docs(multiplayer): add concise next-work checklist

TODO.md

@@ -19,7 +19,7 @@ The largest gap between this and a AAA-feeling product is presentation, not code
 
 ## Multiplayer (long term)
 
-Tracked in **[`multiplayer-todo.md`](multiplayer-todo.md)** — server-authoritative multiplayer, prediction, ENet dedicated hosting, and the Phase 6 exported-server Docker/CI verification are implemented. The remaining gates are a human latency playtest, a real 3v3 session, a controlled external-host run, and Phase 7 Steam identity/browser work.
+The concise current checklist is **[`multiplayer-next.md`](multiplayer-next.md)**. Historical architecture decisions, implementation evidence, and completed-task detail stay in **[`multiplayer-todo.md`](multiplayer-todo.md)**. Server-authoritative multiplayer, prediction, ENet dedicated hosting, and the Phase 6 exported-server Docker/CI verification are implemented; the remaining gates are captured in the current checklist.
 
 Phase 7 begins with optional GodotSteam bootstrap and a transport boundary; direct-IP ENet remains fully supported. It also carries the **graphics/performance work** — the project has never been profiled, and `video_settings.gd` exposes only AA, glow and brightness while SDFGI, SSIL, SSAO and five shadow-casting lights are on by default and unreachable (see §5.5 there).
 

multiplayer-next.md

@@ -0,0 +1,48 @@
+# Multiplayer — next work
+
+Short, current checklist for online multiplayer. Historical design decisions,
+implementation evidence, and completed work stay in
+[`multiplayer-todo.md`](multiplayer-todo.md).
+
+## Release blockers
+
+- [ ] **Phase 4 playtest:** a human playtest at roughly 100 ms RTT. Confirm
+  that ship and ball interaction feel local and contact corrections feel like
+  bumps rather than glitches.
+- [ ] **Phase 5 session:** complete a real 3v3 match with a mid-match
+  disconnect and late joiner.
+- [ ] **Phase 6 external check:** run the exported Docker server and clients
+  from separate machines over the internet, then play a full match. Keep this
+  controlled-only until Steam identity is complete.
+
+## Phase 7 — Steam, identity, discovery
+
+- [ ] Obtain the pinned GodotSteam client/server builds and Steamworks SDK
+  access described in [`STEAM.md`](STEAM.md).
+- [ ] Run `make verify-steam-templates` with the custom executables and fix
+  any custom-template failures.
+- [ ] Validate a two-account Steam SDR host/join using the existing explicit
+  `NetworkManager` Steam transport. ENet direct-IP must keep passing its smoke
+  test.
+- [ ] Build the Steam server browser: internet, LAN, favourites, and history.
+- [ ] Add Steam auth tickets, verified Steam identity in the roster, and a
+  persistent ban list. This fixes the slot-reclaim security issue below.
+
+## Known issues to resolve before public hosting
+
+- [ ] Slot reclaim is currently keyed by display name, so someone can take a
+  disconnected player's reserved slot. Do not expose public servers before
+  verified Steam identity lands.
+- [ ] Investigate occasional input loss during a long server stall; the
+  existing sequence resync recovers it, but transport delivery is variable.
+- [ ] Fix the remaining `_broadcast_snapshot` packet-send stderr race.
+
+## Decide after the latency playtest
+
+- [ ] Decide whether client-only, contact-cohort shadow physics is worthwhile
+  for the remaining prediction weakness.
+
+## Explicitly deferred
+
+120 Hz simulation, latency-gap measurement, audio hooks, and split-screen are
+not part of the current multiplayer release path.

multiplayer-todo.md

@@ -1,6 +1,8 @@
 # Online multiplayer — architecture and task breakdown
 
-Working document for the online multiplayer effort. `TODO.md` points here.
+Historical working document for the online multiplayer effort. For the concise
+current checklist, see [`multiplayer-next.md`](multiplayer-next.md); `TODO.md`
+points there too.
 
 Everything below is written so an agent (or a person) can pick up a single numbered task, do it, verify it against a stated acceptance criterion, and stop. Sections 1–6 are the decisions those tasks assume; read them before picking up work in Phase 2 or later.