diff --git a/backlog.tasks b/backlog.tasks
index da07e72..d468254 100644
--- a/backlog.tasks
+++ b/backlog.tasks
@@ -19,9 +19,21 @@ Setup:
 ☐ Fix `.ts` extensions in emitted `.d.ts`
     - emitted JS rewrites `./pattern.ts` → `./pattern.js`, but `dist/*.d.ts` still imports `"./pattern.ts"` / `"./match.ts"`
     - resolves under TS7, but a portability risk for older resolvers/bundlers; `attw` does not catch it
+    - HANDOVER (setup-phase review, unfixed — emit work deferred out of that session):
+        - verified current state: `tsconfig.build.json` has `rewriteRelativeImportExtensions: true`; it rewrites the JS (dist/match.js → `./pattern.js`) but NOT the declarations (dist/index.d.ts, dist/match.d.ts keep `.ts`)
+        - `npm run build` + `publish:publint` + `publish:attw` + a packed-consumer `tsc -p` all pass today, so this is a portability/robustness fix, not a broken-build fix — don't expect a red gate to confirm it works
+        - the durable proof is a consumer-resolution typecheck that asserts types still flow (a deliberately-wrong assignment must error), not just exit 0 — TS7 resolution silently tolerates the `.ts` form, so a green run alone proves nothing
+        - two directions: (a) post-process the `.d.ts` imports to `.js` in the build, or (b) stop emitting relative `.ts` on the declaration surface (e.g. build-only source or an internal barrel). Either way reconcile the README/CONTRIBUTING sentence claiming the option yields "conventional ESM imports" for consumers
     ☐ Fix the declaration emit (`.d.ts` post-step) or stop using relative `.ts` in the declaration surface
     ☐ Reconcile the README/CONTRIBUTING claim that `rewriteRelativeImportExtensions` yields "conventional ESM imports"
     ☐ Add a consumer-resolution test to the suite (durable guard; `attw` currently misses it)
+☐ Resolve sourcemap sources for consumers
+    - `dist/*.map` `sources` are `../src/*.ts`, but `src` is not in `files`, so debuggers get missing sources
+    - HANDOVER (setup-phase review, unfixed — emit work deferred out of that session):
+        - verified: every `dist/*.map` (js and d.ts) has `sources: ["../src/<file>.ts"]`, and `package.json#files` ships only `dist`, `CHANGELOG.md`, `README.md`, `LICENSE` — so those paths point at files the consumer never receives
+        - decide between shipping `src` in `files` (keeps go-to-definition working, slightly larger tarball) or dropping `sourceMap`/`declarationMap` from `tsconfig.build.json` (smaller, no broken references). Shipping `src` is usually the better library DX
+        - overlaps the `.d.ts` item above: both are emit-surface changes, so doing them in one branch/commit avoids rebuilding that config twice
+    ☐ Ship `src`, or disable `sourceMap`/`declarationMap` for the published artifact
 ✔ Document pi-lsp false-positive diagnostics @done
     - `lsp_diagnostics` reported TS1295/TS1287 "CommonJS file under `verbatimModuleSyntax`" errors that `check:tsc` never produced
     - root cause: an earlier local test emptied package.json; the still-running TS7 server (5 min idle timeout) kept the corrupted project state alive and reported it against the real files
@@ -47,6 +59,7 @@ Setup:
 ☐ Resolve sourcemap sources for consumers
     - `dist/*.map` `sources` are `../src/*.ts`, but `src` is not in `files`, so debuggers get missing sources
     ☐ Ship `src`, or disable `sourceMap`/`declarationMap` for the published artifact
+
 ✔ Sweep doc/formatter drift before v1.0 @done
     ✔ README says `--experimental-strip-types`; scripts use `--strip-types` @done
     ✔ `.vscode/settings.json` bundles `[markdown]`/`[yaml]` oxfmt formatters separately from `.oxfmtrc.json`'s `ignorePatterns` — align @done