backlog: reorder by urgency (critical/high/medium/planned)

RESUME.md

@@ -2,58 +2,43 @@
 
 Last updated: 2026-05-22. Update this at the end of every session.
 
-## Open items (priority order)
+## Open items (urgency order)
 
-### Backup gaps
-- [x] ~~**Pocket-ID backup**~~ — done 2026-05-22. Pre-hook on CT 103 exports via `pocket-id export` + copies keys to UNAS staging; `services-backup-plan` → jottacloud. Verified snapshot includes Pocket-ID data.
-- [ ] **Backrest media-repo** — `video-projects-plan` and `media-backup-plan` were at 0 snapshots but both restic processes were actively running as of 2026-05-22 19:10. Verify snapshots landed after they complete.
-- [x] ~~**Gitea repos**~~ — already in `services-backup-plan` → jottacloud. DB on CT 113 (WAL-G).
-- [x] ~~**Coder workspace homes**~~ — already in `services-backup-plan` → jottacloud.
+### 🔴 Critical — security risk or unrecoverable data loss
+- [ ] **Password rotation: `tapirnase`** — shared across WiFi PSK, LiteLLM root key (`sk-tapirnase`), D-Link admin, Backrest repo password. Single sniff = broad blast radius. Rotate per-service. See `services/homelab-architecture.md` §operational rules.
+- [ ] **UniFi MFA JWT in homepage logs** — JWT found in `homepage/config/logs/homepage.log`. Rotate + scrub. See `services/homelab-architecture.md`.
+- [ ] **UNAS personal data off-host** — ~820 GB Immich library + UNAS bulk have zero off-host copy. Deploy rclone sync: `media/images/library` → jottacloud:Photos + full UNAS → jottacloud:UNAS. See `services/backrest.md` phase 1a.
+- [ ] **Nextcloud Borg passphrase → Vaultwarden** — passphrase only in container env; CT 105 loss = unrecoverable backup. Move to Vaultwarden. See `services/backrest.md` blind spot #4b.
+- [ ] **LiteLLM DB password** — placeholder `litellm_password_here` in `.env` + CT 113 user. Generate real password; update both. See `services/backrest.md` blind spot #6.
 
-### Infrastructure
-- [ ] **CT 109 "ops"** — planned LXC for Prometheus, Loki, Grafana, Alloy, Homarr, sshwifty, Gotify. Not yet built. See `infra/proxmox-state.md` §16.
-- [ ] **Second NVMe** — needed before Postgres consolidation (CT 113) and rpool mirror. Unblocks moving remaining per-stack PG containers to CT 113.
-- [x] ~~**Vaultwarden NFS cleanup**~~ — `/mnt/pve/unas/services/vaultwarden/` deleted 2026-05-22.
-- [x] ~~**apps/backrest rename**~~ — done 2026-05-22 (renamed from PVE host via ZFS subvolume path; idmapped LXC blocked it from inside CT 104).
+### 🟠 High — known broken / verification needed
+- [ ] **Arcane OIDC secret** — rotation done 2026-05-22 but Arcane has known OIDC issues. Verify it still authenticates.
+- [ ] **Backrest media-repo** — `video-projects-plan` and `media-backup-plan` were at 0 snapshots as of 2026-05-22 19:10. Verify snapshots landed.
+- [ ] **AdGuard split-horizon DNS** — internal clients still resolve to public IPs. Rewrite rules audit. See `services/adguard-dns.md`.
+- [ ] **WAL-G monitoring** — silent stall went undetected for 13 h. Add textfile collector + alert for hung archiver. See `services/homelab-architecture.md` roadmap.
+- [ ] **Zoraxy audit** — CT 108 routes: WS headers, ACME coverage, decommissioned routes, auth consistency. See `services/zoraxy.md`.
 
