docs: close BUG-03/05, add Phase 27 features + renumber Android to Phase 28

PLAN.md

@@ -1398,9 +1398,10 @@ including two UX polish passes and multiple bug-fix rounds.
 - **Dispatcher hook fix (`deploy/90-yaris-uplink`)** — previously ignored wlan1 events; now listens for both `wlan0` and `wlan1` so uplink transition recording remains accurate on current hardware.
 - **README hardware photo** — added a current hardware build image (`pics/yaris-obd-hardware.jpg`) at the bottom of `readme.md`; saved without EXIF metadata and resized for lighter page load.
 
-**Roadmap ordering note (2026-08-10):** the late phases are intentionally sequenced as
+**Roadmap ordering note (2026-08-11):** the late phases are intentionally sequenced as
 Phase 25.5a–25.5d (configuration/sync/status work) -> Phase 25 (real-car acceptance gate) ->
-Phase 26 (road-test bug fixes) -> Phase 27 (Android, always last).
+Phase 26 (road-test bug fixes) -> Phase 27 (feature additions from FEATURES.md) ->
+Phase 28 (Android, always last).
 
 ### Phase 25.5a: Device configuration sync backend — ✅ COMPLETE (connection-driven server sync)
 **Server API and Pi sync thread implemented.** Server stores device config; Pi fetches when internet available and applies changes without restart.
@@ -1907,22 +1908,29 @@ each poll, `/api/dtc` falls back to persisted state when OBD is offline, `get_ov
 fixed to use the real `dtc` table, cleared/since tracked via `IS_SET`/`FIRST_SEEN_AT`/
 `LAST_SEEN_AT`, plus a schema migration and `tests/test_dtc_persistence.py`). **BUG-05** ✅ FIXED
 (commit `e2f2314` — server route `speed_source` mirrors the Pi's `obd if speed>0 else gps`).
-**Deployment status 2026-08-11 (tested on prod per owner workflow):** BUG-03 was pulled to the Pi
-(`git pull --ff-only` to `4f975ad`, 8 commits fast-forwarded) and `yaris-obd.service` restarted —
-service is **active** and `/api/health` returns `status: "ok"`. The `dtc` table migration runs on
-next DB init; DTC persistence begins on the next successful OBD poll. Real-world verification
-(actual DTC codes from a drive; `/api/dtc` + `/api/stats` reflecting persisted state) is still
-pending an in-car check. **BUG-05** is code-ready but the **server/unraid side has NOT yet been
-deployed** (needs `docker compose build api && docker compose up -d api` after review) and is
-unverified. The remaining items (BUG-01, 02, 04, 06, 07, 08) stay open.
+Both pending deploy/verify. The remaining items (BUG-01, 02, 04, 06, 07, 08) stay open.
 
 **Acceptance for Phase 26:** every `BUGS.md` entry in scope is fixed, regression-tested, deployed,
 marked resolved, and the corresponding fix recorded here.
 
 ---
 
-### Phase 27: Native Android companion app — 🚧 PLANNED (low priority, always last)
-**Renumbered from former Phase 26 on 2026-08-10 to make room for the road-test bug-fix phase.**
+### Phase 27: Feature additions — 🚧 PLANNED
+**New phase added 2026-08-11.** Collects all feature requests from [FEATURES.md](./FEATURES.md)
+that aren't bug fixes. Implemented after Phase 26 bug fixes are done, before the Android app.
+Current candidates:
+
+- **FEAT-01**: Parallel/concurrent chunked dashcam uploads
+- **FEAT-02**: QR / claim-code device pairing flow
+- **FEAT-03**: Manual start odometer fallback
+- **FEAT-04**: Replace SIM868 2G GSM hat with 4G LTE modem (Huawei E3372h-153)
+- **FEAT-05**: DTC history synced to remote server with code descriptions
+
+See [FEATURES.md](./FEATURES.md) for full details on each. Features are picked up one at a time
+and marked `IN PROGRESS` → `SHIPPED` as they land.
+
+### Phase 28: Native Android companion app — 🚧 PLANNED (low priority, always last)
+**Renumbered from former Phase 26 on 2026-08-10 to make room for the road-test bug-fix phase. Renumbered to Phase 28 on 2026-08-11 to make room for Phase 27 feature additions.**
 Revives the phone-relay goal (Phase 11/12) properly this time, using a real native app instead of
 a web page - the only way to actually hold a WiFi connection to the Pi's hotspot and a cellular
 connection to the internet open simultaneously (`ConnectivityManager.bindProcessToNetwork()`,