## Remaining Work — Priority Order

### P0 — LiveKit E2EE frame encryption (BLOCKING video calls)
- [ ] Enable AES-GCM frame encryption in LiveKit Flutter SDK to match Element X
- Element X publishes media with `encryption: GCM`, app2 publishes `encryption: NONE`
- Without matching encryption, remote video renders as scrambled garbage
- Check livekit_client docs for `E2EEOptions` / `FrameCryptorFactory` on web
- May need to pass shared key material derived from the MatrixRTC session
- **Start here next session**: read livekit_client 2.4.0 source for E2EE setup on web

### P1 — Incoming call detection from Element X
- [ ] Element X sends MSC3401 `org.matrix.msc3401.call.member` state events (already in hidden events list)
- [ ] App currently listens for old `m.call.invite` events in matrixrtc_repository.dart
- [ ] Need to detect call.member state changes and show incoming call overlay
- The state event format includes `memberships[]` with `foci_active[].type: livekit`

### P2 — Cleanup and polish
- [ ] Remove debug logging from rooms_repository.dart (debugPrint of all rooms on every sync)
- [ ] Fix avatar 404s — switch to authenticated media API (/_matrix/client/v1/media/)
- [ ] Clean up 20 ghost devices for @try user on server (DELETE via admin API)
- [ ] Remove diagnostic Olm logging from index.html (console.log statements)
- [ ] Remove debug prints from auth_repository.dart (encryptionEnabled logging)

### P3 — Voice calling
- [ ] Test voice-only calls (same LiveKit flow, just no video track)
- [ ] Likely same E2EE issue as video — fix P0 first

### P4 — Cross-signing (Phase 2)
- [ ] Device verification to remove red exclamation in Element
- [ ] Profile screen hooks for verify/cross-sign

### Build and deploy commands
```bash
cd /srv/wp-dev/pwa-sites/m8chat-app2
dart analyze --fatal-infos
flutter build web --release
rsync -avz --delete --exclude='.htaccess' --exclude='.ftpquota' \
  -e "ssh -p 2233 -i ~/.ssh/m8chat_prod" \
  build/web/ m8chat@app.m8chat.au:public_html/app2.m8chat.au/
```

### Next session should start with
1. Read these claude-notes
2. Research LiveKit E2EE on Flutter web — check `livekit_client` package for `E2EEOptions`, `FrameCryptor`, `KeyProvider`
3. Check if Element X derives the E2EE key from the MatrixRTC session or uses a separate mechanism
4. Implement and test — the scrambled video fix is the most impactful single change