Backlog triage Part D: ROADMAP cleaned (161 -> 123 lines, 81 -> 42 KB): intentions re-sorted P2/P3/P4, each names its 00 row; 33 shipped/killed/closed/moved items + the pre-invite checklist -> ROADMAP-HISTORY; UPDATE-ARC collapsed; one_register_gate reads suffix ids (R-50b found, moved to OPEN-ITEMS; decoy seen red)

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

documentation/backlog/ROADMAP-HISTORY.md

@@ -114,3 +114,42 @@
 | **R-44** | **[P2-HIGH] A manual offsite push ships an unrefreshed DB dump — "backed up now" is false for the DB half.** Shipped in v0.148.0. | **SHIPPED controller v0.148.0 (2026-07-19)** | full text: `git show fddfe00ce268:documentation/backlog/ROADMAP.md` |
 | **R-47** | **[P2-HIGH] The DB replay races the application's own schema repair.** Shipped in 0.153.0, 0.90.0, v0.153.0. | **SHIPPED — controller v0.153.0, 2026-07-20** | full text: `git show fddfe00ce268:documentation/backlog/ROADMAP.md` |
 | **R-49** | **[P2] The offsite capture set is ~90% cache and duplication — 1.1 GB of a 1.2 GB immich "photo backup".** | **MOVED 2026-08-22 -> OPEN-ITEMS.md** (was: idea) | full text: `git show fddfe00ce268:documentation/backlog/ROADMAP.md` |
+
+## 2026-10-03 — the triage: shipped, killed, closed and moved items out of `ROADMAP.md`
+
+| ID | Item | Final state | Full text |
+|---|---|---|---|
+| **R-116** | **The drive-absent alarm and its recovery are a mismatched pair — generic on the way out, specific on the way back** | **CLOSED — the register row is closed (`CLOSED-ITEMS.md`)** | full text: `git show 9f77865:documentation/backlog/ROADMAP.md` |
+| **R-113** | **The drive-absent gate cannot fire on device loss — E-2b's alarm is wired to an unreachable condition** | **CLOSED — the register row is closed (`CLOSED-ITEMS.md`)** | full text: `git show 9f77865:documentation/backlog/ROADMAP.md` |
+| **R-112** | **E-2's degraded banner and offer have no UI consumer — correct endpoint, invisible to the customer** | **CLOSED — the register row is closed (`CLOSED-ITEMS.md`)** | full text: `git show 9f77865:documentation/backlog/ROADMAP.md` |
+| **R-114** | **On target-drive loss the customer is told the wrong story and offered the drive that vanished** | **CLOSED — the register row is closed (`CLOSED-ITEMS.md`)** | full text: `git show 9f77865:documentation/backlog/ROADMAP.md` |
+| **R-7b** | **Share backup EXECUTION** | ****SHIPPED (controller v0.145.0, 2026-07-18)**** | full text: `git show 9f77865:documentation/backlog/ROADMAP.md` |
+| **R-202** | **The orphan card promises recoverability unconditionally** | **CLOSED 2026-10-03 — register row verified finished and moved (`CLOSED-ITEMS.md`)** | full text: `git show 9f77865:documentation/backlog/ROADMAP.md` |
+| **R-201** | **The wipe-and-recover drill** | **CLOSED — both halves passed 2026-08-04/07 (`CLOSED-ITEMS.md`)** | full text: `git show 9f77865:documentation/backlog/ROADMAP.md` |
+| **D5** | **Move app secrets into the LOCAL recovery unit** | ****SHIPPED + PROVEN-LIVE** — controller v0.188.0, 2026-07-30** | full text: `git show 9f77865:documentation/backlog/ROADMAP.md` |
+| **E-2** | **Drive-role machinery around the moved vzdump target.** | **CLOSED — PARTIALLY PROVEN (Session C, 2026-07-29; `CLOSED-ITEMS.md`, the id-less rows)** | full text: `git show 9f77865:documentation/backlog/ROADMAP.md` |
+| **G-1** | **Gate C5 — the cross-repo tag-reachability check.** | ****BUILT AND CLOSED 2026-08-08** — `scripts/wire_contract_gate.py`, `--fast`, registered in `repo_gates.py`** | full text: `git show 9f77865:documentation/backlog/ROADMAP.md` |
+| **G-6** | **C2 — NOT mechanically gateable.** | **KILLED — recorded as a no: "names a route" is a judgement, not a predicate** | full text: `git show 9f77865:documentation/backlog/ROADMAP.md` |
