felhom.eu/documentation/audits/backlog-triage-2026-10-03/RECOMMENDATION.md

# What to work on next — backlog triage, 2026-10-03

## In one screen

- **The open list is now readable.** It went from 442 rows to 326. It went from 824 KB to about 540 KB.
- **Every open row has one category and one severity.** Two gates refuse a row without them, and refuse a
  finished row left in the open list.
- **No row is P1.** Nothing in the list is harm that happens today on shipped code. 27 rows are P2 (must be done
  before the first paying customer).
- **You decide one thing:** which theme starts next. Recommendation: **off-site backup safety**. The other
  option: **box system security updates**. Details are in "The decision" below.

## Headline numbers (before → after)

| | before | after |
|---|---|---|
| rows in the open list (`OPEN-ITEMS.md`) | 442 with an id + 22 without | 326, all with an id |
| size of the open list | 824 KB, 932 lines | ≈540 KB |
| finished rows moved to `CLOSED-ITEMS.md` | — | 125 with an id + 20 without |
| rows marked VERIFY (may be finished; not proven) | — | 11 |
| rows with no severity | the reviewer counted ~182 | 0 |
| new rows filed this session | — | 11: R-812, R-813 (findings beside two roadmap items), R-814, R-815 (old July watches that had no id), R-816 to R-819 (gaps found while sorting), R-50b (a finding that lived only in the roadmap) |
| roadmap (`ROADMAP.md`) | 161 lines, 81 KB | 124 lines, 42 KB |

**Open rows, category × severity** (no P1 anywhere):

| Category | P2 | P3 | P4 | total |
|---|---|---|---|---|
| Install & onboarding | 2 | 11 | 5 | 18 |
| Apps & catalog | 0 | 15 | 21 | 36 |
| App updates | 0 | 12 | 7 | 19 |
| Backup & restore | 12 | 24 | 20 | 56 |
| Storage & devices | 0 | 7 | 5 | 12 |
| Security & access | 3 | 23 | 3 | 29 |
| Box system & updates | 3 | 11 | 3 | 17 |
| Monitoring & notifications | 2 | 16 | 6 | 24 |
| Hub & operator | 1 | 7 | 13 | 21 |
| Business & legal | 4 | 0 | 3 | 7 |
| Process & tooling | 0 | 4 | 83 | 87 |
| **total** | **27** | **130** | **169** | **326** |

## The top 29 — every P2, open list and roadmap together

Order: severity first, then "a household meets it", then cost (small first). Size: XS < S < M < L.

| # | ID | Category | Size | Household meets it? | What is wrong or missing |
|---|---|---|---|---|---|
| 1 | R-508 | Install & onboarding | XS | yes | The hub does not warn when a customer who waits for a box has no e-mail address. |
| 2 | R-509 | Install & onboarding | XS | yes | A new box for an existing customer may not send the connect e-mail. Fix shipped; never seen live (VERIFY). |
| 3 | R-604 | Box system & updates | S | yes | A per-customer version floor can keep one box out of every fleet update, silently. |
| 4 | R-784 | Business & legal | S | yes | SparkyFitness forbids commercial use; the author's written permission is needed. |
| 5 | R-789 | Business & legal | S | yes | Tandoor's licence may forbid selling a service built on it; the authors' permission is needed. |
| 6 | R-342 | Backup & restore | S | yes | Nothing protects the off-site backup data if maintenance on that server goes wrong. |
| 7 | R-813 | Business & legal | S | yes | The website collects personal data but has no privacy notice, no terms and no imprint. |
| 8 | R-243 | Monitoring & notifications | M | yes | A box that waits for its recovery key stops off-site backups, and nobody is told. |
| 9 | R-95 | Backup & restore | M | yes | A box can delete its own off-site backups, and no older copy can be read back today. |
| 10 | R-436 | Backup & restore | M | yes | The provider's "append-only" lock (a box may add but not delete) is untested. **Its check is due 2026-10-06.** |
| 11 | R-726 | Backup & restore | M | yes | A returning customer's new box makes no off-site backup until someone presses a hidden reset. |
| 12 | R-366 | Backup & restore | M | yes | After a reinstall the box cannot read its older whole-machine backups, and it reads as a test failure. |
| 13 | R-32 | Backup & restore | M | yes | Resetting a customer leaves their old encrypted off-site data behind, unseen and uncounted. |
| 14 | R-105 | Backup & restore | M | yes | Two records a whole-box recovery needs may still be empty on the hub; not checked again. |
| 15 | R-518 | Backup & restore | M | yes | "Back up now" stops every app for minutes while a slow second backup runs. |
| 16 | R-519 | Backup & restore | M | yes | After an interrupted backup, a restore point shows a newer time than its files. |
| 17 | R-638 | Backup & restore | M | yes | Restoring a database copy from before an update can fail on top of the newer database. |
| 18 | R-528 | Monitoring & notifications | M | yes | An app killed for lack of memory is often not reported. |
| 19 | R-777 | Security & access | M | yes | Emby and Jellyfin treat internet visitors as home-network visitors and skip their remote limits. |
| 20 | R-304 | Backup & restore | L | yes | A household's correct recovery code for old backups is rejected as wrong. |
| 21 | R-812 / R-808 | Box system & updates | L | yes | Nothing ever installs operating-system security updates on a box (host, guest, Docker engine). |
| 22 | R-809 | Business & legal | M | yes | Contract, data-processing agreement, billing and invoicing do not exist yet. |
| 23 | R-135 | Security & access | S | no | The hub skips its forged-request check when no session cookie is sent. |
| 24 | R-802 | Business & legal | M | no | A lawyer must review the list of non-open-source licences. |
| 25 | R-133 | Security & access | M | no | Every copy of the hub database holds every box's root console password in readable form. |
| 26 | R-173 | Hub & operator | M | no | The hub database, which holds recovery secrets for every box, has no scheduled backup. |
| 27 | R-530 | Box system & updates | M | no | Host agents update only by a signed job per box, and nothing lists which boxes are behind. |
| 28 | R-232 | Backup & restore | L | no | The server that runs the hub keeps all its backups on itself, nothing off-site, and a failure alerts nobody. |

