admin
ef6ac6fe74
Records and process only. No machine contacted. ONE REGISTER (operator ruling). 17 roadmap rows moved into OPEN-ITEMS.md keeping their identifiers, evidence and original filing dates - the oldest R-10, filed 2026-07-15, 38 days. 15 ideas stay in ROADMAP.md, which is their home; the gate exempts them by their own state word. 59 already-closed rows stay as history. Sorting rule recorded in the roadmap header: does the item assert something about the shipped product a reader could check and find false? scripts/one_register_gate.py, wired as the 11th gate. Control run: baseline passes, a planted open roadmap-only row is convicted by name, removing it passes with the file byte-identical, and a planted `idea` row is correctly exempt. Its four residual holes are in its docstring. The gate earned its keep immediately: it caught R-103, a READY finding my hand-sort mis-read as done because my regex matched the whole row where the body contains "shipped" - the gate matches the state cell. It also caught R-203 and R-163, recorded closed in the register and still open in the roadmap; the roadmap copies are marked SUPERSEDED with the register's verdict. HOUSEKEEPING. OPEN-ITEMS 672,376 -> 327,109 bytes (-51%); ROADMAP 239,306 -> 78,110 (-67%). Closed work compressed to 17% into CLOSED-ITEMS.md and ROADMAP-HISTORY.md; every entry names the commit whose git show returns the full original text. Rule-sentences are kept verbatim under "Reasoning kept" rather than judged entry by entry - 25 carry one. CONTEXT.md deliberately NOT compressed and the disagreement is argued in the report: 86% of it is standing rulings still in force, this prompt's own 3.4 says the log is never edited, and it has no per-ruling delimiter. Filed as R-377 - the problem is navigational, not volumetric. The hot/bulk placement decision was NEVER recorded as a decision anywhere - established, not assumed. Now marked [DESIGN] with a pointer honest about having no original date, given a decision-log entry that records what was rejected, and the [DESIGN]/[FACT] legend carried from 1 of 8 architecture documents to 8 of 8. Existing statements deliberately left unmarked (R-376). PROMPT-TEMPLATE gains N.7: compress what you closed, rehome live reasoning before it goes, state the register's size before and after. Ceiling R-375 -> R-378.
28 KiB
ROADMAP-HISTORY — finished and superseded roadmap items, compressed
Companion to
ROADMAP.md, created 2026-08-22 under the same operator ruling that producedCLOSED-ITEMS.md. Each entry keeps its identifier, title, shipped version and final state, and names the commit holding its full original text. Nothing was deleted.
ROADMAP.mdnow carries only live intentions and the reasoning behind them, which is what its own first paragraph has always said it is for.
| R-115 | Publishing is a remembered step — forgotten within eight hours of being documented as forgettable Shipped in 0.113.0, 0.114.0, v0.113.0. | CLOSED — SHIPPED 2026-08-03 (release-agent.sh + check-published-versions.py, no version bump). Releasing now builds, tags, publishes and verifies by an independent download in one act; a | full text:git show fddfe00ce268:documentation/backlog/ROADMAP.md| | **R-111** | **The Day-0 artifact channel is 17 agent releases stale — a box installed today gets agent0.96.0, not 0.113.0** Shipped in 0.110.0, 0.113.0, 0.161.0. | **SHIPPED 2026-07-29** — agent 0.113.0 published (sha 5f3247f7…, round-trip verified) + golden **0.185.1** baked and published (sha dba00f3e…, embeds controller 0.185.1); hub Day-0 manifest moved | full text: git show fddfe00ce268:documentation/backlog/ROADMAP.md| | **R-1** | **Peti convergence** Shipped in v0.57.0. | **rehearsal DONE; Peti half open** | full text:git show fddfe00ce268:documentation/backlog/ROADMAP.md | | **R-2** | **~~Resolve ~215 lines of foreign WIP in felhom.eu clone (hub/internal/notify/, store.go, hub/internal/cla** Shipped in v0.50.0, v0.54.0, v0.55.0. | killed (2026-07-16) | full text: git show fddfe00ce268:documentation/backlog/ROADMAP.md |
