Record the last four milestone units in TODO.md

Adds Completed Steps for the receiver aggregate rate limit (#139), the
documentation accuracy pass (#141), the CI gate repair (#119) and the
RETENTION_SWEEP_INTERVAL bound (#140). Drops the commit hash that
pinned the Status paragraph to a specific next head, since it goes
stale on every merge, and rewrites Next Step now that the gate repair
it named has landed.

TODO.md

@@ -24,22 +24,52 @@ event retention (#63), the database archiving target (#43), the admin
 password change flow (#65), policy compliance (#6), pinned lint tooling
 (#55), and fail-loud configuration parsing (#80).
 
-`next` (9bfd033) holds the completed 1.0.0 milestone: every issue in it
+`next` holds the completed 1.0.0 milestone: every issue in it is closed,
-is closed, and it is verified green by cache-defeated container runs
+and it is verified green both by CI and by cache-defeated container
-rather than by the CI badge, which can pass without executing anything
+runs. The two were only made to mean the same thing this cycle — before
-(#119). Note: TODO.md was deliberately deleted from this repo in f9a9569
+#119, a warm layer cache let the gate report success without executing
-(2026-03-01, #6); its content was folded into the README TODO section,
+anything, and replayed the previous build's console log so the lie
-which this draft reconstructs as of 2026-07-06.
+looked like a real run. Note: TODO.md was deliberately deleted from this
+repo in f9a9569 (2026-03-01, #6); its content was folded into the README
+TODO section, which this draft reconstructs as of 2026-07-06.
 
 # Next Step
 
-Tag 1.0.0 from `main` once the milestone PR merges, then repair the CI
+Merge the milestone PR to `main` and tag 1.0.0 from it.
-gate (#119) before the next cycle's work lands — a gate that can report
+
-success without running is the one thing every other guarantee here
+Two decisions are open and belong to the owner, neither blocking the
-rests on.
+tag: #115 (mask the `http` target's destination URL, implemented
+speculatively and awaiting a yes or no) and #125 (whether IPv6
+rate-limit keys should bucket by `/64`).
 
 # Completed Steps
 
+- 2026-08-12 Bound the receiver rate limit per client IP across the
+  whole `/webhook/*` route. The existing limiter keyed on the request
+  path and `/webhook/{uuid}` matches any single segment, so a client
+  that invented a fresh path per request minted a fresh bucket per
+  request: the limit on the only unauthenticated endpoint bounded
+  nothing in aggregate, and every request still cost an entrypoint
+  lookup before it 404ed. An outer limiter keyed on the client address
+  alone now bounds that, chained in front of the unchanged
+  per-entrypoint limiter (#139)
+- 2026-08-12 Correct release-blocking documentation inaccuracies: the
+  README promised manual redelivery in the present tense in three
+  places when nothing implements it (the same false claim also sat in
+  the doc comment that was its source text), the env table omitted
+  `RETENTION_SWEEP_INTERVAL`, and `TODO.md` itself omitted five landed
+  units (#141)
+- 2026-08-12 Make the CI gate execute the checks it reports on. The
+  workflow now writes a build-context fingerprint before calling
+  `script/cibuild`, so a code commit invalidates the `COPY` layer of
+  the lint and builder stages while a docs-only commit still replays
+  from cache; a superseding run also rewrites the `failure` status
+  Gitea leaves on commits it cancelled and never tested. Verified by
+  pushing a deliberately broken test and watching CI go red (#119)
+- 2026-08-12 Require a positive `RETENTION_SWEEP_INTERVAL`: a
+  non-positive value reached `time.NewTicker` in both the retention
+  reaper and the archive sweeper, panicking two goroutines with no
+  recover after startup had already reported success (#140)
 - 2026-08-12 Bound the `X-Forwarded-For` scan's allocation to the hop
   cap: the reverse walk cuts entries with `strings.LastIndexByte`
   instead of joining and splitting, so a 1 MB header allocates 16 bytes