[Gerrrt]

Refs #574. A correctness fix to the runbook #586 added, found by reading the card before working from it.

The finding

scripts/snmp-walk.sh --device mjolnir 1.3.6.1.4.1.318.1.1.1.5.2, on 2026-09-21:

.1.3.6.1.4.1.318.1.1.1.5.2.8.0   0:0:02:00.00

upsAdvConfigLowBatteryRunTime is two minutes — APC's factory default, never changed on this card. That is when the card raises LB, which is the starting gun for every subscriber. Everything has to finish inside it or the hosts lose power part-way through the shutdown.

It does not fit. The runbook's own timings overrun it before a single guest is counted:

	Seconds
HOSTSYNC — primary waits for secondaries	120
FINALDELAY — primary then waits before halting	30
Before the firewall begins halting at all	150
Window the card gives	120

Built against the factory value, this estate would have spent a maintenance window installing a shutdown sequence that still ends in the unclean stop it exists to prevent.

What changes

A new §0, before everything, raising the threshold to 8 minutes at the card's web interface — the one place in this repository that writes to the card rather than reads it. Eight is chosen to be safely too large, not right: at 21 % load and ~47 claimed minutes it is about a sixth of the pack, spent buying margin on a sequence nobody has timed. §5 times the sequence, §6 measures what a minute of pack is worth, and §6.5 now sets the final value downward from those two readings instead of being where the problem is discovered.

§1's guest count was wrong. Saruman runs two, alexander (140) and phoenix (170), both QEMU, read from homelab_guest_running — not the four the prose assumed. So the primary's wait is generous rather than tight, and §5 brings it down.

A new troubleshooting entry for the failure this design acquires with age: a pack that has weakened until the sequence no longer fits its window. SmartDriveUnsafeShutdownsGrowing is the only thing that would report it, which is exactly the rule ADR-0049 put there.

Not changed

ADR-0049 is unamended, deliberately. It says the low-battery point is the card's, read rather than chosen, and that the measurement is what says whether it is enough. This is that reading arriving before the build instead of after it — the decision is unchanged, so there is nothing to supersede.

Verification

• scripts/validate.sh — 94 checks, no failures, exit 0.
• scripts/check_docs.py — clean, before and after merging main (docs(roadmap): the file is the shape of the open work again, and its history is changelog.md (#577) #584 landed mid-task).
• markdownlint-cli2 — 0 issues across 102 files.
• Cross-checked that every mention of the two numbers agrees between §0, §1, §5 and §6.

🤖 Generated with Claude Code