You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
A single tracking issue keeps the deferred post-V1 / V2 scope visible without cluttering the active board. This is the umbrella for items intentionally pushed past V1. It lives under the v2.0.0 milestone.
Deferred V2 items
Backends beyond Google Drive (IN PROGRESS for v2.5.0: pluggable destination seam + S3-compatible + local/removable folder)
macOS signed in-app auto-update (needs Apple Developer ID)
macOS WidgetKit Control Center / desktop widget (needs Apple Developer ID + a notarization pipeline, neither of which exist yet - same blocker class as the auto-update line above; reuses the menu bar throughput derivation shipped in feat(ui): configurable macOS menu bar extra with live backup metrics #233/v2.6.0)
Newly identified follow-ups (2026-07-29, from the macOS hardware run)
macOS became a hardware-tested platform this cycle, which surfaced work that was
previously invisible:
Shared Drive real-Drive e2e needs a Workspace account. The 5 google_shared_drive_* tests sit behind DRIVEN_E2E_SHARED_DRIVE_ID, and a
consumer Google account cannot satisfy it - Shared Drives are Workspace-only,
so GET /drive/v3/drives returns an empty list for the automation account.
Until a Workspace account exists, that contract has fake-store coverage only.
See design/E2E_REAL.md.
Bundle members bypass open-error classification entirely. bundle::read_member uses a plain File::open, so an unreadable member lands
in BuildOutput::skipped with no per-file error code at all - a denied file
inside a bundle candidate is retried silently forever rather than reported.
Routing bundle-member reads through classify_open_error is the fix.
A permanent TCC denial writes one identical warn row per file per
cycle. Locks are transient; denials are not, so this is the steady state for
a pre-FDA Mac with large protected trees. Needs aggregation/coalescing.
A partly-unreadable source still reports zero errors. Skips do not
appear in the cycle's error count and there is no skipped-file count on cycle
progress, so a user whose entire ~/Library/Mail is unreadable sees a clean
backup. Decide whether that is the intended contract.
PAC fallback chains are not expressible.Proxy::custom returns one Option<Url>, so PROXY a; SOCKS b; DIRECT uses only the first directive.
Real fallback needs connection-failure interception plus a per-proxy failure
cache.
PAC weekdayRange/dateRange/timeRange are always-false stubs.
Implementing them REQUIRES changing the per-host decision cache key in the
same change: it keys on host with no time component, so a decision computed at
08:59 replays at 09:01 - and unit tests calling the predicates directly would
still pass.
A PAC change does not affect in-flight backup traffic. Orchestrator /
Drive clients resolve the proxy once at account assembly, so a re-save or TTL
lapse only reaches per-operation clients until restart or account re-add.
Next action
Promote individual items to their own issues (optionally as sub-issues of this epic) as they are scheduled into a release. Small-file bundling (#35) and restore-by-date (#36) are already tracked as separate issues; the diagnostic-bundle PII/secret leaks are #204.
Why it matters
A single tracking issue keeps the deferred post-V1 / V2 scope visible without cluttering the active board. This is the umbrella for items intentionally pushed past V1. It lives under the v2.0.0 milestone.
Deferred V2 items
Newly identified follow-ups (2026-07-29, from the macOS hardware run)
macOS became a hardware-tested platform this cycle, which surfaced work that was
previously invisible:
google_shared_drive_*tests sit behindDRIVEN_E2E_SHARED_DRIVE_ID, and aconsumer Google account cannot satisfy it - Shared Drives are Workspace-only,
so
GET /drive/v3/drivesreturns an empty list for the automation account.Until a Workspace account exists, that contract has fake-store coverage only.
See design/E2E_REAL.md.
bundle::read_memberuses a plainFile::open, so an unreadable member landsin
BuildOutput::skippedwith no per-file error code at all - a denied fileinside a bundle candidate is retried silently forever rather than reported.
Routing bundle-member reads through
classify_open_erroris the fix.cycle. Locks are transient; denials are not, so this is the steady state for
a pre-FDA Mac with large protected trees. Needs aggregation/coalescing.
appear in the cycle's error count and there is no skipped-file count on cycle
progress, so a user whose entire
~/Library/Mailis unreadable sees a cleanbackup. Decide whether that is the intended contract.
Proxy::customreturns oneOption<Url>, soPROXY a; SOCKS b; DIRECTuses only the first directive.Real fallback needs connection-failure interception plus a per-proxy failure
cache.
weekdayRange/dateRange/timeRangeare always-false stubs.Implementing them REQUIRES changing the per-host decision cache key in the
same change: it keys on host with no time component, so a decision computed at
08:59 replays at 09:01 - and unit tests calling the predicates directly would
still pass.
Drive clients resolve the proxy once at account assembly, so a re-save or TTL
lapse only reaches per-operation clients until restart or account re-add.
Next action
Promote individual items to their own issues (optionally as sub-issues of this epic) as they are scheduled into a release. Small-file bundling (#35) and restore-by-date (#36) are already tracked as separate issues; the diagnostic-bundle PII/secret leaks are #204.