felhom.eu/documentation/backlog/ROADMAP.md

ROADMAP — future features & open work

What this is: the prioritized decision log of planned/open work. Items are intentions, not claims about live behavior — the capability map (architecture/00-capability-map.md) is the only place that states what the platform does today.

Lifecycle: idea → spiked → spec'd → in-progress → shipped (item collapses to a one-liner with the version, and the corresponding capability-map row changes status with evidence). Items can also be killed (keep the one-liner + why — decisions are worth remembering).

Coupling rule: every item names the capability-map row(s) it flips. Every map gap row points back here by ID. Neither file duplicates the other's content.

Priorities: P1 = closed-alpha blocker · P2 = close during alpha · P3 = post-alpha. Existing loose notes in this folder (FOLLOWUP-*, FIX-M*) are absorbed as references below.

---

P1 — closed-alpha blockers

ID	Item	Size	Status	Notes / map rows flipped
R-1	Peti convergence: clean-slate proxmox2 reinstall (spec'd 07-15), first live auto-confirm, supervised escrow ceremony, execute parked publish trains (agent 0.81→0.88, controller → 0.137)	L	spec'd	Flips: publish train PARTIAL→PROVEN-LIVE; appliance/BYO/day-0 "real customer" notes; escrow ceremony. The single biggest unproven surface — an alpha where fixes can't ship remotely is dead
R-2	Resolve ~215 lines of foreign WIP in felhom.eu clone (hub/internal/notify/, store.go, hub/internal/claim/)	S	open	Unknown uncommitted code in the repo that builds the hub; commit, stash-archive, or discard — but decide
R-3	Friend-alpha onboarding runbook (generalized from pilot/RUNBOOK-peti-return-2026-07-13): hardware prep → golden → install → claim → ceremony → "first restore by the customer" scripted step	M	idea	Flips: "customer performs a restore" MISSING row; produces the tester-agreement sibling of PETI-tester-agreement.md
R-4	Claim-code deliverability: test-send to gmail.com / freemail.hu / citromail.hu / t-online.hu; tighten DMARC p=none → p=quarantine (pending since email.md 02-04)	S	idea	A claim code in spam bricks onboarding at step 1. Cheap, do before first invite

P2 — during alpha

ID	Item	Size	Status	Notes
R-5	Hub: Storage Box box-level aggregate — total BX11 fill, Σ(customer soft quotas), oversubscription ratio, operator alert threshold	M	idea	Per-customer OffsiteChecker exists (hub v0.41). Source: Hetzner Storage Box API (verify Robot-legacy vs. new API endpoint for our box before speccing — 2025 migration); NOT ssh du over restic repos. Token → k8s Secret ref. Flips map row G/MISSING
R-6	Spike: LAN service discovery from the guest — SSDP multicast (UDP 1900, DLNA), WSD (Windows discovery), mDNS; host-network vs macvlan; is the customer LXC LAN-bridged in appliance deployments?	M	idea	Shared prerequisite for R-7 + R-8. Spike-first: the traps are networking, not Samba/DLNA
R-7	SMB server share (gated on R-6): samba + wsdd, LAN-only binding (never tunnel), user model (single household user first), which roots are shared (dedicated shares/ vs app userdata — every SMB-writable path needs a backup class), uid-1000 convention, paperless consume flow	L	idea	Flips map row E/MISSING. Alpha-relevant: "my box is a NAS" is a core household expectation
R-8	DLNA (gated on R-6): validate Jellyfin's built-in DLNA server first; only add minidlna to the catalog if Jellyfin-DLNA fails	S	idea	Don't add catalog weight before proving the cheap path
R-9	Uninstaller trio (from 07-15 Peti session): cluster-aware felhom_guests guard (node-local pct list deletes cluster-wide pveum objects); saferemove detection + time estimate + opt-in --quick-remove (never mutate storage.cfg); smarter restore_storage default for BYO clusters (shared storage, not local-lvm)	M	idea	Second item's rejected alternative (temp-disable-and-restore) stays rejected — crash window silently downgrades cluster wipe policy
R-10	T-6E-1: DB-dump dir-fsync asymmetry (LOW, confirmed in 6E)	XS	idea	One-line hardening; batch with the next controller task
R-11	Tester-facing one-pager: what the box does, known limitations, how to report (channel decision: Messenger group?)	S	idea	Pairs with R-3
R-16	Operator hygiene: campaign6 autofs orphan (clears on host reboot) + tied-CreatedAt flash duplicates (audiobookshelf/komga/romm)	XS	open	Viktor's own action items from 6D/6E
R-17	Old-box archive (u629193-sub1) retirement decision — 9/9 byte-identical restores verified	XS	awaiting-decision	Viktor ruling
R-19	Internet-outage customer-experience drill: pull WAN on demo, verify lan_resolver path, document what the customer actually sees/does	S	idea	Flips map row E "LAN access" IMPLEMENTED→PROVEN-LIVE
R-20	Verify operator-key pinning is fully in the day-0 install flow (GL-4 folded plumbing in; confirm no manual step remains)	XS	verify	If a manual step remains, promote to a task

P3 — post-alpha

ID	Item	Size	Status	Notes
R-12	Cluster mode: agent-follows-guest, bind-mount reconciliation on HA migration	XL	idea	Scoped 07-15; interim = HA-group pin to one node. Driven by Peti's two-node cluster
R-13	OOB management arc: dual-use existing WireGuard + hub desired-state channel as mutual-repair	L	idea
R-14	Headscale/WireGuard spike: Minecraft/gaming port connectivity (CGNAT-proof, sovereign DERP fallback)	M	idea
R-15	Multi-user dashboard accounts (household members, roles)	L	idea	Single password is a stated alpha limitation (R-11)

Absorbed / superseded notes in this folder

• FOLLOWUP-nas-automount-guest-reboot-reassert.md — shipped (agent v0.84/v0.85, CAMPAIGN-3); keep for history
• FOLLOWUP-golden-default-controller-tag.md — verify against current golden flow; close or promote to an item
• FIX-M18-NOTES.md, FIX-M19-NOTES.md, DIAGNOSIS-f9-storage-registration-gap-2026-06-14.md — historical diagnoses; superseded by shipped fixes