chanora/docs/governance/master-todo-list-2026-06-11.md

# Master TODO List

**Date:** 2026-06-11
**Branch:** `docs/codebase-analysis-v2`
**Sources:**
- `docs/governance/codebase-analysis-2026-06-11.md` — main codebase analysis
- `docs/governance/issue-history-analysis.md` — git history patterns and root causes
- `docs/verification/test-environment-requirements.md` — test environment setup needs
- `docs/references/external-research-2026-06-11.md` — external research findings

---

## Summary

| Category | P0 | P1 | P2 | P3 | Total |
|---|---|---|---|---|---|
| Dead Code Removal | 0 | 0 | 0 | 5 | 5 |
| Code Quality | 2 | 2 | 3 | 2 | 9 |
| Test Coverage | 2 | 3 | 2 | 0 | 7 |
| Architecture | 0 | 2 | 2 | 1 | 5 |
| Documentation | 3 | 2 | 3 | 2 | 10 |
| Missing APIs / Requirements | 0 | 2 | 7 | 2 | 11 |
| Infrastructure | 0 | 3 | 5 | 1 | 9 |
| External Research Follow-up | 0 | 1 | 2 | 2 | 5 |
| Protocol Implementation | 0 | 2 | 8 | 3 | 13 |
| Reference Document Improvements | 0 | 0 | 9 | 1 | 10 |
| Additional Traceability Gaps | 0 | 0 | 3 | 1 | 4 |
| **Total** | **7** | **17** | **44** | **20** | **88** |

---

## 1. Dead Code Removal

### TODO-001 — Remove dead AudioFrame structs
- **Priority:** P3
- **Source:** codebase-analysis §5
- **Description:** `AudioFrame10ms` and `AudioFrame20ms` structs and `AudioFrame10ms::dbfs()` are never referenced outside tests. Safe to delete.
- **Effort:** S
- **Dependencies:** None

### TODO-002 — Remove dead `disable_failed_vad_backend()`
- **Priority:** P3
- **Source:** codebase-analysis §5
- **Description:** Function only called in tests. Remove from production code.
- **Effort:** S
- **Dependencies:** None

### TODO-003 — Remove unused `share_plus` import
- **Priority:** P3
- **Source:** codebase-analysis §5
- **Description:** `import 'package:share_plus/share_plus.dart'` in main.dart:55 — `Share` class never used.
- **Effort:** S
- **Dependencies:** None

### TODO-004 — Audit and remove likely-dead functions (16 across 5 crates)
- **Priority:** P3
- **Source:** codebase-analysis §2, §5
- **Description:** 16 functions have no production callers. From §5: 11 AudioEngine/TransmitModeSelector/ReleaseTailTimer methods (output_muted, output_gain, capture_active, transmit_gate, set_transmit_active, android_diagnostics, gate, in_channel, ptt_held, cancel, arm) + `AudioEngine::frames_sent()` and `AudioEngine::frames_received()`. From §2: `ChanoraSession::protocol_events_snapshot()` (chanora_core), `ServerState::replace_from_snapshot()/channel_count()/client_count()` (chanora_state), `BookmarkStore::upsert_or_add()` (chanora_storage), `normalize_args()/validate_args()` (chanora_resolver), `HpfProcessor::process_sample()` (chanora_audio), `CoreMlWorker::reset_state()` (chanora_audio), `PttCapabilityLevel::is_global()` (chanora_audio), `handle_media_services_reset_with_route()/handle_interruption_began()` (chanora_bridge). Confirm with call-graph then remove or wire.
- **Effort:** M
- **Dependencies:** None

### TODO-005 — Decide fate of `#[allow(dead_code)]` items
- **Priority:** P3
- **Source:** codebase-analysis §5
- **Description:** `AudioCommand::RemoveClient` has TODO to wire to client disconnect path. Three Android-only modules are conditionally dead. Decide: wire, remove, or keep annotated.
- **Effort:** M
- **Dependencies:** None

---

## 2. Code Quality

### TODO-006 — Replace ~39 `Mutex::lock().unwrap()` calls in engine.rs
- **Priority:** P0
- **Source:** codebase-analysis §6, issue-history §1 (realtime thread safety)
- **Description:** Production `unwrap()` on Mutex locks will panic on poisoned mutex. Replace with `try_lock()` + silence fallback or `parking_lot::Mutex`.
- **Effort:** L
- **Dependencies:** None

