diff --git a/scheme/httpd/surflets/TODO b/scheme/httpd/surflets/TODO
new file mode 100644
index 0000000..d24e1a8
--- /dev/null
+++ b/scheme/httpd/surflets/TODO
@@ -0,0 +1,107 @@
+- adjust open-clause in SURFLETS
+- split surflet-handler file into multiples.
+- add more comments to files.
+- change assoc to assq in get-header in surflets.
+- Add note that make-redirect-response is for CGI only
+- Add note to make-redirect-response that the browser won't notice the
+-  redirect.
+- Add possibility to generate error-responses.
+- Add-simple does not work.
+- Simple SUrflet does not work.==> Bug in GET-BINDINGS of POST req.s
+>>NO PROBLEM on other sites: * ??Spaceships' last step does not work.
+- Surflet administration does not work.
+- *POST-cache* in surflets.scm should be threadsafe. (it is)
+- killing sessions results in error
+>>MOVED to LATER: * Simple Surflets cannot have extra HTML.
+- Uppercase some surflet names in strings.
+- Remove surflet-prefix from surflet-handler options.
+- Remove return-continuation from instance.
+- DELETE-CONTINUATION in surflet-handler: obtain lock before looking
+- for continuation table.
+- Rewrite LOAD-SURFLET in GET-SURFLET-RT-STRUCTURE in surflet-handler
+- thus it is may stand alone.
+- look for resume-url-ids only in the filename, not in the path part.
+>>MOVED to LATER: * ?Only one thread for all surveillance
+- Use convert for gnuplot's output.
+>>>* Better structure for input-fields: changing default values
+>>>* Change representation of Simple SUrflet objects to 
+>>>  record types.
+>>>* Implement vectors with WRITE-BLOCK (see doc/io.txt)
+- DISCOURAGED: SUrflets get only bindings?
+- add-html self-link is wrong, same in add-surflet.scm
+- unify returned-via? and input-field-binding in dispatcher
+?? not reproducable Gateway error while accessing non existing surflet continuation
+- There's a TODO at the end of admin-profiling
+- use scheme-with-scsh in packages.
+- input-field-binding-check in admin-handler (should-be input-field-value)
+- rename set-options-session-lifetime to set-options-session-lifetime!
+- dito for adjust-timeout
+>>>It is useful for initial requests or simple session-id recovering 
+  >> unexport instance-session-id: no use cognizable
+- disentangle form-query (surflets/simple-surflet-api)
+* alias for extract-single-binding (extract/single) and extract-bindings
+  (extract)?
+- outsource some parts from surflets.scm; make them extra modules
+- export conversion-rules 
+- remove l.320: why can't ... be deleted correctly?
+- add session-alive?
+- (define (session-alive? session-id)
+-   (assoc session-id (get-sessions)))
+- add send-html-string that gets a string and sends a no-caching html
+- export status-code Makro for surflet-handler's responses
+- three layer structures:
+  (a) Usual User: surflets:
+      surflets/send-html
+  (b) Advanced User: 
+      . Access to (his) session
+	# surflets/sessions      
+      . own conversion rules
+        # surflets/my-sxml
+      . continuations
+        # responses
+        # send/.. primitives:
+        # surflet-handler/primitives:
+  	  (export 
+  	  surflet-response-constructor
+  	  surflet-response-selectors
+  	  send/.. primitives
+  	  send-error
+  	  (status-code :syntax))
+  (c) Adminstrative User: Full acccess to surflet-handler
+  Naming convention: Avoid "surflet-handler/.." in name, if there is
+  no semantical context to the surflet-handler (e.g. exceptions:
+  responses, status-code, requests)
+>>>* Problem: surveillance-thread: obtains the lock to remove the session
+  entry, if the time-to-live is zero. It may happen that another
+  thread is waiting for this lock just to do something with the killed
+  session. This will encounter an error where the lock for the session
+  table is not released. Thus, we have to use error-handler
+  everywhere, where we use *session-table-lock*
+  >> Some argument checks added with commit 1.64 of
+     surflet-handler.scm
+- >> WITH-LOCK
+- add GET-SESSION to surflet-handler
+- alist-administration in make-callback/make-annotated-address
+  (make-valued-address) -> (url [value] -> return-address)
+  returned-via? will return the value or #f if none was given
+- change data structure for input-fields
+- add annotated versions for input-field constructors
+* make subset lists for some parts
+- structure WITH-LOCK from sunterlib (add to load-surflet-server.scm)
+  and/or DYNAMIC-WIND
+- only ship ID of session / continuation to the user (--> if he saves
+  the session, it will never be GC'ed otherwise)
+- in add-raw: remove link to add-html.scm
+- remove bug: strings in urls seem to be html-quoted twice
+- at simple-surflet-api: bigger distance between following
+  radio-input-fields
+- surflet-handler 552: session-id instead of instance-session-id
+
+send error 411 "Length required" in get-content-length (bindings.scm)
+if the content-length-header is missing.
+
+don't use with-real-input-field, use let and cadr instead. (?)
+
+use internal-error, if surflet fails, not bad gateway
+
+don't let callbackfunctions return.
\ No newline at end of file