Piik/docs/todo.md

Current TODO Ledger

Last reviewed: 2026-10-04

Only Now is executable. Product modules own behavior; Git/PRs own completed history. A parked idea is not implementation authority.

Now

• Publish the accepted v1.8.0 candidate first. Authorized by the owner on 2026-10-04. Complete final checks and publish through the existing squash PR, packaging, mirror and deployment workflow. Preserve #449's contributor credit and Co-authored-by identity. Reply to resolved issues at publication; retain unmatched field reports below. This release keeps the published protocols and 1440p ceiling; the subsequent media/transport work is separate.
• Resolve the extensibility audit boundaries before freezing 2.0. Review the media findings in the assessment below together with optional interaction evolution: the current reaction catalog is a strict wire enum, and an unknown reaction or extra event field terminates the Browser signaling session. Current producers do not send those values. Choose bounded capability-gated delivery or a safe presentation fallback before expanding the catalog; preserve strict command and authority validation. No replacement protocol is accepted yet.
• Align native source-list aggregate bounds. The helper admits up to 1024 sources, but nativecapture.ListSources reuses the 64 KiB probe-output bound. A synthetic helper with 64 individually valid 512-character window titles returns no list; the 32-source control succeeds. Align enumeration, encoded JSON and loopback response budgets with bounded overflow behavior. This is a confirmed uncommon enumeration failure, not a diagnosis of earlier reporter logs; it does not justify removing byte limits or adding pagination.
• Implement extensible resolution and transport support after v1.8.0. The owner requested continued repository review, then 4K (#410) and additional resolutions with adaptation and capability negotiation, followed by Magicsock NAT traversal on 2026-10-04. Compare the isolated Go transport with the repaired Pion baseline under the NAT evidence boundary. Evaluate orientation-independent resolution limits, source aspect preservation and negotiated codec capabilities under the media extension assessment. Establish the supported paths, late-join behavior, resource bounds and public compatibility boundary before freezing the production design. Additional codecs still require a concrete format decision. Experiments do not establish a connectivity gain; implementation authority does not authorize publishing the later release.

Held By Owner

• Browser-internal encoder work. Paused by the owner on 2026-10-01. Comparisons and Chromium traces own the evidence for synchronous H264 initialization, native adaptation and the unbuilt upstream repair candidate. Keep the verified Piik budget and handoff repairs; do not add periodic resets, a quality floor or a Browser fork. The field room's cause and all brief blur are not established as resolved.
• 32-bit Windows/Linux Apps. Deferred by the owner on 2026-10-02; no package or website option is planned. Browser use remains available where the OS/browser supports the required media APIs. Retain the isolated spike/windows-x86-capture experiment; revisit its native dependencies, atomic alignment and real 32-bit device coverage only if this work is reopened.
• Windows ARM64 App. Deferred by the owner on 2026-10-03. Keep Windows App packages and website downloads x64-only until this work is reopened.

Deferred Feature Work

These proposals remain deferred beyond the accepted interaction phase.

• Phone as a Host microphone: assess after the current work. Explore an opt-in link that pairs a phone's microphone with the Host's existing audio mixer. Evaluate pairing/revocation, latency/echo, browser background limits and Browser/native input ownership before accepting an implementation. This proposal does not reopen room voice or change the current release scope.
• Passive App attachment: design hold. Site mode authorizes one selected origin and supplies native media without starting a local room server. A passive replacement needs an accepted site-consent/discovery flow; it must not admit arbitrary sites or add another runtime owner. Keep Site mode until that decision; removal of the Demo prefill does not authorize changing site trust.

Awaiting Device Or Reporter Evidence

These reports remain unmatched. A local repair or successful test is not proof of a reporter's cause; research owns the completed experiments and their limits.