| R-4 | Claim-code deliverability: test-send to gmail.com / freemail.hu; tighten DMARC p=none → p=quarantine Shipped in 1.1.1, 8.8.8. | DONE 2026-07-21 (all three halves) | full text: git show fddfe00ce268:documentation/backlog/ROADMAP.md |
| R-39 | [P2-HIGH] The PBS DR tier can be applied and dead at the same time — and nothing notices. Shipped in 0.68.1, 0.90.0, 0.90.1. | CLOSED 2026-07-21 — PROVEN LIVE (hub 0.68.1 + agent 0.91.2) | full text: git show fddfe00ce268:documentation/backlog/ROADMAP.md |
| R-30 | [P2-HIGH] Liveness presence should come from the wait channel, not the report clock. | MOVED 2026-08-22 -> OPEN-ITEMS.md (was: idea) | full text: git show fddfe00ce268:documentation/backlog/ROADMAP.md |
| R-31 | [P2-HIGH] Offsite provisioning is synchronous with no status affordance. Shipped in v0.138.0. | MOVED 2026-08-22 -> OPEN-ITEMS.md (was: idea) | full text: git show fddfe00ce268:documentation/backlog/ROADMAP.md |
| R-32 | [P2-HIGH] RESET must purge the customer base dir; the orphan card must stay honest; unattributed bytes must be visible. | MOVED 2026-08-22 -> OPEN-ITEMS.md (was: idea) | full text: git show fddfe00ce268:documentation/backlog/ROADMAP.md |
| R-33 | [P2-HIGH] Bootstrap pairing-poll spams the customer-visible console. Shipped in v1.21.0. | SHIPPED (scripts v1.21.0, 2026-07-18) | full text: git show fddfe00ce268:documentation/backlog/ROADMAP.md |
| R-5 | Hub: offsite storage visibility — RESTIC box aggregate (v0.64.0) + PBS DR datastore (v0.65.0), each with fill Shipped in v0.64.0, v0.65.0, v1.2.0. | SHIPPED (hub v0.64.0 + v0.65.0 + tenantsync v1.2.0, 2026-07-17) | full text: git show fddfe00ce268:documentation/backlog/ROADMAP.md |
| R-7 | server Shipped in 1.0.0, v0.144.0. | SHIPPED slice 1 (controller v0.144.0 + felhom-samba:1.0.0, 2026-07-18) | full text: git show fddfe00ce268:documentation/backlog/ROADMAP.md |
| R-10 | T-6E-1: DB-dump dir-fsync asymmetry (LOW, confirmed in 6E) | MOVED 2026-08-22 -> OPEN-ITEMS.md (was: idea) | full text: git show fddfe00ce268:documentation/backlog/ROADMAP.md |
| R-11 | Tester-facing one-pager: what the box does, known limitations, how to report | RULED 2026-07-21 (channel); doc is the architect's | full text: git show fddfe00ce268:documentation/backlog/ROADMAP.md |
| R-16 | Operator hygiene: campaign6 autofs orphan (clears on host reboot) + tied-CreatedAt flash duplicates (audioboo Shipped in v1.17.0. | open (doc-drift bit CLOSED) | full text: git show fddfe00ce268:documentation/backlog/ROADMAP.md |
| R-22 | PBS-DR pre-check self-grant (F4). Shipped in v0.89.0. | SHIPPED + PROVEN-LIVE agent v0.89.0 (2026-07-17) | full text: git show fddfe00ce268:documentation/backlog/ROADMAP.md |
| R-17 | Old-box archive (u629193-sub1) retirement — 9/9 byte-identical restores verified | CLOSED 2026-07-22 — archive deleted (operator console) | full text: git show fddfe00ce268:documentation/backlog/ROADMAP.md |
| R-198 | The superseded-escrow retention kept the K-escrow and dropped the identity blob Shipped in v0.60.0, v0.93.0. | SHIPPED (hub v0.93.0, 2026-08-04) | full text: git show fddfe00ce268:documentation/backlog/ROADMAP.md |
| R-197 | The hub stored both halves of "did this box's offsite data key change" and compared them nowhere Shipped in v0.93.0. | SHIPPED (hub v0.93.0, 2026-08-04) | full text: git show fddfe00ce268:documentation/backlog/ROADMAP.md |