-### MCP / AI stack
-- [ ] **Consolidate syncstack → MCP gateway** — `syncstack.py` cron is fragile; move LiteLLM model polling + LobeChat model-list sync into `mcp-gateway/server.py` alongside the existing plugin sync loop. Delete syncstack container + cron after.
-- [ ] **crawl4ai SSE StreamConsumed** — intermittent 502s on first request after gateway restart (race with in-flight requests from old code). Investigate if still present after a clean restart cycle; likely harmless but worth confirming.
+### 🟡 Medium — incomplete migrations / cleanup debt
+- [ ] **Drop stale `daytona` DB** — Daytona decommissioned 2026-05-20; DB still on shared-postgres CT 113. Drop it.
+- [ ] **Remove old CT 111 Docker volumes** — `coder-db` + `gitea-db` may be stale after migration to CT 113. Verify and remove.
+- [ ] **Migration dump cleanup** — `/mnt/pve/unas/dump/*-migration-20260521.sql` (~492 MB). Keep or delete.
+- [ ] **Docker disk reclaim** — ~13 GB reclaimable on CT 104 (8.3 GB unused images, 4.6 GB build cache). `docker system prune -a` after confirming. See `infra/proxmox-state.md` §10c.
+- [ ] **Dormant stacks audit** — ~10 stacks defined but not running (homepage, dozzle, arr-stack, qdrant, etc.). Document: parked vs. abandoned. See `infra/proxmox-state.md` §10c.
+- [ ] **Config-to-git** — push zoraxy, adguard, pve, ha configs daily to Gitea repos (repos exist, cron not deployed). See `services/backrest.md` phase 3.
+- [ ] **D-Link hardening** — admin UI open to full LAN, SNMP unverified, HTTP-only. Enable trusted-host allowlist, harden SNMP, add TLS. See `services/homelab-architecture.md`.
+- [ ] **Vaultwarden OIDC SSO** — Pocket-ID client created 2026-05-21, auth flow not wired up.
 