### TODO-007 — Audit 8 `unsafe impl Send/Sync` blocks
- **Priority:** P0
- **Source:** codebase-analysis §6
- **Description:** 8 unsafe Send/Sync impls across various files. Each needs safety proof comment and review.
- **Effort:** M
- **Dependencies:** None

### TODO-008 — Resolve 14 TODO/FIXME/HACK entries in codebase
- **Priority:** P1
- **Source:** codebase-analysis §6
- **Description:** 14 occurrences across engine.rs, mobile_voice_backend.rs, audio_event_queue.rs, audio_lifecycle_service.dart, poke_notification_service.dart. Address or convert to tracked issues.
- **Effort:** L
- **Dependencies:** None

### TODO-009 — Audit 23 `unimplemented!("")` in frb_generated.rs
- **Priority:** P1
- **Source:** codebase-analysis §6
- **Description:** Flutter-Rust Bridge generated stubs contain 23 `unimplemented!("")` calls that will panic at runtime if hit. Audit and implement or guard each one.
- **Effort:** M
- **Dependencies:** None

### TODO-010 — Fix `pick_client_version()` hardcoded to Windows
- **Priority:** P2
- **Source:** codebase-analysis §11
- **Description:** `adapter.rs:141` returns Windows client version for ALL platforms. Must return platform-appropriate version strings.
- **Effort:** S
- **Dependencies:** None

### TODO-011 — Fix Android stubs returning None/Ok(None)
- **Priority:** P2
- **Source:** codebase-analysis §11
- **Description:** `log_file_path()` on Android returns `None` (api.rs:350-356), `keyring_load()` on Android returns `Ok(None)` always. These silently hide functionality gaps.
- **Effort:** S
- **Dependencies:** None

### TODO-012 — Deduplicate AudioProcessingConfig construction (4x)
- **Priority:** P2
- **Source:** codebase-analysis §7
- **Description:** AudioProcessingConfig is constructed identically in 4 places in Dart. Extract to factory or shared config.
- **Effort:** S
- **Dependencies:** None

### TODO-013 — Deduplicate audio processing toggle UI
- **Priority:** P3
- **Source:** codebase-analysis §7
- **Description:** Audio processing toggle UI duplicated across 2 Dart files (~150 lines). Extract shared widget.
- **Effort:** S
- **Dependencies:** None

### TODO-014 — Deduplicate low-priority code patterns (7 patterns)
- **Priority:** P3
- **Source:** codebase-analysis §7
- **Description:** PttCapability event construction (1 Rust, ~15 lines), DnsFailed/ServerRejected error mirroring (2 Rust, ~20 lines), host normalization (3 Rust files), create_dir_all (2 Rust files), Io(String) variant (3 crates), StateEvent/Delta mirror (1 Rust file), platform detection scatter (6 Dart, ~35 checks).
- **Effort:** M
- **Dependencies:** None

---

## 3. Test Coverage

### TODO-015 — Add chanora_bridge tests (0/5 modules tested)
- **Priority:** P0
- **Source:** codebase-analysis §3
- **Description:** The Flutter-Rust FFI boundary has zero tests. This is the highest-risk untested area. Need unit tests for all 5 bridge modules.
- **Effort:** XL
- **Dependencies:** None

### TODO-016 — Add poisoned-mutex survival test for audio callbacks
- **Priority:** P0
- **Source:** issue-history §3
- **Description:** Verify `try_lock()` fallback produces silence rather than panic when mutex is poisoned. Directly tests the fix for TODO-006.
- **Effort:** M
- **Dependencies:** TODO-006

### TODO-017 — Add Flutter widget tests for untested core UI
- **Priority:** P1
- **Source:** codebase-analysis §3
- **Description:** `voice_bar`, `voice_settings`, `connect_widgets` modules have no tests. These are core UI components at 56% widget coverage.
- **Effort:** L
- **Dependencies:** None

### TODO-018 — Add chanora_protocol dto module tests
- **Priority:** P1
- **Source:** codebase-analysis §3
- **Description:** Protocol dto module is untested. Serialization bugs here cause silent protocol failures.
- **Effort:** M
- **Dependencies:** None

