Piik/docs/todo.md

# Current TODO Ledger

Last reviewed: 2026-10-04

Only **Now** is executable. Product modules own behavior; Git/PRs own completed
history. A parked idea is not implementation authority.

## Now

- [ ] **Publish the accepted v1.8.0 candidate first.** Authorized by the owner
  on 2026-10-04. Complete final checks and publish through the existing squash
  PR, packaging, mirror and deployment workflow. Preserve
  [#449](https://github.com/TNTcraftHIM/Piik/pull/449)'s contributor credit and
  `Co-authored-by` identity. Reply to resolved issues at publication; retain
  unmatched field reports below. This release keeps the published protocols
  and 1440p ceiling; the subsequent media/transport work is separate.
- [ ] **Resolve the extensibility audit boundaries before freezing 2.0.** Review
  the media findings in the assessment below together with optional interaction
  evolution: the current reaction catalog is a strict wire enum, and an unknown
  reaction or extra event field terminates the Browser signaling session.
  Current producers do not send those values. Choose bounded capability-gated
  delivery or a safe presentation fallback before expanding the catalog; preserve
  strict command and authority validation. No replacement protocol is accepted yet.
- [ ] **Align native source-list aggregate bounds.** The helper admits up to
  1024 sources, but `nativecapture.ListSources` reuses the 64 KiB probe-output
  bound. A synthetic helper with 64 individually valid 512-character window
  titles returns no list; the 32-source control succeeds. Align enumeration,
  encoded JSON and loopback response budgets with bounded overflow behavior.
  This is a confirmed uncommon enumeration failure, not a diagnosis of earlier
  reporter logs; it does not justify removing byte limits or adding pagination.
- [ ] **Implement extensible resolution and transport support after v1.8.0.**
  The owner requested continued repository review, then 4K (#410) and additional
  resolutions with adaptation and capability negotiation, followed by Magicsock
  NAT traversal on 2026-10-04. Compare the isolated Go transport
  with the repaired Pion baseline under the [NAT evidence boundary](#next-p2p-connection-and-feedback-evidence).
  Evaluate orientation-independent resolution limits, source aspect preservation
  and negotiated codec capabilities under the
  [media extension assessment](./research/native-client-media.md#media-capability-extension-assessment).
  Establish the supported paths, late-join behavior, resource bounds and public
  compatibility boundary before freezing the production design. Additional
  codecs still require a concrete format decision. Experiments do not establish
  a connectivity gain; implementation authority does not authorize publishing
  the later release.

## Held By Owner

- [ ] **Browser-internal encoder work.** Paused by the owner on 2026-10-01.
  [Comparisons and Chromium traces](./research/browser-local-encoding-pool.md#sustained-h264-recovery)
  own the evidence for synchronous H264 initialization, native adaptation and
  the unbuilt upstream repair candidate. Keep the verified Piik budget and
  handoff repairs; do not add periodic resets, a quality floor or a Browser fork.
  The field room's cause and all brief blur are not established as resolved.
- [ ] **32-bit Windows/Linux Apps.** Deferred by the owner on 2026-10-02;
  no package or website option is planned. Browser use remains available where
  the OS/browser supports the required media APIs. Retain the isolated
  `spike/windows-x86-capture` experiment; revisit its native dependencies,
  atomic alignment and real 32-bit device coverage only if this work is reopened.
- [ ] **Windows ARM64 App.** Deferred by the owner on 2026-10-03. Keep Windows
  App packages and website downloads x64-only until this work is reopened.

## Deferred Feature Work

These proposals remain deferred beyond the accepted interaction phase.

- [ ] **Phone as a Host microphone: assess after the current work.** Explore an
  opt-in link that pairs a phone's microphone with the Host's existing audio
  mixer. Evaluate pairing/revocation, latency/echo, browser background limits
  and Browser/native input ownership before accepting an implementation. This
  proposal does not reopen room voice or change the current release scope.
- [ ] **Passive App attachment: design hold.** Site mode authorizes one selected
  origin and supplies native media without starting a local room server. A
  passive replacement needs an accepted site-consent/discovery flow; it must not
  admit arbitrary sites or add another runtime owner. Keep Site mode until that
  decision; removal of the Demo prefill does not authorize changing site trust.

## Awaiting Device Or Reporter Evidence

These reports remain unmatched. A local repair or successful test is not proof
of a reporter's cause; research owns the completed experiments and their limits.

