diff --git a/TODO.md b/TODO.md
index 3108cd1c..8100ab1c 100644
--- a/TODO.md
+++ b/TODO.md
@@ -20,7 +20,7 @@ the owner's OS user and can never be granted. Indirection there really is accide
 
 ## Themes
 
-**78 open, 18 closed**, across 28 themes.
+**79 open, 18 closed**, across 28 themes.
 
 | Theme                                                                                      | Open | Closed |
 | ------------------------------------------------------------------------------------------ | ---- | ------ |
@@ -35,7 +35,7 @@ the owner's OS user and can never be granted. Indirection there really is accide
 | [Files app — routing](todo/files-app/)                                                     | 3    | 0      |
 | [Fleet — one command across every server](todo/fleet/)                                     | 3    | 0      |
 | [Headscale](todo/headscale/)                                                               | 0    | 5      |
-| [Infra (alpha)](todo/infra/)                                                               | 5    | 0      |
+| [Infra (alpha)](todo/infra/)                                                               | 6    | 0      |
 | [Known bugs](todo/known-bugs/)                                                             | 2    | 1      |
 | [Mobile apps](todo/mobile-apps/)                                                           | 2    | 0      |
 | [Multi-user](todo/multi-user/)                                                             | 17   | 3      |
@@ -70,5 +70,5 @@ the owner's OS user and can never be granted. Indirection there really is accide
 - `2026-08-21` **Watch a directory, and attach actions to what lands in it** — [file-watchers/watch-a-directory-and-attach-actions-to-what](todo/file-watchers/watch-a-directory-and-attach-actions-to-what.md)
 - `2026-08-21` **Settings to choose which server each feature uses** — [fleet/settings-to-choose-which-server-each-feature](todo/fleet/settings-to-choose-which-server-each-feature.md)
 - `2026-08-21` **A way to mark a commit "this one ships", so a release is not just `master`'s tip** — [fleet/a-way-to-mark-a-commit-this-one-ships-so-a](todo/fleet/a-way-to-mark-a-commit-this-one-ships-so-a.md)
+- `2026-08-21` **OPM — Officer's own process manager, or at least its own PM2** — [infra/opm-officer-s-own-process-manager](todo/infra/opm-officer-s-own-process-manager.md)
 - `2026-08-21` **iPhone Action Button → run an Officer task from a locked phone** — [mobile-apps/iphone-action-button-run-an-officer-task-from](todo/mobile-apps/iphone-action-button-run-an-officer-task-from.md)
-- `2026-08-21` **The mobile recorder app, and the dispatcher agent behind it** — [mobile-apps/the-mobile-recorder-app-and-the-dispatcher](todo/mobile-apps/the-mobile-recorder-app-and-the-dispatcher.md)
diff --git a/todo/infra/opm-officer-s-own-process-manager.md b/todo/infra/opm-officer-s-own-process-manager.md
new file mode 100644
index 00000000..fc575d8d
--- /dev/null
+++ b/todo/infra/opm-officer-s-own-process-manager.md
@@ -0,0 +1,30 @@
+---
+id: infra/opm-officer-s-own-process-manager
+title: "OPM — Officer's own process manager, or at least its own PM2"
+theme: infra
+status: open
+created: 2026-08-21
+date_source: stated
+order: 0
+---
+
+**OPM — Officer's own process manager, or at least its own PM2.** Raised 2026-08-21. Taken as: give
+Officer's processes a manager of their own, **named OPM**, rather than sharing one daemon with whatever
+else lives on the host — worth doing for separation of concerns alone, even without any new capability.
+
+The argument is that Officer is now a fleet of processes, not a process. `pm2 jlist` counts **13 officer
+entries on `officer-dev` and 19 on `alpha`** (verified 2026-08-21), and every one of them is a peer of
+the server rather than a child of it. They are managed today by a generated `ecosystem.config.cjs`
+(`bun run gen:ecosystem`) on a PM2 daemon that belongs to the login user, not to Officer.
+
+What sharing costs, all of it already written down in `CLAUDE.md`: `pm2 restart ecosystem.config.cjs`
+bounces **every** sidecar including the vault, so the safe habit is `--only <name>` and the unsafe one
+looks identical; a `pm2 list` mixes Officer's processes with other projects' and the rule "nothing here
+should touch them" is a convention rather than a boundary; and the documented list of entries goes stale
+every time a sidecar lands, because nothing owns it. **Note the foreign-process case is host-dependent** —
+`mybiblepal-api` and `mybiblepal-audio` are named in `CLAUDE.md` as sharing this daemon, and neither is
+running on `officer-dev` or `alpha` today.
+
+Open, and the owner's call: whether OPM is a genuinely new supervisor or PM2 kept underneath with its own
+daemon, namespace and CLI wrapper — which would buy the separation at a fraction of the cost, since the
+`ecosystem.config.cjs` generation, the naming convention and the restart discipline all already exist.