### TODO-019 — Add chanora_core events module tests
- **Priority:** P1
- **Source:** codebase-analysis §3
- **Description:** Events module is untested (80% coverage overall, but events gap). Event system is central to app behavior.
- **Effort:** M
- **Dependencies:** None

### TODO-020 — Add iOS audio session lifecycle integration tests
- **Priority:** P2
- **Source:** issue-history §3
- **Description:** Test session transitions (ambient → playAndRecord → ambient), already-in-channel response handling, idle audio mode. 15+ historical issues justify this.
- **Effort:** L
- **Dependencies:** TODO-030 (device test infrastructure)

### TODO-021 — Add protocol error surfacing tests
- **Priority:** P2
- **Source:** issue-history §3
- **Description:** Verify server errors are forwarded as UI events, not silently swallowed. Fire-and-forget hides failures.
- **Effort:** M
- **Dependencies:** None

---

## 4. Architecture

### TODO-022 — Split engine.rs (3,244 lines) into smaller modules
- **Priority:** P1
- **Source:** codebase-analysis §6, §12
- **Description:** Monolithic audio engine file. Split into engine core, capture, render, transmit, diagnostics modules.
- **Effort:** L
- **Dependencies:** None

### TODO-023 — Split main.dart (2,910 lines) into smaller modules
- **Priority:** P1
- **Source:** codebase-analysis §6
- **Description:** Monolithic Flutter entry point. Extract into feature-based modules/screens.
- **Effort:** L
- **Dependencies:** None

### TODO-024 — Extract platform backends from chanora_audio into separate crates
- **Priority:** P2
- **Source:** codebase-analysis §12
- **Description:** Split into `chanora_audio` (core ~8K lines), `chanora_audio_android` (~3.2K), `chanora_audio_apple` (~1.4K), `chanora_audio_desktop` (~3.5K). Platform backends are already cfg-gated.
- **Effort:** XL
- **Dependencies:** TODO-022 (split engine.rs first)

### TODO-025 — Reduce `.map_err(format!)` boilerplate across 5 Rust crates
- **Priority:** P2
- **Source:** codebase-analysis §7
- **Description:** ~85 repeated closure patterns. Introduce a `WrapErr` trait or macro to reduce boilerplate.
- **Effort:** L
- **Dependencies:** None

### TODO-026 — Reduce adapter.rs (2,504 lines) and api.rs (2,432 lines)
- **Priority:** P3
- **Source:** codebase-analysis §6
- **Description:** Both files exceed 2,400 lines. Consider splitting by feature area.
- **Effort:** L
- **Dependencies:** TODO-022, TODO-023

---

## 5. Documentation

### TODO-027 — Update implementation-status document
- **Priority:** P0
- **Source:** codebase-analysis §13
- **Description:** `docs/implementation-status-2026-05-28.md` is 14 days stale, missing v0.3.0 features. This is the primary evidence source for verification.
- **Effort:** M
- **Dependencies:** None

### TODO-028 — Allocate SysRS-258–310 in SysDes
- **Priority:** P0
- **Source:** codebase-analysis §13
- **Description:** 53 SysRS requirements lack SysDes allocation, breaking the traceability chain from requirements to design.
- **Effort:** L
- **Dependencies:** None

### TODO-029 — Fix traceability matrix SRS numbering mismatches
- **Priority:** P0
- **Source:** codebase-analysis §13
- **Description:** SRS IDs in traceability matrix don't match actual SRS document. Needs manual reconciliation.
- **Effort:** M
- **Dependencies:** None

### TODO-030 — Add README files to 8 crates + core
- **Priority:** P1
- **Source:** codebase-analysis §4
- **Description:** Only `chanora_resolver` has a README. The other 9 directories need one describing purpose, architecture, and public API.
- **Effort:** M
- **Dependencies:** None

### TODO-031 — Improve chanora_audio doc comments (24% → 80%)
- **Priority:** P2
- **Source:** codebase-analysis §4
- **Description:** Largest crate (168 pub fn, 18,895 lines) at only 24% documentation. Target 80% coverage.
- **Effort:** XL
- **Dependencies:** None

### TODO-032 — Fix 6 broken doc links (create LICENSE files)
- **Priority:** P3
- **Source:** codebase-analysis §8
- **Description:** All 6 broken links point to missing `LICENSE-APACHE` and `LICENSE-MIT` files at project root. LICENSE files have been created — verify links resolve.
- **Effort:** S
- **Dependencies:** None

