admin
33bbf8e94a
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
38 KiB
ROADMAP-HISTORY — finished and superseded roadmap items, compressed
Companion to
ROADMAP.md, created 2026-08-22 under the same operator ruling that producedCLOSED-ITEMS.md. Each entry keeps its identifier, title, shipped version and final state, and names the commit holding its full original text. Nothing was deleted.
ROADMAP.mdnow carries only live intentions and the reasoning behind them, which is what its own first paragraph has always said it is for.
| R-115 | Publishing is a remembered step — forgotten within eight hours of being documented as forgettable Shipped in 0.113.0, 0.114.0, v0.113.0. | CLOSED — SHIPPED 2026-08-03 (release-agent.sh + check-published-versions.py, no version bump). Releasing now builds, tags, publishes and verifies by an independent download in one act; a | full text:git show fddfe00ce268:documentation/backlog/ROADMAP.md| | **R-111** | **The Day-0 artifact channel is 17 agent releases stale — a box installed today gets agent0.96.0, not 0.113.0** Shipped in 0.110.0, 0.113.0, 0.161.0. | **SHIPPED 2026-07-29** — agent 0.113.0 published (sha 5f3247f7…, round-trip verified) + golden **0.185.1** baked and published (sha dba00f3e…, embeds controller 0.185.1); hub Day-0 manifest moved | full text: git show fddfe00ce268:documentation/backlog/ROADMAP.md| | **R-1** | **Peti convergence** Shipped in v0.57.0. | **rehearsal DONE; Peti half open** | full text:git show fddfe00ce268:documentation/backlog/ROADMAP.md | | **R-2** | **~~Resolve ~215 lines of foreign WIP in felhom.eu clone (hub/internal/notify/, store.go, hub/internal/cla** Shipped in v0.50.0, v0.54.0, v0.55.0. | killed (2026-07-16) | full text: git show fddfe00ce268:documentation/backlog/ROADMAP.md |
| R-4 | Claim-code deliverability: test-send to gmail.com / freemail.hu; tighten DMARC p=none → p=quarantine Shipped in 1.1.1, 8.8.8. | DONE 2026-07-21 (all three halves) | full text: git show fddfe00ce268:documentation/backlog/ROADMAP.md |
| R-39 | [P2-HIGH] The PBS DR tier can be applied and dead at the same time — and nothing notices. Shipped in 0.68.1, 0.90.0, 0.90.1. | CLOSED 2026-07-21 — PROVEN LIVE (hub 0.68.1 + agent 0.91.2) | full text: git show fddfe00ce268:documentation/backlog/ROADMAP.md |
| R-30 | [P2-HIGH] Liveness presence should come from the wait channel, not the report clock. | MOVED 2026-08-22 -> OPEN-ITEMS.md (was: idea) | full text: git show fddfe00ce268:documentation/backlog/ROADMAP.md |
| R-31 | [P2-HIGH] Offsite provisioning is synchronous with no status affordance. Shipped in v0.138.0. | MOVED 2026-08-22 -> OPEN-ITEMS.md (was: idea) | full text: git show fddfe00ce268:documentation/backlog/ROADMAP.md |
| R-32 | [P2-HIGH] RESET must purge the customer base dir; the orphan card must stay honest; unattributed bytes must be visible. | MOVED 2026-08-22 -> OPEN-ITEMS.md (was: idea) | full text: git show fddfe00ce268:documentation/backlog/ROADMAP.md |
| R-33 | [P2-HIGH] Bootstrap pairing-poll spams the customer-visible console. Shipped in v1.21.0. | SHIPPED (scripts v1.21.0, 2026-07-18) | full text: git show fddfe00ce268:documentation/backlog/ROADMAP.md |
| R-5 | Hub: offsite storage visibility — RESTIC box aggregate (v0.64.0) + PBS DR datastore (v0.65.0), each with fill Shipped in v0.64.0, v0.65.0, v1.2.0. | SHIPPED (hub v0.64.0 + v0.65.0 + tenantsync v1.2.0, 2026-07-17) | full text: git show fddfe00ce268:documentation/backlog/ROADMAP.md |
| R-7 | server Shipped in 1.0.0, v0.144.0. | SHIPPED slice 1 (controller v0.144.0 + felhom-samba:1.0.0, 2026-07-18) | full text: git show fddfe00ce268:documentation/backlog/ROADMAP.md |
| R-10 | T-6E-1: DB-dump dir-fsync asymmetry (LOW, confirmed in 6E) | MOVED 2026-08-22 -> OPEN-ITEMS.md (was: idea) | full text: git show fddfe00ce268:documentation/backlog/ROADMAP.md |
| R-11 | Tester-facing one-pager: what the box does, known limitations, how to report | RULED 2026-07-21 (channel); doc is the architect's | full text: git show fddfe00ce268:documentation/backlog/ROADMAP.md |
| R-16 | Operator hygiene: campaign6 autofs orphan (clears on host reboot) + tied-CreatedAt flash duplicates (audioboo Shipped in v1.17.0. | open (doc-drift bit CLOSED) | full text: git show fddfe00ce268:documentation/backlog/ROADMAP.md |
| R-22 | PBS-DR pre-check self-grant (F4). Shipped in v0.89.0. | SHIPPED + PROVEN-LIVE agent v0.89.0 (2026-07-17) | full text: git show fddfe00ce268:documentation/backlog/ROADMAP.md |
| R-17 | Old-box archive (u629193-sub1) retirement — 9/9 byte-identical restores verified | CLOSED 2026-07-22 — archive deleted (operator console) | full text: git show fddfe00ce268:documentation/backlog/ROADMAP.md |
