felhom.eu/STATUS.md

# STATUS — what works, what's broken, what's next

**Updated 2026-08-12 (night — the door, part one).**

> **A view, not a source.** `documentation/backlog/OPEN-ITEMS.md` is the authority; this page restates
> part of it in plain words, and **nothing may exist only here**. **Items, not paragraphs. One screen.**
> If it does not fit, it belongs in the register instead.

## Waiting on you

*(Vouched and delivered 2026-08-12 night: golden **0.214.0**, agent **0.129.0**, min agent **0.129.0**,
floor **0.214.0**. **Both demo machines are now on controller 0.214.0 + agent 0.129.0** — checked on the
boxes, not assumed. The safety guard was watched doing its job on the way: `demo-hp` was **held** at
0.213.0 while its agent was still 0.128.0 (*"agent 0.128.0 < MinAgent 0.129.0 — controller floor
withheld"*), and took the update 6 seconds after the agent caught up. That guard exists because a box
once landed on a controller newer than its agent and a customer was told a correct recovery code was
wrong; this is the first time it has been seen firing.)*

- **R-312 — one decision, and it is the interesting one.** The customer is now told the truth about an
  older code, but there is still no button: restoring from a set-aside copy means either threading an
  alternative location through the restore code, or adopting that copy as the machine's current one.
  The second is a different product decision. **Nothing is broken while this waits.**
- **R-313 — the copy you told me to keep cannot be opened by anyone.** `demo-felhom`'s set-aside store
  holds 36 snapshots and one key, and that key was destroyed by the bug we fixed on 4 August. Keeping
  it is still the right call; it should be a decision, not an accumulation.
- **R-303 — one coherence decision**, ranked low: a box can still raise the "we cannot open your new
  backups" card while counting down to deleting the old ones. The two no longer contradict each other,
  but the state is odd and the wrong fix would hide a real second fault.

## What works

Both demo machines are home, healthy and reporting on the approved pair — **controller 0.214.0, agent
0.129.0**, delivered by the floor rather than by hand. Off-site is credentialed on `demo-hp` and its
repository still opens with the machine's own key. `drill-r50` is reverted to `virgin`, powered off.

## Shipped

- **The drive can be re-attached after a reinstall** (R-280). The restore page said *"this is two
  clicks"* over an empty list; it was zero clicks and needed an internal path no customer could produce.
- **The orphan card stops promising** that set-aside off-site copies can be reopened — twice over
  (R-294, then **R-299**, which was the same claim in the plural, in the *always-visible* half, missed
  because the guard matched one inflection of a Hungarian verb).
- **The countdown banner stops promising retrieval it cannot see is still true** (R-302). The promise
  is now conditional on the hub still holding the package it held when the customer decided — pinned
  then, compared now. A sweep found the same claim in five places; a fourth was fixed with it and a
  fifth deliberately left, because it is true where it renders.
- **One name per secret, box side** (R-295): the dashboard code is „Beállító kód" everywhere;
  „Visszaállító kód" is retired. It collided with the escrow „Helyreállítási kód" and cost a real code.
- **A correct recovery code is no longer called wrong** (R-311, three components). If a customer types
  the code for an older set of backups, the machine now checks the packages we kept, recognises it, and
  says so: *your code is correct, it belongs to an earlier package, we kept it, your current backups are
  fine, write to us*. It deliberately promises no restore, because there is no button yet.
- **The countdown on `demo-felhom` is cancelled** on your ruling (R-307). Nothing was deleted; the
  24 August deadline is gone. See R-313 for what that copy turns out to be.
- **Both installer fixes are now PUBLISHED** as `installer-v1.27.0` (R-297 + R-300). Each fault was
  watched happening first, on a machine reset to factory state: the old installer really did build a
  machine on a base image from July, and our own uninstall really did block our own next install.

## Broken, or knowingly incomplete

- **The tester's machine has no recovery route at all** — see the `PETI` row. Its host record was
  deleted on 15 July; there is no key, no off-site copy and no local backup. **If that drive fails,
  everything on it is lost.** First act of the visit: copy the ~3.6 GB off before anything is
  reinstalled — it is currently the only copy in existence. Whether it stays parked is your call and is
  deliberately left open.
- **Kept backups can be opened — but still only by us** (R-304 partly closed, R-312 open). The machine
  now recognises an older code and says so plainly instead of hedging. What it still cannot do is hand
  the customer their old files: that needs the restore code to accept a second location, which is real
  work rather than wiring. Today the honest answer is "your code is right, write to us" — and we can.
- **The dnsmasq fix helps a machine once** (R-305). On a machine that never had Felhom it works. On the
  second reinstall the leftover comes back, because the package is never removed — so the machine looks,
  to our own installer, as if the household had installed it. Watched happening the same afternoon.
- **The hub half of the naming is undone** (R-295 PARTIAL): the emails still use the retired name and
  send people to a page a rebuilt machine does not show.
- **The storage page has its own separate reason for showing an empty list** (R-298), untouched.

## Working on next

R-312's shape (the button, or deliberately no button); then R-305, because the tester's second
reinstall still hits the dnsmasq wall; then the hub naming; then the 2026-08-09 batch
(R-279 … R-292), still untriaged against everything since.