Refresh Serenity audit after source app cleanup

docs/planning/SERENITY_DOCKER_AUDIT.md

@@ -1,18 +1,16 @@
 # Serenity Docker Audit
 
-Status: live-audited baseline for cleanup and migration planning.
+Status: live-audited baseline for cleanup and migration planning, refreshed after the GameVault/RomM cutover cleanup.
 
-Last live verification: 2026-05-25
+Last live verification: 2026-05-26
 
 ## Access path used
 
-Direct SSH from this session to `root@10.5.30.5` failed with `Permission denied`.
-Live audit succeeded by hopping through PD:
+Live audit now succeeds directly from NOMAD using the configured host alias:
 
-- `ssh pd`
-- then `ssh -i /home/truenas_admin/.ssh/serenity_backup_ed25519 root@10.5.30.5`
+- `ssh serenity`
 
-That means the inventory below is grounded in the current live runtime, but through PD's trusted Serenity backup key rather than direct local SSH.
+Older discovery in this document used the PD pivot path before direct local SSH was wired up.
 
 ## What is currently running on Serenity
 
@@ -56,10 +54,8 @@ These are live today, but they are not good long-term reasons to keep Serenity a
   - helper/observability tooling, not a reason to preserve Serenity as a host role
 - `netdata`
   - useful while Serenity remains live, not a reason to keep Serenity permanently
-- `GameVault`
-- `romm`
 - `Wizarr`
-  - these are normal app workloads, not storage-appliance-only workloads
+  - this is a normal app workload, not a storage-appliance-only workload
   - long-term candidates for PD once the storage and app-host migration is ready
 
 ### Retire candidates
@@ -74,11 +70,14 @@ These should be treated as cleanup targets unless a specific live dependency is
 - `keepalived-pihole-serenity`
   - these were legacy DNS/HA remnants once Technitium became the intended resolver strategy
   - mixed-host DNS verification passed during retirement on 2026-05-25, and the Serenity Pi-hole HA stack was then stopped and removed without immediate DNS regression
-- `postgresql15`
-- `MariaDB-Official`
-  - both are live, but they are suspicious because current docs position PD as the shared database home
-  - do not delete blindly; first identify whether any Serenity-only apps still depend on them
-  - treat them as consolidation candidates, not permanent Serenity residents
+- the old local DB pair (`postgresql15` and `MariaDB-Official`) was retired on 2026-05-25 after PD validation and rollback bundle creation
+- the stale stopped source app containers (`romm` and `GameVault`) were removed on 2026-05-26
+- retained rollback paths still exist on Serenity:
+  - `/mnt/user/backups/doris/serenity-d7-db-retire-20260525-213531`
+  - `/mnt/user/appdata/romm`
+  - `/mnt/user/appdata/gamevault`
+  - `/mnt/user/appdata/mariadb-official`
+  - `/mnt/cache/appdata/postgresql15`
 
 ## Not-running / stale containers seen in `docker ps -a`
 These did not appear live and should be reviewed for deletion after confirming their data is not needed.
@@ -91,10 +90,10 @@ Created only (retired on 2026-05-25 after metadata verification):
 - `agregarr`
 
 Exited:
-- `Huntarr` — exited 6 weeks ago
-- `omegabrr` — exited 4 months ago
+- none remaining from the previously audited stale set; `Huntarr`, `omegabrr`, `romm`, and `GameVault` have now been removed
 
-These are strong clutter candidates.
+Current result:
+- no stale created/exited containers remain in `docker ps -a`
 
 ## Live project roots observed