| R-198 | The superseded-escrow retention kept the K-escrow and dropped the identity blob Shipped in v0.60.0, v0.93.0. | SHIPPED (hub v0.93.0, 2026-08-04) | full text: git show fddfe00ce268:documentation/backlog/ROADMAP.md |
| R-197 | The hub stored both halves of "did this box's offsite data key change" and compared them nowhere Shipped in v0.93.0. | SHIPPED (hub v0.93.0, 2026-08-04) | full text: git show fddfe00ce268:documentation/backlog/ROADMAP.md |
| R-196 | Five comments claimed ReissueCredentials rotates the restic repo password Shipped in v0.93.0, v0.95.0. | CLOSED — behaviour shipped hub v0.95.0 (2026-08-05) | full text: git show fddfe00ce268:documentation/backlog/ROADMAP.md |
| R-199 | The hub served recovery blobs on endpoints with no client anywhere Shipped in v0.125.0, v0.94.0. | SHIPPED + PROVEN-LIVE (hub v0.94.0 + agent v0.125.0, 2026-08-04) | full text: git show fddfe00ce268:documentation/backlog/ROADMAP.md |
| R-200 | The password-injection seam had a handler and no form Shipped in v0.195.0. | plumbing SHIPPED (controller v0.195.0); the form is NOT built | full text: git show fddfe00ce268:documentation/backlog/ROADMAP.md |
| R-203 | A mandatory customer data directory was silently absent from the off-site snapshot while the run reported ok Shipped in v0.197.0. | SUPERSEDED 2026-08-22 — the register records SHIPPED + PROVEN-LIVE (controller v0.197.0, 2026-08-04); this row was never updated when it shipped (was:OPEN — halted the R-201 drill 2026-08-04) | full text: git show fddfe00ce268:documentation/backlog/ROADMAP.md |
| R-203 | The app and its backup looked in different directories, and a run that skipped a mandatory folder still said ok Shipped in v0.197.0. | SHIPPED + PROVEN-LIVE (controller v0.197.0, 2026-08-04) | full text: git show fddfe00ce268:documentation/backlog/ROADMAP.md |
| R-204 | The recovered key cannot be used: the Re-issue that reconfigures a rebuilt box's off-site tier marks the escrow stale, which gates every run, and the only way to clear it destroys the key Shipped in v0.199.0, v0.96.0. | ALL FOUR ITEMS SHIPPED (controller v0.199.0 + hub v0.96.0, 2026-08-05) | full text: git show fddfe00ce268:documentation/backlog/ROADMAP.md |
| R-193 | A rebuilt box's off-site history was unreachable, and later reachable only from a command line Shipped in v0.199.0, v0.200.0, v0.96.0. | CLOSED (2026-08-05) — credential half controller v0.199.0 + hub v0.96.0; the customer-facing SCREEN controller v0.200.0 | full text: git show fddfe00ce268:documentation/backlog/ROADMAP.md |
| R-201 | The wipe-and-recover drill | PASSED + PROVEN-LIVE (2026-08-04 night) | full text: git show fddfe00ce268:documentation/backlog/ROADMAP.md |
| R-20 | Verify operator-key pinning is fully in the day-0 install flow | closed (2026-07-16) | full text: git show fddfe00ce268:documentation/backlog/ROADMAP.md |
| R-23 | Immediate-sync Direction-2 follow-ups Shipped in 0.153.0, 0.154.0, 0.155.0. | (a) BANKED in full; only (b) cosmetic remains | full text: git show fddfe00ce268:documentation/backlog/ROADMAP.md |
| R-35 | Config-apply should not end the customer's session. | MOVED 2026-08-22 -> OPEN-ITEMS.md (was: idea) | full text: git show fddfe00ce268:documentation/backlog/ROADMAP.md |
| R-36 | Post-RESET re-enroll leaves offsite "enabled but unprovisioned" — silently. Shipped in v0.67.0. | SHIPPED (hub v0.67.0, 2026-07-18) | full text: git show fddfe00ce268:documentation/backlog/ROADMAP.md |
| R-50 | [P2-HIGH] Island-bridge control plane — make controller↔agent independent of the LAN. Shipped in 0.96.0, 169.254.253, 192.168.0. | SHIPPED 2026-07-25 — fleet-migrated (agent v0.96.0 + host-install v1.19.0) | full text: git show fddfe00ce268:documentation/backlog/ROADMAP.md |
| R-51 | Dead-primary alerting — a multi-container app whose MAIN container is dead must alert. Shipped in v0.156.0. | SHIPPED 2026-07-21 — controller v0.156.0 | full text: git show fddfe00ce268:documentation/backlog/ROADMAP.md |
| R-52 | Boot desired-state reconciliation — a deployed: true app should be running after boot. Shipped in v0.156.0. | SHIPPED 2026-07-21 — controller v0.156.0 | full text: git show fddfe00ce268:documentation/backlog/ROADMAP.md |
| R-54 | [P2-HIGH] The guest's DHCP client is unsupervised — its death takes the box off the internet 1-2 hours later, invisibly. Shipped in 0.92.0, 0.92.1, 192.168.0. | SHIPPED 2026-07-21 — agent v0.92.1 | full text: git show fddfe00ce268:documentation/backlog/ROADMAP.md |