+| **G-7** | **C6 — NOT gateable, and the measurement is the finding.** | **KILLED — recorded as a no, with evidence: `deadcode` re-found neither known instance** | full text: `git show 9f77865:documentation/backlog/ROADMAP.md` |
+| **R-25b** | **RULED: customer DELETE becomes a guided full-teardown cascade.** | ****SHIPPED hub v0.69.0 (2026-07-21)**** | full text: `git show 9f77865:documentation/backlog/ROADMAP.md` |
+| **R-87** | **The restic (app-data offsite) tier is NEVER restore-tested** | ****SHIPPED 2026-08-31 — controller v0.231.0, RE-SCOPED by its own spike.** Not built as written: the spike measured that an unattended scratch restore would have caught ONE of five drill-found restore defects, so it proves the snapshot CONTAINS a recoverable …** | full text: `git show 9f77865:documentation/backlog/ROADMAP.md` |
+| **R-48** | **[P2-HIGH] Restore controls are separable only by layout — and the difference between them is whether the data comes back.** | **SHIPPED — controller v0.154.0 (2026-07-21): the offsite restore wizard, one entry per app (`controller/internal/web/restore_wizard.go:12`); verified 2026-10-03** | full text: `git show 9f77865:documentation/backlog/ROADMAP.md` |
+| **R-29** | **The design-v2 green gates are not enforced anywhere — one has been RED for 16 releases.** | **CLOSED — the register row is closed (`CLOSED-ITEMS.md`)** | full text: `git show 9f77865:documentation/backlog/ROADMAP.md` |
+| **R-127** | **`data_key: true` is unreliable (4+ encryption keys unflagged, contradicting the catalog's own labels), and O4 can regenerate a DB password that no longer matches the restored data directory** | **MOVED → `OPEN-ITEMS.md` — a FINDING; its register row is the record (moved out of this file 2026-10-03; status here was: READY — NEW 2026-07-30)** | full text: `git show 9f77865:documentation/backlog/ROADMAP.md` |
+| **R-133** | **The vaulted break-glass console credential is PLAINTEXT AT REST, so every hub DB backup is a fleet-wide console-credential dump.** | **MOVED → `OPEN-ITEMS.md` — a FINDING; its register row is the record (moved out of this file 2026-10-03; status here was: READY — NEW 2026-07-31)** | full text: `git show 9f77865:documentation/backlog/ROADMAP.md` |
+| **R-126** | **A `.fab` bundle — plaintext secrets, optional password — can be exported ONTO a NAS.** | **MOVED → `OPEN-ITEMS.md` — a FINDING; its register row is the record (moved out of this file 2026-10-03; status here was: READY — 2026-07-30)** | full text: `git show 9f77865:documentation/backlog/ROADMAP.md` |
+| **R-95** | **The restic offsite tier's credential CAN DELETE — R-89's "parallel question", now ANSWERED** | **MOVED → `OPEN-ITEMS.md` — a FINDING; its register row is the record (moved out of this file 2026-10-03; status here was: idea — established read-only 2026-07-27)** | full text: `git show 9f77865:documentation/backlog/ROADMAP.md` |
+| **R-162** | **`docker diff` is the gate's only witness and its failure mode is quiet** | **MOVED → `OPEN-ITEMS.md` — a FINDING; its register row is the record (moved out of this file 2026-10-03; status here was: WATCHING — 2026-08-02)** | full text: `git show 9f77865:documentation/backlog/ROADMAP.md` |
+| **R-164** | **C2's chain — the DB volume tar cannot be dropped until a sound dump predicate exists** | **MOVED → `OPEN-ITEMS.md` — a FINDING; its register row is the record (moved out of this file 2026-10-03; status here was: BLOCKED — on the predicate (2026-08-02))** | full text: `git show 9f77865:documentation/backlog/ROADMAP.md` |
