[Gerrrt]

What changed

• docs/runbooks/verify-the-alert-path.md records the Sensitive tier: ntfy, to bring the notification path in-house #136 cutover as run: a UTC timeline read from Caddy's access log, ntfy's cache and Prometheus's ALERTS, what the run found, and what was not run.
• The runbook steps are corrected where the run showed them to be wrong.
• docs/changelog.md gets an entry for 2026-09-29.

Why

The runbook says the times must be written down before the issue is closed. A notification path is believed only after it has been observed working.

Observed:

• Both halves of the alert path: the in-house copy over Wi-Fi, and the ntfy.sh copy over mobile data, both in the new format.
• The kill drill: docker stop sensitive-ntfy at 03:12:05; EndpointUnreachable paged through ntfy.sh at 03:18.
• The in-house retries: after the restart, Alertmanager delivered the held-back in-house pages.
• AlertmanagerNotificationsFailing: it fired at 03:24:26 with reason="serverError", reporting the drill.

Not run, and recorded as such: the lowered-Watchdog check and the category=security page.

Corrected in the steps:

• amtool runs through docker exec into the container; it isn't installed on the host.
• A secrets edit dirties the deployment checkout and needs a PR, as chore(secrets): trinity's ntfy and Homepage keys, encrypted (#136, #137) #717 and chore(secrets): prometheus's alert-path keys for the in-house ntfy, encrypted (#136) #720 were.
• A URL change needs make render before Alertmanager sees it.
• Resolve the test alert before firing it again.
• The drill's real timing, and the NotificationsFailing tail after it.

Blast radius

Docs only.

• No change to network segmentation or firewall rules
• No new port published to a VLAN that could not already reach the service
• No credential added outside secrets/*.sops.yaml

Verification

• make validate passes
• Deployed and confirmed working: this PR is the record of that
• Docs updated

Closes #136

🤖 Generated with Claude Code