courtside/docs/KNOWN-GAPS.md

Known gaps and things to watch

Honest list of what the MVP does not do well yet. None of these block running a tournament; all of them are worth knowing before you do.

• No real-event mileage yet. The engine has been exercised by simulate.js (dozens of seeds, single and double elimination) and the HTTP smoke test, and the pages have been eyeballed on phone and desktop sizes. It has not run an actual tournament.
• Bracket corrections don't re-propagate. Correcting a bracket match after its winner has already played the next round does not rewind the later match; you must correct that one too. Pool corrections are fine (standings are recomputed).
• Double elimination with byes is tested at 6 teams (8-bracket). Very uneven fields (9–10 teams in a 16-bracket) get the same bye logic but have had less scrutiny.
• Queue priority is round-first. A round-2 match between two rested teams waits behind a round-1 match whose teams just came off court. That keeps pools fair (everyone plays round N before anyone plays round N+1) but can leave a court briefly idle. The engine is a single function (_eligible) if you want a different policy.
• ETAs are estimates. They come from the rolling average of the last six matches and assume a fixed changeover. Early in the day (fewer than one finished match) the default is 15 minutes.
• Alerts are on-page only. A team must have their team page open (or the notification permission granted) to be alerted. SMS and Web Push are the top roadmap items.
• Browser notifications need HTTPS and, on iOS, the page added to the home screen. Through the Cloudflare tunnel HTTPS is automatic.
• Registration is open to anyone with the URL during check-in, by design. If someone registers junk teams, remove them from the desk. There is no rate limiting beyond the 64 KB body cap.
• Team codes are 4 characters (about a million combinations) and only reveal a personalized read-only view, so guessing is harmless. They are not a write credential.
• Organizer sessions reset on restart unless SESSION_SECRET is set.
• node:sqlite is marked experimental by Node (stable API since 22.13, still emits a warning that the start script suppresses). If a future Node changes it, server/store.js is the only file that touches it and is about 50 lines.
• Single process. Restarting the container drops WebSocket connections; clients reconnect with backoff and re-fetch state, and no data is lost since every mutation is written before it is broadcast.
• The desk reloads itself when court or phase state changes (for multi-organizer freshness). If you are mid-typing in a form when another organizer marks a match final, the page reloads. The score pad is exempt while hovered.