| R-196 | Five comments claimed ReissueCredentials rotates the restic repo password Shipped in v0.93.0, v0.95.0. | CLOSED — behaviour shipped hub v0.95.0 (2026-08-05) | full text: git show fddfe00ce268:documentation/backlog/ROADMAP.md |
| R-199 | The hub served recovery blobs on endpoints with no client anywhere Shipped in v0.125.0, v0.94.0. | SHIPPED + PROVEN-LIVE (hub v0.94.0 + agent v0.125.0, 2026-08-04) | full text: git show fddfe00ce268:documentation/backlog/ROADMAP.md |
| R-200 | The password-injection seam had a handler and no form Shipped in v0.195.0. | plumbing SHIPPED (controller v0.195.0); the form is NOT built | full text: git show fddfe00ce268:documentation/backlog/ROADMAP.md |
| R-203 | A mandatory customer data directory was silently absent from the off-site snapshot while the run reported ok Shipped in v0.197.0. | SUPERSEDED 2026-08-22 — the register records SHIPPED + PROVEN-LIVE (controller v0.197.0, 2026-08-04); this row was never updated when it shipped (was:OPEN — halted the R-201 drill 2026-08-04) | full text: git show fddfe00ce268:documentation/backlog/ROADMAP.md |
| R-203 | The app and its backup looked in different directories, and a run that skipped a mandatory folder still said ok Shipped in v0.197.0. | SHIPPED + PROVEN-LIVE (controller v0.197.0, 2026-08-04) | full text: git show fddfe00ce268:documentation/backlog/ROADMAP.md |
| R-204 | The recovered key cannot be used: the Re-issue that reconfigures a rebuilt box's off-site tier marks the escrow stale, which gates every run, and the only way to clear it destroys the key Shipped in v0.199.0, v0.96.0. | ALL FOUR ITEMS SHIPPED (controller v0.199.0 + hub v0.96.0, 2026-08-05) | full text: git show fddfe00ce268:documentation/backlog/ROADMAP.md |
| R-193 | A rebuilt box's off-site history was unreachable, and later reachable only from a command line Shipped in v0.199.0, v0.200.0, v0.96.0. | CLOSED (2026-08-05) — credential half controller v0.199.0 + hub v0.96.0; the customer-facing SCREEN controller v0.200.0 | full text: git show fddfe00ce268:documentation/backlog/ROADMAP.md |
| R-201 | The wipe-and-recover drill | PASSED + PROVEN-LIVE (2026-08-04 night) | full text: git show fddfe00ce268:documentation/backlog/ROADMAP.md |
| R-20 | Verify operator-key pinning is fully in the day-0 install flow | closed (2026-07-16) | full text: git show fddfe00ce268:documentation/backlog/ROADMAP.md |
| R-23 | Immediate-sync Direction-2 follow-ups Shipped in 0.153.0, 0.154.0, 0.155.0. | (a) BANKED in full; only (b) cosmetic remains | full text: git show fddfe00ce268:documentation/backlog/ROADMAP.md |
| R-35 | Config-apply should not end the customer's session. | MOVED 2026-08-22 -> OPEN-ITEMS.md (was: idea) | full text: git show fddfe00ce268:documentation/backlog/ROADMAP.md |
| R-36 | Post-RESET re-enroll leaves offsite "enabled but unprovisioned" — silently. Shipped in v0.67.0. | SHIPPED (hub v0.67.0, 2026-07-18) | full text: git show fddfe00ce268:documentation/backlog/ROADMAP.md |
| R-50 | [P2-HIGH] Island-bridge control plane — make controller↔agent independent of the LAN. Shipped in 0.96.0, 169.254.253, 192.168.0. | SHIPPED 2026-07-25 — fleet-migrated (agent v0.96.0 + host-install v1.19.0) | full text: git show fddfe00ce268:documentation/backlog/ROADMAP.md |
| R-51 | Dead-primary alerting — a multi-container app whose MAIN container is dead must alert. Shipped in v0.156.0. | SHIPPED 2026-07-21 — controller v0.156.0 | full text: git show fddfe00ce268:documentation/backlog/ROADMAP.md |
| R-52 | Boot desired-state reconciliation — a deployed: true app should be running after boot. Shipped in v0.156.0. | SHIPPED 2026-07-21 — controller v0.156.0 | full text: git show fddfe00ce268:documentation/backlog/ROADMAP.md |
