diff --git a/TODO.md b/TODO.md
index 7931a76a..edd4c8aa 100644
--- a/TODO.md
+++ b/TODO.md
@@ -80,6 +80,16 @@ the owner's OS user and can never be granted. Indirection there really is accide
       lookup, the role cache and the fail-closed catches is exercised only by hand. It is the file
       standing between a Member and a shell.
 
+- [ ] **`assertCapabilityTotality` checks the wrong list, and `registry.test.ts` has been red since
+      2026-08-13.** It is fed `Object.keys(handlers)` from `server.tsx`, but Bun serves the *route table*.
+      Those diverged when the cliamp/desktop/vault plugins were switched off: `/api/cliamp/ws` and
+      `/api/cliamp/audio/ws` are still live routes with their handlers and registry claims commented out.
+      Not exploitable — `isWsProviderAllowed` finds no capability and 403s a member; the owner upgrades onto
+      a dead socket. But the boot check that exists to stop exactly this cannot see it. Two fixes: point
+      totality at the route table, and either delete the dead routes or restore their claims. The 8 failing
+      tests in `registry.test.ts` are the same drift — `REAL_WS` still lists all nine providers as served,
+      which is why nobody noticed. Found 2026-08-14.
+
 - [ ] **No empty state for a denied screen.** A member who reaches a route their role lacks gets a
       broken panel or an endless spinner rather than a clean refusal.