admin
33bbf8e94a
gates / gates (push) Successful in 31s
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
156 lines
38 KiB
Markdown
156 lines
38 KiB
Markdown
# ROADMAP-HISTORY — finished and superseded roadmap items, compressed
|
||
|
||
> Companion to `ROADMAP.md`, created 2026-08-22 under the same operator ruling that produced
|
||
> `CLOSED-ITEMS.md`. Each entry keeps its identifier, title, shipped version and final state, and
|
||
> names the commit holding its full original text. **Nothing was deleted.**
|
||
>
|
||
> `ROADMAP.md` now carries only live intentions and the reasoning behind them, which is what its
|
||
> own first paragraph has always said it is for.
|
||
|
||
---
|
||
|
||
| **R-115** | **Publishing is a remembered step — forgotten within eight hours of being documented as forgettable** Shipped in 0.113.0, 0.114.0, v0.113.0. | **CLOSED — SHIPPED 2026-08-03** (`release-agent.sh` + `check-published-versions.py`, no version bump). Releasing now builds, tags, publishes and **verifies by an independent download** in one act; a ` | full text: `git show fddfe00ce268:documentation/backlog/ROADMAP.md` |
|
||
| **R-111** | **The Day-0 artifact channel is 17 agent releases stale — a box installed today gets agent `0.96.0`, not `0.113.0`** Shipped in 0.110.0, 0.113.0, 0.161.0. | **SHIPPED 2026-07-29** — agent 0.113.0 published (sha `5f3247f7…`, round-trip verified) + golden **0.185.1** baked and published (sha `dba00f3e…`, embeds controller 0.185.1); hub Day-0 manifest moved | full text: `git show fddfe00ce268:documentation/backlog/ROADMAP.md` |
|
||
| **R-1** | **Peti convergence** Shipped in v0.57.0. | **rehearsal DONE; Peti half open** | full text: `git show fddfe00ce268:documentation/backlog/ROADMAP.md` |
|
||
| **R-2** | **~~Resolve ~215 lines of foreign WIP in felhom.eu clone (`hub/internal/notify/`, `store.go`, `hub/internal/cla** Shipped in v0.50.0, v0.54.0, v0.55.0. | **killed** (2026-07-16) | full text: `git show fddfe00ce268:documentation/backlog/ROADMAP.md` |
|
||
| **R-4** | **Claim-code deliverability: test-send to gmail.com / freemail.hu; tighten DMARC `p=none` → `p=quarantine`** Shipped in 1.1.1, 8.8.8. | **DONE 2026-07-21 (all three halves)** | full text: `git show fddfe00ce268:documentation/backlog/ROADMAP.md` |
|
||
| **R-39** | **[P2-HIGH] The PBS DR tier can be `applied` and dead at the same time — and nothing notices.** Shipped in 0.68.1, 0.90.0, 0.90.1. | **CLOSED 2026-07-21 — PROVEN LIVE (hub 0.68.1 + agent 0.91.2)** | full text: `git show fddfe00ce268:documentation/backlog/ROADMAP.md` |
|
||
| **R-30** | **[P2-HIGH] Liveness presence should come from the wait channel, not the report clock.** | **MOVED 2026-08-22 -> OPEN-ITEMS.md** (was: idea) | full text: `git show fddfe00ce268:documentation/backlog/ROADMAP.md` |
|
||
| **R-31** | **[P2-HIGH] Offsite provisioning is synchronous with no status affordance.** Shipped in v0.138.0. | **MOVED 2026-08-22 -> OPEN-ITEMS.md** (was: idea) | full text: `git show fddfe00ce268:documentation/backlog/ROADMAP.md` |
|
||
| **R-32** | **[P2-HIGH] RESET must purge the customer base dir; the orphan card must stay honest; unattributed bytes must be visible.** | **MOVED 2026-08-22 -> OPEN-ITEMS.md** (was: idea) | full text: `git show fddfe00ce268:documentation/backlog/ROADMAP.md` |
|
||
| **R-33** | **[P2-HIGH] Bootstrap pairing-poll spams the customer-visible console.** Shipped in v1.21.0. | **SHIPPED (scripts v1.21.0, 2026-07-18)** | full text: `git show fddfe00ce268:documentation/backlog/ROADMAP.md` |
|
||
| **R-5** | **Hub: offsite storage visibility — RESTIC box aggregate (v0.64.0) + PBS DR datastore (v0.65.0), each with fill** Shipped in v0.64.0, v0.65.0, v1.2.0. | **SHIPPED (hub v0.64.0 + v0.65.0 + tenantsync v1.2.0, 2026-07-17)** | full text: `git show fddfe00ce268:documentation/backlog/ROADMAP.md` |
|
||
| **R-7** | **server** Shipped in 1.0.0, v0.144.0. | **SHIPPED slice 1 (controller v0.144.0 + `felhom-samba:1.0.0`, 2026-07-18)** | full text: `git show fddfe00ce268:documentation/backlog/ROADMAP.md` |
|
||
| **R-10** | **T-6E-1: DB-dump dir-fsync asymmetry (LOW, confirmed in 6E)** | **MOVED 2026-08-22 -> OPEN-ITEMS.md** (was: idea) | full text: `git show fddfe00ce268:documentation/backlog/ROADMAP.md` |
|
||
| **R-11** | **Tester-facing one-pager: what the box does, known limitations, how to report** | **RULED 2026-07-21 (channel); doc is the architect's** | full text: `git show fddfe00ce268:documentation/backlog/ROADMAP.md` |
|
||
| **R-16** | **Operator hygiene: campaign6 autofs orphan (clears on host reboot) + tied-CreatedAt flash duplicates (audioboo** Shipped in v1.17.0. | open (doc-drift bit CLOSED) | full text: `git show fddfe00ce268:documentation/backlog/ROADMAP.md` |
|
||
| **R-22** | **PBS-DR pre-check self-grant (F4).** Shipped in v0.89.0. | **SHIPPED + PROVEN-LIVE agent v0.89.0** (2026-07-17) | full text: `git show fddfe00ce268:documentation/backlog/ROADMAP.md` |
