diff --git a/cspell-allow-list.txt b/cspell-allow-list.txt
index 9b26c3c7c..3b1f796ab 100644
--- a/cspell-allow-list.txt
+++ b/cspell-allow-list.txt
@@ -67,6 +67,7 @@ behaviour
 behaviours
 beyang
 bgwriter
+bingbot
 binutils
 bitbucketcloud
 bitbucketserver
@@ -407,6 +408,7 @@ pooler
 PREEMPTIBLE
 preg
 premade
+prerender
 prerendered
 Príncipe
 privkey
diff --git a/dev/TODO.md b/dev/TODO.md
new file mode 100644
index 000000000..ab4378fb7
--- /dev/null
+++ b/dev/TODO.md
@@ -0,0 +1,64 @@
+# TODO
+
+Vercel project `sourcegraph-docs`. One PR per task; delete a task when
+its PR merges.
+
+## 1. Node 20 build image is deprecated (separate thread)
+
+Node 20.x deployments fail after 2026-10-01. `contentlayer` 0.3.4 emits
+`assert { type: 'json' }`, which Node ≥ 22 rejects. Migrate to
+`contentlayer2` / `next-contentlayer2` ≥ 0.5.0, then set Node 22 in
+`.tool-versions` and `package.json#engines`.
+
+## 2. 24 MB shared JS chunk on every page
+
+`src/components/Toc.tsx` and `src/components/ContentTabs.jsx` are
+`'use client'` and import `allPosts`, so every post's raw and compiled
+body ships in one client chunk (`7180-*.js`: 24.4 MB raw, 2.78 MB gzip,
+re-downloaded after every deploy). Fix: resolve the post on the server
+in `src/app/[...slug]/page.tsx` and pass only what each component needs
+as props (`Toc`: the post `_id`; `ContentTabs`: the rendered fallback
+tab), then drop the `allPosts` imports.
+
+## 5. Runtime
+
+- Skip builds for non-site changes: #1901.
+- Prerender `/api/md/[...slug]`, enable Fluid compute: #1912 (stacked on
+  #1901; change its base to `main` after it merges).
+- Static redirects out of middleware: draft #1907 (rebase on `main` now
+  that #1908 merged).
+
+## 6. Build
+
+- Lint warnings and stale `caniuse-lite`: draft #1909.
+
+## 7. Doubled base path 404s and wrong canonical
+
+`sourcegraph.com/docs/docs/_next/...` 404s are bingbot following the
+Cloudflare **302** from `docs.sourcegraph.com/<page>` and resolving the
+page's `/docs/_next/...` asset URLs against the old host.
+
+- Cloudflare: make the `docs.sourcegraph.com` redirect a 301, and
+  redirect `docs.sourcegraph.com/docs/*` to `sourcegraph.com/docs/$1`
+  without doubling the prefix.
+- Repo: every page emits `<link rel="canonical" href="https://sourcegraph.com/docs">`
+  (`src/app/layout.tsx` `alternates.canonical: '/docs'`). Set a per-page
+  canonical in `src/app/[...slug]/page.tsx#generateMetadata`.
+
+## 8. GitHub repo settings (needs an org admin)
+
+Already on: delete branch on merge, squash-only merges, auto-merge,
+squash title/body from PR, `main` ruleset blocks deletion and force-push
+and requires a PR with 1 approval.
+
+- Add required status checks to the `main` ruleset: the link check and
+  the Vercel build. Today "Broken links introduced by this PR" and
+  "CSpell (advisory)" can be red and the PR still merges.
+- Add a "Require signed commits" rule to the `main` ruleset.
+- Turn off `allow_update_branch` ("Always suggest updating PR branches");
+  the button rewrites commits unsigned.
+- Turn on `dismiss_stale_reviews_on_push`; consider
+  `require_last_push_approval` and `required_review_thread_resolution`.
+- Turn off Projects (`has_projects`); Issues are already off.
+- Add `CODEOWNERS` and `.github/dependabot.yml`; confirm Actions
+  permissions and Dependabot alerts are on (not readable without admin).