diff --git a/TODO.md b/TODO.md
index f2b707bd..4720814c 100644
--- a/TODO.md
+++ b/TODO.md
@@ -27,11 +27,24 @@ the owner's OS user and can never be granted. Indirection there really is accide
       and the answers arrive as keystrokes. Visible to a member daily. Fix is to strip query sequences in
       `appendBuffer`, so a replay reproduces output and never re-issues requests.
 
+- [ ] **The web terminal renders a long URL as unreadable fragments.** Claude Code's first-run login prints
+      a ~400-character OAuth URL; the web terminal shows scattered characters with large gaps, nothing
+      selectable. Half worked around by `2a8f004` (OSC 52, so "press c to copy" reaches the clipboard) — the
+      rendering itself is undiagnosed. This is every new member's first five minutes.
+      `docs/open-threads-after-per-user-claude.md` §1 has what is known and where to start.
+
 - [ ] **Agent sessions are not durable, and it is one property behind three symptoms.** A sidecar restart
       loses session identity, which is why `endTurnIfAgentIsGone` must skip sessions with no recorded
       `userId`, why a stuck "generating" spinner survives until a reconnect, and why any crash in that process
       is destructive rather than merely inconvenient. Fixing the three separately would miss that they are one
-      missing property.
+      missing property. `docs/open-threads-after-per-user-claude.md` §2.
+
+- [ ] **`ProcessTransport is not ready for writing` — survivable since `8c4f150`, still unexplained.** A
+      floating rejection inside the SDK's own input pump, with no frames from our code, so no `await` of ours
+      can catch it. It crashed `officer-agent` four times on 2026-08-11, once truncating a turn mid-sentence;
+      the `unhandledRejection` backstop has caught it once since. Best hypothesis is the `claude` CLI exiting
+      while `streamInput` is still pumping. It needs looking at after the next occurrence, not catching in the
+      act — markers to grep in `docs/open-threads-after-per-user-claude.md` §3.
 
 - [x] **No way to create a second account.** Fixed 2026-08-11 on `sidecar-app-store`: `POST /api/users`
       (`api/users/create-user.ts`, owner-gated) plus an Add-account form in