| R-54 | [P2-HIGH] The guest's DHCP client is unsupervised — its death takes the box off the internet 1-2 hours later, invisibly. Shipped in 0.92.0, 0.92.1, 192.168.0. | SHIPPED 2026-07-21 — agent v0.92.1 | full text: git show fddfe00ce268:documentation/backlog/ROADMAP.md |
| R-55 | [P2] A customer's deliberate Stop does NOT survive a guest reboot for any drive-backed app Shipped in v0.157.0. | SHIPPED 2026-07-21 — controller v0.157.0 | full text: git show fddfe00ce268:documentation/backlog/ROADMAP.md |
| R-57 | An app can be withdrawn from the catalog without orphaning the customers already running it Shipped in v0.158.0, v0.158.1. | SHIPPED 2026-07-21 — controller v0.158.0 (+ v0.158.1 fix), LIVE-PROVEN | full text: git show fddfe00ce268:documentation/backlog/ROADMAP.md |
| R-59 | [P1] A no-DHCP install must HARD-ABORT — instead it bakes the installer's fallback address as a STATIC config and completes, producing a box that can never call home. Shipped in 192.168.100, v1.24.0. | **SHIPPED v1.24.0 (2026-07-22) — as a FIRST-BOOT refuse-loudly gate, with a RECORDED DEVIATION: the install-time abort is out of scope (the 192.168.100.2 fallback is baked inside the Proxmox auto-inst | full text: git show fddfe00ce268:documentation/backlog/ROADMAP.md |
| R-60 | [P2] First-boot NIC sweep self-heal: if the hub is unreachable, try DHCP across every carrier-bearing NIC before settling. Shipped in v1.24.0. | **SHIPPED v1.24.0 (2026-07-22) — spike + nested drill proven (SPIKE-firstboot-nic-sweep-2026-07-22.md): cable move → sweep → heal + hub registration unaided in <1 min; sweep is structurally first-boot | full text: git show fddfe00ce268:documentation/backlog/ROADMAP.md |
| R-61 | [P1] The baked root password must be knowable by the operator — the recurring console lockout. Shipped in v1.24.0. | **slice 1 SHIPPED v1.24.0 (2026-07-22): the build emits the plaintext into a 0600 sibling <iso>.rootpw.txt (single record of truth — never logged/manifested/committed); drill-verified against the in | full text: git show fddfe00ce268:documentation/backlog/ROADMAP.md |
| R-63 | The install console learns ő/ű Shipped in 0.153.0, 0.156.0, 0.161.0. | SHIPPED (scripts v1.25.0, 2026-07-23) | full text: git show fddfe00ce268:documentation/backlog/ROADMAP.md |
| R-66 | The box's own address becomes visible — „Hálózat" card, Debug network dump, NetBIOS hint. Shipped in v0.159.0. | SHIPPED (controller v0.159.0, 2026-07-22) | full text: git show fddfe00ce268:documentation/backlog/ROADMAP.md |
| R-67 | The NAS share appears in FileBrowser — browse what you mounted. Shipped in v0.160.0. | SHIPPED (controller v0.160.0, 2026-07-22) | full text: git show fddfe00ce268:documentation/backlog/ROADMAP.md |
| R-68 | Notification train: paired recovery mails + prefs seeding at claim + priority headers (power-outage audit F11+F12+F14-light). Shipped in 0.160.0, v0.71.0. | SHIPPED (hub v0.71.0, 2026-07-22) | full text: git show fddfe00ce268:documentation/backlog/ROADMAP.md |
| R-70 | [P2-HIGH] The offsite last mile is invisible on BOTH surfaces — the hub cannot tell "staged" from "delivered" from "applied". Shipped in v0.161.0, v0.72.0. | SHIPPED (hub v0.72.0 + controller v0.161.0, 2026-07-23) — detector offsite.DeliveryStateFor (one impl, all consumers), customer-card state line with age (static "delivered once" copy GONE), off | full text: git show fddfe00ce268:documentation/backlog/ROADMAP.md| | **R-71** | **[P1] Day-0 race: the managed floor-update kills the offsite apply-bridge between password-consume and persist — the one-shot credential is burned and the box lands in the silent consume-404 dead-end forever.** Shipped in 0.153.0, 0.156.0, v0.162.0. | **SHIPPED — (a)+(c); (b) rejected-by-design.