meshtastic: map usb meshcore companion into meshmonitor

- catch Paperless handoff exceptions during assignment intake
- preserve local submission records when archive handoff fails
- redirect HTML uploads back to the form with readable status details
- show archive-pending messaging instead of a raw 500 page

.github/workflows/secret-guardrails.yml

@@ -3,10 +3,11 @@ name: secret-guardrails
 on:
   push:
   pull_request:
+  workflow_dispatch:
 
 jobs:
   artifact-secret-scan:
-    runs-on: ubuntu-latest
+    runs-on: [self-hosted, linux, x64, nomad, truenas-stacks]
     steps:
       - name: Check out repo
         uses: actions/checkout@v4
@@ -20,7 +21,7 @@ jobs:
         run: scripts/scan-secret-bearing-artifacts.sh --tracked
 
   gitleaks:
-    runs-on: ubuntu-latest
+    runs-on: [self-hosted, linux, x64, nomad, truenas-stacks]
     steps:
       - name: Check out repo
         uses: actions/checkout@v4

DEPLOYMENT_HANDOFF.md

@@ -7,6 +7,7 @@ Phase 2 (AI stack) is fully deployed and verified on PlausibleDeniability (10.5.
 ## What's Done
 
 ### Phase 2 — AI Stack (COMPLETE)
+Historical note: this handoff reflects the original PD-first AI deployment snapshot, not the current Honcho routing policy.
 All 6 containers running and verified on PD (10.5.30.6):
 - **Ollama:** port 11434 — qwen2.5:14b loaded
 - **OpenWebUI:** port 8282 (→8080)

HOMELAB_BUILDOUT_PLAN.md

@@ -575,7 +575,7 @@
    575|Trigger:  Cron node (every Sunday at 10:00 AM)
    576|Step 1:   Postgres node → SELECT watch history for past 7 days
    577|Step 2:   Format data as structured text
-   578|Step 3:   HTTP Request → Ollama API (POST to PD's qwen2.5:14b)
+   578|Step 3:   HTTP Request → Ollama API (POST to the local/default automation model host, preferably N.O.M.A.D.-local rather than PD)
    579|            - Prompt: "Summarize this week's viewing in a fun digest: {data}"
    580|Step 4:   HTTP Request → Gotify (send digest)
    581|```
@@ -1093,9 +1093,9 @@
   1388|
   1389|LiteLLM sits in front of your three Ollama instances and presents a single OpenAI-compatible API at `http://litellm:4000`. It handles:
   1390|
-  1391|- **Model routing** — requests for `qwen3:32b` go to ROCINANTE, `qwen2.5:14b` goes to PD, `phi4` goes to N.O.M.A.D.
+  - **Model routing** — current reliable default is N.O.M.A.D.-local Ollama for background/automation paths, with PD kept available for shared light-tier use and Rocinante treated as optional/manual heavy capacity.
-  1392|- **Failover** — if ROCINANTE is offline, LiteLLM can fall back to PD automatically
+  - **Failover** — avoid designs that require Rocinante to be online; degrade to N.O.M.A.D.-local or explicitly operator-invoked PD paths instead of automatic dependence on a personal PC.
-  1393|- **Load balancing** — distribute requests across instances running the same model
+  - **Load balancing** — distribute requests across instances running the same model when you have multiple dependable backends, but do not assume Rocinante qualifies as one.
   1394|- **Usage tracking** — logs token counts, latency, and costs per model/user via its built-in database
   1395|
   1396|### 7.2 — Scaffold Directories
@@ -1621,17 +1621,23 @@
   1916|{
   1917|  "models": [
   1918|    {
-  1919|      "title": "PD - qwen2.5:14b",
+  1919|      "title": "N.O.M.A.D. - qwen2.5:3b",
   1920|      "provider": "ollama",
-  1921|      "model": "qwen2.5:14b",
+  1921|      "model": "qwen2.5:3b",
-  1922|      "apiBase": "http://PD_TAILSCALE_IP:11434"
+  1922|      "apiBase": "http://NOMAD_LOCAL_OR_TAILSCALE_IP:11434"
   1923|    },
   1924|    {
-  1925|      "title": "ROCINANTE - qwen3:32b",
+  1925|      "title": "PD - shared light tier (manual / fallback)",
   1926|      "provider": "ollama",
-  1927|      "model": "qwen3:32b",
+  1927|      "model": "qwen2.5:14b",
-  1928|      "apiBase": "http://ROCINANTE_TAILSCALE_IP:11434"
+  1928|      "apiBase": "http://PD_TAILSCALE_IP:11434"
-  1929|    }
+  1929|    },
+  1930|    {
+  1931|      "title": "ROCINANTE - opportunistic heavy",
+  1932|      "provider": "ollama",
+  1933|      "model": "qwen3:32b",
+  1934|      "apiBase": "http://ROCINANTE_TAILSCALE_IP:11434"
+  1935|    }
   1930|  ],
   1931|  "tabAutocompleteModel": {
   1932|    "title": "N.O.M.A.D. - phi4",

README.md

@@ -20,7 +20,8 @@ photos/          # immich server + machine learning
 home/            # kitchenowl, donetick, shlink, qui, dakboard bridges, doris-dashboard
 dev/             # gitea, rackpeek
 ai/              # ollama, openwebui
-meshtastic/      # meshmonitor, mqtt-proxy, tileserver, meshtastic-map
+headscale/       # pilot self-hosted tailnet control plane + Headplane UI on PD
+meshtastic/      # meshmonitor, tileserver, meshtastic-map, and MeshCore/MeshMonitor integration notes
 automation/      # planned: gotify, n8n
 search/          # planned: qdrant
 docs/            # all homelab documentation

automation/.env.example

@@ -43,7 +43,7 @@ PD_DATABASES_ROOT=/mnt/docker-ssd/docker/databases
 PD_TANK_DOCKER_ROOT=/mnt/tank/docker
 PD_DB_DUMP_ROOT=/mnt/tank/docker/backups/db-dumps
 POSTGRES_CONTAINER=shared-postgres
-POSTGRES_DB_LIST="n8n paperless"
+POSTGRES_DB_LIST="gitea n8n paperless"
 BACKUP_SSH_KEY=/home/truenas_admin/.ssh/serenity_backup_ed25519
 BACKUP_KNOWN_HOSTS=/home/truenas_admin/.ssh/known_hosts
 DOCKER_BIN=/usr/bin/docker

automation/README.md

@@ -30,7 +30,7 @@ automation/bin/karakeep_api.py /api/health --raw-path --pretty
 
 ## Backup scripts
 
-- `bin/pd_backup_postgres.sh` — creates gzipped `pg_dump` exports for the configured Postgres DB list (quote space-separated DB names in `.env`, e.g. `POSTGRES_DB_LIST="n8n paperless"`)
+- `bin/pd_backup_postgres.sh` — creates gzipped `pg_dump` exports for the configured Postgres DB list (quote space-separated DB names in `.env`, e.g. `POSTGRES_DB_LIST="gitea n8n paperless"`)
 - `bin/pd_backup_sync_to_serenity.sh` — `rsync`s configured backup/config roots to Serenity
 - `bin/run_pd_backups.sh` — wrapper that runs both steps in order
 - `bin/pd_restore_verify_postgres.sh` — restores the latest dump for each configured database into a throwaway Postgres container and fails on SQL errors
@@ -140,6 +140,7 @@ tail -100 /mnt/tank/docker/backups/pd-backups.log
 ## Safety notes
 
 - DB dumps are the priority restore artifacts; do not rely only on raw volume copies.
+- For Gitea specifically, keep the logical Postgres dump in `POSTGRES_DB_LIST`; a live rsynced Postgres volume alone is not the preferred recovery artifact.
 - The sync script uses `rsync --delete` inside the destination backup root, so point it at a dedicated backup path.
 - Keep `.env` and SSH material out of git.
 - If cron runs under a non-root PD account, `sudo -n /usr/bin/docker` must work or the DB dump step will fail.

automation/bin/pangolin_upsert_headscale.py

@@ -0,0 +1,254 @@
+#!/usr/bin/env python3
+"""Create or update the Pangolin resource/target for Headscale.
+
+Expected env vars:
+- PANGOLIN_API_URL   e.g. https://api.paccoco.com/v1
+- PANGOLIN_API_KEY   bearer token for Pangolin integration API
+- PANGOLIN_ORG_ID    e.g. paccoco
+Optional env defaults:
+- PANGOLIN_SITE_ID   default 4 (Plausible Deniability)
+- PANGOLIN_DOMAIN_ID default domain1
+
+Default desired resource:
+- host/domain: headscale.paccoco.com
+- site: Plausible Deniability (siteId 4)
+- target: headscale:8080
+- Pangolin auth: disabled (sso=false)
+- healthcheck: GET /health
+"""
+
+from __future__ import annotations
+
+import argparse
+import json
+import os
+import sys
+from typing import Any
+from urllib import error, parse, request
+
+DEFAULT_API_URL = "https://api.paccoco.com/v1"
+DEFAULT_ORG_ID = "paccoco"
+DEFAULT_DOMAIN_ID = "domain1"
+DEFAULT_SITE_ID = 4
+DEFAULT_NAME = "headscale"
+DEFAULT_SUBDOMAIN = "headscale"
+DEFAULT_TARGET_IP = "headscale"
+DEFAULT_TARGET_PORT = 8080
+DEFAULT_HC_PATH = "/health"
+USER_AGENT = "doris-pangolin-headscale/1.0"
+
+
+def env(name: str, default: str | None = None) -> str | None:
+    value = os.environ.get(name)
+    if value is None or value == "":
+        return default
+    return value
+
+
+def api_request(base_url: str, api_key: str, method: str, path: str, body: dict[str, Any] | None = None) -> tuple[int, Any]:
+    url = base_url.rstrip("/") + path
+    headers = {
+        "Authorization": f"Bearer {api_key}",
+        "Accept": "application/json",
+        "User-Agent": USER_AGENT,
+    }
+    data = None
+    if body is not None:
+        data = json.dumps(body).encode("utf-8")
+        headers["Content-Type"] = "application/json"
+    req = request.Request(url, data=data, headers=headers, method=method.upper())
+    try:
+        with request.urlopen(req, timeout=30) as resp:
+            raw = resp.read().decode("utf-8", "replace")
+            return resp.status, json.loads(raw) if raw else None
+    except error.HTTPError as exc:
+        raw = exc.read().decode("utf-8", "replace")
+        try:
+            payload = json.loads(raw)
+        except Exception:
+            payload = raw
+        return exc.code, payload
+
+
+def fail(msg: str, payload: Any = None) -> int:
+    print(msg, file=sys.stderr)
+    if payload is not None:
+        if isinstance(payload, (dict, list)):
+            print(json.dumps(payload, indent=2, sort_keys=True), file=sys.stderr)
+        else:
+            print(payload, file=sys.stderr)
+    return 1
+
+
+def find_resource(resources: list[dict[str, Any]], *, name: str, full_domain: str) -> dict[str, Any] | None:
+    for resource in resources:
+        if resource.get("fullDomain") == full_domain:
+            return resource
+    for resource in resources:
+        if resource.get("name") == name:
+            return resource
+    return None
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser(description="Upsert Pangolin Headscale resource")
+    parser.add_argument("--api-url", default=env("PANGOLIN_API_URL", DEFAULT_API_URL))
+    parser.add_argument("--api-key", default=env("PANGOLIN_API_KEY"))
+    parser.add_argument("--org-id", default=env("PANGOLIN_ORG_ID", DEFAULT_ORG_ID))
+    site_id_default = env("PANGOLIN_SITE_ID", str(DEFAULT_SITE_ID)) or str(DEFAULT_SITE_ID)
+    parser.add_argument("--site-id", type=int, default=int(site_id_default))
+    parser.add_argument("--domain-id", default=env("PANGOLIN_DOMAIN_ID", DEFAULT_DOMAIN_ID))
+    parser.add_argument("--name", default=DEFAULT_NAME)
+    parser.add_argument("--subdomain", default=DEFAULT_SUBDOMAIN)
+    parser.add_argument("--target-ip", default=DEFAULT_TARGET_IP)
+    parser.add_argument("--target-port", type=int, default=DEFAULT_TARGET_PORT)
+    parser.add_argument("--hc-path", default=DEFAULT_HC_PATH)
+    parser.add_argument("--dry-run", action="store_true")
+    args = parser.parse_args()
+
+    if not args.api_key:
+        return fail("Missing PANGOLIN_API_KEY / --api-key")
+
+    full_domain = f"{args.subdomain}.paccoco.com"
+
+    status, resources_resp = api_request(
+        args.api_url,
+        args.api_key,
+        "GET",
+        f"/org/{parse.quote(args.org_id)}/resources?pageSize=200",
+    )
+    if status != 200:
+        return fail("Failed to list Pangolin resources", resources_resp)
+
+    resources = resources_resp.get("data", {}).get("resources", [])
+    resource = find_resource(resources, name=args.name, full_domain=full_domain)
+
+    create_body = {
+        "name": args.name,
+        "subdomain": args.subdomain,
+        "http": True,
+        "protocol": "tcp",
+        "domainId": args.domain_id,
+    }
+
+    if resource is None:
+        if args.dry_run:
+            print(json.dumps({"action": "create_resource", "body": create_body}, indent=2))
+            resource_id = None
+        else:
+            status, create_resp = api_request(
+                args.api_url,
+                args.api_key,
+                "PUT",
+                f"/org/{parse.quote(args.org_id)}/resource",
+                create_body,
+            )
+            if status not in (200, 201):
+                return fail("Failed to create Pangolin resource", create_resp)
+            resource_id = create_resp.get("data", {}).get("resourceId") or create_resp.get("data", {}).get("resource", {}).get("resourceId")
+            if not resource_id:
+                return fail("Create resource succeeded but resourceId was missing", create_resp)
+            status, resource_resp = api_request(args.api_url, args.api_key, "GET", f"/resource/{resource_id}")
+            if status != 200:
+                return fail("Failed to read back created resource", resource_resp)
+            resource = resource_resp.get("data", {}).get("resource") or resource_resp.get("data") or {}
+    else:
+        resource_id = resource["resourceId"]
+
+    resource_update = {
+        "name": args.name,
+        "niceId": resource.get("niceId") if resource else None,
+        "subdomain": args.subdomain,
+        "ssl": True,
+        "sso": False,
+        "blockAccess": False,
+        "emailWhitelistEnabled": False,
+        "applyRules": False,
+        "domainId": args.domain_id,
+        "enabled": True,
+        "stickySession": False,
+        "tlsServerName": None,
+        "setHostHeader": None,
+        "skipToIdpId": None,
+        "headers": None,
+        "maintenanceModeEnabled": False,
+        "maintenanceModeType": "forced",
+        "maintenanceTitle": None,
+        "maintenanceMessage": None,
+        "maintenanceEstimatedTime": None,
+        "postAuthPath": None,
+    }
+
+    target_body = {
+        "siteId": args.site_id,
+        "method": "http",
+        "ip": args.target_ip,
+        "port": args.target_port,
+        "enabled": True,
+        "hcEnabled": True,
+        "hcPath": args.hc_path,
+        "hcScheme": "http",
+        "hcMode": "http",
+        "hcHostname": args.target_ip,
+        "hcPort": args.target_port,
+        "hcInterval": 30,
+        "hcUnhealthyInterval": 30,
+        "hcTimeout": 10,
+        "hcHeaders": None,
+        "hcFollowRedirects": True,
+        "hcMethod": "GET",
+        "hcStatus": 200,
+        "hcTlsServerName": None,
+        "hcHealthyThreshold": 1,
+        "hcUnhealthyThreshold": 3,
+        "path": None,
+        "pathMatchType": None,
+        "rewritePath": None,
+        "rewritePathType": None,
+    }
+
+    existing_targets = resource.get("targets", []) if resource else []
+    matching_target = None
+    for target in existing_targets:
+        if target.get("siteId") == args.site_id:
+            matching_target = target
+            break
+
+    if args.dry_run:
+        print(json.dumps({
+            "resource_id": resource_id,
+            "full_domain": full_domain,
+            "resource_update": resource_update,
+            "target_action": "update" if matching_target else "create",
+            "target_id": matching_target.get("targetId") if matching_target else None,
+            "target_body": target_body,
+        }, indent=2))
+        return 0
+
+    if resource_id is not None:
+        status, update_resp = api_request(args.api_url, args.api_key, "POST", f"/resource/{resource_id}", resource_update)
+        if status not in (200, 201):
+            return fail("Failed to update Pangolin resource", update_resp)
+
+        if matching_target:
+            target_id = matching_target["targetId"]
+            status, target_resp = api_request(args.api_url, args.api_key, "POST", f"/target/{target_id}", target_body)
+            if status not in (200, 201):
+                return fail("Failed to update Pangolin target", target_resp)
+        else:
+            status, target_resp = api_request(args.api_url, args.api_key, "PUT", f"/resource/{resource_id}/target", target_body)
+            if status not in (200, 201):
+                return fail("Failed to create Pangolin target", target_resp)
+
+        status, final_resp = api_request(args.api_url, args.api_key, "GET", f"/resource/{resource_id}")
+        if status != 200:
+            return fail("Failed to read back final Pangolin resource", final_resp)
+        payload = final_resp.get("data", {}).get("resource") or final_resp.get("data") or final_resp
+        print(json.dumps(payload, indent=2))
+        return 0
+
+    return fail("Unexpected state: resource_id is missing")
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

automation/bin/unifi_stage_hermes_dashboard_policy.py

@@ -0,0 +1,244 @@
+#!/usr/bin/env python3
+"""Stage/apply the narrow UniFi Policy Engine slice that makes the Hermes dashboard Trusted-only.
+
+Default mode is dry-run. Pass --apply to create/update the two desired policies.
+Reads credentials from the PD runtime automation .env by default.
+"""
+
+from __future__ import annotations
+
+import argparse
+import importlib.util
+import json
+import os
+from copy import deepcopy
+from pathlib import Path
+from typing import Any
+
+DEFAULT_RUNTIME_HELPER = Path('/mnt/docker-ssd/docker/compose/automation/bin/unifi_stage_low_risk_objects.py')
+DEFAULT_ENV_PATH = Path('/mnt/docker-ssd/docker/compose/automation/.env')
+INTERNAL_ZONE_NAME = 'Internal'
+
+
+def load_helper(path: Path):
+    spec = importlib.util.spec_from_file_location('unifi_stage', path)
+    if spec is None or spec.loader is None:
+        raise RuntimeError(f'Could not load helper module from {path}')
+    module = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(module)
+    return module
+
+
+def desired_policies() -> list[dict[str, Any]]:
+    return [
+        {
+            'name': 'Allow Trusted to Hermes Dashboard',
+            'enabled': True,
+            'action': 'ALLOW',
+            'protocol': 'tcp',
+            'ip_version': 'IPV4',
+            'logging': False,
+            'create_allow_respond': False,
+            'connection_state_type': 'ALL',
+            'connection_states': [],
+            'match_ip_sec': False,
+            'match_opposite_protocol': False,
+            'icmp_typename': 'ANY',
+            'icmp_v6_typename': 'ANY',
+            'description': 'Allow Trusted clients to reach the Hermes dashboard on Nomad.',
+            'source_zone_name': INTERNAL_ZONE_NAME,
+            'destination_zone_name': INTERNAL_ZONE_NAME,
+            'schedule': {'mode': 'ALWAYS'},
+            'source': {
+                'matching_target': 'IP',
+                'matching_target_type': 'SPECIFIC',
+                'ips': ['10.5.1.0/24'],
+                'match_mac': False,
+                'match_opposite_ips': False,
+                'match_opposite_ports': False,
+                'port_matching_type': 'ANY',
+            },
+            'destination': {
+                'matching_target': 'IP',
+                'matching_target_type': 'SPECIFIC',
+                'ips': ['10.5.30.7'],
+                'match_opposite_ips': False,
+                'match_opposite_ports': False,
+                'port_matching_type': 'SPECIFIC',
+                'port': '9119',
+            },
+        },
+        {
+            'name': 'Block Management and Servers to Hermes Dashboard',
+            'enabled': True,
+            'action': 'BLOCK',
+            'protocol': 'tcp',
+            'ip_version': 'IPV4',
+            'logging': False,
+            'create_allow_respond': False,
+            'connection_state_type': 'ALL',
+            'connection_states': [],
+            'match_ip_sec': False,
+            'match_opposite_protocol': False,
+            'icmp_typename': 'ANY',
+            'icmp_v6_typename': 'ANY',
+            'description': 'Block Management and Servers clients from reaching the Hermes dashboard on Nomad.',
+            'source_zone_name': INTERNAL_ZONE_NAME,
+            'destination_zone_name': INTERNAL_ZONE_NAME,
+            'schedule': {'mode': 'ALWAYS'},
+            'source': {
+                'matching_target': 'IP',
+                'matching_target_type': 'SPECIFIC',
+                'ips': ['10.5.0.0/24', '10.5.30.0/24'],
+                'match_mac': False,
+                'match_opposite_ips': False,
+                'match_opposite_ports': False,
+                'port_matching_type': 'ANY',
+            },
+            'destination': {
+                'matching_target': 'IP',
+                'matching_target_type': 'SPECIFIC',
+                'ips': ['10.5.30.7'],
+                'match_opposite_ips': False,
+                'match_opposite_ports': False,
+                'port_matching_type': 'SPECIFIC',
+                'port': '9119',
+            },
+        },
+    ]
+
+
+POLICY_MUTABLE_KEYS = {
+    'name',
+    'enabled',
+    'action',
+    'protocol',
+    'ip_version',
+    'logging',
+    'create_allow_respond',
+    'connection_state_type',
+    'connection_states',
+    'match_ip_sec',
+    'match_opposite_protocol',
+    'icmp_typename',
+    'icmp_v6_typename',
+    'source',
+    'destination',
+    'schedule',
+    'description',
+}
+
+
+def canonical_policy(policy: dict[str, Any]) -> dict[str, Any]:
+    out = {key: deepcopy(policy.get(key)) for key in POLICY_MUTABLE_KEYS if key in policy}
+    out.setdefault('description', '')
+    out.setdefault('connection_state_type', 'ALL')
+    out.setdefault('connection_states', [])
+    out.setdefault('logging', False)
+    out.setdefault('match_ip_sec', False)
+    out.setdefault('match_opposite_protocol', False)
+    out.setdefault('icmp_typename', 'ANY')
+    out.setdefault('icmp_v6_typename', 'ANY')
+    out.setdefault('schedule', {'mode': 'ALWAYS'})
+    return out
+
+
+def resolve_zone_ids(zone_data: list[dict[str, Any]]) -> dict[str, str]:
+    by_name: dict[str, str] = {}
+    for zone in zone_data:
+        name = zone.get('name')
+        zid = zone.get('_id')
+        if name and zid:
+            by_name[name] = zid
+    return by_name
+
+
+def materialize_policy(spec: dict[str, Any], zone_ids: dict[str, str]) -> dict[str, Any]:
+    source_zone = spec['source_zone_name']
+    dest_zone = spec['destination_zone_name']
+    if source_zone not in zone_ids:
+        raise KeyError(f'Missing source zone: {source_zone}')
+    if dest_zone not in zone_ids:
+        raise KeyError(f'Missing destination zone: {dest_zone}')
+
+    policy = {k: deepcopy(v) for k, v in spec.items() if not k.endswith('_zone_name')}
+    policy['description'] = policy.get('description', '')
+    policy['source'] = deepcopy(policy['source'])
+    policy['destination'] = deepcopy(policy['destination'])
+    policy['source']['zone_id'] = zone_ids[source_zone]
+    policy['destination']['zone_id'] = zone_ids[dest_zone]
+    return policy
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser(description='Stage/apply the Hermes dashboard Trusted-only UniFi Policy Engine slice.')
+    parser.add_argument('--helper', default=str(DEFAULT_RUNTIME_HELPER), help='Path to runtime UniFi helper on PD')
+    parser.add_argument('--env-file', default=str(DEFAULT_ENV_PATH), help='Path to runtime .env on PD')
+    parser.add_argument('--site', default='default')
+    parser.add_argument('--apply', action='store_true')
+    args = parser.parse_args()
+
+    helper = load_helper(Path(args.helper))
+    helper.load_env_file(Path(args.env_file))
+    client = helper.UniFiClient(
+        base_url=os.environ.get('UNIFI_BASE_URL', 'https://10.5.0.1'),
+        username=os.environ['UNIFI_USERNAME'],
+        password=os.environ['UNIFI_PASSWORD'],
+        verify_tls=helper.env_bool('UNIFI_VERIFY_TLS', False),
+        timeout=20,
+    )
+    client.login()
+
+    zones_payload = client.get(f'/proxy/network/v2/api/site/{args.site}/firewall/zone')
+    zone_data_raw = zones_payload['data'] if isinstance(zones_payload, dict) and 'data' in zones_payload else zones_payload
+    zone_data = zone_data_raw if isinstance(zone_data_raw, list) else []
+    zone_ids = resolve_zone_ids(zone_data)
+
+    policies_path = f'/proxy/network/v2/api/site/{args.site}/firewall-policies'
+    policies_payload = client.get(policies_path)
+    policy_data_raw = policies_payload['data'] if isinstance(policies_payload, dict) and 'data' in policies_payload else policies_payload
+    policy_data = policy_data_raw if isinstance(policy_data_raw, list) else []
+    custom_by_name = {p.get('name'): p for p in policy_data if not p.get('predefined') and p.get('name')}
+
+    result: dict[str, Any] = {
+        'mode': 'apply' if args.apply else 'dry-run',
+        'zones': sorted(zone_ids.keys()),
+        'changes': [],
+    }
+
+    for desired in desired_policies():
+        materialized = materialize_policy(desired, zone_ids)
+        existing = custom_by_name.get(materialized['name'])
+        desired_canonical = canonical_policy(materialized)
+        if existing is None:
+            result['changes'].append({'name': materialized['name'], 'action': 'create', 'payload': desired_canonical})
+            if args.apply:
+                status, payload = client._json_request('POST', policies_path, desired_canonical)
+                if status >= 300:
+                    result['changes'][-1]['error'] = {'status': status, 'payload': payload}
+            continue
+
+        existing_canonical = canonical_policy(existing)
+        if existing_canonical != desired_canonical:
+            update_payload = deepcopy(existing)
+            for key, value in desired_canonical.items():
+                update_payload[key] = deepcopy(value)
+            result['changes'].append({
+                'name': materialized['name'],
+                'action': 'update',
+                'before': existing_canonical,
+                'after': desired_canonical,
+            })
+            if args.apply:
+                status, payload = client._json_request('PUT', f"{policies_path}/{existing['_id']}", update_payload)
+                if status >= 300:
+                    result['changes'][-1]['error'] = {'status': status, 'payload': payload}
+        else:
+            result['changes'].append({'name': materialized['name'], 'action': 'noop'})
+
+    print(json.dumps(result, indent=2, sort_keys=True))
+    return 0
+
+
+if __name__ == '__main__':
+    raise SystemExit(main())

docs/README.md

@@ -18,6 +18,7 @@ Central index for all homelab infrastructure documentation.
 | [Architecture Overview](architecture/ARCHITECTURE_OVERVIEW.md) | Full stack diagram and service map |
 | [Services Directory](architecture/SERVICES_DIRECTORY.md) | All services with hosts, ports, and status |
 | [Networking Model](architecture/NETWORKING_MODEL.md) | VLANs, firewall policy, DHCP DNS, and remote access |
+| [PD Future-State Topology](architecture/pd-future-state-topology.html) | Visual target-state diagram for the PD rebuild, cyber VM lane, and Serenity retirement |
 | [AI Services Network](architecture/AI_SERVICES_NETWORK.md) | Cross-stack Docker networking for AI services |
 
 ## Stacks
@@ -34,6 +35,10 @@ Central index for all homelab infrastructure documentation.
 | File | Description |
 |------|-------------|
 | [Expansion Plan](planning/HOMELAB_EXPANSION_PLAN.md) | 6-phase buildout — all phases complete as of 2026-05-06 |
+| [PD Future-State Architecture](planning/PD_FUTURE_STATE_ARCHITECTURE.md) | Target-state host layout, storage model, cyber VM policy, and Serenity retirement path |
+| [Serenity Docker Audit](planning/SERENITY_DOCKER_AUDIT.md) | Live-audited keep/move/retire container baseline for Serenity cleanup |
+| [Serenity Cleanup Wave 1](planning/SERENITY_CLEANUP_WAVE_1.md) | First safe cleanup pass: legacy Pi-hole removal, stale container pruning, and DB-app migration ordering |
+| [Serenity Majority Migration Plan](planning/SERENITY_MAJORITY_MIGRATION_PLAN.md) | Kanban-ready post-D7 plan for what stays, what retires, and what moves only after PD storage ownership changes |
 | [TODO](planning/TODO.md) | Active and backlog tasks |
 
 ## Operations
@@ -44,3 +49,4 @@ Central index for all homelab infrastructure documentation.
 | [Backup Policy](operations/BACKUP_POLICY.md) | Backup scope, database dumps, and restore cadence |
 | [PD Backup Deployment](operations/PD_BACKUP_DEPLOYMENT.md) | Live PD backup runner deployment details |
 | [Secrets Management](operations/SECRETS_MANAGEMENT.md) | `.env` handling, encrypted backups, and incident guardrails |
+| [PD qdrant / seerr drift cleanup incident](operations/INCIDENT_2026-05-28_PD_QDRANT_SEERR_DRIFT.md) | Backup-first reconciliation after manual qdrant recovery and media/AI compose drift cleanup |

docs/architecture/ARCHITECTURE_OVERVIEW.md

@@ -1,6 +1,6 @@
 # Architecture Overview
 
-Full homelab stack as of 2026-05-09. All 6 expansion phases are complete and deployed.
+Current live homelab stack plus the planned direction for the upgraded PD platform.
 
 ## Servers
 
@@ -40,7 +40,8 @@ Full homelab stack as of 2026-05-09. All 6 expansion phases are complete and dep
 - **Dockhand** (3230) — Docker management UI
 
 ### AI Layer
-- **LiteLLM** (4000) — unified LLM proxy; routes to Ollama on PD (light) and Rocinante (heavy)
+- **LiteLLM** (4000) — unified LLM proxy; PD remains the shared light tier, while Rocinante is an opportunistic heavy tier when the PC is online
+- **Honcho** — memory/deriver stack on N.O.M.A.D. using local Ollama first so PD outages do not cascade into MeshMonitor/database incidents
 - **OpenWebUI** (8282) — chat UI with RAG, STT, and web search
 - **Qdrant** (6333/6334) — vector database for RAG
 - **Whisper** (8786 / 8787) — CPU speech-to-text on N.O.M.A.D. plus CUDA speech-to-text on Rocinante
@@ -74,3 +75,12 @@ Full homelab stack as of 2026-05-09. All 6 expansion phases are complete and dep
 4. **NFS for Immich** — photo library lives on Serenity's large array; PD mounts on demand (not at boot)
 5. **TrueNAS manages Docker** — never use `systemctl restart docker` on PD; use `docker compose` or `docker restart` for individual containers
 6. **Credential hygiene** — Gitea pushes from PD/NOMAD use internal SSH (`ssh://git@10.5.30.6:2222/<owner>/<repo>.git`); GitHub remote uses SSH key (`/root/.ssh/id_gitea`)
+
+## Planned Direction — upgraded PD + Serenity retirement
+
+- **PD stays on bare-metal TrueNAS Scale** and becomes the long-term production center of gravity for storage, Docker, shared databases, media, identity, monitoring, and the primary DNS source node.
+- **PD may also host cybersecurity VMs**, but only inside a dedicated lab VLAN / policy lane with default-deny access into production.
+- **N.O.M.A.D. remains the trusted secondary lane** for offline knowledge, game hosting, and the backup Technitium resolver.
+- **Rocinante becomes optional** if PD receives the 4090; otherwise it stays the heavy inference specialist.
+- **Serenity is transitional**: as long as it owns the storage, qBittorrent/ARR locality can remain there; once PD directly owns the storage, that path-locality argument flips and the remaining torrent/media-ingest stack should move to PD before Serenity is retired.
+- See [../planning/PD_FUTURE_STATE_ARCHITECTURE.md](../planning/PD_FUTURE_STATE_ARCHITECTURE.md) for the full target-state plan and [pd-future-state-topology.html](pd-future-state-topology.html) for the visual operator map.

docs/architecture/HARDWARE_INVENTORY.md

@@ -47,6 +47,18 @@
 ### NFS Mounts
 - Serenity data array → `/mnt/unraid/data`
 
+### Planned PD upgrade target
+- **Platform:** HL15 Beast ASRock build (`ASRock ROMED8-2T`)
+- **Recommended CPU floor:** EPYC 7282
+- **Preferred long-term CPU:** EPYC 7452 if budget allows
+- **RAM floor:** 64GB
+- **Preferred RAM if hosting production plus multiple cyber VMs:** 128GB
+- **PSU guidance:** keep the RM1000x unless a 4090-class GPU is likely; move to HX1500i when the 4090 plan becomes real
+- **Planned storage growth:**
+  - adopt Serenity's storage role into PD
+  - add a second HDD-backed ZFS pool using 5-6 new 20TB+ drives
+  - add SSD/NVMe tiers for apps, databases, VM disks, scratch, and model cache
+
 ---
 
 ## N.O.M.A.D. (Offline Knowledge + Game Servers)

docs/architecture/SERVICES_DIRECTORY.md

@@ -2,7 +2,7 @@
 
 All homelab services, their hosts, ports, and current status.
 
