diff --git a/TODO.md b/TODO.md
index 00222ad..f20811d 100644
--- a/TODO.md
+++ b/TODO.md
@@ -5,38 +5,38 @@ One issue per unit of work, one branch and one PR per issue:
 - ensure a tracked issue exists with a definition of done
 - branch from `next` (never from `main`)
 - do the work; open a PR based on `next` (never on `main`)
-- pass an independent review, then the change is squash-merged into `next`
+- pass an independent review, then `clawbot` squash-merges it into `next`
 - push; nothing stays local-only
 
-`next` is the branch for the next milestone and must stay green and
-mergeable to `main` without notice. Only `sneak` merges `next` into
-`main`, and for now only `sneak` merges into `next`. No commits land
-directly on `main` or `next` — only merges via PRs.
+`next` is the branch for the next milestone and must stay green and mergeable to
+`main` without notice. Only `sneak` merges `next` into `main`. No commits land
+directly on `main` or `next`, only merges via PRs. A deploy is a squash commit
+from `main` onto `prod`; `prod` never follows `main` automatically.
 
-Issue branches do NOT touch this file — it is maintained on `next`.
-Every branch editing `TODO.md` conflicts with every other.
+Other issue branches do not touch this file; it changes only in its own PR to
+`next`, because every branch editing `TODO.md` conflicts with every other.
 
 # Status
 
-The repository has been brought up to current repo standards: `script/`
-Scripts to Rule Them All entrypoints with the `Makefile` reduced to thin
-shims, a `Dockerfile` whose `lint` and `test` phases gate the build, a
-`.gitea/workflows/` CI workflow running `script/cibuild`, the vendored
-`.golangci.yml`, `REPO_POLICIES.md`, `.editorconfig`, `.dockerignore`, a
-`LICENSE` file, and a comprehensive `.gitignore`.
+On `next`:
 
-Lint is clean under the standard `default: all` configuration, with the
-findings fixed rather than suppressed. The only annotations are
-justified `//nolint:gosec` on the `ping`/`curl` subprocess calls (G204)
-and on opening the operator-chosen log file (G304): fixed argv with no
-shell, so these are false positives, annotated as the reference repos do.
+- Repo standards (https://git.eeqj.de/sneak/rtnetmon/issues/1): the `script/`
+  entrypoints, the vendored `.golangci.yml`, and `REPO_POLICIES.md`.
+- Interface detection on Linux and macOS
+  (https://git.eeqj.de/sneak/rtnetmon/issues/2).
+- The fix for macOS VPN detection
+  (https://git.eeqj.de/sneak/rtnetmon/issues/8).
+- Starlink status lines (https://git.eeqj.de/sneak/rtnetmon/issues/3).
+- A version stamp: built with `make build` or a plain `docker build .`, the
+  binary logs its git tag or short commit at startup
+  (https://git.eeqj.de/sneak/rtnetmon/issues/10).
+- CI that runs `script/cibuild` on every push to a branch
+  (https://git.eeqj.de/sneak/rtnetmon/issues/12).
 
 # Next Step
 
-Feature work, each on its own branch and PR from `next`:
-
-- https://git.eeqj.de/sneak/rtnetmon/issues/2 — macOS support:
-  VPN-aware interface detection and a single-interface UI when only one
-  interface exists.
-- https://git.eeqj.de/sneak/rtnetmon/issues/3 — show Starlink status
-  lines when Starlink is the non-VPN gateway.
+- `sneak` merges the milestone PR, https://git.eeqj.de/sneak/rtnetmon/pulls/6,
+  carrying `next` into `main`.
+- A first run on a real Mac of what is on `next` now. The fix for
+  https://git.eeqj.de/sneak/rtnetmon/issues/8 has not run on a Mac yet;
+  `sneak`'s first run on his Mac is its test.