README: license and author up front; bring TODO.md up to date (closes #38)

REPO_POLICIES.md asks the README's first line to name the license and the
author, and for License and Author sections; the README had neither up
front, its License section only said "See LICENSE file.", and it had no
Author section.

TODO.md's Status, Next Step and Future Steps still described the unmerged
repo-policies-compliance branch and a missing CI workflow. They now say
what is true of next, and Completed Steps gains a line for each issue that
landed from 2026-09-21 on without one. The next step is not decided, and
Next Step says so.

Model: opus-5-5

TODO.md

@@ -10,19 +10,24 @@
 
 # Status
 
-pre-1.0. No git tags. Runs in production-style Docker deployment, but
-the policy compliance branch (repo-policies-compliance, make check
-passing, clean tree) is unmerged to main and the CI workflow is missing.
+pre-1.0. No git tags. The Docker build runs the format check, the linter
+and the tests, and the Gitea workflow runs that build on every push. The
+image sets memory ceilings for a 5 GiB container (README "Memory") and the
+README says how to run it under upaas (README "Running under upaas"). A
+35-hour run of `3898daa` on the live feed peaked at about 1 GiB, without a
+container memory limit.
 
 # Next Step
 
-Merge repo-policies-compliance into main (3 commits: policy files and
-.gitignore, Makefile targets fmt-check/check/docker/hooks, gofmt pass),
-then add .gitea/workflows/check.yml as a small follow-up commit so CI
-runs make check on main.
+Not decided. Nothing on the tracker orders the open issues under Future
+Steps.
 
 # Completed Steps
 
+- 2026-09-29: README first line names the MIT license and the author,
+  with new License and Author sections; this file brought up to date
+  (closes #38)
+- 2026-09-29: MIT `LICENSE` (closes #1)
 - 2026-09-28: stopping the daemon while the feed is flowing no longer
   panics with "send on closed channel": the read loop checks for a stop
   just before handing a message to the handler queues, and a second
@@ -40,6 +45,33 @@ runs make check on main.
   startup and adjusted on every write, oldest/newest route timestamps via
   index-end lookups; `/api/v1/stats` no longer scans the tables (closes
   #27)
+- 2026-09-21: batch writes take the write lock when their transaction
+  begins (`_txlock=immediate`), so they wait out a WAL checkpoint instead
+  of failing with "database is locked" (closes #25)
+- 2026-09-21: `MALLOC_ARENA_MAX=2` in the image caps glibc malloc arenas,
+  so memory outside the Go runtime no longer grows with the core count
+  (closes #23)
+- 2026-09-21: `GOMEMLIMIT=1536MiB` in the image; README Memory section
+  with the memory budget and the 5 GiB container limit (closes #13)
+- 2026-09-21: the four handler queues hold at most 20,000 messages each,
+  down from 100,000 (closes #11)
+- 2026-09-21: two goroutine leaks fixed: the stats handlers after a
+  timeout and the streamer's tickers on every reconnect (closes #12)
+- 2026-09-21: parsed RIS messages no longer keep the unused `Community`
+  and `Raw` fields (closes #9)
+- 2026-09-21: `.editorconfig`, and a Gitea workflow that runs
+  `script/cibuild` on every push (closes #14)
+- 2026-09-21: the peering handler's AS-path map holds at most 500,000
+  paths and is swapped for an empty one every 30 seconds instead of copied
+  (closes #10)
+- 2026-09-21: SQLite memory bounded across the whole connection pool: a
+  64 MiB page cache on each connection, 1 GiB soft and 1.5 GiB hard heap
+  limits (closes #8)
+- 2026-09-21: the Docker build runs the format check, the linter and the
+  tests, linting in a separate stage on a golangci-lint image pinned by
+  digest (closes #5)
+- 2026-09-21: `make test` skips the live-network feed test (`-short`), so
+  `make check` no longer depends on the network (closes #2)
 - 2026-07-07 Adopted scripts-to-rule-them-all: `script/` entrypoints,
   Makefile shims, README Entrypoints section
 - 2026-02-22: repo policy compliance: required policy files, .gitignore
@@ -58,8 +90,10 @@ runs make check on main.
 
 # Future Steps
 
-- Verify main is green after the merge: make check locally and the new
-  CI workflow passing
-- Review stale remote branches fix-min-time-calculation and
-  optimize-sqlite-settings: land or delete
-- Clean up the tmp/ directory at the repo root: gitignore or remove
+- Production memory under 5 GiB: whether to test under a real 5 GiB
+  container limit on fsn1app1 is open for sneak
+  (https://git.eeqj.de/sneak/routewatch/issues/3)
+- `/api/v1/stats` answered HTTP 500 after 35 hours on the live feed, seen
+  on `3898daa`, which predates the 2026-09-22 in-memory statistics
+  (https://git.eeqj.de/sneak/routewatch/issues/30)
+- Add a `.dockerignore` (https://git.eeqj.de/sneak/routewatch/issues/39)