-*Last updated: 2026-05-21*
+*Last updated: 2026-06-13*
 
 ## Shared Databases (PD)
 
@@ -27,6 +27,8 @@ All homelab services, their hosts, ports, and current status.
 | RackPeek | 8283 | http://pd:8283 | ✅ Active |
 | Authelia | 9091 | http://pd:9091 | ✅ Active internally on PD as legacy migration-only auth plumbing; public `auth.paccoco.com` now redirects to Authentik |
 | Authentik | 9000 | http://pd:9000 / https://authentik.paccoco.com | ✅ Active; public identity front door for OIDC/SAML and forward-auth flows |
+| Headscale | 8084 | http://pd:8084 | ✅ Active; control-plane container is running and host port is published |
+| Headplane | 3005 | http://pd:3005 | ✅ Active; admin UI container is running and host port is published |
 
 ## AI Stack
 
@@ -36,14 +38,21 @@ All homelab services, their hosts, ports, and current status.
 | OpenWebUI | PD | 8282 | ✅ Active |
 | Qdrant | PD | 6333 (HTTP) / 6334 (gRPC) | ✅ Active |
 | Whisper (faster-whisper, CPU) | N.O.M.A.D. (10.5.30.7) | 8786 | ✅ Active |
-| Whisper (faster-whisper, CUDA large-v3) | Rocinante (10.5.30.112) | 8787 | ⚠️ Unreachable from N.O.M.A.D. during 2026-05-21 Doris validation |
+| Whisper (faster-whisper, CUDA large-v3) | Rocinante (10.5.30.112) | 8787 | ⚠️ Re-check from N.O.M.A.D. if Whisper-specific traffic is needed; Ollama-only recovery was validated 2026-05-27 |
 | SearXNG | PD | 8888 | ✅ Active |
-| Ollama — light tier | PD (10.5.30.6) | 11434 | ✅ Active |
+| Ollama — light tier | PD (10.5.30.6) | 11434 | ✅ Active; keep routine Honcho load off this host to protect MeshMonitor/shared Postgres |
-| Ollama — heavy tier | Rocinante (10.5.30.112) | 11434 | ⚠️ Unreachable from N.O.M.A.D. during 2026-05-21 Doris validation |
+| Ollama — heavy tier | Rocinante (10.5.30.112) | 11434 | ⚠️ Personal PC / opportunistic only; do not depend on it for routine background routing |
 | Reranker (TEI) | Serenity (10.5.30.5) | 9787 | ✅ Active |
 
 OpenClaw is no longer treated as an active PD service in the operator inventory. Only helper-artifact references remain under the school-intake planning docs.
 
+## DNS / network control plane
+
+| Service | Host | Port | Status |
+|---------|------|------|--------|
+| Technitium primary source node | PD (`10.5.30.8` via `technitium-pilot` macvlan stack) | 53 / 5380 | ✅ Active source of truth; PD root cron runs `technitium-pilot/bin/sync_backup_nodes.sh` every 15 minutes, and recent logs show successful sync + verification of Nomad (`10.5.30.9`) and Serenity (`10.5.30.10`) |
+| Legacy Pi-hole runtime | PD + N.O.M.A.D. | former legacy resolver path (`10.5.30.53`, Pi-hole/Unbound/Keepalived) | Historical only. PD's old Pi-hole stack (`nebula-sync`, `pihole-primary`, `unbound-pihole-primary`, `keepalived-pihole-primary`) and NOMAD's leftover stack (`pihole-nomad` + `unbound-pihole-nomad` + `keepalived-pihole-nomad`) were both retired on 2026-05-27. The old VIP `10.5.30.53` no longer answers; Technitium (`10.5.30.8/.9/.10`) is the live DNS path. |
+
 ## Media (PD)
 
 | Service | Port | Status |
@@ -67,6 +76,7 @@ OpenClaw is no longer treated as an active PD service in the operator inventory.
 | DoneTick | 2021 | ✅ Active |
 | Dakboard Bridge | 5087 | ✅ Active |
 | Qui | 7476 | ✅ Active |
+| Dispatcharr | 9191 | ✅ Active |
 
 ## Smart Home (PD)
 
@@ -90,7 +100,13 @@ OpenClaw is no longer treated as an active PD service in the operator inventory.
 
 | Service | Host | Port | Status |
 |---------|------|------|--------|
-| MeshCore to MQTT relay | N.O.M.A.D. (10.5.30.7) | outbound MQTT only | ✅ Running as Docker container `mctomqtt` (`mctomqtt:latest`); config bind-mounted from `/etc/mctomqtt` |
+| MeshCore companion observer | N.O.M.A.D. (10.5.30.7) | outbound MQTT only | ✅ Running as systemd service `meshcore-capture`; install root `/home/fizzlepoof/.meshcore-packet-capture`; direct serial connection to the Heltec companion node |
+
+## Local file intake
+
+| Service | Host | Port | Status |
+|---------|------|------|--------|
+| LocalSend Trusted Inbox | N.O.M.A.D. (`10.5.1.16` on Trusted VLAN 51) | 53317/tcp+udp | ✅ Repo-tracked Docker stack at `/opt/localsend-nomad`; advertises `Doris Trusted Inbox`; writes directly into `/home/fizzlepoof/private/inbox-secrets`; Minerva auto-sort watches that inbox via `minerva-localsend-autosort.path`; same-host checks from N.O.M.A.D. are unreliable because of macvlan isolation |
 
 ## Mapping / Geo (PD)
 

docs/architecture/pd-future-state-topology.html

@@ -0,0 +1,210 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="UTF-8" />
+  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <title>PD Future-State Topology</title>
+  <link rel="preconnect" href="https://fonts.googleapis.com">
+  <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
+  <link href="https://fonts.googleapis.com/css2?family=JetBrains+Mono:wght@400;600;700&display=swap" rel="stylesheet">
+  <style>
+    :root {
+      --bg: #020617;
+      --panel: #0f172a;
+      --panel-2: #111827;
+      --text: #e2e8f0;
+      --muted: #94a3b8;
+      --cyan: #22d3ee;
+      --emerald: #34d399;
+      --violet: #a78bfa;
+      --amber: #fbbf24;
+      --rose: #fb7185;
+      --slate: #94a3b8;
+      --line: #1e293b;
+    }
+    * { box-sizing: border-box; }
+    body {
+      margin: 0;
+      font-family: 'JetBrains Mono', monospace;
+      color: var(--text);
+      background:
+        linear-gradient(var(--line) 1px, transparent 1px),
+        linear-gradient(90deg, var(--line) 1px, transparent 1px),
+        var(--bg);
+      background-size: 40px 40px;
+    }
+    .wrap { max-width: 1600px; margin: 0 auto; padding: 24px; }
+    .header, .card, .diagram-shell {
+      background: rgba(15, 23, 42, 0.88);
+      border: 1px solid #1f2937;
+      border-radius: 16px;
+      box-shadow: 0 10px 30px rgba(0, 0, 0, 0.35);
+    }
+    .header { padding: 20px 24px; margin-bottom: 20px; }
+    h1 { margin: 0 0 8px; font-size: 28px; }
+    .subtitle { color: var(--muted); line-height: 1.6; }
+    .diagram-shell { padding: 16px; overflow-x: auto; }
+    svg { width: 100%; min-width: 1450px; height: auto; display: block; }
+    .grid {
+      display: grid;
+      grid-template-columns: repeat(3, 1fr);
+      gap: 16px;
+      margin-top: 20px;
+    }
+    .card { padding: 16px 18px; }
+    .card h3 { margin: 0 0 12px; font-size: 16px; }
+    .card ul { margin: 0; padding-left: 18px; color: var(--muted); line-height: 1.7; }
+    .footer { margin-top: 16px; color: var(--muted); font-size: 12px; }
+    @media (max-width: 1100px) { .grid { grid-template-columns: 1fr; } }
+  </style>
+</head>
+<body>
+  <div class="wrap">
+    <div class="header">
+      <h1>PD Future-State Topology</h1>
+      <div class="subtitle">
+        Target-state operator map for the post-upgrade homelab: PD becomes the primary production platform, NOMAD remains the trusted secondary lane, Rocinante is optional AI specialization, and Serenity is drained then retired after storage adoption.
+      </div>
+    </div>
+
+    <div class="diagram-shell">
+      <svg viewBox="0 0 1500 940" xmlns="http://www.w3.org/2000/svg" role="img" aria-label="PD future-state topology diagram">
+        <defs>
+          <marker id="arrow-cyan" markerWidth="10" markerHeight="10" refX="8" refY="3" orient="auto" markerUnits="strokeWidth">
+            <path d="M0,0 L0,6 L9,3 z" fill="#22d3ee" />
+          </marker>
+          <marker id="arrow-emerald" markerWidth="10" markerHeight="10" refX="8" refY="3" orient="auto" markerUnits="strokeWidth">
+            <path d="M0,0 L0,6 L9,3 z" fill="#34d399" />
+          </marker>
+          <marker id="arrow-rose" markerWidth="10" markerHeight="10" refX="8" refY="3" orient="auto" markerUnits="strokeWidth">
+            <path d="M0,0 L0,6 L9,3 z" fill="#fb7185" />
+          </marker>
+          <marker id="arrow-amber" markerWidth="10" markerHeight="10" refX="8" refY="3" orient="auto" markerUnits="strokeWidth">
+            <path d="M0,0 L0,6 L9,3 z" fill="#fbbf24" />
+          </marker>
+        </defs>
+
+        <rect x="20" y="20" width="1460" height="900" rx="18" fill="none" stroke="#334155" stroke-width="1.5" />
+
+        <path d="M745 115 L745 170" stroke="#22d3ee" stroke-width="3" fill="none" marker-end="url(#arrow-cyan)"/>
+        <path d="M540 405 L400 405" stroke="#34d399" stroke-width="3" fill="none" marker-end="url(#arrow-emerald)"/>
+        <path d="M960 405 L1110 405" stroke="#a78bfa" stroke-width="3" fill="none" marker-end="url(#arrow-cyan)"/>
+        <path d="M745 640 L745 760" stroke="#fbbf24" stroke-width="3" fill="none" marker-end="url(#arrow-amber)"/>
+        <path d="M1240 535 C1320 560, 1360 620, 1360 710" stroke="#fb7185" stroke-width="3" fill="none" stroke-dasharray="8 6" marker-end="url(#arrow-rose)"/>
+        <path d="M250 520 C180 570, 160 640, 180 725" stroke="#34d399" stroke-width="3" fill="none" marker-end="url(#arrow-emerald)"/>
+        <path d="M1180 220 C1290 240, 1360 300, 1380 390" stroke="#fbbf24" stroke-width="2.5" fill="none" stroke-dasharray="7 5" marker-end="url(#arrow-amber)"/>
+
+        <rect x="600" y="50" width="290" height="65" rx="10" fill="#0f172a" />
+        <rect x="600" y="50" width="290" height="65" rx="10" fill="rgba(30,41,59,0.55)" stroke="#94a3b8" stroke-width="1.5" />
+        <text x="745" y="77" fill="#e2e8f0" text-anchor="middle" font-size="15" font-weight="700">Internet / Remote Edge</text>
+        <text x="745" y="97" fill="#94a3b8" text-anchor="middle" font-size="11">Pangolin VPS, public DNS, external access</text>
+
+        <rect x="510" y="170" width="470" height="470" rx="18" fill="none" stroke="#fbbf24" stroke-width="1.5" stroke-dasharray="10 6" />
+        <text x="530" y="195" fill="#fbbf24" font-size="12">Production / Servers lane</text>
+
+        <rect x="60" y="300" width="340" height="270" rx="14" fill="#0f172a" />
+        <rect x="60" y="300" width="340" height="270" rx="14" fill="rgba(6,78,59,0.35)" stroke="#34d399" stroke-width="1.6" />
+        <text x="85" y="330" fill="#e2e8f0" font-size="18" font-weight="700">N.O.M.A.D.</text>
+        <text x="85" y="352" fill="#34d399" font-size="12">Trusted secondary / resilience lane</text>
+        <text x="85" y="385" fill="#cbd5e1" font-size="12">• Project NOMAD offline stack</text>
+        <text x="85" y="408" fill="#cbd5e1" font-size="12">• Pelican / Wings / game servers</text>
+        <text x="85" y="431" fill="#cbd5e1" font-size="12">• Backup Technitium resolver</text>
+        <text x="85" y="454" fill="#cbd5e1" font-size="12">• Small bounded utility workloads</text>
+        <text x="85" y="500" fill="#94a3b8" font-size="11">Second failure domain. Do not turn into a second PD.</text>
+
+        <rect x="540" y="220" width="420" height="360" rx="16" fill="#0f172a" />
+        <rect x="540" y="220" width="420" height="360" rx="16" fill="rgba(6,78,59,0.42)" stroke="#34d399" stroke-width="1.8" />
+        <text x="570" y="253" fill="#e2e8f0" font-size="24" font-weight="700">PD (upgraded HL15 Beast)</text>
+        <text x="570" y="277" fill="#34d399" font-size="13">Primary production core on bare-metal TrueNAS Scale</text>
+
+        <rect x="570" y="305" width="180" height="110" rx="10" fill="rgba(76,29,149,0.36)" stroke="#a78bfa" stroke-width="1.4" />
+        <text x="590" y="330" fill="#e2e8f0" font-size="14" font-weight="700">Storage</text>
+        <text x="590" y="354" fill="#cbd5e1" font-size="11">• imported Serenity capacity</text>
+        <text x="590" y="374" fill="#cbd5e1" font-size="11">• new 20TB+ HDD pool</text>
+        <text x="590" y="394" fill="#cbd5e1" font-size="11">• SSD/NVMe app + VM tier</text>
+
+        <rect x="770" y="305" width="160" height="110" rx="10" fill="rgba(8,51,68,0.36)" stroke="#22d3ee" stroke-width="1.4" />
+        <text x="790" y="330" fill="#e2e8f0" font-size="14" font-weight="700">Apps + DBs</text>
+        <text x="790" y="354" fill="#cbd5e1" font-size="11">• Docker / compose</text>
+        <text x="790" y="374" fill="#cbd5e1" font-size="11">• shared Postgres/MariaDB/Redis</text>
+        <text x="790" y="394" fill="#cbd5e1" font-size="11">• identity / monitoring / media</text>
+
+        <rect x="570" y="440" width="180" height="110" rx="10" fill="rgba(120,53,15,0.32)" stroke="#fbbf24" stroke-width="1.4" />
+        <text x="590" y="465" fill="#e2e8f0" font-size="14" font-weight="700">Media + ARR</text>
+        <text x="590" y="489" fill="#cbd5e1" font-size="11">• qbit/ARR move here after cutover</text>
+        <text x="590" y="509" fill="#cbd5e1" font-size="11">• path locality follows the disks</text>
+        <text x="590" y="529" fill="#cbd5e1" font-size="11">• removes Serenity dependency</text>
+
+        <rect x="770" y="440" width="160" height="110" rx="10" fill="rgba(136,19,55,0.30)" stroke="#fb7185" stroke-width="1.4" />
+        <text x="790" y="465" fill="#e2e8f0" font-size="14" font-weight="700">Cyber VM lane</text>
+        <text x="790" y="489" fill="#cbd5e1" font-size="11">• AD / Windows / Linux labs</text>
+        <text x="790" y="509" fill="#cbd5e1" font-size="11">• segmented VLAN</text>
+        <text x="790" y="529" fill="#cbd5e1" font-size="11">• default-deny to production</text>
+
+        <rect x="1110" y="300" width="310" height="250" rx="14" fill="#0f172a" />
+        <rect x="1110" y="300" width="310" height="250" rx="14" fill="rgba(76,29,149,0.36)" stroke="#a78bfa" stroke-width="1.6" />
+        <text x="1135" y="330" fill="#e2e8f0" font-size="18" font-weight="700">Rocinante</text>
+        <text x="1135" y="352" fill="#a78bfa" font-size="12">Optional AI specialist</text>
+        <text x="1135" y="385" fill="#cbd5e1" font-size="12">• Keep if PD does not get the 4090</text>
+        <text x="1135" y="408" fill="#cbd5e1" font-size="12">• Otherwise overflow / experimental AI</text>
+        <text x="1135" y="431" fill="#cbd5e1" font-size="12">• Must justify its ongoing power + sprawl</text>
+        <text x="1135" y="477" fill="#94a3b8" font-size="11">Heavy inference can stay separate if desired, but production does not depend on that.</text>
+
+        <rect x="545" y="690" width="400" height="180" rx="16" fill="#0f172a" />
+        <rect x="545" y="690" width="400" height="180" rx="16" fill="rgba(120,53,15,0.30)" stroke="#fbbf24" stroke-width="1.6" stroke-dasharray="10 6" />
+        <text x="570" y="720" fill="#e2e8f0" font-size="18" font-weight="700">Serenity</text>
+        <text x="570" y="742" fill="#fbbf24" font-size="12">Transition-only platform</text>
+        <text x="570" y="775" fill="#cbd5e1" font-size="12">Now: storage owner, torrent locality, reranker, backup DNS node</text>
+        <text x="570" y="798" fill="#cbd5e1" font-size="12">Then: drain services, adopt storage into PD, remove dependency</text>
+        <text x="570" y="821" fill="#fb7185" font-size="12">End-state: retire to reduce power draw and operational sprawl</text>
+
+        <rect x="1140" y="650" width="280" height="200" rx="14" fill="#0f172a" />
+        <rect x="1140" y="650" width="280" height="200" rx="14" fill="rgba(136,19,55,0.28)" stroke="#fb7185" stroke-width="1.6" />
+        <text x="1165" y="680" fill="#e2e8f0" font-size="18" font-weight="700">Lab VLAN policy</text>
+        <text x="1165" y="712" fill="#cbd5e1" font-size="12">• Lab -> production: deny by default</text>
+        <text x="1165" y="735" fill="#cbd5e1" font-size="12">• Trusted admin -> lab: explicit allow</text>
+        <text x="1165" y="758" fill="#cbd5e1" font-size="12">• Lab -> DNS/NTP/internet: allow</text>
+        <text x="1165" y="781" fill="#cbd5e1" font-size="12">• Resource-cap VMs to protect production</text>
+        <text x="1165" y="804" fill="#cbd5e1" font-size="12">• Malware / truly sketchy work should still move elsewhere</text>
+
+        <rect x="80" y="660" width="300" height="170" rx="14" fill="#0f172a" />
+        <rect x="80" y="660" width="300" height="170" rx="14" fill="rgba(30,41,59,0.52)" stroke="#94a3b8" stroke-width="1.4" />
+        <text x="105" y="690" fill="#e2e8f0" font-size="18" font-weight="700">Operating principles</text>
+        <text x="105" y="722" fill="#cbd5e1" font-size="12">1. PD is the production center of gravity</text>
+        <text x="105" y="745" fill="#cbd5e1" font-size="12">2. NOMAD stays the trusted secondary lane</text>
+        <text x="105" y="768" fill="#cbd5e1" font-size="12">3. Cyber labs can share hardware, not trust</text>
+        <text x="105" y="791" fill="#cbd5e1" font-size="12">4. Design around Serenity retirement</text>
+      </svg>
+    </div>
+
+    <div class="grid">
+      <div class="card">
+        <h3>What belongs on PD</h3>
+        <ul>
+          <li>Primary ZFS storage, production Docker, databases, media, identity, monitoring, and DNS source-of-truth</li>
+          <li>qBittorrent + ARR stack after the storage move, because path locality should follow the disks</li>
+          <li>AI primary too if the 4090 lands there</li>
+        </ul>
+      </div>
+      <div class="card">
+        <h3>What remains off PD</h3>
+        <ul>
+          <li>NOMAD keeps offline knowledge, game hosting, and backup DNS</li>
+          <li>Rocinante stays only if heavy inference separation is still useful</li>
+          <li>High-risk or sketchy cyber work should eventually move to a dedicated lab node</li>
+        </ul>
+      </div>
+      <div class="card">
+        <h3>What this means for Serenity</h3>
+        <ul>
+          <li>Remove obvious service sprawl early</li>
+          <li>Preserve storage/torrent locality only until PD owns the storage directly</li>
+          <li>Retire Serenity once its storage and remaining roles are drained</li>
+        </ul>
+      </div>
+    </div>
+
+    <div class="footer">Generated as a repo-owned planning artifact for the PD rebuild, segmentation plan, and Serenity retirement path.</div>
+  </div>
+</body>
+</html>

docs/operations/INCIDENT_2026-05-28_PD_QDRANT_SEERR_DRIFT.md

@@ -0,0 +1,126 @@
+# Incident: PD qdrant / seerr compose drift cleanup (2026-05-28)
+
+## Summary
+
+An earlier recovery on PlausibleDeniability left the runtime state healthier than the operator metadata around it.
+
+Public and LAN access were restored, but `qdrant` had been manually recreated from `docker inspect` data because its prior compose-path labeling was stale or absent. That fixed service availability, but it also created the risk that live state, repo state, and future operator assumptions could drift apart.
+
+On 2026-05-28, the stack was squared away by taking fresh backups, re-validating the live compose roots, re-syncing repo-managed compose content into the live directories, pruning a stale backup artifact from the live media compose directory, and re-verifying health.
+
+## What broke
+
+The incident had two layers:
+
+1. **Service health / accessibility breakage**
+   - `qdrant` and related AI/media surface area needed recovery work earlier in the day.
+   - `seerr` public/local availability also had to be checked as part of the same cleanup pass.
+
+2. **Post-recovery metadata drift risk**
+   - `qdrant` no longer had a trustworthy compose lifecycle trail from the original broken state.
+   - Manual recreation from `docker inspect` restored the container, but that is not the same as a clean repo-driven compose reconciliation.
+   - A stale file (`docker-compose.yaml.pre-d3b-20260526-003732`) was still sitting in the live media compose directory, which was not dangerous by itself but increased operator ambiguity.
+
+## What was manually recreated
+
+During the earlier recovery, `qdrant` was recreated manually from live container metadata when the prior compose-path labels were stale or missing.
+
+By the end of the cleanup, the running `qdrant` container correctly reported:
+
+- working dir: `/mnt/docker-ssd/docker/compose/ai`
+- compose file: `/mnt/docker-ssd/docker/compose/ai/docker-compose.yaml`
+- service: `qdrant`
+
+`seerr` correctly reported:
+
+- working dir: `/mnt/docker-ssd/docker/compose/media`
+- compose file: `/mnt/docker-ssd/docker/compose/media/docker-compose.yaml`
+- service: `seerr`
+
+## Backups taken before cleanup
+
+Fresh rollback-friendly backups were created on PD at:
+
+- directory: `/mnt/docker-ssd/docker/backups/post-incident-sync-20260528-192945`
+- tarball: `/mnt/docker-ssd/docker/backups/post-incident-sync-20260528-192945.tgz`
+
+Backup contents include:
+
+- live `ai` compose tree
+- live `media` compose tree
+- `qdrant` appdata
+- `docker inspect` output for `qdrant`, `openwebui`, and `seerr`
+- rendered `docker compose config` output for both stacks
+
+## Cleanup actions performed
+
+1. verified the live container labels for `qdrant`, `openwebui`, and `seerr`
+2. compared live compose files against the repo-managed copies under `truenas-stacks`
+3. confirmed the active tracked compose content already matched repo
+4. re-synced repo-managed `ai/` and `media/` compose trees into the live PD compose directories
+5. pruned the stale live file `docker-compose.yaml.pre-d3b-20260526-003732` from the media compose directory **after** backup
+6. re-ran `docker compose config` validation in both live directories
+7. re-checked HTTP health for `qdrant`, `openwebui`, and `seerr`
+
+## What was verified at the end
+
+### Live compose / label alignment
+
+The live runtime and repo are back in agreement for the affected services:
+
+- `qdrant` labels point to `/mnt/docker-ssd/docker/compose/ai/docker-compose.yaml`
+- `seerr` labels point to `/mnt/docker-ssd/docker/compose/media/docker-compose.yaml`
+- repo-managed tracked compose content matches the live active files
+
+### Health
+
+The following checks passed after cleanup:
+
+- `http://10.5.30.6:6333/healthz` → `200`
+- `http://10.5.30.6:8282/` → `200`
+- `http://10.5.30.6:5055/` → `200`
+
+### Compose validation
+
+These both rendered successfully:
+
+- `/mnt/docker-ssd/docker/compose/ai/docker-compose.yaml`
+- `/mnt/docker-ssd/docker/compose/media/docker-compose.yaml`
+
+## Important non-actions
+
+- The Docker daemon was **not** restarted.
+- The stacks were **not** redeployed during this cleanup pass.
+- No repo-unrelated working tree changes were touched.
+
+That was intentional: the active tracked compose files already matched repo, and the services were healthy, so a no-redeploy reconciliation was the safer path.
+
+## Why this matters
+
+The main value of this cleanup was not changing application behavior. It was restoring operator confidence that:
+
+- the live compose roots are the authoritative ones
+- the running containers point back to those roots
+- repo state and live state are aligned again
+- future maintenance can start from the compose directories instead of from ad hoc inspect output
+
+## Next time: safer recovery procedure
+
+If a PD stack service must be rebuilt under pressure:
+
+1. **Identify the authoritative compose directory first.**
+   - Prefer `/mnt/docker-ssd/docker/compose/<stack>/docker-compose.yaml` over ad hoc recreation.
+2. **Take a backup before cleanup, even if the service is already back up.**
+   - Capture compose trees, relevant appdata, and `docker inspect` output.
+3. **If manual recreation is unavoidable, treat it as temporary stabilization only.**
+   - Reconcile labels, compose roots, and repo state immediately afterward.
+4. **Compare repo ↔ live compose content before redeploying.**
+   - If tracked content already matches and health is good, avoid unnecessary churn.
+5. **Prune stale backup/override files from live compose dirs only after backup.**
+   - Leaving old compose fragments nearby makes future incident work harder.
+6. **Verify both health and metadata.**
+   - A container being up is not enough; confirm compose labels, working dir, and health endpoints.
+
+## Follow-up status
+
+No immediate further action was required after the cleanup pass. The remaining lesson is procedural: manual container recreation is acceptable as a short-term rescue, but it should always be followed by a backup-first repo/live reconciliation so drift does not become the new baseline.

docs/operations/PD_BACKUP_DEPLOYMENT.md

@@ -35,7 +35,7 @@ PD_DATABASES_ROOT=/mnt/docker-ssd/docker/databases
 PD_TANK_DOCKER_ROOT=/mnt/tank/docker
 PD_DB_DUMP_ROOT=/mnt/tank/docker/backups/db-dumps
 POSTGRES_CONTAINER=shared-postgres
-POSTGRES_DB_LIST="n8n paperless"
+POSTGRES_DB_LIST="gitea n8n paperless"
 BACKUP_SSH_KEY=/home/truenas_admin/.ssh/serenity_backup_ed25519
 DOCKER_BIN=/usr/bin/docker
 SUDO_BIN=/usr/bin/sudo
@@ -54,7 +54,7 @@ mkdir -p /mnt/tank/docker/backups/db-dumps
 
 Confirm:
 
-- fresh `*.sql.gz` files appear in `/mnt/tank/docker/backups/db-dumps`
+- fresh `gitea_*.sql.gz`, `n8n_*.sql.gz`, and `paperless_*.sql.gz` files appear in `/mnt/tank/docker/backups/db-dumps`
 - appdata/database/tank-docker content lands under the chosen Serenity backup root
 - no sudo prompt appeared during `docker exec`
 
@@ -98,6 +98,8 @@ What it proves:
 - expected files still exist inside the restored sample
 - the latest run state can be exported to Prometheus via node-exporter's textfile collector
 
+Current expectation: `POSTGRES_DB_LIST` includes `gitea` so the backup set contains a logical dump for the Gitea database in addition to the raw synced Postgres data directory.
+
 ## Important limitations
 
 - Do **not** use `systemctl restart docker` on PD.
@@ -105,3 +107,4 @@ What it proves:
 - `rsync --delete` is intentional; use a dedicated destination root, not a shared miscellaneous folder.
 - This scaffolding does not yet back up `.env` files here because those are already handled by the separate encrypted/private-repo process.
 - If you insist on a non-root cron user on PD, you will need passwordless Docker access (`sudo -n /usr/bin/docker ...`) and write access to the chosen dump directory.
+- For Gitea, do not treat the live-synced Postgres datadir as the main restore proof; keep and verify the `gitea` logical dump as part of the normal restore-verification cycle.

docs/operations/STACK_STANDARDS.md

@@ -6,7 +6,7 @@ PD live compose root: `/mnt/docker-ssd/docker/compose`
 NOMAD exception: standalone live deployments belong under `/opt/<service>` rather than a shared `/mnt/docker-ssd/docker/compose` tree.
 
 Remotes:
-- GitHub: `git@github.com:Paccoco/truenas-stacks.git`
+- GitHub: `git@github.com:fizzlepoof/truenas-stacks.git`
 - Gitea web: `http://10.5.30.6:3002/fizzlepoof/truenas-stacks`
 - Gitea SSH: `ssh://git@10.5.30.6:2222/fizzlepoof/truenas-stacks.git`
 

docs/planning/DEPLOY_PIHOLE.md

@@ -1,9 +1,9 @@
 # Pi-hole Deployment Plan
 
-**Status:** Historical Trusted-VLAN design. PD primary is still valid, but after NOMAD moved to Servers (`10.5.30.7`) its participation in the old Trusted-side VIP `10.5.30.53` was disabled to restore correct routing. Do not reuse this document for NOMAD as-is until a same-subnet HA redesign exists.
+**Status:** Historical Pi-hole design. It is no longer the active DNS source of truth. Both the PD and NOMAD Pi-hole runtimes were retired on 2026-05-27 after cutover to the Technitium trio, and the old VIP `10.5.30.53` no longer answers. Treat this document as history/reference, not the current intended DNS architecture.
 **Architecture:** 3-node HA cluster with Keepalived VIP, Unbound recursive DNS, Nebula Sync
 
-> **Warning:** The examples below describe the original Trusted-side plan where NOMAD was `10.5.30.7` and shared VIP `10.5.30.53/24`. They are retained as historical deployment notes, not the current NOMAD runtime truth.
+> **Warning:** The examples below describe the original HA Pi-hole plan. The entire Pi-hole path has now been retired. Current live DNS is Technitium on `10.5.30.8`, `10.5.30.9`, and `10.5.30.10`; the old Pi-hole VIP `10.5.30.53` is dead. Do not treat anything below as the desired current-state DNS design.
 
 ---
 

docs/planning/PD_FUTURE_STATE_ARCHITECTURE.md

@@ -0,0 +1,305 @@
+# PD Future-State Architecture Plan
+
+Status: proposed target state for the next major PD rebuild and Serenity retirement.
+
+## Goal
+
+Turn PD into the long-term primary homelab platform while keeping enough separation for resilience and cybersecurity lab work.
+
+This plan assumes:
+- PD is rebuilt on the HL15 Beast ASRock platform
+- Serenity is temporary and will be retired after its storage is adopted into PD
+- John will add a second HDD ZFS pool using 5-6 new 20TB+ drives
+- A few SSDs may be added for appdata, databases, scratch, and cache tiers
+- Cybersecurity VMs may live on PD, but only inside a tightly segmented lab lane
+
+## Recommended platform model
+
+### Keep PD on bare-metal TrueNAS Scale
+
+Recommended role:
+- primary NAS
+- primary production Docker/app host
+- primary shared database host
+- primary media host
+- primary identity/control-plane host
+- primary DNS source node
+- primary AI host if the 4090 lands here
+- limited, disciplined VM host for cybersecurity lab work
+
+Do not treat PD as an unrestricted cyber range.
+Production remains the first-class role.
+
+## Hardware direction
+
+### Minimum build worth doing
+- HL15 Beast ASRock build
+- EPYC 7282
+- 64GB RAM
+- RM1000x if no 4090 is going in immediately
+
+### Preferred long-term build
+- HL15 Beast ASRock build
+- EPYC 7452
+- 128GB RAM preferred if PD will carry production plus multiple security VMs
+- HX1500i if PD is likely to receive the 4090
+
+### Why the base model is not recommended
+The 7252 + 16GB base build is too small for the intended role once PD becomes:
+- primary ZFS host
+- primary app host
+- primary DB host
+- future ARR/qbit host after pool migration
+- possible AI host
+- bounded cybersecurity VM host
+
+## Storage model
+
+### HDD pools
+PD should end up with at least two major HDD-backed data classes:
+
+1. Imported Serenity capacity
+- absorb the current Serenity storage role
+- preserve large media/archive capacity
+
+2. New HDD ZFS pool
+- 5-6 x 20TB+ drives
+- use for future bulk media, archives, backup targets, and growth
+
+Exact vdev shape should be chosen when the final drive count is locked, but the high-level operating model should be:
+- one bulk pool for high-capacity household data
+- one or more fast SSD-backed tiers for apps, DBs, and VM-heavy workloads
+
+### SSD / NVMe role split
+Use SSD/NVMe for:
+- Docker root
+- shared PostgreSQL / MariaDB / Redis data
+- write-heavy appdata
+- VM disks for cyber lab systems
+- AI model cache
+- transcode/temp/scratch
+
+Use HDD pools for:
+- media libraries
+- document archives
+- backups
+- long-term storage
+- lower-IO datasets
+
+## Host role layout
+
+### PD = production core
+PD should eventually own:
+- ZFS/NAS duties
+- production Docker stack
+- shared databases
+- media stack
+- household/productivity stack
+- Authentik / identity stack
+- monitoring/control plane
+- primary Technitium node
+- ARR/qbit stack after storage cutover
+- AI primary if the 4090 lands here
+- controlled cyber lab VMs
+
+### N.O.M.A.D. = secondary trusted platform
+Keep NOMAD for:
+- offline knowledge / Project NOMAD
+- game servers
+- backup Technitium resolver
+- small bounded utility workloads
+
+NOMAD should not become a second general-purpose production host.
+
+### Rocinante = optional AI specialist
+If PD gets the 4090:
+- Rocinante becomes optional
+- can remain an overflow / experimental inference box
+- can later be repurposed or retired
+
+If PD does not get the 4090:
+- Rocinante stays the heavy inference box
+- PD remains the production/NAS core
+
+### Serenity = transition-only
+Near-term:
+- current storage owner
+- current torrent locality host
+- current reranker host
+- backup Technitium node
+
+End-state:
+- storage role moved into PD
+- remaining services drained or moved
+- host retired
+
+## Service placement target
+
+### Keep on PD long-term
+Infrastructure / control plane:
+- Gitea
+- Homepage
+- Uptime Kuma
+- Gotify
+- RackPeek
+- Traefik / Pangolin-side internal ingress
+- Authentik
+- shared PostgreSQL / MariaDB / Redis
+- monitoring stack
+
+Household / productivity:
+- Paperless
+- Immich
+- Karakeep
+- n8n
+- KitchenOwl
+- DoneTick
+- Qui
+
+Media / library:
+- Plex
+- Tautulli
+- Audiobookshelf
+- Calibre-Web
+- Seerr
+- RomM
+- GameVault
+- Shelfmark
+- Notifiarr
+
+AI / search:
+- LiteLLM
+- OpenWebUI
+- Qdrant
+- SearXNG
+- Ollama light tier
+- primary heavy inference too if the 4090 lands on PD
+- reranker after Serenity is retired
+
+Torrent/media ingestion after storage cutover:
+- qBittorrent
+- qbit_manage
+- Gluetun
+- unpackerr
+- Sonarr / Sonarr-anime
+- Radarr
+- Lidarr
+- Readarr / Readarr-epub
+- Prowlarr
+- Bazarr
+- autobrr
+
+### Keep off PD long-term
+NOMAD:
+- Project NOMAD stack
+- Pelican / Wings / game servers
+- backup Technitium resolver
+
+Optional elsewhere:
+- heavy inference on Rocinante if PD does not get the 4090
+- high-risk security experiments on a future dedicated lab node if the school/lab workload outgrows PD-hosted segmented VMs
+
+### Move off Serenity early; does not need the storage cutover
+- retire Wizarr if it is still present; rebuild later only if onboarding need returns
+- Notifiarr -> PD only if PD headroom makes the move worth it
+- netdata -> keep only where it still adds monitoring value
+
+These are low-risk peel-off candidates because they are not part of the storage-local torrent/media locality lane.
+
+## Cybersecurity VM model on PD
+
+### This is acceptable on PD
+- Windows Server / AD lab VMs
+- Windows client VMs
+- Linux practice VMs
+- Wazuh / SIEM learning stack
+- Kali or similar coursework boxes
+- isolated vulnerable targets for coursework
+- patch/test environments
+
+### This should remain tightly bounded
+- scanning labs
+- IDS/packet-capture experiments
+- exploit practice
+- intentionally vulnerable targets
+
+These may run on PD only when:
+- placed on a dedicated lab VLAN
+- firewalled from production by default
+- resource-limited
+- treated as disposable
+
+### This should ideally not live on PD
+- malware detonation
+- unknown or sketchy offensive tooling
+- random public PoCs with unclear trust
+- anything that could meaningfully threaten production storage or family services
+
+## Network / VLAN recommendation for the lab lane
+
+Create or preserve a dedicated lab/security lane with these rules:
+- separate VLAN / subnet from production lanes
+- default-deny from lab to production
+- allow only explicit admin paths from trusted management devices
+- allow outbound internet as needed for updates/labs
+- allow tightly scoped DNS/NTP/logging paths
+- keep identity trust boundaries explicit rather than automatic
+
+Suggested policy posture:
+- Lab -> PD production apps: deny by default
+- Lab -> shared DNS: allow
+- Lab -> internet: allow with logging
+- Trusted admin devices -> lab: explicit allow
+- Lab -> management interfaces: explicit deny unless specifically required
+
+## Phased roadmap
+
+### Phase 1: document and reduce Serenity sprawl now
+- document current host roles and future-state design
+- classify Serenity services into keep / move / retire
+- retire or peel off only the smallest low-risk items first (`Wizarr`, maybe `Notifiarr`, and possibly `netdata`) while leaving `Hawser` + `dockersocket` in place as the Dockhand management path
+
+### Phase 2: build upgraded PD
+- install TrueNAS Scale on the new PD hardware
+- stand up SSD tiers for apps/DBs/VMs
+- add the new HDD pool
+- validate networking, Docker, GPU, and backup posture
+
+### Phase 3: move production services into the new PD layout
+- migrate any remaining general-purpose apps off Serenity
+- relocate databases/appdata onto the intended SSD tier
+- validate ingress, monitoring, and DNS roles
+- keep `Newt`, `reranker`, and the off-PD Technitium node as explicit special cases until their redesign work is ready
+
+### Phase 4: move the storage-dependent torrent/media automation stack
+- after the storage move design is finalized, move qbit + ARR locality to PD
+- keep path locality on the box that owns the disks
+- then remove the old Serenity-locality requirement
+
+### Phase 5: move or redesign the remaining special cases
+- move reranker onto PD if AI core lands there
+- redesign backup DNS so Serenity is no longer required, likely by introducing a small dedicated Raspberry Pi 4B resolver lane while preserving an off-PD Technitium failure domain
+- preserve at least one off-PD Technitium node outside PD even after Serenity retires
+
+### Phase 6: retire Serenity
+- verify pool adoption is complete
+- verify services are drained
+- confirm backups and DNS redundancy still work
+- power down and retire Serenity
+
+## Architecture principles
+
+1. PD becomes the production center of gravity.
+2. NOMAD stays a separate trusted failure domain.
+3. Rocinante is optional and should justify its existence.
+4. Serenity should be designed out of the future state.
+5. The cybersecurity lab lane can share PD hardware, but not PD trust boundaries.
+6. Production stability beats hypervisor sprawl.
+
+## Immediate implications for current cleanup work
+
+For the current Serenity Docker review, the guiding rule is:
+- remove obvious sprawl from Serenity now
+- retire dead weight and peel off only the smallest miscellaneous low-risk apps before touching the storage-locality lane
+- do not over-optimize the final placement around Serenity permanence
+- remember that once PD directly owns the storage, the qbit/ARR locality argument flips to PD