| R-55 | [P2] A customer's deliberate Stop does NOT survive a guest reboot for any drive-backed app Shipped in v0.157.0. | SHIPPED 2026-07-21 — controller v0.157.0 | full text: git show fddfe00ce268:documentation/backlog/ROADMAP.md |
| R-57 | An app can be withdrawn from the catalog without orphaning the customers already running it Shipped in v0.158.0, v0.158.1. | SHIPPED 2026-07-21 — controller v0.158.0 (+ v0.158.1 fix), LIVE-PROVEN | full text: git show fddfe00ce268:documentation/backlog/ROADMAP.md |
| R-59 | [P1] A no-DHCP install must HARD-ABORT — instead it bakes the installer's fallback address as a STATIC config and completes, producing a box that can never call home. Shipped in 192.168.100, v1.24.0. | **SHIPPED v1.24.0 (2026-07-22) — as a FIRST-BOOT refuse-loudly gate, with a RECORDED DEVIATION: the install-time abort is out of scope (the 192.168.100.2 fallback is baked inside the Proxmox auto-inst | full text: git show fddfe00ce268:documentation/backlog/ROADMAP.md |
| R-60 | [P2] First-boot NIC sweep self-heal: if the hub is unreachable, try DHCP across every carrier-bearing NIC before settling. Shipped in v1.24.0. | **SHIPPED v1.24.0 (2026-07-22) — spike + nested drill proven (SPIKE-firstboot-nic-sweep-2026-07-22.md): cable move → sweep → heal + hub registration unaided in <1 min; sweep is structurally first-boot | full text: git show fddfe00ce268:documentation/backlog/ROADMAP.md |
| R-61 | [P1] The baked root password must be knowable by the operator — the recurring console lockout. Shipped in v1.24.0. | **slice 1 SHIPPED v1.24.0 (2026-07-22): the build emits the plaintext into a 0600 sibling <iso>.rootpw.txt (single record of truth — never logged/manifested/committed); drill-verified against the in | full text: git show fddfe00ce268:documentation/backlog/ROADMAP.md |
| R-63 | The install console learns ő/ű Shipped in 0.153.0, 0.156.0, 0.161.0. | SHIPPED (scripts v1.25.0, 2026-07-23) | full text: git show fddfe00ce268:documentation/backlog/ROADMAP.md |
| R-66 | The box's own address becomes visible — „Hálózat" card, Debug network dump, NetBIOS hint. Shipped in v0.159.0. | SHIPPED (controller v0.159.0, 2026-07-22) | full text: git show fddfe00ce268:documentation/backlog/ROADMAP.md |
| R-67 | The NAS share appears in FileBrowser — browse what you mounted. Shipped in v0.160.0. | SHIPPED (controller v0.160.0, 2026-07-22) | full text: git show fddfe00ce268:documentation/backlog/ROADMAP.md |
| R-68 | Notification train: paired recovery mails + prefs seeding at claim + priority headers (power-outage audit F11+F12+F14-light). Shipped in 0.160.0, v0.71.0. | SHIPPED (hub v0.71.0, 2026-07-22) | full text: git show fddfe00ce268:documentation/backlog/ROADMAP.md |
| R-70 | [P2-HIGH] The offsite last mile is invisible on BOTH surfaces — the hub cannot tell "staged" from "delivered" from "applied". Shipped in v0.161.0, v0.72.0. | SHIPPED (hub v0.72.0 + controller v0.161.0, 2026-07-23) — detector offsite.DeliveryStateFor (one impl, all consumers), customer-card state line with age (static "delivered once" copy GONE), off | full text: git show fddfe00ce268:documentation/backlog/ROADMAP.md| | **R-71** | **[P1] Day-0 race: the managed floor-update kills the offsite apply-bridge between password-consume and persist — the one-shot credential is burned and the box lands in the silent consume-404 dead-end forever.** Shipped in 0.153.0, 0.156.0, v0.162.0. | **SHIPPED — (a)+(c); (b) rejected-by-design.** **(a) SHIPPED (controller v0.162.0, 2026-07-24): the apply-bridge settle-gate.**offsiteapply.SettleProvider.SettleState()+SettleFuncadapter over | full text:git show fddfe00ce268:documentation/backlog/ROADMAP.md | | **R-53** | **app_export.htmlsubstituted the CSRF token where the customer domain belongs** Shipped in v0.150.0. | **SHIPPED (controller v0.150.0, 2026-07-20)** | full text:git show fddfe00ce268:documentation/backlog/ROADMAP.md| | **R-102** | **Tier-2 writes a fullrecovery-unit/mirror on every run and no code path reads it.** | **MOVED 2026-08-22 -> OPEN-ITEMS.md** (was: READY — 2026-07-28) | full text:git show fddfe00ce268:documentation/backlog/ROADMAP.md| | **R-103** | **The Tier-2 no-coverage refusal names the working action but does not route to it.** Shipped in v0.183.0. | **MOVED 2026-08-22 -> OPEN-ITEMS.md** (was: READY — 2026-07-28) | full text:git show fddfe00ce268:documentation/backlog/ROADMAP.md| | **R-104** | **An interrupted offsite run leaves an exclusive restic lock the existing self-heal cannot reach.** | **MOVED 2026-08-22 -> OPEN-ITEMS.md** (was: READY — 2026-07-28) | full text:git show fddfe00ce268:documentation/backlog/ROADMAP.md| | **R-105** | **Three hub-held DR records are empty on the entire live fleet.