** **(a) SHIPPED (controller v0.162.0, 2026-07-24): the apply-bridge settle-gate.**offsiteapply.SettleProvider.SettleState()+SettleFuncadapter over | full text:git show fddfe00ce268:documentation/backlog/ROADMAP.md | | **R-53** | **app_export.htmlsubstituted the CSRF token where the customer domain belongs** Shipped in v0.150.0. | **SHIPPED (controller v0.150.0, 2026-07-20)** | full text:git show fddfe00ce268:documentation/backlog/ROADMAP.md| | **R-102** | **Tier-2 writes a fullrecovery-unit/mirror on every run and no code path reads it.** | **MOVED 2026-08-22 -> OPEN-ITEMS.md** (was: READY — 2026-07-28) | full text:git show fddfe00ce268:documentation/backlog/ROADMAP.md| | **R-103** | **The Tier-2 no-coverage refusal names the working action but does not route to it.** Shipped in v0.183.0. | **MOVED 2026-08-22 -> OPEN-ITEMS.md** (was: READY — 2026-07-28) | full text:git show fddfe00ce268:documentation/backlog/ROADMAP.md| | **R-104** | **An interrupted offsite run leaves an exclusive restic lock the existing self-heal cannot reach.** | **MOVED 2026-08-22 -> OPEN-ITEMS.md** (was: READY — 2026-07-28) | full text:git show fddfe00ce268:documentation/backlog/ROADMAP.md| | **R-105** | **Three hub-held DR records are empty on the entire live fleet.** | **MOVED 2026-08-22 -> OPEN-ITEMS.md** (was: READY — 2026-07-28) | full text:git show fddfe00ce268:documentation/backlog/ROADMAP.md| | **R-106** | **~~The DR recipe records the PBS namespace as"root"on every box~~** Shipped in v0.118.1. | **SHIPPED** — agent v0.118.1, 2026-07-30 | full text:git show fddfe00ce268:documentation/backlog/ROADMAP.md| | **R-107** | **No offsite action unpacks the named-volume tars Tier-3 captures on every run.** | **MOVED 2026-08-22 -> OPEN-ITEMS.md** (was: READY — 2026-07-28) | full text:git show fddfe00ce268:documentation/backlog/ROADMAP.md| | **R-108** | **~~Network storage can host an app's namespace, and FileBrowser binds a network share at its ROOT — this BLOCK** Shipped in v0.187.0. | **SHIPPED** — controller v0.187.0, 2026-07-30 | full text:git show fddfe00ce268:documentation/backlog/ROADMAP.md| | **R-109** | **~~The DR recipe records no backup target~~** Shipped in v0.118.1, v0.83.0. | **SHIPPED** — agent v0.118.1 + hub v0.83.0, 2026-07-30 | full text:git show fddfe00ce268:documentation/backlog/ROADMAP.md| | **R-27** | **Customer-facing self-bind page (R-21 slice C follow-on).** Shipped in v0.62.0, v0.66.0. | **SHIPPED (slice 1, hub v0.66.0, 2026-07-17)** | full text:git show fddfe00ce268:documentation/backlog/ROADMAP.md| | **R-25** | **Device-node TOCTOU hardening (drive init).** Shipped in v0.141.0. | **MOVED 2026-08-22 -> OPEN-ITEMS.md** (was: idea) | full text:git show fddfe00ce268:documentation/backlog/ROADMAP.md| | **R-24** | **Guest RAM resize (live) — SHIPPED (agent v0.90.0 + controller v0.143.0, 2026-07-17).** Shipped in v0.143.0, v0.90.0. | **SHIPPED + PROVEN-LIVE** | full text:git show fddfe00ce268:documentation/backlog/ROADMAP.md| | **R-13** | **OOB management arc: dual-use existing WireGuard + hub desired-state channel as mutual-repair** Shipped in 10.77.0, v0.59.0, v0.89.0. | **first slice PROVEN-LIVE (poke channel)** | full text:git show fddfe00ce268:documentation/backlog/ROADMAP.md| | **R-28** | **Agent fast-tick-until-first-convergence — SHIPPED (agent v0.90.0, 2026-07-17).** Shipped in v0.90.0. | **SHIPPED** | full text:git show fddfe00ce268:documentation/backlog/ROADMAP.md| | **R-73** | **SMART history / trending (hub-side) — SUPERSEDED by the phased disk-health arc; see R-330 (Phase 2) and R-331 (Phase 3)** Shipped in v0.215.0. | **partly SHIPPED** | full text:git show fddfe00ce268:documentation/backlog/ROADMAP.md| | **R-75** | **Catalog-derived userdata skeleton + import surfaces** Shipped in v0.172.0. | **SHIPPED (controller v0.172.0 + catalog, 2026-07-26)** | full text:git show fddfe00ce268:documentation/backlog/ROADMAP.md| | **R-77** | **Endpoint-drift detection, samba protected-set gate, channel log honesty** Shipped in 169.254.253, v0.173.0, v0.74.0. | **SHIPPED (controller v0.173.0 + hub v0.74.0, 2026-07-26)** | full text:git show fddfe00ce268:documentation/backlog/ROADMAP.md | | **R-78** | **local_apiauthority ruling — auto-reconcile vs detect-only** | **MOVED 2026-08-22 -> OPEN-ITEMS.md** (was: idea (deferred OUT of R-77 on purpose)) | full text:git show fddfe00ce268:documentation/backlog/ROADMAP.md | | **R-79** | **report.Issues/report.Warningsare English on customer-facing surfaces** | **MOVED 2026-08-22 -> OPEN-ITEMS.md** (was: idea) | full text:git show fddfe00ce268:documentation/backlog/ROADMAP.md | | **R-80** | **expected_backup_missedfalse alarm — diagnosed + class-fixed** Shipped in v0.75.0. | **SHIPPED (hub v0.75.0, 2026-07-26)** | full text:git show fddfe00ce268:documentation/backlog/ROADMAP.md| | **R-81** | **"No signal" is not "bad signal" — anchor the backup deadline check** Shipped in v0.12.0, v0.73.0, v0.75.0. | **SHIPPED (hub v0.75.0, 2026-07-26)** | full text:git show fddfe00ce268:documentation/backlog/ROADMAP.md| | **R-82** | **The backup target split — local daily + offsite weekly** Shipped in 1.20.0, v0.100.0, v0.101.0. | **SHIPPED (agent v0.102.0 + controller v0.175.0 + hub v0.76.0 + host-install 1.20.0, 2026-07-26)** | full text:git show fddfe00ce268:documentation/backlog/ROADMAP.md| | **R-83** | **Ratify or retire07-backup-architecture.md** | **DISCHARGED (2026-07-26) — brought current, NOT ratified** | full text: git show fddfe00ce268:documentation/backlog/ROADMAP.md| | **R-84** | **The agent's cold backupStoreno longer causes a redundant backup** Shipped in v0.103.0. | **SHIPPED (agent v0.103.0, 2026-07-26)** | full text:git show fddfe00ce268:documentation/backlog/ROADMAP.md| | **R-85** | **The DR tier must be restore-tested UNATTENDED, and its failure must be HEARD** Shipped in v0.104.0, v0.77.0. | **Code SHIPPED (agent v0.104.0 + hub v0.77.0, 2026-07-27); rotation NOT YET OBSERVED LIVE** | full text:git show fddfe00ce268:documentation/backlog/ROADMAP.md| | **R-86** | **Backup-ALIGNED restore-test scheduling — test a tier ~1 day after ITS OWN backup** Shipped in v0.121.0, v0.91.0. | **CLOSED — SHIPPED + PROVEN-LIVE 2026-08-03 (agent v0.121.0 + hub v0.91.0)** | full text:git show fddfe00ce268:documentation/backlog/ROADMAP.md| | **R-88** | **An UNREACHABLE backup target reads as "no backup exists" → the agent fires a doomed backup at it** Shipped in 10.77.0, v0.176.0. | **Part 1 SHIPPED (controller v0.176.0, 2026-07-27); Part 2 OPEN (agent wire change)** — **Part 1** added the failure breaker: consecutive failures tracked per TARGET, backoff15m→30m→1h→2h→4hcapped | full text:git show fddfe00ce268:documentation/backlog/ROADMAP.md| | **R-89** | **Retention is a COMMERCIAL attribute — it belongs to the hub, not to ep0 or a box** | idea — operator ruling 2026-07-27, first increment SHIPPED same day | full text:git show fddfe00ce268:documentation/backlog/ROADMAP.md| | **R-97** | **The whole-guest backup tier has NO failure signal to the hub —internal/quiescenever notifies** Shipped in v0.164.0, v0.177.0, v0.78.0. | **SHIPPED (controller v0.177.0 + hub v0.78.0, 2026-07-27)** — **R-97a:**quiesce.TierNotifier, a seam (not an import) wired by an init-only setter, edge-triggered on the R-88 breaker ARMING so a fai | full text: git show fddfe00ce268:documentation/backlog/ROADMAP.md| | **R-94** | **~~A hand-synced version constant drifts, and the gate that would catch it is never run~~** Shipped in 9.9.9, v0.87.0. | **CLOSED — SHIPPED hub v0.87.0, 2026-08-02** | full text:git show fddfe00ce268:documentation/backlog/ROADMAP.md | | **R-110** | **mainis the installer's publish channel — there is no staging** Shipped in 1.22.0, v1.23.0. | **CLOSED — SHIPPED 2026-08-03** (installer v1.23.0)./scripts/syncsinstaller-v1.23.0; the website still tracks main. Proven by HTTP: a push to mainleft the served bytes byte-identical, movi | full text:git show fddfe00ce268:documentation/backlog/ROADMAP.md | | **R-128** | **ISO_VERSION"aligns with SCRIPT_VERSION" was a comment nothing evaluated** Shipped in v1.26.0. | **CLOSED — iso v1.26.0, 2026-07-31** | full text:git show fddfe00ce268:documentation/backlog/ROADMAP.md | | **R-154** | **[first-boot]is automated-install-only, and nothing in the tree said so** Shipped in v1.26.0. | **CLOSED — iso v1.26.0, 2026-07-31** | full text:git show fddfe00ce268:documentation/backlog/ROADMAP.md | | **R-155** | **iso-repack.shrefused any ISO withoutauto-installer-mode.toml** Shipped in v1.26.0. | **CLOSED — iso v1.26.0, 2026-07-31** | full text: git show fddfe00ce268:documentation/backlog/ROADMAP.md| | **R-156** | **An app's data is neither persisted nor backed up, and it reports healthy** | **CLOSED — all three apps fixed, 2026-08-03.** papra's template now mountspapra_data:/app/app-data(the app's own data ROOT, chosen over reconfiguring three env vars so a future upstream path canno | full text:git show fddfe00ce268:documentation/backlog/ROADMAP.md | | **R-157** | **bootrecon's start-ONCE sweep misses the boot orphan it exists to recover** Shipped in v0.189.0, v0.190.0. | **CLOSED — SHIPPED + PROVEN-LIVE (v0.189.0 + v0.190.0, 2026-08-02)** | full text: git show fddfe00ce268:documentation/backlog/ROADMAP.md| | **R-170** | **The drive-backed boot gate infers a Stop from a container count** Shipped in v0.190.0. | **CLOSED — SHIPPED + PROVEN-LIVE (v0.190.0, 2026-08-02)** | full text:git show fddfe00ce268:documentation/backlog/ROADMAP.md| | **R-171** | **The boot sweep started apps whose data drive was ABSENT** Shipped in v0.189.0, v0.190.0. | **CLOSED — SHIPPED + PROVEN-LIVE (v0.190.0, 2026-08-02)** | full text:git show fddfe00ce268:documentation/backlog/ROADMAP.md| | **R-166** | **App state gets a desired/observed model with its own store** Shipped in v0.189.0. | **SHIPPED + PROVEN-LIVE — controller v0.189.0, 2026-08-02** | full text:git show fddfe00ce268:documentation/backlog/ROADMAP.md| | **R-158** | **~~A local Tier-1 backup failure reaches no hub channel~~** Shipped in v0.191.0, v0.89.0. | **SHIPPED — controller v0.191.0 + hub v0.89.0, 2026-08-02** | full text:git show fddfe00ce268:documentation/backlog/ROADMAP.md| | **R-167** | **~~Storage monitoring and backup alerts (decision D-c)~~** Shipped in v0.191.0, v0.89.0. | **SHIPPED — controller v0.191.0/.1/.2 + hub v0.89.0, 2026-08-02** | full text:git show fddfe00ce268:documentation/backlog/ROADMAP.md| | **R-165** | **~~Mergemp1intomp0— the dedicated backup partition stops existing (decision D-a)~~** Shipped in v0.120.0, v0.192.0, v0.193.0. | **CLOSED — PROVEN-LIVE 2026-08-03.** Variant V-c shipped (golden v3.0.0 + agent v0.120.0 + controller v0.192.0); both demo boxes reinstalled and proven end to end (R-178). **Its stated replacement for | full text:git show fddfe00ce268:documentation/backlog/ROADMAP.md | | **R-159** | **wishlist's data landed in an ANONYMOUS volume — never backed up, orphaned by a redeploy** | **SHIPPED** (templates/wishlist/, 2026-08-02) — filed for the CLASS | full text: git show fddfe00ce268:documentation/backlog/ROADMAP.md | | **R-160** | **gramps-web persisted three paths and wrote to none of them** | **SHIPPED** (templates/gramps-web/, 2026-08-02) | full text: git show