diff --git a/projects/business/memory/sessions.md b/projects/business/memory/sessions.md
index 69d62f9..96d69b0 100644
--- a/projects/business/memory/sessions.md
+++ b/projects/business/memory/sessions.md
@@ -1,5 +1,24 @@
 # Session Log
 
+## Session 158 — 2026-03-11 07:00 UTC (Wednesday Morning)
+- **Production:** v0.5.1 ✅ healthy, 2 replicas
+- **Staging:** v0.5.2 ✅ healthy, deployed with marked v17 upgrade
+- **Support tickets:** 0 pending
+- **Bugs:** 0 open
+
+### Work Done
+- **Upgraded `marked` v15→v17** (security + breaking change migration)
+  - ReDoS vulnerability fix (v17.0.4)
+  - Added 10 new tests for list rendering: loose lists, checkboxes, nested lists, mixed content
+  - Tests: 647→657, all green
+  - Zero TypeScript errors, zero npm audit vulnerabilities
+  - Pushed to main, deployed to staging, smoke-tested (markdown with lists → valid PDF)
+
+### Audit Notes
+- All semver-range deps at latest (within ^ranges)
+- Remaining major upgrades: Express 5, express-rate-limit 8, vitest 4 (future sessions)
+- No CI runner still (tests run locally only)
+
 ## Session 157 — 2026-03-10 19:00 UTC (Tuesday Evening)
 - **Production:** v0.5.1 ✅ healthy, 2 replicas, 0 restarts, ~12d uptime
 - **Staging:** v0.5.2 ✅ commit af3391d (69+ commits ahead of prod)
diff --git a/projects/business/memory/state.json b/projects/business/memory/state.json
index 52c9437..8afd32e 100644
--- a/projects/business/memory/state.json
+++ b/projects/business/memory/state.json
@@ -3,7 +3,7 @@
   "phaseLabel": "Build Production-Grade Product",
   "status": "launch-ready",
   "product": "DocFast — HTML/Markdown to PDF API",
-  "currentPriority": "Production on v0.5.1. Staging v0.5.2 (69+ commits ahead). npm audit 0 vulns. 647 tests passing (59 files). ZERO open bugs. ZERO tsc --noEmit errors (strict mode clean). CI runner still absent — needs restoration. Ready for production tag when investor approves.",
+  "currentPriority": "Production on v0.5.1. Staging v0.5.2 (70+ commits ahead). npm audit 0 vulns. 657 tests passing (60 files). marked upgraded v15→v17 (ReDoS fix). ZERO open bugs. ZERO tsc --noEmit errors (strict mode clean). CI runner still absent — needs restoration. Ready for production tag when investor approves.",
   "ownerDirectives_PRIORITY": "Process these IN ORDER. Do not skip. Remove items marked ✅ DONE/FIXED during housekeeping.",
   "ownerDirectives": [
     "Stripe Product ID for DocFast: prod_TygeG8tQPtEAdE — webhook handler must filter by this product_id to ignore events from other projects on the same Stripe account."
@@ -83,7 +83,7 @@
     "LOW": [],
     "note": "All bugs resolved. BUG-105 fixed 4f6659c. BUG-104 fixed 503e651. BUG-103 (template validation bypass) fixed 47571c8. BUG-102 (sanitized options ignored) fixed ba2e542. BUG-101 (body limits) fixed c03f217. BUG-100 (flush poisoning) fixed d2f819d. BUG-099 (memory leak) fixed 5f776db. BUG-098 (interceptor leak) fixed 024fa00."
   },
-  "sessionCount": 157
+  "sessionCount": 158
   },
   "blockers": [],
   "startDate": "2026-02-14"