** | **MOVED 2026-08-22 -> OPEN-ITEMS.md** (was: READY — 2026-07-28) | full text:git show fddfe00ce268:documentation/backlog/ROADMAP.md| | **R-106** | **~~The DR recipe records the PBS namespace as"root"on every box~~** Shipped in v0.118.1. | **SHIPPED** — agent v0.118.1, 2026-07-30 | full text:git show fddfe00ce268:documentation/backlog/ROADMAP.md| | **R-107** | **No offsite action unpacks the named-volume tars Tier-3 captures on every run.** | **MOVED 2026-08-22 -> OPEN-ITEMS.md** (was: READY — 2026-07-28) | full text:git show fddfe00ce268:documentation/backlog/ROADMAP.md| | **R-108** | **~~Network storage can host an app's namespace, and FileBrowser binds a network share at its ROOT — this BLOCK** Shipped in v0.187.0. | **SHIPPED** — controller v0.187.0, 2026-07-30 | full text:git show fddfe00ce268:documentation/backlog/ROADMAP.md| | **R-109** | **~~The DR recipe records no backup target~~** Shipped in v0.118.1, v0.83.0. | **SHIPPED** — agent v0.118.1 + hub v0.83.0, 2026-07-30 | full text:git show fddfe00ce268:documentation/backlog/ROADMAP.md| | **R-27** | **Customer-facing self-bind page (R-21 slice C follow-on).** Shipped in v0.62.0, v0.66.0. | **SHIPPED (slice 1, hub v0.66.0, 2026-07-17)** | full text:git show fddfe00ce268:documentation/backlog/ROADMAP.md| | **R-25** | **Device-node TOCTOU hardening (drive init).** Shipped in v0.141.0. | **MOVED 2026-08-22 -> OPEN-ITEMS.md** (was: idea) | full text:git show fddfe00ce268:documentation/backlog/ROADMAP.md| | **R-24** | **Guest RAM resize (live) — SHIPPED (agent v0.90.0 + controller v0.143.0, 2026-07-17).** Shipped in v0.143.0, v0.90.0. | **SHIPPED + PROVEN-LIVE** | full text:git show fddfe00ce268:documentation/backlog/ROADMAP.md| | **R-13** | **OOB management arc: dual-use existing WireGuard + hub desired-state channel as mutual-repair** Shipped in 10.77.0, v0.59.0, v0.89.0. | **first slice PROVEN-LIVE (poke channel)** | full text:git show fddfe00ce268:documentation/backlog/ROADMAP.md| | **R-28** | **Agent fast-tick-until-first-convergence — SHIPPED (agent v0.90.0, 2026-07-17).** Shipped in v0.90.0. | **SHIPPED** | full text:git show fddfe00ce268:documentation/backlog/ROADMAP.md| | **R-73** | **SMART history / trending (hub-side) — SUPERSEDED by the phased disk-health arc; see R-330 (Phase 2) and R-331 (Phase 3)** Shipped in v0.215.0. | **partly SHIPPED** | full text:git show fddfe00ce268:documentation/backlog/ROADMAP.md| | **R-75** | **Catalog-derived userdata skeleton + import surfaces** Shipped in v0.172.0. | **SHIPPED (controller v0.172.0 + catalog, 2026-07-26)** | full text:git show fddfe00ce268:documentation/backlog/ROADMAP.md| | **R-77** | **Endpoint-drift detection, samba protected-set gate, channel log honesty** Shipped in 169.254.253, v0.173.0, v0.74.0. | **SHIPPED (controller v0.173.0 + hub v0.74.0, 2026-07-26)** | full text:git show fddfe00ce268:documentation/backlog/ROADMAP.md | | **R-78** | **local_apiauthority ruling — auto-reconcile vs detect-only** | **MOVED 2026-08-22 -> OPEN-ITEMS.md** (was: idea (deferred OUT of R-77 on purpose)) | full text:git show fddfe00ce268:documentation/backlog/ROADMAP.md | | **R-79** | **report.Issues/report.Warningsare English on customer-facing surfaces** | **MOVED 2026-08-22 -> OPEN-ITEMS.md** (was: idea) | full text:git show fddfe00ce268:documentation/backlog/ROADMAP.md | | **R-80** | **expected_backup_missedfalse alarm — diagnosed + class-fixed** Shipped in v0.75.0. | **SHIPPED (hub v0.75.0, 2026-07-26)** | full text:git show fddfe00ce268:documentation/backlog/ROADMAP.md| | **R-81** | **"No signal" is not "bad signal" — anchor the backup deadline check** Shipped in v0.12.0, v0.73.0, v0.75.0. | **SHIPPED (hub v0.75.0, 2026-07-26)** | full text:git show fddfe00ce268:documentation/backlog/ROADMAP.md| | **R-82** | **The backup target split — local daily + offsite weekly** Shipped in 1.20.0, v0.100.0, v0.101.0. | **SHIPPED (agent v0.102.0 + controller v0.175.0 + hub v0.76.0 + host-install 1.20.0, 2026-07-26)** | full text:git show fddfe00ce268:documentation/backlog/ROADMAP.md| | **R-83** | **Ratify or retire07-backup-architecture.md** | **DISCHARGED (2026-07-26) — brought current, NOT ratified** | full text: git show fddfe00ce268:documentation/backlog/ROADMAP.md| | **R-84** | **The agent's cold backupStoreno longer causes a redundant backup** Shipped in v0.103.0. | **SHIPPED (agent v0.103.0, 2026-07-26)** | full text:git show fddfe00ce268:documentation/backlog/ROADMAP.md| | **R-85** | **The DR tier must be restore-tested UNATTENDED, and its failure must be HEARD** Shipped in v0.104.0, v0.77.0. | **Code