Record live Sized project and verified release cleanup

SHIPMENT.md

@@ -31,7 +31,8 @@ cliff-mads, overriding the job image with the pinned Sized Rust runtime.
 The runner itself launches the two tmpfs mounts. Jobs have no Docker socket
 and run `scripts/check-linux-container.sh` as UID 65532, using the checked-out
 workspace as `SIZED_TEST_SOURCE`. Its tests, strict Clippy, formatting and
-optimized-binary smoke test are the same as the local Docker workflow.
+optimized-binary smoke test and extracted release-archive verification are the
+same as the local Docker workflow.
 
 The runtime contains Rust 1.88.0, rustfmt/Clippy and Node for the pinned checkout
 action. On cliff-mads, rebuild it explicitly with:
@@ -55,8 +56,11 @@ The first complete native AMD64 push check is
 [Gitea run 1048 (number 2)](https://gitea.speelman.ca/gamertan/sized/actions/runs/1048),
 at `74b30bbf750417121f3b0c26017d2f011a2a8286`. All 23 tests, formatting, strict
 Clippy, release smoke and unchanged-checkout verification passed as UID 65532
-on `cliff-himesan-linux-amd64`. PR and manual-dispatch events are configured;
+on `cliff-himesan-linux-amd64`. The packaging source checkpoint `77b11a8`
-only push execution has been exercised. See `TODO.md` for the current checkpoint.
+subsequently passed [push run 1065](https://gitea.speelman.ca/gamertan/sized/actions/runs/1065)
+and [PR run 1066](https://gitea.speelman.ca/gamertan/sized/actions/runs/1066),
+including executable/archive checks and output/symlink refusal. Manual dispatch
+is configured but not independently exercised. See `TODO.md` for current work.
 
 ## 1. Versioning and Tagging
 

TODO.md

@@ -18,7 +18,7 @@ Keep the existing CLI useful and preserve the GPL-3.0-only license.
   user, including actual mount boundaries, strict Clippy and a release smoke test.
 - [x] Commit the scanner hardening and Linux check tooling; push the existing
   `sizequeen-scan-hardening` review branch. Remote equality is verified.
-  Open a PR when ready; release/tag/package publication remains separate.
+  PR #2 is open; release/tag/package publication remains separate.
 - [x] Enable repository Actions and run the same Linux checks on the existing
   cliff-mads runner. Keep its container isolation and other jobs unchanged;
   verify a real workflow result before treating CI as proven.
@@ -39,8 +39,9 @@ on SizeQueen. Website delivery is tracked in that repository's existing queue.
   Remove incidental installer generation; host binaries must not become `.deb`s.
 - [x] Verify archive contents/checksum, run the extracted CLI and test overwrite
   refusal on macOS arm64. Add the same verification to Linux CI.
-- [ ] Verify the updated cliff-mads workflow, push the review checkpoint and
+- [x] Verify the updated cliff-mads workflow, push the review checkpoint and
-  record the public CMS delivery. No new version, release assets or merge yet.
+  record the public CMS delivery. PR #2 is open; no new version, release assets
+  or merge. Historical v1.0.0 notes are corrected and asset bytes preserved.
 
 ## Deferred / next release
 
@@ -54,8 +55,43 @@ scan tuning remain separate work. See `SHIPMENT.md` for the release process.
 
