This release removes two features rather than fixing them. Both were advertised, neither was ever connected to the running daemon, and both were offered to users as reasons to trust this software: the security guide recommended the REST backend as the way to run non-root, and the README offered backup and rollback as the safety net for production.
Removed: the REST API backend
backend: api was accepted for a year and did nothing. The implementation existed, with tests, and no production module imported it. Every operation went through pct. An operator setting it believed they had moved off root and off SSH, and had not.
Connecting it was measured rather than assumed: 26 call sites invoke pct directly, three of them pct exec which has no REST equivalent, and the abstraction is missing the eight methods the ASG design specifies plus the per-guest node resolution it never had. That is the first three issues of the ASG milestone, not a wiring job, and against an interface the design document already says is not the one that existed.
backend: api is now refused at startup with a message explaining why. backend: cli is unchanged and remains the default; use_remote_proxmox still drives a remote node over SSH. Building a real one is #56.
Removed: backup and --rollback
No backup file was ever written. The helper was reachable only from a dead duplicate of the data collector, so --rollback iterated every container, found nothing, and logged Rollback process completed. Confirmed on a live node: after a run that resized a container, the configured backup directory did not exist.
Not reimplemented, because what a backup of a live container's resource settings means across a restart, a manual edit and a migration is a decision that does not exist anywhere in this project. Shipping a half-answer would recreate what this was: a safety net that is not there.
--rollback now exits 2 with an explanation. Container settings live in /etc/pve/lxc/<ctid>.conf and in your Proxmox backups. backup_dir stays, since the boost record lives there, and is documented as the state directory it actually is.
Both refuse rather than continue quietly
That is the point of the release. Each of these survived a year because setting them changed nothing and said nothing. A configuration value that cannot do what the operator intends should stop the daemon, not be ignored.
Also
get_container_data, the dead duplicate whose death is what silently disabled backups, and prune_old_backups, never called and with semantics its own parameter name contradicted, are gone with them.
Production code is 3700 lines, down from 4005.
One fix worth naming, because it was introduced in this cycle and caught by running the code rather than by the test that covered it: the --rollback explanation was initially raised from inside async_main, where the entry point catches SystemExit and turns it into an INFO line. The message was swallowed and the process exited 0. The test asserted on the raised exception rather than on what a caller observes, so it passed the whole time. It now runs the entry point as a subprocess and checks the exit code and stderr.
Upgrading
Re-run the installer or pull main. Two configurations now stop rather than being ignored:
backend: apirefuses at startup. Change it tocli, which is what was running anyway.--rollbackexits 2. There was never anything to roll back to.