-### Security / secrets
-- [ ] **Password rotation: `tapirnase`** — used as WiFi PSK, LiteLLM root key (`sk-tapirnase`), D-Link admin, and Backrest repo password. Single sniff = broad blast radius. Rotate all per-service. See `services/homelab-architecture.md` §operational rules.
-- [ ] **LiteLLM DB password** — placeholder `litellm_password_here` in `.env` + CT 113 user. Generate real password and update both. See `services/backrest.md` blind spot #6.
-- [ ] **Infisical secrets migration** — CT 112 provisioned but migration not started. Phase 1-4: move 85+ `.env` keys into central store. See `services/secrets-manager.md`.
-- [ ] **UniFi MFA JWT in homepage logs** — JWT found in `homepage/config/logs/homepage.log`. Rotate JWT + scrub log. See `services/homelab-architecture.md`.
-- [ ] **Vaultwarden OIDC SSO** — Pocket-ID client created 2026-05-21 but auth flow not wired up. Complete integration.
-- [ ] **Nextcloud Borg passphrase → Vaultwarden** — passphrase stored only in container env; CT 105 loss = unrecoverable backup. Move to Vaultwarden. See `services/backrest.md` blind spot #4b.
-
-### Backup gaps (extended)
-- [ ] **UNAS personal data off-host** — ~820 GB Immich library + UNAS bulk not replicated off-host. Deploy rclone sync jobs: `media/images/library` → jottacloud:Photos + full UNAS → jottacloud:UNAS. See `services/backrest.md` phase 1a.
-- [ ] **Config-to-git** — daily cron to push zoraxy, adguard, pve, ha configs to `fkrebs/{zoraxy,adguard,pve,ha}-conf` Gitea repos. Repos exist, scripts not deployed. See `services/backrest.md` phase 3.
-- [ ] **Migration dump cleanup** — `/mnt/pve/unas/dump/*-migration-20260521.sql` (~492 MB, 2026-05-21). Decide keep or delete. See `services/backrest.md` blind spot #7.
-
-### Database cleanup
-- [ ] **Drop stale `daytona` DB** — Daytona decommissioned 2026-05-20; DB still on shared-postgres (CT 113). Drop it. See `services/databases.md`.
-- [ ] **Remove old CT 111 Docker volumes** — `coder-db` + `gitea-db` Docker volumes on CT 111 may be stale after migration to CT 113. Verify and remove. See `services/databases.md`.
-
-### Infrastructure (extended)
-- [ ] **ZFS ARC tuning** — `zfs_arc_max` artificially capped at 6.2 GiB; raise to 16 GiB once CT 101 memory is right-sized. See `infra/proxmox-state.md` §3.
-- [ ] **Docker disk reclaim** — ~13 GB reclaimable on CT 104 (8.3 GB unused images, 4.6 GB build cache). Run `docker system prune -a` after confirming no needed images. See `infra/proxmox-state.md` §10c.
-- [ ] **Dormant stacks audit** — ~10 stacks defined but not running on CT 104 (homepage, dozzle, arr-stack, qdrant, etc.). Document: parked vs. abandoned, or delete. See `infra/proxmox-state.md` §10c.
-
-### Services / integrations
-- [ ] **Document ingestion n8n workflow** — Docling MCP deployed; n8n orchestration not built. Nextcloud/Paperless → Docling → LiteLLM embeddings → LobeChat knowledge base. See `services/doc-ingestion.md`.
-- [ ] **WAL-G monitoring** — silent stall went undetected for 13 h (failed_count=0). Add textfile collector + alert for hung archiver. See `services/homelab-architecture.md` roadmap.
-- [ ] **ComfyUI async queue** — current MCP tool blocks 90–300 s per call. Implement job-queue pattern: `generate_image()` returns job ID; `get_job_status()` polls. See `services/comfyui.md`.
-- [ ] **Arcane → CT 109 migration** — when CT 109 lands, move Arcane from CT 104; edge agents on CT 104/113 reconnect. Procedure documented in `services/arcane.md`.
-- [ ] **Additional MCP servers** — community MCPs exist for: Gitea, Paperless, Karakeep, Vaultwarden, Proxmox-VE, Audiobookshelf. Evaluate and wire into gateway.
-
-### Audits / housekeeping
-- [ ] **Zoraxy audit** — CT 108 routes: WS headers, ACME coverage, decommissioned routes, auth consistency (Tinyauth gaps). See `services/zoraxy.md`.
-- [ ] **Arcane OIDC secret** — rotation was done 2026-05-22 but Arcane has known issues with OIDC. Verify it still authenticates cleanly.
-- [ ] **AdGuard split-horizon DNS** — some internal services still resolve to public IPs instead of LAN IPs for internal clients. Needs rewrite rules audit in `services/adguard-dns.md`.
-- [ ] **D-Link hardening** — admin UI reachable from any LAN device; SNMP community strings unverified; HTTP-only admin. Enable trusted-host allowlist, disable/harden SNMP, add TLS. See `services/homelab-architecture.md`.
+### 🔵 Planned — requires infrastructure or significant effort
+- [ ] **CT 109 "ops"** — LXC for Prometheus, Loki, Grafana, Alloy, Homarr, sshwifty, Gotify. Blocks monitoring stack + Arcane migration. See `infra/proxmox-state.md` §16.
+- [ ] **Second NVMe** — needed before rpool mirror + Postgres consolidation (CT 113). Blocks several items.
+- [ ] **Infisical secrets migration** — CT 112 provisioned; migration not started. Phase 1-4: move 85+ `.env` keys. See `services/secrets-manager.md`.
+- [ ] **Consolidate syncstack → MCP gateway** — move LiteLLM model polling + LobeChat sync into gateway's loop; delete syncstack cron.
+- [ ] **ZFS ARC tuning** — raise `zfs_arc_max` from 6.2 GiB → 16 GiB once CT 101 memory right-sized. See `infra/proxmox-state.md` §3.
+- [ ] **Document ingestion n8n workflow** — Docling MCP deployed; n8n orchestration not built. Nextcloud/Paperless → Docling → embeddings → LobeChat KB. See `services/doc-ingestion.md`.
+- [ ] **ComfyUI async queue** — MCP tool blocks 90–300 s. Job-queue pattern: `generate_image()` returns ID; `get_job_status()` polls. See `services/comfyui.md`.
+- [ ] **Additional MCP servers** — community MCPs exist for Gitea, Paperless, Karakeep, Vaultwarden, Proxmox-VE, Audiobookshelf. Evaluate + wire in.
+- [ ] **Arcane → CT 109 migration** — blocked by CT 109. Procedure documented in `services/arcane.md`.
+- [ ] **crawl4ai SSE StreamConsumed** — intermittent 502s on gateway restart. Confirm resolved after clean restart cycle.
 
 ## Recently completed (session continued ×2, 2026-05-22)