Piik/docs/todo.md

Current TODO Ledger

Last reviewed: 2026-09-01

Only Now is executable. Observations, old branches, experiments, and parked topics are not implementation authority.

Now

No executable product work is currently accepted. Items below remain parked until their stated boundary is met.

Parked Product Work

1. Broader quality optimization. Same-edge connection regeneration is now part of the bounded local convergence path. Weighted/global optimization, parent-wide prediction, startup-limited inference, complete cross-clone source isolation, and alternative SFU policies remain unaccepted. Reopen only from exact path evidence; do not add a score, all-pairs probe, periodic rebalancer, or ordinary SFU preference. Validate whether a quality move merely shifts residual shared-source pressure to the new parent's siblings before widening it. Preserve the accepted profiles, bitrate ceilings, endpoint capacity, degradation preferences and LiveKit representations unless a measured gain is large enough to justify the quality, resilience, compatibility and maintenance cost through a new accepted decision.
2. Startup codec budget. Reconcile the bounded Auto codec probe with the first-frame target from measured Browser evidence; do not silently weaken Auto or move an unproved result into the availability path. Validate whether H.264 qualification can choose a slower VP8 fallback under mixed GPU/CPU load before adding comparative or dual-codec probing.
3. Browser encoded-frame reuse. After the current Browser experience release, gate one narrow video-edge adapter that preserves signaling, routing, ICE/TURN, DTLS, DataChannel congestion control, upstream WebRTC playback and SFU fallback while reusing one encoded representation across every compatible P2P descendant. First determine whether current Browser APIs or a mature module can preserve per-edge adaptation without re-encoding; do not accept a standard-WebRTC weak-edge fallback as the default merely because it is easy. Compare one layered SVC encode with a small room-wide simulcast set before any per-edge encoder; select layers from current edge capacity rather than classifying Viewers into permanent strong/weak groups. A strong/weak two-child gate must keep the strong path at full quality, recover the weak path without globally lowering the shared representation, bound queues and temporary copies, and measure CPU, bytes, latency, keyframe recovery, A/V timing and supported mobile Browsers. Reuse existing quality evidence and route operations; add no custom score, global worst-viewer rule, periodic ladder or unproved codec representation.
4. Control-plane resource fairness. Calibrate one deployment-wide LiveKit control queue and simple HTTP/WebSocket ingress budgets before implementation; prove a self-hosted stale-token revocation boundary before independently releasing subscription egress; do not introduce accounts, polling, risk scoring, or an independent policy framework.
5. Client ownership. Extract media-session owners from the Host/Viewer pages only alongside reachable behavior work. File length alone does not authorize a page rewrite; Host diagnostic presentation is already coalesced without delaying media evidence or route control.
6. C=3 structural intent retention. Revisit multiple simultaneous one-shot Host-root convergence intents only with an exact C=3 reproduction; do not add periodic balancing or another topology queue for the default path.
7. Mobile Viewer lifecycle. Run Android Chrome and iOS Safari matrices for autoplay, background audio, foreground recovery, lock/page reclamation, rotation, network migration, and relay survival.
8. Representative network acceptance. Complete public-network direct, Browser relay, SFU, recovery, Pause/Resume, screen-audio, real-game A/V, two-room SFU, 20-Viewer endurance, and all-UDP-blocked bounded failure. Validate LiveKit Server 1.13.6 simulcast retransmission under controlled loss and correlate any remaining SFU freezes with publisher encoding counts before changing Dynacast or representation policy.
9. Client-input security review. Audit HTTP/WebSocket schema, auth, authorization, rate/body/resource bounds, errors, logs, and secrets without adding a parallel security framework.
10. Public-server package. Package the exact Web/signaling, STUN/SFU, proxy, secrets, health, and recovery contract for a user-owned server.
11. Fully local package. Package Host capture, application server, and local state for Windows/macOS/Linux with honest TLS, gateway, NAT, and firewall limits.
12. Native Host and shared encode. Revisit Windows first only after capture, hardware encode, audio, RTP feedback, resources, packaging, licensing, and Browser interoperability are proved.
13. Platform output. System/tab mirroring needs no product adapter, while Remote Playback, default Cast and AirPlay do not provide a portable live MediaStream output contract. Reopen only for a registered custom receiver acting as an ordinary Viewer after a named Browser and physical receiver pass the platform-output gate.
14. NAT inference and predictive candidates. The default-off Host-only connection-local experiment is accepted under ADR-0009. Keep multi-STUN observations and injected candidates additive and diagnostic; do not make them a participant-wide NAT label, hard candidate skip, route score, or SFU preference. Validate target-network success, candidate direction, and bounded resource impact before enabling it by default or extending it to Viewer relay edges.
15. Unresolved route-state ownership claims. Reopen lower-revision reauthentication, active SFU failure during an unrelated prepare, and multi-child relay-evidence ownership only from an exact current-wire reproduction. Do not add a second revision namespace, parallel failure state, or generalized evidence map from static possibility alone.

Decision Needed

• Choose the repository and distribution license before public release or package distribution. GPL/AGPL implementations remain research-only until then.