# TODO — Implementation Plans

Eight plans derived from the architecture assessment, ordered by priority and with
effort/risk so you can sequence the work. Each lives in `todo/<topic>/overview.md`.

## Critical / High — do first (all low effort, low risk)

| # | Topic | Priority | Effort | Depends on |
|---|-------|----------|--------|------------|
| 1 | [xss-fixes](xss-fixes/overview.md) — escape server data at `innerHTML`; add CSP | Critical | Low | — |
| 2 | [websocket-robustness](websocket-robustness/overview.md) — try/catch parse, reconnect backoff, dead-channel fallback | High | Low–Med | — |
| 3 | [ws-guest-control-permission](ws-guest-control-permission/overview.md) — route WS control through `userHasPermission` | High | Trivial | — |
| 4 | [channel-get-auth](channel-get-auth/overview.md) — add auth to `GET /api/channels/:id` | High | Trivial | — |

Items 1–4 are independent and can be done in parallel. Each is a small, isolated change.

## Medium — correctness and efficiency

| # | Topic | Priority | Effort | Depends on |
|---|-------|----------|--------|------------|
| 5 | [fetch-response-validation](fetch-response-validation/overview.md) — `res.ok` checks before `res.json()` | Medium | Low | — |
| 6 | [duplicate-download-race](duplicate-download-race/overview.md) — synchronous check-and-claim for bulk downloads | Medium | Low | — |
| 7 | [client-cache-correctness](client-cache-correctness/overview.md) — revoke blob URLs, LRU prune, real `streamOnly` | Medium | Medium | #6 (shares `downloadAndCacheTrack`) |

## Strategic — refactor, do last

| # | Topic | Priority | Effort | Depends on |
|---|-------|----------|--------|------------|
| 8 | [client-store-and-windowing](client-store-and-windowing/overview.md) — virtualize list + minimal store + decompose god module | Strategic | High | #1, #6, #7 (inherit correct behavior first) |

## Suggested order

1, 3, 4 (one-line/server-side, ship immediately) → 2 → 5 → 6 → 7 → 8.

All plans include affected file:line references, a step-by-step implementation
sketch, validation steps, and rollback notes.