blastoise/todo/README.md

TODO — Implementation Plans

Eight plans derived from the architecture assessment, ordered by priority and with effort/risk so you can sequence the work. Each lives in todo/<topic>/overview.md.

Critical / High — do first (all low effort, low risk)

#	Topic	Priority	Effort	Depends on
1	xss-fixes — escape server data at innerHTML; add CSP	Critical	Low	—
2	websocket-robustness — try/catch parse, reconnect backoff, dead-channel fallback	High	Low–Med	—
3	ws-guest-control-permission — route WS control through userHasPermission	High	Trivial	—
4	channel-get-auth — add auth to GET /api/channels/:id	High	Trivial	—

Items 1–4 are independent and can be done in parallel. Each is a small, isolated change.

Medium — correctness and efficiency

#	Topic	Priority	Effort	Depends on
5	fetch-response-validation — res.ok checks before res.json()	Medium	Low	—
6	duplicate-download-race — synchronous check-and-claim for bulk downloads	Medium	Low	—
7	client-cache-correctness — revoke blob URLs, LRU prune, real streamOnly	Medium	Medium	#6 (shares downloadAndCacheTrack)

Strategic — refactor, do last

#	Topic	Priority	Effort	Depends on
8	client-store-and-windowing — virtualize list + minimal store + decompose god module	Strategic	High	#1, #6, #7 (inherit correct behavior first)

Suggested order

1, 3, 4 (one-line/server-side, ship immediately) → 2 → 5 → 6 → 7 → 8.

All plans include affected file:line references, a step-by-step implementation sketch, validation steps, and rollback notes.