diff --git a/TODO.md b/TODO.md
deleted file mode 100644
index 4e96eda..0000000
--- a/TODO.md
+++ /dev/null
@@ -1,47 +0,0 @@
-# TODO — Certificate Issuance Issues
-
-## Problem 1: Timeout Mismatch Causes WebUI Freeze → FIXED
-
-**Date Found:** May 30, 2026
-**Date Fixed:** May 30, 2026
-
-**Symptom:** Clicking "Issue Certificate" in the WebUI freezes for ~30 seconds, then returns a 500 error with "Daemon request timed out". Meanwhile the daemon silently runs `acme.sh` in the background for up to 120s before timing out itself.
-
-**Root Cause:**
-- `daemon/client.py` — WebUI client uses `timeout=30` for all daemon requests
-- `daemon/handlers/acme.py` — Daemon allows `acme.sh` subprocess `timeout=120`
-- The WebUI gives up at 30s while the daemon is still legitimately processing
-
-**Fix Applied:** Replaced blocking issue endpoint with async step-by-step issuance:
-- `POST /acme/validate` — Pre-flight checks (instant): acme.sh installed, email configured, webroot ready, DNS resolves, challenge configured
-- `POST /acme/issue` — Returns immediately with `request_id`, spawns background task
-- `GET /acme/issue/status` — Client polls for step-by-step progress
-- UI shows pre-check results, then step progress with polling (no timeout issues)
-- Blocking DNS check prevents wasted acme.sh calls when domain doesn't resolve
-
-**Files Changed:** `daemon/handlers/acme.py`, `webui/api/certs.py`, `webui/templates/certs.html`, `webui/static/app.js`
-
----
-
-## Problem 2: ZeroSSL Rate Limits Block Certificate Issuance
-
-**Date Found:** May 30, 2026
-
-**Symptom:** `acme.sh` fails to issue a certificate for `218broad.vacuum.network` with:
-```
-The retryafter=86400 value is too large (> 600), will not retry anymore.
-```
-
-**Root Cause:** ZeroSSL CA returns a `retry-after` of 86400 seconds (24 hours), likely from a prior failed challenge. `acme.sh` has a hard cap of 600s on retry-after values and refuses to proceed when the CA requests a longer wait.
-
-**Files:** N/A (acme.sh behavior, not a project code issue)
-
-**Workarounds:**
-- Switch CA to Let's Encrypt: `acme.sh --set-default-ca --server letsencrypt`
-- Wait 24 hours and retry
-- Investigate and clean up prior failed challenges for the domain on ZeroSSL's side
-
-## Status
-
-- **Problem 1:** ✅ FIXED (2026-05-30) — Refactored to async step-by-step issuance with polling. State store collectors replace blocking subprocess calls on every request.
-- **Problem 2:** ℹ️ N/A — ZeroSSL rate limit is external to the project. Workarounds: switch CA to Let's Encrypt, wait 24h, or clean up failed challenges on ZeroSSL's side.