docs/planning/SERENITY_CLEANUP_WAVE_1.md

@@ -0,0 +1,559 @@
+# Serenity Cleanup Wave 1 Plan
+
+Status: approved planning baseline for the first safe cleanup pass on Serenity.
+
+## Goal
+
+Reduce obvious legacy clutter on Serenity without breaking the still-needed torrent/media-locality group or the still-needed Serenity Newt path.
+
+This wave is intentionally conservative.
+It does not move qBittorrent/ARR off Serenity yet.
+It does not retire Serenity yet.
+It does not delete databases that still back live apps.
+
+## Operator decisions already resolved
+
+- Nothing should intentionally remain on Serenity after PD owns the disks locally.
+- Technitium already covers the DNS role John wants.
+- Serenity Pi-hole remnants should be treated as removable.
+- Serenity Newt is still needed and must be preserved.
+- GameVault and RomM should migrate, not be pruned.
+- Final end-state remains:
+  - move qbit + ARR family to PD after storage cutover
+  - leave no intentional production app role on Serenity
+  - retire Serenity entirely
+
+## Scope of cleanup wave 1
+
+Wave 1 includes only these categories:
+
+1. Remove legacy DNS clutter that should no longer be serving production traffic.
+2. Remove obviously stale created/exited containers.
+3. Document migration order for the two database-backed apps that should move later.
+
+Wave 1 explicitly excludes:
+
+- qbit
+- GluetunVPN
+- qbit_manage
+- prowlarr
+- sonarr
+- sonarr-anime
+- radarr
+- lidarr
+- readarr
+- readarr-epub
+- bazarr
+- autobrr
+- unpackerr
+- Notifiarr
+- shelfmark
+- Newt
+- technitium-dns-pilot
+- GameVault
+- romm
+- reranker
+
+## Live facts this plan is based on
+
+From the live Serenity audit before D5/D6/D7:
+
+- ARR/torrent locality is still tied to `/mnt/user/data`
+- `GameVault` pointed at local Postgres on `10.5.30.5:5432`
+- `RomM` pointed at local MariaDB on `10.5.30.5:3306`
+- live container env inspection showed those explicit DB_HOST/DB_PORT bindings on 2026-05-25 before cutover
+- quick live checks did not surface immediate DB dependencies for `Wizarr`, `Shelfmark`, or `Notifiarr`
+- `Newt` is still needed
+- legacy Pi-hole containers are still running even though Technitium is now the intended DNS path
+- Serenity Newt-backed Pangolin routes still had stale health-check hostnames pointing at old `10.5.1.5` even though their target IPs had already been rewritten to `localhost`/`10.5.30.5`
+- a temporary `10.5.1.5/32` alias on `br0` validated the diagnosis, but it was removed because the old IP is no longer allowed on that VLAN
+- authoritative Pangolin cleanup was then completed by rewriting the audited Serenity target set to `10.5.30.5` for both routing and health checks, removing the need for any legacy-IP workaround
+
+## Wave 1 current execution status
+
+Live execution on 2026-05-25 established:
+- `Huntarr` and `omegabrr` were low-risk stale stopped containers and were removed from Serenity
+- the recent non-running `Created` containers (`calibre-web`, `SuggestArr`, `Cleanuparr`, `calibre`, `agregarr`) were metadata-verified and then removed after confirming they were still only `Created`, had `restart=no`, and were not live workloads
+- `Unraid-Cloudflared-Tunnel` was audited, stopped, and removed after verification showed it was only transport-alive and no current public traffic depended on it
+- the Serenity Pi-hole HA stack (`binhex-official-pihole`, `pihole-serenity`, `unbound-pihole-serenity`, `keepalived-pihole-serenity`) was then stopped and removed after live mixed-host DNS checks confirmed the Technitium path remained healthy without it
+- `gamevault` and `gamevault-db` validated healthy on PD, then Serenity `postgresql15` was exported, stopped, archived for rollback, and removed during D7
+- `romm` and `romm-db` validated healthy on PD, then Serenity `MariaDB-Official` was exported, stopped, archived for rollback, and removed during D7
+- the stale stopped Serenity source app containers `romm` and `GameVault` were then removed as post-cutover cleanup, so rollback now depends on retained appdata/backup artifacts rather than source containers lingering in `docker ps -a`
+
+## Wave 1-A: legacy Pi-hole removal
+
+### Target containers
+
+- `binhex-official-pihole`
+- `pihole-serenity`
+- `unbound-pihole-serenity`
+- `keepalived-pihole-serenity`
+
+### Why they are in scope
+
+- They are legacy DNS/HA remnants.
+- Current homelab docs describe the active internal DNS path as the Technitium trio.
+- Operator confirmed Technitium covers the intended DNS role.
+- Keeping old DNS stacks around increases confusion and future troubleshooting blast radius.
+
+### Preconditions
+
+Before removal, verify only these read-only checks:
+
+1. Serenity Technitium backup node is healthy.
+2. DHCP-advertised resolver set is still PD/NOMAD/Serenity Technitium, not Pi-hole.
+3. No Pangolin route, bookmark, or admin workflow still intentionally points at a Pi-hole UI.
+4. No host on the LAN still relies on the old Pi-hole admin port out of habit.
+
+### Removal order
+
+1. stop `keepalived-pihole-serenity`
+2. stop `pihole-serenity`
+3. stop `unbound-pihole-serenity`
+4. stop `binhex-official-pihole`
+5. verify Technitium-only DNS behavior still looks normal
+6. remove the stopped containers
+7. archive or delete their stale appdata only after a short observation window
+
+### Verification after removal
+
+- Serenity Technitium container remained healthy
+- mixed-host DNS checks stayed good after removal:
+  - from NOMAD, `10.5.30.8` and `10.5.30.10` still resolved both public and homelab names
+  - from PD, `10.5.30.9` and `10.5.30.10` still resolved both public and homelab names
+- `10.5.30.53` continued answering DNS even after Serenity Pi-hole removal, confirming it is no longer tied to the removed Serenity Pi-hole containers
+- no immediate client-facing DNS regression was observed during the removal window
+- no public regression was observed on sampled hostnames such as `panel.paccoco.com` and `audiobookshelf.paccoco.com`
+
+## Wave 1-B: stale container pruning
+
+### Created-only clutter to remove
+
+- `calibre-web`
+- `SuggestArr`
+- `Cleanuparr`
+- `calibre`
+- `agregarr`
+
+### Exited clutter to remove
+
+- `Huntarr`
+- `omegabrr`
+
+### Why they are in scope
+
+- They are not live workloads.
+- They add noise to `docker ps -a` and make host intent harder to understand.
+- There is no current architecture reason to preserve them as active Serenity residents.
+
+### Safe pruning rules
+
+Before deleting each one:
+
+1. confirm container status is still `Created` or `Exited`
+2. confirm it is not referenced by a live reverse-proxy route
+3. confirm it is not the only source of some needed config/data you still care about
+4. if uncertain, export one final metadata snapshot first:
+   - image name
+   - mounts
+   - env file path if obvious
+
+### Practical order
+
+1. remove `Created` containers first
+2. remove long-dead exited containers second
+3. leave appdata in place initially
+4. only delete appdata later after a short cooling-off window
+
+## Wave 1-C: cloudflared deadwood removal
+
+### Target container
+
+- `Unraid-Cloudflared-Tunnel`
+
+### Why it is in scope
+
+- It is already documented in repo docs as dead/stale.
+- Pangolin/Newt is the active exposure pattern now.
+- Live audit on 2026-05-25 showed the container is a remote-managed Cloudflare Tunnel carrying a stale legacy config, not an active Serenity service path.
+
+### Live audit findings (2026-05-25)
+
+- `Unraid-Cloudflared-Tunnel` is healthy at the transport layer (`/ready` reported 4 ready connections), but metrics showed `cloudflared_tunnel_total_requests 0` and `cloudflared_tunnel_request_errors 0` for the current run.
+- Startup logs exposed the remote-managed ingress set as legacy hostnames pointed at old `192.168.1.x` origins:
+  - `wazuh.paccoco.com` -> `https://192.168.1.102`
+  - `remotely.paccoco.com` -> `http://192.168.1.180:5001`
+  - `hp.paccoco.com` -> `http://192.168.1.180:3000`
+  - `octoprint.paccoco.com` -> `http://192.168.1.52`
+  - `audiobookshelf.paccoco.com` -> `http://192.168.1.5:13378`
+  - `spoolman.paccoco.com` -> `http://192.168.1.202:7912`
+  - `node1.paccoco.com` -> `https://192.168.1.189:8080`
+  - `hp2.paccoco.com` -> `http://192.168.1.224:3000`
+  - `panel.paccoco.com` -> `https://192.168.1.189`
+  - `nextcloud.paccoco.com` -> `http://192.168.1.5:11000`
+- The tunnel has no local config files under `/mnt/user/appdata/cloudflared`; it is driven entirely by Cloudflare-side config plus a token.
+- Public checks for those hostnames currently resolve to `172.245.79.139` and return either live responses or front-door 404s without producing any new tunnel traffic, indicating the present public path is elsewhere and not traversing this Serenity container.
+- Repo/docs no longer identify this tunnel as an intended live exposure path; the only repeated modern exposure requirement in Serenity docs is the local Pangolin/Newt lane.
+
+### Preconditions
+
+1. verify no current DNS/public route still expects this tunnel
+2. verify no local notes still treat it as the active exposure path
+3. verify Newt-based routes are the real live path
+
+Status after live audit:
+- (1) satisfied enough for container retirement: no observed current public traffic is reaching this tunnel
+- (2) satisfied: local docs treat it as stale legacy deadwood, not the intended active path
+- (3) satisfied for Serenity-hosted apps: Pangolin/Newt remains the intentionally preserved exposure path
+
+### Recommended retirement path
+
+1. stop the container and watch briefly for any unexpected complaint or new public breakage
+2. remove the container
+3. keep `/mnt/user/appdata/cloudflared` during a cooling-off window even though it appears empty/unneeded
+4. later, from the Cloudflare side, delete or repoint the stale tunnel config/hostnames if they still exist there
+
+Status:
+- completed on 2026-05-25: `Unraid-Cloudflared-Tunnel` was stopped and removed
+- sampled public checks (`panel.paccoco.com`, `audiobookshelf.paccoco.com`) remained healthy after removal
+
+## Wave 1-D: DB-backed migration ordering
+
+These apps should not be deleted in wave 1.
+They need planned migration.
+
+### Pair 1: GameVault + local Postgres
+
+Live dependency:
+- `GameVault` -> `postgresql15`
+
+Recommended sequence:
+1. create PD-side target appdata path
+2. create PD-side Postgres DB/user on shared-postgres, or a deliberate dedicated PD Postgres if there is a reason not to use shared-postgres
+3. export GameVault DB from Serenity
+4. import into PD target database
+5. migrate GameVault appdata/config
+6. recreate GameVault on PD attached to the shared database network if using shared-postgres
+7. verify login, library visibility, and metadata path behavior
+8. only then retire Serenity `postgresql15`
+
+Default recommendation:
+- prefer PD shared-postgres unless GameVault has a proven reason to stay isolated
+- note: live `psql` inspection on 2026-05-25 showed a Postgres collation-version mismatch warning on Serenity (`gamevault` created with glibc collation 2.36 while host now provides 2.41), so include a post-migration refresh/reindex plan rather than carrying that debt forward silently
+
+### Pair 2: RomM + local MariaDB
+
+Live dependency:
+- `RomM` -> `MariaDB-Official`
+
+Recommended sequence:
+1. create PD-side target appdata path
+2. create PD-side MariaDB DB/user on shared-mariadb, or a deliberate dedicated PD MariaDB only if needed
+3. export RomM DB from Serenity
+4. import into PD target MariaDB
+5. migrate RomM appdata/config/assets/resources
+6. recreate RomM on PD attached to the shared database network if using shared-mariadb
+7. verify UI, library, metadata, and asset behavior
+8. only then retire Serenity `MariaDB-Official`
+
+Default recommendation:
+- prefer PD shared-mariadb unless RomM proves awkward on the shared stack
+
+## Recommended order across all wave 1 work
+
+1. verify Technitium is the only intended active DNS path
+2. remove legacy Pi-hole stack
+3. remove dead Cloudflared tunnel
+4. remove stale created/exited containers
+5. leave GameVault/Postgres and RomM/MariaDB in place until their PD migration is prepared
+6. keep qbit/ARR locality untouched until PD storage cutover is real
+
+## Risks and guardrails
+
+### Do not touch yet
+
+Do not touch in this wave:
+- qbit
+- ARR family
+- GluetunVPN
+- qbit_manage
+- Newt
+- technitium-dns-pilot
+- GameVault
+- romm
+- postgresql15
+- MariaDB-Official
+
+### Specific guardrails
+
+- Do not delete any appdata directory in the same step as container removal unless the dependency is unquestionably dead.
+- Do not remove `postgresql15` until GameVault is verified on PD.
+- Do not remove `MariaDB-Official` until RomM is verified on PD.
+- Do not move qbit/ARR until PD directly owns the relevant media/torrent paths.
+- Do not break Serenity Newt while cleanup is happening.
+
+## Suggested Kanban decomposition
+
+### Card A1 — verify legacy Pi-hole is truly unused
+Definition of done:
+- current DNS path confirmed as Technitium-only
+- no intentional admin dependency on Serenity Pi-hole remains
+
+### Card A2 — remove Serenity legacy Pi-hole containers
+Definition of done:
+- all four legacy Pi-hole containers stopped and removed
+- no DNS regression observed
+
+### Card B1 — remove stale created containers
+Definition of done:
+- created-only clutter removed
+- appdata retained for cooling-off period
+
+### Card B2 — remove stale exited containers
+Definition of done:
+- exited clutter removed
+- appdata retained for cooling-off period
+
+### Card C1 — remove dead Unraid Cloudflared tunnel
+Definition of done:
+- no public path depends on it
+- container removed
+
+### Card D1 — choose PD target layout for GameVault and RomM wave
+Definition of done:
+- PD target appdata paths chosen for both apps
+- decision recorded to use PD shared-postgres for GameVault unless blocked
+- decision recorded to use PD shared-mariadb for RomM unless blocked
+- required PD mount paths for libraries/assets/resources identified
+
+Chosen target layout (2026-05-25):
+- place both services in the PD `media` stack so they follow the same steady-state placement already documented for PD media/library apps
+- attach both services to:
+  - `media-net` for local app adjacency
+  - `pangolin` for internal ingress / public exposure
+- attach only GameVault to `ix-databases_shared-databases` because it keeps using PD `shared-postgres`
+- keep RomM on `media-net` + `pangolin`; its database will be a dedicated sibling service on `media-net`, not a shared DB consumer
+- preserve the current host ports on PD because live checks showed them free there:
+  - GameVault: `8785:8080`
+  - RomM: `8457:8080`
+- preserve the public hostnames already in use during cutover:
+  - `gamevault.paccoco.com`
+  - `romm.paccoco.com`
+- use the PD internal ingress model (`Pangolin -> Traefik -> app`) when the public route is re-homed, rather than introducing another direct-to-container edge pattern
+
+Chosen storage layout:
+- GameVault appdata on SSD because it is small and write-active:
+  - `/mnt/docker-ssd/docker/appdata/gamevault/media` -> `/media`
+  - `/mnt/docker-ssd/docker/appdata/gamevault/logs` -> `/logs`
+- GameVault canonical content mounts should be re-used, not copied:
+  - `/mnt/unraid/data/media/Games-Apps Isos` -> `/files`
+  - `/mnt/unraid/data/media/Saved Games` -> `/savefiles`
+- RomM split layout:
+  - write-active cache on SSD:
+    - `/mnt/docker-ssd/docker/appdata/romm/redis-data` -> `/redis-data`
+  - config/assets/resources on tank appdata:
+    - `/mnt/tank/docker/appdata/romm/config` -> `/romm/config`
+    - `/mnt/tank/docker/appdata/romm/assets` -> `/romm/assets`
+    - `/mnt/tank/docker/appdata/romm/resources` -> `/romm/resources`
+- RomM canonical library mount should be re-used, not copied:
+  - `/mnt/unraid/data/media/RomM` -> `/romm/library`
+
+Chosen database layout:
+- GameVault -> PD `shared-postgres` on `ix-databases_shared-databases`
+  - target DB: `gamevault`
+  - target DB user: `gamevault`
+- RomM -> dedicated PD `romm-db` service on `media-net`
+  - target image pin: `mariadb:12.2`
+  - target DB: `romm`
+  - target DB user: `romm`
+  - target data path: `/mnt/docker-ssd/docker/appdata/romm-db/mysql`
+
+Routing/proxy notes to preserve during implementation:
+- RomM upstream docs call out reverse-proxy sensitivity; keep websocket support intact when the route is moved behind PD Traefik
+- existing Traefik file-provider patterns in `ingress/traefik/dynamic/routes.yml` should be extended rather than inventing a new routing mechanism for these two apps
+
+### Card D2 — stage PD database targets for the wave
+Definition of done:
+- GameVault target DB/user created on PD shared-postgres or explicit exception documented
+- RomM target DB/user created on the chosen PD MariaDB target or explicit exception documented
+- connection details verified from the future PD app network context
+- migration rollback notes captured before any source export
+
+Execution notes (2026-05-25):
+- staged PD targets on the live shared DB services:
+  - Postgres DB/user: `gamevault` / `gamevault`
+  - MariaDB DB/user: `romm` / `romm`
+- stored live credentials in the PD media stack env file and synced that env into the encrypted secrets repo; credentials were not written into the main repo
+- verified future app-network connectivity with ephemeral clients on `ix-databases_shared-databases`:
+  - Postgres check returned `gamevault|gamevault`
+  - MariaDB check returned `romm` / `romm@%`
+- rollback notes:
+  - pre-change backup of PD media env: `/mnt/docker-ssd/docker/compose/media/.env.pre-serenity-wave2-d2-20260525-182938`
+  - if D3/D4 later uncover an issue, keep the staged DBs unused, restore the prior media `.env` if needed, and rotate/drop the staged users before re-attempting
+  - no Serenity source data was touched yet in D2; this card only prepared empty PD landing zones
+- note after D3b:
+  - the staged shared-mariadb `romm` target is now superseded by the dedicated `romm-db` plan and should not be used for RomM cutover
+
+### Card D3 — export and validate Serenity source databases
+Definition of done:
+- pre-cutover exports from Serenity are taken for both apps so restore/import flow can be tested before downtime
+- `gamevault` Postgres dump exported from Serenity and integrity-checked
+- `romm` MariaDB dump exported from Serenity and integrity-checked
+- source app versions and DB container versions recorded alongside dumps
+- Postgres collation-version warning captured as a post-import remediation item
+- final cutover note recorded: these pre-cutover dumps are not the authoritative final state; a last quiesced export must be taken after the Serenity app is stopped during cutover and imported to PD before PD goes live
+
+Execution notes (2026-05-25):
+- successful pre-cutover exports were captured and staged under PD backup storage:
+  - latest verified dump set: `/mnt/tank/docker/backups/db-dumps/serenity-wave2/20260525-184917/`
+  - `20260525-184917-serenity-gamevault.pgcustom` — 175290 bytes, sha256 `1ebd0286483e7f34dddc21076a7540c966a812d8891a8ed7a24247fe972d927d`
+  - `20260525-184917-serenity-romm.sql` — 8526126 bytes, sha256 `c74a2d9d715f6c0982d707ba9f41174e19ba681a1debebde865e94e63271302b`
+- source runtime facts recorded during export validation:
+  - Serenity `postgresql15`: PostgreSQL 15.18, `gamevault` has 18 public tables and ~12 MB logical size
+  - Serenity `MariaDB-Official`: MariaDB 12.2.2, `romm` has 20 tables and ~12.41 MB logical size
+  - the existing Serenity Postgres collation-version mismatch warning is still present and should be remediated after final import on PD
+- GameVault restore-path validation succeeded:
+  - the pre-cutover Postgres dump restored cleanly into PD shared-postgres
+  - PD `gamevault` target currently shows the expected 18 public tables
+- RomM restore-path validation exposed a blocker on the planned PD shared-mariadb target:
+  - importing the Serenity RomM dump into PD shared-mariadb failed at line 167 while creating `device_save_sync`
+  - MariaDB returned `ERROR 1005 (HY000): Can't create table romm.device_save_sync (errno: 121 "Duplicate key on write or update")`
+  - PD shared-mariadb is currently MariaDB 11.4.11 while the Serenity RomM source dump was produced from MariaDB 12.2.2
+  - treat this as a compatibility / target-selection issue, not a dump-corruption issue; the dump itself is populated and preserved in backup storage
+- net result:
+  - D3 is complete for GameVault
+  - D3 export validation is complete for RomM, but the original PD shared-mariadb landing target is rejected
+
+### Card D3b — resolve RomM PD database target compatibility
+Decision:
+- do not upgrade PD `shared-mariadb` just to fit RomM
+- keep PD `shared-mariadb` on its current conservative shared-infra track unless a separate approved maintenance change is planned for all consumers
+- provision a dedicated PD MariaDB target for RomM instead
+
+Evidence behind the decision:
+- the RomM source dump repeatedly uses reused foreign-key names such as `CONSTRAINT \`1\`` and `CONSTRAINT \`2\`` across multiple tables
+- MariaDB docs state that foreign-key names must be unique per database before MariaDB 12.1, and only become reusable across tables in MariaDB 12.1+
+- Serenity `MariaDB-Official` is MariaDB 12.2.2, which explains why the source schema can exist there
+- PD `shared-mariadb` is MariaDB 11.4.11, where the same dump fails with `errno: 121` while creating `device_save_sync`
+- the PD databases stack currently provisions MariaDB specifically for Uptime Kuma via `databases/initdb-mariadb/01-create-uptime-kuma-db.sh`; there is no evidence in repo or live stack layout that shared-mariadb was intentionally upgraded or validated as a broad multi-app MariaDB landing zone
+- RomM's own setup docs commonly show a dedicated MariaDB container and even call out compatibility-conscious MariaDB version choices in example guides
+
+Operational recommendation:
+- create a dedicated PD MariaDB service for RomM, isolated from `shared-mariadb`
+- pin that dedicated service to a MariaDB 12.x line compatible with the Serenity source behavior unless RomM docs or release notes later justify a different pin
+- attach PD RomM only to its own DB service plus the networks it already needs for ingress/library access
+- leave `shared-mariadb` untouched for now to avoid coupling the RomM migration to a shared-database major-version change and validation cycle
+
+Definition of done for D3b:
+- dedicated PD MariaDB target for RomM is chosen and documented
+- target image/version pin recorded
+- restore path is re-tested successfully against that dedicated target before RomM cutover proceeds
+
+Execution notes (2026-05-26):
+- restore-path proof was executed on PD using an isolated test container pinned to `mariadb:12.2`
+- test target details:
+  - container: `romm-db-d3b-test`
+  - image/runtime version: `mariadb:12.2` / `12.2.2-MariaDB`
+  - data path: `/mnt/docker-ssd/docker/appdata/romm-db-d3b-test/mysql`
+- the preserved Serenity RomM dump `/home/fizzlepoof/serenity-wave2-d3-work/20260525-184736-serenity-romm.sql` imported cleanly into the 12.2 target on PD
+- post-import verification on the PD test target returned:
+  - `20` tables in schema `romm`
+  - approximately `10.42 MB` logical table+index footprint
+- result:
+  - the compatibility blocker is resolved for a dedicated MariaDB 12.2 target
+  - RomM should proceed against dedicated `romm-db`, not `shared-mariadb`
+
+### Card D4 — sync appdata for GameVault and RomM to PD staging paths
+Definition of done:
+- GameVault config/media/log paths copied to PD staging
+- RomM config/assets/resources paths copied to PD staging
+- large library mounts intentionally re-used from canonical storage instead of blindly duplicating data
+- ownership/permissions on PD staging paths verified
+
+Note:
+- do not advance RomM cutover assumptions until the MariaDB target mismatch found in D3 is resolved; RomM may need a different PD DB target than the original shared-mariadb assumption
+
+### Card D5 — cut over GameVault to PD
+Definition of done:
+- Serenity GameVault stopped only for the final cutover window
+- after GameVault is stopped on Serenity, a final quiesced `gamevault` Postgres export is taken and imported to the PD target DB so PD does not come up on stale data
+- PD GameVault starts against the PD target Postgres DB
+- login, library visibility, metadata behavior, and save/upload paths verified
+- public/LAN route updated if needed and verified
+- Serenity `postgresql15` kept in place but clearly marked retirement-ready if cutover succeeds
+
+### Card D6 — cut over RomM to PD
+Definition of done:
+- Serenity RomM stopped only for the final cutover window
+- after RomM is stopped on Serenity, a final quiesced `romm` MariaDB export is taken and imported to the PD target DB so PD does not come up on stale data
+- PD RomM starts against the PD target MariaDB DB
+- UI, library visibility, assets/resources, background jobs, and metadata behavior verified
+- public/LAN route updated if needed and verified
+- Serenity `MariaDB-Official` kept in place but clearly marked retirement-ready if cutover succeeds
+
+### Card D7 — retire Serenity DB remnants after cooldown
+Definition of done:
+- GameVault and RomM remain healthy on PD through an observation window
+- Serenity `postgresql15` and `MariaDB-Official` are stopped and removed only after successful PD validation
+- Serenity-side DB appdata is retained for cooldown/rollback, not deleted immediately
+- docs and host inventory updated to show Serenity no longer carries those DB pairs
+
+Execution notes (2026-05-25):
+- PD validation passed before source retirement:
+  - `gamevault`, `gamevault-db`, `romm`, and `romm-db` all reported healthy
+  - HTTP checks returned `200` from PD for `http://127.0.0.1:8785/` and `http://127.0.0.1:8457/`
+  - PD DB quick checks returned 18 public tables for `gamevault` and 20 tables for `romm`
+- Serenity rollback retention created at `/mnt/user/backups/doris/serenity-d7-db-retire-20260525-213531`
+  - `romm.sql`
+  - `gamevault.sql`
+  - `mariadb-official-appdata.tgz`
+  - `postgresql15-appdata.tgz`
+- Serenity source DB appdata paths were intentionally left in place for cooldown:
+  - `/mnt/user/appdata/mariadb-official`
+  - `/mnt/cache/appdata/postgresql15`
+- After D7, `docker ps -a` on Serenity no longer listed `MariaDB-Official` or `postgresql15`
+
+## Open item that still needs verification
+
+- `reranker` mounts `/mnt/user/appdate/reranker`
+- verify whether `appdate` is intentional before any future reranker move or cleanup
+
+## Expected result after wave 1
+
+After wave 1, Serenity should still be alive for the workloads that currently justify it, but with much less misleading baggage:
+
+- torrent/media-locality group still intact
+- Newt still intact
+- Technitium backup node still intact
+- GameVault and RomM still live until their migration is prepared
+- legacy Pi-hole gone
+- dead Cloudflared gone
+- stale created/exited clutter gone
+
+That leaves a cleaner host and a safer runway for the later PD storage cutover and full Serenity retirement.
+
+## Wave 1 verification results (2026-05-25)
+
+Verified during this planning pass:
+
+- Serenity still has these live containers relevant to wave 1:
+  - `technitium-dns-pilot`
+  - `binhex-official-pihole`
+  - `pihole-serenity`
+  - `unbound-pihole-serenity`
+  - `keepalived-pihole-serenity`
+  - `Newt`
+  - `Unraid-Cloudflared-Tunnel`
+- PD still runs the primary Technitium stack plus its own Pi-hole and Newt lane.
+- From NOMAD, `/etc/resolv.conf` currently lists `10.5.30.8`, `10.5.30.9`, and `10.5.30.10` ahead of external fallback `9.9.9.9`.
+- From NOMAD, `dig` to `10.5.30.8` and `10.5.30.10` succeeded for public DNS resolution; same-host checks to `10.5.30.9` were unreliable, matching the existing macvlan caveat in the docs.
+- `Unraid-Cloudflared-Tunnel` is still running, but repo docs already classify it as dead/stale and its container has `Restart=no`.
+- Serenity `Newt` must not be treated as deadwood: operator confirmed Pangolin tunnels Serenity resources through Serenity's local Newt instead of routing from PD or NOMAD to Serenity resources over the Serenity LAN IP.
+- Live Serenity `Newt` logs still show repeated Pangolin health checks against stale `10.5.1.5` targets (`7474`, `8785`, `8787`, `8788`, `8990`, `8457`, `5690`, `5454`).
+
+Operational implication:
+
+- removing Cloudflared remains low-risk after one final dependency check
+- removing the legacy Pi-hole stack remains appropriate
+- removing Serenity `Newt` is not appropriate during wave 1
+- Pangolin target drift for Serenity-hosted resources should be repaired later by rehoming those resources to the correct Serenity site/local-path model instead of stale literal pre-migration IPs