SHIPPED (agent v0.104.0 + hub v0.77.0, 2026-07-27); rotation NOT YET OBSERVED LIVE** | full text:git show fddfe00ce268:documentation/backlog/ROADMAP.md| | **R-86** | **Backup-ALIGNED restore-test scheduling — test a tier ~1 day after ITS OWN backup** Shipped in v0.121.0, v0.91.0. | **CLOSED — SHIPPED + PROVEN-LIVE 2026-08-03 (agent v0.121.0 + hub v0.91.0)** | full text:git show fddfe00ce268:documentation/backlog/ROADMAP.md| | **R-88** | **An UNREACHABLE backup target reads as "no backup exists" → the agent fires a doomed backup at it** Shipped in 10.77.0, v0.176.0. | **Part 1 SHIPPED (controller v0.176.0, 2026-07-27); Part 2 OPEN (agent wire change)** — **Part 1** added the failure breaker: consecutive failures tracked per TARGET, backoff15m→30m→1h→2h→4hcapped | full text:git show fddfe00ce268:documentation/backlog/ROADMAP.md| | **R-89** | **Retention is a COMMERCIAL attribute — it belongs to the hub, not to ep0 or a box** | idea — operator ruling 2026-07-27, first increment SHIPPED same day | full text:git show fddfe00ce268:documentation/backlog/ROADMAP.md| | **R-97** | **The whole-guest backup tier has NO failure signal to the hub —internal/quiescenever notifies** Shipped in v0.164.0, v0.177.0, v0.78.0. | **SHIPPED (controller v0.177.0 + hub v0.78.0, 2026-07-27)** — **R-97a:**quiesce.TierNotifier, a seam (not an import) wired by an init-only setter, edge-triggered on the R-88 breaker ARMING so a fai | full text: git show fddfe00ce268:documentation/backlog/ROADMAP.md| | **R-94** | **~~A hand-synced version constant drifts, and the gate that would catch it is never run~~** Shipped in 9.9.9, v0.87.0. | **CLOSED — SHIPPED hub v0.87.0, 2026-08-02** | full text:git show fddfe00ce268:documentation/backlog/ROADMAP.md | | **R-110** | **mainis the installer's publish channel — there is no staging** Shipped in 1.22.0, v1.23.0. | **CLOSED — SHIPPED 2026-08-03** (installer v1.23.0)./scripts/syncsinstaller-v1.23.0; the website still tracks main. Proven by HTTP: a push to mainleft the served bytes byte-identical, movi | full text:git show fddfe00ce268:documentation/backlog/ROADMAP.md | | **R-128** | **ISO_VERSION"aligns with SCRIPT_VERSION" was a comment nothing evaluated** Shipped in v1.26.0. | **CLOSED — iso v1.26.0, 2026-07-31** | full text:git show fddfe00ce268:documentation/backlog/ROADMAP.md | | **R-154** | **[first-boot]is automated-install-only, and nothing in the tree said so** Shipped in v1.26.0. | **CLOSED — iso v1.26.0, 2026-07-31** | full text:git show fddfe00ce268:documentation/backlog/ROADMAP.md | | **R-155** | **iso-repack.shrefused any ISO withoutauto-installer-mode.toml** Shipped in v1.26.0. | **CLOSED — iso v1.26.0, 2026-07-31** | full text: git show fddfe00ce268:documentation/backlog/ROADMAP.md| | **R-156** | **An app's data is neither persisted nor backed up, and it reports healthy** | **CLOSED — all three apps fixed, 2026-08-03.** papra's template now mountspapra_data:/app/app-data(the app's own data ROOT, chosen over reconfiguring three env vars so a future upstream path canno | full text:git show fddfe00ce268:documentation/backlog/ROADMAP.md | | **R-157** | **bootrecon's start-ONCE sweep misses the boot orphan it exists to recover** Shipped in v0.189.0, v0.190.0. | **CLOSED — SHIPPED + PROVEN-LIVE (v0.189.0 + v0.190.0, 2026-08-02)** | full text: git show fddfe00ce268:documentation/backlog/ROADMAP.md| | **R-170** | **The drive-backed boot gate infers a Stop from a container count** Shipped in v0.190.0. | **CLOSED — SHIPPED + PROVEN-LIVE (v0.190.0, 2026-08-02)** | full text:git show fddfe00ce268:documentation/backlog/ROADMAP.md| | **R-171** | **The boot sweep started apps whose data drive was ABSENT** Shipped in v0.189.0, v0.190.0. | **CLOSED — SHIPPED + PROVEN-LIVE (v0.190.0, 2026-08-02)** | full text:git show fddfe00ce268:documentation/backlog/ROADMAP.md| | **R-166** | **App state gets a desired/observed model with its own store** Shipped in v0.189.0. | **SHIPPED + PROVEN-LIVE — controller v0.189.0, 2026-08-02** | full text:git show fddfe00ce268:documentation/backlog/ROADMAP.md| | **R-158** | **~~A local Tier-1 backup failure reaches no hub channel~~** Shipped in v0.191.0, v0.89.0. | **SHIPPED — controller v0.191.0 + hub v0.89.0, 2026-08-02** | full text:git show fddfe00ce268:documentation/backlog/ROADMAP.md| | **R-167** | **~~Storage monitoring and backup alerts (decision D-c)~~** Shipped in v0.191.0, v0.89.0. | **SHIPPED — controller v0.191.0/.1/.2 + hub v0.89.0, 2026-08-02** | full text:git show fddfe00ce268:documentation/backlog/ROADMAP.md| | **R-165** | **~~Mergemp1intomp0— the dedicated backup partition stops existing (decision D-a)~~** Shipped in v0.120.0, v0.192.0, v0.193.0. | **CLOSED — PROVEN-LIVE 2026-08-03.