docs: close out serenity migration cleanup lane

docs/planning/SERENITY_MAJORITY_MIGRATION_PLAN.md

@@ -12,6 +12,7 @@ Completed live:
 - `Hawser` + `dockersocket` verified live and healthy on Serenity
 - `Notifiarr` re-evaluated against live PD headroom and intentionally left on Serenity for now
 - `netdata` re-evaluated and kept on Serenity for now as host-local monitoring, not as an early migration target
+- closeout check: no remaining open Serenity-specific Kanban cards exist from the completed cleanup/planning wave; only the documented planned/blocked future lanes remain
 
 Current blockers verified live:
 - PD is still RAM-constrained (`31 GiB total`, `27 GiB used`, `2.3 GiB free` at check time)
@@ -133,7 +134,7 @@ Use this as the working card map.
 ### Epic A — Immediate cleanup and intention-locking
 
 #### A1. Retire Wizarr
-Status: ready
+Status: completed 2026-05-26
 Depends on: none
 
 Acceptance criteria:
@@ -143,7 +144,7 @@ Acceptance criteria:
 - rollback expectation is explicitly "rebuild if needed later," not "preserve migrated state"
 
 #### A2. Document Hawser + dockersocket as protected keepers
-Status: ready
+Status: completed 2026-05-26
 Depends on: none
 
 Acceptance criteria:
@@ -152,7 +153,7 @@ Acceptance criteria:
 - any later rehome/removal must be paired with a replacement Dockhand management path
 
 #### A3. Decide whether netdata remains worth keeping
-Status: ready
+Status: completed 2026-05-26
 Depends on: none
 
 Acceptance criteria:
@@ -212,7 +213,7 @@ Acceptance criteria:
 ### Epic C — Optional tiny near-term moves
 
 #### C1. Re-evaluate Notifiarr against live PD headroom
-Status: ready
+Status: completed 2026-05-26
 Depends on: none
 
 Acceptance criteria:

docs/planning/TODO.md

@@ -11,8 +11,11 @@
   - RPi4 remains optional future BACKUP2 work if you want a third node later
 - [x] Deploy Kima-Hub — completed 2026-05-06; docs/planning/DEPLOY_KIMA_HUB.md now serves as deployment/repair reference
 - [ ] Set up off-site backup for vital data (appdata, databases, config repo, photos)
-- [ ] Remove dead Unraid-Cloudflared-Tunnel container from Serenity
+- [x] Remove dead Unraid-Cloudflared-Tunnel container from Serenity — completed 2026-05-25
 - [ ] Serenity malcolm pool capacity planning (heavily utilized)
+- [ ] Design post-Serenity backup DNS lane (target: Pi 4B backup resolver outside PD's failure domain)
+- [ ] Redesign Pangolin/Newt so Serenity resources no longer require Serenity-local Newt
+- [ ] Define PD storage cutover model for qBittorrent/ARR locality migration off Serenity
 - [x] Add Pangolin resource for `openwebui.paccoco.com` → OpenWebUI (port 8282) — completed 2026-05-15
 - [x] Add Cloudflare DNS record for `openwebui.paccoco.com` — completed 2026-05-15
 - [ ] Install fresh editor on PD

docs/servers/SERENITY.md

@@ -80,6 +80,6 @@ Serenity hosts the secondary backup Technitium node on `10.5.30.10`.
 
 - Transitional only; do not design new long-term dependencies around Serenity.
 - Near-term it continues to host storage locality, reranker, the backup Technitium node, and the Serenity-local Newt needed for Pangolin access to Serenity resources.
-- Near-term cleanup should retire `Wizarr`, keep `Hawser` + `dockersocket` because Dockhand depends on them for remote management of Serenity's remaining Docker stacks, and only consider tiny optional moves such as `Notifiarr` if PD headroom makes them worthwhile.
+- Near-term cleanup already retired `Wizarr`, keeps `Hawser` + `dockersocket` because Dockhand depends on them for remote management of Serenity's remaining Docker stacks, and intentionally leaves `Notifiarr` and `netdata` on Serenity for now because PD headroom and host-local monitoring value do not justify an early move.
 - Once PD directly owns the storage, qBittorrent/ARR locality should move to PD and Serenity should be drained and retired.
 - The stale Pangolin/Newt health-check drift to `10.5.1.5` was fixed on 2026-05-25; future Newt work is now a deliberate rehome/retirement design task rather than an active incident.