Backlog triage Part D: ROADMAP cleaned (161 -> 123 lines, 81 -> 42 KB): intentions re-sorted P2/P3/P4, each names its 00 row; 33 shipped/killed/closed/moved items + the pre-invite checklist -> ROADMAP-HISTORY; UPDATE-ARC collapsed; one_register_gate reads suffix ids (R-50b found, moved to OPEN-ITEMS; decoy seen red)

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
2026-10-03 09:22:30 +02:00
parent 9f77865c2a
commit 33bbf8e94a
7 changed files with 140 additions and 121 deletions
@@ -114,3 +114,42 @@
 | **R-44** | **[P2-HIGH] A manual offsite push ships an unrefreshed DB dump — "backed up now" is false for the DB half.** Shipped in v0.148.0. | **SHIPPED controller v0.148.0 (2026-07-19)** | full text: `git show fddfe00ce268:documentation/backlog/ROADMAP.md` |
 | **R-47** | **[P2-HIGH] The DB replay races the application's own schema repair.** Shipped in 0.153.0, 0.90.0, v0.153.0. | **SHIPPED — controller v0.153.0, 2026-07-20** | full text: `git show fddfe00ce268:documentation/backlog/ROADMAP.md` |
 | **R-49** | **[P2] The offsite capture set is ~90% cache and duplication — 1.1 GB of a 1.2 GB immich "photo backup".** | **MOVED 2026-08-22 -> OPEN-ITEMS.md** (was: idea) | full text: `git show fddfe00ce268:documentation/backlog/ROADMAP.md` |
+
+## 2026-10-03 — the triage: shipped, killed, closed and moved items out of `ROADMAP.md`
+
+| ID | Item | Final state | Full text |
+|---|---|---|---|
+| **R-116** | **The drive-absent alarm and its recovery are a mismatched pair — generic on the way out, specific on the way back** | **CLOSED — the register row is closed (`CLOSED-ITEMS.md`)** | full text: `git show 9f77865:documentation/backlog/ROADMAP.md` |
+| **R-113** | **The drive-absent gate cannot fire on device loss — E-2b's alarm is wired to an unreachable condition** | **CLOSED — the register row is closed (`CLOSED-ITEMS.md`)** | full text: `git show 9f77865:documentation/backlog/ROADMAP.md` |
+| **R-112** | **E-2's degraded banner and offer have no UI consumer — correct endpoint, invisible to the customer** | **CLOSED — the register row is closed (`CLOSED-ITEMS.md`)** | full text: `git show 9f77865:documentation/backlog/ROADMAP.md` |
+| **R-114** | **On target-drive loss the customer is told the wrong story and offered the drive that vanished** | **CLOSED — the register row is closed (`CLOSED-ITEMS.md`)** | full text: `git show 9f77865:documentation/backlog/ROADMAP.md` |
+| **R-7b** | **Share backup EXECUTION** | ****SHIPPED (controller v0.145.0, 2026-07-18)**** | full text: `git show 9f77865:documentation/backlog/ROADMAP.md` |
+| **R-202** | **The orphan card promises recoverability unconditionally** | **CLOSED 2026-10-03 — register row verified finished and moved (`CLOSED-ITEMS.md`)** | full text: `git show 9f77865:documentation/backlog/ROADMAP.md` |
+| **R-201** | **The wipe-and-recover drill** | **CLOSED — both halves passed 2026-08-04/07 (`CLOSED-ITEMS.md`)** | full text: `git show 9f77865:documentation/backlog/ROADMAP.md` |
+| **D5** | **Move app secrets into the LOCAL recovery unit** | ****SHIPPED + PROVEN-LIVE** — controller v0.188.0, 2026-07-30** | full text: `git show 9f77865:documentation/backlog/ROADMAP.md` |
+| **E-2** | **Drive-role machinery around the moved vzdump target.** | **CLOSED — PARTIALLY PROVEN (Session C, 2026-07-29; `CLOSED-ITEMS.md`, the id-less rows)** | full text: `git show 9f77865:documentation/backlog/ROADMAP.md` |
+| **G-1** | **Gate C5 — the cross-repo tag-reachability check.** | ****BUILT AND CLOSED 2026-08-08** — `scripts/wire_contract_gate.py`, `--fast`, registered in `repo_gates.py`** | full text: `git show 9f77865:documentation/backlog/ROADMAP.md` |
+| **G-6** | **C2 — NOT mechanically gateable.** | **KILLED — recorded as a no: "names a route" is a judgement, not a predicate** | full text: `git show 9f77865:documentation/backlog/ROADMAP.md` |
