diff --git a/TODO.md b/TODO.md
index f80180f..308005a 100644
--- a/TODO.md
+++ b/TODO.md
@@ -202,11 +202,19 @@
       it would fall through to somebody else's), and only fetching its
       document refuses, naming the method. `did:web` gained its first test
       coverage and a real document fixture
-- [ ] The disallowed-TLD list from the handle spec (.local, .arpa,
-      .invalid, .internal, .localhost, .example, .alt, .onion) is not
-      enforced — policy rather than syntax, and enforcing it would break
-      anyone pointed at a local test PDS. Revisit if it ever saves a real
-      support question
+- [x] The disallowed-TLD list from the handle spec (.local, .arpa,
+      .invalid, .internal, .localhost, .example, .alt, .onion) is enforced,
+      and was already: `jacquard::types::string::Handle` refuses one, which
+      is why `explain_handle` carries a `DISALLOWED_TLDS` branch whose only
+      job is to *name* the reserved TLD — it exists precisely because that
+      is the one refusal `domain` knows nothing about. Verified:
+      `ATGC_ACCOUNT=a.localhost` is refused with ".localhost is reserved and
+      cannot be a handle".
+
+      The entry's own worry is the live behaviour, not a hypothetical:
+      "enforcing it would break anyone pointed at a local test PDS" is what
+      happens today. If that ever costs somebody something, the fix is an
+      escape hatch, not the enforcement — but nobody has asked
 - [x] `account::names_account` prefix-tested for `did:` and answered a
       boolean, so a value the classifier rejects and a value naming somebody
       else both came back `false` and both produced `EnvWins` — "something
@@ -983,8 +991,8 @@
       Either jacquard grows a header accessor, or the blob upload is
       hand-rolled against `clients/http.rs` the way the other reads are —
       and the second is a lot of machinery for one header
-- [ ] `pr list` and `status pr` resolve their columns one round trip at a
-      time: one `handle_from_did_doc` per unique author DID and one
+- [x] `pr list` and `pr list --all` resolved their columns one round trip at
+      a time: one `handle_from_did_doc` per unique author DID and one
       `repo_name` per unique repo DID, both in plain `for` loops, so a page
       from fifteen authors was fifteen serial DID-document fetches, and the
       `--all` half worse — `repo_name` is up to three requests of its own.
@@ -1262,9 +1270,12 @@ warn where the stack command is better.
       silent when the listing will not load: this is a note attached to a
       write that is going to happen anyway, and a read that fails is a reason
       to say nothing rather than to refuse a close somebody asked for
-- [ ] `pr view`/`pr list` still print `?` for the same fresh pulls that
-      `stack view` now calls open — they read through `gather` directly,
-      not `repo_rows`. Align them if the split starts costing questions
+- [x] `pr view`/`pr list` printed `?` for the same fresh pulls that `stack
+      view` called open, because the promotion lived in `repo_rows` and they
+      read through `gather` directly. Done since, and the other way round
+      from what this entry proposed: `settle_own_open` moved *into* `gather`,
+      so every listing gets it and `repo_rows` gets it by going through the
+      same door. Its comment there says so
 - [x] `--add-change-ids` rewrites the branch before atgc has a session.
       `ensure_change_ids` moves `refs/heads/<branch>` at the top of both
       `create` and `resubmit`, and `agent_for_did` is not called until a
@@ -1465,11 +1476,6 @@ and borrows `pr`'s conventions rather than inventing new ones beside them.
       the knot mints. Validating a stand-in record would check the fields
       the caller controls, which is most of them, at the cost of a shape
       that is not the one sent. Worth it or not is an open question
-- [ ] `new_body`/`comment_body` in `cmd/issue/write.rs` are the third near-copy
-      of "a body from a flag, a file, or stdin" in the tree, after
-      `cmd/pr/write.rs` and `cmd/report.rs`. Three copies is where this stops
-      being cheaper than one shared helper, and the three do differ (a
-      clearable body, an unclearable one, and an optional one)
 - [x] `new_body`/`comment_body` in `cmd/issue/write.rs` were the third
       near-copy of "a body from a flag, a file, or stdin" in the tree, after
       `cmd/pr/write.rs` and `cmd/report.rs` — three copies serving six
@@ -1957,6 +1963,16 @@ and borrows `pr`'s conventions rather than inventing new ones beside them.
       if wanted; nothing asks for them yet
 
 ## misc
+- [x] Four entries in this file claimed work was undone that was done, which
+      before a 1.0 is worse than no entry at all: two were plain staleness
+      (the reserved-TLD list, which jacquard enforces and always has, and the
+      `?` promotion, which moved *into* `gather` rather than being aligned
+      the way its entry proposed), and two were damage from resolving rebase
+      conflicts in this file — one entry kept a `[ ]` box over a body
+      rewritten to describe the finished work, and one survived twice, once
+      in each state. Found by reading every `- [ ]` back against the code
+      rather than by trusting the boxes
+
 - [x] "N scope(s) granted since this login" said the opposite of what it
       meant, in all three places it was printed: `doctor local`'s scopes row,
       `auth status`'s per-account lines, and `scope_gap`'s own doc comment.