Refresh Serenity audit after source app cleanup

docs/planning/SERENITY_CLEANUP_WAVE_1.md

@@ -78,7 +78,7 @@ Live execution on 2026-05-25 established:
 - the Serenity Pi-hole HA stack (`binhex-official-pihole`, `pihole-serenity`, `unbound-pihole-serenity`, `keepalived-pihole-serenity`) was then stopped and removed after live mixed-host DNS checks confirmed the Technitium path remained healthy without it
 - `gamevault` and `gamevault-db` validated healthy on PD, then Serenity `postgresql15` was exported, stopped, archived for rollback, and removed during D7
 - `romm` and `romm-db` validated healthy on PD, then Serenity `MariaDB-Official` was exported, stopped, archived for rollback, and removed during D7
-- the stale stopped Serenity source app container `romm` was then removed as post-cutover cleanup; `gamevault` was already absent from live inventory by that point, so rollback now depends on retained appdata/backup artifacts rather than source containers lingering in `docker ps -a`
+- the stale stopped Serenity source app containers `romm` and `GameVault` were then removed as post-cutover cleanup, so rollback now depends on retained appdata/backup artifacts rather than source containers lingering in `docker ps -a`
 
 ## Wave 1-A: legacy Pi-hole removal
 

docs/planning/SERENITY_DOCKER_AUDIT.md

@@ -1,18 +1,16 @@
 # Serenity Docker Audit
 
-Status: live-audited baseline for cleanup and migration planning.
+Status: live-audited baseline for cleanup and migration planning, refreshed after the GameVault/RomM cutover cleanup.
 
-Last live verification: 2026-05-25
+Last live verification: 2026-05-26
 
 ## Access path used
 
-Direct SSH from this session to `root@10.5.30.5` failed with `Permission denied`.
+Live audit now succeeds directly from NOMAD using the configured host alias:
-Live audit succeeded by hopping through PD:
 
-- `ssh pd`
+- `ssh serenity`
-- then `ssh -i /home/truenas_admin/.ssh/serenity_backup_ed25519 root@10.5.30.5`
 
-That means the inventory below is grounded in the current live runtime, but through PD's trusted Serenity backup key rather than direct local SSH.
+Older discovery in this document used the PD pivot path before direct local SSH was wired up.
 
 ## What is currently running on Serenity
 
@@ -56,10 +54,8 @@ These are live today, but they are not good long-term reasons to keep Serenity a
   - helper/observability tooling, not a reason to preserve Serenity as a host role
 - `netdata`
   - useful while Serenity remains live, not a reason to keep Serenity permanently
-- `GameVault`
-- `romm`
 - `Wizarr`
-  - these are normal app workloads, not storage-appliance-only workloads
+  - this is a normal app workload, not a storage-appliance-only workload
   - long-term candidates for PD once the storage and app-host migration is ready
 
 ### Retire candidates
@@ -74,11 +70,14 @@ These should be treated as cleanup targets unless a specific live dependency is
 - `keepalived-pihole-serenity`
   - these were legacy DNS/HA remnants once Technitium became the intended resolver strategy
   - mixed-host DNS verification passed during retirement on 2026-05-25, and the Serenity Pi-hole HA stack was then stopped and removed without immediate DNS regression
-- `postgresql15`
+- the old local DB pair (`postgresql15` and `MariaDB-Official`) was retired on 2026-05-25 after PD validation and rollback bundle creation
-- `MariaDB-Official`
+- the stale stopped source app containers (`romm` and `GameVault`) were removed on 2026-05-26
-  - both are live, but they are suspicious because current docs position PD as the shared database home
+- retained rollback paths still exist on Serenity:
-  - do not delete blindly; first identify whether any Serenity-only apps still depend on them
+  - `/mnt/user/backups/doris/serenity-d7-db-retire-20260525-213531`
-  - treat them as consolidation candidates, not permanent Serenity residents
+  - `/mnt/user/appdata/romm`
+  - `/mnt/user/appdata/gamevault`
+  - `/mnt/user/appdata/mariadb-official`
+  - `/mnt/cache/appdata/postgresql15`
 
 ## Not-running / stale containers seen in `docker ps -a`
 These did not appear live and should be reviewed for deletion after confirming their data is not needed.
@@ -91,10 +90,10 @@ Created only (retired on 2026-05-25 after metadata verification):
 - `agregarr`
 
 Exited:
-- `Huntarr` — exited 6 weeks ago
+- none remaining from the previously audited stale set; `Huntarr`, `omegabrr`, `romm`, and `GameVault` have now been removed
-- `omegabrr` — exited 4 months ago
 
-These are strong clutter candidates.
+Current result:
+- no stale created/exited containers remain in `docker ps -a`
 
 ## Live project roots observed