### TODO-033 — Link 14 orphaned documentation files
- **Priority:** P3
- **Source:** codebase-analysis §8
- **Description:** 14 files in `docs/superpowers/plans/` and `docs/superpowers/specs/` are not linked from any index document.
- **Effort:** S
- **Dependencies:** None

### TODO-034 — Update SDD (docs/architecture/sdd.md)
- **Priority:** P2
- **Source:** codebase-analysis §13
- **Description:** Software Design Description scored 5/10 freshness. Missing many modules added since initial write.
- **Effort:** L
- **Dependencies:** None

### TODO-035 — Update SAD (docs/architecture/sad.md)
- **Priority:** P2
- **Source:** codebase-analysis §13
- **Description:** Software Architecture Description scored 5/10 freshness. Missing components and interfaces.
- **Effort:** L
- **Dependencies:** None

### TODO-036 — Update Verification Master Plan
- **Priority:** P1
- **Source:** codebase-analysis §13
- **Description:** Verification Master Plan scored 6/10, stale evidence sources and missing verification methods.
- **Effort:** M
- **Dependencies:** None

---

## 6. Missing APIs / Requirements

### TODO-037 — Add missing bridge read-back functions
- **Priority:** P1
- **Source:** codebase-analysis §11
- **Description:** `is_hard_muted()`, `get_output_gain()`, `get_client_volume()`, `connection_state()`, `reconnect()` are missing from bridge. UI must derive state from events only.
- **Effort:** M
- **Dependencies:** None

### TODO-038 — Write requirements for implemented features
- **Priority:** P1
- **Source:** codebase-analysis §13
- **Description:** Poke, file transfer, hard-mute, and cache features exist in code but have no SysRS/SRS requirements. Breaks traceability.
- **Effort:** L
- **Dependencies:** None

### TODO-039 — Implement UI settings persistence (SysRS-143, SRS-087)
- **Priority:** P2
- **Source:** codebase-analysis §11
- **Description:** Settings persistence is a documented requirement with no implementation.
- **Effort:** M
- **Dependencies:** None

### TODO-040 — Implement per-user mute/volume persistence (SysRS-145/144, SRS-088)
- **Priority:** P2
- **Source:** codebase-analysis §11
- **Description:** Per-user mute and volume persistence requirements are partially implemented. Needs completion.
- **Effort:** M
- **Dependencies:** None

### TODO-041 — Implement notification permission handling (SysRS-166, SRS-109)
- **Priority:** P2
- **Source:** codebase-analysis §11
- **Description:** Notification permission requirement has no implementation.
- **Effort:** M
- **Dependencies:** None

### TODO-042 — Complete recent server management (SysRS-141, SRS-085)
- **Priority:** P2
- **Source:** codebase-analysis §11
- **Description:** Recent server management is partially implemented. Needs completion per spec.
- **Effort:** M
- **Dependencies:** None

### TODO-043 — Implement event replay tool (SysRS-171, SRS-098)
- **Priority:** P2
- **Source:** codebase-analysis §11
- **Description:** Event replay tool is a documented requirement with no implementation.
- **Effort:** L
- **Dependencies:** None

### TODO-044 — Implement audio processing test tool (SysRS-074, SRS-083)
- **Priority:** P2
- **Source:** codebase-analysis §11
- **Description:** Audio processing test tool is a documented requirement with no implementation.
- **Effort:** L
- **Dependencies:** None

### TODO-045 — Complete input validation (SysRS-157, SRS-094)
- **Priority:** P2
- **Source:** codebase-analysis §11
- **Description:** Input validation is partially implemented. Needs completion per spec.
- **Effort:** M
- **Dependencies:** None

### TODO-046 — Implement audio loopback test tool (SysRS-073, SRS-083)
- **Priority:** P3
- **Source:** codebase-analysis §11
- **Description:** Audio loopback test tool is a documented requirement with no implementation.
- **Effort:** L
- **Dependencies:** TODO-054 (audio loopback harness)

### TODO-047 — Implement protocol probe tool (SysRS-128, SRS-123)
- **Priority:** P3
- **Source:** codebase-analysis §11
- **Description:** Protocol probe tool is a documented requirement with no implementation.
- **Effort:** L
- **Dependencies:** None

