diff --git a/README.md b/README.md
index 32a197d..80028eb 100644
--- a/README.md
+++ b/README.md
@@ -84,7 +84,7 @@ In order to facilitate deployment in varied setups, each web validator respects
 - a `spec` submodule contains this very repository ([forge/endpoints](https://tildegit.org/forge/endpoints))
 - a `bin/test.sh` script starts the tests: ensures the spec submodule is cloned, and starts the `spec/test_web.sh` with the following arguments:
   - the full path to the executable (generated by `bin/server`)
-  - **TODO** (optional) the full path to `bin/whck` if it exists (user override), or the full path to `whck` from current `PATH`, or nothing if neither of those options matches
+  - (optional) the full path to `bin/whck` if it exists (user override), or the full path to `whck` from current `PATH`, or nothing if neither of those options matches
 - the executable starts the web server on localhost, on a port which is configured, in this order of precedence:
   - by a `FORGEHOOKPORT` environment variable (used in tests)
   - by a first positional argument passed to the script (for manual use)
@@ -101,7 +101,7 @@ The `test_web.sh` script is used for testing web validators (such as [endpoints.
   - `bin/server`, relative to the directory from which you called the tests (eg. if you're running `specs/test_web.sh` from endpoints.php repository)
   - `../bin/server`, relative to the directory containing test_web.sh (eg. if you're running `./test_web.sh` from specs submodule in endpoints.php repository)
   - if no path was matched, the test suite fails to start
-- **TODO:** a path to a CLI validator executable; if no argument is provided, the following paths will be attempted, in order of precedence:
+- a path to a CLI validator executable; if no argument is provided, the following paths will be attempted, in order of precedence:
   - the output of `whck/bin/cli`, relative to the current working dir (eg. calling `specs/test_web.sh` from endpoints.php repository)
   - the output of `../whck/bin/cli`, relative to the current working dir (eg. calling `./test_web.sh` from specs submodule in endpoints.php repository)
   - if no path was matched, the test suite fails to start
@@ -128,3 +128,12 @@ Talk about sudo, suid, please etc.
 ## Unprivileged user, web server running as system account
 
 ## Privileged user (requires root)
+
+
+# TODO
+
+- reimplement calling forgehook-notify from endpoints.php
+- add test to check it's actually called
+- split READMEs separately for CLI and HTTP endpoint
+- maybe have all specs/tests/READMEs (with forgebuild) in a single repo?
+- make higher-level helper functions that can be shared across test files and implementation, for better consistency