docs: add agent tracking files, update task management and dev checklist to .github folder

docs/DEVELOPMENT.md

@@ -52,8 +52,9 @@
 ## Cloudflare Configuration (manual — Cloudflare dashboard)
 
 > Evidence tracker: `docs/operations/cloudflare-uptimerobot-checklist.md`
+> Cloudflare Pages deploy workflow created (`.gitea/workflows/pages-deploy.yml`); setup docs written (`docs/operations/cloudflare-pages-setup.md`, `docs/operations/gitea-cloudflare.pages.md`).
 
-- [ ] Cloudflare Pages: link Gitea repo, build `cd frontend && npm run build`, output `frontend/dist`
+- [ ] Cloudflare Pages: create project in dashboard, link custom domain, or deploy via Gitea Actions Direct Upload
 - [ ] Tiered Cache: enable Smart Tiered Cache, validate `Cf-Cache-Status: HIT` from upper tier
 - [ ] WAF: enable OWASP Managed Ruleset, set to Simulate → review 48h → Block, enable Bot Fight Mode
 - [ ] Rate limiting: `/api/admin/login` + `/api/admin/*` → 10 req/10s per IP, Challenge action
@@ -89,7 +90,27 @@
 - [ ] Measure TTFB: WebPageTest from 3+ US regions, target <4s warm cache, document baseline
 - [ ] Load-test WebSocket: `artillery` or Go script, ramp 10→100→500→1000 connections, measure p95 latency + errors (scaffolding complete; benchmark execution pending)
 - [ ] Benchmark admin API: `wrk`/`k6` against `/api/admin/*`, target p95 <1s, identify slow queries (scaffolding complete; benchmark execution pending)
+- [x] Load-test scaffolding: ws-chat.yml, admin-api.js, run-loadtests.ps1, summarizers, README
+- [x] Cache-hit ratio exporter (scripts/cache-hit-ratio.js + .ps1)
+- [x] Saturation alerts: chat p95 latency, Redis memory usage, cache-hit ratio
 - [ ] Track cache hit ratio: Cloudflare GraphQL → Grafana panel, alert <90%
-- [ ] Capacity triggers: Prometheus rules for cache-miss >10%/15min, chat p95 >1s/5min, CPU >80%/10min, Redis memory >85%/10min
+- [ ] Capacity triggers: Prometheus rules for cache-miss >10%/15min, CPU >80%/10min (chat p95, Redis memory, cache-hit already done)
 - [ ] Phase 2 plan: document boundaries (playout CPU, chat latency, DB state, monitoring), estimate per-service resources
 - [ ] Phase 3 plan: research second Hetzner location, design warm standby + DNS failover + DB/Redis replication
+
+## Streaming Pipeline (2026-08-10 audit)
+
+Gaps between STREAMING.md contract and playlist.go/main.ts implementation:
+
+- [ ] **Continuous R2 sync during playout (HIGH)**: `syncLatestToR2()` runs only after FFmpeg exits. Needs per-segment upload via filesystem watch or FFmpeg progress pipe.
+- [ ] **Globally unique segment naming (HIGH)**: Add run/session UUID + monotonic sequence. Currently `strftime` only — collisions possible.
+- [ ] **Atomic manifest publication (MEDIUM)**: Upload to temp key then atomically replace `live/playlist.m3u8`.
+- [ ] **Manifest Cache-Control alignment (LOW)**: Add `must-revalidate` and `s-maxage`/`max-age` split.
+- [ ] **CORS headers on HLS responses (MEDIUM)**: Add `Access-Control-Allow-Origin` to Worker or R2 custom domain.
+- [ ] **Player error recovery (MEDIUM)**: Add `hls.on(Hls.Events.ERROR, ...)` with retries, drift, reconnecting state.
+- [ ] **Health endpoint detail (LOW)**: Add active item, playlist revision, run ID, segment info, R2 pub timestamp.
+- [x] Source media contract + validation — implemented
+- [x] fMP4 HLS packaging (6s, 24 window) — implemented
+- [x] Slate fallback + recovery — implemented
+- [x] R2 cache headers (immutable segments, short-lived manifest) — implemented
+- [x] Cloudflare Worker immutable `.m4s` headers — implemented