• macOS and Linux physical capture. Complete the remaining capture/audio checks in verification status, including an Intel Mac with a usable hardware H.264 encoder, an ARM64 Linux desktop, and Linux systems beyond the PR author's Hyprland/NVIDIA result.
• Signaling recovery on passwordless sites (#446). Verify the admission correction against a matched Host/Server attempt; identify the event preceding the handshake failure rather than inferring password denial from AUTH_REQUIRED.
• HDR, audio-exclusion and mobile interaction device coverage. Complete the physical matrix: HDR/mixed displays, voice-app process trees across playback devices and phone keyboard/theater/participant-menu interaction. Browser HDR #420 needs its own capture evidence, separate from Native conversion.
• Native H.264 motion quality (#432). Obtain matched source/decoded pictures and bitstream for the original 720p30 game comparison. Retain current codec parameters. The evidence review owns the withdrawn CBR claim, Baseline admission repair and Main/High comparison; none establishes this report's cause.
• Self-hosted room creation HTTP 403. Retest affected deployments using the address checks. Obtain the configured public address/origin and response details; distinguish Piik's rejection from a proxy/WAF 403 before assigning their cause.
• No available media route. Compare the same endpoints/networks before assigning a regression since v1.4. Obtain paired Host/Viewer/App reports and distinguish route allocation, ICE, first-frame admission and route rejection. #443 lacks a connected Native edge and its paired Viewer/App transport report; #448 only reaches route allocation. The v1.6.3 candidate-timeout report lacks share-start and SDP/ICE evidence.
• Camera and Host microphone device coverage. Check real audio levels, echo, device replacement/native mixing and phone camera permission, orientation and background behavior. Include OBS virtual-camera/audio-input sound quality and A/V synchronization. The capture assessment owns current behavior and the accepted physical limits.
• Public-invitation startup and HTTP 1033. Obtain version and matched diagnostics for creation failures, Demo access and a stream stalling before reload returns 1033. Distinguish connector recovery/exit, DNS/provider failure and an obsolete link from media routing. Compare #396 with the runtime evidence. #434 establishes DNS refusal during edge discovery, not a cause shared by all startup reports.
• Viewer interruptions. Obtain paired endpoint/upstream-relay diagnostics for established viewing returning to P2P connecting, including #429's SFU-to-P2P dropout. Separately retest the v1.5.0 App public-link report where one Viewer drops immediately after connection details appear while others work. Distinguish first-frame admission, signaling grace and current-edge recovery.
• Windows 11 capture border remains visible. Identify the App/Browser capture path, Windows build, permission result and other active captures. Capture evidence owns the graceful-retirement and concurrent-capture checks.
• App discovery and share-start failures. Retest missing sources and unreachable App reports across authorization, browser permissions, control capacity, enumeration and startup. For the v1.6.5 Auto-to-VP8 report, obtain the Browser exception/assets and actual VP8 output: Browser stop-share precedes any local-edge request and does not prove a no-frame timeout. #419's AMD manual-H264 failure and #437's Auto-only failure need the same attempt's App diagnostics. For input-texture-create / 0x887a0005, obtain the next candidate/fallback result and final state; a rejected candidate alone is not the share outcome. Native media research owns the hardware checks and limits.
• Share ends after entering a game. Obtain version, capture path, codec and paired diagnostics. Locate the first capture/output, preview-bridge, control or authority failure; distinguish source silence from target replacement, display-mode change and device loss. Capture research owns the quiet-source behavior; an encoder output deadline remains a candidate mechanism, not a diagnosis of this report.
• Windows launcher exit after opening the page. A user reports that the mode-selection page opens, then the App console reports Piik App could not open its launcher: exit status 0xc0000005. Retest the browser handoff and obtain the affected build and URL-handler process/dump evidence if it still fails.
• System becomes very laggy after starting a share. Obtain mode, actual codec, profile, display refresh rate and CPU/GPU use, distinguishing startup from sustained lag. Compare saturated GPU/game-FPS impact and multi-output recovery with the helper-cost checks before changing allocation or cadence. For Native/SFU stalls, correlate the relevant Go runtime using the GC attribution boundary; no field report currently establishes GC as its cause.

Next: P2P Connection And Feedback Evidence

For the transport assessment, measure connection success, time to first picture and failure causes on representative networks, especially App and P2P-only sites. Use existing Debug provenance and selected-path events under the NAT evidence boundaries. Separate candidates, attempts, successful paths and timeouts; scope observations to connection generations without raw endpoints. Verify survey responses and P2P/SFU handoffs, including background direct attempts behind working SFU media. The iroh/Tailscale comparison records the isolated Go media/migration experiment and Browser/relay limits. Before adopting magicsock in the product, establish a benefit on matched network pairs and define room-authorized peer keys, endpoint exchange, MTU/resource limits and mixed Browser/Native behavior. Keep the experiment isolated from the production routing contract; Go reuse already works, so a Rust alternative needs a concrete Go limitation.

Parked Product Work

1. Representative device/network acceptance. Resume the remaining matrix in verification status when directed, preserving platform deferrals and serial physical checks. Before reusing the optional viewer-mbb canary, replace its obsolete Viewer-only trigger and capacity assertions with the sender-owned contract.
2. Broader quality work. Reopen from measured interruptions, failed recovery or healthy-sibling degradation at acceptable complexity. The Browser pool comparison owns cold-encoder tradeoffs; low resolution alone is not a defect. Check whether a proposed move merely shifts pressure to another parent's siblings.
3. Signaling execution model. Measure signaling-lock contention, synchronous persistence, presence fan-out, diagnostic I/O and cross-room password-work fairness before changing the lock or execution model.
4. Reachable ownership/refactor work. With related behavior changes, evaluate per-share Host and Viewer route ownership under engineering review. Reopen C=3 structural-intent retention or multi-child evidence ownership only with current-contract reproductions. Shared recovery must preserve Native bridge versus network-failure semantics. Before changing Host loopback-failure retirement, account for its preview, Browser quality candidates, quality/SFU updates and track-ended consumers; independent Native publication alone does not make ignoring the failure safe. This is not a diagnosed field cause.
5. Storage fault recovery. Choose and verify a damaged-disk/COMMIT/ROLLBACK recovery policy before adding catch-and-continue or retries. This failure boundary remains unestablished after ordinary persistence checks.
6. Platform output. Reopen for a registered receiver acting as an ordinary Viewer only after the platform-output gate passes.
7. Additional languages. Review community catalogs and their rendered UI following the translation guide, including names, menu navigation, text direction and layout.
8. Windows code signing. Revisit after enrollment in a trusted signing service. Sign executables before archive checksums; publisher identity does not guarantee that antivirus cloud scanning stops.
9. Gitee download-source warning. Paused by the owner. Keep GitHub primary and retain Gitee; do not add a self-hosted mirror. Chrome still blocks the Gitee attachment when Referer is removed. Reopen for new evidence or a provider review; the warning remains unresolved.
10. Release-operation policy. Protected release environments, immutable draft assets and changing mirror-failure policy remain unaccepted proposals; evaluate their benefit before adding release machinery.
11. Automatic local chat history. Explicit TXT export covers manual retention. Reconsider automatic storage only with a stable room-incarnation identity, bounded retention and a clear delete control; reusable room codes must not combine conversations. No new history service or wire field is authorized.
12. Direct OBS input (#436). Reopen for a measured virtual-camera limitation. The capture assessment records raw-frame output and the WHIP boundary; virtual camera alone is not a second encode. Do not add an RTMP/WHIP listener without an accepted publication owner.