- File chooser for `<input type="file">`: there is no `run-file-chooser` handler, so no page can upload a file. Through the Eydos permission system's file dialog; the page sees the chosen file, never its path
- Printing: the PDF is one JPEG per page; a text layer and link annotations would make it searchable and its links live. In a Flatpak the portal's dialog has no preview
- PDF viewer: WPE has none, a PDF only downloads. pdf.js served from a scheme of trust's own, so it runs in its own origin
- External schemes (`mailto:`, `tel:`, `magnet:`): `xdg-open` after asking, since a page can try to launch applications on its own
- Downloads: open the file, progress in the panel, choose the folder; never `xdg-open` an executable
- Security
	- WebGPU is on for every site while WebKit marks it unstable: attack surface, the GPU process above all. Behind a setting off by default, or per site
	- Confirm the web processes run sandboxed (bwrap, seccomp); ltk-webkit configures nothing for it
	- WPE security updates: our build is 2.54.0 liberux1; every WebKit security advisory needs a rebuild and a release, as the Safari version in the user agent needs following
	- HTTPS first for addresses typed without a scheme; warn on forms sent over http
	- TLS errors: keep them impossible to skip, but give them a page that explains, and show in the address bar whether the connection is secure
	- Site permissions: with no `permission-request` handler WebKit denies camera, microphone, location and notifications, which leaves video calls unusable. Per origin through the Eydos permission system, remembered and revocable in Settings
- Privacy
	- Private browsing: needs an ephemeral session in ltk-webkit
	- Site data: see and clear each site's cookies and storage, clear chosen sites on close
	- Blocking list: ours has 91 domains. A maintained third-party list (EasyList, uBlock's) is a licence and update decision; per-site exceptions
	- Fingerprinting: limit what WebGPU and WebGL say about the GPU, screen sizes, exposed fonts; the Safari user agent only protects if the rest looks like Safari
	- Encrypted DNS: WebKit uses the system resolver; DNS over TLS in systemd-resolved, for the whole of Eydos
	- Passwords and autofill, if ever: in the Secret Service, never a file of trust's, nothing synchronised
- Performance
	- Memory on the phone is still poor; tune the thresholds from the device's own log lines
	- Favicons out of the state file: about 32 KB per tab saved every 30 s; files in the cache, the state keeping a reference
	- History: `history.json` is rewritten whole on every flush; SQLite
	- Check on the phone that video is decoded in hardware
	- Back/forward cache: `DocumentBrowser` under 4 GB keeps no whole pages for back; a more generous model on desktops
- forge/web's Makefile: `hello`, `crustace` and `crustace-dev` end serving and block, so `make hello crustace-dev` never reaches crustace; build targets and a separate `serve`
- Restore each video's position with the session: a restored or reloaded tab starts its videos from zero, since WebKit's session state keeps the history but not media time
	- Generic, not YouTube only: the tab's main video, the largest with currentTime > 0. The `&t=` parameter of YouTube is not an option, since tabs come back from WebKit's serialised history rather than from their URL
	- Read only when needed, no polling: on_close_requested returns false, asks every loaded tab for the time through evaluate_javascript, and sets quit once all have answered or after about 300 ms; ltk then calls save_state with the times in it. Same before `Tab::unload` drops a view to save memory
	- A thread or detached process that saves after exit cannot work: threads die with the process, and the web processes that hold the times are trust's children
	- `SavedTab` gains `media_time: Option<f64>` with a serde default. On restore, a script waits for the `<video>` (YouTube builds its player late) and sets currentTime; with autoplay denied it stays paused there
	- Not covered: SIGTERM / SIGINT (logout, shutdown), where ltk sets exit_requested in platform/wayland/session.rs without asking the app; covering it needs an ltk hook that warns the app and grants a short delay. A crash or an OOM kill loses the time unless something polls