---

## 7. Infrastructure

### TODO-048 — Add Android CI build job
- **Priority:** P1
- **Source:** test-environment-requirements §9 Phase 1
- **Description:** No Android CI build exists. Add NDK + cargo-ndk + multi-ABI build to GitHub Actions.
- **Effort:** M
- **Dependencies:** None

### TODO-049 — Add Windows and macOS CI build jobs
- **Priority:** P1
- **Source:** test-environment-requirements §9 Phase 1
- **Description:** Windows and macOS builds are not in CI. Add windows-latest and macOS runners for build verification.
- **Effort:** M
- **Dependencies:** None

### TODO-050 — Add xcodebuild Archive verification to CI
- **Priority:** P1
- **Source:** issue-history §1
- **Description:** 4+ historical issues caused by `flutter build` passing but `xcodebuild archive` failing. Add xcodebuild archive step to CI.
- **Effort:** M
- **Dependencies:** None

### TODO-051 — Enable clippy as blocking CI check
- **Priority:** P2
- **Source:** test-environment-requirements §9 Phase 1
- **Description:** Clippy is currently advisory only. Make it a blocking PR gate.
- **Effort:** S
- **Dependencies:** None

### TODO-052 — Add Linux multi-distro build matrix
- **Priority:** P2
- **Source:** test-environment-requirements §9 Phase 1
- **Description:** Add Docker-based CI matrix for Ubuntu, Fedora, Arch to catch distro-specific PipeWire/Portal/DBus issues.
- **Effort:** M
- **Dependencies:** None

### TODO-053 — Add `cargo llvm-cov` coverage reporting
- **Priority:** P2
- **Source:** test-environment-requirements §9 Phase 1
- **Description:** No code coverage reporting exists. Add `cargo llvm-cov` to CI for trend tracking.
- **Effort:** M
- **Dependencies:** None

### TODO-054 — Implement audio loopback test harness
- **Priority:** P2
- **Source:** test-environment-requirements §9 Phase 2
- **Description:** Build virtual audio device loopback for CI audio quality testing. Use BlackHole (macOS), VB-Audio (Windows), snd-aloop (Linux).
- **Effort:** L
- **Dependencies:** TODO-048, TODO-049

### TODO-055 — Implement test environment Phase 2 (device integration)
- **Priority:** P2
- **Source:** test-environment-requirements §9 Phase 2
- **Description:** Set up self-hosted runners for device tests, Flutter integration tests with platform channels, Firebase Test Lab for Android, network condition test suite.
- **Effort:** XL
- **Dependencies:** TODO-048, TODO-049

### TODO-056 — Implement test environment Phase 3 (full automation)
- **Priority:** P3
- **Source:** test-environment-requirements §9 Phase 3
- **Description:** Benchmark regression gates, iOS TestFlight automation, signed build automation, weekly audio quality regression, Android multi-device testing.
- **Effort:** XL
- **Dependencies:** TODO-055

---

## 8. External Research Follow-up

### TODO-057 — Upstream p256 coordinate padding fix to ReSpeak
- **Priority:** P1
- **Source:** external-research §2 (ReSpeak)
- **Description:** Chanora forks `tsclientlib` for a p256 fix. Submit PR upstream to reduce fork maintenance burden.
- **Effort:** M
- **Dependencies:** None

### TODO-058 — Monitor tsdeclarations for TS5 protocol updates
- **Priority:** P2
- **Source:** external-research §2 (ReSpeak)
- **Description:** No full TS5 client protocol exists yet. Watch `tsdeclarations` repo for updates that may affect Chanora compatibility.
- **Effort:** S
- **Dependencies:** None (ongoing)

### TODO-059 — Build auto-reconnect logic internally
- **Priority:** P2
- **Source:** external-research §2 (ReSpeak)
- **Description:** tsclientlib explicitly notes auto-reconnect is "not yet there." Chanora must build this independently.
  - **Evidence:** `core/chanora_core/src/lib.rs:1722-2123` — Supervisor with:
    - Exponential backoff: `BACKOFF_SCHEDULE = [1, 2, 5, 15, 30, 60]` seconds
    - Watchdog: 5s interval, 4s probe timeout, 3 max misses
    - Network state awareness: pre-charges watchdog on offline, resets on online
    - Audio re-attachment via `sup_inner` after successful reconnect
    - Cancellation via `cancel_rx` oneshot on user disconnect
    - Broadcasts `SessionEvent::Reconnecting { attempt, delay_secs }` to UI
    - No max attempt limit (indefinite retry — correct for voice client)
    - Cross-verified against ReSpeak §1.10 (exponential backoff for packet timeouts)
- **Effort:** L
- **Dependencies:** None
- **Status:** VERIFIED COMPLETE — supervisor with exponential backoff, watchdog, network awareness (2026-06-11)

