diff --git a/TODO.md b/TODO.md
index b6f475a..f8b9e3b 100644
--- a/TODO.md
+++ b/TODO.md
@@ -89,3 +89,14 @@ rategy: run unusedSymbols report-only (10-14) first to get go/no-go reclaimable-
 - [ ] #wire-templates-to-load [!medium] Wire templates to load their page-type bundle instead of base.min.css — Update each template's <link> tags to point at the appropriate per-page bundle. Ensure no page loads CSS it doesn't need and that shared pages still get full styling.
 - [ ] #measure-before-after-css-bytes [!low] Measure before/after CSS bytes shipped per page type — Moot: part of split stream which is NO-GO (task 14). Skip unless split is revived.
 - [ ] #add-lightningcss-unusedsymbols-report-only [!high] Add lightningcss unusedSymbols report-only pass for base.min.css — SEQUENCING: do this (unusedSymbols report-only) BEFORE the per-page split (u). Reasoning: high priority, zero-risk diagnostic-only, produces reclaimable-byte go/no-go (14) against ~216KB baseline; if pruning is not worthwhile the split may not be either. Reuses inventory from v (docs/css-split-analysis.md). Start: 11 collect-content-sources.
+# TODO
+
+- [x] Open up CSP frame-src from hardcoded domain whitelist to `https:` scheme-wide
+- [x] Fix relinked file not appearing in FilePond UI: switch to ID-based input lookup
+- [x] Fix student name popover overflowing below viewport: clamp position so popover stays within screen bounds
+- [x] Fix orientation (and other filter) metadata links on TFE page leading to empty search: remove redundant `query=` param
+- [x] Fix language metadata link using wrong `query=` param instead of dedicated `language=` filter
+- [x] Sort TFE files by display category on public page (note d'intention → TFE → image → video → audio → website → annexes)
+- [x] Fix CSV import: VALUES had 24 ? placeholders but execute array has 23 values → 27 total for 26 columns
+- [x] Upgrade production php8.4-fpm to 8.4.27 for CVE-2026-109618 / CVE-2026-109619 (php2shell); rebooted to 6.12.113, FPM/nginx active, site HTTP 200, NTP synchronized
+- [ ] Upgrade local dev PHP 8.5.11 to 8.5.12+ for CVE-2026-109618 / CVE-2026-109619