|
||
| **R-17** | **Old-box archive (u629193-sub1) retirement — 9/9 byte-identical restores verified** | **CLOSED 2026-07-22 — archive deleted (operator console)** | full text: `git show fddfe00ce268:documentation/backlog/ROADMAP.md` |
|
||
| **R-198** | **The superseded-escrow retention kept the K-escrow and dropped the identity blob** Shipped in v0.60.0, v0.93.0. | **SHIPPED (hub v0.93.0, 2026-08-04)** | full text: `git show fddfe00ce268:documentation/backlog/ROADMAP.md` |
|
||
| **R-197** | **The hub stored both halves of "did this box's offsite data key change" and compared them nowhere** Shipped in v0.93.0. | **SHIPPED (hub v0.93.0, 2026-08-04)** | full text: `git show fddfe00ce268:documentation/backlog/ROADMAP.md` |
|
||
| **R-196** | **Five comments claimed `ReissueCredentials` rotates the restic repo password** Shipped in v0.93.0, v0.95.0. | **CLOSED — behaviour shipped hub v0.95.0 (2026-08-05)** | full text: `git show fddfe00ce268:documentation/backlog/ROADMAP.md` |
|
||
| **R-199** | **The hub served recovery blobs on endpoints with no client anywhere** Shipped in v0.125.0, v0.94.0. | **SHIPPED + PROVEN-LIVE (hub v0.94.0 + agent v0.125.0, 2026-08-04)** | full text: `git show fddfe00ce268:documentation/backlog/ROADMAP.md` |
|
||
| **R-200** | **The password-injection seam had a handler and no form** Shipped in v0.195.0. | **plumbing SHIPPED (controller v0.195.0); the form is NOT built** | full text: `git show fddfe00ce268:documentation/backlog/ROADMAP.md` |
|
||
| **R-203** | **A mandatory customer data directory was silently absent from the off-site snapshot while the run reported `ok`** Shipped in v0.197.0. | **SUPERSEDED 2026-08-22 — the register records SHIPPED + PROVEN-LIVE (controller v0.197.0, 2026-08-04); this row was never updated when it shipped** (was:**OPEN — halted the R-201 drill 2026-08-04**) | full text: `git show fddfe00ce268:documentation/backlog/ROADMAP.md` |
|
||
| **R-203** | **The app and its backup looked in different directories, and a run that skipped a mandatory folder still said `ok`** Shipped in v0.197.0. | **SHIPPED + PROVEN-LIVE (controller v0.197.0, 2026-08-04)** | full text: `git show fddfe00ce268:documentation/backlog/ROADMAP.md` |
|
||
| **R-204** | **The recovered key cannot be used: the Re-issue that reconfigures a rebuilt box's off-site tier marks the escrow stale, which gates every run, and the only way to clear it destroys the key** Shipped in v0.199.0, v0.96.0. | **ALL FOUR ITEMS SHIPPED (controller v0.199.0 + hub v0.96.0, 2026-08-05)** | full text: `git show fddfe00ce268:documentation/backlog/ROADMAP.md` |
|
||
| **R-193** | **A rebuilt box's off-site history was unreachable, and later reachable only from a command line** Shipped in v0.199.0, v0.200.0, v0.96.0. | **CLOSED (2026-08-05)** — credential half controller v0.199.0 + hub v0.96.0; the customer-facing SCREEN controller v0.200.0 | full text: `git show fddfe00ce268:documentation/backlog/ROADMAP.md` |
|
||
| **R-201** | **The wipe-and-recover drill** | **PASSED + PROVEN-LIVE (2026-08-04 night)** | full text: `git show fddfe00ce268:documentation/backlog/ROADMAP.md` |
|
||
| **R-20** | **~~Verify operator-key pinning is fully in the day-0 install flow~~** | **closed** (2026-07-16) | full text: `git show fddfe00ce268:documentation/backlog/ROADMAP.md` |
|
||
| **R-23** | **Immediate-sync Direction-2 follow-ups** Shipped in 0.153.0, 0.154.0, 0.155.0. | **(a) BANKED in full; only (b) cosmetic remains** | full text: `git show fddfe00ce268:documentation/backlog/ROADMAP.md` |
|
||
| **R-35** | **Config-apply should not end the customer's session.** | **MOVED 2026-08-22 -> OPEN-ITEMS.md** (was: idea) | full text: `git show fddfe00ce268:documentation/backlog/ROADMAP.md` |
|
||
| **R-36** | **Post-RESET re-enroll leaves offsite "enabled but unprovisioned" — silently.** Shipped in v0.67.0. | **SHIPPED (hub v0.67.0, 2026-07-18)** | full text: `git show fddfe00ce268:documentation/backlog/ROADMAP.md` |
|
||
| **R-50** | **[P2-HIGH] Island-bridge control plane — make controller↔agent independent of the LAN.** Shipped in 0.96.0, 169.254.253, 192.168.0. | **SHIPPED 2026-07-25 — fleet-migrated (agent v0.96.0 + host-install v1.19.0)** | full text: `git show fddfe00ce268:documentation/backlog/ROADMAP.md` |
|
||
| **R-51** | **Dead-primary alerting — a multi-container app whose MAIN container is dead must alert.** Shipped in v0.156.0. | **SHIPPED 2026-07-21 — controller v0.156.0** | full text: `git show fddfe00ce268:documentation/backlog/ROADMAP.md` |
|
||
| **R-52** | **Boot desired-state reconciliation — a `deployed: true` app should be running after boot.** Shipped in v0.156.0. | **SHIPPED 2026-07-21 — controller v0.156.0** | full text: `git show fddfe00ce268:documentation/backlog/ROADMAP.md` |
|
||