### TODO-060 — Extract server error codes from YaTQA for error handling
- **Priority:** P3
- **Source:** external-research §3 (YaTQA)
- **Description:** YaTQA's `/ressourcen/` section has comprehensive unofficial server error codes. Extract for Chanora error handling reference.
- **Effort:** S
- **Dependencies:** None

### TODO-061 — Extract anti-flood/rate-limiting reference from YaTQA
- **Priority:** P3
- **Source:** external-research §3 (YaTQA)
- **Description:** YaTQA documents anti-flood mechanics and rate limiting. Use as reference when implementing Chanora's rate limiting.
- **Effort:** S
- **Dependencies:** None

---

## 9. Protocol Implementation (from Reference Documents)

### TODO-062 — Implement DNS resolution chain (SRV→TSDNS→DNS)
- **Priority:** P1
- **Source:** yatqa-offline-reference §8.5
- **Description:** YaTQA documents the full DNS resolution order: SRV `_ts3._udp` → SRV TSDNS → TSDNS TCP port 41144 → DNS AAAA/A. First successful resolution wins, NO fallback on connection failure. Critical for connection reliability.
  - **Evidence:** `crates/chanora_resolver/src/lib.rs:178-387` — Full chain implemented:
    - Direct DNS resolution (`resolve_dns`, line 594)
    - TSDNS SRV resolution (`resolve_tsdns_srv_candidates`, line 414)
    - TSDNS TCP resolution (`resolve_tsdns_tcp_candidates`, line 454)
    - First-wins semantics with `return Ok(resolution)` on first success
    - No fallback on failure (errors accumulate, bail at end)
    - Cross-verified against YaTQA §8.5 resolution order
- **Effort:** M
- **Dependencies:** None
- **Status:** VERIFIED COMPLETE — full resolution chain implemented (2026-06-11)

### TODO-063 — Verify tsclientlib encoding handling (UTF-8 vs UCS-2 vs CESU-8)
- **Priority:** P1
- **Source:** yatqa-offline-reference §1.3
- **Description:** TS claims UTF-8 but uses UCS-2 (BMP only). Mobile apps use CESU-8. Server 3.2.0+ adds partial emoji support. tsclientlib/tsproto delivers Rust `String` (UTF-8) via `str::from_utf8()` at the protocol layer (ReSpeak §1.8.3 confirms: "Command string encoded in UTF-8"). If encoding bugs exist, the fix belongs in the EdisonJwa/tsclientlib fork, not in chanora_protocol.
- **Verification:** Confirm tsclientlib handles UCS-2 correctly. Document encoding behavior in protocol-implementation-traps.md (TODO-070).
- **Effort:** S (verification + documentation)
- **Status:** Scope revised from implementation to verification (2026-06-11)
- **Dependencies:** TODO-070 (protocol traps doc)

### TODO-064 — Implement client-side anti-flood point awareness
- **Priority:** P2
- **Source:** yatqa-offline-reference §5
- **Description:** YaTQA documents complete point costs per action (channelsubscribe=158pts, connect=80pts, etc.). Design Chanora's client-side anti-flood awareness to avoid accidental server bans. Tick-based point reduction model.
- **Effort:** M
- **Dependencies:** None

### TODO-065 — Implement badge fetching and display
- **Priority:** P2
- **Source:** yatqa-offline-reference §8.9, respeak-protocol-reference §5
- **Description:** Badges fetched from `badges-content.teamspeak.com` in Protobuf format, cached locally, refreshed every 24h. Chanora needs badge Protobuf parsing, caching, and UI display.
- **Effort:** L
- **Dependencies:** None