+| **R-91** | **The old 13 GB datastore copy is still on ep0's root disk** | **MOVED → `OPEN-ITEMS.md` — a FINDING; its register row is the record (moved out of this file 2026-10-03; status here was: WATCHING — gated on demo-felhom's first post-migration PBS backup)** | full text: `git show 9f77865:documentation/backlog/ROADMAP.md` |
+| **R-92** | **The hub's PBS-DR gauge is 0.1 GB-granular, so small deltas are unverifiable** | **MOVED → `OPEN-ITEMS.md` — a FINDING; its register row is the record (moved out of this file 2026-10-03; status here was: idea — 2026-07-27)** | full text: `git show 9f77865:documentation/backlog/ROADMAP.md` |
+| **R-93** | **`drill-r50` is both a blocked customer and the only drift fixture** | **MOVED → `OPEN-ITEMS.md` — a FINDING; its register row is the record (moved out of this file 2026-10-03; status here was: idea — 2026-07-27)** | full text: `git show 9f77865:documentation/backlog/ROADMAP.md` |
+| **R-169** | **CI can only report, because there is no gate in the road** | **MOVED → `OPEN-ITEMS.md` — a FINDING; its register row is the record (moved out of this file 2026-10-03; status here was: idea — minted 2026-08-02, **WAITING-ON-OPERATOR**)** | full text: `git show 9f77865:documentation/backlog/ROADMAP.md` |
+| **UPDATE-ARC** | **The app-update arc — seven slices, from "nobody knows what any box runs" to "an update is a decision the box can take safely."** | **COLLAPSED 2026-10-03** — parts 1–10 shipped, part 11 deferred by ruling; the open rows are listed in `ROADMAP.md` §UPDATE-ARC. Status at collapse: **slices 1, 1b, 2, 3 & 5 SHIPPED (controller v0.233.0 / v0.234.0 / v0.235.0; harness `app-catalog/scripts/upgrade-test.py`); slices 4, 6, 7 open** **2026-09-13 — SLICE 4 COLLAPSED: SHIPPED** (controller v0.237.0/v0.238.0/v0.238.1, R-448 CLOSED, proven live — … | full text: `git show 9f77865:documentation/backlog/ROADMAP.md` |
+| pre-invite: golden 0.146.0 rebuild | **golden 0.146.0 rebuild** | **DONE — baked + published 2026-07-18** | full text: `git show 9f77865:documentation/backlog/ROADMAP.md` |
+| pre-invite: golden ≥0.147.x carries all four infra images | **golden ≥0.147.x carries all four infra images** | **DONE — `build-golden.sh` v2.1.0 derives the pre-pull list (2026-07-19)** | full text: `git show 9f77865:documentation/backlog/ROADMAP.md` |
+| pre-invite: freemail.hu test-send (R-4) | **freemail.hu test-send (R-4)** | **DONE — R-4 closed 2026-07-21 (all three halves)** | full text: `git show 9f77865:documentation/backlog/ROADMAP.md` |
+| pre-invite: C6 — a customer performs a restore unassisted | **C6 — a customer performs a restore unassisted** | **SUPERSEDED — the unaided recovery journey was proven 2026-08-07 (`00` §A); the capability row "a customer performs a restore via UI alone" stays as R-3's target** | full text: `git show 9f77865:documentation/backlog/ROADMAP.md` |
+| pre-invite: R-11 rulings (contact channel, tester agreement, alert thresholds) | **R-11 rulings (contact channel, tester agreement, alert thresholds)** | **PARTLY RULED — the contact channel ruled 2026-07-21; the tester agreement → R-809 (2026-10-03)** | full text: `git show 9f77865:documentation/backlog/ROADMAP.md` |
+| stray text | **Two paragraphs that sat between ROADMAP rows** (a boot-gate log excerpt about immich after the R-50b row; three paragraphs on a quiesce-cycle amplifier after the R-87 row) | **KEPT IN HISTORY** — their rows are history; nothing open depends on them | full text: `git show 9f77865:documentation/backlog/ROADMAP.md` |
+| **R-50b** | **A root-owned privileged host artifact is delivered unversioned from `main`** | **MOVED → `OPEN-ITEMS.md`** (Box system & updates, P3) — a FINDING, found when `one_register_gate.py` stopped skipping suffix ids (2026-10-03) | full text: `git show 9f77865:documentation/backlog/ROADMAP.md` |