felhom.eu/STATUS.md

# STATUS — what works, what's broken, what's next

**Updated 2026-08-08.**

> **A view, not a source.** `documentation/backlog/OPEN-ITEMS.md` is the authority; this page restates
> part of it in plain words, and **nothing may exist only here**. Not `CONTEXT.md`, which is technical
> state written for Claude Code. **Items, not paragraphs. One screen.** If it does not fit, something
> belongs in the register instead.
>
> *Rebuilt from the register on 2026-08-07, from 258 lines. The old "what shipped recently" log is what
> the per-repo `CHANGELOG.md` files and the register are for, and is not restated here.*

## What works

A blank machine boots the Felhom disc, installs itself unattended, and is claimed by the customer, who
sets their own password. They install apps from a catalogue of fifty-three, share files over the home
network, and open apps from a launcher or a shared link. Backups run on their own to three places — the
machine's drive, a second drive, and an encrypted off-site copy.

**The backup promise is proved, and so is getting the data back yourself.** A machine has been
destroyed on purpose and its files came back byte for byte identical — four times now. On
**2026-08-07 the household's own journey passed for the first time**: someone with a browser and
their recovery code got everything back with **no command line inside the machine at any point**,
in 72 seconds. The two rough edges that walk found are also gone. *(R-201, R-252, R-253 — closed.)*

## What's broken

- **Nothing new is broken.** The *check* against a fourth secret-in-a-page covers 4 pages of 27, and
  the cheap one covering all of them is blind to the shape that shipped. *(R-255)*
- **An already-paired box is still told to pair itself**, 25 minutes on. *(R-214, R-235)*
- **A backup that covered nothing still calls itself „Sikeres".** *(R-240)*
- **A machine waiting for its recovery code can stop backing up off-site without alarming us.** *(R-243)*
- **The card offering to reopen set-aside backups promises more than we can deliver.** *(R-202)*
- **Deleting a customer leaves rows behind** while reporting a clean teardown — no secrets, but it
  accumulates. *(R-244)*
- **Putting restored files back where they belong is still manual.** *(R-213)*

## Fixed today — four things the machine knew and did not say

All one family: something the box already knows, thrown away or drawn as its opposite.

- **A rebuilt machine can set up its own recovery again.** The one fact the setup needs was written
  only the first time, and a rebuild replaced the configuration while leaving the note saying
  "already done". It is now checked and re-written every minute instead of remembered once, so a
  hand-edited or restored configuration heals too. **This was the last item blocking a customer from
  something we promise them.** *(R-221 — agent 0.128.0.)*
- **A disk we failed to read is no longer drawn as a healthy empty one.** No figures, no bar, and it
  says so: „A tárhely mérete most nem olvasható ki." *(R-259 — controller 0.210.0.)*
- **A backup tick now answers about that app.** It went green because *some* backup file existed and
  *some other* app's database dump had succeeded most recently. Now: that app's own result, and
  **no mark at all** when we have none. *(R-258 — controller 0.210.0.)*
- **Our own alarm no longer points at a page that may not exist.** A check run now gives up after
  five minutes rather than hanging until something else kills it, and the mail says how long it ran.
  *(R-265.)*

**Not fixed, and said rather than glossed:** that failed disk reading still reaches us as "0 of
0 GB". It is the quiet direction — it can only miss a true alarm, never raise a false one. *(R-266)*

**And R-221 is now proven on hardware, not just in tests** — on a demo machine we removed the one
line, watched the setup screen refuse, waited one minute, and watched it go green by itself with
nothing restarted. Every other line of that file came back identical.

## What we're working on

- **Widening the check** so a fourth secret-in-a-page is caught by a machine. *(R-255)* · **Deciding
  the twenty-one** — each gets a reader, or stops being sent. *(R-264)*
- **Proving the hub really keeps the old sealed key** when a machine re-seals. *(R-198)* · Still open,
  none urgent: *(R-256, R-257, R-261…R-263, R-266)*

## Waiting on you

- **A watching moment, five minutes.** Today's recovery fix is proved by removing one line from a
  demo machine's config — backed up first, disposable machine, no customer data near it — and
  watching the setup screen go green on its own. Nothing is destroyed. Say when.
- **One approval, three values this time.** Hub → Configuration → Day-0 artifacts: Golden
  **0.210.0**, Agent **0.128.0**, minimum agent **0.127.0** (unchanged) → Save. Each was checked to
  be downloadable and selectable before being written here. **Agent 0.128.0 is the one that carries
  today's recovery fix**, so a new machine needs both, not just the image. It supersedes the 0.209.0
  approval you already gave, and it is reversible. *(R-242)*

## DooPlex infrastructure — separate from the product

*Kept under its own heading rather than dropped: these are real asks that need you, but they concern
the machine all this is built on, not what a customer receives. Mixing them in is why the page stopped
being readable.*

- **DooPlex's own backup keeps every copy inside the same box, and is silent when it fails.** *(R-232)*
- **193 old images exist only on this machine**, ~27 GB — clutter, not space. *(R-210)*
- **The hub password needs rotating** — a diagnostic printed it into a session log; nothing suggests
  anyone else saw it. *(R-132)*
- **After DooPlex next restarts**, read `/var/log/felhom-store-postboot-check.log` — the second-SSD
  move has never survived a reboot; on PASS, 34 GB comes back. *(R-209a)*
- **Backup scripts on DooPlex are unversioned host state** *(R-231)*, and the instruction-file
  follow-ups each need a decision rather than an edit *(R-229, R-230)*.
- **The Configuration page is fixed: 26 s → 0.14 s.** It was never hashing anything — the hashes
  are already stored and simply read. It was making 42 calls one after another. Now they overlap,
  connections are kept, the answer is held for a minute, and the old artifacts are gone. Worst case
  is 5 s, once a minute at most. **Your instinct to prune was right and my measurement said
  otherwise** — trimming to ten of each halved the slow path. *(R-267 — closed.)*
- **I printed a live access token into a session log** while setting up today's drill, and I am
  telling you rather than quietly rotating it. It only opens the agent's private channel to one
  demo guest, on a wire that exists solely between that host and that guest — not reachable from
  your network or the internet, on a disposable machine with no customer data. Rotating it also
  means updating the guest, so it is a deliberate act, not a background one. *(R-268)*
- **Our build-check alarm has one gap left.** A run that hangs is now cut off after five minutes and
  the mail says how long it took — but **whether the alarm fires at all when the machinery kills a
  run outright is still unverified**, and we have not claimed otherwise. *(R-265)*