Piik/docs/todo.md

Current TODO Ledger

Last reviewed: 2026-08-30

Only Now is executable. Observations, old branches, experiments, and parked topics are not implementation authority.

Now

No executable product work is currently accepted. Items below remain parked until their stated boundary is met.

Parked Product Work

1. Broader quality optimization. Same-edge connection regeneration is now part of the bounded local convergence path. Weighted/global optimization, parent-wide prediction, startup-limited inference, complete cross-clone source isolation, and alternative SFU policies remain unaccepted. Reopen only from exact path evidence; do not add a score, all-pairs probe, periodic rebalancer, or ordinary SFU preference. Validate whether a quality move merely shifts residual shared-source pressure to the new parent's siblings before widening it.
2. Startup codec budget. Reconcile the bounded Auto codec probe with the first-frame target from measured Browser evidence; do not silently weaken Auto or move an unproved result into the availability path.
3. Control-plane resource fairness. Calibrate one deployment-wide LiveKit control queue and simple HTTP/WebSocket ingress budgets before implementation; prove a self-hosted stale-token revocation boundary before independently releasing subscription egress; do not introduce accounts, polling, risk scoring, or an independent policy framework.
4. Client ownership and diagnostic rendering. Batch Host-only diagnostic snapshots when a 20-Viewer measurement proves rendering cost, and extract media-session owners from the Host/Viewer pages only alongside reachable behavior work. File length alone does not authorize a page rewrite.
5. C=3 structural intent retention. Revisit multiple simultaneous one-shot Host-root convergence intents only with an exact C=3 reproduction; do not add periodic balancing or another topology queue for the default path.
6. Mobile Viewer lifecycle. Run Android Chrome and iOS Safari matrices for autoplay, background audio, foreground recovery, lock/page reclamation, rotation, network migration, and relay survival.
7. Representative network acceptance. Complete public-network direct, Browser relay, SFU, recovery, Pause/Resume, screen-audio, real-game A/V, two-room SFU, 20-Viewer endurance, and all-UDP-blocked bounded failure.
8. Client-input security review. Audit HTTP/WebSocket schema, auth, authorization, rate/body/resource bounds, errors, logs, and secrets without adding a parallel security framework.
9. Public-server package. Package the exact Web/signaling, STUN/SFU, proxy, secrets, health, and recovery contract for a user-owned server.
10. Fully local package. Package Host capture, application server, and local state for Windows/macOS/Linux with honest TLS, gateway, NAT, and firewall limits.
11. Native Host and shared encode. Revisit Windows first only after capture, hardware encode, audio, RTP feedback, resources, packaging, licensing, and Browser interoperability are proved.
12. Platform output. Revisit AirPlay/Cast only when a target Browser and physical receiver prove the live MediaStream contract.
13. NAT inference and predictive candidates. Keep multi-STUN observations diagnostic until controlled Browser and target-network evidence proves a connection-scoped classifier with bounded false rejection. Do not hard-skip Peer candidates from a participant-wide NAT label or inject predicted ports into production ICE without a new accepted decision and a measured gate.

Decision Needed

• Choose the repository and distribution license before public release or package distribution. GPL/AGPL implementations remain research-only until then.