diff --git a/README.md b/README.md
index e1cddf5..6204266 100644
--- a/README.md
+++ b/README.md
@@ -1,6 +1,9 @@
 # RouteWatch
 
-RouteWatch is a real-time BGP routing table monitor that streams BGP UPDATE messages from the RIPE RIS Live service, maintains a live routing table in SQLite, and provides HTTP APIs for querying routing information.
+RouteWatch is an MIT-licensed Go daemon by @sneak that monitors the BGP routing
+table in real time: it streams BGP UPDATE messages from the RIPE RIS Live
+service, maintains a live routing table in SQLite, and provides HTTP APIs for
+querying routing information.
 
 
 ## Features
@@ -299,4 +302,8 @@ invoke `go test` directly without `-short`:
 
 ## License
 
-See LICENSE file.
+MIT. See [`LICENSE`](LICENSE).
+
+## Author
+
+[@sneak](https://sneak.berlin)
diff --git a/TODO.md b/TODO.md
index 70ef510..01ee428 100644
--- a/TODO.md
+++ b/TODO.md
@@ -10,19 +10,24 @@
 
 # Status
 
-pre-1.0. No git tags. Runs in production-style Docker deployment, but
-the policy compliance branch (repo-policies-compliance, make check
-passing, clean tree) is unmerged to main and the CI workflow is missing.
+pre-1.0. No git tags. The Docker build runs the format check, the linter
+and the tests, and the Gitea workflow runs that build on every push. The
+image sets memory ceilings for a 5 GiB container (README "Memory") and the
+README says how to run it under upaas (README "Running under upaas"). A
+35-hour run of `3898daa` on the live feed peaked at about 1 GiB, without a
+container memory limit.
 
 # Next Step
 
-Merge repo-policies-compliance into main (3 commits: policy files and
-.gitignore, Makefile targets fmt-check/check/docker/hooks, gofmt pass),
-then add .gitea/workflows/check.yml as a small follow-up commit so CI
-runs make check on main.
+Not decided. Nothing on the tracker orders the open issues under Future
+Steps.
 
 # Completed Steps
 
+- 2026-09-29: README first line names the MIT license and the author,
+  with new License and Author sections; this file brought up to date
+  (closes #38)
+- 2026-09-29: MIT `LICENSE` (closes #1)
 - 2026-09-28: stopping the daemon while the feed is flowing no longer
   panics with "send on closed channel": the read loop checks for a stop
   just before handing a message to the handler queues, and a second
@@ -40,6 +45,33 @@ runs make check on main.
   startup and adjusted on every write, oldest/newest route timestamps via
   index-end lookups; `/api/v1/stats` no longer scans the tables (closes
   #27)
+- 2026-09-21: batch writes take the write lock when their transaction
+  begins (`_txlock=immediate`), so they wait out a WAL checkpoint instead
+  of failing with "database is locked" (closes #25)
+- 2026-09-21: `MALLOC_ARENA_MAX=2` in the image caps glibc malloc arenas,
+  so memory outside the Go runtime no longer grows with the core count
+  (closes #23)
+- 2026-09-21: `GOMEMLIMIT=1536MiB` in the image; README Memory section
+  with the memory budget and the 5 GiB container limit (closes #13)
+- 2026-09-21: the four handler queues hold at most 20,000 messages each,
+  down from 100,000 (closes #11)
+- 2026-09-21: two goroutine leaks fixed: the stats handlers after a
+  timeout and the streamer's tickers on every reconnect (closes #12)
+- 2026-09-21: parsed RIS messages no longer keep the unused `Community`
+  and `Raw` fields (closes #9)
+- 2026-09-21: `.editorconfig`, and a Gitea workflow that runs
+  `script/cibuild` on every push (closes #14)
+- 2026-09-21: the peering handler's AS-path map holds at most 500,000
+  paths and is swapped for an empty one every 30 seconds instead of copied
+  (closes #10)
+- 2026-09-21: SQLite memory bounded across the whole connection pool: a
+  64 MiB page cache on each connection, 1 GiB soft and 1.5 GiB hard heap
+  limits (closes #8)
+- 2026-09-21: the Docker build runs the format check, the linter and the
+  tests, linting in a separate stage on a golangci-lint image pinned by
+  digest (closes #5)
+- 2026-09-21: `make test` skips the live-network feed test (`-short`), so
+  `make check` no longer depends on the network (closes #2)
 - 2026-07-07 Adopted scripts-to-rule-them-all: `script/` entrypoints,
   Makefile shims, README Entrypoints section
 - 2026-02-22: repo policy compliance: required policy files, .gitignore
@@ -58,8 +90,10 @@ runs make check on main.
 
 # Future Steps
 
-- Verify main is green after the merge: make check locally and the new
-  CI workflow passing
-- Review stale remote branches fix-min-time-calculation and
-  optimize-sqlite-settings: land or delete
-- Clean up the tmp/ directory at the repo root: gitignore or remove
+- Production memory under 5 GiB: whether to test under a real 5 GiB
+  container limit on fsn1app1 is open for sneak
+  (https://git.eeqj.de/sneak/routewatch/issues/3)
+- `/api/v1/stats` answered HTTP 500 after 35 hours on the live feed, seen
+  on `3898daa`, which predates the 2026-09-22 in-memory statistics
+  (https://git.eeqj.de/sneak/routewatch/issues/30)
+- Add a `.dockerignore` (https://git.eeqj.de/sneak/routewatch/issues/39)