+| **G-7** | **C6 — NOT gateable, and the measurement is the finding.** | **KILLED — recorded as a no, with evidence: `deadcode` re-found neither known instance** | full text: `git show 9f77865:documentation/backlog/ROADMAP.md` |
+| **R-25b** | **RULED: customer DELETE becomes a guided full-teardown cascade.** | ****SHIPPED hub v0.69.0 (2026-07-21)**** | full text: `git show 9f77865:documentation/backlog/ROADMAP.md` |
+| **R-87** | **The restic (app-data offsite) tier is NEVER restore-tested** | ****SHIPPED 2026-08-31 — controller v0.231.0, RE-SCOPED by its own spike.** Not built as written: the spike measured that an unattended scratch restore would have caught ONE of five drill-found restore defects, so it proves the snapshot CONTAINS a recoverable …** | full text: `git show 9f77865:documentation/backlog/ROADMAP.md` |
+| **R-48** | **[P2-HIGH] Restore controls are separable only by layout — and the difference between them is whether the data comes back.** | **SHIPPED — controller v0.154.0 (2026-07-21): the offsite restore wizard, one entry per app (`controller/internal/web/restore_wizard.go:12`); verified 2026-10-03** | full text: `git show 9f77865:documentation/backlog/ROADMAP.md` |
+| **R-29** | **The design-v2 green gates are not enforced anywhere — one has been RED for 16 releases.** | **CLOSED — the register row is closed (`CLOSED-ITEMS.md`)** | full text: `git show 9f77865:documentation/backlog/ROADMAP.md` |
+| **R-127** | **`data_key: true` is unreliable (4+ encryption keys unflagged, contradicting the catalog's own labels), and O4 can regenerate a DB password that no longer matches the restored data directory** | **MOVED → `OPEN-ITEMS.md` — a FINDING; its register row is the record (moved out of this file 2026-10-03; status here was: READY — NEW 2026-07-30)** | full text: `git show 9f77865:documentation/backlog/ROADMAP.md` |
+| **R-133** | **The vaulted break-glass console credential is PLAINTEXT AT REST, so every hub DB backup is a fleet-wide console-credential dump.** | **MOVED → `OPEN-ITEMS.md` — a FINDING; its register row is the record (moved out of this file 2026-10-03; status here was: READY — NEW 2026-07-31)** | full text: `git show 9f77865:documentation/backlog/ROADMAP.md` |
+| **R-126** | **A `.fab` bundle — plaintext secrets, optional password — can be exported ONTO a NAS.** | **MOVED → `OPEN-ITEMS.md` — a FINDING; its register row is the record (moved out of this file 2026-10-03; status here was: READY — 2026-07-30)** | full text: `git show 9f77865:documentation/backlog/ROADMAP.md` |
+| **R-95** | **The restic offsite tier's credential CAN DELETE — R-89's "parallel question", now ANSWERED** | **MOVED → `OPEN-ITEMS.md` — a FINDING; its register row is the record (moved out of this file 2026-10-03; status here was: idea — established read-only 2026-07-27)** | full text: `git show 9f77865:documentation/backlog/ROADMAP.md` |
+| **R-162** | **`docker diff` is the gate's only witness and its failure mode is quiet** | **MOVED → `OPEN-ITEMS.md` — a FINDING; its register row is the record (moved out of this file 2026-10-03; status here was: WATCHING — 2026-08-02)** | full text: `git show 9f77865:documentation/backlog/ROADMAP.md` |
+| **R-164** | **C2's chain — the DB volume tar cannot be dropped until a sound dump predicate exists** | **MOVED → `OPEN-ITEMS.md` — a FINDING; its register row is the record (moved out of this file 2026-10-03; status here was: BLOCKED — on the predicate (2026-08-02))** | full text: `git show 9f77865:documentation/backlog/ROADMAP.md` |
+| **R-91** | **The old 13 GB datastore copy is still on ep0's root disk** | **MOVED → `OPEN-ITEMS.md` — a FINDING; its register row is the record (moved out of this file 2026-10-03; status here was: WATCHING — gated on demo-felhom's first post-migration PBS backup)** | full text: `git show 9f77865:documentation/backlog/ROADMAP.md` |