| **R-54** | **[P2-HIGH] The guest's DHCP client is unsupervised — its death takes the box off the internet 1-2 hours later, invisibly.** Shipped in 0.92.0, 0.92.1, 192.168.0. | **SHIPPED 2026-07-21 — agent v0.92.1** | full text: `git show fddfe00ce268:documentation/backlog/ROADMAP.md` |
|
||
| **R-55** | **[P2] A customer's deliberate Stop does NOT survive a guest reboot for any drive-backed app** Shipped in v0.157.0. | **SHIPPED 2026-07-21 — controller v0.157.0** | full text: `git show fddfe00ce268:documentation/backlog/ROADMAP.md` |
|
||
| **R-57** | **An app can be withdrawn from the catalog without orphaning the customers already running it** Shipped in v0.158.0, v0.158.1. | **SHIPPED 2026-07-21 — controller v0.158.0 (+ v0.158.1 fix), LIVE-PROVEN** | full text: `git show fddfe00ce268:documentation/backlog/ROADMAP.md` |
|
||
| **R-59** | **[P1] A no-DHCP install must HARD-ABORT — instead it bakes the installer's fallback address as a STATIC config and completes, producing a box that can never call home.** Shipped in 192.168.100, v1.24.0. | **SHIPPED v1.24.0 (2026-07-22) — as a FIRST-BOOT refuse-loudly gate, with a RECORDED DEVIATION: the install-time abort is out of scope (the 192.168.100.2 fallback is baked inside the Proxmox auto-inst | full text: `git show fddfe00ce268:documentation/backlog/ROADMAP.md` |
|
||
| **R-60** | **[P2] First-boot NIC sweep self-heal: if the hub is unreachable, try DHCP across every carrier-bearing NIC before settling.** Shipped in v1.24.0. | **SHIPPED v1.24.0 (2026-07-22) — spike + nested drill proven (SPIKE-firstboot-nic-sweep-2026-07-22.md): cable move → sweep → heal + hub registration unaided in <1 min; sweep is structurally first-boot | full text: `git show fddfe00ce268:documentation/backlog/ROADMAP.md` |
|
||
| **R-61** | **[P1] The baked root password must be knowable by the operator — the recurring console lockout.** Shipped in v1.24.0. | **slice 1 SHIPPED v1.24.0 (2026-07-22): the build emits the plaintext into a 0600 sibling `<iso>.rootpw.txt` (single record of truth — never logged/manifested/committed); drill-verified against the in | full text: `git show fddfe00ce268:documentation/backlog/ROADMAP.md` |
|
||
| **R-63** | **The install console learns ő/ű** Shipped in 0.153.0, 0.156.0, 0.161.0. | **SHIPPED (scripts v1.25.0, 2026-07-23)** | full text: `git show fddfe00ce268:documentation/backlog/ROADMAP.md` |
|
||
| **R-66** | **The box's own address becomes visible — „Hálózat" card, Debug network dump, NetBIOS hint.** Shipped in v0.159.0. | **SHIPPED (controller v0.159.0, 2026-07-22)** | full text: `git show fddfe00ce268:documentation/backlog/ROADMAP.md` |
|
||
| **R-67** | **The NAS share appears in FileBrowser — browse what you mounted.** Shipped in v0.160.0. | **SHIPPED (controller v0.160.0, 2026-07-22)** | full text: `git show fddfe00ce268:documentation/backlog/ROADMAP.md` |
|
||
| **R-68** | **Notification train: paired recovery mails + prefs seeding at claim + priority headers (power-outage audit F11+F12+F14-light).** Shipped in 0.160.0, v0.71.0. | **SHIPPED (hub v0.71.0, 2026-07-22)** | full text: `git show fddfe00ce268:documentation/backlog/ROADMAP.md` |
|
||
| **R-70** | **[P2-HIGH] The offsite last mile is invisible on BOTH surfaces — the hub cannot tell "staged" from "delivered" from "applied".** Shipped in v0.161.0, v0.72.0. | **SHIPPED (hub v0.72.0 + controller v0.161.0, 2026-07-23)** — detector `offsite.DeliveryStateFor` (one impl, all consumers), customer-card state line with age (static "delivered once" copy GONE), `off | full text: `git show fddfe00ce268:documentation/backlog/ROADMAP.md` |
|
||
| **R-71** | **[P1] Day-0 race: the managed floor-update kills the offsite apply-bridge between password-consume and persist — the one-shot credential is burned and the box lands in the silent consume-404 dead-end forever.** Shipped in 0.153.0, 0.156.0, v0.162.0. | **SHIPPED — (a)+(c); (b) rejected-by-design.** **(a) SHIPPED (controller v0.162.0, 2026-07-24): the apply-bridge settle-gate.** `offsiteapply.SettleProvider.SettleState()` + `SettleFunc` adapter over | full text: `git show fddfe00ce268:documentation/backlog/ROADMAP.md` |
|
||
| **R-53** | **`app_export.html` substituted the CSRF token where the customer domain belongs** Shipped in v0.150.0. | **SHIPPED (controller v0.150.0, 2026-07-20)** | full text: `git show fddfe00ce268:documentation/backlog/ROADMAP.md` |
|
||
| **R-102** | **Tier-2 writes a full `recovery-unit/` mirror on every run and no code path reads it.** | **MOVED 2026-08-22 -> OPEN-ITEMS.md** (was: READY — 2026-07-28) | full text: `git show fddfe00ce268:documentation/backlog/ROADMAP.md` |
|
||
| **R-103** | **The Tier-2 no-coverage refusal names the working action but does not route to it.** Shipped in v0.183.0. | **MOVED 2026-08-22 -> OPEN-ITEMS.md** (was: READY — 2026-07-28) | full text: `git show fddfe00ce268:documentation/backlog/ROADMAP.md` |
|
||