docs/planning/SERENITY_DOCKER_AUDIT.md

@@ -0,0 +1,336 @@
+# Serenity Docker Audit
+
+Status: live-audited baseline for cleanup and migration planning, refreshed after the GameVault/RomM cutover cleanup and the broader keep/move/retire placement review.
+
+Last live verification: 2026-05-26
+
+## Access path used
+
+Live audit now succeeds directly from NOMAD using the configured host alias:
+
+- `ssh serenity`
+
+Older discovery in this document used the PD pivot path before direct local SSH was wired up.
+
+## What is currently running on Serenity
+
+### Keep for now until PD storage ownership changes
+These are the containers whose current placement still makes operational sense because Serenity owns the active media/torrent locality today.
+
+- `qbit`
+- `GluetunVPN`
+- `qbit_manage`
+- `prowlarr`
+- `sonarr`
+- `sonarr-anime`
+- `radarr`
+- `lidarr`
+- `readarr`
+- `readarr-epub`
+- `bazarr`
+- `autobrr`
+- `unpackerr`
+- `shelfmark`
+
+Common pattern observed from live mounts:
+- these stacks are bound heavily to `/mnt/user/data`
+- torrent state and backup artifacts live under Serenity-owned paths like `/mnt/user/data/torrents`, `/mnt/user/data/BT_backup`, and appdata under `/mnt/user/appdata/*`
+- current path locality still argues for keeping them on Serenity until PD directly owns the disks and final media paths
+- `shelfmark` is not a generic "random app" here; its live mounts also tie it to Serenity-owned `/mnt/user/data`, audiobook ingest paths, and torrent/library paths
+
+### Keep temporarily, but plan to move or collapse later
+These are live today, but they are not good long-term reasons to keep Serenity alive after PD is rebuilt.
+
+- `reranker`
+  - currently on Serenity because CPU-only TEI was moved off PD
+  - planned long-term home: PD if PD remains the AI control-plane/core host
+  - live runtime uses `/mnt/user/appdate/reranker`, not `/mnt/user/appdata/reranker`; treat that as a migration hazard that must be handled deliberately
+- `technitium-dns-pilot`
+  - current backup Technitium node on Serenity (`10.5.30.10`)
+  - long-term: keep at least one off-PD backup resolver, but that does not have to remain on Serenity forever
+- `Newt`
+  - live on Serenity now
+  - operator confirmed it is still needed, so it should be preserved during cleanup and only rehomed deliberately later
+- `Hawser`
+  - operator confirmed Dockhand depends on it for remote management of Serenity's remaining Docker stacks
+  - keep on Serenity with `dockersocket` until that management pattern is intentionally replaced
+- `dockersocket`
+  - Hawser helper sidecar required by the current Dockhand remote-management path
+- `netdata`
+  - useful while Serenity remains live, not a reason to keep Serenity permanently
+- `Notifiarr`
+  - low-risk utility app that can move later if PD has spare headroom
+  - not urgent while PD remains RAM-constrained
+- `Wizarr`
+  - operator confirmed it is unused and should be retired rather than migrated
+
+### Placement verdict by service group
+
+#### Keep on Serenity until the storage-locality cutover is designed
+- torrent / download lane:
+  - `qbit`
+  - `GluetunVPN`
+  - `qbit_manage`
+  - `autobrr`
+  - `unpackerr`
+- media automation lane:
+  - `prowlarr`
+  - `sonarr`
+  - `sonarr-anime`
+  - `radarr`
+  - `lidarr`
+  - `readarr`
+  - `readarr-epub`
+  - `bazarr`
+- locality-adjacent helpers:
+  - `Notifiarr`
+  - `shelfmark`
+
+Reason:
+- all of these either mount Serenity-owned `/mnt/user/data` directly or depend on the downloader/media-path locality that still lives on Serenity today
+- moving them before PD owns the storage locally would just trade one cleanup project for a fragile NFS-path rewrite project
+
+#### Optional early cleanup / peel-off work
+- retire `Wizarr`
+- move `Notifiarr` only if PD headroom clearly allows it
+- review whether `netdata` still adds enough local-monitoring value to keep
+
+Reason:
+- these are the few remaining low-risk app-level changes that do not depend on the qbit/ARR storage cutover
+- PD is constrained right now, so only very small wins should happen before the larger storage redesign
+
+#### Keep as explicit temporary exceptions, then redesign last
+- `reranker`
+- `technitium-dns-pilot`
+- `Newt`
+
+Reason:
+- these are the remaining special cases that still justify Serenity for non-media reasons
+- each one has a real redesign question attached:
+  - reranker: whether PD should re-absorb AI helper services later
+  - Technitium backup node: which off-PD host should own the durable backup resolver role
+  - Newt: when Serenity-hosted Pangolin resources are deliberately rehomed so the local tunnel is no longer required
+
+### Retire candidates
+These should be treated as cleanup targets unless a specific live dependency is rediscovered.
+
+- `Unraid-Cloudflared-Tunnel`
+  - live audit on 2026-05-25 showed a remote-managed Cloudflare Tunnel with stale legacy `192.168.1.x` origins and zero observed proxied requests on the current run
+  - stopped and removed on 2026-05-25 after post-stop checks showed sampled public hostnames remained healthy without it
+- `binhex-official-pihole`
+- `pihole-serenity`
+- `unbound-pihole-serenity`
+- `keepalived-pihole-serenity`
+  - these were legacy DNS/HA remnants once Technitium became the intended resolver strategy
+  - mixed-host DNS verification passed during retirement on 2026-05-25, and the Serenity Pi-hole HA stack was then stopped and removed without immediate DNS regression
+- the old local DB pair (`postgresql15` and `MariaDB-Official`) was retired on 2026-05-25 after PD validation and rollback bundle creation
+- the stale stopped source app containers (`romm` and `GameVault`) were removed on 2026-05-26
+- retained rollback paths still exist on Serenity:
+  - `/mnt/user/backups/doris/serenity-d7-db-retire-20260525-213531`
+  - `/mnt/user/appdata/romm`
+  - `/mnt/user/appdata/gamevault`
+  - `/mnt/user/appdata/mariadb-official`
+  - `/mnt/cache/appdata/postgresql15`
+
+## Not-running / stale containers seen in `docker ps -a`
+These did not appear live and should be reviewed for deletion after confirming their data is not needed.
+
+Created only (retired on 2026-05-25 after metadata verification):
+- `calibre-web`
+- `SuggestArr`
+- `Cleanuparr`
+- `calibre`
+- `agregarr`
+
+Exited:
+- none remaining from the previously audited stale set; `Huntarr`, `omegabrr`, `romm`, and `GameVault` have now been removed
+
+Current result:
+- no stale created/exited containers remain in `docker ps -a`
+
+## Live project roots observed
+
+Compose Manager project roots found on Serenity:
+- `/boot/config/plugins/compose.manager/projects/pihole-ha`
+- `/boot/config/plugins/compose.manager/projects/re-ranker`
+
+Direct compose file under appdata:
+- `/mnt/user/appdata/technitium-serenity/docker-compose.yaml`
+
+Operational implication:
+- much of Serenity appears to be managed through Unraid Docker templates or ad-hoc container definitions, not a clean compose-per-stack layout
+- cleanup work should expect drift between repo planning docs, backup stack snapshots, and the actual Unraid runtime inventory
+
+## Important live mount observations
+
+Examples from the live container inspection:
+- `qbit` binds `/mnt/user/data -> /data`
+- `qbit_manage` binds `/mnt/user/data`, `/mnt/user/data/BT_backup`, and `/mnt/user/appdata/qbit_manage`
+- `shelfmark` binds `/mnt/user/data`, `/mnt/user/data/media/books/Audiobooks`, `/mnt/user/data/media/books/ingest`, and `/mnt/user/data/torrents`
+- most ARR-family services bind `/mnt/user/data`
+- `reranker` binds `/mnt/user/appdate/reranker -> /data`
+- `Wizarr` only binds its own appdata/database paths and has no meaningful storage-locality reason to stay on Serenity
+- `Hawser` + `dockersocket` are local helper tooling, not media-path owners
+
+Notable typo/risk:
+- `reranker` is mounted from `/mnt/user/appdate/reranker` (note `appdate`, not `appdata`)
+- `/mnt/user/appdate/reranker` exists live; `/mnt/user/appdata/reranker` does not currently exist
+- treat that as an intentional-on-disk reality for now, but fix the naming deliberately during a future migration rather than by surprise during unrelated cleanup
+
+## Recommended next work order
+
+### Phase 1: completed cleanup baseline
+- dead Cloudflared / Pi-hole / stale-container cleanup is done
+- the old local DB pair and source GameVault/RomM containers are already retired
+- current live work should start from the narrower remaining set, not re-open that cleanup unless new evidence appears
+
+### Phase 2: peel off the low-risk non-locality apps
+- retire `Wizarr`
+- optionally move `Notifiarr` if PD headroom clearly permits it
+- decide whether `netdata` still provides unique value once the broader monitoring stack is considered
+
+### Phase 3: preserve the only things that currently justify Serenity
+Until PD owns the storage locally, keep the torrent/media-ingest locality group together:
+- qBittorrent/VPN path
+- ARR family
+- qbit_manage
+- autobrr
+- unpackerr
+- related helpers like Notifiarr and Shelfmark
+
+### Phase 4: cut over after PD storage migration
+Once PD directly owns the relevant media/torrent datasets:
+- move qbit + ARR locality to PD
+- keep path locality on the box that owns the disks
+- move or retire the locality-adjacent helpers that were intentionally left with that lane
+
+### Phase 5: redesign the special cases last
+- move reranker to PD if desired, while normalizing the `appdate`/`appdata` path naming intentionally
+- keep at least one off-PD Technitium node somewhere, preferably NOMAD if Serenity is retiring
+- re-home or retire Serenity-local `Newt` only after Pangolin dependencies are deliberately redesigned
+
+## Kanban-ready workstreams
+
+### Epic A — Serenity live inventory normalization
+- capture `docker ps`, mounts, ports, and remaining host-role assumptions
+- keep the repo docs aligned with the actual Unraid runtime inventory
+- treat ad-hoc Unraid container definitions as a drift risk until they are intentionally replaced
+
+### Epic B — low-risk miscellaneous app peel-off
+- retire `Wizarr`
+- decide whether `Notifiarr` is worth an early move given PD RAM pressure
+- decide whether `netdata` still earns its keep alongside the broader monitoring stack
+
+### Epic C — torrent/media-locality preservation until PD cutover
+- keep qbit/ARR stack stable on Serenity for now
+- document exact media/torrent paths that must exist on PD before migration
+- prevent premature moves that would recreate NFS-path weirdness
+
+### Epic D — special-case redesign
+- normalize the reranker path oddity during a planned move rather than an incidental cleanup
+- decide where the off-PD backup Technitium role should live after Serenity
+- re-home Pangolin/Newt dependencies last, not during the media cutover
+
+### Epic E — final Serenity retirement
+- move remaining wanted apps to PD or NOMAD
+- preserve only the intended backup-DNS failure-domain role off PD
+- decommission Serenity once no production path depends on it
+
+## Resolved operator decisions
+
+Resolved on 2026-05-25:
+
+1. No app should deliberately remain on Serenity once PD owns the disks locally.
+2. Technitium covers the desired DNS role; the legacy Serenity Pi-hole stack should be treated as removable.
+3. `Newt` on Serenity is still needed and should not be treated as cleanup.
+4. `GameVault` and `RomM` should migrate rather than be pruned.
+5. End-state remains:
+   - move qbit + ARR family to PD after storage cutover
+   - leave no intentional production app role on Serenity
+   - retire Serenity entirely
+6. `Wizarr` is explicit retire-now dead weight; `Notifiarr` is the main optional tiny move candidate; `Hawser`/`dockersocket` remain intentional keepers because Dockhand depends on them.
+
+## Remaining verification questions
+
+- No additional live dependency beyond the retired `GameVault`/`RomM` pair was surfaced during the quick DB audit; if that changes later, treat it as a rediscovery against rollback artifacts rather than a live-stack blocker.
+- Decide when the retained DB/appdata rollback artifacts are old enough to archive more aggressively or finally delete.
+- Normalize the `reranker` path naming during the eventual move: preserve the live `/mnt/user/appdate/reranker` data now, but decide whether the destination should standardize back to `appdata`.
+- Serenity's Pangolin/Newt health-check drift is fixed now; any future Newt rehome is an architecture task, not a stale-health-check incident response.
+
+## Pangolin / Newt live remediation status
+
+Live verification on 2026-05-25 showed Serenity Newt still probing stale pre-renumbering health-check URLs like `http://10.5.1.5:8787/` even though the Pangolin target objects already showed `ip=localhost` or `10.5.30.5` for those resources.
+
+Affected target IDs observed live:
+- `15` (`autobrr`)
+- `20` (`notifiarr`)
+- `25` (`readarr`)
+- `29` (`wizarr`)
+- `56` (`readarr-epub`)
+- `57` (`sonarr-anime`)
+- `58` (`romm`)
+- `69` (`gamevault`)
+
+Diagnostic probe performed live on Serenity:
+- temporarily added `10.5.1.5/32` to `br0`
+- this immediately restored health for several targets, proving the stale `hcHostname` diagnosis
+
+However, the old `10.5.1.5` address is no longer allowed on that VLAN, so the alias was removed again.
+
+Verification after removal:
+- `ip addr del 10.5.1.5/32 dev br0`
+- Newt immediately resumed failures such as:
+  - target `56` -> `http://10.5.1.5:8788/`
+  - target `57` -> `http://10.5.1.5:8990/`
+  - target `15` -> `http://10.5.1.5:7474/`
+  - target `25` -> `http://10.5.1.5:8787/`
+
+Interpretation:
+- the alias was useful as a proof-of-cause test only
+- it is not an acceptable steady-state fix here
+- the real remaining task is to authoritatively rewrite the stale Pangolin `hcHostname` values away from `10.5.1.5`
+
+## Pangolin / Newt authoritative fix completed
+
+Follow-up live mutation on 2026-05-25 rewrote the remaining Serenity site targets that were still drifting on stale `10.5.1.5` health checks:
+- target `25` (`readarr`) -> `ip=10.5.30.5`, `hcHostname=10.5.30.5`, `hcHealth=healthy`
+- target `56` (`readarr-epub`) -> `ip=10.5.30.5`, `hcHostname=10.5.30.5`, `hcHealth=healthy`
+- target `57` (`sonarr-anime`) -> `ip=10.5.30.5`, `hcHostname=10.5.30.5`, `hcHealth=healthy`
+
+Post-fix verification:
+- `docker exec Newt wget http://10.5.30.5:8787/`, `:8788/`, and `:8990/` all succeeded from inside Serenity's `Newt` container
+- public probes for `readarr.paccoco.com`, `readarr-epub.paccoco.com`, and `sonarr-anime.paccoco.com` all returned the expected Pangolin-auth redirect flow
+- live Pangolin API inventory for site `serenity` no longer contains any target with `ip=10.5.1.5` or `hcHostname=10.5.1.5`
+
+Current steady state for the audited Serenity-hosted Pangolin targets (`15`, `20`, `25`, `29`, `56`, `57`, `58`, `69`):
+- all now show `ip=10.5.30.5`
+- all now show `hcHostname=10.5.30.5`
+- all now report `hcHealth=healthy`
+
+Rollback / evidence artifacts:
+- pre-change backup for targets `56` and `57`: `/home/fizzlepoof/pangolin-target-backup-serenity-hc-authoritative-20260525T204548Z.json`
+- post-fix snapshot for audited targets: `/home/fizzlepoof/pangolin-target-snapshot-serenity-post-hc-fix-20260525T204741Z.json`
+
+## Database dependency findings
+
+Live inspection before the GameVault/RomM retirement pointed to:
+
+- `GameVault` -> local `postgresql15`
+  - `DB_HOST=10.5.30.5`
+  - `DB_PORT=5432`
+- `RomM` -> local `MariaDB-Official`
+  - `DB_HOST=10.5.30.5`
+  - `DB_PORT=3306`
+
+No immediate database dependency was surfaced from the quick live environment check for:
+
+- `Wizarr`
+- `Shelfmark`
+- `Notifiarr`
+
+Operational implication:
+
+- `postgresql15` should currently be treated as a `GameVault` dependency until proven otherwise.
+- `MariaDB-Official` should currently be treated as a `RomM` dependency until proven otherwise.
+- those databases can likely retire once their dependent apps are migrated to PD and verified there.
+- the legacy Pi-hole containers can be scheduled for removal at the next cleanup window.

docs/planning/SERENITY_MAJORITY_MIGRATION_PLAN.md

@@ -0,0 +1,368 @@
+# Serenity Majority Migration Plan
+
+Status: approved planning baseline for the post-D7 Serenity drain strategy.
+
+Last updated: 2026-05-26
+
+## Execution update — 2026-05-26
+
+Completed live:
+- `Wizarr` retired from Serenity runtime
+- stale Pangolin frontend for `wizarr.paccoco.com` disabled; public hostname now returns `404` instead of fronting a dead service
+- `Hawser` + `dockersocket` verified live and healthy on Serenity
+- `Notifiarr` re-evaluated against live PD headroom and intentionally left on Serenity for now
+- `netdata` re-evaluated and kept on Serenity for now as host-local monitoring, not as an early migration target
+- closeout check: no remaining open Serenity-specific Kanban cards exist from the completed cleanup/planning wave; only the documented planned/blocked future lanes remain
+
+Current blockers verified live:
+- PD is still RAM-constrained (`31 GiB total`, `27 GiB used`, `2.3 GiB free` at check time)
+- PD still consumes Serenity storage over NFS (`/mnt/unraid/data` and `/mnt/unraid/immich` mounted from `10.5.30.5`)
+- backup-DNS replacement is still only a target direction in docs; no Pi 4B resolver lane is live yet
+- Serenity-local `Newt` is still part of the current Pangolin path for Serenity resources, so the special-case access lane is not retired yet
+
+Interpretation:
+- The no-regret cleanup phase is complete.
+- The majority migration phase remains blocked on future infrastructure work, not on missed low-risk cleanup.
+
+## Goal
+
+Move the majority of remaining Docker workload off Serenity without recreating NFS/path-locality pain, while preserving the few roles that still legitimately need to live there until later infrastructure work is complete.
+
+This plan assumes:
+- qBittorrent and the torrent/media-locality lane stay on Serenity for now
+- PD is resource-constrained for a while, especially on RAM
+- `Wizarr` should be retired, not migrated
+- `Hawser` + `dockersocket` stay on Serenity because Dockhand uses them for remote management of Serenity's remaining Docker stacks
+- `Shelfmark` stays with the media-locality lane for now
+- Serenity's backup-DNS replacement should likely land on a small dedicated Raspberry Pi 4B rather than collapsing onto PD
+
+## Executive summary
+
+It is feasible to move the majority of Serenity's Docker workload off the box, but not as a single near-term wave.
+
+Right now the correct strategy is:
+1. retire obvious dead weight
+2. preserve the torrent/media-locality lane on Serenity
+3. keep Hawser/dockersocket, Newt, reranker, and backup-DNS as explicit temporary exceptions
+4. only move tiny low-risk apps early if PD headroom makes the move worth it
+5. do the real majority migration only after PD directly owns the relevant storage and path locality
+
+## Current placement decision matrix
+
+### Keep on Serenity now
+
+#### Media-locality lane
+- `GluetunVPN`
+- `qbit`
+- `qbit_manage`
+- `prowlarr`
+- `sonarr`
+- `sonarr-anime`
+- `radarr`
+- `lidarr`
+- `readarr`
+- `readarr-epub`
+- `bazarr`
+- `autobrr`
+- `unpackerr`
+- `shelfmark`
+
+Reason:
+- these either mount Serenity-owned `/mnt/user/data` directly or depend on workflows whose correctness currently assumes Serenity-local path ownership
+- splitting them early would turn this into an NFS-path rewrite project instead of a cleanup project
+
+#### Temporary intentional exceptions
+- `Hawser`
+- `dockersocket`
+- `Newt`
+- `technitium-dns-pilot`
+- `reranker`
+- `netdata`
+
+Reason:
+- `Hawser` + `dockersocket` remain part of the current Dockhand remote-management path
+- `Newt` still matters because Pangolin tunnels Serenity resources through Serenity-local Newt
+- `technitium-dns-pilot` preserves an off-PD DNS failure domain until replacement exists
+- `reranker` is not urgent to move while PD remains constrained
+- `netdata` is host-local monitoring; evaluate whether to simplify it later, not as a forced migration target now
+
+### Retire
+- `Wizarr`
+
+Reason:
+- operator confirmed it is unused and disposable
+- if onboarding needs return later, it can be rebuilt cleanly instead of migrated
+
+### Optional tiny move candidate
+- `Notifiarr`
+
+Reason:
+- low storage-locality coupling
+- but not worth forcing while PD remains constrained unless there is a concrete benefit
+
+## What should not be added to Serenity
+
+Default rule: add nothing new.
+
+Serenity is in a shrinking transitional role. New durable app responsibilities should go elsewhere unless they are explicitly temporary, host-local, and part of a migration or retirement aid.
+
+## Suggested long-term end state
+
+### PD long-term
+After storage cutover and capacity improvement, PD should absorb:
+- qBittorrent + Gluetun + qbit_manage
+- ARR family
+- `autobrr`
+- `unpackerr`
+- `shelfmark`
+- optional `Notifiarr`
+- `reranker` if PD remains the AI/control-plane center
+
+### Off-PD DNS resilience
+When Serenity retires, preserve at least one non-PD Technitium lane. Likely target:
+- dedicated Raspberry Pi 4B backup resolver
+
+### Serenity end state
+- no intentional durable production app role
+- no unique production dependency path left behind
+- host eligible for retirement after cooldown and verification
+
+## Execution-style Kanban board
+
+Use this as the working card map.
+
+### Epic A — Immediate cleanup and intention-locking
+
+#### A1. Retire Wizarr
+Status: completed 2026-05-26
+Depends on: none
+
+Acceptance criteria:
+- `Wizarr` is removed from live Serenity runtime if still present
+- no reverse-proxy or bookmark expectation still points at it as a live service
+- docs no longer describe it as a migration target
+- rollback expectation is explicitly "rebuild if needed later," not "preserve migrated state"
+
+#### A2. Document Hawser + dockersocket as protected keepers
+Status: completed 2026-05-26
+Depends on: none
+
+Acceptance criteria:
+- docs explicitly state Dockhand depends on `Hawser` + `dockersocket`
+- future cleanup cards do not treat them as accidental leftovers
+- any later rehome/removal must be paired with a replacement Dockhand management path
+
+#### A3. Decide whether netdata remains worth keeping
+Status: completed 2026-05-26
+Depends on: none
+
+Acceptance criteria:
+- decision recorded as one of:
+  - keep as host-local monitoring until retirement
+  - simplify/replace with a lighter local signal
+  - remove after confirming broader monitoring already covers the operator need
+- if changed, verification includes equivalent host visibility from the replacement path
+
+### Epic B — Preserve Serenity's temporary intentional roles
+
+#### B1. Keep the media-locality lane stable on Serenity
+Status: locked
+Depends on: none
+
+Acceptance criteria:
+- no partial migration of qbit/ARR lane is attempted before storage design is ready
+- docs keep the lane grouped as an intentional temporary unit
+- future cards treat locality breakage as a rollback trigger, not a minor warning
+
+#### B2. Keep Hawser + dockersocket in place for Dockhand
+Status: locked
+Depends on: none
+
+Acceptance criteria:
+- `Hawser` and `dockersocket` remain healthy on Serenity
+- Dockhand remote management path still works for the remaining Serenity stacks
+- no proposal to move them is executed without a replacement management path
+
+#### B3. Keep Serenity-local Newt until Pangolin redesign exists
+Status: locked
+Depends on: none
+
+Acceptance criteria:
+- Pangolin-routed Serenity resources continue working
+- no retirement of Serenity-local Newt is attempted early
+- redesign work is handled as its own lane, not hidden inside app migration cards
+
+#### B4. Keep backup Technitium role on Serenity until replacement exists
+Status: locked
+Depends on: none
+
+Acceptance criteria:
+- off-PD DNS failure domain remains intact
+- no cutover collapses this role onto PD alone
+- replacement host is defined and verified before Serenity DNS role is removed
+
+#### B5. Keep reranker on Serenity until PD capacity or architecture changes
+Status: locked
+Depends on: none
+
+Acceptance criteria:
+- reranker remains stable where it is
+- no move is attempted just for neatness
+- any future move explicitly handles the live `/mnt/user/appdate/reranker` path oddity
+
+### Epic C — Optional tiny near-term moves
+
+#### C1. Re-evaluate Notifiarr against live PD headroom
+Status: completed 2026-05-26
+Depends on: none
+
+Acceptance criteria:
+- current PD RAM/storage headroom is checked at execution time
+- clear recommendation recorded: move now, defer, or drop the idea
+- if moved, verification proves app health plus any expected integrations still work
+
+### Epic D — Replace Serenity special-case roles
+
+#### D1. Design the post-Serenity backup DNS lane
+Status: planned
+Depends on: none
+
+Target direction:
+- dedicated Raspberry Pi 4B backup resolver
+
+Acceptance criteria:
+- target host chosen and documented
+- role is explicitly outside PD's failure domain
+- expected sync, secrets, and verification model are documented before cutover
+
+#### D2. Build and validate the Pi 4B backup resolver
+Status: blocked
+Depends on: D1
+
+Acceptance criteria:
+- Pi 4B resolver is online and documented
+- sync path is defined
+- LAN clients can resolve through it as expected
+- it is clearly not dependent on PD for local authoritative continuity
+
+#### D3. Redesign Pangolin/Newt dependency
+Status: planned
+Depends on: none
+
+Acceptance criteria:
+- Serenity-hosted access path no longer requires Serenity-local Newt
+- replacement routing model is documented
+- cutover plan includes rollback and validation steps
+
+#### D4. Re-evaluate reranker final home
+Status: planned
+Depends on: none
+
+Acceptance criteria:
+- host choice made based on live resource reality and AI architecture, not symmetry
+- migration plan explicitly preserves existing data path and naming oddity handling
+
+### Epic E — Majority migration after storage ownership changes
+
+#### E1. Define PD storage cutover model
+Status: blocked
+Depends on: none
+
+Acceptance criteria:
+- exact target datasets/paths on PD are documented
+- ownership, mount semantics, and performance assumptions are explicit
+- migration no longer depends on NFS-style cross-host path fakery
+
+#### E2. Validate media/torrent path behavior on the target model
+Status: blocked
+Depends on: E1
+
+Acceptance criteria:
+- download path behavior validated
+- import path behavior validated
+- hardlink or equivalent behavior validated
+- post-processing behavior validated
+- ARR/qbit path mapping is internally consistent
+
+#### E3. Move qbit + Gluetun + qbit_manage
+Status: blocked
+Depends on: E2
+
+Acceptance criteria:
+- downloader lane works on the target without Serenity path dependence
+- VPN and management behavior are verified
+- rollback window is defined before source teardown
+
+#### E4. Move ARR + helper lane
+Status: blocked
+Depends on: E3
+
+Includes:
+- `prowlarr`
+- `sonarr`
+- `sonarr-anime`
+- `radarr`
+- `lidarr`
+- `readarr`
+- `readarr-epub`
+- `bazarr`
+- `autobrr`
+- `unpackerr`
+- `shelfmark`
+- optional `Notifiarr`
+
+Acceptance criteria:
+- libraries remain visible
+- imports and automation continue working
+- no stale Serenity-local path assumptions remain in configs
+
+#### E5. Post-cutover soak and verification
+Status: blocked
+Depends on: E4
+
+Acceptance criteria:
+- successful download/import verification exists
+- operator-facing health paths are normal
+- rollback confidence window passes without hidden path regressions
+
+### Epic F — Final Serenity retirement
+
+#### F1. Remove remaining special roles from Serenity
+Status: blocked
+Depends on: D2, D3, D4, E5
+
+Acceptance criteria:
+- no production path still depends on Serenity DNS role, Serenity-local Newt, or Serenity reranker placement
+- any retained backups are documented and off the critical path
+
+#### F2. Retire Serenity
+Status: blocked
+Depends on: F1
+
+Acceptance criteria:
+- no intentional production app remains
+- no unique resolver or tunnel role remains
+- docs describe Serenity as retired rather than transitional
+
+## Suggested execution order
+
+If only a few cards should move soon, use this order:
+1. A1 — Retire Wizarr
+2. A2 — Lock Hawser/dockersocket as intentional keepers
+3. A3 — Decide netdata end-state
+4. C1 — Re-evaluate Notifiarr only if there is real benefit
+5. D1/D2 — Create the replacement backup-DNS lane on Pi 4B
+6. D3/D4 — redesign special cases
+7. E1-E5 — execute the true majority migration only after PD storage ownership changes
+8. F1/F2 — retire Serenity
+
+## Recommendation
+
+Do not force a near-term "move the majority now" project.
+
+The correct near-term board is:
+- retire dead weight
+- keep the locality lane intact
+- keep Dockhand's Hawser path intact
+- build the future DNS replacement lane
+- wait for the storage and capacity conditions that make the real majority move sane

docs/planning/TODO.md

@@ -5,14 +5,17 @@
 - [x] Regenerate N.O.M.A.D. Newt secret (was exposed in chat) — completed 2026-05-15
 
 ## Infrastructure
-- [x] Deploy Pi-hole HA on PD + N.O.M.A.D. with VIP `10.5.30.53` — completed 2026-05-15; historical Trusted-VLAN design, later superseded after NOMAD moved to Servers (`10.5.30.7`) and its Trusted-side Keepalived role was disabled pending a same-subnet HA redesign; see docs/planning/DEPLOY_PIHOLE.md
+- [x] Deploy Pi-hole HA on PD + N.O.M.A.D. with VIP `10.5.30.53` — completed 2026-05-15; historical design later superseded by the Technitium trio. Both the PD runtime at `/mnt/docker-ssd/docker/compose/pihole` and the NOMAD runtime at `/opt/pihole-nomad` were retired on 2026-05-27; see docs/planning/DEPLOY_PIHOLE.md
-  - PD primary live at `/mnt/docker-ssd/docker/compose/pihole`
+  - PD primary retired 2026-05-27 after local resolver cutover to Technitium (`10.5.30.8/.9/.10` + `9.9.9.9`)
-  - NOMAD backup live at `/opt/pihole-nomad`
+  - NOMAD legacy survivor retired 2026-05-27; old VIP `10.5.30.53` no longer answers
   - RPi4 remains optional future BACKUP2 work if you want a third node later
 - [x] Deploy Kima-Hub — completed 2026-05-06; docs/planning/DEPLOY_KIMA_HUB.md now serves as deployment/repair reference
 - [ ] Set up off-site backup for vital data (appdata, databases, config repo, photos)
-- [ ] Remove dead Unraid-Cloudflared-Tunnel container from Serenity
+- [x] Remove dead Unraid-Cloudflared-Tunnel container from Serenity — completed 2026-05-25
 - [ ] Serenity malcolm pool capacity planning (heavily utilized)
+- [ ] Design post-Serenity backup DNS lane (target: Pi 4B backup resolver outside PD's failure domain)
+- [ ] Redesign Pangolin/Newt so Serenity resources no longer require Serenity-local Newt
+- [ ] Define PD storage cutover model for qBittorrent/ARR locality migration off Serenity
 - [x] Add Pangolin resource for `openwebui.paccoco.com` → OpenWebUI (port 8282) — completed 2026-05-15
 - [x] Add Cloudflare DNS record for `openwebui.paccoco.com` — completed 2026-05-15
 - [ ] Install fresh editor on PD

docs/planning/doris-barbell-v1-plan.md

@@ -47,8 +47,10 @@ Tech stack: FastAPI, Jinja2, JSON state store for V1 bootstrap, Docker Compose o
 - Homepage now renders current metrics, recent workouts, exercise bests, and placeholder template/routine scaffolding.
 - Homepage now renders John's imported five-day split as the default routine board.
 - Homepage now includes mobile-friendly HTML forms for quick weight entry, body measurements, exercise templates, routine drafts, and quick workout logging.
+- Routine log sheets now support dropdown exercise selection with set-by-set rep and weight entry for seeded program days.
+- Live workout pages now let John start a session and save one exercise at a time mid-workout before finishing the routine into history.
 - Homepage now includes John-focused recent history snapshots so the app is useful before charts exist.
-- Tests currently cover health, seeded users, BMI calculation, imperial measurement logging, exercise template creation, routine creation, history ordering, structured workout logging, progression summaries, homepage render, and form-post redirects.
+- Tests currently cover health, seeded users, BMI calculation, imperial measurement logging, exercise template creation, routine creation, history ordering, structured workout logging, live workout session flows, progression summaries, homepage render, routine log flows, and form-post redirects.
 
 ## Next build slices
 

docs/reference/MESHTASTIC.md

@@ -1,9 +1,14 @@
 # Meshtastic Stack
 
 ## Overview
-Self-hosted Meshtastic monitoring and management stack running on PlausibleDeniability.
+Self-hosted MeshMonitor stack running on PlausibleDeniability, plus the current operator note for the separate NOMAD-side MeshCore companion observer.
 
-Related NOMAD-side bridge note: a separate MeshCore-to-MQTT relay is running on N.O.M.A.D. as Docker container `mctomqtt` (`mctomqtt:latest`), with config bind-mounted from `/etc/mctomqtt`. The package also includes a systemd unit under `/opt/mctomqtt`, but that is not the active runtime on this host.
+Related NOMAD-side bridge note: the legacy `mctomqtt` Docker relay was retired on 2026-06-13. N.O.M.A.D. now uses the LetsMesh companion observer flow via `meshcore-capture.service`, running from `/home/fizzlepoof/.meshcore-packet-capture` and connecting directly to the Heltec over `/dev/serial/by-id/...`.
+
+Important split:
+- **PD** hosts the MeshMonitor web/UI stack.
+- **NOMAD** owns the USB-attached Heltec companion observer via `meshcore-capture.service`.
+- Do not assume MeshMonitor and the companion observer are the same runtime path.
 
 ## Stack Location
 `/mnt/docker-ssd/docker/compose/meshtastic/`
@@ -12,29 +17,43 @@ Related NOMAD-side bridge note: a separate MeshCore-to-MQTT relay is running on
 
 | Container | Image | Port | Purpose |
 |-----------|-------|------|---------|
-| meshmonitor | ghcr.io/yeraze/meshmonitor:4.2.0 | 8081→3001 | Main UI + backend |
+| meshmonitor | ghcr.io/yeraze/meshmonitor:latest | 8081→3001, 4404→4404, 1883→1883 | Main UI + backend; live compose publishes the virtual-node port and embedded MQTT broker directly from this container, and now maps `/dev/ttyACM0` into the container for native MeshCore USB sources |
-| meshmonitor (virtual node) | — | 4404 | TCP virtual node server |
+| meshmonitor (virtual node) | — | 4404 | TCP virtual node server exposed directly by the meshmonitor container |
-| meshmonitor-tileserver | maptiler/tileserver-gl-light | 8082→8080 | Offline map tiles |
+| meshmonitor (embedded MQTT broker) | — | 1883 | Embedded Aedes-based MQTT broker exposed directly by the meshmonitor container |
-| meshmonitor-mqtt-proxy | ghcr.io/ln4cy/mqtt-proxy:master | — | MQTT→TCP bridge |
+| meshmonitor-tileserver | maptiler/tileserver-gl-light:latest | 8082→8080 | Offline map tiles |
 | meshmonitor-upgrader | docker:latest | — | Auto-upgrade watchdog |
 
+Live runtime verified on 2026-07-03:
+- `docker compose ps` on PD showed `meshmonitor`, `meshmonitor-tileserver`, and `meshmonitor-upgrader` running.
+- Repo compose and live runtime now agree that there is no separate `meshmonitor-mqtt-proxy` sidecar in the active stack.
+- The embedded MQTT broker source `Meshcore Peachtree Observer` is configured in MeshMonitor and logs `MQTT broker listening on 0.0.0.0:1883`.
+- A native MeshCore USB source `PT Meshcore` is now auto-connected in MeshMonitor via `/dev/ttyACM0` after the compose file was updated to map the device into the container.
+- NOMAD `meshcore-capture.service` was later returned to its three upstream brokers after the embedded-broker test path proved unnecessary for real MeshCore ingestion.
+
 ## Architecture
 ```
-Meshtastic Node (10.5.1.172)
+Trusted-LAN mesh node (10.5.1.120)
-        ↓ MQTT
+        ↓ direct node connection configured by MESHTASTIC_NODE_IP
-meshmonitor-mqtt-proxy
+meshmonitor backend on PD
-        ↓ TCP (port 4404)
-meshmonitor virtual node server
-        ↓
-meshmonitor backend
         ↓
 PostgreSQL (shared-postgres, db: meshmonitor)
+
+Separate path:
+NOMAD Heltec companion observer (`meshcore-capture.service`)
+        ↓ upstream MQTT brokers (LetsMesh US / EU + NashMe)
+
+PD native MeshCore USB source (`PT Meshcore`)
+        ↓ `/dev/ttyACM0` mapped into the meshmonitor container
+        ↓ meshcore.js native companion backend
 ```
 
+Note: the embedded MeshMonitor broker now accepts the NOMAD connection on `10.5.30.6:1883`, but current MeshMonitor logs still show protobuf decode warnings for MeshCore packet payloads. Treat this as confirmed broker fanout connectivity, not yet confirmed first-class MeshCore ingestion.
+
 ## Node Connection
-- Node IP: `10.5.1.172`
+- PD MeshMonitor compose is currently configured with `MESHTASTIC_NODE_IP=10.5.1.120`
-- Connection type: MQTT via mqtt-proxy (not direct TCP)
+- MeshMonitor itself publishes port `4404` for the virtual-node path and `1883` for the embedded MQTT broker; there is no separate `meshmonitor-mqtt-proxy` service in the active stack
-- mqtt-proxy connects to meshmonitor's virtual node server on port 4404
+- For native MeshCore USB sources on PD, the live compose now maps `/dev/ttyACM0` directly into the `meshmonitor` container
+- NOMAD's companion observer is a different ingest path and should not be documented as a MeshMonitor sidecar
 
 ## Storage
 - Appdata: `/mnt/tank/docker/appdata/meshmonitor/data` → `/data`
@@ -60,7 +79,7 @@ mkdir -p /mnt/docker-ssd/docker/compose/meshtastic/scripts
 
 ## Known Warnings
 - Node `!dd972536` has a low-entropy public key — this is a device configuration issue, not a meshmonitor bug
-- Frequent connect/disconnect cycles in logs are normal when the MQTT proxy reconnects
+- MeshMonitor logs can still show noisy reconnect/admin-session churn during node or radio instability; do not confuse that with the retired NOMAD `mctomqtt` path
 
 ## Tiles
 Map tiles stored in `./tiles/`. Currently includes `zurich_switzerland.mbtiles` (34MB).
@@ -68,5 +87,4 @@ Tiles directory is gitignored. To add new tiles, download `.mbtiles` files and p
 
 ## TODO
 - [ ] Document all running meshtastic-map container config
-- [ ] Document meshtastic-map-mosquitto and meshtastic-mqtt containers
 - [ ] Add healthcheck to meshmonitor container

docs/servers/NOMAD.md

@@ -12,6 +12,11 @@ Offline survival/knowledge server and game server host.
 - **Motherboard:** ASRock H97M Pro4
 - **UPS:** None
 
+## Planned long-term role
+- Keep NOMAD intentionally separate from PD's production stack.
+- Continue to host Project NOMAD, game services, and the backup Technitium resolver.
+- Accept only small bounded helper workloads; do not let it drift into being a second general-purpose production host.
+
 ## Storage
 | Device | Size | Mount | Purpose |
 |--------|------|-------|---------|
@@ -208,43 +213,40 @@ These are expected to be managed by Wings/Pelican rather than a local compose fi
 - The live `.env` is also backed up into the encrypted PD secrets repo as `env/technitium-nomad.env`
 - Same-host checks from NOMAD to `10.5.30.9` are unreliable because the resolver sits behind macvlan networking; verify from another LAN peer instead
 
-### MeshCore to MQTT relay
+### LocalSend Trusted inbox
-- Install date: 2026-05-18
+- Live stack path: `/opt/localsend-nomad`
-- Install root: `/opt/mctomqtt`
+- Repo source path: `/home/fizzlepoof/repos/truenas-stacks/localsend-nomad`
-- Config root: `/etc/mctomqtt`
+- Trusted bind IP: `10.5.1.16`
-- Service account: `mctomqtt:mctomqtt`
+- Advertised device name: `Doris Trusted Inbox`
-- Installer metadata: `.version_info` reports `installer_version: 1.3.0.0-preview`, repo `Cisien/meshcoretomqtt`, branch `main`, commit `10f7c0e`
+- Role: headless LocalSend receiver for Trusted-LAN handoff into `/home/fizzlepoof/private/inbox-secrets`
-- Detected install type marker: `/opt/mctomqtt/.install_type` contains `docker`
+- Runtime model: standalone Docker Compose stack on a Trusted-LAN macvlan (`enp5s0.51`, VLAN 51) while the host stays on Servers (`10.5.30.7`)
-- Runtime model:
+- LocalSend listener ports: `53317/tcp`, `53317/udp`
-  - Active runtime is a standalone Docker container named `mctomqtt`
+- Same-host checks from NOMAD to `10.5.1.16` are unreliable because the receiver sits behind macvlan networking; verify from another Trusted-LAN peer instead
-  - Image: `mctomqtt:latest`
+- Inbox watcher for Minerva staging: `minerva-localsend-autosort.path`
-  - Command: `python3 /opt/mctomqtt/mctomqtt.py`
+- Sorter service: `minerva-localsend-autosort.service`
-  - User: `mctomqtt`
+- Sorter script: `/home/fizzlepoof/.local/bin/minerva-localsend-autosort.py`
-  - Restart policy: `unless-stopped`
+
-  - Network mode: `bridge`
+### MeshCore companion observer
-  - Config bind mount: `/etc/mctomqtt:/etc/mctomqtt:ro`
+- Current runtime: `meshcore-capture.service` (systemd)
-  - Device passthrough: the Heltec serial device is mapped directly into the container at the same `/dev/serial/by-id/... ` path
+- Install root: `/home/fizzlepoof/.meshcore-packet-capture`
-- Systemd note:
+- Service unit: `/etc/systemd/system/meshcore-capture.service`
-  - The packaged repo also includes `/opt/mctomqtt/mctomqtt.service`, but it is not the active runtime on NOMAD
+- Runtime command: `/home/fizzlepoof/.meshcore-packet-capture/venv/bin/python3 /home/fizzlepoof/.meshcore-packet-capture/packet_capture.py`
-  - No installed unit was present in `/etc/systemd/system` or `/lib/systemd/system`
+- Connection mode: direct serial on the Heltec via `/dev/serial/by-id/usb-Espressif_Systems_heltec_wifi_lora_32_v4__16_MB_FLASH__2_MB_PSRAM__441BF670B684-if00`
-  - The bundled unit expects `/opt/mctomqtt/venv/bin/python3`, but no `venv/` directory exists under `/opt/mctomqtt`
+- Observer role:
-  - Treat the systemd unit as an unused package artifact for this host unless the deployment model changes later
+  - NOMAD now uses the LetsMesh companion observer flow instead of the legacy `mctomqtt` relay
-- Config layering:
+  - The companion process connects to the Heltec locally, signs JWTs on-device, and publishes packet capture data upstream to MQTT brokers
-  - Base reference: `/etc/mctomqtt/config.toml`
+- Service health observed on 2026-07-03:
-  - Preset overlay: `/etc/mctomqtt/config.d/10-meshmapper.toml`
+  - `systemctl status meshcore-capture` shows the service active/running
-  - Local overrides: `/etc/mctomqtt/config.d/99-user.toml`
+  - Logs confirm successful serial connection to device name `Peachtree Mesh Monitor`
-- Current local overrides observed:
+  - Logs confirm MQTT connectivity to LetsMesh US, LetsMesh EU, and NashMe
-  - IATA region code set to `BNA`
+  - After removing the temporary PD embedded-broker test target, startup logs now show `Connected to 3 MQTT broker(s)`
-  - Serial device pinned to `/dev/serial/by-id/usb-Espressif_Systems_heltec_wifi_lora_32_v4__16_MB_FLASH__2_MB_PSRAM__441BF670B684-if00`
+  - Packet capture mode is enabled and waiting for packets
-  - Enabled broker targets include MeshMapper, LetsMesh US, and NashMe
+- Initial-start caveat:
-  - Credentials/secrets are stored inline in `99-user.toml`; do not mirror them into git-backed docs
+  - One installer-start attempt failed with `No such file or directory` for the `/dev/serial/by-id/...` path
-- Container health observed during inspection:
+  - A subsequent manual `systemctl start meshcore-capture` succeeded once the device path was present again
-  - Logs show the relay loading all three config layers, opening the Heltec serial device, and connecting successfully to MeshMapper, NashMe, and LetsMesh US after restart
+- Legacy relay retirement:
-  - The current container had been up about 5 minutes during inspection with `MQTT: 3/3`, zero failures, and live RX air-time reported
+  - The old standalone Docker container `mctomqtt` was retired on 2026-06-13
-  - An earlier start logged one DNS resolution failure for a broker label shown as `custom-2`, but the current running container recovered and all three named brokers connected cleanly
+  - Backup of the retired relay files/config was saved under `/home/fizzlepoof/private/backups/mctomqtt-retire/20260613-174536`
-- Container logs / inspection:
-  - Use `docker logs mctomqtt` for runtime output
-  - Use `docker inspect mctomqtt` for bind mounts, device mappings, and restart policy
 - Documentation linkage:
   - Related mesh stack notes live in [MESHTASTIC.md](../reference/MESHTASTIC.md)
 

docs/servers/PLAUSIBLEDENABILITY.md

@@ -2,6 +2,8 @@
 
 Primary Docker host running all production workloads.
 
+> Planned direction: this host remains bare-metal TrueNAS Scale and becomes the long-term primary production platform after the HL15 Beast rebuild. See `docs/planning/PD_FUTURE_STATE_ARCHITECTURE.md`.
+
 ## Specs
 - **OS:** TrueNAS Scale 25.10.2.1
 - **CPU:** Ryzen 9 3950X
@@ -45,9 +47,10 @@ Recommended models for 11GB VRAM:
 | `phi4` | ~8GB | Analytical tasks |
 
 Current light-tier notes:
-- PD Ollama is the active light-tier endpoint for LiteLLM on `http://10.5.30.6:11434`
+- PD Ollama remains the shared light-tier endpoint for the broader AI stack on `http://10.5.30.6:11434`, but it should be protected from routine Honcho background load.
-- Local Honcho currently points at PD Ollama over LAN (`http://10.5.30.6:11434/v1`) instead of using a separate local model host
+- Local Honcho now uses N.O.M.A.D.'s own Ollama on `http://127.0.0.1:11434/v1` so PD pressure does not take down MeshMonitor or shared Postgres.
-- Current Honcho routing split keeps embeddings on `nomic-embed-text:latest`, cheap/default paths on `qwen2.5:7b`, and deeper high/max paths on `qwen2.5:14b`
+- Current Honcho routing keeps embeddings on `nomic-embed-text:v1.5`, cheap/default paths on `qwen2.5:3b`, and high/max paths on `llama3.1:latest`.
+- Rocinante is John's PC and should be treated as an opportunistic/manual heavy tier, not a dependable always-on backend.
 
 ## Remote Access
 - Pangolin VPS + Newt for external services
@@ -67,6 +70,8 @@ Current light-tier notes:
 > ```bash
 > sudo bash /mnt/tank/docker/scripts/mount-unraid-nfs.sh
 > ```
+>
+> **Important:** if `/mnt/unraid/data` or `/mnt/unraid/immich` gets remounted after dependent containers are already running, restart the bind-mounted consumers so they pick up the live NFS mount instead of the pre-remount underlay. Current restart set: Plex, Audiobookshelf, Calibre-Web, and Immich Server.
 
 ## Known Issues
 - immich-ml intermittently unhealthy — investigate GPU/CUDA health
@@ -76,3 +81,12 @@ Current light-tier notes:
 ## Pending
 - Add Pangolin resource + DNS for `ai.paccoco.com`
 - Install fresh editor
+
+## Planned future role
+- Primary NAS after Serenity retirement
+- Primary production Docker/app host
+- Primary shared database host
+- Primary media / automation / identity / monitoring host
+- Primary Technitium source node
+- Future home of qBittorrent + ARR after storage ownership moves local to PD
+- Acceptable host for tightly segmented cybersecurity VMs, but not an unrestricted lab/free-for-all hypervisor

docs/servers/ROCINANTE.md

@@ -2,6 +2,8 @@
 
 Heavy AI inference server.
 
+> Planned direction: Rocinante becomes optional if the upgraded PD build receives the 4090. If PD does not get the 4090, Rocinante remains the heavy-inference specialist.
+
 ## Hardware
 
 | Component | Details |
@@ -22,14 +24,15 @@ Ollama runs on port `11434` and hosts the large-model ("heavy") tier.
 | `qwen2.5:32b` | Large-context tasks |
 | `gemma3:27b` | Multimodal / vision |
 
-> **LiteLLM tier:** Rocinante is the **"heavy"** tier in LiteLLM `config.yaml`.
+> **LiteLLM tier:** Rocinante may serve as an **opportunistic heavy/manual tier** when the PC is online.
-> Heavy-tier requests from OpenWebUI and n8n route to `http://10.5.30.112:11434`.
+> Do not depend on `http://10.5.30.112:11434` for routine background routing; verify live reachability first and prefer N.O.M.A.D.-local paths for guaranteed availability.
 
 ## Current operational note
 
-- During Doris validation from N.O.M.A.D. on 2026-05-21, `10.5.30.112` did not answer ping and did not accept connections on `11434` or `8787`.
+- Rocinante is John's personal PC and is not a dependable always-on homelab tier.
-- Treat Rocinante-hosted Ollama heavy-tier traffic and CUDA Whisper as currently unreachable from N.O.M.A.D. until host/network reachability is restored.
+- Treat Ollama/Whisper on Rocinante as opportunistic capacity when the machine is online, not as a required background dependency.
-- Re-validate from N.O.M.A.D. with `curl http://10.5.30.112:11434/api/tags` and `curl http://10.5.30.112:8787/health` after recovery.
+- If N.O.M.A.D. or PD need guaranteed inference, prefer local N.O.M.A.D. routing first and keep PD protected from routine background load.
+- Re-check live reachability from N.O.M.A.D. before any Rocinante-dependent maintenance or cutover.
 
 ## Notes
 

docs/servers/SERENITY.md

@@ -1,6 +1,6 @@
 # Serenity
 
-NAS, media ingestion, and CPU-based AI inference.
+Current NAS, media-ingestion, and CPU-based AI helper host. Planned to retire after the upgraded PD build absorbs its storage role.
 
 ## Hardware
 
@@ -18,6 +18,7 @@ NAS, media ingestion, and CPU-based AI inference.
 - **NAS** — primary storage for Docker volumes, media, and backups via NFS
 - **Media ingestion** — full ARR stack (Sonarr, Radarr, Prowlarr, qBittorrent, etc.)
 - **Reranker host** — CPU-based TEI reranker for the AI RAG pipeline
+- **Pangolin site host** — Serenity's local Newt is intentionally kept because Pangolin tunnels Serenity resources through that Newt instead of targeting Serenity resources from PD or NOMAD over Serenity LAN IPs
 
 ## Services
 
@@ -32,6 +33,8 @@ NAS, media ingestion, and CPU-based AI inference.
 > ```bash
 > sudo bash /mnt/tank/docker/scripts/mount-unraid-nfs.sh
 > ```
+>
+> **Important:** if PD remounts `/mnt/unraid/data` or `/mnt/unraid/immich` after media containers are already running, restart the bind-mounted consumers so they repoint at the live NFS mount instead of the pre-remount underlay. Current restart set: Plex, Audiobookshelf, Calibre-Web, and Immich Server.
 
 ### Reranker (TEI)
 
@@ -42,12 +45,13 @@ Text Embeddings Inference reranker for OpenWebUI RAG pipeline.
 | **Model** | `BAAI/bge-reranker-v2-m3` |
 | **Image** | `ghcr.io/huggingface/text-embeddings-inference:cpu-latest` |
 | **Port** | `9787` |
-| **Volume** | `/mnt/user/appdata/reranker` |
+| **Volume** | `/mnt/user/appdate/reranker` |
 | **LiteLLM model name** | `reranker` |
 | **API base** | `http://10.5.30.5:9787` |
 
 > Moved from PlausibleDeniability (port 8787) to Serenity (port 9787) on 2026-05-09.
 > CPU-only inference is acceptable for RAG reranking workloads.
+> Live runtime currently uses `/mnt/user/appdate/reranker`; preserve that path as-is until a deliberate migration normalizes it.
 
 ### ARR Stack
 
@@ -68,3 +72,14 @@ Serenity hosts the secondary backup Technitium node on `10.5.30.10`.
 
 - No GPU; reranker uses CPU-only TEI image
 - Tailscale active — reachable at `100.94.87.79` from any Tailscale node
+- Local Serenity DB containers for the old GameVault and RomM stacks (`postgresql15` and `MariaDB-Official`) were retired on 2026-05-25 after both apps validated healthy on PD.
+- The stale stopped source app containers for those old stacks were cleaned out afterward; rollback now lives in the retained appdata plus `/mnt/user/backups/doris/serenity-d7-db-retire-20260525-213531` rather than in lingering `docker ps -a` entries.
+- Cooldown/rollback artifacts for that retirement were retained on Serenity under `/mnt/user/backups/doris/serenity-d7-db-retire-20260525-213531`, and the original DB appdata paths were left in place rather than deleted immediately.
+
+## Planned future role
+
+- Transitional only; do not design new long-term dependencies around Serenity.
+- Near-term it continues to host storage locality, reranker, the backup Technitium node, and the Serenity-local Newt needed for Pangolin access to Serenity resources.
+- Near-term cleanup already retired `Wizarr`, keeps `Hawser` + `dockersocket` because Dockhand depends on them for remote management of Serenity's remaining Docker stacks, and intentionally leaves `Notifiarr` and `netdata` on Serenity for now because PD headroom and host-local monitoring value do not justify an early move.
+- Once PD directly owns the storage, qBittorrent/ARR locality should move to PD and Serenity should be drained and retired.
+- The stale Pangolin/Newt health-check drift to `10.5.1.5` was fixed on 2026-05-25; future Newt work is now a deliberate rehome/retirement design task rather than an active incident.

docs/troubleshooting/KNOWN_QUIRKS.md

@@ -26,8 +26,15 @@ Per-service gotchas that aren't bugs but will bite you if you forget them.
 - Requires `/mnt/tank/docker/appdata/donetick/config/selfhosted.yaml` with full DB config
 - Uses viper config loader — `DT_ENV` controls config file path
 - Public exposure through Pangolin can stay unhealthy after renumbering if the target health-check hostname is stale even when the target IP/port are already fixed; verify both `ip` and `hcHostname`
+- If PD-side Pangolin/Newt targets still probe a stale pre-renumbering host IP (for example `10.5.1.6`) but the backend is otherwise healthy, the fastest reversible recovery is a runtime `/32` compatibility alias on PD while the authoritative Pangolin target/health-check state is corrected
+- If the PD `newt-loopback-bridge` helper is using `network_mode: "container:<newt>"`, restarting `ix-newt-newt-1` can leave the loopback relays broken until `newt-loopback-bridge` is also restarted; symptom is public 502/503 on `localhost`-backed Pangolin routes even after target health turns green
 - OIDC metadata for the frontend is exposed from `/api/v1/resource`; if the login button is missing, check that endpoint before debugging the SPA
 
+### homepage
+- Live config is `/mnt/tank/docker/appdata/homepage/services.yaml`; it is not currently repo-managed, so live edits should be mirrored back into docs when they matter operationally
+- `books.paccoco.com` is the working public Calibre-Web route; `calibre.paccoco.com` / `kindle.paccoco.com` are legacy/broken unless separate Pangolin resources are created for them
+- RoMm widget URLs must use a backend Homepage can actually reach from PD; if the only working path is the auth-gated public Pangolin route, remove the widget instead of leaving a stale literal LAN IP
+
 ### shlink
 - Data directory must be `chmod 777` — runs as non-root user that doesn't match host default ownership
 
@@ -35,6 +42,15 @@ Per-service gotchas that aren't bugs but will bite you if you forget them.
 - DB: user=`openwebui`, db=`openwebui` on shared-postgres
 - If restart-looping with auth errors: container wasn't on `ix-databases_shared-databases` at creation time — must `down && up`
 
+### qdrant
+- If the container has to be manually recreated from `docker inspect` because compose labels are stale or missing, treat that as emergency stabilization only, not final cleanup
+- After emergency recovery, immediately reconcile the runtime back to `/mnt/docker-ssd/docker/compose/ai/docker-compose.yaml`, back up the live state, and verify the container labels again before calling the incident closed
+- The container being `Up` is not enough; also confirm `com.docker.compose.project.working_dir`, `com.docker.compose.project.config_files`, and `/healthz`
+
+### seerr
+- After adjacent media-stack incident work, verify both LAN/public availability and that the container still points at `/mnt/docker-ssd/docker/compose/media/docker-compose.yaml`
+- Stale `*.pre-*` compose backups do not belong in the live compose directory long-term; back them up elsewhere, then prune them to reduce operator ambiguity
+
 ### plex
 - Port `5353/udp` conflicts with system avahi/mDNS — remove from port mappings
 
@@ -52,6 +68,12 @@ Per-service gotchas that aren't bugs but will bite you if you forget them.
 - `docker restart` or `docker compose restart` will NOT fix missing network attachments
 - Must use `docker compose --env-file .env down <service> && docker compose --env-file .env up -d <service>`
 
+### UniFi Protect WiFi chimes after doorbell/network changes
+- A UniFi Protect WiFi chime can look healthy in UniFi Network while still showing offline in Protect if a per-client Camera virtual-network override puts it on a lane that does not preserve the required Protect path.
+- In John's current environment, the known-good fallback for the two Wi-Fi chimes is Management/default `UniFi Wireless`, not the Camera-lane override that was tried on 2026-05-22.
+- After a doorbell is re-adopted, also verify each chime's `ringSettings.cameraId` still points at the current doorbell object; a stale camera binding can break ringing even when the network path is healthy.
+- Treat "device online in UniFi Network" and "device healthy in Protect / rings for the current doorbell" as separate checks.
+
 ---
 
 ## Serenity
@@ -61,7 +83,23 @@ Per-service gotchas that aren't bugs but will bite you if you forget them.
 - MAM-init script updates MyAnonamouse IP inside qbit container on startup
 
 ### Unraid-Cloudflared-Tunnel
-- Dead container, should be removed
+- Older notes called this dead, but live inspection on 2026-05-25 showed active Cloudflare QUIC edge registrations and a configured tunnel token.
+- Follow-up audit showed it is only transport-alive: current-run metrics reported zero proxied requests, its remote-managed ingress config still points at legacy `192.168.1.x` origins, and the listed public hostnames appear to be served elsewhere now.
+- Retired on 2026-05-25: the container was stopped and removed, sampled public hostnames stayed healthy, and Cloudflare-side cleanup can now happen separately from Serenity runtime cleanup.
+
+### Serenity Wave 1 cleanup guardrails
+- `Unraid-Cloudflared-Tunnel` has already been retired from Serenity runtime; any remaining cleanup is Cloudflare-side control-plane cleanup, not local container cleanup.
+- Serenity's legacy Pi-hole HA containers were retired on 2026-05-25 after mixed-host DNS verification; if future DNS issues appear, investigate the surviving Technitium/other-resolver path rather than trying to resurrect those old Pi-hole containers by default.
+- Recent `Created` containers on Unraid may represent intentionally retained templates rather than stale debris; distinguish them from long-dead exited containers before pruning.
+
+### Serenity Newt / Pangolin stale health-check IP drift
+- Several Serenity Newt-backed Pangolin targets were corrected to `ip=localhost`/`10.5.30.5` but still retained stale `hcHostname=10.5.1.5`, so Newt health checks failed with `no route to host`
+- Verified affected target IDs on 2026-05-25: `15`, `20`, `25`, `29`, `56`, `57`, `58`, `69`
+- A temporary local `/32` alias on Serenity (`ip addr add 10.5.1.5/32 dev br0`) proved the diagnosis by flipping multiple targets back to healthy
+- That alias was then removed because the old `10.5.1.5` address is no longer allowed on the VLAN
+- After removal, targets immediately fell back to unhealthy on the same stale health-check URLs, confirming the real problem is authoritative Pangolin metadata drift, not local app failure
+- Treat the alias only as a diagnostic probe; do not persist it. The correct fix is to rewrite Pangolin health-check hostnames away from the stale pre-renumbering IP.
+- Authoritative fix completed for the Serenity audit set on 2026-05-25: targets `15`, `20`, `25`, `29`, `56`, `57`, `58`, and `69` now use `10.5.30.5` for both routing and health checks, and no audited Serenity Pangolin target still carries `10.5.1.5` in live API state.
 
 ---
 

headscale/.env.example

@@ -0,0 +1,13 @@
+TZ=America/Chicago
+
+# Public control-plane hostname for off-LAN clients.
+HEADSCALE_SERVER_URL=https://headscale.paccoco.com
+HEADPLANE_BASE_URL=http://headplane.home.paccoco.com:3005
+
+# Must be replaced with an actual 32-character secret before deployment.
+HEADPLANE_COOKIE_SECRET=CHANGE_ME_TO_EXACTLY_32_CHARS
+
+# Optional future OIDC wiring for Headscale users. Leave blank for the initial pilot.
+HEADSCALE_OIDC_ISSUER=
+HEADSCALE_OIDC_CLIENT_ID=
+HEADSCALE_OIDC_CLIENT_SECRET=

headscale/README.md

@@ -0,0 +1,317 @@
+# Headscale pilot on PD
+
+Self-hosted Headscale + Headplane pilot stack for replacing the Tailscale free-tier 3-user limit without doing a blind cutover.
+
+## Why this exists
+
+- remove the 3-human-user ceiling from the current Tailscale free-tier setup
+- keep the control plane on PD, the long-term primary Docker host
+- prove a small household-safe access model before expanding scope
+- keep the repo copy as the source of truth for stack config and policy
+
+## Pilot shape
+
+- Host: **PlausibleDeniability**
+- Live path: `/mnt/docker-ssd/docker/compose/headscale`
+- Services:
+  - `headscale`
+  - `headplane`
+- Data paths:
+  - `/mnt/docker-ssd/docker/appdata/headscale`
+  - `/mnt/docker-ssd/docker/appdata/headplane`
+- No OIDC on day one
+- No subnet-router or exit-node rollout on day one
+- Headscale can be published later as a dedicated public control-plane hostname without exposing Headplane the same way
+
+## URLs for the pilot
+
+- Headscale control plane for clients: `https://headscale.paccoco.com`
+- Headplane admin UI (restricted/LAN-only): `http://headplane.home.paccoco.com:3005/admin`
+
+This is the recommended **Option C** shape:
+- publish **Headscale** on a stable public HTTPS hostname so phones and laptops can enroll/use it off-LAN
+- keep **Headplane** off the public internet by default; treat it as an admin surface reached on LAN/private DNS (or a separately restricted admin path later)
+
+The internal Traefik example in `examples/traefik-routes.yml` is still useful for private-DNS/LAN convenience, but it is not the public control-plane path for off-LAN device enrollment.
+
+### Current live pilot note
+
+Before the public hostname is wired, the live PD pilot uses direct-IP URLs:
+- Headscale: `http://10.5.30.6:8084`
+- Headplane: `http://10.5.30.6:3005/admin`
+
+Once `https://headscale.paccoco.com` is created and verified through Pangolin, off-LAN clients should use that public Headscale URL. Headplane can stay on the restricted LAN/private-DNS path above.
+
+## Initial users
+
+- `fizzlepoof`
+- `manndra`
+
+Policy references them as:
+- `fizzlepoof@`
+- `manndra@`
+
+## Initial tags
+
+- `tag:infra`
+- `tag:apps`
+- `tag:admin`
+
+## Access model
+
+- `fizzlepoof@` = full pilot admin access to `tag:infra`, `tag:apps`, `tag:admin`, and his own devices
+- `manndra@` = app access only via `tag:apps` plus her own devices
+- no limited-user tier yet
+- no routed-LAN access yet
+
+## Files
+
+- `docker-compose.yaml`
+- `.env.example`
+- `config/headscale/config.yaml`
+- `config/headscale/policy.hujson`
+- `config/headplane/config.yaml`
+- `examples/traefik-routes.yml`
+
+## Pre-deploy edits
+
+Before first deploy, replace the placeholder values in:
+
+- `.env` copied from `.env.example`
+- `config/headplane/config.yaml`
+
+Required changes:
+- replace `CHANGE_ME_TO_EXACTLY_32_CHARS` with a real 32-character cookie secret
+- confirm the restricted Headplane LAN/private-DNS record exists if you want the nicer admin hostname
+- for off-LAN clients, create/verify the public Pangolin hostname for Headscale
+- if you want different ports or hostnames, update both the config files and `.env`
+
+Important live-ops note:
+- the repo-tracked `config/headplane/config.yaml` intentionally keeps a placeholder `cookie_secret`
+- before restarting the live Headplane container, render or restore the real 32-character secret from the live secret-bearing `.env`
+- blindly syncing the tracked placeholder over the live config will make Headplane fail startup with `server.cookie_secret must be exactly length 32`
+
+## Deploy on PD
+
+1. Sync this directory into the live compose tree:
+   - `/mnt/docker-ssd/docker/compose/headscale`
+2. Copy `.env.example` to `.env`
+3. Create persistent appdata paths:
+   - `/mnt/docker-ssd/docker/appdata/headscale`
+   - `/mnt/docker-ssd/docker/appdata/headscale/run`
+   - `/mnt/docker-ssd/docker/appdata/headplane`
+4. Validate:
+
+```bash
+cd /mnt/docker-ssd/docker/compose/headscale
+docker compose --env-file .env config
+```
+
+5. Bring up Headscale first:
+
+```bash
+docker compose --env-file .env up -d headscale
+docker logs headscale --tail=100
+```
+
+6. Create pilot users:
+
+```bash
+docker exec -it headscale headscale users create fizzlepoof
+docker exec -it headscale headscale users create manndra
+docker exec -it headscale headscale users list
+```
+
+7. Generate a Headscale API key for Headplane login:
+
+```bash
+docker exec -it headscale headscale apikeys create --expiration 90d
+```
+
+Save the returned key somewhere secure. Headplane uses it for the initial admin login.
+
+8. Enroll John's admin device.
+9. Bring up Headplane:
+
+```bash
+docker compose --env-file .env up -d headplane
+docker logs headplane --tail=100
+```
+
+10. Log in to Headplane with the API key from step 7.
+11. Register one tagged service node.
+12. Enroll one Manndra device.
+
+## Public Headscale via Pangolin
+
+For the off-LAN/mobile path, publish only Headscale itself.
+
+Desired public hostname:
+- `https://headscale.paccoco.com`
+
+Desired Pangolin target shape:
+- resource name: `headscale`
+- site: `Plausible Deniability` (siteId `4`)
+- target: `headscale:8080`
+- healthcheck path: `/health`
+- Pangolin auth/SSO: **disabled** for this route
+
+Why:
+- Headscale clients need a plain reachable control-plane endpoint; adding browser SSO in front of it is the wrong shape
+- Headplane is an admin UI and should stay restricted/admin-only instead of being published like a normal household app
+
+Use `automation/bin/pangolin_upsert_headscale.py` to create or reconcile the public Pangolin resource.
+
+## Policy reload
+
+After editing `config/headscale/policy.hujson`:
+
+```bash
+docker exec -it headscale kill -HUP 1
+```
+
+Then inspect the container logs for policy parse results.
+
+## Owner-facing Headplane pilot checklist
+
+This section is for John as the stack owner using the Web UI. Doris should handle the CLI and backend admin work; this checklist is about what John should look for in Headplane and when to escalate.
+
+### Where to go
+
+- Open: `http://headplane.home.paccoco.com:3005/admin`
+- Log in with the temporary Headscale API key Doris generated for the pilot
+
+### What you should expect to see first
+
+After initial pilot bring-up, Headplane should show:
+- two users:
+  - `fizzlepoof`
+  - `manndra`
+- John's enrolled device(s)
+- one tagged pilot service node
+- a generally healthy/online control plane with no obvious UI errors
+
+If any of those are missing, that is a Doris problem to fix, not a John problem to debug.
+
+### UI-first smoke test
+
+#### 1. Confirm the users exist
+Look for:
+- `fizzlepoof`
+- `manndra`
+
+Good:
+- both users appear once
+
+Bad / message Doris if:
+- a user is missing
+- a duplicate or unexpected user exists
+- user ownership looks wrong
+
+#### 2. Confirm John's device is present
+Look for at least one clearly identifiable John-owned device.
+
+Good:
+- device shows as online
+- device is owned by `fizzlepoof`
+- the name is recognizable enough to tell what it is
+
+Bad / message Doris if:
+- device is offline when it should be online
+- device is attached to the wrong user
+- device appears more than once unexpectedly
+
+#### 3. Confirm Manndra's device is present
+Good:
+- device is owned by `manndra`
+- it appears separately from John's devices
+
+Bad / message Doris if:
+- it shows under the wrong user
+- it never appears after enrollment
+- it appears to have broad access it should not have
+
+#### 4. Confirm the tagged node looks like a service node
+Look for one node tagged as a pilot service node, typically with `tag:apps` or `tag:infra`.
+
+Good:
+- the node is visibly tagged
+- it is not owned like a normal human personal device
+- it is online when the underlying service is online
+
+Bad / message Doris if:
+- the node is untagged
+- it appears owned like a personal device when it should be infra
+- it has the wrong tag
+
+#### 5. Confirm the UI is usable enough to keep
+Good:
+- pages load consistently
+- node/user details are understandable
+- no obvious blank/error screens
+- refreshing does not randomly lose state
+
+Bad / message Doris if:
+- login repeatedly fails with a known-good API key
+- pages partially load or spin forever
+- the UI looks disconnected from reality
+- the UI feels too broken to trust for visibility
+
+### Expected access behavior
+
+John does not need to test raw ACL syntax. The practical expectations are:
+
+- `fizzlepoof` should have broad pilot visibility/access
+- `manndra` should be limited to app-level access
+- Manndra should **not** have broad admin/infra access by default
+
+If Manndra can reach something that feels like core infra/admin, treat that as a problem and tell Doris.
+
+### What counts as pilot success from John's side
+
+The pilot is good enough to continue if:
+- Headplane reliably loads
+- the users/nodes make sense at a glance
+- John's devices are visible
+- Manndra's device is visible and separated correctly
+- the tagged service node is visible and clearly infra-like
+- nothing suggests accidental overexposure
+
+### When John should call Doris instead of poking at it
+
+Call Doris if:
+- login stops working
+- users disappear or duplicate
+- devices are attached to the wrong owner
+- a tagged node loses its tag or looks wrong
+- Manndra appears to have too much access
+- the UI starts showing stale, contradictory, or obviously broken state
+
+The point of the Web UI is visibility and confidence, not pushing John into VPN-control-plane babysitting.
+
+## What to validate before expanding
+
+- Headscale stays healthy
+- Headplane is usable enough to justify keeping it
+- John can reach `tag:infra`, `tag:admin`, and `tag:apps`
+- Manndra can reach `tag:apps` but not `tag:infra` or `tag:admin`
+- one tagged service node registers cleanly and behaves as expected
+- existing Tailscale remains intact as rollback during the pilot
+
+## Notes on Headplane integration
+
+This stack enables Headplane's Docker integration so it can identify the Headscale container via the label:
+
+- `me.tale.headplane.target=headscale`
+
+It also mounts the tracked Headscale config into Headplane so the UI can inspect and, if you later choose, manage more than just node registration.
+
+## Not done here on purpose
+
+- no OIDC wiring yet
+- no DERP customization yet
+- no public auth/proxy routing yet
+- no explicit subnet-router policy yet
+- no migration of the existing infrastructure stack's `tailscale` container yet
+
+Pilot first. Cutover later.

headscale/config/headplane/config.yaml

@@ -0,0 +1,28 @@
+server:
+  host: "0.0.0.0"
+  port: 3000
+  base_url: "http://headplane.home.paccoco.com:3005"
+  cookie_secret: "CHANGE_ME_TO_EXACTLY_32_CHARS"
+  cookie_secure: false
+  cookie_max_age: 86400
+  data_path: "/var/lib/headplane"
+
+headscale:
+  url: "http://headscale:8080"
+  public_url: "https://headscale.paccoco.com"
+  config_path: "/etc/headscale/config.yaml"
+  config_strict: true
+
+integration:
+  agent:
+    enabled: false
+    pre_authkey: ""
+  docker:
+    enabled: true
+    container_label: "me.tale.headplane.target=headscale"
+    socket: "unix:///var/run/docker.sock"
+  kubernetes:
+    enabled: false
+    pod_name: ""
+  proc:
+    enabled: false

headscale/config/headscale/config.yaml

@@ -0,0 +1,99 @@
+server_url: https://headscale.paccoco.com
+listen_addr: 0.0.0.0:8080
+metrics_listen_addr: 127.0.0.1:9090
+grpc_listen_addr: 0.0.0.0:50443
+grpc_allow_insecure: false
+trusted_proxies: []
+
+noise:
+  private_key_path: /var/lib/headscale/noise_private.key
+
+prefixes:
+  v4: 100.64.0.0/10
+  v6: fd7a:115c:a1e0::/48
+  allocation: sequential
+
+derp:
+  server:
+    enabled: false
+    region_id: 999
+    region_code: "headscale"
+    region_name: "Headscale Embedded DERP"
+    verify_clients: true
+    stun_listen_addr: "0.0.0.0:3478"
+    private_key_path: /var/lib/headscale/derp_server_private.key
+    automatically_add_embedded_derp_region: true
+    ipv4: 198.51.100.1
+    ipv6: 2001:db8::1
+  urls:
+    - https://controlplane.tailscale.com/derpmap/default
+  paths: []
+  auto_update_enabled: true
+  update_frequency: 3h
+
+disable_check_updates: false
+
+node:
+  expiry: 0
+  ephemeral:
+    inactivity_timeout: 30m
+  routes:
+    ha:
+      probe_interval: 10s
+      probe_timeout: 5s
+
+database:
+  type: sqlite
+  debug: false
+  gorm:
+    prepare_stmt: true
+    parameterized_queries: true
+    skip_err_record_not_found: true
+    slow_threshold: 1000
+  sqlite:
+    path: /var/lib/headscale/db.sqlite
+    write_ahead_log: true
+    wal_autocheckpoint: 1000
+
+acme_url: https://acme-v02.api.letsencrypt.org/directory
+acme_email: ""
+tls_letsencrypt_hostname: ""
+tls_letsencrypt_cache_dir: /var/lib/headscale/cache
+tls_letsencrypt_challenge_type: HTTP-01
+tls_letsencrypt_listen: ":http"
+
+tls_cert_path: ""
+tls_key_path: ""
+
+log:
+  level: info
+  format: text
+
+policy:
+  mode: file
+  path: /etc/headscale/policy.hujson
+
+dns:
+  magic_dns: true
+  base_domain: tail.home.paccoco.com
+  override_local_dns: true
+  nameservers:
+    global:
+      - 10.5.30.8
+      - 10.5.30.9
+      - 10.5.30.10
+  split: {}
+  search_domains: []
+  extra_records: []
+
+unix_socket: /var/run/headscale/headscale.sock
+unix_socket_permission: "0770"
+
+logtail:
+  enabled: false
+
+taildrop:
+  enabled: true
+
+auto_update:
+  enabled: false

headscale/config/headscale/policy.hujson

@@ -0,0 +1,49 @@
+{
+  // Small deny-by-default-ish pilot policy for the household tailnet.
+  // Expand only after John + Manndra + one tagged service node validate cleanly.
+
+  "groups": {
+    "group:admins": ["fizzlepoof@"],
+    "group:vip": ["manndra@"]
+  },
+
+  "tagOwners": {
+    "tag:infra": ["group:admins"],
+    "tag:apps": ["group:admins"],
+    "tag:admin": ["group:admins"]
+  },
+
+  "acls": [
+    {
+      "action": "accept",
+      "src": ["group:admins"],
+      "dst": [
+        "tag:infra:*",
+        "tag:apps:*",
+        "tag:admin:*"
+      ]
+    },
+    {
+      "action": "accept",
+      "src": ["group:vip"],
+      "dst": [
+        "tag:apps:*"
+      ]
+    }
+  ],
+
+  "ssh": [
+    {
+      "action": "accept",
+      "src": ["group:admins"],
+      "dst": ["tag:infra"],
+      "users": ["autogroup:nonroot"]
+    },
+    {
+      "action": "accept",
+      "src": ["group:admins"],
+      "dst": ["tag:admin"],
+      "users": ["autogroup:nonroot"]
+    }
+  ]
+}

headscale/docker-compose.yaml

@@ -0,0 +1,55 @@
+name: headscale
+
+networks:
+  headscale-net:
+    driver: bridge
+  pangolin:
+    external: true
+
+services:
+  headscale:
+    image: headscale/headscale:0.26.0
+    container_name: headscale
+    restart: unless-stopped
+    command: serve
+    labels:
+      me.tale.headplane.target: headscale
+    networks:
+      - headscale-net
+      - pangolin
+    ports:
+      - "8084:8080"
+    volumes:
+      - /mnt/docker-ssd/docker/compose/headscale/config/headscale/config.yaml:/etc/headscale/config.yaml
+      - /mnt/docker-ssd/docker/compose/headscale/config/headscale/policy.hujson:/etc/headscale/policy.hujson
+      - /mnt/docker-ssd/docker/appdata/headscale:/var/lib/headscale
+      - /mnt/docker-ssd/docker/appdata/headscale/run:/var/run/headscale
+    healthcheck:
+      test: ["CMD", "headscale", "version"]
+      interval: 30s
+      timeout: 10s
+      retries: 5
+      start_period: 30s
+
+  headplane:
+    image: ghcr.io/tale/headplane:latest
+    container_name: headplane
+    restart: unless-stopped
+    depends_on:
+      - headscale
+    networks:
+      - headscale-net
+      - pangolin
+    ports:
+      - "3005:3000"
+    volumes:
+      - /mnt/docker-ssd/docker/compose/headscale/config/headplane/config.yaml:/etc/headplane/config.yaml
+      - /mnt/docker-ssd/docker/compose/headscale/config/headscale/config.yaml:/etc/headscale/config.yaml
+      - /mnt/docker-ssd/docker/appdata/headplane:/var/lib/headplane
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+    healthcheck:
+      test: ["CMD", "/bin/hp_healthcheck"]
+      interval: 30s
+      timeout: 5s
+      retries: 3
+      start_period: 10s

headscale/examples/traefik-routes.yml

@@ -0,0 +1,26 @@
+http:
+  routers:
+    headscale:
+      rule: "Host(`headscale.home.paccoco.com`)"
+      entryPoints: [web]
+      service: headscale
+      middlewares:
+        - security-headers
+
+    headplane:
+      rule: "Host(`headplane.home.paccoco.com`)"
+      entryPoints: [web]
+      service: headplane
+      middlewares:
+        - security-headers
+
+  services:
+    headscale:
+      loadBalancer:
+        servers:
+          - url: "http://headscale:8080"
+
+    headplane:
+      loadBalancer:
+        servers:
+          - url: "http://headplane:3000"

home/doris-barbell/README.md

@@ -53,6 +53,8 @@ The current scaffold already supports:
 - exercise template creation/listing
 - routine creation/listing on top of John's imported base split
 - structured workout logging with nested exercises and sets
+- dedicated routine log sheets with dropdown exercise selection plus set-by-set reps and weight entry
+- live workout pages that let John start a session and save one exercise at a time mid-workout
 - history endpoints for weight, measurements, and workouts
 - exercise progression summaries with max weight and estimated 1RM per exercise
 - mobile-friendly homepage with HTML forms for:

home/doris-barbell/app/models.py

@@ -61,7 +61,7 @@ class RoutineCreate(BaseModel):
 
 class WorkoutSetCreate(BaseModel):
     reps: int = Field(ge=1)
-    weight_lbs: float = Field(ge=0)
+    weight_lbs: float | None = Field(default=None, ge=0)
     rpe: float | None = Field(default=None, ge=0)
     rest_seconds: int | None = Field(default=None, ge=0)
     notes: str | None = None

home/doris-barbell/app/routes/ui.py

@@ -1,5 +1,7 @@
 from __future__ import annotations
 
+from datetime import datetime
+
 from fastapi import APIRouter, Form, HTTPException, Request, status
 from fastapi.responses import RedirectResponse
 from fastapi.templating import Jinja2Templates
@@ -121,9 +123,136 @@ def quick_log_workout(
     return RedirectResponse(url='/', status_code=status.HTTP_303_SEE_OTHER)
 
 
+@router.get('/routines/{routine_id}/log')
+def routine_log_sheet(request: Request, routine_id: str):
+    routine = _get_routine_or_404(request, routine_id)
+    return templates.TemplateResponse(
+        request=request,
+        name='routine_log.html',
+        context={
+            'title': f"Log {routine['name']}",
+            'routine': routine,
+            'routine_sheet': _build_routine_log_sheet(request, routine),
+            'exercise_options': _exercise_options_for_routine(request, routine),
+            'routine_action_label': _routine_action_label(routine['name']),
+            'default_performed_at': _default_performed_at_value(),
+        },
+    )
+
+
+@router.get('/routines/{routine_id}/live')
+def live_workout_logger(request: Request, routine_id: str):
+    routine = _get_routine_or_404(request, routine_id)
+    return templates.TemplateResponse(
+        request=request,
+        name='live_workout.html',
+        context=_live_workout_context(request, routine),
+    )
+
+
+@router.post('/routines/{routine_id}/live/start', status_code=303)
+def start_live_workout_session(
+    request: Request,
+    routine_id: str,
+    user_id: str = Form(...),
+    performed_at: str = Form(...),
+):
+    routine = _get_routine_or_404(request, routine_id)
+    if routine['user_id'] != user_id:
+        raise HTTPException(status_code=400, detail='Routine does not belong to that user.')
+    request.app.state.store.start_active_workout_session(
+        {
+            'routine_id': routine['id'],
+            'routine_name': routine['name'],
+            'user_id': user_id,
+            'performed_at': performed_at,
+        }
+    )
+    return RedirectResponse(url=f"/routines/{routine_id}/live", status_code=status.HTTP_303_SEE_OTHER)
+
+
+@router.post('/routines/{routine_id}/live/add-exercise', status_code=303)
+async def add_live_workout_exercise(
+    request: Request,
+    routine_id: str,
+    user_id: str = Form(...),
+    performed_at: str = Form(...),
+    exercise_name: str = Form(...),
+    set_count: int = Form(...),
+):
+    routine = _get_routine_or_404(request, routine_id)
+    if routine['user_id'] != user_id:
+        raise HTTPException(status_code=400, detail='Routine does not belong to that user.')
+    active_session = request.app.state.store.get_active_workout_session(routine_id, user_id)
+    if active_session is None:
+        request.app.state.store.start_active_workout_session(
+            {
+                'routine_id': routine['id'],
+                'routine_name': routine['name'],
+                'user_id': user_id,
+                'performed_at': performed_at,
+            }
+        )
+    exercise = await _parse_live_workout_exercise_form(request, routine, exercise_name, set_count)
+    request.app.state.store.add_active_workout_exercise(routine_id, user_id, exercise)
+    return RedirectResponse(url=f"/routines/{routine_id}/live", status_code=status.HTTP_303_SEE_OTHER)
+
+
+@router.post('/routines/{routine_id}/live/finish', status_code=303)
+def finish_live_workout_session(
+    request: Request,
+    routine_id: str,
+    user_id: str = Form(...),
+    performed_at: str = Form(...),
+    notes: str = Form(''),
+):
+    routine = _get_routine_or_404(request, routine_id)
+    if routine['user_id'] != user_id:
+        raise HTTPException(status_code=400, detail='Routine does not belong to that user.')
+    active_session = request.app.state.store.get_active_workout_session(routine_id, user_id)
+    if active_session is None:
+        raise HTTPException(status_code=400, detail='No live workout session in progress.')
+    if active_session['performed_at'] != performed_at:
+        raise HTTPException(status_code=400, detail='Performed-at timestamp does not match the active session.')
+    if not active_session.get('exercises'):
+        raise HTTPException(status_code=400, detail='Log at least one exercise before finishing the session.')
+    request.app.state.store.finish_active_workout_session(routine_id, user_id, notes.strip() or None)
+    return RedirectResponse(url='/', status_code=status.HTTP_303_SEE_OTHER)
+
+
+@router.post('/workouts/routine-log', status_code=303)
+async def log_seeded_routine_workout(
+    request: Request,
+    user_id: str = Form(...),
+    routine_id: str = Form(...),
+    performed_at: str = Form(...),
+    routine_name: str = Form(...),
+    exercise_count: int = Form(...),
+    notes: str = Form(''),
+):
+    routine = _get_routine_or_404(request, routine_id)
+    if routine['user_id'] != user_id:
+        raise HTTPException(status_code=400, detail='Routine does not belong to that user.')
+
+    payload = {
+        'user_id': user_id,
+        'performed_at': performed_at,
+        'routine_name': routine_name.strip(),
+        'notes': notes.strip() or None,
+        'exercises': await _parse_structured_routine_form(request, routine, exercise_count),
+    }
+    request.app.state.store.add_workout(payload)
+    return RedirectResponse(url='/', status_code=status.HTTP_303_SEE_OTHER)
+
+
 def _dashboard_context(request: Request) -> dict:
     store = request.app.state.store
     summary = store.dashboard_summary()
+    routines_with_live_state = []
+    for routine in summary['routines']:
+        active_session = store.get_active_workout_session(routine['id'], routine['user_id'])
+        routines_with_live_state.append({**routine, 'live_session': active_session})
+    summary['routines'] = routines_with_live_state
     return {
         'title': 'Doris Barbell',
         'summary': summary,
@@ -134,6 +263,49 @@ def _dashboard_context(request: Request) -> dict:
     }
 
 
+def _live_workout_context(request: Request, routine: dict) -> dict:
+    active_session = request.app.state.store.get_active_workout_session(routine['id'], routine['user_id'])
+    routine_sheet = _build_routine_log_sheet(request, routine)
+    remaining_exercises = _remaining_live_exercises(routine_sheet, active_session)
+    logged_exercises = []
+    if active_session is not None:
+        for exercise in active_session.get('exercises', []):
+            logged_exercises.append(
+                {
+                    'exercise_name': exercise['exercise_name'],
+                    'set_count': len(exercise.get('sets', [])),
+                    'notes': exercise.get('notes'),
+                }
+            )
+    return {
+        'title': f"Live log · {routine['name']}",
+        'routine': routine,
+        'routine_sheet': routine_sheet,
+        'active_session': active_session,
+        'logged_exercises': logged_exercises,
+        'remaining_exercises': remaining_exercises,
+        'default_performed_at': active_session['performed_at'] if active_session else _default_performed_at_value(),
+        'routine_action_label': _routine_action_label(routine['name']),
+    }
+
+
+def _remaining_live_exercises(routine_sheet: list[dict], active_session: dict | None) -> list[dict]:
+    completed_counts: dict[str, int] = {}
+    if active_session is not None:
+        for exercise in active_session.get('exercises', []):
+            normalized_name = exercise['exercise_name'].strip().lower()
+            completed_counts[normalized_name] = completed_counts.get(normalized_name, 0) + 1
+    remaining = []
+    for exercise in routine_sheet:
+        normalized_name = exercise['exercise_name'].strip().lower()
+        completed_count = completed_counts.get(normalized_name, 0)
+        if completed_count > 0:
+            completed_counts[normalized_name] = completed_count - 1
+            continue
+        remaining.append(exercise)
+    return remaining
+
+
 def _optional_float(value: str) -> float | None:
     cleaned = value.strip()
     if not cleaned:
@@ -208,3 +380,203 @@ def _parse_workout_exercises(raw_lines: str) -> list[dict]:
     if not exercises:
         raise HTTPException(status_code=400, detail='At least one workout exercise is required.')
     return exercises
+
+
+def _get_routine_or_404(request: Request, routine_id: str) -> dict:
+    routine = request.app.state.store.get_routine(routine_id)
+    if routine is None:
+        raise HTTPException(status_code=404, detail='Unknown routine')
+    return routine
+
+
+def _build_routine_log_sheet(request: Request, routine: dict) -> list[dict]:
+    equipment_by_name = _exercise_equipment_lookup(request)
+    sheet = []
+    for exercise_index, exercise in enumerate(routine.get('exercises', [])):
+        exercise_name = exercise['exercise_name']
+        target_sets = max(int(exercise.get('target_sets', 1) or 1), 1)
+        default_reps = _default_reps_value(exercise.get('target_reps'))
+        is_band = equipment_by_name.get(exercise_name.strip().lower()) == 'band'
+        sheet.append(
+            {
+                'exercise_index': exercise_index,
+                'exercise_name': exercise_name,
+                'target_sets': target_sets,
+                'target_reps': exercise.get('target_reps'),
+                'default_reps': default_reps,
+                'notes': exercise.get('notes'),
+                'is_band': is_band,
+                'sets': [
+                    {
+                        'exercise_index': exercise_index,
+                        'index': set_index,
+                        'default_reps': default_reps,
+                        'is_band': is_band,
+                    }
+                    for set_index in range(target_sets)
+                ],
+            }
+        )
+    return sheet
+
+
+def _exercise_options_for_routine(request: Request, routine: dict) -> list[str]:
+    routine_names = [exercise['exercise_name'] for exercise in routine.get('exercises', []) if exercise.get('exercise_name')]
+    template_names = [
+        template['name']
+        for template in request.app.state.store.list_exercise_templates()
+        if template.get('name')
+    ]
+    ordered = []
+    seen = set()
+    for name in [*routine_names, *template_names]:
+        normalized = name.strip().lower()
+        if normalized in seen:
+            continue
+        ordered.append(name)
+        seen.add(normalized)
+    return ordered
+
+
+def _exercise_equipment_lookup(request: Request) -> dict[str, str]:
+    lookup: dict[str, str] = {}
+    for template in request.app.state.store.list_exercise_templates():
+        name = str(template.get('name', '')).strip().lower()
+        equipment = str(template.get('equipment', '')).strip().lower()
+        if not name or not equipment:
+            continue
+        lookup[name] = equipment
+    return lookup
+
+
+def _default_reps_value(target_reps: str | None) -> str:
+    if target_reps is None:
+        return ''
+    cleaned = str(target_reps).strip()
+    return cleaned if cleaned.isdigit() else ''
+
+
+def _default_performed_at_value() -> str:
+    return datetime.now().astimezone().strftime('%Y-%m-%dT%H:%M')
+
+
+def _routine_action_label(routine_name: str) -> str:
+    if ': ' in routine_name:
+        label = routine_name.split(': ', 1)[1].strip().lower()
+    else:
+        label = routine_name.strip().lower()
+    day_aliases = {
+        'shoulders': 'shoulder day',
+        'arms': 'arm day',
+        'legs': 'leg day',
+    }
+    return day_aliases.get(label, label)
+
+
+async def _parse_live_workout_exercise_form(
+    request: Request,
+    routine: dict,
+    exercise_name: str,
+    set_count: int,
+) -> dict:
+    form = await request.form()
+    sheet = _build_routine_log_sheet(request, routine)
+    matching_exercise = next(
+        (exercise for exercise in sheet if exercise['exercise_name'].strip().lower() == exercise_name.strip().lower()),
+        None,
+    )
+    if matching_exercise is None:
+        raise HTTPException(status_code=400, detail=f'Unknown routine exercise: {exercise_name}')
+    default_reps_raw = matching_exercise.get('default_reps', '')
+    is_band_exercise = bool(matching_exercise.get('is_band'))
+    sets = []
+    for set_index in range(set_count):
+        reps_raw = str(form.get(f'set_{set_index}_reps', '')).strip()
+        weight_raw = str(form.get(f'set_{set_index}_weight_lbs', '')).strip()
+        if not reps_raw and not weight_raw:
+            if is_band_exercise and default_reps_raw.isdigit():
+                reps_raw = default_reps_raw
+            else:
+                continue
+        if not reps_raw and default_reps_raw.isdigit():
+            reps_raw = default_reps_raw
+        if not reps_raw:
+            raise HTTPException(
+                status_code=400,
+                detail=f'Exercise {exercise_name} set {set_index + 1} needs reps.',
+            )
+        if not weight_raw and not is_band_exercise:
+            raise HTTPException(
+                status_code=400,
+                detail=f'Exercise {exercise_name} set {set_index + 1} needs both reps and weight.',
+            )
+        try:
+            reps = int(reps_raw)
+            weight_lbs = None if not weight_raw else float(weight_raw)
+        except ValueError as exc:
+            raise HTTPException(
+                status_code=400,
+                detail=f'Exercise {exercise_name} set {set_index + 1} has invalid reps or weight.',
+            ) from exc
+        sets.append({'reps': reps, 'weight_lbs': weight_lbs})
+    if not sets:
+        raise HTTPException(status_code=400, detail=f'Log at least one set for {exercise_name}.')
+    exercise_notes = str(form.get('exercise_notes', '')).strip() or None
+    return {'exercise_name': matching_exercise['exercise_name'], 'notes': exercise_notes, 'sets': sets}
+
+
+async def _parse_structured_routine_form(request: Request, routine: dict, exercise_count: int) -> list[dict]:
+    form = await request.form()
+    routine_exercises = routine.get('exercises', [])
+    equipment_by_name = _exercise_equipment_lookup(request)
+    exercises = []
+    for exercise_index in range(exercise_count):
+        exercise_name = str(form.get(f'exercise_{exercise_index}_name', '')).strip()
+        if not exercise_name:
+            continue
+        is_band_exercise = equipment_by_name.get(exercise_name.lower()) == 'band'
+        try:
+            set_count = int(str(form.get(f'exercise_{exercise_index}_set_count', '0')).strip())
+        except ValueError as exc:
+            raise HTTPException(status_code=400, detail='Invalid set count in routine log form.') from exc
+        target_reps = None
+        if exercise_index < len(routine_exercises):
+            target_reps = routine_exercises[exercise_index].get('target_reps')
+        default_reps_raw = _default_reps_value(target_reps)
+        sets = []
+        for set_index in range(set_count):
+            reps_raw = str(form.get(f'exercise_{exercise_index}_set_{set_index}_reps', '')).strip()
+            weight_raw = str(form.get(f'exercise_{exercise_index}_set_{set_index}_weight_lbs', '')).strip()
+            if not reps_raw and not weight_raw:
+                if is_band_exercise and default_reps_raw.isdigit():
+                    reps_raw = default_reps_raw
+                else:
+                    continue
+            if not reps_raw and default_reps_raw.isdigit():
+                reps_raw = default_reps_raw
+            if not reps_raw:
+                raise HTTPException(
+                    status_code=400,
+                    detail=f'Exercise {exercise_name} set {set_index + 1} needs reps.',
+                )
+            if not weight_raw and not is_band_exercise:
+                raise HTTPException(
+                    status_code=400,
+                    detail=f'Exercise {exercise_name} set {set_index + 1} needs both reps and weight.',
+                )
+            try:
+                reps = int(reps_raw)
+                weight_lbs = None if not weight_raw else float(weight_raw)
+            except ValueError as exc:
+                raise HTTPException(
+                    status_code=400,
+                    detail=f'Exercise {exercise_name} set {set_index + 1} has invalid reps or weight.',
+                ) from exc
+            sets.append({'reps': reps, 'weight_lbs': weight_lbs})
+        if not sets:
+            continue
+        exercise_notes = str(form.get(f'exercise_{exercise_index}_notes', '')).strip() or None
+        exercises.append({'exercise_name': exercise_name, 'notes': exercise_notes, 'sets': sets})
+    if not exercises:
+        raise HTTPException(status_code=400, detail='Log at least one completed exercise set.')
+    return exercises

home/doris-barbell/app/services/store.py

@@ -52,7 +52,7 @@ SEEDED_EXERCISE_TEMPLATES = [
     {'name': 'Upright Row', 'primary_muscle': 'shoulders', 'equipment': 'barbell'},
     {'name': 'Shoulder Shrugs', 'primary_muscle': 'traps', 'equipment': 'dumbbells'},
     {'name': '7-7-7 Shoulder Press', 'primary_muscle': 'shoulders', 'equipment': 'machine'},
-    {'name': 'Resistance Band Punch-Out Holds', 'primary_muscle': 'abs', 'equipment': 'band'},
+    {'name': 'Resistance Band Punch-Out Training', 'primary_muscle': 'shoulders', 'equipment': 'band'},
     {'name': 'Squats', 'primary_muscle': 'legs', 'equipment': 'barbell'},
     {'name': 'Leg Extensions', 'primary_muscle': 'quads', 'equipment': 'machine'},
     {'name': 'Step Ups', 'primary_muscle': 'legs', 'equipment': 'bodyweight'},
@@ -96,14 +96,14 @@ SEEDED_ROUTINES = [
             {'exercise_name': 'Overhead Tricep Extensions', 'target_sets': 3, 'target_reps': '10'},
             {'exercise_name': 'Incline Barbell Curls', 'target_sets': 3, 'target_reps': '10'},
             {'exercise_name': 'Isolation Bicep Curls', 'target_sets': 3, 'target_reps': '10'},
-            {'exercise_name': '7-7-7 Barbell Curl', 'target_sets': 3, 'target_reps': '10'},
+            {'exercise_name': '7-7-7 Barbell Curl', 'target_sets': 1, 'target_reps': '7-7-7'},
             {'exercise_name': 'Suitcase Carry', 'target_sets': 3, 'target_reps': '10'},
         ],
     },
     {
         'user_id': 'john',
         'name': 'Thursday: Shoulders',
-        'notes': "Imported from John's current routine. Default prescription is 3 sets of 10 reps. Weights are still TBD. Includes resistance band punch-out ab holds.",
+        'notes': "Imported from John's current routine. Default prescription is 3 sets of 10 reps. Weights are still TBD. Includes resistance band punch-out training.",
         'exercises': [
             {'exercise_name': 'Shoulder Press', 'target_sets': 3, 'target_reps': '10'},
             {'exercise_name': 'Arnold Press', 'target_sets': 3, 'target_reps': '10'},
@@ -111,8 +111,8 @@ SEEDED_ROUTINES = [
             {'exercise_name': 'Front Lateral Raise', 'target_sets': 3, 'target_reps': '10'},
             {'exercise_name': 'Upright Row', 'target_sets': 3, 'target_reps': '10'},
             {'exercise_name': 'Shoulder Shrugs', 'target_sets': 3, 'target_reps': '10'},
-            {'exercise_name': '7-7-7 Shoulder Press', 'target_sets': 3, 'target_reps': '10'},
+            {'exercise_name': '7-7-7 Shoulder Press', 'target_sets': 1, 'target_reps': '7-7-7'},
-            {'exercise_name': 'Resistance Band Punch-Out Holds', 'target_sets': 3, 'target_reps': '10'},
+            {'exercise_name': 'Resistance Band Punch-Out Training', 'target_sets': 3, 'target_reps': '10'},
         ],
     },
     {
@@ -155,6 +155,11 @@ DEFAULT_STATE = {
     'weight_entries': [],
     'measurement_entries': [],
     'workout_sessions': [],
+    'active_workout_sessions': [],
+}
+
+LEGACY_TEMPLATE_ALIASES = {
+    'resistance band punch-out holds': 'Resistance Band Punch-Out Training',
 }
 
 
@@ -172,7 +177,11 @@ class JSONStore:
             self._write(seeded_state)
 
     def _read(self) -> dict[str, Any]:
-        return json.loads(self.state_path.read_text())
+        payload = json.loads(self.state_path.read_text())
+        seeded_payload = _ensure_seeded_library(payload)
+        if seeded_payload != payload:
+            self._write(seeded_payload)
+        return seeded_payload
 
     def _write(self, payload: dict[str, Any]) -> None:
         self.state_path.write_text(json.dumps(payload, indent=2, sort_keys=True))
@@ -267,6 +276,91 @@ class JSONStore:
         state = self._read()
         return sorted(state['routines'], key=lambda item: item['name'].lower())
 
+    def get_routine(self, routine_id: str) -> dict[str, Any] | None:
+        state = self._read()
+        for routine in state['routines']:
+            if routine.get('id') == routine_id:
+                return routine
+        return None
+
+    def get_active_workout_session(self, routine_id: str, user_id: str) -> dict[str, Any] | None:
+        state = self._read()
+        self._user_or_raise(state, user_id)
+        for session in state['active_workout_sessions']:
+            if session['routine_id'] == routine_id and session['user_id'] == user_id:
+                return session
+        return None
+
+    def start_active_workout_session(self, payload: dict[str, Any]) -> dict[str, Any]:
+        state = self._read()
+        self._user_or_raise(state, payload['user_id'])
+        state['active_workout_sessions'] = [
+            session
+            for session in state['active_workout_sessions']
+            if not (
+                session['routine_id'] == payload['routine_id'] and session['user_id'] == payload['user_id']
+            )
+        ]
+        saved = {
+            'id': uuid4().hex,
+            'routine_id': payload['routine_id'],
+            'routine_name': payload['routine_name'],
+            'user_id': payload['user_id'],
+            'performed_at': payload['performed_at'],
+            'notes': payload.get('notes'),
+            'exercises': [],
+        }
+        state['active_workout_sessions'].append(saved)
+        self._write(state)
+        return saved
+
+    def add_active_workout_exercise(self, routine_id: str, user_id: str, exercise: dict[str, Any]) -> dict[str, Any]:
+        state = self._read()
+        self._user_or_raise(state, user_id)
+        for session in state['active_workout_sessions']:
+            if session['routine_id'] == routine_id and session['user_id'] == user_id:
+                session['exercises'].append(
+                    {
+                        'exercise_name': exercise['exercise_name'],
+                        'notes': exercise.get('notes'),
+                        'sets': [dict(item) for item in exercise['sets']],
+                    }
+                )
+                self._write(state)
+                return session
+        raise KeyError((routine_id, user_id))
+
+    def finish_active_workout_session(self, routine_id: str, user_id: str, notes: str | None = None) -> dict[str, Any]:
+        state = self._read()
+        self._user_or_raise(state, user_id)
+        for session in state['active_workout_sessions']:
+            if session['routine_id'] != routine_id or session['user_id'] != user_id:
+                continue
+            workout_payload = {
+                'user_id': user_id,
+                'performed_at': session['performed_at'],
+                'routine_name': session['routine_name'],
+                'notes': notes,
+                'exercises': [
+                    {
+                        'exercise_name': exercise['exercise_name'],
+                        'notes': exercise.get('notes'),
+                        'sets': [dict(item) for item in exercise['sets']],
+                    }
+                    for exercise in session['exercises']
+                ],
+            }
+            saved_workout = self.add_workout(workout_payload)
+            refreshed_state = self._read()
+            refreshed_state['active_workout_sessions'] = [
+                active_session
+                for active_session in refreshed_state['active_workout_sessions']
+                if active_session.get('id') != session['id']
+            ]
+            self._write(refreshed_state)
+            return saved_workout
+        raise KeyError((routine_id, user_id))
+
     def add_workout(self, payload: dict[str, Any]) -> dict[str, Any]:
         state = self._read()
         self._user_or_raise(state, payload['user_id'])
@@ -278,7 +372,9 @@ class JSONStore:
             normalized_sets = []
             for item in exercise['sets']:
                 set_count += 1
-                total_volume_lbs += item['reps'] * item['weight_lbs']
+                weight_lbs = item.get('weight_lbs')
+                if weight_lbs is not None:
+                    total_volume_lbs += item['reps'] * weight_lbs
                 normalized_sets.append(dict(item))
             exercises.append({
                 'exercise_name': exercise['exercise_name'],
@@ -329,10 +425,13 @@ class JSONStore:
                     stats['last_performed_at'] = workout['performed_at']
                 for item in exercise['sets']:
                     stats['set_count'] += 1
-                    stats['max_weight_lbs'] = max(stats['max_weight_lbs'], item['weight_lbs'])
+                    weight_lbs = item.get('weight_lbs')
+                    if weight_lbs is None:
+                        continue
+                    stats['max_weight_lbs'] = max(stats['max_weight_lbs'], weight_lbs)
                     stats['best_set_estimated_1rm'] = max(
                         stats['best_set_estimated_1rm'],
-                        _estimated_1rm(item['weight_lbs'], item['reps']),
+                        _estimated_1rm(weight_lbs, item['reps']),
                     )
         results = []
         for item in progression.values():
@@ -414,6 +513,18 @@ def _ensure_seeded_library(state: dict[str, Any]) -> dict[str, Any]:
     payload.setdefault('weight_entries', [])
     payload.setdefault('measurement_entries', [])
     payload.setdefault('workout_sessions', [])
+    payload.setdefault('active_workout_sessions', [])
+
+    for template in payload['exercise_templates']:
+        legacy_name = template.get('name', '').strip().lower()
+        replacement_name = LEGACY_TEMPLATE_ALIASES.get(legacy_name)
+        if replacement_name is None:
+            continue
+        seeded_template = next(item for item in SEEDED_EXERCISE_TEMPLATES if item['name'] == replacement_name)
+        template['name'] = seeded_template['name']
+        template['primary_muscle'] = seeded_template.get('primary_muscle')
+        template['equipment'] = seeded_template.get('equipment')
+        template['notes'] = seeded_template.get('notes')
 
     existing_template_names = {
         item.get('name', '').strip().lower()

home/doris-barbell/app/static/app.css

@@ -413,6 +413,79 @@ button:focus, input:focus, select:focus, textarea:focus { outline: 2px solid rgb
   padding: 14px;
 }
 