+| **R-92** | **The hub's PBS-DR gauge is 0.1 GB-granular, so small deltas are unverifiable** | **MOVED → `OPEN-ITEMS.md` — a FINDING; its register row is the record (moved out of this file 2026-10-03; status here was: idea — 2026-07-27)** | full text: `git show 9f77865:documentation/backlog/ROADMAP.md` |
+| **R-93** | **`drill-r50` is both a blocked customer and the only drift fixture** | **MOVED → `OPEN-ITEMS.md` — a FINDING; its register row is the record (moved out of this file 2026-10-03; status here was: idea — 2026-07-27)** | full text: `git show 9f77865:documentation/backlog/ROADMAP.md` |
+| **R-169** | **CI can only report, because there is no gate in the road** | **MOVED → `OPEN-ITEMS.md` — a FINDING; its register row is the record (moved out of this file 2026-10-03; status here was: idea — minted 2026-08-02, **WAITING-ON-OPERATOR**)** | full text: `git show 9f77865:documentation/backlog/ROADMAP.md` |
+| **UPDATE-ARC** | **The app-update arc — seven slices, from "nobody knows what any box runs" to "an update is a decision the box can take safely."** | **COLLAPSED 2026-10-03** — parts 1–10 shipped, part 11 deferred by ruling; the open rows are listed in `ROADMAP.md` §UPDATE-ARC. Status at collapse: **slices 1, 1b, 2, 3 & 5 SHIPPED (controller v0.233.0 / v0.234.0 / v0.235.0; harness `app-catalog/scripts/upgrade-test.py`); slices 4, 6, 7 open** **2026-09-13 — SLICE 4 COLLAPSED: SHIPPED** (controller v0.237.0/v0.238.0/v0.238.1, R-448 CLOSED, proven live — … | full text: `git show 9f77865:documentation/backlog/ROADMAP.md` |
+| pre-invite: golden 0.146.0 rebuild | **golden 0.146.0 rebuild** | **DONE — baked + published 2026-07-18** | full text: `git show 9f77865:documentation/backlog/ROADMAP.md` |
+| pre-invite: golden ≥0.147.x carries all four infra images | **golden ≥0.147.x carries all four infra images** | **DONE — `build-golden.sh` v2.1.0 derives the pre-pull list (2026-07-19)** | full text: `git show 9f77865:documentation/backlog/ROADMAP.md` |
+| pre-invite: freemail.hu test-send (R-4) | **freemail.hu test-send (R-4)** | **DONE — R-4 closed 2026-07-21 (all three halves)** | full text: `git show 9f77865:documentation/backlog/ROADMAP.md` |
+| pre-invite: C6 — a customer performs a restore unassisted | **C6 — a customer performs a restore unassisted** | **SUPERSEDED — the unaided recovery journey was proven 2026-08-07 (`00` §A); the capability row "a customer performs a restore via UI alone" stays as R-3's target** | full text: `git show 9f77865:documentation/backlog/ROADMAP.md` |
+| pre-invite: R-11 rulings (contact channel, tester agreement, alert thresholds) | **R-11 rulings (contact channel, tester agreement, alert thresholds)** | **PARTLY RULED — the contact channel ruled 2026-07-21; the tester agreement → R-809 (2026-10-03)** | full text: `git show 9f77865:documentation/backlog/ROADMAP.md` |
+| stray text | **Two paragraphs that sat between ROADMAP rows** (a boot-gate log excerpt about immich after the R-50b row; three paragraphs on a quiesce-cycle amplifier after the R-87 row) | **KEPT IN HISTORY** — their rows are history; nothing open depends on them | full text: `git show 9f77865:documentation/backlog/ROADMAP.md` |
+| **R-50b** | **A root-owned privileged host artifact is delivered unversioned from `main`** | **MOVED → `OPEN-ITEMS.md`** (Box system & updates, P3) — a FINDING, found when `one_register_gate.py` stopped skipping suffix ids (2026-10-03) | full text: `git show 9f77865:documentation/backlog/ROADMAP.md` |
@@ -1,3 +1,11 @@
+## one-register reads suffix ids and splits on pipes outside code (2026-10-03, backlog triage, Part D)
+
+- `one_register_gate.py`: the id pattern was `R-(\d+)`, so ROADMAP rows R-27b, R-27c and R-50b were never read;
+  and its naive split read R-50b's state from inside `create\|reconcile\|grant`. Both fixed (suffix ids;
+  `register_table.split_cells`). The fix convicted R-50b at once — a finding that lived only in `ROADMAP.md`; it
+  moved to `OPEN-ITEMS.md`. Decoy `one-register/suffix-id-row`: **passed the old gate — seen red**, convicts now.