- [ ] **macOS and Linux physical capture.** Complete the remaining capture/audio
  checks in [verification status](./verification-status.md#device-evidence-boundary),
  including an Intel Mac with a usable hardware H.264 encoder, an ARM64 Linux
  desktop, and Linux systems beyond the PR author's Hyprland/NVIDIA result.
- [ ] **Signaling recovery on passwordless sites (#446).** Verify the admission
  correction against a matched Host/Server attempt; identify the event preceding
  the handshake failure rather than inferring password denial from `AUTH_REQUIRED`.
- [ ] **HDR, audio-exclusion and mobile interaction device coverage.** Complete
  the [physical matrix](./verification-status.md#device-evidence-boundary):
  HDR/mixed displays, voice-app process trees across playback devices and phone
  keyboard/theater/participant-menu interaction. Browser HDR
  [#420](https://github.com/TNTcraftHIM/Piik/issues/420) needs its own capture
  evidence, separate from Native conversion.
- [ ] **Native H.264 motion quality (#432).** Obtain matched source/decoded
  pictures and bitstream for the original 720p30 game comparison. Retain current
  codec parameters. The [evidence review](./research/native-client-media.md#native-h264-motion-quality)
  owns the withdrawn CBR claim, Baseline admission repair and Main/High comparison;
  none establishes this report's cause.
- [ ] **Self-hosted room creation HTTP 403.** Retest affected deployments using
  the [address checks](./guide/troubleshooting.md#room-creation-returns-403).
  Obtain the configured public address/origin and response details; distinguish
  Piik's rejection from a proxy/WAF 403 before assigning their cause.
- [ ] **No available media route.** Compare the same endpoints/networks before
  assigning a regression since v1.4. Obtain paired Host/Viewer/App reports and
  distinguish route allocation, ICE, first-frame admission and route rejection.
  [#443](https://github.com/TNTcraftHIM/Piik/issues/443) lacks a connected Native
  edge and its paired Viewer/App transport report;
  [#448](https://github.com/TNTcraftHIM/Piik/issues/448) only reaches route allocation.
  The v1.6.3 candidate-timeout report lacks share-start and SDP/ICE evidence.
- [ ] **Camera and Host microphone device coverage.** Check real audio levels,
  echo, device replacement/native mixing and phone camera permission, orientation
  and background behavior. Include OBS virtual-camera/audio-input sound quality
  and A/V synchronization. The [capture assessment](./research/camera-and-microphone.md)
  owns current behavior and the accepted physical limits.
- [ ] **Public-invitation startup and HTTP 1033.** Obtain version and matched
  diagnostics for creation failures, Demo access and a stream stalling before
  reload returns 1033. Distinguish connector recovery/exit, DNS/provider failure
  and an obsolete link from media routing. Compare
  [#396](https://github.com/TNTcraftHIM/Piik/issues/396#issuecomment-5691465700) with
  the [runtime evidence](./research/cross-platform-client-runtime.md#public-invitation-startup).
  [#434](https://github.com/TNTcraftHIM/Piik/issues/434) establishes DNS refusal
  during edge discovery, not a cause shared by all startup reports.
- [ ] **Viewer interruptions.** Obtain paired endpoint/upstream-relay diagnostics
  for established viewing returning to P2P connecting, including
  [#429](https://github.com/TNTcraftHIM/Piik/issues/429)'s SFU-to-P2P dropout.
  Separately retest the v1.5.0 App public-link report where one Viewer drops
  immediately after connection details appear while others work. Distinguish
  first-frame admission, signaling grace and current-edge recovery.
- [ ] **Windows 11 capture border remains visible.** Identify the App/Browser
  capture path, Windows build, permission result and other active captures.
  [Capture evidence](./research/native-client-lifecycle.md#windows-capture-borders)
  owns the graceful-retirement and concurrent-capture checks.
- [ ] **App discovery and share-start failures.** Retest missing sources and
  unreachable App reports across authorization, browser permissions, control
  capacity, enumeration and startup. For the v1.6.5 Auto-to-VP8 report, obtain
  the Browser exception/assets and actual VP8 output: Browser `stop-share`
  precedes any local-edge request and does not prove a no-frame timeout.
  [#419](https://github.com/TNTcraftHIM/Piik/issues/419)'s AMD manual-H264 failure
  and [#437](https://github.com/TNTcraftHIM/Piik/issues/437)'s Auto-only failure
  need the same attempt's App diagnostics. For `input-texture-create / 0x887a0005`,
  obtain the next candidate/fallback result and final state; a rejected candidate
  alone is not the share outcome. [Native media research](./research/native-client-media.md#current-boundary)
  owns the hardware checks and limits.
- [ ] **Share ends after entering a game.** Obtain version, capture path, codec
  and paired diagnostics. Locate the first capture/output, preview-bridge,
  control or authority failure; distinguish source silence from target replacement,
  display-mode change and device loss. [Capture research](./research/native-client-lifecycle.md#quiet-sources-and-viewer-recovery)
  owns the quiet-source behavior; an encoder output deadline remains a candidate
  mechanism, not a diagnosis of this report.
- [ ] **Windows launcher exit after opening the page.** A user reports that the
  mode-selection page opens, then the App console reports
  `Piik App could not open its launcher: exit status 0xc0000005`.
  Retest the browser handoff and obtain the affected build and URL-handler
  process/dump evidence if it still fails.
- [ ] **System becomes very laggy after starting a share.** Obtain mode, actual
  codec, profile, display refresh rate and CPU/GPU use, distinguishing startup
  from sustained lag. Compare saturated GPU/game-FPS impact and multi-output
  recovery with the [helper-cost checks](./research/native-client-media.md#windows-helper-cost-2026-09-29)
  before changing allocation or cadence. For Native/SFU stalls, correlate the
  relevant Go runtime using the [GC attribution boundary](./research/realtime-quality-adaptation.md#go-gc-attribution);
  no field report currently establishes GC as its cause.

