diff --git a/TODO.md b/TODO.md
index 1f6ec7d..d153f72 100644
--- a/TODO.md
+++ b/TODO.md
@@ -89,6 +89,17 @@ Pick anything from here when relevant. Cross-cutting design notes live in
   eye on; if it gets renamed too, sync_agents stops being
   able to seed a fresh meta repo.
 
+- **Stream `nixos-container update` stdout into tracing.**
+  Today `lifecycle::run` calls `.output()` which buffers
+  until exit, so a 5-minute rebuild looks identical to a hang
+  in the journal — only the success/failure summary lands. Pipe
+  stdout + stderr line-by-line into tracing (or into the
+  per-agent live event bus when we know which agent) so the
+  operator sees `building '/nix/store/…drv'` / `copying path …`
+  in real time and can tell "slow" from "stuck." Same applies to
+  every other `nixos-container` shellout that takes
+  meaningful time (`create`, `update`).
+
 ## Bugs
 
 - **Pending question doesn't always appear on the dashboard.**