| **R-104** | **An interrupted offsite run leaves an exclusive restic lock the existing self-heal cannot reach.** | **MOVED 2026-08-22 -> OPEN-ITEMS.md** (was: READY — 2026-07-28) | full text: `git show fddfe00ce268:documentation/backlog/ROADMAP.md` |
|
||
| **R-105** | **Three hub-held DR records are empty on the entire live fleet.** | **MOVED 2026-08-22 -> OPEN-ITEMS.md** (was: READY — 2026-07-28) | full text: `git show fddfe00ce268:documentation/backlog/ROADMAP.md` |
|
||
| **R-106** | **~~The DR recipe records the PBS namespace as `"root"` on every box~~** Shipped in v0.118.1. | **SHIPPED** — agent v0.118.1, 2026-07-30 | full text: `git show fddfe00ce268:documentation/backlog/ROADMAP.md` |
|
||
| **R-107** | **No offsite action unpacks the named-volume tars Tier-3 captures on every run.** | **MOVED 2026-08-22 -> OPEN-ITEMS.md** (was: READY — 2026-07-28) | full text: `git show fddfe00ce268:documentation/backlog/ROADMAP.md` |
|
||
| **R-108** | **~~Network storage can host an app's namespace, and FileBrowser binds a network share at its ROOT — this BLOCK** Shipped in v0.187.0. | **SHIPPED** — controller v0.187.0, 2026-07-30 | full text: `git show fddfe00ce268:documentation/backlog/ROADMAP.md` |
|
||
| **R-109** | **~~The DR recipe records no backup target~~** Shipped in v0.118.1, v0.83.0. | **SHIPPED** — agent v0.118.1 + hub v0.83.0, 2026-07-30 | full text: `git show fddfe00ce268:documentation/backlog/ROADMAP.md` |
|
||
| **R-27** | **Customer-facing self-bind page (R-21 slice C follow-on).** Shipped in v0.62.0, v0.66.0. | **SHIPPED (slice 1, hub v0.66.0, 2026-07-17)** | full text: `git show fddfe00ce268:documentation/backlog/ROADMAP.md` |
|
||
| **R-25** | **Device-node TOCTOU hardening (drive init).** Shipped in v0.141.0. | **MOVED 2026-08-22 -> OPEN-ITEMS.md** (was: idea) | full text: `git show fddfe00ce268:documentation/backlog/ROADMAP.md` |
|
||
| **R-24** | **Guest RAM resize (live) — SHIPPED (agent v0.90.0 + controller v0.143.0, 2026-07-17).** Shipped in v0.143.0, v0.90.0. | **SHIPPED + PROVEN-LIVE** | full text: `git show fddfe00ce268:documentation/backlog/ROADMAP.md` |
|
||
| **R-13** | **OOB management arc: dual-use existing WireGuard + hub desired-state channel as mutual-repair** Shipped in 10.77.0, v0.59.0, v0.89.0. | **first slice PROVEN-LIVE (poke channel)** | full text: `git show fddfe00ce268:documentation/backlog/ROADMAP.md` |
|
||
| **R-28** | **Agent fast-tick-until-first-convergence — SHIPPED (agent v0.90.0, 2026-07-17).** Shipped in v0.90.0. | **SHIPPED** | full text: `git show fddfe00ce268:documentation/backlog/ROADMAP.md` |
|
||
| **R-73** | **SMART history / trending (hub-side) — SUPERSEDED by the phased disk-health arc; see R-330 (Phase 2) and R-331 (Phase 3)** Shipped in v0.215.0. | **partly SHIPPED** | full text: `git show fddfe00ce268:documentation/backlog/ROADMAP.md` |
|
||
| **R-75** | **Catalog-derived userdata skeleton + import surfaces** Shipped in v0.172.0. | **SHIPPED (controller v0.172.0 + catalog, 2026-07-26)** | full text: `git show fddfe00ce268:documentation/backlog/ROADMAP.md` |
|
||
| **R-77** | **Endpoint-drift detection, samba protected-set gate, channel log honesty** Shipped in 169.254.253, v0.173.0, v0.74.0. | **SHIPPED (controller v0.173.0 + hub v0.74.0, 2026-07-26)** | full text: `git show fddfe00ce268:documentation/backlog/ROADMAP.md` |
|
||
| **R-78** | **`local_api` authority ruling — auto-reconcile vs detect-only** | **MOVED 2026-08-22 -> OPEN-ITEMS.md** (was: idea (deferred OUT of R-77 on purpose)) | full text: `git show fddfe00ce268:documentation/backlog/ROADMAP.md` |
|
||
| **R-79** | **`report.Issues` / `report.Warnings` are English on customer-facing surfaces** | **MOVED 2026-08-22 -> OPEN-ITEMS.md** (was: idea) | full text: `git show fddfe00ce268:documentation/backlog/ROADMAP.md` |
|
||
| **R-80** | **`expected_backup_missed` false alarm — diagnosed + class-fixed** Shipped in v0.75.0. | **SHIPPED (hub v0.75.0, 2026-07-26)** | full text: `git show fddfe00ce268:documentation/backlog/ROADMAP.md` |
|
||
| **R-81** | **"No signal" is not "bad signal" — anchor the backup deadline check** Shipped in v0.12.0, v0.73.0, v0.75.0. | **SHIPPED (hub v0.75.0, 2026-07-26)** | full text: `git show fddfe00ce268:documentation/backlog/ROADMAP.md` |
|
||
| **R-82** | **The backup target split — local daily + offsite weekly** Shipped in 1.20.0, v0.100.0, v0.101.0. | **SHIPPED (agent v0.102.0 + controller v0.175.0 + hub v0.76.0 + host-install 1.20.0, 2026-07-26)** | full text: `git show fddfe00ce268:documentation/backlog/ROADMAP.md` |
|
||
| **R-83** | **Ratify or retire `07-backup-architecture.md`** | **DISCHARGED (2026-07-26) — brought current, NOT ratified** | full text: `git show fddfe00ce268:documentation/backlog/ROADMAP.md` |
|
||
| **R-84** | **The agent's cold backup `Store` no longer causes a redundant backup** Shipped in v0.103.0. | **SHIPPED (agent v0.103.0, 2026-07-26)** | full text: `git show fddfe00ce268:documentation/backlog/ROADMAP.md` |
|
||
