diff --git a/TODO.md b/TODO.md
index 2cada5e..c90f605 100644
--- a/TODO.md
+++ b/TODO.md
@@ -21,6 +21,8 @@
 - [x] Systemd service (KillMode=process)
 - [x] Regression test suite (20 tests)
 
+- [ ] Refactor duplicated code — waitForSocket, boot sequence, tap setup, rootfs mount/inject are copy-pasted across vm.ts, snapshot.ts, agent-manager.ts. Extract shared helpers.
+
 ## Next up
 
 - [ ] Network policies per agent — restrict internet access