diff --git a/TODO_API_REFACTOR.md b/TODO_API_REFACTOR.md
index e5356fb..987fea5 100644
--- a/TODO_API_REFACTOR.md
+++ b/TODO_API_REFACTOR.md
@@ -33,8 +33,8 @@
 ## 测试与收尾（high）
 
 - [x] 20. 新增 `handlers/api_test.go`：happy path / 校验码 / 401 / 403 / CSRF 头 / 429 / 409
-- [ ] 21. 更新 `security_test.go`/`p2_validation_test.go`/`p3_upload_test.go`/`session_upload_security_test.go` 到新 URL 与 JSON 断言
-- [ ] 22. `go build ./... && go vet ./... && go test ./...` 全绿；README 路由表同步
+- [x] 21. 更新 `security_test.go`/`p2_validation_test.go`/`p3_upload_test.go`/`session_upload_security_test.go` 到新 URL 与 JSON 断言
+- [x] 22. `go build/vet/test ./...`（含 -count=1 -race）全绿；README 路由表同步
 
 ## 执行说明