[gregoryfoster]

Refs #126. This is part 2, after #113's first window (2026-11-10 05:00–10:00Z) closed. Part 1 was #128.

This PR needs a deploy. It edits comments and operator messages in src/, deploy/, scripts/deploy.sh, pyproject.toml and .skills/patching-hosts. No behaviour changes.

Tokens (measure-context.sh --exact)

File	Before	After	Budget
AGENTS.md	5,929	5,945	6,000
docs/DEPLOYMENT.md	17,639	9,437	10,000
docs/PATCHING.md (new)	—	8,702	10,000

Every live doc is now under budget. There are no dead links or anchors, and no orphaned or unindexed docs. The baseline and after rows are on the ledger.

Relocated

Block	From	To
## Patching with ### The patch-due check	DEPLOYMENT.md	PATCHING.md
## Node.js (agent tooling only) with ### Patching Node, ### Moving the major line, ### Removing it	DEPLOYMENT.md	PATCHING.md
At a glance rows: Patching, Node.js	DEPLOYMENT.md	PATCHING.md ## At a glance

DEPLOYMENT.md's ## Moved sections gains ### Patching and ### Node.js (agent tooling only) stubs. Old anchors, archived plans and specs, and issue comments still resolve.

Edited lines (each warranted in .skills/context-loss-ok)

• retarget (8): anchor links in the moved block, re-aimed at the doc that holds each target. Two point at DEPLOYMENT.md (Operate, Deploy a change). The rest go through the part 1 stubs to DEPENDENCIES, NETWORK and MONITORING. Step 8's bare § Tailscale DNS now names NETWORK.md.
• disproven (2): systemctl is-enabled apt-daily.timer returns enabled. apt-config dump shows APT::Periodic::Enable "1" and Update-Package-Lists "1" (Patching: a missed window goes unnoticed — solicit approval before each window, or automate unless overridden #113), so the lists refresh daily at 12:00 UTC. Two lines said otherwise:
  • Run step 1: "which nothing else refreshes" now reads "which apt-daily.timer last refreshed at 12:00 UTC the day before".
  • § Patching Node: "(apt-daily.timer is masked and APT::Periodic::Enable is 0)" now reads "which apt-daily.timer does only daily at 12:00 UTC".
• index (1): DEPLOYMENT.md's topic index line now also links PATCHING.md.
• AGENTS.md (3, retarget): the Patching and Node.js rows now link PATCHING.md. The Detail Docs line for DEPLOYMENT.md is split into two, with a new PATCHING.md line.

No deletions. Fact check: 46 TRUE, 16 UNVERIFIABLE, 0 FALSE. The two FALSE lines above were checked by hand on the host.

Runtime citations re-pointed (commit d90328a)

Doc	Files
PATCHING.md	patching.py (due and missed messages); .skills/patching-hosts (the service note); deploy/apt/apt.conf.d/processor-periodic; deploy/apt-daily.timer.d/processor-window.conf; deploy/needrestart.conf.d/processor.conf; deploy/nodesource.sh; processor-patching.service Documentation=
MONITORING.md	checkin.py; deploy.sh's timer note; the knob's liveness note; deploy/disk-gc/disk-gc.conf; processor-drift.service Documentation=
NETWORK.md	tailscaled drop-in Install:
DEPENDENCIES.md	pyproject.toml shell lint; the knob's lock audit
PROVISIONING.md	deploy.sh § Install

What still names DEPLOYMENT.md points at sections that stayed there: the CI gate, Rollback, Deploy a change, and the host-config comparison.

After merge (live)

1. scripts/deploy.sh.
2. Reinstall the five hand-installed host configs. Each differs from the installed copy by one comment line, so nothing in effect changes:
   • processor-periodic
   • the apt-daily.timer.d drop-in
   • needrestart processor.conf
   • disk-gc.conf
   • the tailscaled drop-in (daemon-reload only, no tailscaled restart)
3. On the node, test_*::test_installed_copy_matches_tracked passes again, and the deploy prints no differs from note.

Checks

• Full suite: 1027 passed, 15 skipped. The 5 failures are the on-node installed-copy tests above, which are expected until step 2. CI doesn't run them.
• ruff and shellcheck are clean.
• no-loss: 0 lost (AGENTS 3 warranted, DEPLOYMENT 13 warranted).
• seams: 0 open (52 acknowledged; part 1's 22 stale entries pruned).
• counts: 0 open.

Fresh-eyes review (fixed in 994574d)

1. deploy.sh's host-config notes (:591, :593) said "(docs/DEPLOYMENT.md)", but no install step is left there. They now name § Deploy a change, and its HOST_CONFIGS line links where each config is installed: NETWORK.md § tailscaled's OOM rank, PATCHING.md § Patching and § Node.js, and MONITORING.md § Disk GC. That line is warranted retarget.
2. PATCHING.md "No apt timer has a stamp" (measured 2026-11-05) was refuted on the host. Both timers have had stamps since their first runs (stamp-apt-daily.timer 12:14:42Z, stamp-apt-daily-upgrade.timer 13:42:42Z), and both are Persistent=true. The sentence now says re-enabling catches up a missed run. Warranted disproven.
3. The list refresh happens between 12:00 and 12:30 UTC (RandomizedDelaySec=30m), not at 12:00.
4. Not changed: #the-patch-due-check, #patching-node, #moving-the-major-line and #removing-it have no DEPLOYMENT.md stub. That matches part 1, which stubbed only ## sections, and nothing in the repo links them.

🤖 Generated with Claude Code