| **R-85** | **The DR tier must be restore-tested UNATTENDED, and its failure must be HEARD** Shipped in v0.104.0, v0.77.0. | **Code SHIPPED (agent v0.104.0 + hub v0.77.0, 2026-07-27); rotation NOT YET OBSERVED LIVE** | full text: `git show fddfe00ce268:documentation/backlog/ROADMAP.md` |
|
||
| **R-86** | **Backup-ALIGNED restore-test scheduling — test a tier ~1 day after ITS OWN backup** Shipped in v0.121.0, v0.91.0. | **CLOSED — SHIPPED + PROVEN-LIVE 2026-08-03 (agent v0.121.0 + hub v0.91.0)** | full text: `git show fddfe00ce268:documentation/backlog/ROADMAP.md` |
|
||
| **R-88** | **An UNREACHABLE backup target reads as "no backup exists" → the agent fires a doomed backup at it** Shipped in 10.77.0, v0.176.0. | **Part 1 SHIPPED (controller v0.176.0, 2026-07-27); Part 2 OPEN (agent wire change)** — **Part 1** added the failure breaker: consecutive failures tracked per TARGET, backoff `15m→30m→1h→2h→4h` capped | full text: `git show fddfe00ce268:documentation/backlog/ROADMAP.md` |
|
||
| **R-89** | **Retention is a COMMERCIAL attribute — it belongs to the hub, not to ep0 or a box** | idea — operator ruling 2026-07-27, first increment SHIPPED same day | full text: `git show fddfe00ce268:documentation/backlog/ROADMAP.md` |
|
||
| **R-97** | **The whole-guest backup tier has NO failure signal to the hub — `internal/quiesce` never notifies** Shipped in v0.164.0, v0.177.0, v0.78.0. | **SHIPPED (controller v0.177.0 + hub v0.78.0, 2026-07-27)** — **R-97a:** `quiesce.TierNotifier`, a seam (not an import) wired by an init-only setter, edge-triggered on the R-88 breaker ARMING so a fai | full text: `git show fddfe00ce268:documentation/backlog/ROADMAP.md` |
|
||
| **R-94** | **~~A hand-synced version constant drifts, and the gate that would catch it is never run~~** Shipped in 9.9.9, v0.87.0. | **CLOSED — SHIPPED hub v0.87.0, 2026-08-02** | full text: `git show fddfe00ce268:documentation/backlog/ROADMAP.md` |
|
||
| **R-110** | **`main` is the installer's publish channel — there is no staging** Shipped in 1.22.0, v1.23.0. | **CLOSED — SHIPPED 2026-08-03** (installer v1.23.0). `/scripts/` syncs `installer-v1.23.0`; the website still tracks `main`. Proven by HTTP: a push to `main` left the served bytes byte-identical, movi | full text: `git show fddfe00ce268:documentation/backlog/ROADMAP.md` |
|
||
| **R-128** | **`ISO_VERSION` "aligns with SCRIPT_VERSION" was a comment nothing evaluated** Shipped in v1.26.0. | **CLOSED — iso v1.26.0, 2026-07-31** | full text: `git show fddfe00ce268:documentation/backlog/ROADMAP.md` |
|
||
| **R-154** | **`[first-boot]` is automated-install-only, and nothing in the tree said so** Shipped in v1.26.0. | **CLOSED — iso v1.26.0, 2026-07-31** | full text: `git show fddfe00ce268:documentation/backlog/ROADMAP.md` |
|
||
| **R-155** | **`iso-repack.sh` refused any ISO without `auto-installer-mode.toml`** Shipped in v1.26.0. | **CLOSED — iso v1.26.0, 2026-07-31** | full text: `git show fddfe00ce268:documentation/backlog/ROADMAP.md` |
|
||
| **R-156** | **An app's data is neither persisted nor backed up, and it reports healthy** | **CLOSED — all three apps fixed, 2026-08-03.** papra's template now mounts `papra_data:/app/app-data` (the app's own data ROOT, chosen over reconfiguring three env vars so a future upstream path canno | full text: `git show fddfe00ce268:documentation/backlog/ROADMAP.md` |
|
||
| **R-157** | **`bootrecon`'s start-ONCE sweep misses the boot orphan it exists to recover** Shipped in v0.189.0, v0.190.0. | **CLOSED — SHIPPED + PROVEN-LIVE (v0.189.0 + v0.190.0, 2026-08-02)** | full text: `git show fddfe00ce268:documentation/backlog/ROADMAP.md` |
|
||
| **R-170** | **The drive-backed boot gate infers a Stop from a container count** Shipped in v0.190.0. | **CLOSED — SHIPPED + PROVEN-LIVE (v0.190.0, 2026-08-02)** | full text: `git show fddfe00ce268:documentation/backlog/ROADMAP.md` |
|
||
| **R-171** | **The boot sweep started apps whose data drive was ABSENT** Shipped in v0.189.0, v0.190.0. | **CLOSED — SHIPPED + PROVEN-LIVE (v0.190.0, 2026-08-02)** | full text: `git show fddfe00ce268:documentation/backlog/ROADMAP.md` |
|
||
| **R-166** | **App state gets a desired/observed model with its own store** Shipped in v0.189.0. | **SHIPPED + PROVEN-LIVE — controller v0.189.0, 2026-08-02** | full text: `git show fddfe00ce268:documentation/backlog/ROADMAP.md` |
|
||
| **R-158** | **~~A local Tier-1 backup failure reaches no hub channel~~** Shipped in v0.191.0, v0.89.0. | **SHIPPED — controller v0.191.0 + hub v0.89.0, 2026-08-02** | full text: `git show fddfe00ce268:documentation/backlog/ROADMAP.md` |
|
||
| **R-167** | **~~Storage monitoring and backup alerts (decision D-c)~~** Shipped in v0.191.0, v0.89.0. | **SHIPPED — controller v0.191.0/.1/.2 + hub v0.89.0, 2026-08-02** | full text: `git show fddfe00ce268:documentation/backlog/ROADMAP.md` |
|
||
