diff --git a/.planning/todos/pending/2026-07-31-build-iso-for-v1.7.119-alpha.md b/.planning/todos/pending/2026-07-31-build-iso-for-v1.7.119-alpha.md
new file mode 100644
index 00000000..c5466ffe
--- /dev/null
+++ b/.planning/todos/pending/2026-07-31-build-iso-for-v1.7.119-alpha.md
@@ -0,0 +1,32 @@
+---
+created: 2026-07-31T19:00:00.000Z
+title: Build the installer ISO for v1.7.119-alpha
+area: tooling
+severity: minor
+files:
+  - scripts/build-iso-release.sh
+---
+
+## Problem
+
+v1.7.119-alpha is released and its OTA assets are published and checksum-verified, but the **installer ISO was never built**. Three attempts were blocked by a dirty working tree — `build-iso-release.sh`'s preflight hard-fails on any uncommitted change, and this checkout is shared by phase 1 executors and a separate BotFights session, so the tree is rarely clean for long. Not urgent: the ISO only matters for fresh installations; everyone updating is served by the working OTA.
+
+## Solution
+
+Run during a genuine pause in phase 1 execution (between waves), not racing against it:
+
+```
+TMPDIR=/home/archipelago/tmp/iso-scratch bash scripts/build-iso-release.sh
+```
+
+Keep the QEMU boot test (no `--no-qemu`).
+
+**Preconditions:** `git status --porcelain` empty on `main`.
+
+**Launch it as an explicit background job.** The build runs well past 10 minutes; twice it hit the tool's foreground timeout and once that killed an in-progress `cargo test` outright.
+
+**Build from current `main` HEAD, not a detached tag checkout** — decision already made, don't re-derive. Preflight requires `git rev-parse --abbrev-ref HEAD == "main"` (a detached checkout returns `HEAD` and fails), and the archipelago version identity (Cargo.toml / package.json / CHANGELOG / manifest, all `1.7.119-alpha`) is untouched by commits made after the tag. BotFights is versioned and shipped independently via the signed catalog, so building at HEAD ships the security-fixed 1.2.11 rather than reverting to the vulnerable 1.2.9 current at tag time.
+
+**Gates already seen passing** (mostly cached, expect them to pass fast): git-diff-check, cargo-fmt, catalog-drift, whats-new-sync, ui-type-check, ui-unit-tests (788), cargo-check. **Not yet reached:** cargo-test-weekly (~1500s), verify-artifacts, build-iso, iso-smoke, qemu-boot.
+
+`TMPDIR` matters while `/tmp` (12G tmpfs) is tight — honored natively by mktemp-based scripts and by `test-iso-qemu.sh` since commit `6c2b6668` fixed its hardcoded `/tmp` paths.