diff --git a/TASKS.md b/TASKS.md
new file mode 100644
index 0000000..415f907
--- /dev/null
+++ b/TASKS.md
@@ -0,0 +1,39 @@
+# TASKS
+
+## Authentication & Identity
+- [ ] Cover register success behavior: trims username/display name, enforces 24/16 char caps, issues auth cookie, stores normalized username (no plain passwords).
+- [ ] Add register/login rejection cases for overlength usernames/display names and ensure login success sets LastLoginAt + fills DisplayName when null.
+- [ ] Verify admin claim/authorization end-to-end: admin cookie includes claim; non-admin hitting `/api/admin/*` returns 401/403.
+
+## State & Phase
+- [ ] Assert `/api/state` payload fields (currentPhase, votesFinal, hasJoker, counts) for authenticated user.
+- [ ] Test GetPhase alignment: legacy Reveal -> Vote; closing results (resultsOpen false) realigns users from Results to Vote and clears VotesFinal.
+- [ ] Add `/api/me/phase/next` happy path to Results when resultsOpen=true and ensure VotesFinal clears on advance; cover Suggest->Vote success.
+- [ ] Ensure `/api/me/phase/prev` clears VotesFinal and respects per-step back transitions; add name limit >16 rejection.
+
+## Suggestions
+- [ ] Enforce phase gating on create for non-admins outside Suggest (no joker) and require display name before create.
+- [ ] Add validation cases: invalid game/youtube URLs, missing/overlong name (>100), player count ranges (min<1, max>32, only one of min/max provided), trimming/truncation of optional fields.
+- [ ] Verify `/api/suggestions/mine` excludes other players; `/api/suggestions/all` returns ordered list with LinkedIds/LinkedTitles metadata.
+- [ ] Test DELETE: player can delete own in Suggest only; admin any time; links to children cleared and related votes removed.
+- [ ] Joker create path should unfinalize all players’ ballots, not just the caller.
+
+## Votes
+- [ ] Guard `/api/votes/mine` for auth/phase mismatch; reject negative scores too.
+- [ ] Cover finalize toggle back to false and phase-change unfinalization; ensure VotesFinal blocks edits and resets correctly.
+- [ ] Add linked-vote coverage for nested/root-detection cases (e.g., chains) to ensure scores fan out as expected.
+
+## Results
+- [ ] Require Results phase and auth even when resultsOpen=true (phase mismatch/unauth 400/401).
+- [ ] Validate results payload fields: totals/count/average (average=0 when no votes), MyVote, link metadata, ordering by average.
+
+## Admin Operations
+- [ ] Cover `/api/admin/results` closing path: moves everyone to Vote, clears VotesFinal, updates UpdatedAt timestamp.
+- [ ] Extend vote-status tests for mixed finalized vs waiting users and ordering by display/username.
+- [ ] Add happy-path joker grant in Vote phase; assert VotesFinal resets for that player.
+- [ ] Exercise link/unlink phase gating and not-found cases; verify linking re-parents groups, deletes group votes, and unfinalizes affected players counts; ensure unlink follows spec vs current NotFound-on-missing behavior.
+- [ ] Confirm reset clears HasJoker/VotesFinal and closes results; factory-reset re-seeds AppState defaults (ResultsOpen=false, UpdatedAt set).
+
+## Infrastructure/Helpers
+- [ ] Expand `IsReachableImageAsync` tests: HEAD success path, redirect rejection, oversized content-length guard, fallback GET with non-image content.
+- [ ] Add coverage for global exception handler returning JSON 500 and logging.