[Gerrrt]

smaug runs TrueNAS, not Ubuntu Server. ADR-0016 decided the opposite and
rejected TrueNAS by name; the operator was only ever going to install TrueNAS,
and it surfaced on 2026-09-15 when the next step was said out loud.

This is the second divergence between the record and the operator's intent
on this one machine — four days after ADR-0038 caught the zion/trinity
naming, found the same way. Neither was catchable by CI: both are disagreements
about intent, and every document involved was internally consistent.

Unlike ADR-0038, this one is not nominal. ADR-0016 weighed this option and
declined it, so ADR-0040 prices the reversal instead of performing it quietly.

What expired, and what didn't

ADR-0016's case was four losses: no compose file, no pinned digests, no
make validate, configuration that exists only as clicks.

• The first three have expired. TrueNAS replaced k3s with Docker in 24.10
  "Electric Eel" and runs user-supplied compose.
• The fourth stands. Pool geometry, datasets, shares and snapshot
  schedules are clicks, are not in git, and CI cannot see them. Decision 4
  bounds that — it gets written into a runbook as it is built, rather than
  waived.

The media stack stays here

On smaug, as a compose file under TrueNAS's app runtime — not catalogue apps.
Mechanical reasons, not taste:

• Dependabot edits compose.yaml and nothing else, and merges bumps weekly
  in this repo.
• check_image_pins.py enforces the tag + sha256: pair that stops a moved
  tag changing what deploys.
• restore-the-stack.md and backup-volumes.sh already assume compose
  volumes. Catalogue apps would need a second restore path nobody has written.

ADR-0004 is not amended and smaug is not an exception to it. It decides
repository layout — one directory per stack — and says nothing about what
launches the stack. An earlier draft called smaug "ADR-0004's documented
exception"; it isn't, and saying so would have invented a precedent for
exempting hosts from a rule they satisfy.

The reopen condition, with a deadline

Quick Sync passthrough into a container on the installed release. #138
wanted this box for the TS150's HD P630, and the roadmap declines Plex Pass on
the strength of it. If the iGPU doesn't reach a container cleanly, decision 2
reopens. Checked before the library exists — moving a populated library is a
weekend, moving an empty stack is an afternoon.

Deliberately left open

• Add the scrape path for a host that pushes nothing #256's scrape path now has a fork. TrueNAS ships its own metrics endpoint
  where the issue specifies node_exporter on 99 → 40:9100.
• ADR-0027's PBS sync job targets a PBS instance. On TrueNAS that's PBS in a
  VM/container, or a change to an NFS/SMB datastore.

Both belong to their own trackers on the day they're built, not to a guess here.

Mechanics

ADR-0016 keeps its text and gains a note, per ADR-0001 and ADR-0038's fourth
decision. Its existing ADR-0038 banner is folded into the same blockquote —
two adjacent blockquotes are MD028 — with every word preserved. roadmap.md
and hardware.md said Ubuntu in three places and no longer do.

README's ADR count goes 39 → 40, which check_counts required rather than
the author remembering — it failed the run until corrected. That guard landed
in #472 yesterday and has now caught its first real drift.

make validate passes; check_docs green at 10 assertions.

Refs #413 #138 #256

🤖 Generated with Claude Code