(R-808 and R-812 are one item: the roadmap intention and its finding. 28 lines, 29 rows.)

## Five work themes (about one session each)

1. **Off-site backup safety** — R-436, R-95, R-342, R-243, R-726, R-366, R-32, R-105, R-304. The household's
   files and photos sit in the tier whose credential can delete. Start with R-436's measurement (due 2026-10-06),
   then the cheapest step that stops a box deleting its own history.
2. **Box system security updates** — R-812 / R-808, R-604, R-530. A spike first (what the agent may run, what a
   half-done update leaves), on a throwaway box. Nothing exists today.
3. **The hub's own safety** — R-133, R-135, R-173, R-232. Operator-side; no household meets it directly, but a hub
   loss or leak touches every box. R-232 is on DooPlex, which needs an operator word before anyone touches it.
4. **Honest backup and app behaviour** — R-518, R-519, R-638, R-528, R-777, R-508, R-509. Smaller items a
   household meets; good for a session after theme 1.
5. **Business and legal** — R-809, R-813, R-784, R-789, R-802. **Yours**, not a CC session. CC drafts a text when
   you ask. It can run beside any other theme.

## The decision

**Which theme does the next session start with?**

| | A — Off-site backup safety (recommended) | B — Box system security updates |
|---|---|---|
| What it does | Measures the provider's append-only lock (R-436), then closes the biggest data risk: a box that can delete its own off-site history (R-95). | A spike on a throwaway box: what update path is safe for host, guest and Docker engine. Then a design. |
| What it costs | One session. Touches the off-site test account, never a customer's data. | One spike session plus a later build session. Touches only a Tier-0 box. |
| Why | The largest data risk the list has ranked first since July. The household's own files sit there. | Boxes stay in homes for years. Today they never receive a security patch. |
| If you decide nothing | On 2026-10-06 the dated check turns red and refuses every push to this repo until the measurement is done or the date is moved. | Boxes keep the packages they were installed with. Nothing breaks this week; the risk grows every month. |

**My pick: A.** It has a hard date in three days, it guards the household's data, and it needs no new mechanism.
B is next.

## Rows that wait on you (18)

R-132 (change the hub password), R-169, R-210, R-503, R-504, R-508, R-526, R-530, R-719, R-769, R-770, R-771, R-779,
R-784, R-789, R-802, R-804, R-813. The P2 ones are in the top list above. Each row says what it needs from you.

## Rows marked VERIFY (11) — may already be finished; nobody proved it

R-274, R-282, R-284, R-287, R-509, R-527, R-602, R-621, R-814, R-815, R-817. Each carries, at the start of its state,
what suggests it is finished and the evidence pointer. Close one only after checking it against live source.