## Next: P2P Connection And Feedback Evidence

For the transport assessment, measure connection success, time to first picture and
failure causes on representative networks, especially App and P2P-only sites.
Use existing Debug provenance and selected-path events under the
[NAT evidence boundaries](./research/nat-traversal.md#gateway-and-survey-limits).
Separate candidates, attempts, successful paths and timeouts; scope observations
to connection generations without raw endpoints. Verify survey responses and
P2P/SFU handoffs, including background direct attempts behind working SFU media.
The [iroh/Tailscale comparison](./research/nat-traversal.md#iroh-and-tailscale-comparison)
records the isolated Go media/migration experiment and Browser/relay limits.
Before adopting magicsock in the product, establish a benefit on matched network
pairs and define room-authorized peer keys, endpoint exchange, MTU/resource limits
and mixed Browser/Native behavior. Keep the experiment isolated from the
production [routing contract](./standards/routing-transport.md); Go reuse already
works, so a Rust alternative needs a concrete Go limitation.

## Parked Product Work

1. **Representative device/network acceptance.** Resume the remaining matrix in
   [verification status](./verification-status.md#remaining-device-and-network-acceptance)
   when directed, preserving platform deferrals and serial physical checks.
   Before reusing the optional `viewer-mbb` canary, replace its obsolete
   Viewer-only trigger and capacity assertions with the sender-owned contract.
2. **Broader quality work.** Reopen from measured interruptions, failed recovery
   or healthy-sibling degradation at acceptable complexity. The
   [Browser pool comparison](./research/browser-local-encoding-pool.md#balanced-startup-and-recovery)
   owns cold-encoder tradeoffs; low resolution alone is not a defect. Check
   whether a proposed move merely shifts pressure to another parent's siblings.
3. **Signaling execution model.** Measure signaling-lock contention, synchronous
   persistence, presence fan-out, diagnostic I/O and cross-room password-work
   fairness before changing the lock or execution model.
4. **Reachable ownership/refactor work.** With related behavior changes, evaluate
   per-share Host and Viewer route ownership under
   [engineering review](./standards/engineering.md#ablation-and-review).
   Reopen C=3 structural-intent retention or multi-child evidence ownership only
   with current-contract reproductions. Shared recovery must preserve Native
   bridge versus network-failure semantics. Before changing Host loopback-failure
   retirement, account for its preview, Browser quality candidates, quality/SFU
   updates and track-ended consumers; independent Native publication alone does
   not make ignoring the failure safe. This is not a diagnosed field cause.
5. **Storage fault recovery.** Choose and verify a damaged-disk/COMMIT/ROLLBACK
   recovery policy before adding catch-and-continue or retries. This failure
   boundary remains unestablished after ordinary persistence checks.
6. **Platform output.** Reopen for a registered receiver acting as an ordinary
   Viewer only after the [platform-output gate](./research/platform-output.md)
   passes.
7. **Additional languages.** Review community catalogs and their rendered UI
   following the [translation guide](./guide/translating.md), including names,
   menu navigation, text direction and layout.
8. **Windows code signing.** Revisit after enrollment in a trusted signing
    service. Sign executables before archive checksums; publisher identity does
    not guarantee that antivirus cloud scanning stops.
9. **Gitee download-source warning.** Paused by the owner. Keep GitHub primary
    and retain Gitee; do not add a self-hosted mirror. Chrome still blocks the
    Gitee attachment when Referer is removed. Reopen for new evidence or a
    provider review; the warning remains unresolved.
10. **Release-operation policy.** Protected release environments, immutable
    draft assets and changing mirror-failure policy remain unaccepted proposals;
    evaluate their benefit before adding release machinery.
11. **Automatic local chat history.** Explicit TXT export covers manual retention.
    Reconsider automatic storage only with a stable room-incarnation identity,
    bounded retention and a clear delete control; reusable room codes must not
    combine conversations. No new history service or wire field is authorized.
12. **Direct OBS input (#436).** Reopen for a measured virtual-camera limitation.
    The [capture assessment](./research/camera-and-microphone.md) records raw-frame
    output and the WHIP boundary; virtual camera alone is not a second encode.
    Do not add an RTMP/WHIP listener without an accepted publication owner.