| **R-165** | **~~Merge `mp1` into `mp0` — the dedicated backup partition stops existing (decision D-a)~~** Shipped in v0.120.0, v0.192.0, v0.193.0. | **CLOSED — PROVEN-LIVE 2026-08-03.** Variant V-c shipped (golden v3.0.0 + agent v0.120.0 + controller v0.192.0); both demo boxes reinstalled and proven end to end (R-178). **Its stated replacement for | full text: `git show fddfe00ce268:documentation/backlog/ROADMAP.md` |
|
||
| **R-159** | **wishlist's data landed in an ANONYMOUS volume — never backed up, orphaned by a redeploy** | **SHIPPED** (`templates/wishlist/`, 2026-08-02) — filed for the CLASS | full text: `git show fddfe00ce268:documentation/backlog/ROADMAP.md` |
|
||
| **R-160** | **gramps-web persisted three paths and wrote to none of them** | **SHIPPED** (`templates/gramps-web/`, 2026-08-02) | full text: `git show fddfe00ce268:documentation/backlog/ROADMAP.md` |
|
||
| **R-161** | **The volume-persistence gate is enforced by convention, not automatically** | **RULED + SHIPPED at reduced scope** (operator, 2026-08-02; `app-catalog` `fd7747d`) | full text: `git show fddfe00ce268:documentation/backlog/ROADMAP.md` |
|
||
| **R-163** | **`mp1` is RETENTION, not staging — and it is sized as if it were neither** Shipped in v3.0.0. | **SUPERSEDED 2026-08-22 — the register records CLOSED by R-165 (golden v3.0.0, 2026-08-03): the ceiling this row describes no longer exists** (was:**WAITING-ON-OPERATOR** — the ratio is a tier-sizing | full text: `git show fddfe00ce268:documentation/backlog/ROADMAP.md` |
|
||
| **R-90** | **ep0 has 3.8 GB and NO swap — it OOMs under a restore-test, and that gates R-86** | **CLOSED 2026-08-03 — the operator rescaled ep0 to a CX33.** MEASURED on the box, not read from an invoice: `Mem: 7757` MB (**8 GB**, was 3.8), `nproc` **4**, and the 4 GiB swapfile added 2026-07-27 * | full text: `git show fddfe00ce268:documentation/backlog/ROADMAP.md` |
|
||
| **R-96** | **Two standing rules were agreed in chat and never committed** | **MOVED 2026-08-22 -> OPEN-ITEMS.md** (was: idea — found 2026-07-27) | full text: `git show fddfe00ce268:documentation/backlog/ROADMAP.md` |
|
||
| **R-76** | **FileBrowser-created folders break the setgid chain, and a drop-zone's mode is not stable** Shipped in 1.3.3. | **MOVED 2026-08-22 -> OPEN-ITEMS.md** (was: idea (surfaced by the R-75 spike, 2026-07-26)) | full text: `git show fddfe00ce268:documentation/backlog/ROADMAP.md` |
|
||
| **R-21** | **Bare-metal Felhom ISO** Shipped in 0.92.1, v0.62.0, v1.18.0. | **SHIPPED + PHYSICALLY CLOSED (slices A+B+C; rehearsal executed 2026-07-18)** | full text: `git show fddfe00ce268:documentation/backlog/ROADMAP.md` |
|
||
| **R-168** | **~~CI: no runner exists, and with trunk-based pushes CI can DETECT but not BLOCK~~** | **CLOSED — SHIPPED 2026-08-02** | full text: `git show fddfe00ce268:documentation/backlog/ROADMAP.md` |
|
||
| **R-37** | **Post-RESET health card shows stale pre-RESET warnings.** Shipped in v0.67.0. | **SHIPPED (hub v0.67.0, 2026-07-18)** | full text: `git show fddfe00ce268:documentation/backlog/ROADMAP.md` |
|
||
| **R-38** | **Installer GRUB slice.** Shipped in v1.21.0, v1.22.0. | **SHIPPED (scripts v1.22.0, 2026-07-19)** | full text: `git show fddfe00ce268:documentation/backlog/ROADMAP.md` |
|
||
| **R-40** | **[P2-HIGH] The update path cannot express a MULTI-HOP major upgrade.** | **MOVED 2026-08-22 -> OPEN-ITEMS.md** (was: idea) | full text: `git show fddfe00ce268:documentation/backlog/ROADMAP.md` |
|
||
| **R-42** | **RULED: sidecar majors follow the APP, never the newest tag.** | **RULED 2026-07-21 — option (a)** | full text: `git show fddfe00ce268:documentation/backlog/ROADMAP.md` |
|
||
| **R-43** | **[P2-HIGH] No offsite restore path can restore a database — offsite restore cannot reconstitute a DB-indexed app.** Shipped in v0.148.0. | **SHIPPED controller v0.148.0 (2026-07-19) — live acceptance PENDING** | full text: `git show fddfe00ce268:documentation/backlog/ROADMAP.md` |
|
||
| **R-44** | **[P2-HIGH] A manual offsite push ships an unrefreshed DB dump — "backed up now" is false for the DB half.** Shipped in v0.148.0. | **SHIPPED controller v0.148.0 (2026-07-19)** | full text: `git show fddfe00ce268:documentation/backlog/ROADMAP.md` |
|
||
| **R-47** | **[P2-HIGH] The DB replay races the application's own schema repair.** Shipped in 0.153.0, 0.90.0, v0.153.0. | **SHIPPED — controller v0.153.0, 2026-07-20** | full text: `git show fddfe00ce268:documentation/backlog/ROADMAP.md` |
|
||
| **R-49** | **[P2] The offsite capture set is ~90% cache and duplication — 1.1 GB of a 1.2 GB immich "photo backup".** | **MOVED 2026-08-22 -> OPEN-ITEMS.md** (was: idea) | full text: `git show fddfe00ce268:documentation/backlog/ROADMAP.md` |
|
||
|
||
## 2026-10-03 — the triage: shipped, killed, closed and moved items out of `ROADMAP.md`
|
||
|
||
| ID | Item | Final state | Full text |
|
||
|---|---|---|---|
|
||
