diff --git a/src/calculator.ts b/src/calculator.ts
index 68b894d..8fa3de6 100644
--- a/src/calculator.ts
+++ b/src/calculator.ts
@@ -15,7 +15,7 @@ export function multiply(a: number, b: number): number {
   return a * b
 }
 
-// BUG: Division by zero is not handled
 export function divide(a: number, b: number): number {
+  if (b === 0) throw new Error("Division by zero")
   return a / b
 }
diff --git a/src/date-utils.ts b/src/date-utils.ts
index 37272a7..4aad361 100644
--- a/src/date-utils.ts
+++ b/src/date-utils.ts
@@ -5,16 +5,13 @@
 /**
  * Format a date as a human-readable relative string.
  * e.g. "2 days ago", "just now", "in 3 hours"
- *
- * BUG: off-by-one — uses Math.floor where Math.round is needed for days,
- * causing "1 day ago" to appear for anything from 12h to 47h.
  */
 export function formatRelative(date: Date, now: Date = new Date()): string {
   const diffMs = now.getTime() - date.getTime()
   const diffSec = diffMs / 1000
   const diffMin = diffSec / 60
   const diffHours = diffMin / 60
-  const diffDays = Math.floor(diffHours / 24) // BUG: should be Math.round
+  const diffDays = Math.round(Math.abs(diffHours) / 24)
 
   if (Math.abs(diffSec) < 60) return "just now"
   if (Math.abs(diffMin) < 60) {
diff --git a/src/string-utils.ts b/src/string-utils.ts
index 63fba18..d364b6d 100644
--- a/src/string-utils.ts
+++ b/src/string-utils.ts
@@ -11,10 +11,16 @@ export function reverse(str: string): string {
   return str.split("").reverse().join("")
 }
 
-// TODO: implement truncate — should truncate at a word boundary, with "..."
-// counting toward maxLength. Return unchanged if str.length <= maxLength.
+const ELLIPSIS = "..."
+
 export function truncate(str: string, maxLength: number): string {
-  throw new Error("not implemented")
+  if (str.length <= maxLength) return str
+  if (maxLength <= ELLIPSIS.length) return str.slice(0, Math.max(0, maxLength))
+
+  const clipped = str.slice(0, maxLength - ELLIPSIS.length)
+  const lastSpace = clipped.lastIndexOf(" ")
+  const body = lastSpace > 0 ? clipped.slice(0, lastSpace) : clipped
+  return body.trimEnd() + ELLIPSIS
 }
 
 export function slugify(str: string): string {
@@ -24,8 +30,8 @@ export function slugify(str: string): string {
     .replace(/^-|-$/g, "")
 }
 
-// BUG: This doesn't handle multiple consecutive spaces
 export function wordCount(str: string): number {
-  if (!str.trim()) return 0
-  return str.split(" ").length
+  const trimmed = str.trim()
+  if (!trimmed) return 0
+  return trimmed.split(/\s+/).length
 }
diff --git a/src/task-manager.ts b/src/task-manager.ts
index a920e85..9afa472 100644
--- a/src/task-manager.ts
+++ b/src/task-manager.ts
@@ -52,20 +52,31 @@ export class TaskManager {
     return true
   }
 
-  // TODO: implement — remove a task by id, return true if removed, false if not found
   remove(id: string): boolean {
-    throw new Error("not implemented")
+    return this.tasks.delete(id)
   }
 
-  // TODO: implement — update title/description/priority of a task
-  // return true if updated, false if not found
   update(id: string, changes: Partial<Pick<Task, "title" | "description" | "priority">>): boolean {
-    throw new Error("not implemented")
+    const task = this.tasks.get(id)
+    if (!task) return false
+    if (changes.title !== undefined) task.title = changes.title
+    if (changes.description !== undefined) task.description = changes.description
+    if (changes.priority !== undefined) task.priority = changes.priority
+    return true
   }
 
-  // TODO: implement — return all tasks sorted by the given field
-  // priority sort order: high > medium > low
   sortBy(field: "priority" | "createdAt" | "status"): Task[] {
-    throw new Error("not implemented")
+    const priorityOrder: Record<Priority, number> = { high: 0, medium: 1, low: 2 }
+    const statusOrder: Record<Status, number> = { in_progress: 0, pending: 1, completed: 2 }
+    const tasks = Array.from(this.tasks.values())
+
+    switch (field) {
+      case "priority":
+        return tasks.sort((a, b) => priorityOrder[a.priority] - priorityOrder[b.priority])
+      case "status":
+        return tasks.sort((a, b) => statusOrder[a.status] - statusOrder[b.status])
+      case "createdAt":
+        return tasks.sort((a, b) => a.createdAt.getTime() - b.createdAt.getTime())
+    }
   }
 }
diff --git a/src/validator.ts b/src/validator.ts
index 27bf385..ee5c667 100644
--- a/src/validator.ts
+++ b/src/validator.ts
@@ -2,27 +2,43 @@
  * Input validation utilities.
  */
 
+const DOMAIN_LABEL = /^[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?$/
+const TLD = /^[a-zA-Z]{2,63}$/
+
 /**
  * Returns true if the string is a valid email address.
  *
- * BUG: the regex does not allow subdomains (e.g. user@mail.example.com fails)
- * and rejects valid TLDs longer than 4 chars (e.g. .museum, .travel).
+ * Validated by splitting on "@" and checking each dot-separated domain label
+ * individually. This accepts subdomains (user@mail.example.com) and TLDs
+ * longer than four characters (user@example.museum), both of which the
+ * previous single-pattern check rejected. Length limits follow RFC 5321:
+ * 254 characters total, 64 for the local part.
  */
 export function isEmail(value: string): boolean {
-  // BUG: too restrictive — missing subdomain support and long TLDs
-  return /^[^\s@]+@[^\s@]+\.[a-zA-Z]{2,4}$/.test(value)
+  if (!value || value.length > 254) return false
+
+  const parts = value.split("@")
+  if (parts.length !== 2) return false
+
+  const [local, domain] = parts
+  if (!local || local.length > 64 || /\s/.test(local)) return false
+  if (!domain || /\s/.test(domain)) return false
+
+  const labels = domain.split(".")
+  if (labels.length < 2) return false
+  if (!labels.every((label) => DOMAIN_LABEL.test(label))) return false
+
+  return TLD.test(labels[labels.length - 1])
 }
 
 /**
  * Returns true if the string is a valid URL (http or https).
- *
- * BUG: rejects URLs with ports (e.g. http://localhost:3000)
+ * Ports are permitted (e.g. http://localhost:3000).
  */
 export function isUrl(value: string): boolean {
   try {
     const url = new URL(value)
-    // BUG: only allows http/https but also rejects valid port usage
-    return (url.protocol === "http:" || url.protocol === "https:") && url.port === ""
+    return url.protocol === "http:" || url.protocol === "https:"
   } catch {
     return false
   }