Backlog triage Part E: RECOMMENDATION (top 29 = every P2, five themes, pick A off-site backup safety vs B box OS updates), STATUS decision, REPORT-backlog-triage-2026-10-03

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

STATUS.md

@@ -2,9 +2,23 @@
 
 **Ready for the first real tester (Tester-2): yes. You confirmed the tunnel route and the connect mails (2026-09-30).**
 
-**Updated 2026-10-02 (afternoon). Both demo boxes run controller 0.288.0 and host agent 0.138.0. Hub 0.126.0. New
+**Updated 2026-10-03 (the to-do list put in order). Versions unchanged since 2026-10-02 (afternoon). Both demo boxes run controller 0.288.0 and host agent 0.138.0. Hub 0.126.0. New
 installs get golden 0.288.0 with agent 0.138.0.**
 
+## Today (2026-10-03): the to-do list is in order — paperwork only, no machine touched
+
+- **Finished items left the open list.** It went from 442 rows to 326. Nothing was deleted; each moved row names
+  where its full text is.
+- **Every open row now has one category and one severity** (P1 now · P2 before the first paying customer · P3
+  during the first customers · P4 later). **No row is P1.** 27 rows are P2.
+- **Two new automatic checks** refuse a finished row left in the open list, and a new row without a category or a
+  severity.
+- **Your four new items are on the roadmap:** security updates for the box's own system; legal pages and business
+  papers; "what if the household leaves Felhom"; a second login step for the dashboard. Two of them are also real
+  findings today: **a box never receives system security updates**, and **the website has no privacy notice,
+  terms or imprint.**
+- The ranked list and my reasoning: the triage recommendation in the audits folder.
+
 **Tester-2 — read only, from the hub.** The customer record exists. Tester-2's box has not registered yet.
 
 ## Today (afternoon): every app checked again
@@ -41,6 +55,10 @@ Your licence decisions are recorded: Emby, Plex and n8n stay. recipe-importer ne
 
 ## What needs you
 
+0. **Pick the next theme.** **A — off-site backup safety** (recommended): a dated check on it turns red on
+   6 October and then refuses every push until it is done; it guards the household's own files. **B — box system
+   security updates**: nothing patches a box today; a test on a throwaway box comes first. **If you say nothing:**
+   the next session starts A. 18 rows wait on you; the list is in the triage recommendation.
 1. **plant-it:** keep the hidden template as it is, or remove it entirely (its image no longer exists). **If you say
    nothing:** it stays hidden; nothing runs it.
 2. **Send the SparkyFitness request, and ask the Tandoor authors** (the "Before the first paying customer" list).