diff --git a/TASKS.md b/TASKS.md
index 527c89f..29814b0 100644
--- a/TASKS.md
+++ b/TASKS.md
@@ -34,6 +34,12 @@
 - [x] SCANRATE command (BLE scan interval tuning, 5-300s)
 - [x] PROBERATE command (probe dedup cooldown tuning, 1-300s)
 - [x] Fix: promiscuous mode disables CSI on original ESP32 — guarded with `#if`
+- [x] FreeRTOS CPU runtime stats in PROFILE (trace facility enabled)
+- [x] Increased cmd_task stack 4KB → 6KB (was 516 bytes free)
+- [x] WiFi channel in STATUS (`channel=`)
+- [x] Boot counter in NVS (`boots=`)
+- [x] RSSI min/max tracking from CSI frames (`rssi_min=`, `rssi_max=`)
+- [x] Actual CSI rate in STATUS (`csi_rate=`)
 
 ## Completed: v0.5 - BLE Scanning
 
@@ -92,10 +98,10 @@
 ## Notes
 
 - Adaptive threshold varies by environment; 0.001-0.01 is a good starting range
-- NVS keys: `send_rate`, `tx_power`, `adaptive`, `threshold`, `ble_scan`, `target_ip`, `target_port`, `hostname`
+- NVS keys: `send_rate`, `tx_power`, `adaptive`, `threshold`, `ble_scan`, `target_ip`, `target_port`, `hostname`, `boot_count`
 - EVENT packets now include sensor hostname: `EVENT,<hostname>,motion=... rate=... wander=...`
 - ALERT_DATA format: `ALERT_DATA,<hostname>,<deauth|disassoc>,<sender_mac>,<target_mac>,<rssi>`
-- STATUS now includes `temp=`, `uptime_s=`, `csi_count=` fields
+- STATUS fields: `uptime=`, `uptime_s=`, `heap=`, `rssi=`, `channel=`, `tx_power=`, `rate=`, `csi_rate=`, `hostname=`, `version=`, `adaptive=`, `motion=`, `ble=`, `target=`, `temp=`, `csi_count=`, `boots=`, `rssi_min=`, `rssi_max=`
 - PROBE_DATA format: `PROBE_DATA,<hostname>,<mac>,<rssi>,<ssid>`
 - Probe requests deduped per MAC (default 10s cooldown, tunable via PROBERATE)
 - mDNS service: `_esp-csi._udp` on data port (for sensor discovery)
diff --git a/docs/CHEATSHEET.md b/docs/CHEATSHEET.md
index 9ab5c6f..9e7845a 100644
--- a/docs/CHEATSHEET.md
+++ b/docs/CHEATSHEET.md
@@ -34,7 +34,8 @@ idf.py reconfigure                      # Re-fetch managed components
 ## Remote Management (esp-cmd)
 
 ```bash
-esp-cmd <host> STATUS                   # Uptime, heap, RSSI, rate, version, adaptive, motion, csi_count
+esp-cmd <host> STATUS                   # Full device status (see STATUS Fields below)
+esp-cmd <host> PROFILE                  # Heap, stack watermarks, CPU runtime stats
 esp-cmd <host> IDENTIFY                 # LED solid 5s (find the device)
 esp-cmd <host> RATE 50                  # Set ping rate to 50 Hz (disables adaptive)
 esp-cmd <host> POWER 15                 # Set TX power to 15 dBm (NVS saved)
@@ -178,6 +179,38 @@ PROBE_DATA,<hostname>,mac,rssi,ssid
 because it breaks CSI data collection at the driver level. These packet types are
 only generated on ESP32-C6 and newer chips.
 
+## STATUS Fields
+
+| Field | Example | Description |
+|-------|---------|-------------|
+| uptime | 1h23m | Human-readable uptime |
+| uptime_s | 4980 | Raw uptime in seconds |
+| heap | 108744 | Free heap bytes |
+| rssi | -67 | Current AP RSSI (dBm) |
+| channel | 11 | WiFi channel |
+| tx_power | 10 | TX power (dBm) |
+| rate | 100 | Target CSI rate (Hz) |
+| csi_rate | 97 | Actual CSI rate (Hz, computed) |
+| hostname | amber-maple | Device hostname |
+| version | 27aeddb | Firmware git commit |
+| adaptive | on/off | Adaptive sampling |
+| motion | 0/1 | Motion detected |
+| ble | on/off | BLE scanning |
+| target | 192.168.129.11:5500 | UDP destination |
+| temp | 0.0 | Chip temperature (ESP32-S2/C3/C6 only) |
+| csi_count | 30002 | Total CSI frames since boot |
+| boots | 3 | Boot count (NVS persisted) |
+| rssi_min | -71 | Lowest RSSI since boot |
+| rssi_max | -62 | Highest RSSI since boot |
+
+## PROFILE Sections
+
+| Section | Fields | Description |
+|---------|--------|-------------|
+| HEAP | free, min, dram, iram | Heap usage and watermarks |
+| TASKS | stack_free per task | Per-task stack high watermark |
+| CPU | % per task | FreeRTOS runtime stats (requires `CONFIG_FREERTOS_USE_TRACE_FACILITY`) |
+
 ## Source Paths
 
 | File | Purpose |