diff --git a/TODO.md b/TODO.md
index d080aca3..41f4aef5 100644
--- a/TODO.md
+++ b/TODO.md
@@ -254,6 +254,20 @@ write**, orphaning a pty per reload; Running Shells has **404'd since 2026-07-31
 error boundaries** anywhere in the repo; and `dashboards.id` is a **global** primary key fed by
 `slugify(name)`, so two members naming a dashboard the same thing collide.
 
+- [ ] **Renaming a panel key is a silent data migration, and the repair is destructive.** A saved layout
+      holds `appType` strings. `normalizeLayout` replaces any appType not in the allow-list with the
+      caller's `fallback`, and `WorkspaceView.tsx:97` writes that back — so a renamed key turns every
+      saved layout into N copies of whichever panel is `allowed[0]`, permanently, on one page load.
+      Renaming `headscale-*` → `offscale-*` did exactly this: `/offscale` rendered three server pickers,
+      `ServersView` never mounted, and it survived every restart because the code was correct and the
+      data was not (2026-08-17, `ed3806f9`).
+
+      Plugin screens are now cleared at install, which covers plugins and nothing else. The general fix
+      is a rule about wholesale mismatch: **a layout in which NO panel has a recognised appType is
+      residue from older code — discard it and use the screen's default**, rather than collapsing it.
+      `fallback: allowed[0]` is arbitrary (it is whatever `panels.ts` happens to list first) and should
+      probably not be a per-panel substitution at all.
+
 ## Code editor
 
 - [ ] **The owner wants to go deeper here — ideas pending (noted 2026-08-15).** Raised right after the file