admin
c102832892
gates / gates (push) Successful in 8s
- OPEN-ITEMS: R-86 CLOSED with the trap in its own wording recorded (the literal reading is never true on a daily tier); R-87 re-ranked UP because R-86 built most of what it waited for; R-185 (the agent cannot list demo-felhom's host backup tier — a missing storage ACL, pre-existing), R-186 (a released binary's sha is not reproducible from its tag), R-187 (R-115's publish leg had never actually run) filed. R-184 was the highest ID in use. - ROADMAP: R-86 collapsed, keeping the reasoning and correcting the shape the row itself proposed — which would have been the never-fires version. - 07-backup-architecture: new contract section — restore-testing is per ARCHIVE GENERATION, with the trap and what did not change (S-1). - 00-capability-map: the unattended restore-proof row upgraded to PROVEN-LIVE on the 635 s due-triggered offsite run, with the restart and teardown evidence. - CONTEXT: S-17 (the rule, the trap, the config key, the hub's derivation) and S-18 (ep0 is Tier 2 — extends D-d's protected list to three machines). Numbered 17/18 because S-14 and S-15 were already duplicated in the file. - STATUS: rewritten for the operator, trimmed back to one screen.
86 lines
5.6 KiB
Markdown
86 lines
5.6 KiB
Markdown
# STATUS — what works, what's broken, what's next
|
|
|
|
**Updated 2026-08-03.**
|
|
|
|
> **A view, not a source.** `documentation/backlog/OPEN-ITEMS.md` is the authority on open work; this
|
|
> page restates part of it in plain words, and **nothing may exist only here**. **Not `CONTEXT.md`**,
|
|
> which is technical state written for Claude Code — keep the two separate. **Maintenance:** update
|
|
> at the end of every session in which something shipped, broke, or was decided. One screen; cut
|
|
> items rather than extend it.
|
|
|
|
## What works right now
|
|
|
|
A blank machine boots the Felhom disc, installs itself unattended, and is claimed by the customer,
|
|
who sets their own password. They install apps from a catalogue of fifty-three, share files over the
|
|
home network, and open apps from a launcher or a shared link. Backups run on their own to three
|
|
places — the machine's drive, a second drive, and an encrypted off-site copy — and a customer can
|
|
restore files and app data from the drive alone. Apps come back after a power cut: hard-reset the demo
|
|
box six times, everything returned every time, and an app switched off deliberately stayed off.
|
|
Proven end to end on real hardware.
|
|
|
|
## What's broken
|
|
|
|
- **The off-site copy can be erased by the machine that made it.** The credential that writes it can
|
|
also delete it. A daily snapshot is armed as a stopgap, and we have never restored from that copy.
|
|
*(R-95, R-87)*
|
|
- **Nothing else open that affects a customer.** The three faults that were on this list yesterday —
|
|
the reserve watching the wrong step, the last app whose data was never saved, and the alert that
|
|
told you about one app and swallowed the rest — are all fixed and proven on a real machine.
|
|
|
|
## What shipped recently
|
|
|
|
- **Each backup is now proved, instead of the clock being obeyed.** The machine used to re-test a
|
|
backup every twenty-four hours on a timer that restarted whenever the software was updated, so the
|
|
test happened at an arbitrary time and a fresh backup could sit unproven while an old one was
|
|
re-checked. Now a copy is tested once, about a day after it is made, and not again until there is a
|
|
newer one — so the daily copy is proved daily and the weekly off-site copy weekly, each on its own.
|
|
The alert that says "this copy has not been proved lately" learned each copy's own rhythm in the
|
|
same change; without that it would have started complaining every night about a system that is
|
|
working. *(R-86)*
|
|
- **A failed backup now tells you about every app, once.** When several apps fail in one night you get
|
|
**one** email listing all of them, what kind of backup failed for each, why, and how much space is
|
|
left — instead of an email about one app and silence about the rest. Measured before the fix: nine
|
|
failures, two emails. Separately, **every failure is now written down the moment it happens**,
|
|
whether or not it is emailed, and **a message the machine decides not to send now leaves a record
|
|
saying so**. A machine choosing not to tell you and nothing happening no longer look identical.
|
|
A run that finds nothing wrong stays silent, and a backup you trigger yourself always reports.
|
|
*(R-182)*
|
|
- **Publishing became something you do, not something that happens.** The installer that runs as root
|
|
on a new machine, and the agent, both moved onto labelled versions with a way back; a check now
|
|
refuses a release nobody can download. *(R-110, R-115)*
|
|
- **The reserve now guards the step that fills the disk, and its promise is true.** It decides once
|
|
per app, before writing anything, and no longer waves an app through at 96% full. *(R-181)*
|
|
|
|
## What we're working on
|
|
|
|
- **Now:** nothing outstanding.
|
|
- **Next:** proving the off-site *app-data* copy can actually be restored — the one tier nothing
|
|
tests unattended. Most of the machinery it needed arrived with the restore-test change below.
|
|
*(R-87)*
|
|
- **After:** the off-site copy that the machine making it can still erase. *(R-95)*
|
|
|
|
## Waiting on you
|
|
|
|
- **A job, not a decision: the hub password needs changing.** A diagnostic command printed it into a
|
|
session log; nothing suggests anyone else saw it. *(R-132)*
|
|
- **One small question, not urgent.** The automatic check cannot see which version you have told
|
|
machines to install, only which ones exist. Closing that needs either a password given to the build
|
|
server or a check inside the hub itself. *(R-184)*
|
|
- **Nothing else.** The question about whether the off-site endpoint counts as protected is
|
|
**settled — it does**, and the machine list now says so instead of asking.
|
|
|
|
## Changed since last update
|
|
|
|
- **2026-08-03** — Backups are now proved one at a time, each about a day after it is made, instead of
|
|
on a timer; the "not proved lately" alert learned each copy's own rhythm so it does not complain
|
|
about a healthy weekly copy. You settled that the off-site endpoint is protected, and the machine
|
|
list records it. One thing found while testing: on the small demo machine the agent cannot see its
|
|
own local backups at all — a permission that was never granted — so that copy has never been
|
|
test-restored there. Written down, not yet fixed. *(R-86, R-185)*
|
|
- **2026-08-03** — A failed backup now reports every app in one email, and nothing is dropped without
|
|
a record. You rescaled the off-site endpoint to twice the memory, which closed one item and
|
|
unblocked another; the documents describing the old machine were corrected, and the audit records
|
|
of what it used to be were annotated rather than rewritten.
|
|
- **2026-08-03** — Publishing became deliberate for both the installer and the agent, with a way back
|
|
and a check that a release can actually be downloaded.
|