### TODO-066 — Implement TSDNS protocol support
- **Priority:** P2
- **Source:** yatqa-offline-reference §8.4
- **Description:** TSDNS protocol: TCP port 41144, lowercase domain + magic bytes. Required for `ts3server://` URL resolution and server bookmark handling.
- **Effort:** M
- **Dependencies:** TODO-062

### TODO-067 — Implement TS3 file transfer protocol
- **Priority:** P2
- **Source:** yatqa-offline-reference §8.3, external-research §2 (ReSpeak gap)
- **Description:** Raw file transfer: send key from `ftinitupload`/`ftinitdownload` to server IP:port, then raw data. No escaping. ReSpeak has no file transfer implementation — Chanora must build this independently.
- **Effort:** L
- **Dependencies:** None

### TODO-068 — Evaluate tsdeclarations machine-readable files for code generation
- **Priority:** P2
- **Source:** respeak-protocol-reference §9
- **Description:** Messages.toml, Book.toml, Enums.toml, MessagesToBook.toml, BookToMessages.toml could automate protocol struct and event generation. Evaluate feasibility for Chanora's build pipeline.
- **Effort:** M
- **Dependencies:** None

### TODO-069 — Extract Permission IDs into Chanora's permission system
- **Priority:** P2
- **Source:** respeak-protocol-reference §3, yatqa-offline-reference §1.2
- **Description:** Both ReSpeak (tsdeclarations) and YaTQA provide comprehensive permission ID lists with Skip/Negate/Grant logic. Map these to Chanora's permission implementation for full TS3 compatibility.
- **Effort:** L
- **Dependencies:** None

### TODO-070 — Document protocol implementation traps
- **Priority:** P2
- **Source:** yatqa-offline-reference §1.4, §1.5, §3.1
- **Description:** Several implementation traps documented in YaTQA: icon IDs signed/unsigned mismatch, avatar flag is MD5 hash not boolean, channel subscription limited to ONE at a time, line terminator is `0x0A 0x0D` (reversed Windows). Compile into Chanora developer notes.
- **Effort:** S
- **Dependencies:** None

### TODO-071 — Handle IPv6 blacklist canonicalization bug
- **Priority:** P3
- **Source:** yatqa-offline-reference §8.7
- **Description:** TS3 server 3.1.6-3.1.7 has IPv6 canonicalization bug in Blacklist2 protocol. Chanora should be aware when connecting to older servers.
- **Effort:** S
- **Dependencies:** None

### TODO-072 — Establish connection/message performance benchmarks
- **Priority:** P3
- **Source:** respeak-protocol-reference §10
- **Description:** tsclientlib benchmarks: ~199ms connect, ~189µs/message. Use as baseline for Chanora's performance testing.
- **Effort:** S
- **Dependencies:** None

### TODO-073 — Assess web client feasibility
- **Priority:** P3
- **Source:** teaspeak-offline-reference §10, external-research §1
- **Description:** TeaSpeak's web client was a compelling installation-less option. Evaluate whether a future Chanora web client makes sense. Not current scope.
- **Effort:** S
- **Dependencies:** None

---

## 10. Reference Document Improvements

### TODO-074 — Fix respeak reference: malformed badge table row
- **Priority:** P2
- **Source:** respeak-protocol-reference review (line 1309)
- **Description:** MIFCOM badge row has 6 columns (5 pipes) but table header has 5 columns. "Entered Performance" is a misplaced column. Fix table formatting.
- **Effort:** S
- **Dependencies:** None

### TODO-075 — Fix respeak reference: section numbering placeholder
- **Priority:** P2
- **Source:** respeak-protocol-reference review (line 764)
- **Description:** Section "4.? Differences between Query and Full Client" has a `?` placeholder. Assign correct section number (4.9 or similar).
- **Effort:** S
- **Dependencies:** None

### TODO-076 — Fix respeak reference: duplicate section numbering
- **Priority:** P2
- **Source:** respeak-protocol-reference review
- **Description:** Both the protocol spec section and reference data sections start at `# 2.`, making "Section 2" ambiguous. Separate into Part I (Protocol) and Part II (Reference Data) or renumber.
- **Effort:** S
- **Dependencies:** None

### TODO-077 — Resolve teaspeak reference: godmode permission contradiction
- **Priority:** P2
- **Source:** teaspeak-offline-reference review (lines 401 vs 414)
- **Description:** `b_virtualserver_select_godmode` listed as active permission in "Other Permissions" table (line 401) AND as "removed" in "Removed Permissions" table (line 414). Resolve: remove from one location or clarify version-based behavior.
- **Effort:** S
- **Dependencies:** None

