diff --git a/TODO.md b/TODO.md
index 07a4523..0458586 100644
--- a/TODO.md
+++ b/TODO.md
@@ -1,12 +1,12 @@
 # Workflow
 
-* branch (from `main`)
-* do the work in Next Step
-* move Next Step to the top of Completed Steps
-* move the top item of Future Steps into Next Step
-* commit (`TODO.md` changes in the same commit as the work)
-* merge to `main` if the branch is not protected, otherwise open a PR
-* push
+- branch (from `main`)
+- do the work in Next Step
+- move Next Step to the top of Completed Steps
+- move the top item of Future Steps into Next Step
+- commit (`TODO.md` changes in the same commit as the work)
+- merge to `main` if the branch is not protected, otherwise open a PR
+- push
 
 # Status
 
@@ -15,35 +15,33 @@ pre-1.0
 # Next Step
 
 Implement the download retry policy from the README TODO: no retry on 4xx,
-exponential backoff on 5xx and network errors. Apply it to file and
-thumbnail downloads, cover it with mock-server tests, and update the
-README TODO checkbox.
+exponential backoff on 5xx and network errors. Apply it to file and thumbnail
+downloads, cover it with mock-server tests, and update the README TODO checkbox.
 
 # Completed Steps
 
-- 2026-06-10: Decrypted collections shared by other users (sealed-box
-  keys); listCollections drops deleted-collection tombstones.
+- 2026-06-10: Decrypted collections shared by other users (sealed-box keys);
+  listCollections drops deleted-collection tombstones.
 - 2026-06-10: Login hardening: dual-2FA empty-string fields handled, TOTP
   preferred when a passkey is also enrolled, interactive input via
   @inquirer/prompts.
 - 2026-06-10: Replaced sharp with pure JS (jpeg-js + exif-reader); added
   single-binary bun build and make install.
-- 2026-06-09: Added backup-metadata command (ML data always included,
-  --exif opt-in); rewrote README to match the implementation; added
-  thumbnail helper tests.
+- 2026-06-09: Added backup-metadata command (ML data always included, --exif
+  opt-in); rewrote README to match the implementation; added thumbnail helper
+  tests.
 - 2026-05-13: Full CLI surface: login, backup with dedup symlink layout,
   collections, files, get, get-thumb, thumbnail repair helpers.
 - 2026-05-13: Client OO API with literate usage tests; file download and
-  decryption; all three metadata layers decrypted and persisted; renamed
-  quack to quak.
+  decryption; all three metadata layers decrypted and persisted; renamed quack
+  to quak.
 - 2026-05-11: SRP login flow (email OTP + TOTP) and ApiClient.
 
 # Future Steps
 
-- Retry policy: no retry on 4xx, exponential backoff on 5xx and network
-  errors (the Next Step).
-- Update the README API reference section to match the current
-  implementation.
+- Retry policy: no retry on 4xx, exponential backoff on 5xx and network errors
+  (the Next Step).
+- Update the README API reference section to match the current implementation.
 - Make `make docker` green.
 - Tag v1.0.0.
 - Future desktop client, separate repo: