Update services directory after homelab sweep

docs/architecture/SERVICES_DIRECTORY.md

@@ -2,7 +2,7 @@
 
 All homelab services, their hosts, ports, and current status.
 
-*Last updated: 2026-05-26*
+*Last updated: 2026-05-27*
 
 ## Shared Databases (PD)
 
@@ -27,6 +27,8 @@ All homelab services, their hosts, ports, and current status.
 | RackPeek | 8283 | http://pd:8283 | ✅ Active |
 | Authelia | 9091 | http://pd:9091 | ✅ Active internally on PD as legacy migration-only auth plumbing; public `auth.paccoco.com` now redirects to Authentik |
 | Authentik | 9000 | http://pd:9000 / https://authentik.paccoco.com | ✅ Active; public identity front door for OIDC/SAML and forward-auth flows |
+| Headscale | 8084 | http://pd:8084 | ✅ Active; control-plane container is running and host port is published |
+| Headplane | 3005 | http://pd:3005 | ✅ Active; admin UI container is running and host port is published |
 
 ## AI Stack
 
@@ -44,6 +46,13 @@ All homelab services, their hosts, ports, and current status.
 
 OpenClaw is no longer treated as an active PD service in the operator inventory. Only helper-artifact references remain under the school-intake planning docs.
 
+## DNS / network control plane
+
+| Service | Host | Port | Status |
+|---------|------|------|--------|
+| Technitium primary source node | PD (`10.5.30.8` via `technitium-pilot` macvlan stack) | 53 / 5380 | ⚠️ Container is running, but this pass did not directly verify the admin HTTP path because the service is not host-published and simple LAN-side `:5380` probes did not answer |
+| Nebula Sync | PD | container-only | ⚠️ Container is present but currently reports `unhealthy`; re-check before treating old Pi-hole sync as healthy |
+
 ## Media (PD)
 
 | Service | Port | Status |
@@ -67,6 +76,7 @@ OpenClaw is no longer treated as an active PD service in the operator inventory.
 | DoneTick | 2021 | ✅ Active |
 | Dakboard Bridge | 5087 | ✅ Active |
 | Qui | 7476 | ✅ Active |
+| Dispatcharr | 9191 | ✅ Active |
 
 ## Smart Home (PD)