docs: add filepond crash analysis report

Documents the 'can't access property main, n.status is undefined'
crash in FilePond 4.32.12. Root cause: vendor code in filepond.min.js
has a property name mismatch — createResponse objects use .code but the
load-file-error handler reads .status. When action.status is undefined,
the view writers crash.

Proposes Option B (custom load function) as the cleanest fix.

TODO.md

@@ -14,10 +14,9 @@ Reference: `docs/autosave-system.md` → "HTMX v2 Migration Plan" section.
 - [x] Form-help inline editors: add OverType toolbar + HTMX auto-save + remove save buttons
 - [x] Markdown cheatsheet modal: reusable dialog on all OverType editors
 
-## FilePond error fixes
+## FilePond crash on TFE upload forms
 
-- [x] Fix `server.process.onerror`: don't access `response.status` on string (response is XHR text body)
-- [x] Fix `server.load`: convert from string URL to object with proper `onload`/`onerror` handlers
-- [x] Fix `server.process.onload`: guard against non-ID responses (e.g. HTML error pages disguised as 200)
-- [x] Fix `destroyFilePondsIn`: abort in-flight uploads before destroying to prevent stale XHR callbacks crashing `_write`
-- [x] Fix `FilepondHandler.php`: set `Content-Type: text/plain` header at top of `handleProcess`, `handleLoad`, `handleRevert`, `handleRemove` so PHP doesn't default to `text/html` on `die()`
+- [x] Analyze root cause → `docs/filepond-crash-analysis.md`
+- [x] Partial fixes (Content-Type headers, onerror cleanup, load object) — insufficient, crash still reproduces
+- [ ] Replace `server.load` with custom function to bypass FilePond's buggy `load-file-error` → `DID_THROW_ITEM_INVALID` dispatch (see analysis doc, Option B)
+- [ ] Implement `destroyFilePondsIn()` pre-destroy abort (defense in depth)