** Variant V-c shipped (golden v3.0.0 + agent v0.120.0 + controller v0.192.0); both demo boxes reinstalled and proven end to end (R-178). **Its stated replacement for | full text:git show fddfe00ce268:documentation/backlog/ROADMAP.md | | **R-159** | **wishlist's data landed in an ANONYMOUS volume — never backed up, orphaned by a redeploy** | **SHIPPED** (templates/wishlist/, 2026-08-02) — filed for the CLASS | full text: git show fddfe00ce268:documentation/backlog/ROADMAP.md | | **R-160** | **gramps-web persisted three paths and wrote to none of them** | **SHIPPED** (templates/gramps-web/, 2026-08-02) | full text: git show fddfe00ce268:documentation/backlog/ROADMAP.md| | **R-161** | **The volume-persistence gate is enforced by convention, not automatically** | **RULED + SHIPPED at reduced scope** (operator, 2026-08-02;app-catalog fd7747d) | full text: git show fddfe00ce268:documentation/backlog/ROADMAP.md | | **R-163** | **mp1is RETENTION, not staging — and it is sized as if it were neither** Shipped in v3.0.0. | **SUPERSEDED 2026-08-22 — the register records CLOSED by R-165 (golden v3.0.0, 2026-08-03): the ceiling this row describes no longer exists** (was:**WAITING-ON-OPERATOR** — the ratio is a tier-sizing | full text:git show fddfe00ce268:documentation/backlog/ROADMAP.md| | **R-90** | **ep0 has 3.8 GB and NO swap — it OOMs under a restore-test, and that gates R-86** | **CLOSED 2026-08-03 — the operator rescaled ep0 to a CX33.** MEASURED on the box, not read from an invoice:Mem: 7757MB (**8 GB**, was 3.8),nproc**4**, and the 4 GiB swapfile added 2026-07-27 * | full text:git show fddfe00ce268:documentation/backlog/ROADMAP.md| | **R-96** | **Two standing rules were agreed in chat and never committed** | **MOVED 2026-08-22 -> OPEN-ITEMS.md** (was: idea — found 2026-07-27) | full text:git show fddfe00ce268:documentation/backlog/ROADMAP.md| | **R-76** | **FileBrowser-created folders break the setgid chain, and a drop-zone's mode is not stable** Shipped in 1.3.3. | **MOVED 2026-08-22 -> OPEN-ITEMS.md** (was: idea (surfaced by the R-75 spike, 2026-07-26)) | full text:git show fddfe00ce268:documentation/backlog/ROADMAP.md| | **R-21** | **Bare-metal Felhom ISO** Shipped in 0.92.1, v0.62.0, v1.18.0. | **SHIPPED + PHYSICALLY CLOSED (slices A+B+C; rehearsal executed 2026-07-18)** | full text:git show fddfe00ce268:documentation/backlog/ROADMAP.md| | **R-168** | **~~CI: no runner exists, and with trunk-based pushes CI can DETECT but not BLOCK~~** | **CLOSED — SHIPPED 2026-08-02** | full text:git show fddfe00ce268:documentation/backlog/ROADMAP.md| | **R-37** | **Post-RESET health card shows stale pre-RESET warnings.** Shipped in v0.67.0. | **SHIPPED (hub v0.67.0, 2026-07-18)** | full text:git show fddfe00ce268:documentation/backlog/ROADMAP.md| | **R-38** | **Installer GRUB slice.** Shipped in v1.21.0, v1.22.0. | **SHIPPED (scripts v1.22.0, 2026-07-19)** | full text:git show fddfe00ce268:documentation/backlog/ROADMAP.md| | **R-40** | **[P2-HIGH] The update path cannot express a MULTI-HOP major upgrade.** | **MOVED 2026-08-22 -> OPEN-ITEMS.md** (was: idea) | full text:git show fddfe00ce268:documentation/backlog/ROADMAP.md| | **R-42** | **RULED: sidecar majors follow the APP, never the newest tag.** | **RULED 2026-07-21 — option (a)** | full text:git show fddfe00ce268:documentation/backlog/ROADMAP.md| | **R-43** | **[P2-HIGH] No offsite restore path can restore a database — offsite restore cannot reconstitute a DB-indexed app.** Shipped in v0.148.0. | **SHIPPED controller v0.148.0 (2026-07-19) — live acceptance PENDING** | full text:git show fddfe00ce268:documentation/backlog/ROADMAP.md| | **R-44** | **[P2-HIGH] A manual offsite push ships an unrefreshed DB dump — "backed up now" is false for the DB half.** Shipped in v0.148.0. | **SHIPPED controller v0.148.0 (2026-07-19)** | full text:git show fddfe00ce268:documentation/backlog/ROADMAP.md| | **R-47** | **[P2-HIGH] The DB replay races the application's own schema repair.** Shipped in 0.153.0, 0.90.0, v0.153.0. | **SHIPPED — controller v0.153.0, 2026-07-20** | full text:git show fddfe00ce268:documentation/backlog/ROADMAP.md| | **R-49** | **[P2] The offsite capture set is ~90% cache and duplication — 1.1 GB of a 1.2 GB immich "photo backup".** | **MOVED 2026-08-22 -> OPEN-ITEMS.md** (was: idea) | full text:git show fddfe00ce268:documentation/backlog/ROADMAP.md` |
2026-10-03 — the triage: shipped, killed, closed and moved items out of ROADMAP.md
| ID | Item | Final state | Full text |
|---|---|---|---|
