diff --git a/TODO.md b/TODO.md
new file mode 100644
index 0000000..a695101
--- /dev/null
+++ b/TODO.md
@@ -0,0 +1,68 @@
+# TODO — robustness backlog for the van router (`wayback`)
+
+Candidate improvements toward a robust unattended mobile router, tiered by
+value-for-effort. Generated 2026-06-29 from a robustness review of the live box.
+
+## Already in place (for reference — don't redo)
+
+- [x] Multi-WAN failover (wifi → Starlink → 4G) — `van-failover`
+- [x] Thermal monitoring + alerts + history — `van-thermal`
+- [x] Battery low-charge Pushover alerts + safe auto-shutdown — `van-battery`
+- [x] Mains ↔ battery transition alerts
+- [x] Cockpit dashboard (AP, temps, battery, failover, WAN)
+- [x] Never-sleep / lid-closed operation
+- [x] `unattended-upgrades` enabled
+- [x] `smartd` active (SMART being read) — but see Tier 2 (alerts go nowhere)
+- [x] Time sync healthy (NTP synced)
+- [x] journald within sane ZFS limits
+
+---
+
+## Tier 1 — high value, pieces already on hand
+
+- [ ] **systemd hardware watchdog** — `/dev/watchdog` exists but isn't wired. A hung
+  kernel/driver currently needs someone to open the lid. Given the EC-latch and
+  USB-hub-hang history, auto-reboot-on-hang is the biggest unattended win.
+  Set `RuntimeWatchdogSec` (and `RebootWatchdogSec`) in `/etc/systemd/system.conf`.
+- [ ] **Auto power-on when mains returns** — the 10% auto-shutdown is currently a
+  one-way trip; a laptop won't boot itself when solar/shore power returns. Needs the
+  BIOS "restore on AC loss → power on" setting (cannot be set from the OS). Without
+  it the safe-shutdown can strand the router. **Manual BIOS toggle.**
+- [ ] **Heartbeat / dead-man's switch** — every existing alert can only fire if the box
+  is alive. A periodic ping to healthchecks.io (or similar) inverts it: silence =
+  something is dead (panic, no-boot, total power loss).
+- [ ] **Connectivity alerts → Pushover** — `van-failover` already knows when it fails
+  over or when ALL WANs are down; it just logs it. Pipe those events to the Pushover
+  plumbing so internet loss is alerted, not just battery.
+
+## Tier 2 — worth doing soon
+
+- [ ] **smartd → Pushover** — smartd alerts default to emailing root (a black hole on a
+  headless box). Wire `-M exec` to a Pushover script so NVMe SMART/wear warnings
+  (reallocated sectors, wear-leveling) actually reach a phone.
+- [ ] **ZFS hygiene** (root is `zroot`) — schedule a periodic scrub (with zfs-zed
+  alerting), and auto-snapshot before `deploy.sh` for one-command rollback. Cap ARC if
+  RAM ever gets tight.
+- [ ] **Security hardening**:
+  - [ ] Cockpit binds `*:9090` (all interfaces incl. WANs unless nftables drops inbound —
+    confirm). Restrict to LAN/ZeroTier.
+  - [ ] Add `fail2ban` for Cockpit/SSH.
+  - [ ] WPA3-transition on the AP.
+  - [ ] Guest SSID isolated from trusted devices.
+- [ ] **Cellular data-cap tracking** — `vnstat` or nftables counters on the gsm iface +
+  a Pushover alert near the monthly cap, to avoid bill shock when parked on 4G.
+
+## Tier 3 — situational
+
+- [ ] **Captive-portal handling** for public-WiFi WANs (campsites / neighbour APs) —
+  detection at minimum, auto-auth for frequently-used ones.
+- [ ] **GPS** — location logging / geofencing / offline time source.
+- [ ] **Secrets backup** — git covers configs, but `/etc/van-battery/pushover.json` and
+  other secrets are intentionally out of git. Document a restore path so a disk swap
+  doesn't lose them.
+
+---
+
+**Suggested next:** Tier 1. The watchdog and connectivity-alerts are quick and reuse
+existing plumbing; the AC-restore BIOS setting is what makes the battery auto-shutdown
+genuinely safe rather than a trap.