+.compact-casefile-header {
+  padding-bottom: 0.35rem;
+}
+
+.compact-title-row {
+  display: grid;
+  grid-template-columns: minmax(0, 1fr) minmax(220px, 300px);
+  gap: 16px;
+}
+
+.compact-hot-fuzz-art {
+  min-width: 0;
+}
+
+.compact-hero-mark {
+  max-width: 300px;
+  margin-left: auto;
+}
+
+.compact-page-shell {
+  padding-bottom: 1.5rem;
+}
+
+.compact-panel {
+  padding: 1rem;
+}
+
+.compact-stat-grid {
+  display: grid;
+  grid-template-columns: repeat(2, minmax(0, 1fr));
+  gap: 0.85rem;
+  margin-bottom: 0.9rem;
+}
+
+.stat-slab {
+  display: grid;
+  gap: 0.3rem;
+}
+
+.stat-label,
+.section-label {
+  color: var(--hf-amber);
+  text-transform: uppercase;
+  letter-spacing: 0.12em;
+  font-size: 0.72rem;
+}
+
+.metric-value-sm {
+  font-size: 1.5rem;
+}
+
+.compact-summary-list {
+  display: grid;
+  grid-template-columns: repeat(auto-fit, minmax(130px, 1fr));
+  gap: 0.65rem;
+}
+
+.compact-summary-list li {
+  margin: 0;
+  padding: 0.7rem 0.8rem;
+  border: 1px solid rgba(255, 255, 255, 0.08);
+  border-radius: 14px;
+  background: rgba(255, 255, 255, 0.03);
+}
+
+.compact-summary-list li + li {
+  margin-top: 0;
+}
+
+.compact-history-block h3 {
+  margin-bottom: 0.65rem;
+}
+
 @media (max-width: 700px) {
   .page-header,
   .page-shell {
@@ -431,6 +504,18 @@ button:focus, input:focus, select:focus, textarea:focus { outline: 2px solid rgb
     flex-basis: 100%;
     min-width: 0;
   }
+
+  .compact-title-row {
+    grid-template-columns: 1fr;
+  }
+
+  .compact-hero-mark {
+    margin-left: 0;
+  }
+
+  .compact-stat-grid {
+    grid-template-columns: 1fr;
+  }
 }
 
 .doris-family-shell .case-nav {

home/doris-barbell/app/templates/base.html

@@ -4,11 +4,11 @@
     <meta charset="utf-8">
     <meta name="viewport" content="width=device-width, initial-scale=1">
     <title>{{ title or 'Doris Barbell' }}</title>
-    <link rel="stylesheet" href="/static/app.css?v=6">
+    <link rel="stylesheet" href="/static/app.css?v=7">
   </head>
   <body class="doris-hot-fuzz doris-family-shell app-barbell">
     <div class="incident-tape" aria-hidden="true"></div>
-    <header class="page-header casefile-header app-casefile app-casefile-barbell">
+    <header class="page-header casefile-header app-casefile app-casefile-barbell compact-casefile-header">
       <div class="film-grain" aria-hidden="true"></div>
       <div class="cinematic-glow" aria-hidden="true"></div>
       <div class="brand-row">
@@ -17,28 +17,26 @@
           <strong>Doris Constabulary</strong>
         </div>
         <nav class="nav-links doris-family-nav" aria-label="Doris family navigation">
-          <a class="nav-link {{ 'active' if request.url.path == '/' else '' }}" href="http://10.5.30.6:8093/">Barbell</a>
+          <a class="nav-link {{ 'active' if request.url.path == '/' else '' }}" href="https://gym.paccoco.com/">Barbell</a>
           <a class="nav-link" href="http://10.5.30.7:8787/">Dashboard</a>
           <a class="nav-link" href="http://10.5.30.7:8787/services.html">Services</a>
           <a class="nav-link" href="http://10.5.30.7:8092/">Kitchen</a>
           <a class="nav-link" href="https://schoolhouse.paccoco.com/">Schoolhouse</a>
         </nav>
       </div>
-      <div class="casefile-title-row">
+      <div class="casefile-title-row compact-title-row">
-        <div>
+        <div class="hero-copy">
           <p class="eyebrow">Station training desk</p>
           <div class="casefile-stamp barbell-evidence-tag">Training Dossier</div>
           <h1>Doris Barbell</h1>
-          <p class="lede">Reps, weight, BMI, and body metrics now look like a proper performance dossier instead of generic gym CRUD.</p>
+          <p class="lede">Log lifts, body weight, and routines.</p>
           <div class="brand-badges" aria-label="Theme badges">
             <span class="pill badge-hotfuzz">For the Greater Good</span>
-            <span class="pill">Evidence locker: reps</span>
-            <span class="pill">Case type: Training Dossier</span>
           </div>
         </div>
         <div class="art-stack">
-          <div class="hot-fuzz-art" aria-hidden="true">
+          <div class="hot-fuzz-art compact-hot-fuzz-art" aria-hidden="true">
-            <svg viewBox="0 0 320 220" class="poster-illustration" role="presentation">
+            <svg viewBox="0 0 320 140" class="poster-illustration compact-hero-mark" role="presentation">
               <defs>
                 <linearGradient id="barbell-sunset" x1="0%" y1="0%" x2="100%" y2="100%">
                   <stop offset="0%" stop-color="#f2c14e"></stop>
@@ -46,58 +44,27 @@
                   <stop offset="100%" stop-color="#910f3f"></stop>
                 </linearGradient>
               </defs>
-              <rect x="8" y="8" width="304" height="204" rx="24" class="poster-frame"></rect>
+              <rect x="8" y="8" width="304" height="124" rx="24" class="poster-frame"></rect>
-              <circle cx="228" cy="72" r="58" class="poster-halo"></circle>
+              <circle cx="250" cy="45" r="34" class="poster-halo"></circle>
-              <path d="M18 170 L112 100 L134 124 L40 198 Z" class="poster-tape tape-left"></path>
+              <path d="M34 104 L86 58 L102 74 L50 118 Z" class="poster-tape tape-left"></path>
-              <path d="M202 82 L302 32 L314 60 L214 112 Z" class="poster-tape tape-right"></path>
+              <path d="M218 44 L292 18 L300 38 L226 66 Z" class="poster-tape tape-right"></path>
-              <path d="M112 180 C110 150 116 126 132 110 C140 100 148 94 154 90 C160 94 168 100 176 110 C192 126 198 150 196 180 Z" class="constable-silhouette lead"></path>
+              <path d="M112 106 C112 82 118 64 132 52 C140 44 147 39 154 36 C161 39 168 44 176 52 C190 64 196 82 196 106 Z" class="constable-silhouette lead"></path>
-              <path d="M174 184 C172 154 178 132 194 118 C202 110 210 104 218 100 C226 104 234 110 242 118 C258 132 264 154 262 184 Z" class="constable-silhouette partner"></path>
+              <path d="M168 108 C170 86 178 70 192 60 C201 53 210 48 218 45 C226 48 235 53 242 60 C255 70 262 86 260 108 Z" class="constable-silhouette partner"></path>
-              <circle cx="84" cy="60" r="28" class="swan-stamp"></circle>
+              <circle cx="76" cy="44" r="20" class="swan-stamp"></circle>
-              <path d="M76 64 C80 54 91 48 101 53 C93 52 88 57 89 63 C90 69 101 68 103 76 C94 78 83 76 78 69 L71 76 L66 71 L74 64 Z" class="swan-mark"></path>
+              <path d="M71 47 C74 40 82 35 90 39 C84 39 80 43 81 48 C82 53 90 53 92 58 C85 60 77 58 73 53 L68 58 L64 55 L70 49 Z" class="swan-mark"></path>
-              <rect x="120" y="88" width="88" height="38" rx="8" class="evidence-card"></rect>
+              <rect x="114" y="62" width="92" height="10" rx="5" class="barbell-bar"></rect>
-              <path d="M130 98 h58 M130 108 h42 M130 118 h32" class="evidence-lines"></path>
+              <circle cx="112" cy="67" r="16" class="plate-outer"></circle>
-              <circle cx="88" cy="88" r="8" class="marker-dot"></circle>
+              <circle cx="112" cy="67" r="8" class="plate-inner"></circle>
-              <circle cx="100" cy="104" r="6" class="marker-dot marker-dot-alt"></circle>
+              <circle cx="208" cy="67" r="16" class="plate-outer"></circle>
-              <path d="M96 94 L122 110 L152 96" class="map-thread"></path>
+              <circle cx="208" cy="67" r="8" class="plate-inner"></circle>
-              <path d="M210 88 C226 80 242 80 254 88" class="beacon-arc"></path>
+              <path d="M88 76 L120 68 L154 82" class="map-thread"></path>
-              <rect x="122" y="110" width="86" height="8" rx="4" class="barbell-bar"></rect>
+              <text x="160" y="118" class="poster-callout">TRAINING DOSSIER</text>
-              <circle cx="120" cy="114" r="16" class="plate-outer"></circle>
-              <circle cx="120" cy="114" r="8" class="plate-inner"></circle>
-              <circle cx="210" cy="114" r="16" class="plate-outer"></circle>
-              <circle cx="210" cy="114" r="8" class="plate-inner"></circle>
-              <rect x="216" y="126" width="38" height="16" rx="6" class="radio-body"></rect>
-              <rect x="232" y="110" width="8" height="16" rx="4" class="radio-antenna"></rect>
-              <text x="160" y="204" class="poster-callout">TRAINING DOSSIER</text>
             </svg>
           </div>
-          <div class="evidence-contact-grid">
+          <figure class="photo-evidence-card hero-photo-card supporting-photo-card">
-            <section class="evidence-note-card case-contact-sheet" aria-label="Training caseboard details">
+            <img src="/static/images/hotfuzz-training-dossier.jpg" alt="Gym training photo with cable machine station, bench, and weight stacks." loading="eager">
-              <div class="case-contact-top">
+            <figcaption>Training still · source logged in docs</figcaption>
-                <span class="case-contact-kicker">Station drill board</span>
+          </figure>
-                <span class="case-contact-badge">Cadet fitness</span>
-              </div>
-              <svg viewBox="0 0 320 160" class="contact-sheet-illustration" role="presentation">
-                <rect x="12" y="14" width="116" height="132" rx="16" class="contact-frame"></rect>
-                <rect x="24" y="30" width="92" height="54" rx="12" class="contact-photo"></rect>
-                <path d="M30 96 h80 M30 108 h66 M30 120 h48" class="contact-lines"></path>
-                <rect x="146" y="24" width="78" height="44" rx="10" class="contact-photo alt"></rect>
-                <rect x="160" y="84" width="112" height="52" rx="12" class="contact-photo alt"></rect>
-                <circle cx="250" cy="40" r="16" class="contact-marker"></circle>
-                <path d="M132 94 C152 82 176 80 194 88 C208 94 228 98 250 96" class="contact-thread"></path>
-                <text x="70" y="60" class="contact-label">RPE</text>
-                <text x="186" y="52" class="contact-label">PACE</text>
-                <text x="218" y="114" class="contact-label">PLATE</text>
-              </svg>
-              <ul class="case-contact-list">
-                <li>Clipboard-style slips, radio cues, and drill-board labels make the page read like a police training dossier instead of generic fitness software.</li>
-                <li>The photo still remains for texture, but the authored graphics now carry the theme.</li>
-              </ul>
-            </section>
-            <figure class="photo-evidence-card hero-photo-card supporting-photo-card">
-              <img src="/static/images/hotfuzz-training-dossier.jpg" alt="Sepia-toned training photo with dumbbells, weight plates, and a handwritten workout clipboard." loading="eager">
-              <figcaption>Training still · source logged in docs</figcaption>
-            </figure>
-          </div>
         </div>
       </div>
       <nav class="case-nav" aria-label="Doris Barbell sections">
@@ -107,7 +74,7 @@
         <a class="case-nav-link" href="/#recent-workouts">Workout reports</a>
       </nav>
     </header>
-    <main class="page-shell">
+    <main class="page-shell compact-page-shell">
       <section class="family-portal evidence-board casefile-directory">
         <div class="section-heading">
           <div>
@@ -116,32 +83,32 @@
           </div>
           <span class="pill">Casefile directory</span>
         </div>
-        <p class="muted case-legend">One shell, separate runtimes. Training reports live here, but the rest of the Doris family is one jump away.</p>
+        <p class="muted case-legend">One shell, separate runtimes. Jump between training, household ops, and coursework without losing the same caseboard language.</p>
         <div class="family-directory-grid">
-          <a class="family-app-card current-desk" href="http://10.5.30.6:8093/">
+          <a class="family-app-card current-desk" href="https://gym.paccoco.com/">
             <span class="family-app-kicker">Current desk</span>
             <strong>Doris Barbell</strong>
-            <small>Body metrics, routines, workouts, and progression dossiers.</small>
+            <small>Workout logs, body metrics, and progression dossiers.</small>
           </a>
           <a class="family-app-card" href="http://10.5.30.7:8787/">
             <span class="family-app-kicker">Operator portal</span>
             <strong>Doris Dashboard</strong>
-            <small>Canonical front door for the whole Doris family.</small>
+            <small>Canonical front door for alerts, briefings, and launch control.</small>
           </a>
           <a class="family-app-card" href="http://10.5.30.7:8787/services.html">
             <span class="family-app-kicker">Switchboard</span>
             <strong>Services Directory</strong>
-            <small>Dense launch wall for the wider homelab stack.</small>
+            <small>Dense portal card wall for the broader stack.</small>
           </a>
           <a class="family-app-card" href="http://10.5.30.7:8092/">
             <span class="family-app-kicker">Pantry desk</span>
             <strong>Doris Kitchen</strong>
-            <small>Recipe leads, repair queue, and planning board.</small>
+            <small>Recipe triage, search warrants, and pantry planning.</small>
           </a>
           <a class="family-app-card" href="https://schoolhouse.paccoco.com/">
             <span class="family-app-kicker">Records desk</span>
             <strong>Doris Schoolhouse</strong>
-            <small>Assignments, recordings, and school intake packets.</small>
+            <small>Assignments, recordings, and archive intake.</small>
           </a>
         </div>
       </section>

home/doris-barbell/app/templates/dashboard.html

@@ -1,51 +1,70 @@
 {% extends 'base.html' %}
 
 {% block content %}
-<section id="body-metrics" class="grid cols-2 evidence-board dossier-grid">
+<section id="body-metrics" class="grid cols-2 dossier-grid">
-  <article class="card evidence-card">
+  <article class="card evidence-card compact-panel">
     <div class="case-legend">
       <span class="section-label">Training floor board</span>
-      <span class="pill">Training Dossier</span>
+      <span class="pill">John</span>
     </div>
     <h2>Current body metrics</h2>
-    <div class="grid dossier-grid">
+    {% for user in summary.users if user.id == 'john' %}
-      {% for user in summary.users %}
+    <div class="compact-stat-grid">
-      <section class="evidence-slab">
+      <section class="evidence-slab stat-slab">
-        <h3>{{ user.display_name }} {% if user.is_stub %}<span class="badge">stub</span>{% endif %}</h3>
+        <span class="stat-label">Weight</span>
         <p class="metric-value">{{ user.current_weight_lbs if user.current_weight_lbs is not none else '—' }}{% if user.current_weight_lbs is not none %} lb{% endif %}</p>
-        <p class="muted">BMI: {{ '%.1f'|format(user.current_bmi) if user.current_bmi is not none else 'Not set yet' }}</p>
-        <p class="muted">System: {{ user.measurement_system }}</p>
-        {% if user.latest_measurements %}
-        <p class="muted">
-          Waist {{ user.latest_measurements.waist_inches or '—' }} in ·
-          Hips {{ user.latest_measurements.hip_inches or '—' }} in ·
-          Chest {{ user.latest_measurements.chest_inches or '—' }} in ·
-          Neck {{ user.latest_measurements.neck_inches or '—' }} in
-        </p>
-        {% else %}
-        <p class="muted">No body measurements logged yet.</p>
-        {% endif %}
       </section>
-      {% endfor %}
+      <section class="evidence-slab stat-slab">
+        <span class="stat-label">BMI</span>
+        <p class="metric-value metric-value-sm">{{ '%.1f'|format(user.current_bmi) if user.current_bmi is not none else '—' }}</p>
+      </section>
     </div>
+    {% if user.latest_measurements %}
+    <ul class="list compact-summary-list">
+      <li>Waist {{ user.latest_measurements.waist_inches or '—' }} in</li>
+      <li>Chest {{ user.latest_measurements.chest_inches or '—' }} in</li>
+      <li>Hips {{ user.latest_measurements.hip_inches or '—' }} in</li>
+      <li>Neck {{ user.latest_measurements.neck_inches or '—' }} in</li>
+    </ul>
+    {% else %}
+    <p class="muted">No body measurements logged yet.</p>
+    {% endif %}
+    {% endfor %}
   </article>
 
-  <article class="card evidence-card">
+  <article id="routine-board" class="card evidence-board compact-panel">
     <div class="case-legend">
-      <span class="section-label">Case priorities</span>
+      <span class="section-label">Current split</span>
-      <span class="pill">Operator notes</span>
+      <span class="pill">Routine board</span>
     </div>
-    <h2>V1 focus</h2>
+    <h2>Current routine board</h2>
-    <ul class="list case-list">
+    <ul class="list compact-summary-list">
-      <li>Structured workout logging with routines and exercises.</li>
+      <li>Routines: {{ summary.counts.routines }}</li>
-      <li>Body-weight, BMI, waist/hip/chest/neck history in imperial units.</li>
+      <li>Exercise templates: {{ summary.counts.exercise_templates }}</li>
-      <li>Recent workouts, volume trends, and simple PR tracking.</li>
+      <li>Workout sessions: {{ summary.counts.workout_sessions }}</li>
     </ul>
+    {% if summary.routines %}
+    <div class="history-block compact-history-block">
+      <ul class="list">
+        {% for routine in summary.routines %}
+        <li>
+          <strong>{{ routine.name }}</strong>
+          <p class="muted">{{ routine.exercises|length }} exercises</p>
+          <p>
+            <a class="nav-link" href="/routines/{{ routine.id }}/log">Open log sheet</a>
+            ·
+            <a class="nav-link" href="/routines/{{ routine.id }}/live">{% if routine.live_session %}Resume {{ routine.name }} live log{% else %}Resume live log{% endif %}</a>
+          </p>
+        </li>
+        {% endfor %}
+      </ul>
+    </div>
+    {% endif %}
   </article>
 </section>
 
 <section id="weight-log" class="grid cols-2 dossier-grid">
-  <article class="card evidence-board">
+  <article class="card evidence-board compact-panel">
     <div class="case-legend"><span class="section-label">Intake docket</span><span class="pill">Weight log</span></div>
     <h2>Log weight</h2>
     <form class="stack-form intake-docket" method="post" action="/log/weight">
@@ -74,7 +93,7 @@
     </form>
   </article>
 
-  <article class="card evidence-board">
+  <article class="card evidence-board compact-panel">
     <div class="case-legend"><span class="section-label">Intake docket</span><span class="pill">Measurements</span></div>
     <h2>Log body measurements</h2>
     <form class="stack-form intake-docket" method="post" action="/log/measurements">
@@ -104,108 +123,8 @@
   </article>
 </section>
 
-<section class="grid cols-2 dossier-grid">
-  <article class="card evidence-board">
-    <div class="case-legend"><span class="section-label">Exercise library</span><span class="pill">Template intake</span></div>
-    <h2>Add exercise template</h2>
-    <form class="stack-form intake-docket" method="post" action="/templates">
-      <label>Name
-        <input type="text" name="name" placeholder="Bench Press" required>
-      </label>
-      <div class="grid cols-2 compact-grid">
-        <label>Primary muscle
-          <input type="text" name="primary_muscle" placeholder="Chest">
-        </label>
-        <label>Equipment
-          <input type="text" name="equipment" placeholder="Barbell">
-        </label>
-      </div>
-      <label>Notes
-        <textarea name="notes" rows="3" placeholder="Technique cue, setup reminder, variation notes."></textarea>
-      </label>
-      <button type="submit">Add template</button>
-    </form>
-  </article>
-
-  <article class="card evidence-board">
-    <div class="case-legend"><span class="section-label">Routine intake</span><span class="pill">Draft split</span></div>
-    <h2>Build routine draft</h2>
-    <form class="stack-form intake-docket" method="post" action="/routines">
-      <input type="hidden" name="user_id" value="john">
-      <label>Routine name
-        <input type="text" name="name" placeholder="Push Day Draft" required>
-      </label>
-      <label>Exercise lines
-        <textarea name="exercise_lines" rows="6" placeholder="Bench Press|4|6-8&#10;Incline Dumbbell Press|3|8-10&#10;Triceps Pushdown|3|12-15" required></textarea>
-      </label>
-      <p class="hint">Format: exercise | target sets | target reps | optional notes</p>
-      <label>Notes
-        <textarea name="notes" rows="2" placeholder="Temporary until the real split gets entered."></textarea>
-      </label>
-      <button type="submit">Save routine draft</button>
-    </form>
-  </article>
-</section>
-
 <section id="recent-workouts" class="grid cols-2 dossier-grid">
-  <article class="card evidence-board">
+  <article class="card evidence-board compact-panel">
-    <div class="case-legend"><span class="section-label">Workout report</span><span class="pill">Quick log</span></div>
-    <h2>Quick log workout</h2>
-    <form class="stack-form intake-docket" method="post" action="/workouts/quick-log">
-      <input type="hidden" name="user_id" value="john">
-      <label>Workout name
-        <input type="text" name="routine_name" placeholder="Push Day" required>
-      </label>
-      <label>Performed at
-        <input type="datetime-local" name="performed_at" required>
-      </label>
-      <label>Exercise lines
-        <textarea name="exercise_lines" rows="6" placeholder="Bench Press|8@135, 8@145&#10;Incline Dumbbell Press|10@50, 8@55|Last set close to failure" required></textarea>
-      </label>
-      <p class="hint">Format: exercise | reps@weight, reps@weight | optional notes</p>
-      <label>Notes
-        <textarea name="notes" rows="2" placeholder="Energy, pain, wins, misses."></textarea>
-      </label>
-      <button type="submit">Save workout</button>
-    </form>
-  </article>
-
-  <article id="routine-board" class="card evidence-board">
-    <div class="case-legend"><span class="section-label">Current split</span><span class="pill">Routine board</span></div>
-    <h2>Current routine board</h2>
-    <p class="muted">John's current five-day split is now loaded as the default routine library with a default prescription of 3 sets of 10 reps. Weights are still TBD.</p>
-    <ul class="list case-list">
-      <li>Exercise templates: {{ summary.counts.exercise_templates }}</li>
-      <li>Routines: {{ summary.counts.routines }}</li>
-    </ul>
-    {% if summary.routines %}
-    <div class="history-block">
-      <h3>Loaded routine days</h3>
-      <ul class="list">
-        {% for routine in summary.routines %}
-        <li>
-          <strong>{{ routine.name }}</strong>
-          <p class="muted">{{ routine.exercises|length }} exercises{% if routine.notes %} · {{ routine.notes }}{% endif %}</p>
-        </li>
-        {% endfor %}
-      </ul>
-    </div>
-    {% endif %}
-    {% if summary.exercise_templates %}
-    <div class="history-block">
-      <h3>Template snapshot</h3>
-      <ul class="list">
-        {% for template in summary.exercise_templates %}
-        <li>{{ template.name }}{% if template.equipment %} · {{ template.equipment }}{% endif %}</li>
-        {% endfor %}
-      </ul>
-    </div>
-    {% endif %}
-  </article>
-</section>
-
-<section class="grid cols-2 dossier-grid">
-  <article class="card evidence-board">
     <div class="case-legend"><span class="section-label">Recent logs</span><span class="pill">Session reports</span></div>
     <h2>Recent workouts</h2>
     {% if john_workout_history %}
@@ -222,50 +141,7 @@
     {% endif %}
   </article>
 
-  <article class="card evidence-board">
+  <article class="card evidence-board compact-panel">
-    <div class="case-legend"><span class="section-label">History snapshot</span><span class="pill">John file</span></div>
-    <h2>John history snapshot</h2>
-    <div class="history-block">
-      <h3>Recent weights</h3>
-      {% if john_weight_history %}
-      <ul class="list">
-        {% for entry in john_weight_history %}
-        <li>{{ entry.recorded_at }} · {{ entry.weight_lbs }} lb{% if entry.bmi is not none %} · BMI {{ '%.1f'|format(entry.bmi) }}{% endif %}</li>
-        {% endfor %}
-      </ul>
-      {% else %}
-      <p class="muted">No weight entries yet.</p>
-      {% endif %}
-    </div>
-    <div class="history-block">
-      <h3>Recent measurements</h3>
-      {% if john_measurement_history %}
-      <ul class="list">
-        {% for entry in john_measurement_history %}
-        <li>{{ entry.recorded_at }} · Waist {{ entry.waist_inches or '—' }} · Chest {{ entry.chest_inches or '—' }} · Hips {{ entry.hip_inches or '—' }} · Neck {{ entry.neck_inches or '—' }}</li>
-        {% endfor %}
-      </ul>
-      {% else %}
-      <p class="muted">No measurement entries yet.</p>
-      {% endif %}
-    </div>
-  </article>
-</section>
-
-<section class="grid cols-2 dossier-grid">
-  <article class="card evidence-board">
-    <div class="case-legend"><span class="section-label">Current counts</span><span class="pill">Inventory</span></div>
-    <h2>Current counts</h2>
-    <ul class="list case-list">
-      <li>Workout sessions: {{ summary.counts.workout_sessions }}</li>
-      <li>Weight entries: {{ summary.counts.weight_entries }}</li>
-      <li>Measurement entries: {{ summary.counts.measurement_entries }}</li>
-      <li>Exercise templates: {{ summary.counts.exercise_templates }}</li>
-      <li>Routines: {{ summary.counts.routines }}</li>
-    </ul>
-  </article>
-
-  <article class="card evidence-board">
     <div class="case-legend"><span class="section-label">Exercise bests</span><span class="pill">PR board</span></div>
     <h2>Exercise bests</h2>
     {% if john_progression %}
@@ -284,14 +160,108 @@
 </section>
 
 <section class="grid cols-2 dossier-grid">
-  <article class="card evidence-board">
+  <article class="card evidence-board compact-panel">
-    <div class="case-legend"><span class="section-label">Next likely build</span><span class="pill">Open casework</span></div>
+    <div class="case-legend"><span class="section-label">Library tools</span><span class="pill">Templates</span></div>
-    <h2>Next likely build</h2>
+    <h2>Add exercise template</h2>
-    <ul class="list case-list">
+    <form class="stack-form intake-docket" method="post" action="/templates">
-      <li>Replace placeholder routines with John’s real day-by-day program tomorrow.</li>
+      <label>Name
-      <li>Routine-specific workout entry flow driven directly from the saved split.</li>
+        <input type="text" name="name" placeholder="Bench Press" required>
-      <li>Exercise progression and PR views.</li>
+      </label>
-    </ul>
+      <div class="grid cols-2 compact-grid">
+        <label>Primary muscle
+          <input type="text" name="primary_muscle" placeholder="Chest">
+        </label>
+        <label>Equipment
+          <input type="text" name="equipment" placeholder="Barbell">
+        </label>
+      </div>
+      <label>Notes
+        <textarea name="notes" rows="2" placeholder="Technique cue or setup reminder."></textarea>
+      </label>
+      <button type="submit">Add template</button>
+    </form>
+    {% if summary.exercise_templates %}
+    <div class="history-block compact-history-block">
+      <h3>Template snapshot</h3>
+      <ul class="list">
+        {% for template in summary.exercise_templates %}
+        <li>{{ template.name }}{% if template.equipment %} · {{ template.equipment }}{% endif %}</li>
+        {% endfor %}
+      </ul>
+    </div>
+    {% endif %}
+  </article>
+
+  <article class="card evidence-board compact-panel">
+    <div class="case-legend"><span class="section-label">Workout report</span><span class="pill">Quick log</span></div>
+    <h2>Quick log workout</h2>
+    <form class="stack-form intake-docket" method="post" action="/workouts/quick-log">
+      <input type="hidden" name="user_id" value="john">
+      <label>Workout name
+        <input type="text" name="routine_name" placeholder="Push Day" required>
+      </label>
+      <label>Performed at
+        <input type="datetime-local" name="performed_at" required>
+      </label>
+      <label>Exercise lines
+        <textarea name="exercise_lines" rows="5" placeholder="Bench Press|8@135, 8@145&#10;Incline Dumbbell Press|10@50, 8@55|Last set close to failure" required></textarea>
+      </label>
+      <p class="hint">Format: exercise | reps@weight, reps@weight | optional notes</p>
+      <label>Notes
+        <textarea name="notes" rows="2" placeholder="Energy, pain, wins, misses."></textarea>
+      </label>
+      <button type="submit">Save workout</button>
+    </form>
+  </article>
+</section>
+
+<section class="grid cols-2 dossier-grid">
+  <article class="card evidence-board compact-panel">
+    <div class="case-legend"><span class="section-label">Routine tools</span><span class="pill">Draft split</span></div>
+    <h2>Build routine draft</h2>
+    <form class="stack-form intake-docket" method="post" action="/routines">
+      <input type="hidden" name="user_id" value="john">
+      <label>Routine name
+        <input type="text" name="name" placeholder="Push Day Draft" required>
+      </label>
+      <label>Exercise lines
+        <textarea name="exercise_lines" rows="5" placeholder="Bench Press|4|6-8&#10;Incline Dumbbell Press|3|8-10&#10;Triceps Pushdown|3|12-15" required></textarea>
+      </label>
+      <p class="hint">Format: exercise | target sets | target reps | optional notes</p>
+      <label>Notes
+        <textarea name="notes" rows="2" placeholder="Optional notes."></textarea>
+      </label>
+      <button type="submit">Save routine draft</button>
+    </form>
+  </article>
+
+  <article class="card evidence-board compact-panel">
+    <div class="case-legend"><span class="section-label">History snapshot</span><span class="pill">John file</span></div>
+    <h2>Recent body history</h2>
+    <div class="history-block compact-history-block">
+      <h3>Recent weights</h3>
+      {% if john_weight_history %}
+      <ul class="list">
+        {% for entry in john_weight_history %}
+        <li>{{ entry.recorded_at }} · {{ entry.weight_lbs }} lb{% if entry.bmi is not none %} · BMI {{ '%.1f'|format(entry.bmi) }}{% endif %}</li>
+        {% endfor %}
+      </ul>
+      {% else %}
+      <p class="muted">No weight entries yet.</p>
+      {% endif %}
+    </div>
+    <div class="history-block compact-history-block">
+      <h3>Recent measurements</h3>
+      {% if john_measurement_history %}
+      <ul class="list">
+        {% for entry in john_measurement_history %}
+        <li>{{ entry.recorded_at }} · Waist {{ entry.waist_inches or '—' }} · Chest {{ entry.chest_inches or '—' }} · Hips {{ entry.hip_inches or '—' }} · Neck {{ entry.neck_inches or '—' }}</li>
+        {% endfor %}
+      </ul>
+      {% else %}
+      <p class="muted">No measurement entries yet.</p>
+      {% endif %}
+    </div>
   </article>
 </section>
 {% endblock %}

home/doris-barbell/app/templates/live_workout.html

@@ -0,0 +1,132 @@
+{% extends 'base.html' %}
+
+{% block content %}
+<section class="grid cols-2 dossier-grid">
+  <article class="card evidence-board">
+    <div class="case-legend">
+      <span class="section-label">Live workout logger</span>
+      <span class="pill">One-at-a-time entry</span>
+    </div>
+    <h2>{{ routine.name }}</h2>
+    <p class="muted">Log one exercise at a time while you work through the session. Save each movement as you finish it, then close out the workout when you're done.</p>
+    {% if routine.notes %}
+    <p class="muted">{{ routine.notes }}</p>
+    {% endif %}
+  </article>
+
+  <article class="card evidence-board">
+    <div class="case-legend">
+      <span class="section-label">Routine field sheet</span>
+      <span class="pill">{{ routine_sheet|length }} exercises</span>
+    </div>
+    <h2>Loaded exercises</h2>
+    <ul class="list case-list">
+      {% for exercise in routine_sheet %}
+      <li>
+        <strong>{{ exercise.exercise_name }}</strong>
+        <p class="muted">{{ exercise.target_sets }} sets{% if exercise.target_reps %} · target reps {{ exercise.target_reps }}{% endif %}</p>
+      </li>
+      {% endfor %}
+    </ul>
+  </article>
+</section>
+
+{% if not active_session %}
+<section class="grid dossier-grid">
+  <article class="card evidence-board">
+    <div class="case-legend">
+      <span class="section-label">Session control</span>
+      <span class="pill">Ready</span>
+    </div>
+    <h2>Start live session</h2>
+    <form class="stack-form intake-docket" method="post" action="/routines/{{ routine.id }}/live/start">
+      <input type="hidden" name="user_id" value="{{ routine.user_id }}">
+      <label>Performed at
+        <input type="datetime-local" name="performed_at" value="{{ default_performed_at }}" required>
+      </label>
+      <button type="submit">Start {{ routine.name }} session</button>
+    </form>
+  </article>
+</section>
+{% else %}
+<section class="grid cols-2 dossier-grid">
+  <article class="card evidence-board">
+    <div class="case-legend">
+      <span class="section-label">Session control</span>
+      <span class="pill">In progress</span>
+    </div>
+    <h2>Session in progress</h2>
+    <p class="muted">Started at {{ active_session.performed_at }} · Logged exercises so far: {{ logged_exercises|length }}</p>
+    {% if logged_exercises %}
+    <ul class="list case-list">
+      {% for exercise in logged_exercises %}
+      <li>
+        <strong>{{ exercise.exercise_name }} · {{ exercise.set_count }} sets</strong>
+        {% if exercise.notes %}<p class="muted">{{ exercise.notes }}</p>{% endif %}
+      </li>
+      {% endfor %}
+    </ul>
+    {% else %}
+    <p class="muted">No exercises saved yet.</p>
+    {% endif %}
+    <form class="stack-form intake-docket" method="post" action="/routines/{{ routine.id }}/live/finish">
+      <input type="hidden" name="user_id" value="{{ routine.user_id }}">
+      <input type="hidden" name="performed_at" value="{{ active_session.performed_at }}">
+      <label>Session notes
+        <textarea name="notes" rows="2" placeholder="Energy, pain, machine swaps, or anything worth remembering."></textarea>
+      </label>
+      <button type="submit">Finish {{ routine_action_label }} workout</button>
+    </form>
+  </article>
+
+  <article class="card evidence-board">
+    <div class="case-legend">
+      <span class="section-label">Remaining queue</span>
+      <span class="pill">{{ remaining_exercises|length }} left</span>
+    </div>
+    <h2>Ready to log next</h2>
+    {% if remaining_exercises %}
+    <p class="muted">Each card saves one exercise at a time, so you can log mid-workout without rewriting the whole session.</p>
+    {% for exercise in remaining_exercises %}
+    <section class="evidence-slab">
+      <form class="stack-form intake-docket" method="post" action="/routines/{{ routine.id }}/live/add-exercise">
+        <input type="hidden" name="user_id" value="{{ routine.user_id }}">
+        <input type="hidden" name="performed_at" value="{{ active_session.performed_at }}">
+        <input type="hidden" name="exercise_name" value="{{ exercise.exercise_name }}">
+        <input type="hidden" name="set_count" value="{{ exercise.target_sets }}">
+        <div class="case-legend">
+          <span class="section-label">Exercise</span>
+          <span class="pill">{{ exercise.target_sets }} sets</span>
+        </div>
+        <h3>{{ exercise.exercise_name }}</h3>
+        <p class="muted">{% if exercise.target_reps %}Target reps {{ exercise.target_reps }}{% else %}Enter reps manually{% endif %}</p>
+        {% if exercise.is_band %}
+        <p class="muted">Resistance-band exercise: leave weight blank to log sets and default reps only.</p>
+        {% endif %}
+        <div class="grid cols-2 compact-grid">
+          {% for set in exercise.sets %}
+          <div class="evidence-slab compact-slab">
+            <strong>Set {{ set.index + 1 }}</strong>
+            <label>Reps
+              <input type="number" name="set_{{ set.index }}_reps" min="1" step="1" placeholder="{{ set.default_reps }}">
+            </label>
+            <label>Weight (lb)
+              <input type="number" name="set_{{ set.index }}_weight_lbs" min="0" step="0.1">
+            </label>
+          </div>
+          {% endfor %}
+        </div>
+        <label>Exercise notes
+          <textarea name="exercise_notes" rows="2" placeholder="Technique note, pain flag, or machine change."></textarea>
+        </label>
+        <button type="submit">Save {{ exercise.exercise_name }}</button>
+      </form>
+    </section>
+    {% endfor %}
+    {% else %}
+    <p class="muted">Everything in this routine is logged. Finish the workout to move it into history.</p>
+    {% endif %}
+  </article>
+</section>
+{% endif %}
+{% endblock %}

