ☐ `npm run clean` only removes `dist`; add `coverage` (both are gitignored but bloat the working tree)
+☐ Drop redundant `main`/`types` top-level fields
+    ☐ `exports` is the source of truth; `main`/`types` are redundant (harmless, but publint/ATTW prefer `exports`)
+☐ Silence the knip `@runwisp/pubv` false positive
+    - `pubv` is a CLI invoked by `release.sh`, not imported, so knip flags it as an unused devDependency and advisory output stays permanently red
+    ☐ Add a knip `ignoreDependencies` entry
+☐ Resolve sourcemap sources for consumers
+    - `dist/*.map` `sources` are `../src/*.ts`, but `src` is not in `files`, so debuggers get missing sources
+    ☐ Ship `src`, or disable `sourceMap`/`declarationMap` for the published artifact
+☐ Sweep doc/formatter drift before v1.0
+    ☐ README says `--experimental-strip-types`; scripts use `--strip-types`
+    ☐ `.vscode/settings.json` bundles `[markdown]`/`[yaml]` oxfmt formatters separately from `.oxfmtrc.json`'s `ignorePatterns` — align
 ✔ Document branching model @done
     ✔ Describe branching model: when to branch, base branch, naming @done
     ✔ Clarify release workflow: who pushes `main`, CI as post-merge gate, drop PR usage @done (9/8/2026, 2:54:32 PM)