Roadmap: Orbit Multiroom, in three stages, with its security

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

docs/roadmap.md

@@ -410,3 +410,33 @@ Six looks: Orbit Night, Daybreak, Nebula, Retro Tube, Deep Sea, High Contrast (d
 - The chosen look applies at once, onboarding included, so "Choose your look" comes right after Welcome.
 - Every colour in the app comes from the theme (no fixed navy or gold left in any screen), and each look is checked on every
   screen, in the player overlays, pop-ups and games too, before release. The cast never changes colour.
+
+## Orbit Multiroom (Paul, 5 November 2026)
+"Bring Orbit to another room." On a new box, first launch offers **Join an existing Orbit** alongside a fresh set-up: it finds
+the living-room box on the home network (or takes a six-digit code shown there), the living-room TV confirms, the chosen
+settings come across, you name the room and start watching.
+
+Shared between rooms: channel choices and presets; channel schedules only if shared viewing is chosen; themes and accessibility;
+profiles and Kids restrictions; Director's Chair decisions; Arcade preferences. Stays with each box: sleep timer, sound output,
+playback capabilities, remote preferences, what's playing, local caches and diagnostics.
+
+Shared schedules are an explicit choice: the same programme on Orbit 1 upstairs and down at the same moment (join live at its
+place), or the same line-up with independent schedules.
+
+Stages, with no box ever made a server others depend on:
+1. **Transfer my Orbit:** a secure one-time copy of approved settings. No lasting connection.
+2. **Keep rooms in sync:** approved changes to channels, profiles or themes pass between paired boxes, with clear conflict
+   handling.
+3. **Shared network:** boxes play from one canonical schedule with independent playback. This needs one schedule authority,
+   or two boxes could plan different programmes for 8pm. An optional small local coordinator, never required.
+
+Security, to settle before building:
+- No Emby password ever leaves a box. Each box signs in for itself, or gets its own device token the server issues, so each one
+  can be signed out on its own.
+- Pairing only on the local network, by the code plus a confirmation on the existing box's TV. Codes are short-lived and
+  single-use.
+- The transfer is encrypted end to end with a key agreed during pairing, never sent in the clear. The receiving box shows what
+  is coming before it's applied.
+- The Grown-ups PIN travels only as its salted hash, never as digits. Kids restrictions can't be loosened from the new box
+  without the PIN.
+- Paired boxes can be listed and removed from Settings. Removing one stops any sync.