| **R-116** | **The drive-absent alarm and its recovery are a mismatched pair — generic on the way out, specific on the way back** | **CLOSED — the register row is closed (`CLOSED-ITEMS.md`)** | full text: `git show 9f77865:documentation/backlog/ROADMAP.md` |
|
||
| **R-113** | **The drive-absent gate cannot fire on device loss — E-2b's alarm is wired to an unreachable condition** | **CLOSED — the register row is closed (`CLOSED-ITEMS.md`)** | full text: `git show 9f77865:documentation/backlog/ROADMAP.md` |
|
||
| **R-112** | **E-2's degraded banner and offer have no UI consumer — correct endpoint, invisible to the customer** | **CLOSED — the register row is closed (`CLOSED-ITEMS.md`)** | full text: `git show 9f77865:documentation/backlog/ROADMAP.md` |
|
||
| **R-114** | **On target-drive loss the customer is told the wrong story and offered the drive that vanished** | **CLOSED — the register row is closed (`CLOSED-ITEMS.md`)** | full text: `git show 9f77865:documentation/backlog/ROADMAP.md` |
|
||
| **R-7b** | **Share backup EXECUTION** | ****SHIPPED (controller v0.145.0, 2026-07-18)**** | full text: `git show 9f77865:documentation/backlog/ROADMAP.md` |
|
||
| **R-202** | **The orphan card promises recoverability unconditionally** | **CLOSED 2026-10-03 — register row verified finished and moved (`CLOSED-ITEMS.md`)** | full text: `git show 9f77865:documentation/backlog/ROADMAP.md` |
|
||
| **R-201** | **The wipe-and-recover drill** | **CLOSED — both halves passed 2026-08-04/07 (`CLOSED-ITEMS.md`)** | full text: `git show 9f77865:documentation/backlog/ROADMAP.md` |
|
||
| **D5** | **Move app secrets into the LOCAL recovery unit** | ****SHIPPED + PROVEN-LIVE** — controller v0.188.0, 2026-07-30** | full text: `git show 9f77865:documentation/backlog/ROADMAP.md` |
|
||
| **E-2** | **Drive-role machinery around the moved vzdump target.** | **CLOSED — PARTIALLY PROVEN (Session C, 2026-07-29; `CLOSED-ITEMS.md`, the id-less rows)** | full text: `git show 9f77865:documentation/backlog/ROADMAP.md` |
|
||
| **G-1** | **Gate C5 — the cross-repo tag-reachability check.** | ****BUILT AND CLOSED 2026-08-08** — `scripts/wire_contract_gate.py`, `--fast`, registered in `repo_gates.py`** | full text: `git show 9f77865:documentation/backlog/ROADMAP.md` |
|
||
| **G-6** | **C2 — NOT mechanically gateable.** | **KILLED — recorded as a no: "names a route" is a judgement, not a predicate** | full text: `git show 9f77865:documentation/backlog/ROADMAP.md` |
|
||
| **G-7** | **C6 — NOT gateable, and the measurement is the finding.** | **KILLED — recorded as a no, with evidence: `deadcode` re-found neither known instance** | full text: `git show 9f77865:documentation/backlog/ROADMAP.md` |
|
||
| **R-25b** | **RULED: customer DELETE becomes a guided full-teardown cascade.** | ****SHIPPED hub v0.69.0 (2026-07-21)**** | full text: `git show 9f77865:documentation/backlog/ROADMAP.md` |
|
||
| **R-87** | **The restic (app-data offsite) tier is NEVER restore-tested** | ****SHIPPED 2026-08-31 — controller v0.231.0, RE-SCOPED by its own spike.** Not built as written: the spike measured that an unattended scratch restore would have caught ONE of five drill-found restore defects, so it proves the snapshot CONTAINS a recoverable …** | full text: `git show 9f77865:documentation/backlog/ROADMAP.md` |
|
||
| **R-48** | **[P2-HIGH] Restore controls are separable only by layout — and the difference between them is whether the data comes back.** | **SHIPPED — controller v0.154.0 (2026-07-21): the offsite restore wizard, one entry per app (`controller/internal/web/restore_wizard.go:12`); verified 2026-10-03** | full text: `git show 9f77865:documentation/backlog/ROADMAP.md` |
|
||
| **R-29** | **The design-v2 green gates are not enforced anywhere — one has been RED for 16 releases.** | **CLOSED — the register row is closed (`CLOSED-ITEMS.md`)** | full text: `git show 9f77865:documentation/backlog/ROADMAP.md` |
|
||
| **R-127** | **`data_key: true` is unreliable (4+ encryption keys unflagged, contradicting the catalog's own labels), and O4 can regenerate a DB password that no longer matches the restored data directory** | **MOVED → `OPEN-ITEMS.md` — a FINDING; its register row is the record (moved out of this file 2026-10-03; status here was: READY — NEW 2026-07-30)** | full text: `git show 9f77865:documentation/backlog/ROADMAP.md` |
|
||
| **R-133** | **The vaulted break-glass console credential is PLAINTEXT AT REST, so every hub DB backup is a fleet-wide console-credential dump.** | **MOVED → `OPEN-ITEMS.md` — a FINDING; its register row is the record (moved out of this file 2026-10-03; status here was: READY — NEW 2026-07-31)** | full text: `git show 9f77865:documentation/backlog/ROADMAP.md` |
|
||
| **R-126** | **A `.fab` bundle — plaintext secrets, optional password — can be exported ONTO a NAS.** | **MOVED → `OPEN-ITEMS.md` — a FINDING; its register row is the record (moved out of this file 2026-10-03; status here was: READY — 2026-07-30)** | full text: `git show 9f77865:documentation/backlog/ROADMAP.md` |
