note the x11vnc orphan/duplicate risk in TODO

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

TODO.md

@@ -31,6 +31,16 @@ Deferred work. Context: Officer is collapsing from multi-tenant / open-source-re
       paths and an outdated package name, so `installPi` always fires and floods the logs with
       `EEXIST` noise. Should detect `@earendil-works/pi-coding-agent` at the real npm prefix.
 
+- [ ] **VNC mirror can orphan/duplicate x11vnc across sidecar restarts.** `vnc-manager.startSession`
+      tracks the running mirror in module-level state and skips spawning only if that pid is alive.
+      On a vnc-sidecar restart the state resets to null while the old x11vnc keeps running orphaned;
+      the next `startSession` spawns a second one. Worse, `waitForPort` treats *any* listener on 5900
+      as success, so the platform can believe it started a mirror that is actually a stale process —
+      desyncing into multiple contending x11vnc instances on `:0` (suspected cause of click-lag on
+      2026-07-16, cleared by killing all but one). Fix: before spawning, kill any existing
+      `x11vnc -display :0` / free port 5900 (an `ExecStartPre`-style cleanup, like the old
+      officer-vnc.service unit did with `vncserver -kill`).
+
 ## Infra (alpha)
 
 - [ ] **Delete `/etc/systemd/system/officer-vnc.service`.** Hand-installed unit (not in this repo)