| R-116 | The drive-absent alarm and its recovery are a mismatched pair — generic on the way out, specific on the way back | CLOSED — the register row is closed (CLOSED-ITEMS.md) |
full text: git show 9f77865:documentation/backlog/ROADMAP.md |
| R-113 | The drive-absent gate cannot fire on device loss — E-2b's alarm is wired to an unreachable condition | CLOSED — the register row is closed (CLOSED-ITEMS.md) |
full text: git show 9f77865:documentation/backlog/ROADMAP.md |
| R-112 | E-2's degraded banner and offer have no UI consumer — correct endpoint, invisible to the customer | CLOSED — the register row is closed (CLOSED-ITEMS.md) |
full text: git show 9f77865:documentation/backlog/ROADMAP.md |
| R-114 | On target-drive loss the customer is told the wrong story and offered the drive that vanished | CLOSED — the register row is closed (CLOSED-ITEMS.md) |
full text: git show 9f77865:documentation/backlog/ROADMAP.md |
| R-7b | Share backup EXECUTION | SHIPPED (controller v0.145.0, 2026-07-18) | full text: git show 9f77865:documentation/backlog/ROADMAP.md |
| R-202 | The orphan card promises recoverability unconditionally | CLOSED 2026-10-03 — register row verified finished and moved (CLOSED-ITEMS.md) |
full text: git show 9f77865:documentation/backlog/ROADMAP.md |
| R-201 | The wipe-and-recover drill | CLOSED — both halves passed 2026-08-04/07 (CLOSED-ITEMS.md) |
full text: git show 9f77865:documentation/backlog/ROADMAP.md |
| D5 | Move app secrets into the LOCAL recovery unit | SHIPPED + PROVEN-LIVE — controller v0.188.0, 2026-07-30 | full text: git show 9f77865:documentation/backlog/ROADMAP.md |
| E-2 | Drive-role machinery around the moved vzdump target. | CLOSED — PARTIALLY PROVEN (Session C, 2026-07-29; CLOSED-ITEMS.md, the id-less rows) |
full text: git show 9f77865:documentation/backlog/ROADMAP.md |
| G-1 | Gate C5 — the cross-repo tag-reachability check. | BUILT AND CLOSED 2026-08-08 — scripts/wire_contract_gate.py, --fast, registered in repo_gates.py |
full text: git show 9f77865:documentation/backlog/ROADMAP.md |
| G-6 | C2 — NOT mechanically gateable. | KILLED — recorded as a no: "names a route" is a judgement, not a predicate | full text: git show 9f77865:documentation/backlog/ROADMAP.md |
| G-7 | C6 — NOT gateable, and the measurement is the finding. | KILLED — recorded as a no, with evidence: deadcode re-found neither known instance |
full text: git show 9f77865:documentation/backlog/ROADMAP.md |
| R-25b | RULED: customer DELETE becomes a guided full-teardown cascade. | SHIPPED hub v0.69.0 (2026-07-21) | full text: git show 9f77865:documentation/backlog/ROADMAP.md |
| R-87 | The restic (app-data offsite) tier is NEVER restore-tested | SHIPPED 2026-08-31 — controller v0.231.0, RE-SCOPED by its own spike. Not built as written: the spike measured that an unattended scratch restore would have caught ONE of five drill-found restore defects, so it proves the snapshot CONTAINS a recoverable … | full text: git show 9f77865:documentation/backlog/ROADMAP.md |
| R-48 | [P2-HIGH] Restore controls are separable only by layout — and the difference between them is whether the data comes back. | SHIPPED — controller v0.154.0 (2026-07-21): the offsite restore wizard, one entry per app (controller/internal/web/restore_wizard.go:12); verified 2026-10-03 |
full text: git show 9f77865:documentation/backlog/ROADMAP.md |
| R-29 | The design-v2 green gates are not enforced anywhere — one has been RED for 16 releases. | CLOSED — the register row is closed (CLOSED-ITEMS.md) |
full text: git show 9f77865:documentation/backlog/ROADMAP.md |
| R-127 | data_key: true is unreliable (4+ encryption keys unflagged, contradicting the catalog's own labels), and O4 can regenerate a DB password that no longer matches the restored data directory |
MOVED → OPEN-ITEMS.md — a FINDING; its register row is the record (moved out of this file 2026-10-03; status here was: READY — NEW 2026-07-30) |
full text: git show 9f77865:documentation/backlog/ROADMAP.md |
| R-133 | The vaulted break-glass console credential is PLAINTEXT AT REST, so every hub DB backup is a fleet-wide console-credential dump. | MOVED → OPEN-ITEMS.md — a FINDING; its register row is the record (moved out of this file 2026-10-03; status here was: READY — NEW 2026-07-31) |
full text: git show 9f77865:documentation/backlog/ROADMAP.md |
| R-126 | A .fab bundle — plaintext secrets, optional password — can be exported ONTO a NAS. |
MOVED → OPEN-ITEMS.md — a FINDING; its register row is the record (moved out of this file 2026-10-03; status here was: READY — 2026-07-30) |