|
||
| **R-95** | **The restic offsite tier's credential CAN DELETE — R-89's "parallel question", now ANSWERED** | **MOVED → `OPEN-ITEMS.md` — a FINDING; its register row is the record (moved out of this file 2026-10-03; status here was: idea — established read-only 2026-07-27)** | full text: `git show 9f77865:documentation/backlog/ROADMAP.md` |
|
||
| **R-162** | **`docker diff` is the gate's only witness and its failure mode is quiet** | **MOVED → `OPEN-ITEMS.md` — a FINDING; its register row is the record (moved out of this file 2026-10-03; status here was: WATCHING — 2026-08-02)** | full text: `git show 9f77865:documentation/backlog/ROADMAP.md` |
|
||
| **R-164** | **C2's chain — the DB volume tar cannot be dropped until a sound dump predicate exists** | **MOVED → `OPEN-ITEMS.md` — a FINDING; its register row is the record (moved out of this file 2026-10-03; status here was: BLOCKED — on the predicate (2026-08-02))** | full text: `git show 9f77865:documentation/backlog/ROADMAP.md` |
|
||
| **R-91** | **The old 13 GB datastore copy is still on ep0's root disk** | **MOVED → `OPEN-ITEMS.md` — a FINDING; its register row is the record (moved out of this file 2026-10-03; status here was: WATCHING — gated on demo-felhom's first post-migration PBS backup)** | full text: `git show 9f77865:documentation/backlog/ROADMAP.md` |
|
||
| **R-92** | **The hub's PBS-DR gauge is 0.1 GB-granular, so small deltas are unverifiable** | **MOVED → `OPEN-ITEMS.md` — a FINDING; its register row is the record (moved out of this file 2026-10-03; status here was: idea — 2026-07-27)** | full text: `git show 9f77865:documentation/backlog/ROADMAP.md` |
|
||
| **R-93** | **`drill-r50` is both a blocked customer and the only drift fixture** | **MOVED → `OPEN-ITEMS.md` — a FINDING; its register row is the record (moved out of this file 2026-10-03; status here was: idea — 2026-07-27)** | full text: `git show 9f77865:documentation/backlog/ROADMAP.md` |
|
||
| **R-169** | **CI can only report, because there is no gate in the road** | **MOVED → `OPEN-ITEMS.md` — a FINDING; its register row is the record (moved out of this file 2026-10-03; status here was: idea — minted 2026-08-02, **WAITING-ON-OPERATOR**)** | full text: `git show 9f77865:documentation/backlog/ROADMAP.md` |
|
||
| **UPDATE-ARC** | **The app-update arc — seven slices, from "nobody knows what any box runs" to "an update is a decision the box can take safely."** | **COLLAPSED 2026-10-03** — parts 1–10 shipped, part 11 deferred by ruling; the open rows are listed in `ROADMAP.md` §UPDATE-ARC. Status at collapse: **slices 1, 1b, 2, 3 & 5 SHIPPED (controller v0.233.0 / v0.234.0 / v0.235.0; harness `app-catalog/scripts/upgrade-test.py`); slices 4, 6, 7 open** **2026-09-13 — SLICE 4 COLLAPSED: SHIPPED** (controller v0.237.0/v0.238.0/v0.238.1, R-448 CLOSED, proven live — … | full text: `git show 9f77865:documentation/backlog/ROADMAP.md` |
|
||
| pre-invite: golden 0.146.0 rebuild | **golden 0.146.0 rebuild** | **DONE — baked + published 2026-07-18** | full text: `git show 9f77865:documentation/backlog/ROADMAP.md` |
|
||
| pre-invite: golden ≥0.147.x carries all four infra images | **golden ≥0.147.x carries all four infra images** | **DONE — `build-golden.sh` v2.1.0 derives the pre-pull list (2026-07-19)** | full text: `git show 9f77865:documentation/backlog/ROADMAP.md` |
|
||
| pre-invite: freemail.hu test-send (R-4) | **freemail.hu test-send (R-4)** | **DONE — R-4 closed 2026-07-21 (all three halves)** | full text: `git show 9f77865:documentation/backlog/ROADMAP.md` |
|
||
| pre-invite: C6 — a customer performs a restore unassisted | **C6 — a customer performs a restore unassisted** | **SUPERSEDED — the unaided recovery journey was proven 2026-08-07 (`00` §A); the capability row "a customer performs a restore via UI alone" stays as R-3's target** | full text: `git show 9f77865:documentation/backlog/ROADMAP.md` |
|
||
| pre-invite: R-11 rulings (contact channel, tester agreement, alert thresholds) | **R-11 rulings (contact channel, tester agreement, alert thresholds)** | **PARTLY RULED — the contact channel ruled 2026-07-21; the tester agreement → R-809 (2026-10-03)** | full text: `git show 9f77865:documentation/backlog/ROADMAP.md` |
|
||
| stray text | **Two paragraphs that sat between ROADMAP rows** (a boot-gate log excerpt about immich after the R-50b row; three paragraphs on a quiesce-cycle amplifier after the R-87 row) | **KEPT IN HISTORY** — their rows are history; nothing open depends on them | full text: `git show 9f77865:documentation/backlog/ROADMAP.md` |
|
||
| **R-50b** | **A root-owned privileged host artifact is delivered unversioned from `main`** | **MOVED → `OPEN-ITEMS.md`** (Box system & updates, P3) — a FINDING, found when `one_register_gate.py` stopped skipping suffix ids (2026-10-03) | full text: `git show 9f77865:documentation/backlog/ROADMAP.md` |
|