# TODO

## Distribution follow-up (findings + host config)

Verified via API+host credentials (2026-10-31):

- [x] Repo is **public** (`private:false`) and account has admin rights.
- [x] Release `v0.2.1` now carries all five artifacts (portable binaries + NSIS installer +
      AppImage) — the two installers were missing after CI publish (script uploaded only the
      portables); `tools/publish_release.sh` fixed to include them and re-uploaded via API.
- [ ] **Remaining host setting**: instance-wide `[service] REQUIRE_SIGNIN_VIEW=true` makes
      anonymous browsing/downloads redirect to login (API-confirmed repo is public; this is a
      server `app.ini` setting, not an API or repo option).
      Advised path for the host admin: set `REQUIRE_SIGNIN_VIEW = false` in `app.ini` under
      `[service]`, restart Gitea, then verify `curl -sI https://git.allucanget.biz/zwitschi/security-game/releases/tag/v0.2.1`
      returns 200 (not a login redirect) and an anonymous asset download succeeds. Alternative:
      mirror downloads (Itch.io / GitHub Releases) for anonymous users.

## Future Systems (design-level backlog)

- [ ] Body-camera replay timeline in the shift review.
- [ ] Venue selection startup menu (keyboard cycling with `V` is implemented).
- [ ] IDE/editor-based GUT integration when a Godot editor workflow is introduced.

## Open Polish

- [ ] Keep `%` placeholders stable in `Strings.fmt` when adding keys (positional formatting).

## Detailed Graphics — remaining performance items

The visual pass is done (textures, rigs, HUD feedback — see `DONE.md`). Remaining work is
performance hardening only.

- [ ] Profile the crowd: ensure textured materials and props hold target frame rate around a
      busy entrance.
- [ ] Add LOD or culling for distant NPCs/props if the crowd grows.