[Gerrrt]

The Exos drives arrive today. This is the runbook that makes their arrival a
twenty-minute job, split so everything independent of the drives can be done
before they turn up — §0 is the BIOS, the AMT check, the static address, the
Kea reservation and the three firewall rules.

It found an error in ADR-0040, which I wrote yesterday

That ADR claims the address, the three rules and the scrape direction "were
never OS decisions". The ports in ADR-0016's Hicks rule were.

That table reads 22,8096 — port 22 because ADR-0016 chose Ubuntu Server and
assumed administration over SSH. smaug runs TrueNAS, administered over
HTTPS. Created as written, the rule would have left the NAS unreachable
from a Hicks workstation in a way that presents as a firewall fault rather
than a stale assumption.

Corrected table is in §0.5: 443,8096. Port 22 stays on the Winterfell rule,
which is prometheus pulling the metadata backup — and TrueNAS ships SSH
disabled, so that rule is inert until the service is deliberately enabled.

Neither ADR is edited, per ADR-0001 and ADR-0038's fourth decision.
ADR-0040 gains a note naming which of its own claims is wrong; ADR-0016's
existing banner gains the port consequence, so a reader arriving at that rule
table is warned at the table rather than after creating it.

The backup question #138 demanded, answered

Not a yes or a no — a dataset split, carried into the layout so it can't be
drifted away from:

Dataset	Holds	Backed up
hoard/media	the library	no
hoard/apps	Jellyfin's database and config	yes

ADR-0008 already ruled the library replaceable and its loss "annoying rather
than catastrophic"; backing up 18 TB of re-downloadable files would spend the
mirror's capacity contradicting a decision already taken. But watch history,
resume positions and library organisation are what re-acquiring a series
doesn't restore — and they're megabytes.

Two checks that exist because passing isn't the same as being right

• §0.6 tests that Winterfell still CANNOT reach 443. A success there would
  mean the rule is wider than it reads. It also reads the TerminalSegmentReachedInternalNetwork cannot fire — the firewall logs blocks only #223 tripwire
  counter, which must still be zero — terminal-outward is what the whole
  segment rests on.
• §6 puts ADR-0040's reopen condition where it belongs: Quick Sync reaching
  a container, checked before the library exists. A live P630 and a P630 a
  container can use are different claims, and moving a populated library is a
  weekend.

Mechanics

README goes 24 → 25 runbooks, which check_counts required rather than the
author remembering.

make validate passes; check_docs green at 10 assertions.

Refs #413 #138 #223

🤖 Generated with Claude Code

---

Since opened: the pool is erebor, and stacks/media exists

Pool renamed hoard → erebor. A hoard is what Smaug sits on; Erebor is
what he took and occupies. A pool is a container, so it takes the name of the
container. Renamed while it costs a find-and-replace rather than an export and
an import.

stacks/media is authored — the thing §6 deploys. One service, because
ADR-0016 builds Jellyfin alone and defers Plex against a test nobody has run.

No reverse proxy, deliberately

The sensitive tier puts twelve services behind Caddy and publishes one port
because it holds the data whose loss hurts. This tier is the other half of
ADR-0008's bargain — "a failure of the media box costs a film night" — and its
clients are televisions, which reach 8096 on their own broadcast domain with
no firewall rule involved at all. A proxy would add a hop, a certificate every
television must trust, and a second thing to be down.

Measured on the pinned image, not read from upstream docs

Two of the five findings changed what got written:

• /health answers 200 with a body reading Degraded on a fresh
  instance. A check requiring Healthy would mark the container unhealthy from
  first boot until somebody finished the setup wizard — on
  restart: unless-stopped, a restart loop. The check keys on the status
  code and says in the file that it ignores the body on purpose.
• curl is present; wget, busybox and nc are not — which decides a
  healthcheck this repo otherwise writes with busybox wget.

Also: the image declares no user and would run as root; /config and /cache
are mode 777, which is what lets it run as 65534 with no chown sidecar; and
65 MiB idle RSS is what the 2 GiB ceiling is a ceiling over.

The digest came from scripts/pin-digests.sh via the registry API. That script
rewrites image references in comments too, so the verification command uses
a placeholder — the same reason stacks/sensitive writes <caddy image>.

Mechanics

docs/architecture.md gains the host-and-stack row check_host_stack_table
requires, marked not built yet — true of both the stack and the pool, and what
keeps that assertion on its planned branch while smaug is absent from
network.md.

The boot disk's self-test also finished: extended offline, completed without
error, at lifetime hour 13,183 — the first ever logged on that drive. It ran
far past its own two-minute estimate because it advertises Suspend Offline
collection upon new command and TrueNAS was live underneath it, which is worth
recording before somebody reads a slow self-test as a sick disk.