 ## Resume note
 
-Current work: the approved project page and packaging cleanup above. Local Mac
+The approved Sized project page and release cleanup are delivered. Source
-archive verification passes; updated Linux CI and CMS publication are pending.
+checkpoint `77b11a8c29b5ca3435fdd962717f8e8285abe972` is pushed on
+`sizequeen-scan-hardening`; [PR #2](https://gitea.speelman.ca/gamertan/sized/pulls/2)
+is open against unchanged `main`. Repository visibility remains public.
+
+Final cliff-mads checks passed for both events:
+[push run 1065](https://gitea.speelman.ca/gamertan/sized/actions/runs/1065)
+(4m 57s) and
+[PR run 1066](https://gitea.speelman.ca/gamertan/sized/actions/runs/1066)
+(5m 0s). Rust 1.88.0 / Linux AMD64 / UID 65532 passed all 23 tests, formatting,
+strict Clippy, optimized smoke, archive extraction/checksum/executable and
+existing-output/dangling-symlink guards, plus unchanged-checkout verification.
+Mac arm64 passed the same package checks and documented Cargo/Make installs into
+temporary prefixes. Ignored local evidence is in `target/release-audit/`,
+including `gitea-run-1065.txt`, `package-macos.log` and `install-macos.log`.
+
+[Sized](https://gamertan.com/projects/sized/) is published through the shared
+Gamertan project template (CMS revision 6), with a compact status sidebar,
+verified synthetic CLI example, source instructions and accurate release limits.
+It appears on the homepage, project index and sitemap. SizeQueen's
+[Built on Sized section](https://gamertan.com/projects/sizequeen/) is published
+in revision 14; all prior sections and app downloads are preserved. Desktop
+and 320px mobile checks passed. Website evidence and recovery are recorded in
+`../gamertancom-web-foundations/docs/PRODUCTION_SANDBOX_2026-09-04.md` under
+“Sized project and Built on Sized — 10 October 2026”.
+
+Historical v1.0.0 release notes now identify the attached executable as macOS
+arm64 and distinguish the newer review branch. Asset IDs, lengths and executable
+SHA-256 above remain unchanged. No new binary release, tag, merge or private-core
+source publication occurred. Next: review PR #2's CLI exit status, JSON and
+library API changes, then choose a release version and complete corresponding
+source/dependency notices before authorizing new binary publication.
+
+### Earlier verification history
+
+The records below describe previous checkpoints; current delivery and next
+actions are above.
 
 Previous CI checkpoint: repository Actions is enabled and a real native AMD64
 push run passed on cliff-mads. [Gitea run 1048 (number 2)](https://gitea.speelman.ca/gamertan/sized/actions/runs/1048)
@@ -69,7 +105,8 @@ the corrected runtime pre-owns it for the job user. The workflow reuses the
 existing `himesan-node24` label and a local, pinned Rust/Node image. Runner
 configuration, other jobs and repository visibility are unchanged. Temporary
 setup credentials were revoked and their files removed. Push execution is
-proven; PR/manual-dispatch triggers are configured but not independently run.
+proven; PR execution was subsequently proven in run 1066; manual dispatch remains
+configured but not independently exercised.
 
 Linux validation and the requested remote review branch are complete.
 Scanner hardening is `8b177e2`; repeatable Linux checks and equivalent format
@@ -79,7 +116,7 @@ unprivileged checkout fix `74b30bb`. The source checkpoint is verified remotely
 at `74b30bbf750417121f3b0c26017d2f011a2a8286`; later documentation-only
 checkpoint commits do not rerun the source checks. Gitea main remains `9c8d1d4`.
 The repository was already public (`private: false`); visibility is unchanged.
-No PR, merge, tag, package publication or release occurred.
+At that checkpoint, no PR, merge, tag, package publication or release occurred.
 
 `scripts/check-linux.sh` owns the container workflow. Linux ARM64 (native in
 Docker's VM) and AMD64 (emulated on this Mac) each passed 23 tests as UID 65532:
@@ -96,10 +133,8 @@ Rust 1.88 Clippy identified format-string style warnings; equivalent
 interpolations fix those without suppressions. SizeQueen's included scanner
 still matches `8b177e2` exactly; the follow-up changes only one scanner Display
 format string, not scan behaviour. SizeQueen itself was unchanged in this pass.
-Next: open/review a PR against main, calling out CLI partial-scan status and
+The planned PR and packaging repairs are now complete; review and version
-library/API changes. Keep shared-core extraction as the following proposed PR,
+selection remain next. These checks do not prove desktop X11/Wayland interaction,
-then choose a release version and repair/verify packaging when release work
-is authorized. These checks do not prove desktop X11/Wayland interaction,
 Windows allocation or performance on very large/cold/remote trees.
 
 Previous local checkpoint: baseline `9c8d1d4` matched Gitea main;