# STATUS — what works, what's broken, what's next

**Updated 2026-08-12 (late evening — retained-key drill).**

> **A view, not a source.** `documentation/backlog/OPEN-ITEMS.md` is the authority; this page restates
> part of it in plain words, and **nothing may exist only here**. **Items, not paragraphs. One screen.**
> If it does not fit, it belongs in the register instead.

## Waiting on you

*(The golden-vouch and floor-raise asks that stood here are **done** — the hub reads golden **0.213.0**,
floor **0.213.0**, agent **0.128.0**. Checked live, not assumed.)*

- **R-307 — a countdown is already running on `demo-felhom`**, started 10 Aug, **firing 24 August**,
  after which that set-aside off-site copy is deleted for good. Today's drill did not start it and
  deliberately did not cancel it. Cancel it (copy kept, costs storage) or let it run (copy deleted).
  **Doing nothing chooses deletion.**
- **R-304 — decide what we promise about old backups.** The retention works, but only an operator can
  use it; the customer is told their correct code is wrong. Either build the door, or stop promising.
- **R-303 — one coherence decision**, ranked low: a box can still raise the "we cannot open your new
  backups" card while counting down to deleting the old ones. The two no longer contradict each other,
  but the state is odd and the wrong fix would hide a real second fault.

## What works

Both demo machines are home, healthy and reporting on the approved pair. Off-site is credentialed on
`demo-hp` and its repository still opens with the machine's own key. `drill-r50` is blocked, as intended.

## Shipped

- **The drive can be re-attached after a reinstall** (R-280). The restore page said *"this is two
  clicks"* over an empty list; it was zero clicks and needed an internal path no customer could produce.
- **The orphan card stops promising** that set-aside off-site copies can be reopened — twice over
  (R-294, then **R-299**, which was the same claim in the plural, in the *always-visible* half, missed
  because the guard matched one inflection of a Hungarian verb).
- **The countdown banner stops promising retrieval it cannot see is still true** (R-302). The promise
  is now conditional on the hub still holding the package it held when the customer decided — pinned
  then, compared now. A sweep found the same claim in five places; a fourth was fixed with it and a
  fifth deliberately left, because it is true where it renders.
- **One name per secret, box side** (R-295): the dashboard code is „Beállító kód" everywhere;
  „Visszaállító kód" is retired. It collided with the escrow „Helyreállítási kód" and cost a real code.
- **Both installer fixes are now PUBLISHED** as `installer-v1.27.0` (R-297 + R-300). Each fault was
  watched happening first, on a machine reset to factory state: the old installer really did build a
  machine on a base image from July, and our own uninstall really did block our own next install.

## Broken, or knowingly incomplete

- **The tester's machine has no recovery route at all** — see the `PETI` row. Its host record was
  deleted on 15 July; there is no key, no off-site copy and no local backup. **If that drive fails,
  everything on it is lost.** First act of the visit: copy the ~3.6 GB off before anything is
  reinstalled — it is currently the only copy in existence. Whether it stays parked is your call and is
  deliberately left open.
- **Kept backups can be opened — but not by the customer** (R-304). We now know for certain the old key
  is kept and **does** open the old backups: three planted files came back byte-for-byte from a store the
  machine itself could no longer read. But nothing in the product reads a kept key, so it takes an
  operator with a shell. Worse, a customer who types their **correct** old code is told it *"did not open
  the sealed bundle"*. The keeping is real; the promise that they can use it is not.
- **The dnsmasq fix helps a machine once** (R-305). On a machine that never had Felhom it works. On the
  second reinstall the leftover comes back, because the package is never removed — so the machine looks,
  to our own installer, as if the household had installed it. Watched happening the same afternoon.
- **The hub half of the naming is undone** (R-295 PARTIAL): the emails still use the retired name and
  send people to a page a rebuilt machine does not show.
- **The storage page has its own separate reason for showing an empty list** (R-298), untouched.

## Working on next

Your two decisions above (R-307's deadline is the hard one); then R-304's shape; then the hub naming;
then the 2026-08-09 batch (R-279 … R-292), still untriaged against everything since.