+- `instructions_gate.py`: `ROADMAP-HISTORY.md` counts as history, like the narratives archive.
+
 ## Every open row has a category and a severity (2026-10-03, backlog triage, Part C)

 - `register_shape_gate.py` **RULES 5–8**: a register row splits (pipes outside backticks) into exactly the cells its
@@ -558,8 +558,11 @@ def register_state(workspace_root):
    # 2026-10-03: the register's narrative sections (campaign write-ups, rulings, ranking
    # paragraphs) moved word for word to this archive. An id cited only there — R-153, named in the
    # 2026-08-02 intake paragraph and in felhom.eu/CLAUDE.md — is history, not "a reference to nothing".
-    narr = os.path.join(workspace_root, "felhom.eu", "documentation", "archive",
-                        "OPEN-ITEMS-narratives-2026-10-03.md")
+    # ROADMAP-HISTORY.md is the same kind of record for the roadmap: an id the 2026-10-03 clean-up moved
+    # there (a shipped or killed intention) is history too.
+    for narr in (os.path.join(workspace_root, "felhom.eu", "documentation", "archive",
+                              "OPEN-ITEMS-narratives-2026-10-03.md"),
+                 os.path.join(base, "ROADMAP-HISTORY.md")):
        if os.path.exists(narr):
            with io_open(narr) as fh:
                hist_text += "\n" + fh.read()
@@ -37,11 +37,14 @@ import os
 import re
 import sys

+sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
+import register_table  # noqa: E402
+
 ROOT = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
 ROADMAP = os.path.join(ROOT, "documentation", "backlog", "ROADMAP.md")
 REGISTER = os.path.join(ROOT, "documentation", "backlog", "OPEN-ITEMS.md")

-ROW = re.compile(r"^\|\s*\*{0,2}R-(\d+)\*{0,2}\s*\|")
+ROW = re.compile(r"^\|\s*\*{0,2}R-(\d+[a-z]?)\*{0,2}\s*\|")  # 2026-10-03: a suffix id (R-27b, R-27c, R-50b) was skipped unchecked
 # DONE and IDEA are matched against the row's STATE cell only, never the whole row: the body of a
 # finding routinely contains the word "shipped" while describing something else.
 # BANKED and PROVEN-LIVE are this project's own done-words and were found by running the gate: a row
@@ -58,8 +61,11 @@ def rows(path):
        m = ROW.match(line)
        if not m:
            continue
-        cells = line.split("|")
-        state = cells[4].strip() if len(cells) > 4 else ""
+        # 2026-10-03: split on pipes OUTSIDE backticks (`register_table.split_cells`). R-50b's item
+        # carries `create\|reconcile\|grant` in code, and the naive split read its STATE from the
+        # middle of that — so the row was judged on words that were not its state at all.
+        cells = register_table.split_cells(line) or []
+        state = cells[3].strip() if len(cells) > 3 else ""
        yield m.group(1), state, line


@@ -240,6 +240,15 @@ decoy("closed-register/open-row-closed-word (BY DESIGN)", "closed_register_gate.
      append_to(_OPEN_REG, _open_row("R-907", "**READY — RE-RANKED UP 2026-08-03 (R-86 closed)**")),
      expect="accept")

+# --- one-register (2026-10-03): an open ROADMAP row whose id carries a LETTER SUFFIX ------------
+# The gate's id pattern was `R-(\d+)`, so R-27b, R-27c and R-50b were never read. Fixing it convicted
+# R-50b at once — a finding that had lived only in ROADMAP.md. This decoy is that shape. (one-register
+# stays in decoy_coverage_gate's EXEMPT list for R-424's hole — a finding filed under `idea` — which
+# this decoy does not close.)
+decoy("one-register/suffix-id-row", "one_register_gate.py",
+      append_to(os.path.join(ROOT, "documentation", "backlog", "ROADMAP.md"),
+                u"\n| R-905b | **A finding filed only here.** | S | READY — 2026-10-03 | none |\n"))
+
 # --- hub-copy: an ENGLISH retrieval promise, planted in the bundle (R-558) -----------------------
 #
 # TWO SHAPES AT ONCE, and the second is why this decoy exists at all.