diff --git a/TODO.md b/TODO.md
index d531826..cb372f4 100644
--- a/TODO.md
+++ b/TODO.md
@@ -439,7 +439,7 @@ above target the remaining 31.3% of CPU-bound operations.
 - No persistent connections (stateless HTTP)
 
 **Future considerations:**
-- [ ] Add rate limiting on /api/stats endpoint
+- [x] Add rate limiting on /api/stats endpoint (300 req/60s sliding window)
 - [ ] Cache expensive DB queries (top countries, protocol breakdown)
 - [ ] Lazy-load historical data (only when scrolled into view)
 - [ ] WebSocket option for push updates (reduce polling overhead)
@@ -452,24 +452,22 @@ above target the remaining 31.3% of CPU-bound operations.
 **Low priority - consider when time permits:**
 - [x] Geographic map visualization - /map endpoint with Leaflet.js
 - [x] Dark/light/muted theme toggle - t key cycles themes
-- [ ] Export stats as CSV/JSON from dashboard
+- [x] Export stats as CSV/JSON from dashboard (/api/stats/export?format=json|csv)
 - [ ] Historical graphs (24h, 7d) using stats_history table
 - [ ] Per-ASN performance analysis
 - [ ] Alert thresholds (success rate < X%, MITM detected)
 - [ ] Mobile-responsive improvements
 - [x] Keyboard shortcuts (r=refresh, 1-9=tabs, t=theme, p=pause)
 
-### [ ] Local JS Library Serving
+### [x] Local JS Library Serving
 
-**Goal:** Serve all JavaScript libraries locally instead of CDN for reliability and offline use.
+**Completed.** All JavaScript libraries now served locally from /static/lib/ endpoint.
 
-**Current CDN dependencies:**
-- Leaflet.js 1.9.4 (map) - https://unpkg.com/leaflet@1.9.4/
-
-**Implementation:**
-- [ ] Bundle libraries into container image
-- [ ] Serve from /static/lib/ endpoint
-- [ ] Update HTML to reference local paths
+**Bundled libraries (static/lib/):**
+- Leaflet.js 1.9.4 (leaflet.js, leaflet.css)
+- Leaflet.markercluster (MarkerCluster.Default.css)
+- Chart.js 4.x (chart.umd.min.js)
+- uPlot (uPlot.iife.min.js, uPlot.min.css)
 
 **Candidate libraries for future enhancements:**
 
@@ -522,11 +520,11 @@ Object Distribution:
   522,807 list              (2 per job - results + targets)
 ```
 
-**Potential optimizations (not yet implemented):**
+**Potential optimizations:**
 - [ ] Lock consolidation - reduce per-proxy locks (260k LockType objects)
 - [ ] Leaner state objects - reduce dict/list count per job
-- [ ] Slot-based classes - use `__slots__` on hot objects
-- [ ] Object pooling - reuse ProxyTestState/TargetTestJob objects
+- [x] Slot-based classes - use `__slots__` on ProxyTestState (27 attrs), TargetTestJob (4 attrs)
+- [ ] Object pooling - reuse ProxyTestState/TargetTestJob objects (not recommended)
 
 **Verdict:** Memory scales linearly with queue (~4.5 KB/job). No leaks detected.
 Current usage acceptable for production workloads. Optimize only if memory