Product feature gap matrix (inspected 2026-11-01, updated after live PPPoE shaping)
Classification vs original ISP-router scope. Never advertise missing as supported.
| Area | Status | Notes |
|---|---|---|
| Interfaces (ether/mgmt/dummy/veth) | implemented-unverified | Schema+UI; UCI now emits bridges/802.1q; live bridge apply pending dedicated acceptance |
| Bridges | implemented-unverified | UCI config device type bridge + ports from master= exported; Safe Mode apply not yet separately evidenced |
| VLANs / bridge VLANs | implemented-unverified | UCI 8021q + bridge-vlan exported; live verification pending |
| Bonding | missing | Not in schema/UI/export |
| IPv4 addresses/routes | verified | Desired→UCI→apply |
| IPv6 desired/apply | missing | Observe may show IPv6; no desired IPv6 |
| Policy routing / tables | missing | |
| Firewall filter | verified | |
| NAT masquerade | verified | |
| SNAT/DNAT | implemented-unverified | UCI config nat / config redirect now exported; live nft verify pending |
| Conntrack tuning | missing | |
| DHCP server | verified | |
| DHCP client | missing | |
| DNS forwarders | verified | |
| DNS search domains | implemented-unverified | Stored; written as comments only |
| PPPoE clients (WAN) | verified | Live disposable appliance: session up + Safe Mode confirm (evidence/0.4.0-rc/pppoe-shaping-measured/) |
| PPPoE BRAS / pools / RADIUS | intentionally deferred | Not OpenWrt client scope; do not advertise |
| Subscriber accounting (RADIUS acct) | intentionally deferred | Same |
| Queues / HTB shaping | verified | HTB upload + ingress download observed on pppoe-wan_pppoe (1024 kbps / 2048 kbps targets) |
| WireGuard | intentionally deferred | Packages/LuCI only; no WinControl workflow |
| FRRouting | intentionally deferred | Packages on image; no WinControl control plane |
| Users/roles UI | missing | CLI admin; is_admin gate; license roles partial |
| Audit logs | verified | |
| Diagnostics UI | missing | Observe JSON includes shaping_status; no dedicated diagnostics workspace |
| Licensing | verified | |
| Fleet / max_routers enforce | implemented-unverified | Soft; not hard-gated on create |
| Backup/restore (config) | verified | |
| Appliance OTA update | implemented-unverified | nur-update + docs/APPLIANCE-UPDATES.md; no A/B rollback; VM suite not executed this pass |
| Installer recovery | verified (partial) | BIOS-focused; UEFI suite stale |
| WinControl windows/layout | verified | localStorage layout |
| Pending vs applied / Safe Mode UI | verified | Live confirm after PPPoE apply |
| Search/sort/pagination | missing | Hard take(N) |
| en/bn localization | missing | |
| Keyboard/zoom | implemented-unverified | Basic HTML forms; not audited |
Pilot label: WinControl↔appliance SSH apply works on lab after nur-mgmt home/shell + setuid elev + SCP path fixes. Tree changes require ISO rebuild before claiming them on fresh installs. Measured PPPoE shaping: PASS on disposable QEMU. OTA acceptance suite: not run. RADIUS/BRAS: deferred.