diff --git a/TODO.md b/TODO.md
index 8171084..48266eb 100644
--- a/TODO.md
+++ b/TODO.md
@@ -426,12 +426,14 @@ ctest --test-dir build-coverage --output-on-failure
 
 Reports land in `build-coverage/coverage/` (`index.html`, `coverage.xml`).
 
-**Line coverage 79.6%, function coverage 87.2%** (2189/2749 lines, 164/188
-functions), up from 77.2% / 83.1% and from a 39.6% / 44.3% baseline. All 21
-suites pass. (An earlier revision of this file recorded `character` as an
-intentionally failing suite; it passes now, and nothing in `tests/character.c`
-or `src/character.c` has changed since — the fix came from elsewhere in the tree
-and this note was never updated.)
+**Line coverage 83.9%, function coverage 91.2%** (2433/2901 lines, 176/193
+functions), up from 79.6% / 87.2% before the 0.5.0 defect work and from a
+39.6% / 44.3% baseline. All 25 registered tests pass, and that count now
+includes three non-C ones: `api_surface`, `error_protocol` and the generated
+per-header compile checks inside `headers`.
+
+The `character` suite deserves its own line. It was recorded here as passing;
+it was not running. See "Test suites that could not fail" below.
 
 Note the trap described in "Known and still open" item 13 while regenerating
 these numbers: a coverage tree rebuilt after a source edit fails `coverage_reset`
@@ -443,24 +445,28 @@ it.
 | `src/actor.c` | 205/258 (80%) | 16/18 |
 | `src/assets.c` | 0/21 (0%) | 0/1 |
 | `src/audio.c` | 229/248 (92%) | 22/23 |
-| `src/character.c` | 104/118 (88%) | 6/7 |
-| `src/controller.c` | 300/329 (91%) | 16/16 |
-| `src/draw.c` | 253/267 (95%) | 11/12 |
+| `src/character.c` | 122/126 (97%) | 7/7 |
+| `src/controller.c` | 314/349 (90%) | 17/17 |
+| `src/draw.c` | 281/286 (98%) | 12/12 |
 | `src/error.c` | 9/9 (100%) | 1/1 |
-| `src/game.c` | 128/235 (54%) | 12/17 |
-| `src/heap.c` | 111/111 (100%) | 12/12 |
-| `src/json_helpers.c` | 111/111 (100%) | 11/11 |
-| `src/physics.c` | 140/140 (100%) | 10/10 |
-| `src/registry.c` | 76/102 (74%) | 11/12 |
-| `src/renderer.c` | 42/75 (56%) | 7/8 |
-| `src/sprite.c` | 93/101 (92%) | 5/5 |
-| `src/staticstring.c` | 16/17 (94%) | 2/2 |
-| `src/text.c` | 48/48 (100%) | 4/4 |
-| `src/tilemap.c` | 201/426 (47%) | 10/20 |
-| `src/util.c` | 121/131 (92%) | 7/8 |
+| `src/game.c` | 142/243 (58%) | 13/18 |
+| `src/heap.c` | 116/116 (100%) | 12/12 |
+| `src/json_helpers.c` | 123/123 (100%) | 11/11 |
+| `src/physics.c` | 144/144 (100%) | 10/10 |
+| `src/registry.c` | 83/111 (75%) | 12/13 |
+| `src/renderer.c` | 61/83 (74%) | 8/8 |
+| `src/sprite.c` | 102/110 (93%) | 5/5 |
+| `src/staticstring.c` | 17/18 (94%) | 2/2 |
+| `src/text.c` | 79/80 (99%) | 7/7 |
+| `src/tilemap.c` | 276/444 (62%) | 13/20 |
+| `src/util.c` | 128/130 (98%) | 7/7 |
 | `src/version.c` | 2/2 (100%) | 1/1 |
 
-Branch coverage reads 21.2% and should not be used as a target. The akerror
+`src/tilemap.c` moved the most, 47% to 62%, because the bounds and leak work
+needed the loaders driven rather than merely called. `src/assets.c` is still the
+one file with no coverage at all.
+
+Branch coverage reads 24.7% and should not be used as a target. The akerror
 control-flow macros (`ATTEMPT`/`CATCH`/`PROCESS`/`FINISH`, `FAIL_*_RETURN`)
 expand into large branch trees per call site, most of them unreachable in normal
 operation — `src/game.c` reports over 1700 branches across 230 lines. Track line