full text: git show 9f77865:documentation/backlog/ROADMAP.md |
| R-95 | The restic offsite tier's credential CAN DELETE — R-89's "parallel question", now ANSWERED | MOVED → OPEN-ITEMS.md — a FINDING; its register row is the record (moved out of this file 2026-10-03; status here was: idea — established read-only 2026-07-27) |
full text: git show 9f77865:documentation/backlog/ROADMAP.md |
| R-162 | docker diff is the gate's only witness and its failure mode is quiet |
MOVED → OPEN-ITEMS.md — a FINDING; its register row is the record (moved out of this file 2026-10-03; status here was: WATCHING — 2026-08-02) |
full text: git show 9f77865:documentation/backlog/ROADMAP.md |
| R-164 | C2's chain — the DB volume tar cannot be dropped until a sound dump predicate exists | MOVED → OPEN-ITEMS.md — a FINDING; its register row is the record (moved out of this file 2026-10-03; status here was: BLOCKED — on the predicate (2026-08-02)) |
full text: git show 9f77865:documentation/backlog/ROADMAP.md |
| R-91 | The old 13 GB datastore copy is still on ep0's root disk | MOVED → OPEN-ITEMS.md — a FINDING; its register row is the record (moved out of this file 2026-10-03; status here was: WATCHING — gated on demo-felhom's first post-migration PBS backup) |
full text: git show 9f77865:documentation/backlog/ROADMAP.md |
| R-92 | The hub's PBS-DR gauge is 0.1 GB-granular, so small deltas are unverifiable | MOVED → OPEN-ITEMS.md — a FINDING; its register row is the record (moved out of this file 2026-10-03; status here was: idea — 2026-07-27) |
full text: git show 9f77865:documentation/backlog/ROADMAP.md |
| R-93 | drill-r50 is both a blocked customer and the only drift fixture |
MOVED → OPEN-ITEMS.md — a FINDING; its register row is the record (moved out of this file 2026-10-03; status here was: idea — 2026-07-27) |
full text: git show 9f77865:documentation/backlog/ROADMAP.md |
| R-169 | CI can only report, because there is no gate in the road | MOVED → OPEN-ITEMS.md — a FINDING; its register row is the record (moved out of this file 2026-10-03; status here was: idea — minted 2026-08-02, WAITING-ON-OPERATOR) |
full text: git show 9f77865:documentation/backlog/ROADMAP.md |
| UPDATE-ARC | The app-update arc — seven slices, from "nobody knows what any box runs" to "an update is a decision the box can take safely." | COLLAPSED 2026-10-03 — parts 1–10 shipped, part 11 deferred by ruling; the open rows are listed in ROADMAP.md §UPDATE-ARC. Status at collapse: slices 1, 1b, 2, 3 & 5 SHIPPED (controller v0.233.0 / v0.234.0 / v0.235.0; harness app-catalog/scripts/upgrade-test.py); slices 4, 6, 7 open 2026-09-13 — SLICE 4 COLLAPSED: SHIPPED (controller v0.237.0/v0.238.0/v0.238.1, R-448 CLOSED, proven live — … |
full text: git show 9f77865:documentation/backlog/ROADMAP.md |
| pre-invite: golden 0.146.0 rebuild | golden 0.146.0 rebuild | DONE — baked + published 2026-07-18 | full text: git show 9f77865:documentation/backlog/ROADMAP.md |
| pre-invite: golden ≥0.147.x carries all four infra images | golden ≥0.147.x carries all four infra images | DONE — build-golden.sh v2.1.0 derives the pre-pull list (2026-07-19) |
full text: git show 9f77865:documentation/backlog/ROADMAP.md |
| pre-invite: freemail.hu test-send (R-4) | freemail.hu test-send (R-4) | DONE — R-4 closed 2026-07-21 (all three halves) | full text: git show 9f77865:documentation/backlog/ROADMAP.md |
| pre-invite: C6 — a customer performs a restore unassisted | C6 — a customer performs a restore unassisted | SUPERSEDED — the unaided recovery journey was proven 2026-08-07 (00 §A); the capability row "a customer performs a restore via UI alone" stays as R-3's target |
full text: git show 9f77865:documentation/backlog/ROADMAP.md |
| pre-invite: R-11 rulings (contact channel, tester agreement, alert thresholds) | R-11 rulings (contact channel, tester agreement, alert thresholds) | PARTLY RULED — the contact channel ruled 2026-07-21; the tester agreement → R-809 (2026-10-03) | full text: git show 9f77865:documentation/backlog/ROADMAP.md |
| stray text | Two paragraphs that sat between ROADMAP rows (a boot-gate log excerpt about immich after the R-50b row; three paragraphs on a quiesce-cycle amplifier after the R-87 row) | KEPT IN HISTORY — their rows are history; nothing open depends on them | full text: git show 9f77865:documentation/backlog/ROADMAP.md |
| R-50b | A root-owned privileged host artifact is delivered unversioned from main |
MOVED → OPEN-ITEMS.md (Box system & updates, P3) — a FINDING, found when one_register_gate.py stopped skipping suffix ids (2026-10-03) |
full text: git show 9f77865:documentation/backlog/ROADMAP.md |