# BACKLOG

## Cloudflare Configuration

- [x] Configure DNS for linearvoid.tv apex and www redirect (manual)
- [x] Configure media.linearvoid.tv for split-domain HLS delivery (manual)
- [x] Create R2 bucket (manual)
- [x] Configure Cache Rules: .ts/.m4s + .m3u8 (manual)
- [x] Configure Cloudflare Pages deploy workflow (`.gitea/workflows/pages-deploy.yml`) and setup docs (`docs/operations/cloudflare-pages-setup.md`, `docs/operations/gitea-cloudflare.pages.md`)
- [ ] Create Cloudflare Pages project in dashboard and link custom domain (manual)
- [ ] Enable Tiered Cache, WAF, rate limiting (manual)
- [x] Implement Worker for immutable cache headers on segment paths
- [ ] Enforce HTTPS/WSS, redirect HTTP → HTTPS (manual)

## Monitoring & Observability

- [x] Set up Prometheus with chat/playout/nginx/redis/postgres/node scrape targets
- [x] Add nginx-exporter, redis-exporter, postgres-exporter, node-exporter
- [x] Import Grafana app + operational dashboards
- [x] Define Prometheus alerting rules (8 rules: ChatDown, PlayoutDown, RedisDown, etc.)
- [ ] Set up UptimeRobot external monitoring

## Security

- [x] Implement admin cookie-session auth (HttpOnly, SameSite=Strict, Secure when TLS)
- [x] Implement server-side session expiration
- [ ] Enforce HTTPS/WSS at edge and origin
- [x] Implement rate limiting for chat messages (Redis windowing)
- [x] Implement WebSocket connection rate limiting (5/IP/60s)
- [x] Implement admin login rate limiting (5/IP/5min)

## Scaling & Performance

- [x] Create scaling/performance playbook (methods, thresholds, execution order)
- [x] Load-test scaffolding: ws-chat.yml, admin-api.js, run-loadtests.ps1, summarizers
- [x] Cache-hit ratio exporter (scripts/cache-hit-ratio.js + .ps1)
- [x] Saturation alerts: chat p95, Redis memory, cache-hit ratio
- [ ] Create Cloudflare Pages project and cut over frontend hosting (manual)
- [ ] Optimize segment immutability and manifest TTL for cache efficiency
- [ ] Measure playback TTFB from multiple US regions
- [ ] Execute WebSocket load tests with real infrastructure
- [ ] Execute admin API benchmarks with real infrastructure
- [ ] Track cache hit ratio and R2 ops in production
- [ ] Plan Phase 2 service separation
- [ ] Plan Phase 3 multi-origin resilience

## Streaming Pipeline

Gaps from 2026-08-10 audit → 2026-08-10 implementation (STREAMING.md contract vs playlist.go implementation):

- [x] **Continuous R2 sync during playout (HIGH)**: `syncLatestToR2()` now uses fsnotify watcher to upload segments in real-time (~7s delay).
- [x] **Globally unique segment naming (HIGH)**: Implemented `r-{ISOTIME}/seg-{seq}.m4s` naming via run ID + ffmpeg monotonic sequence.
- [x] **Atomic manifest publication (MEDIUM)**: Upload manifest to `playlist.m3u8.tmp`, then `CopyObject` to final key.
- [x] **Manifest Cache-Control alignment (LOW)**: Updated to `public, max-age=1, s-maxage=2, must-revalidate`.
- [ ] **CORS headers on HLS responses (MEDIUM)**: Needs Cloudflare R2 bucket CORS config (infrastructure, not code) — CORS already set in nginx for same-origin; media.linearvoid.tv needs Cloudflare setting.
- [x] **Player error recovery (MEDIUM)**: Added `hls.on(Hls.Events.ERROR)` handler with bounded retries (5x), exponential backoff, reconnecting overlay.
- [x] **Health endpoint detail (LOW)**: Added active item, run ID, playlist revision, last segment seq, last R2 pub, consecutive failures.
- [x] Source media contract + validation (H.264/AAC, 30fps, keyframe check) — implemented
- [x] fMP4 HLS packaging (6s segments, 24 window) — implemented
- [x] Slate fallback + recovery (`shouldEscalateToSlate`) — implemented
- [x] R2 cache headers (immutable segments, short-lived manifest) — implemented
- [x] Cloudflare Worker immutable `.m4s` headers — implemented