diff --git a/docs/chat-hardening-plan.md b/docs/chat-hardening-plan.md
index a306276..cd09693 100644
--- a/docs/chat-hardening-plan.md
+++ b/docs/chat-hardening-plan.md
@@ -355,6 +355,10 @@ it; do not make ordinary unit tests depend on external network access.
   stress run; verify leave/reconnect controls remain responsive.
 - [ ] Linux and Windows URL opening for valid links; malformed/userinfo links remain
   selectable but do not launch.
+- [ ] A message with more than eight URLs renders eight clickable links and the
+  rest as selectable plain text, with nothing dropped.
+- [ ] A message attempting bidi-override display spoofing renders in send order
+  (the override characters are stripped, emoji/joining-script text intact).
 
 ## Completion criteria