diff --git a/.gitignore b/.gitignore
index 68e8adb..9ed9dc4 100644
--- a/.gitignore
+++ b/.gitignore
@@ -24,3 +24,7 @@ dist/
 .feedctl/
 node_modules/
 .testbld/
+
+# Local doc-export artifact: the canonical Poro findings live in
+# docs/poro-findings.md; the root PDF is a personal export, not a tracked file.
+/poro-findings.pdf
diff --git a/docs/TODO.md b/docs/TODO.md
index 4781447..cc1e5c5 100644
--- a/docs/TODO.md
+++ b/docs/TODO.md
@@ -12,4 +12,5 @@ session task list; this file is the durable copy.
 | ~~5~~ | ~~Review `docs/mock-data-register.md`; approve each replacement/retirement~~ **DONE 2026-07-07** | — | — |
 | ~~6~~ | ~~5-minute demo rehearsal on a fresh seed (`docs/demo-script.md`)~~ **DONE 2026-07-07** | — | — |
 | ~~7~~ | ~~Announce a GPU window for the full LIVE run-through~~ **DONE 2026-07-04** — live loop verified end to end (see CLAUDE.md run-through status); the keyword-free alert-nomination case still waits for the real corpus | — | — |
-| 8 | Maintenance watch: bump `SQLitePCLRaw.bundle_e_sqlite3` when upstream ships SQLite ≥ 3.50.2 (GHSA-2m69-gcr7-jv3q has no patched version as of 2026-07-03; exposure assessed low — see docs/audits/dotnet-2026-07-03.md) | upstream release | clean vulnerability scan |
+| ~~8~~ | ~~Maintenance watch: bump `SQLitePCLRaw.bundle_e_sqlite3` when upstream ships SQLite ≥ 3.50.2 (GHSA-2m69-gcr7-jv3q)~~ **DONE 2026-07-16** — Dependabot PR #55 bumped `SQLitePCLRaw.bundle_e_sqlite3` 2.1.\* → 3.0.\* (and `Microsoft.Data.Sqlite` 8.\* → 10.\*); verified the bundled SQLite is **3.50.4** (≥ 3.50.2, clears the GHSA), full suite green on net8.0 | — | — |
+| ~~9~~ | ~~Rebuild + restart the local API/desk instance to pick up the merged demoted-content fixes (PRs #58/#59)~~ **DONE 2026-07-15** — `feedctl down` → rebuild API → `feedctl up`; verified live on `/live/report` (Yhteenveto rated-only, moderation buckets count-only with no trend) | — | — |