diff --git a/TODO.md b/TODO.md
new file mode 100644
index 0000000..918622a
--- /dev/null
+++ b/TODO.md
@@ -0,0 +1,90 @@
+# Live queue
+
+## Current scope
+
+Harden Sized for reuse by the native SpaceMonger-inspired SizeQueen project.
+The user authorized fixes and updates discovered during that investigation.
+Keep the existing CLI useful and preserve the GPL-3.0-only license.
+
+- [x] Correct allocated-size totals for hard links; retain apparent per-path
+  sizes and define deterministic ownership within each scan.
+- [x] Preserve scan errors and expose incomplete results instead of silently
+  treating missing paths as accessible empty directories.
+- [x] Expose cancellable scans, progress counters, per-scan worker selection,
+  and an optional filesystem boundary for the native UI.
+- [x] Add accounting and control regressions; run the existing CLI tests and
+  compare bounded release-build scan measurements.
+- [x] Run reproducible Linux ARM64 and AMD64 Docker checks as an unprivileged
+  user, including actual mount boundaries, strict Clippy and a release smoke test.
+- [x] Commit the scanner hardening and Linux check tooling; push the existing
+  `sizequeen-scan-hardening` review branch. Remote equality is verified.
+  Open a PR when ready; release/tag/package publication remains separate.
+
+## Proposed next work
+
+SizeQueen now includes a byte-identical scanner snapshot in a small core crate,
+removing terminal dependencies and allowing independent builds. Extract that
+shared core upstream in a separate PR after the behaviour changes are reviewed;
+terminal formatting is already separate from scan logic.
+Windows allocation support and very-large/deep-tree tuning need separate evidence.
+README/MANUAL/Cargo metadata still contain legacy GitLab addresses; reconcile
+them against available Gitea releases before changing distribution instructions.
+Before producing release assets, fix and verify `scripts/release.sh`: it currently
+creates the tarball before copying the executable into its input directory.
+Do not release/tag/publish automatically. The requested review-branch push is
+authorized; see `SHIPMENT.md` for source review and the separate release process.
+
+## Resume note
+
+Linux validation and the requested remote review branch are complete.
+Scanner hardening is `8b177e2`; repeatable Linux checks and equivalent format
+interpolations are `988aad9`. Both implementation commits are pushed to
+`origin/sizequeen-scan-hardening`; SSH verified remote/local equality at
+`988aad99510c0424cf0db5a116d9086183da74a5`. Gitea main remains `9c8d1d4`.
+The repository was already public (`private: false`); visibility is unchanged.
+No PR, merge, tag, package publication or release occurred.
+
+`scripts/check-linux.sh` owns the container workflow. Linux ARM64 (native in
+Docker's VM) and AMD64 (emulated on this Mac) each passed 23 tests as UID 65532:
+5 library, 6 CLI, 11 scan integrations and one explicitly enabled real-mount
+integration. `tests/linux_mount.rs` checks two distinct tmpfs devices through
+the library and CLI, with boundaries enabled and disabled. Formatting, strict
+all-target Clippy and an optimized-binary fixture smoke test passed on both.
+Mac passed its 22 applicable tests, formatting and strict Clippy. Commands are
+documented in README/SHIPMENT; full local logs are in ignored
+`target/linux-checks/{arm64,amd64}.log`. Cargo.lock and unrelated `.DS_Store`
+hashes are unchanged; only source inputs and owned fixtures enter the checks.
+
+Rust 1.88 Clippy identified format-string style warnings; equivalent
+interpolations fix those without suppressions. SizeQueen's included scanner
+still matches `8b177e2` exactly; the follow-up changes only one scanner Display
+format string, not scan behaviour. SizeQueen itself was unchanged in this pass.
+Next: open/review a PR against main, calling out CLI partial-scan status and
+library/API changes. Keep shared-core extraction as the following proposed PR,
+then choose a release version and repair/verify packaging when release work
+is authorized. These checks do not prove desktop X11/Wayland interaction,
+Windows allocation or performance on very large/cold/remote trees.
+
+Previous local checkpoint: baseline `9c8d1d4` matched Gitea main;
+branch `sizequeen-scan-hardening`.
+All six baseline tests passed. SizeQueen's independent probe reproduced
+hard-link overcount and missing-path misclassification, and confirmed sparse
+allocation, symlink leaf handling, and hidden-file inclusion. Source inspection
+found discarded walker errors and no scan control API. These scoped corrections
+are implemented locally, with no push, tag, or release. `cargo test --locked`
+passed 22 tests (5 library, 6 CLI, 11 scan integrations); strict all-target
+Clippy passed. The independent SizeQueen probe passed 6 accounting tests.
+Man page was regenerated. Cargo.lock is unchanged and unrelated `.DS_Store`
+was preserved.
+
+Release probes on the Mac took 49–56ms for 20,000 files; sorting, identity
+tracking, diagnostics and control cost more than the baseline (29–39ms for
+the grouped tree). Inline Node size grew from 88 to 136 bytes; whole-process
+peak RSS was about 8.2MiB grouped / 16.7MiB wide. These are bounded warm-metadata
+fixtures, not evidence for million-entry, cold-disk, or remote-filesystem speed.
+Cancellation is cooperative between filesystem calls. Allocation is reported
+blocks, not guaranteed bytes recoverable from shared extents or snapshots.
+
+Detailed audit and bounded probes are maintained in the sibling SizeQueen
+project at `../sizequeen/research/SIZED-AUDIT.md`; that project's product queue
+remains separate from this backend's fix queue.