### TODO-078 — Resolve teaspeak reference: music bot command contradiction
- **Priority:** P2
- **Source:** teaspeak-offline-reference review (lines 499 vs 1229)
- **Description:** Music bot queue commands (`musicbotqueuelist`, `musicbotqueueadd`, etc.) listed in active Music Bot Query Commands table (lines 499-501) AND in "Removed Commands" section (lines 1229-1236). Clarify which version removed them.
- **Effort:** S
- **Dependencies:** None

### TODO-079 — Add Chanora relevance section to teaspeak reference
- **Priority:** P2
- **Source:** teaspeak-offline-reference review
- **Description:** TeaSpeak reference has no section connecting features to Chanora's needs. Add "Relevance to Chanora" section mapping TeaSpeak features to Chanora SRS requirements and identifying protocol divergence points.
- **Effort:** M
- **Dependencies:** None

### TODO-080 — Backfill YaTQA reference: complete variable parameters tables
- **Priority:** P2
- **Source:** yatqa-offline-reference review
- **Description:** Variable parameters section severely condensed: ~15 of 50+ client vars, ~15 of 35+ channel vars, ~7 of 70+ server vars. Backfill from `yat.qa/ressourcen/variablen-parameter/`.
- **Effort:** L
- **Dependencies:** None

### TODO-081 — Backfill YaTQA reference: complete anti-flood action table
- **Priority:** P2
- **Source:** yatqa-offline-reference review
- **Description:** Anti-flood section reduced ~80 individual actions to summary tiers. Replace with complete itemized table from `yat.qa/ressourcen/voice-client-anti-flood/`.
- **Effort:** M
- **Dependencies:** None

### TODO-082 — Backfill YaTQA reference: missing error codes and truncated messages
- **Priority:** P2
- **Source:** yatqa-offline-reference review
- **Description:** ~28 error codes missing, several messages truncated (errors 1030, 1035, 522). Add missing codes and fix truncated messages.
- **Effort:** S
- **Dependencies:** None

### TODO-083 — Backfill YaTQA reference: expand ServerQuery notify events
- **Priority:** P2
- **Source:** yatqa-offline-reference review
- **Description:** Missing events: `notifychanneldescriptionchanged`, `notifychannelpasswordchanged`. Most events listed by name only with no field details. Expand with full field lists and behavioral notes.
- **Effort:** M
- **Dependencies:** None

### TODO-084 — Cross-reference YaTQA and ReSpeak error codes
- **Priority:** P3
- **Source:** yatqa-offline-reference review, respeak-protocol-reference review
- **Description:** YaTQA §9 and ReSpeak Errors.csv may have discrepancies. Cross-reference and note differences.
- **Effort:** S
- **Dependencies:** None

---

## 11. Additional Traceability Gaps

### TODO-085 — Add Flutter app documentation
- **Priority:** P2
- **Source:** codebase-analysis §4
- **Description:** Flutter app has <1% documentation coverage (~586 functions, ~5 documented). Add dart doc comments to core services and widgets.
- **Effort:** XL
- **Dependencies:** None

### TODO-086 — Add chanora_bridge doc comments (15% coverage)
- **Priority:** P2
- **Source:** codebase-analysis §4
- **Description:** chanora_bridge has 65 pub fn at 15% documentation. This is the FFI boundary — every function should be documented.
- **Effort:** L
- **Dependencies:** None

### TODO-087 — Track Flutter framework upstream bugs and workarounds
- **Priority:** P2
- **Source:** codebase-analysis §9, issue-history §1
- **Description:** 3+ historical issues required Flutter framework workarounds. Create tracking document for upstream Flutter bugs that affect Chanora and document current workarounds.
- **Effort:** S
- **Dependencies:** None

### TODO-088 — Improve branch management workflow
- **Priority:** P3
- **Source:** codebase-analysis §10, issue-history §2
- **Description:** PR stacking complexity and local CI mirroring noted as development pain points. Evaluate git-worktree or branch management tooling.
- **Effort:** M
- **Dependencies:** None

---

*Generated from codebase analysis on 2026-06-11. 88 items across 11 categories.*