diff --git a/2026/2026-08-17--bonfire-chromium-login.md b/2026/2026-08-17--bonfire-chromium-login.md
index 1ed468c..567205a 100644
--- a/2026/2026-08-17--bonfire-chromium-login.md
+++ b/2026/2026-08-17--bonfire-chromium-login.md
@@ -26,3 +26,9 @@ Not the `isoc` account (email + username profile exist; login API ok).
 Unregister the worker for `bonfire.hacktivism.ch` in that Chromium profile (`chrome://serviceworker-internals` or DevTools Application), clear site data, hard reload. Then `/login` matches Firefox.
 
 Host copies (optional, recreate-volatile in the image): `~/koopa-bonfire/data/branding/{pwabuilder-sw.js,hacktivism-login-fix.css,unregister-sw.js}`.
+
+## Upstream
+
+Not marked known in Bonfire GitHub (2026-08-17): no issue matches `pwabuilder-sw` or “service worker login”. Related PWA issues are push (#1292) and widgets (#1758), not Chromium `/login` hijack.
+
+**Still open locally.** File a bonfire-app issue when ready: `configs/bonfire/TODO-chromium-login-upstream.md`.
diff --git a/configs/bonfire/README.md b/configs/bonfire/README.md
index fa886a0..5e4c759 100644
--- a/configs/bonfire/README.md
+++ b/configs/bonfire/README.md
@@ -47,4 +47,7 @@ Workaround (this Chromium profile):
 Server-side notes (host `~/koopa-bonfire/data/branding/`, not a substitute for unregister): kill-switch `pwabuilder-sw.js`, overlay CSS, login-click JS. Container copies are overwritten on image recreate.
 
 Daylog: `2026/2026-08-17--bonfire-chromium-login.md`.  
-UI badge **Federation disabled** can still show while `.env` has `FEDERATE=true` (see `2026/2026-07-10--bonfire-federate.md`).
\ No newline at end of file
+**Unsolved** in operator Chromium. File-upstream TODO: `TODO-chromium-login-upstream.md`.  
+UI badge **Federation disabled** can still show while `.env` has `FEDERATE=true` (see `2026/2026-07-10--bonfire-federate.md`).
+
+**Upstream (checked 2026-08-17):** not filed as a known Bonfire bug. GitHub `org:bonfire-networks` issues: 0 hits for `pwabuilder-sw` / `service worker login`. PWA tickets are [web push #1292](https://github.com/bonfire-networks/bonfire-app/issues/1292) and [dashboard widgets #1758](https://github.com/bonfire-networks/bonfire-app/issues/1758) — not this Chromium navigation stall. Login-labelled issues are other topics (2FA, Welcome Back button, OAuth).
\ No newline at end of file
diff --git a/configs/bonfire/TODO-chromium-login-upstream.md b/configs/bonfire/TODO-chromium-login-upstream.md
new file mode 100644
index 0000000..b81a302
--- /dev/null
+++ b/configs/bonfire/TODO-chromium-login-upstream.md
@@ -0,0 +1,15 @@
+# TODO — file Chromium login stall upstream
+
+**Status:** open (2026-08-17). Symptom on https://bonfire.hacktivism.ch/ is **unsolved** in the operator Chromium profile.
+
+Firefox and `curl` work. Chromium stays on the guest homepage (Log in click and `/login` in the address bar).
+
+**Upstream:** not a known Bonfire issue. GitHub `org:bonfire-networks` has 0 issues for `pwabuilder-sw` / “service worker login”. PWA tickets (#1292 web push, #1758 widgets) are something else.
+
+## Still to do
+
+1. File a **bonfire-app** bug (Social **1.0.5**): Chromium + PWA SW (`register("/pwabuilder-sw.js", {scope: "/"})`) can keep `/` and `/login` on the cached guest homepage; guest page also uses `data-live-socket="false"` + `data-phx-link="redirect"` on Log in.
+2. Link this instance as one repro (no secrets). Point at `README.md` § *Login in Chromium* and `2026/2026-08-17--bonfire-chromium-login.md`.
+3. After a GitHub issue exists, put the URL here and in `README.md`; close this TODO.
+
+Do **not** treat unregister-SW / Incognito / Firefox as a product fix — those are local workarounds only.