Files

T

admin e994bf35d2 STATUS.md: a plain-language operator page, and today's four decisions recorded

Documentation only — no code, no box, no build.

STATUS.md (repo root, 652 words / 67 lines): what works · what's broken ·
what we're working on · waiting on you · changed since. A VIEW of
OPEN-ITEMS.md, holding nothing of its own; not CONTEXT.md, and both files
now say why they stay separate. No R-n is the subject of a sentence —
identifiers are bracketed pointers only.

CONTEXT.md S-5 records the four operator decisions taken 2026-08-02
(D-a … D-d), none of them implemented:
  D-a merge mp1 into mp0 rather than resize it — before any external
      install, and D-c ships in the same step        → R-165
  D-b desired/observed app state in its own store, with the state-store
      safety rule verbatim                           → R-166 (BLOCKED)
  D-c customer fill warning + operator backup-failure alert → R-167
  D-d only DooPlex and Peti's box are protected      → target-selection.md

R-163 RE-FRAMED, not closed: the sizing question is withdrawn rather than
answered; the row survives as the record of the constraint until R-165
lands. R-156's papra referral RESOLVED — deployed nowhere, so the template
fix strands nothing; the docker ps evidence is recorded with its
provenance and its scope limit.

target-selection.md: two protected machines, everything else disposable.
ep0 is no longer Tier 2 but is not scratch (it holds the only off-premises
copy of real customer data) — flagged for explicit operator confirmation.
The demo-box backup-target fence drops from prohibition to stated cost,
because D-d spends that reference anyway.

CLAUDE.md gains an End-of-session checklist carrying the STATUS.md
maintenance rule and "a finding goes in OPEN-ITEMS.md first".

2026-08-02 14:20:29 +02:00

3.7 KiB

Raw Blame History

STATUS — what works, what's broken, what's next

Updated 2026-08-02.

A view, not a source. documentation/backlog/OPEN-ITEMS.md is the authority on open work; this page restates part of it in plain words, and nothing may exist only here. Not CONTEXT.md, which is technical state written for Claude Code — keep the two separate. Maintenance: update at the end of every session in which something shipped, broke, or was decided. One screen; cut items rather than extend it.

What works right now

A blank machine boots the Felhom disc, installs itself unattended, and is claimed by the customer, who sets their own password. They install apps from a catalogue of fifty-three, share files over the home network, and open apps from a launcher or a shared link. Backups run on their own to three places — the machine's drive, a second drive, and an encrypted off-site copy — and a customer can restore files and app data from the drive alone. Proven end to end on real hardware.

What's broken

After a power cut, an app can stay switched off — and nothing says so. The machine looks for apps that didn't come back, but looks too early and never again. In one case it decides the customer switched it off deliberately, so it isn't even counted as down. (R-157)

The off-site copy can be erased by the machine that made it — the credential that writes it can also delete it. A daily snapshot is armed as a stopgap, and we have never restored from that copy. (R-95, R-87)

Three apps out of fifty-three kept their data where backups never looked. They reported healthy; the data would vanish on the next update. Two are fixed, the third is now clear to fix because it is installed nowhere. (R-156)

Local backups get 20 GB while apps get 50 GB. An app that outgrows the smaller space stops being backed up locally — and the off-site copy is made from the local one, so that stops too. Nothing is lost: the last good copy is kept intact. (R-163)

When that happens, only one page says so — no email, no alert. The page that answers "is this app backed up?" is the one that stays silent. (R-158)

The check that catches this needs a person to remember it. One command, run by hand; nothing refuses a change that skipped it. (R-161)

What we're working on

Now: the last app whose data was never saved; today's decisions written down.
Next: merging the small backup partition into the large one, with the drive-filling warning and the backup-failure alert in the same step.
After: rebuilding how the machine records whether an app is meant to be running.

Waiting on you

How a new version reaches a machine. Pushing the installer publishes it — half a minute later every new machine downloads it, with no staging and no way back but another push. And publishing is a step we remember rather than one the release performs, forgotten twice: a fix can be live here and still not reach a new machine. Nothing is installing today, so this is the cheapest moment to settle both. (R-110, R-115)
A job, not a decision: the hub password needs changing. A diagnostic command printed it into a session log; nothing suggests anyone else saw it. (R-132)

Changed since last update

2026-08-02 — Decided: the 20 GB backup partition goes away and shares space with app data. That changes the disk layout, so it happens before any machine is installed outside the house.
2026-08-02 — Decided: only this machine and the tester's box are protected; every other box, both demo boxes included, may be broken or reinstalled freely.
2026-08-02 — Two of the three apps that never saved their data are fixed; this page created.

3.7 KiB Raw Blame History