fddfe00ce268:documentation/backlog/ROADMAP.md| | **R-161** | **The volume-persistence gate is enforced by convention, not automatically** | **RULED + SHIPPED at reduced scope** (operator, 2026-08-02;app-catalog fd7747d) | full text: git show fddfe00ce268:documentation/backlog/ROADMAP.md | | **R-163** | **mp1is RETENTION, not staging — and it is sized as if it were neither** Shipped in v3.0.0. | **SUPERSEDED 2026-08-22 — the register records CLOSED by R-165 (golden v3.0.0, 2026-08-03): the ceiling this row describes no longer exists** (was:**WAITING-ON-OPERATOR** — the ratio is a tier-sizing | full text:git show fddfe00ce268:documentation/backlog/ROADMAP.md| | **R-90** | **ep0 has 3.8 GB and NO swap — it OOMs under a restore-test, and that gates R-86** | **CLOSED 2026-08-03 — the operator rescaled ep0 to a CX33.** MEASURED on the box, not read from an invoice:Mem: 7757MB (**8 GB**, was 3.8),nproc**4**, and the 4 GiB swapfile added 2026-07-27 * | full text:git show fddfe00ce268:documentation/backlog/ROADMAP.md| | **R-96** | **Two standing rules were agreed in chat and never committed** | **MOVED 2026-08-22 -> OPEN-ITEMS.md** (was: idea — found 2026-07-27) | full text:git show fddfe00ce268:documentation/backlog/ROADMAP.md| | **R-76** | **FileBrowser-created folders break the setgid chain, and a drop-zone's mode is not stable** Shipped in 1.3.3. | **MOVED 2026-08-22 -> OPEN-ITEMS.md** (was: idea (surfaced by the R-75 spike, 2026-07-26)) | full text:git show fddfe00ce268:documentation/backlog/ROADMAP.md| | **R-21** | **Bare-metal Felhom ISO** Shipped in 0.92.1, v0.62.0, v1.18.0. | **SHIPPED + PHYSICALLY CLOSED (slices A+B+C; rehearsal executed 2026-07-18)** | full text:git show fddfe00ce268:documentation/backlog/ROADMAP.md| | **R-168** | **~~CI: no runner exists, and with trunk-based pushes CI can DETECT but not BLOCK~~** | **CLOSED — SHIPPED 2026-08-02** | full text:git show fddfe00ce268:documentation/backlog/ROADMAP.md| | **R-37** | **Post-RESET health card shows stale pre-RESET warnings.** Shipped in v0.67.0. | **SHIPPED (hub v0.67.0, 2026-07-18)** | full text:git show fddfe00ce268:documentation/backlog/ROADMAP.md| | **R-38** | **Installer GRUB slice.** Shipped in v1.21.0, v1.22.0. | **SHIPPED (scripts v1.22.0, 2026-07-19)** | full text:git show fddfe00ce268:documentation/backlog/ROADMAP.md| | **R-40** | **[P2-HIGH] The update path cannot express a MULTI-HOP major upgrade.** | **MOVED 2026-08-22 -> OPEN-ITEMS.md** (was: idea) | full text:git show fddfe00ce268:documentation/backlog/ROADMAP.md| | **R-42** | **RULED: sidecar majors follow the APP, never the newest tag.** | **RULED 2026-07-21 — option (a)** | full text:git show fddfe00ce268:documentation/backlog/ROADMAP.md| | **R-43** | **[P2-HIGH] No offsite restore path can restore a database — offsite restore cannot reconstitute a DB-indexed app.** Shipped in v0.148.0. | **SHIPPED controller v0.148.0 (2026-07-19) — live acceptance PENDING** | full text:git show fddfe00ce268:documentation/backlog/ROADMAP.md| | **R-44** | **[P2-HIGH] A manual offsite push ships an unrefreshed DB dump — "backed up now" is false for the DB half.** Shipped in v0.148.0. | **SHIPPED controller v0.148.0 (2026-07-19)** | full text:git show fddfe00ce268:documentation/backlog/ROADMAP.md| | **R-47** | **[P2-HIGH] The DB replay races the application's own schema repair.** Shipped in 0.153.0, 0.90.0, v0.153.0. | **SHIPPED — controller v0.153.0, 2026-07-20** | full text:git show fddfe00ce268:documentation/backlog/ROADMAP.md| | **R-49** | **[P2] The offsite capture set is ~90% cache and duplication — 1.1 GB of a 1.2 GB immich "photo backup".** | **MOVED 2026-08-22 -> OPEN-ITEMS.md** (was: idea) | full text:git show fddfe00ce268:documentation/backlog/ROADMAP.md` |