[Gerrrt]

Why

docs/roadmap.md said in its header that it is the shape of the work and that status lives on the issues. It was 2,790 lines. Twenty-one of the thirty entries under Security / Monitoring / Infrastructure / Automation pointed at closed issues; Everything still to buy carried ten dated paragraphs around a two-row table; Done was 1,450 lines. It took 177 commits in thirty days, and #536, #487 and #486 were pure drift fixes to it.

Closes #577.

What the file is now

The ordered shape of the open work. One section per GitHub milestone, in working order, each with its close condition and only the issues whose gate or order needs a sentence the issue cannot carry. The header states what an entry may contain: a link, the gate, its place in the order, and why — no date except a gate that is a date — and that an entry leaves when its issue closes, with anything worth keeping going to the changelog under the date, in the same PR.

Kept: Everything still to buy (the rule, the two-row table, the ifrit paragraph, the decision-gated bullets, Never and the consumable exception, all present tense), and Considered and declined verbatim bar two lines: its first sentence pointed at a section that no longer exists, and its Authelia bullet said #103 still tracks the SSO deferral when #103 closed on ADR-0022.

393 lines, from 2,790. The untouched Considered and declined section is 78 of them.

Where the history went

docs/changelog.md, new, 2,691 lines: every dated block moved verbatim, filed under the latest date it names, or under the date of the commit that wrote it when it names none. The 67 Done entries keep their shape minus the [x]. The buy section's dated paragraphs, the paid-for register, every closed-issue entry from the open sections, and the full narrative of the entries for issues that are still open (#92, #95, #101, #102, #421, #418) are all there under their dates. Nothing was summarised.

A line-by-line comparison of the old file against the two new ones (whitespace-normalised) finds only these lines absent, each dropped on purpose:

• the old header's three paragraphs (rewritten);
• the four topical section headings and the one intro sentence under The stack does not watch itself;
• Decided but not built — every entry in it read "Under X above"; its rule survives as one sentence in the new header;
• a truncated - **[#100](…) Automate the Grafana fragment that was a title with no body (its Done entry moved intact);
• the "this bullet used to read …" sentences inside three decision-gated bullets, whose substance is in the changelog's 2026-09-10 and 2026-09-13 entries.

Checks

• check_buy_list is untouched: the section heading, its first table and the single **One more, later literal are where it reads them. python3 scripts/check_docs.py passes, ten assertions.
• The three roadmap.md#everything-still-to-buy anchors and the twenty-odd whole-file links resolve unchanged.
• Every issue cited in a milestone section is open on GitHub (loop over gh api). The four closed ones cited elsewhere are reopen tickets in Considered and declined and the battery worked example in the buy exception.
• scripts/lint.sh passes (markdownlint-cli2, editorconfig-checker, shellcheck). CI is green on this commit: Lint, Secret scan and Validate configs.
• Locally scripts/validate.sh passed before the rebase and then failed twice on observability: promtool check config. That is the known local flake, not this change: promtool exits 0 on that file, validate.sh's own grep -qE '^\s*SUCCESS' pipeline passes standalone, lab: promtool check config is green immediately above it, and this branch touches nothing under stacks/ or scripts/validate.sh. CI's isolated runner is the verdict.
• check_docs.py's docstring and PROSE comment now name changelog.md among the records it deliberately does not check. README, successor-handover.md, swap-the-switch.md, fit-the-ups-battery.md and rotate-snmp-community.md no longer tell a reader to move an entry into Done.

Kept up with main, which moved ten commits under this branch

Two rebases before the branch was pushed, then a merge. Nothing upstream was overwritten:

• feat(snmp): poll shiva over SNMPv3 authPriv (#85) #581, docs(snmp): the iLO's SNMPv1 is off, and four documents stop pointing at the issue for it #585 moved shiva to SNMPv3. The roadmap's Move the iLO and the UPS card to SNMPv3 authPriv (ADR-0036) #85 entry says the iLO is polled over v3 and mjolnir is next; the device-side proof is a dated changelog entry that explicitly corrects the 2026-09-09 sentence about checking the MokerLink's UI for a v3 user page.
• docs(power): decide who shuts down on the UPS's signal, record what powers smaug, and watch the counter that measures the cuts it misses #586, docs(adr): the estate's backup sets ride on the second recipient's medium, and the visit that proves the key proves the copy #588 added ADR-0047 and two ADR-0048s. The buy table's off-estate drive row now says the estate's own backup sets are not what it is for, and The estate's three backup sets are off-host twice and offsite never: decide where they go beyond the shelf, or that they do not #573 and No host shuts down on the UPS's signal, and nothing records what powers smaug #574 are entries under Nothing blocks these, each stated as its gate: a ninety-day visit for the one, a rack visit for the other.
• feat(smart): a static reallocated count is a recorded baseline the rule reads, not a silence that expires (#572) #583, feat(nas): smaug's SMART arrives by a root cron job under the scrape, and patch state is declined on the record #589, fix(saruman): enable the Proxmox firewall, and narrow local_network so ADR-0014's rule actually holds (#566) #590 closed oracle's SmartDriveBadSectors silence expires 2026-10-08 with nothing behind it, and smaug's boot disk is next: decide what a static reallocated count means #572, smaug has no SMART and no patch state, and the mechanism every other host uses is a push it cannot make #483 and Saruman's Proxmox firewall was never enabled: ADR-0014's rule exists only in a runbook, and phoenix's 8006 line has no wall to go in #566, so none of them appears in a milestone section, and the Saruman's pve-firewall is enabled by #566 and watched by nothing: a gauge and a rule so it stays on #576 line says what it now watches rather than pointing at a closed issue.
• What those merges found — the Proxmox firewall never enabled and its management set derived from the node's subnet, smaug's SMART by root cron with patch state declined, what powers smaug, and both ADR-0048 decisions — is in changelog.md under 2026-09-20. That is the split doing its job on its first real day.

Because the roadmap was rewritten wholesale, git renders each of these as a whole-file conflict; every one was resolved by keeping the new structure and re-applying the upstream facts into the section they belong in.

main's ADR-0048 collision, and how it cleared

#586 and #588 merged in parallel and both numbered their ADR 0048, which turned main red at c774d64 and, through the merge, this branch with it: 14 check_docs.py disagreements, none in a file this change is about. #591 already owned the renumber, so this branch did not touch it and waited instead. That PR has since landed, the UPS ADR is 0049, and merging it in cleared all 14. The #574 entry here and its dated changelog entry point at ADR-0049.

All three checks are green on the head commit, and the branch is level with main.

Documentation only; no host changes.

🤖 Generated with Claude Code