home/doris-barbell/app/templates/routine_log.html

@@ -0,0 +1,95 @@
+{% extends 'base.html' %}
+
+{% block content %}
+<section class="grid cols-2 dossier-grid">
+  <article class="card evidence-board">
+    <div class="case-legend">
+      <span class="section-label">Routine field sheet</span>
+      <span class="pill">Live training log</span>
+    </div>
+    <h2>{{ routine.name }}</h2>
+    <p class="muted">Fill in today's completed reps and weight for each set. Leave any unfinished exercise blank and it will be skipped.</p>
+    {% if routine.notes %}
+    <p class="muted">{{ routine.notes }}</p>
+    {% endif %}
+  </article>
+
+  <article class="card evidence-board">
+    <div class="case-legend">
+      <span class="section-label">Current prescription</span>
+      <span class="pill">Shoulder day</span>
+    </div>
+    <h2>Loaded exercises</h2>
+    <ul class="list case-list">
+      {% for exercise in routine_sheet %}
+      <li>
+        <strong>{{ exercise.exercise_name }}</strong>
+        <p class="muted">{{ exercise.target_sets }} sets{% if exercise.target_reps %} · target reps {{ exercise.target_reps }}{% endif %}{% if exercise.notes %} · {{ exercise.notes }}{% endif %}</p>
+      </li>
+      {% endfor %}
+    </ul>
+  </article>
+</section>
+
+<section class="grid dossier-grid">
+  <article class="card evidence-board">
+    <div class="case-legend">
+      <span class="section-label">Workout report</span>
+      <span class="pill">Structured entry</span>
+    </div>
+    <h2>Log this session</h2>
+    <form class="stack-form intake-docket" method="post" action="/workouts/routine-log">
+      <input type="hidden" name="user_id" value="{{ routine.user_id }}">
+      <input type="hidden" name="routine_id" value="{{ routine.id }}">
+      <input type="hidden" name="routine_name" value="{{ routine.name }}">
+      <input type="hidden" name="exercise_count" value="{{ routine_sheet|length }}">
+      <label>Performed at
+        <input type="datetime-local" name="performed_at" value="{{ default_performed_at }}" required>
+      </label>
+      <label>Session notes
+        <textarea name="notes" rows="2" placeholder="Pain, wins, machine availability, energy, anything worth remembering."></textarea>
+      </label>
+
+      {% for exercise in routine_sheet %}
+      <section class="evidence-slab">
+        <input type="hidden" name="exercise_{{ exercise.exercise_index }}_set_count" value="{{ exercise.target_sets }}">
+        <input type="hidden" name="exercise_{{ exercise.exercise_index }}_default_reps" value="{{ exercise.default_reps }}">
+        <div class="case-legend">
+          <span class="section-label">Exercise {{ loop.index }}</span>
+          <span class="pill">{{ exercise.target_sets }} sets</span>
+        </div>
+        <label>Exercise
+          <select name="exercise_{{ exercise.exercise_index }}_name">
+            {% for option_name in exercise_options %}
+            <option value="{{ option_name }}" {% if option_name == exercise.exercise_name %}selected{% endif %}>{{ option_name }}</option>
+            {% endfor %}
+          </select>
+        </label>
+        <p class="muted">Target reps: {{ exercise.target_reps or 'enter manually' }}</p>
+        {% if exercise.is_band %}
+        <p class="muted">Resistance-band exercise: leave weight blank to log sets and default reps only.</p>
+        {% endif %}
+        <div class="grid cols-2 compact-grid">
+          {% for set in exercise.sets %}
+          <div class="evidence-slab compact-slab">
+            <strong>Set {{ set.index + 1 }}</strong>
+            <label>Reps
+              <input type="number" name="exercise_{{ set.exercise_index }}_set_{{ set.index }}_reps" min="1" step="1" placeholder="{{ set.default_reps }}">
+            </label>
+            <label>Weight (lb)
+              <input type="number" name="exercise_{{ set.exercise_index }}_set_{{ set.index }}_weight_lbs" min="0" step="0.1">
+            </label>
+          </div>
+          {% endfor %}
+        </div>
+        <label>Exercise notes
+          <textarea name="exercise_{{ exercise.exercise_index }}_notes" rows="2" placeholder="Technique note, pain flag, or machine change."></textarea>
+        </label>
+      </section>
+      {% endfor %}
+
+      <button type="submit">Save {{ routine_action_label }} workout</button>
+    </form>
+  </article>
+</section>
+{% endblock %}

home/doris-barbell/tests/test_app.py

@@ -1,4 +1,5 @@
 import json
+import re
 from pathlib import Path
 
 from fastapi.testclient import TestClient
@@ -54,6 +55,18 @@ def test_dashboard_summary_seeds_john_and_manndra(tmp_path: Path) -> None:
     }
     assert '3 sets of 10 reps' in payload['routines'][0]['notes']
     assert 'Weights are still TBD' in payload['routines'][0]['notes']
+    shoulders = next(routine for routine in payload['routines'] if routine['name'] == 'Thursday: Shoulders')
+    assert shoulders['exercises'][6] == {
+        'exercise_name': '7-7-7 Shoulder Press',
+        'target_sets': 1,
+        'target_reps': '7-7-7',
+    }
+    assert shoulders['exercises'][7] == {
+        'exercise_name': 'Resistance Band Punch-Out Training',
+        'target_sets': 3,
+        'target_reps': '10',
+    }
+    assert 'resistance band punch-out training' in shoulders['notes']
     template_names = [template['name'] for template in payload['exercise_templates']]
     assert template_names == [
         'Resistance Band Crunches',
@@ -366,12 +379,277 @@ def test_homepage_renders_core_sections_and_forms(tmp_path: Path) -> None:
     assert response.status_code == 200
     body = response.text
     assert 'Doris Barbell' in body
+    assert 'Log lifts, body weight, and routines.' in body
     assert 'Recent workouts' in body
     assert 'Current body metrics' in body
     assert 'Log weight' in body
     assert 'Add exercise template' in body
     assert 'Current routine board' in body
     assert 'Monday: Chest' in body
+    assert 'Doris family directory' in body
+    assert 'Singular front door' in body
+    assert 'V1 focus' not in body
+    assert 'Next likely build' not in body
+
+
+def test_seeded_routine_can_render_prefilled_log_sheet(tmp_path: Path) -> None:
+    client = make_client(tmp_path)
+
+    summary = client.get('/api/dashboard/summary').json()
+    shoulders = next(routine for routine in summary['routines'] if routine['name'] == 'Thursday: Shoulders')
+
+    response = client.get(f"/routines/{shoulders['id']}/log")
+
+    assert response.status_code == 200
+    body = response.text
+    assert 'Thursday: Shoulders' in body
+    assert 'Shoulder Press' in body
+    assert 'Save shoulder day workout' in body
+    assert 'name="exercise_0_name"' in body
+    assert '<option value="Shoulder Press" selected>' in body
+    assert 'value="Upright Row"' in body
+    assert 'name="exercise_0_set_0_reps"' in body
+    assert 'name="exercise_0_set_0_weight_lbs"' in body
+    assert 'placeholder="10"' in body
+    assert 'name="exercise_0_set_0_reps" min="1" step="1" placeholder="10"' in body
+    assert re.search(r'name="performed_at" value="\d{4}-\d{2}-\d{2}T\d{2}:\d{2}"', body)
+
+
+def test_seeded_routine_can_render_live_workout_page(tmp_path: Path) -> None:
+    client = make_client(tmp_path)
+
+    summary = client.get('/api/dashboard/summary').json()
+    shoulders = next(routine for routine in summary['routines'] if routine['name'] == 'Thursday: Shoulders')
+
+    response = client.get(f"/routines/{shoulders['id']}/live")
+
+    assert response.status_code == 200
+    body = response.text
+    assert 'Live workout logger' in body
+    assert 'Log one exercise at a time' in body
+    assert 'Start Thursday: Shoulders session' in body
+    assert 'Resume live log' in client.get('/').text
+
+
+def test_live_workout_page_backfills_older_state_without_active_session_key(tmp_path: Path) -> None:
+    client = make_client(tmp_path)
+
+    legacy_state = json.loads((tmp_path / 'state.json').read_text())
+    legacy_state.pop('active_workout_sessions', None)
+    (tmp_path / 'state.json').write_text(json.dumps(legacy_state))
+
+    response = client.get('/routines/seed-routine-04/live')
+
+    assert response.status_code == 200
+    assert 'Start Thursday: Shoulders session' in response.text
+
+
+def test_live_workout_session_can_log_exercises_one_at_a_time_and_finish(tmp_path: Path) -> None:
+    client = make_client(tmp_path)
+
+    summary = client.get('/api/dashboard/summary').json()
+    shoulders = next(routine for routine in summary['routines'] if routine['name'] == 'Thursday: Shoulders')
+
+    start_response = client.post(
+        f"/routines/{shoulders['id']}/live/start",
+        data={
+            'user_id': 'john',
+            'performed_at': '2026-05-28T12:15:00',
+        },
+        follow_redirects=True,
+    )
+
+    assert start_response.status_code == 200
+    start_body = start_response.text
+    assert 'Session in progress' in start_body
+    assert 'Logged exercises so far: 0' in start_body
+    assert 'name="exercise_name"' in start_body
+    assert 'name="set_0_reps"' in start_body
+    assert 'name="set_0_weight_lbs"' in start_body
+
+    add_response = client.post(
+        f"/routines/{shoulders['id']}/live/add-exercise",
+        data={
+            'user_id': 'john',
+            'performed_at': '2026-05-28T12:15:00',
+            'exercise_name': 'Shoulder Press',
+            'set_count': '3',
+            'set_0_reps': '10',
+            'set_0_weight_lbs': '70',
+            'set_1_reps': '10',
+            'set_1_weight_lbs': '80',
+            'set_2_reps': '8',
+            'set_2_weight_lbs': '90',
+        },
+        follow_redirects=True,
+    )
+
+    assert add_response.status_code == 200
+    add_body = add_response.text
+    assert 'Logged exercises so far: 1' in add_body
+    assert 'Shoulder Press · 3 sets' in add_body
+    assert 'Upright Row' in add_body
+
+    finish_response = client.post(
+        f"/routines/{shoulders['id']}/live/finish",
+        data={
+            'user_id': 'john',
+            'performed_at': '2026-05-28T12:15:00',
+            'notes': 'Logged between sets.',
+        },
+        follow_redirects=False,
+    )
+
+    assert finish_response.status_code == 303
+    assert finish_response.headers['location'] == '/'
+
+    workout_history = client.get('/api/history/john/workouts')
+    assert workout_history.status_code == 200
+    payload = workout_history.json()
+    assert payload[0]['routine_name'] == 'Thursday: Shoulders'
+    assert payload[0]['exercise_count'] == 1
+    assert payload[0]['set_count'] == 3
+    assert payload[0]['notes'] == 'Logged between sets.'
+    assert payload[0]['exercises'][0]['exercise_name'] == 'Shoulder Press'
+    assert payload[0]['exercises'][0]['sets'][2] == {'reps': 8, 'weight_lbs': 90.0}
+
+    dashboard = client.get('/').text
+    assert 'Resume Thursday: Shoulders live log' not in dashboard
+
+
+def test_seeded_routine_log_submission_creates_structured_workout(tmp_path: Path) -> None:
+    client = make_client(tmp_path)
+
+    summary = client.get('/api/dashboard/summary').json()
+    shoulders = next(routine for routine in summary['routines'] if routine['name'] == 'Thursday: Shoulders')
+
+    response = client.post(
+        '/workouts/routine-log',
+        data={
+            'user_id': 'john',
+            'routine_id': shoulders['id'],
+            'performed_at': '2026-05-28T12:00:00',
+            'routine_name': shoulders['name'],
+            'notes': 'Shoulder day at the gym.',
+            'exercise_count': '2',
+            'exercise_0_name': 'Shoulder Press',
+            'exercise_0_set_count': '3',
+            'exercise_0_set_0_reps': '10',
+            'exercise_0_set_0_weight_lbs': '70',
+            'exercise_0_set_1_reps': '10',
+            'exercise_0_set_1_weight_lbs': '80',
+            'exercise_0_set_2_reps': '8',
+            'exercise_0_set_2_weight_lbs': '90',
+            'exercise_1_name': 'Upright Row',
+            'exercise_1_set_count': '3',
+            'exercise_1_set_0_reps': '10',
+            'exercise_1_set_0_weight_lbs': '35',
+            'exercise_1_set_1_reps': '10',
+            'exercise_1_set_1_weight_lbs': '35',
+            'exercise_1_set_2_reps': '8',
+            'exercise_1_set_2_weight_lbs': '40',
+        },
+        follow_redirects=False,
+    )
+
+    assert response.status_code == 303
+    assert response.headers['location'] == '/'
+
+    workout_history = client.get('/api/history/john/workouts')
+    assert workout_history.status_code == 200
+    payload = workout_history.json()
+    assert payload[0]['routine_name'] == 'Thursday: Shoulders'
+    assert payload[0]['exercise_count'] == 2
+    assert payload[0]['set_count'] == 6
+    assert payload[0]['total_volume_lbs'] == 3240
+    assert payload[0]['exercises'][0]['exercise_name'] == 'Shoulder Press'
+    assert payload[0]['exercises'][0]['sets'][2] == {'reps': 8, 'weight_lbs': 90.0}
+    assert payload[0]['exercises'][1]['exercise_name'] == 'Upright Row'
+
+
+def test_seeded_routine_log_uses_numeric_target_reps_when_reps_left_blank(tmp_path: Path) -> None:
+    client = make_client(tmp_path)
+
+    summary = client.get('/api/dashboard/summary').json()
+    shoulders = next(routine for routine in summary['routines'] if routine['name'] == 'Thursday: Shoulders')
+
+    response = client.post(
+        '/workouts/routine-log',
+        data={
+            'user_id': 'john',
+            'routine_id': shoulders['id'],
+            'performed_at': '2026-05-28T12:00:00',
+            'routine_name': shoulders['name'],
+            'notes': 'Use default target reps when left blank.',
+            'exercise_count': '1',
+            'exercise_0_name': 'Shoulder Press',
+            'exercise_0_set_count': '3',
+            'exercise_0_set_0_reps': '',
+            'exercise_0_set_0_weight_lbs': '45',
+            'exercise_0_set_1_reps': '',
+            'exercise_0_set_1_weight_lbs': '45',
+            'exercise_0_set_2_reps': '',
+            'exercise_0_set_2_weight_lbs': '45',
+        },
+        follow_redirects=False,
+    )
+
+    assert response.status_code == 303
+    assert response.headers['location'] == '/'
+
+    workout_history = client.get('/api/history/john/workouts')
+    assert workout_history.status_code == 200
+    payload = workout_history.json()
+    assert payload[0]['routine_name'] == 'Thursday: Shoulders'
+    assert payload[0]['exercises'][0]['sets'] == [
+        {'reps': 10, 'weight_lbs': 45.0},
+        {'reps': 10, 'weight_lbs': 45.0},
+        {'reps': 10, 'weight_lbs': 45.0},
+    ]
+
+
+def test_seeded_routine_log_allows_band_exercises_without_weight(tmp_path: Path) -> None:
+    client = make_client(tmp_path)
+
+    summary = client.get('/api/dashboard/summary').json()
+    shoulders = next(routine for routine in summary['routines'] if routine['name'] == 'Thursday: Shoulders')
+
+    response = client.post(
+        '/workouts/routine-log',
+        data={
+            'user_id': 'john',
+            'routine_id': shoulders['id'],
+            'performed_at': '2026-05-28T12:05:00',
+            'routine_name': shoulders['name'],
+            'notes': 'Band work without tracked weight.',
+            'exercise_count': '1',
+            'exercise_0_name': 'Resistance Band Punch-Out Training',
+            'exercise_0_set_count': '3',
+            'exercise_0_set_0_reps': '',
+            'exercise_0_set_0_weight_lbs': '',
+            'exercise_0_set_1_reps': '',
+            'exercise_0_set_1_weight_lbs': '',
+            'exercise_0_set_2_reps': '',
+            'exercise_0_set_2_weight_lbs': '',
+        },
+        follow_redirects=False,
+    )
+
+    assert response.status_code == 303
+    assert response.headers['location'] == '/'
+
+    workout_history = client.get('/api/history/john/workouts')
+    assert workout_history.status_code == 200
+    payload = workout_history.json()
+    assert payload[0]['routine_name'] == 'Thursday: Shoulders'
+    assert payload[0]['set_count'] == 3
+    assert payload[0]['total_volume_lbs'] == 0
+    assert payload[0]['exercises'][0]['exercise_name'] == 'Resistance Band Punch-Out Training'
+    assert payload[0]['exercises'][0]['sets'] == [
+        {'reps': 10, 'weight_lbs': None},
+        {'reps': 10, 'weight_lbs': None},
+        {'reps': 10, 'weight_lbs': None},
+    ]
 
 
 def test_existing_state_gets_seeded_routine_backfill(tmp_path: Path) -> None:
@@ -472,6 +750,82 @@ def test_existing_seeded_routines_upgrade_prescriptions_to_three_by_ten(tmp_path
     assert 'Weights are still TBD' in monday['notes']
 
 
+def test_existing_seeded_shoulders_routine_gets_777_and_punch_out_corrections(tmp_path: Path) -> None:
+    state_path = tmp_path / 'state.json'
+    state_path.write_text(
+        json.dumps(
+            {
+                'users': {
+                    'john': {
+                        'id': 'john',
+                        'display_name': 'John',
+                        'is_stub': False,
+                        'measurement_system': 'imperial',
+                        'height_inches': 68.5,
+                        'goal_weight_lbs': None,
+                        'notes': 'Legacy state',
+                    },
+                    'manndra': {
+                        'id': 'manndra',
+                        'display_name': 'Manndra',
+                        'is_stub': True,
+                        'measurement_system': 'imperial',
+                        'height_inches': None,
+                        'goal_weight_lbs': None,
+                        'notes': 'Legacy stub',
+                    },
+                },
+                'exercise_templates': [
+                    {
+                        'id': 'seed-template-25',
+                        'name': 'Resistance Band Punch-Out Holds',
+                        'primary_muscle': 'abs',
+                        'equipment': 'band',
+                        'notes': None,
+                    }
+                ],
+                'routines': [
+                    {
+                        'id': 'seed-routine-04',
+                        'user_id': 'john',
+                        'name': 'Thursday: Shoulders',
+                        'notes': "Imported from John's current routine. Default prescription is 3 sets of 10 reps. Weights are still TBD. Includes resistance band punch-out ab holds.",
+                        'exercises': [
+                            {'exercise_name': 'Shoulder Press', 'target_sets': 3, 'target_reps': '10'},
+                            {'exercise_name': 'Arnold Press', 'target_sets': 3, 'target_reps': '10'},
+                            {'exercise_name': 'Side Lateral Raise', 'target_sets': 3, 'target_reps': '10'},
+                            {'exercise_name': 'Front Lateral Raise', 'target_sets': 3, 'target_reps': '10'},
+                            {'exercise_name': 'Upright Row', 'target_sets': 3, 'target_reps': '10'},
+                            {'exercise_name': 'Shoulder Shrugs', 'target_sets': 3, 'target_reps': '10'},
+                            {'exercise_name': '7-7-7 Shoulder Press', 'target_sets': 3, 'target_reps': '10'},
+                            {'exercise_name': 'Resistance Band Punch-Out Holds', 'target_sets': 3, 'target_reps': '10'},
+                        ],
+                    }
+                ],
+                'weight_entries': [],
+                'measurement_entries': [],
+                'workout_sessions': [],
+            }
+        )
+    )
+
+    client = make_client(tmp_path)
+    payload = client.get('/api/dashboard/summary').json()
+
+    shoulders = next(routine for routine in payload['routines'] if routine['name'] == 'Thursday: Shoulders')
+    assert shoulders['exercises'][6] == {
+        'exercise_name': '7-7-7 Shoulder Press',
+        'target_sets': 1,
+        'target_reps': '7-7-7',
+    }
+    assert shoulders['exercises'][7] == {
+        'exercise_name': 'Resistance Band Punch-Out Training',
+        'target_sets': 3,
+        'target_reps': '10',
+    }
+    assert 'resistance band punch-out training' in shoulders['notes']
+
+
 def test_weight_form_submission_redirects_and_updates_dashboard(tmp_path: Path) -> None:
     client = make_client(tmp_path)
 

home/doris-dashboard/bin/generate_dashboard.py

@@ -112,9 +112,6 @@ SERVICE_DIRECTORY = [
         'items': [
             {'name': 'Home Assistant', 'url': '', 'purpose': 'Smart-home control hub documented on PD, but Doris does not yet have a stable operator-safe route.', 'exposure': 'PRIVATE', 'state': 'attention', 'host': 'PD', 'port': '8123', 'probe': False, 'badge': 'Manual', 'detail': 'documented active on PD; local port currently refuses from NOMAD, so keep this manual until routed cleanly'},
             {'name': 'Kima Hub', 'url': 'http://10.5.30.6:3333', 'health_url': 'http://10.5.30.6:3333', 'purpose': 'Custom IoT gateway and smart-home integration surface.', 'exposure': 'LAN', 'state': 'ok', 'host': 'PD', 'port': '3333'},
-            {'name': 'Pi-hole VIP', 'url': 'http://10.5.30.53/ui/', 'health_url': 'http://10.5.30.53/admin/', 'purpose': 'Floating DNS/admin surface for the HA Pi-hole pair your clients should target.', 'exposure': 'LAN', 'state': 'ok', 'host': 'VIP', 'port': '53 / 80'},
-            {'name': 'Pi-hole PD', 'url': 'http://10.5.30.6/ui/', 'health_url': 'http://10.5.30.6/admin/', 'purpose': 'Primary PD Pi-hole node behind the floating DNS VIP.', 'exposure': 'LAN', 'state': 'ok', 'host': 'PD', 'port': '53 / 80'},
-            {'name': 'Pi-hole NOMAD', 'url': 'https://10.5.30.7/login', 'purpose': 'NOMAD backup Pi-hole replica for the HA DNS pair.', 'exposure': 'LAN', 'state': 'attention', 'host': 'NOMAD', 'port': '53 / 80/443', 'probe': False, 'badge': 'Manual', 'detail': 'documented active; local admin currently presents a self-signed TLS flow from NOMAD so Doris leaves this manual'},
             {'name': 'Authelia', 'url': 'http://10.5.30.6:9091', 'health_url': 'http://10.5.30.6:9091', 'purpose': 'Identity and auth gate backing protected public routes.', 'exposure': 'LAN', 'state': 'ok', 'host': 'PD', 'port': '9091'},
         ],
     },
@@ -2022,7 +2019,7 @@ def top_nav(active:str)->str:
         ('Services','services.html','services'),
         ('Kitchen','http://10.5.30.7:8092','kitchen'),
         ('Schoolhouse','https://schoolhouse.paccoco.com','schoolhouse'),
-        ('Barbell','http://10.5.30.6:8093','barbell'),
+        ('Barbell','https://gym.paccoco.com','barbell'),
         ('Donetick','https://donetick.paccoco.com','donetick'),
         ('Paperless','https://paperless.paccoco.com','paperless'),
         ('n8n','https://n8n.paccoco.com','n8n'),
@@ -2054,7 +2051,7 @@ def render_family_directory(active:str)->str:
         ('Services Directory','services.html','services','Switchboard','Dense launch wall for the wider stack once you know where you need to go.'),
         ('Doris Kitchen','http://10.5.30.7:8092','kitchen','Pantry desk','Recipe leads, import repair, and meal-planning evidence review.'),
         ('Doris Schoolhouse','https://schoolhouse.paccoco.com','schoolhouse','Records desk','Assignments, recordings, D2L sync, and archive intake.'),
-        ('Doris Barbell','http://10.5.30.6:8093','barbell','Training desk','Body metrics, routines, workouts, and progression dossiers.'),
+        ('Doris Barbell','https://gym.paccoco.com','barbell','Training desk','Body metrics, routines, workouts, and progression dossiers.'),
     ]
     cards=[]
     active_key='dashboard' if active=='home' else active

home/doris-dashboard/docs/hermes-dashboard-trusted-access-apply-2026-05-24.md

@@ -0,0 +1,81 @@
+# Hermes dashboard Trusted-only Policy Engine apply — 2026-05-24
+
+## Live change summary
+Applied the narrow UniFi Policy Engine service slice that makes the Hermes dashboard on Nomad effectively Trusted-only.
+
+Dashboard endpoint:
+- `10.5.30.7:9119`
+
+Apply time artifact stamp:
+- `2026-05-24-061715`
+
+## What changed
+Created these two custom firewall policies:
+
+1. `Allow Trusted to Hermes Dashboard`
+- id: `6a1297eefb913dd84d4a3fbb`
+- action: `ALLOW`
+- protocol: `tcp`
+- source: `10.5.1.0/24`
+- destination: `10.5.30.7`
+- destination port: `9119`
+- schedule: `ALWAYS`
+
+2. `Block Management and Servers to Hermes Dashboard`
+- id: `6a1297eefb913dd84d4a3fc0`
+- action: `BLOCK`
+- protocol: `tcp`
+- source: `10.5.0.0/24`, `10.5.30.0/24`
+- destination: `10.5.30.7`
+- destination port: `9119`
+- schedule: `ALWAYS`
+
+## Verification result
+- Pre-apply baseline did not already contain either Hermes-dashboard policy.
+- Post-apply readback shows both rules present as non-predefined custom policies.
+- Apply helper returned no API errors.
+
+## Artifacts
+Baselines and apply output saved in:
+- `home/doris-dashboard/docs/baselines/unifi-firewall-policies-custom-2026-05-24-061715-pre-hermes-dashboard-slice.json`
+- `home/doris-dashboard/docs/baselines/unifi-hermes-dashboard-policy-apply-2026-05-24-061715.json`
+- `home/doris-dashboard/docs/baselines/unifi-firewall-policies-custom-2026-05-24-061715-post-hermes-dashboard-slice.json`
+
+Helper added to repo and copied to PD runtime for repeatable staging/apply:
+- repo: `automation/bin/unifi_stage_hermes_dashboard_policy.py`
+- PD runtime: `/mnt/docker-ssd/docker/compose/automation/bin/unifi_stage_hermes_dashboard_policy.py`
+
+## Representative lane probe after apply
+Follow-up live check from PD showed an important enforcement caveat.
+
+From PD (`10.5.30.6`) to Nomad (`10.5.30.7:9119`):
+- direct TCP connect succeeded
+- HTTP GET succeeded with `200 OK`
+- route on PD is on-link: `10.5.30.7 dev enp3s0f0 src 10.5.30.6`
+
+Interpretation:
+- PD and Nomad are both on the `Servers` subnet (`10.5.30.0/24`)
+- this flow stays L2-local and does not traverse the UniFi gateway
+- therefore the gateway Policy Engine block does not stop PD from reaching the dashboard even though the custom rule exists
+
+What the current rule set still likely achieves:
+- Trusted clients on `10.5.1.0/24` can reach the dashboard
+- routed Management-lane access should still be governed by the custom block
+- same-subnet Servers peers are not isolated by this gateway-only approach
+
+## Operator validation still worth doing
+Because same-subnet east-west traffic bypasses the gateway enforcement point, the right checks are now:
+- from a Trusted client: confirm `http://hermes.home.paccoco.com:9119` or the intended dashboard URL still loads
+- from a Management client on a different subnet: confirm `10.5.30.7:9119` is blocked
+- do not treat PD->Nomad reachability as proof the rule failed globally; it specifically proves intra-subnet server peers need host-local enforcement if they must be excluded
+
+## If true Trusted-only must exclude PD and other Servers peers
+Use one of these instead of relying only on the gateway policy:
+- add a host firewall on Nomad permitting only Trusted-source addresses/subnets to port `9119`
+- move the dashboard to a lane where disallowed sources must cross a routed boundary
+- use switch/ACL mechanisms that can enforce same-subnet isolation if available
+
+## Rollback
+Fastest rollback is to delete the two Hermes-dashboard custom rules by id or rerun a small helper update that disables/removes them:
+- `6a1297eefb913dd84d4a3fbb`
+- `6a1297eefb913dd84d4a3fc0`

home/doris-dashboard/docs/legacy-cia-triage-worksheet.md

@@ -2,6 +2,11 @@
 
 > For Doris: this worksheet exists so tomorrow does not devolve into vibes and guessing. Every device on Legacy CIA gets one label: migrate, quarantine, or kill.
 
+Historical status note:
+- this is a 2026-05-22 migration worksheet, not the current remaining-work checklist
+- do not treat its "tomorrow" language as active backlog without checking later result docs
+- current truth for Protect accessories lives in `unifi-protect-doorbell-chime-current-state-2026-05-26.md`
+
 Goal: classify every remaining device on the legacy CIA Via VLAN/SSID so we can make deliberate decisions during and after the cutover.
 
 Rules:
@@ -47,8 +52,8 @@ Use `kill` when all or most are true:
 - MyQ -> IoT VLAN 40
 - Samsung FamilyHub -> IoT VLAN 40
 - LG dryer -> IoT VLAN 40
-- doorbell -> Cameras VLAN 60
+- doorbell -> Cameras VLAN 60 only if immediate validation is available
-- Protect chimes -> Cameras VLAN 60
+- Protect chimes -> Cameras VLAN 60 only after explicit Protect-path validation; current known-good live state keeps them on Management/default `UniFi Wireless`
 
 ### Migrate later / careful handling
 - Google Home Mini -> IoT VLAN 40 after discovery testing
@@ -114,7 +119,7 @@ If answers are bad, it does not earn migration tomorrow.
 
 ### Protect chimes / doorbell
 - These are not Legacy CIA end-state residents.
-- Move to Cameras/Security as early cleanup.
+- Treat Cameras/Security as the target design, not an automatic next action. The Wi-Fi chimes currently have a documented Management/default-SSID exception because the Camera override broke Protect health.
 
 ### old bulbs / old plugs
 - If still useful but irrecoverable, quarantine.

home/doris-dashboard/docs/network-cutover-master-operator-sheet.md

@@ -2,6 +2,11 @@
 
 > For Doris: this is the one-page live operator sheet for tomorrow. Use this instead of bouncing between five docs while tired.
 
+Historical status note:
+- this file is a 2026-05-22 live cutover sheet, not the current remaining-work source of truth
+- do not treat its open checkboxes or "tomorrow" language as active backlog
+- current truth lives in `network-migration-remaining-checklist-2026-05-22.md` and `unifi-protect-doorbell-chime-current-state-2026-05-26.md`
+
 Goal: execute the UniFi network redesign with minimal improvisation, explicit stop/go gates, per-port actions, per-device dispositions, and fast rollback discipline.
 
 Architecture:
@@ -43,7 +48,7 @@ Current client counts:
 - Trusted: 14
 
 Current hazards:
-- two unnamed `espressif` devices are on Management via `UniFi Wireless` on the U7 Pro
+- the two historical `espressif` Management hazards are now known Protect WiFi chimes, not unidentified junk
 - almost all Wi‑Fi clients are on the U7 Pro
 - there are no custom firewall rules/groups yet, so tomorrow’s segmentation policy is basically greenfield
 
@@ -110,7 +115,7 @@ Stop/go gate:
 - [ ] Trusted admin path still fine
 
 ### Minute 20-35: management cleanup first
-- [ ] identify/address the 2 Management `espressif` devices
+- [ ] confirm the two former Management `espressif` devices are still understood as the documented Protect-chime exception
 - [ ] ensure infra devices remain on Management intent
 - [ ] remove obvious non-infra junk from Management
 
@@ -120,7 +125,7 @@ Stop/go gate:
 
 ### Minute 35-50: security cleanup
 - [ ] validate Camera lane
-- [ ] move Protect chimes if ready
+- [ ] move Protect chimes only if Protect health is explicitly validated during the move
 - [ ] confirm doorbell remains healthy
 
 ### Minute 50-85: core server move wave
@@ -160,22 +165,22 @@ Stop/go gate:
 
 ## 5. Management Offender Sheet
 
-These two devices are currently on Management and need identification or removal from that lane:
+These two devices were the historical Management offenders that needed identification. They are no longer mystery devices, and they are not a rediscovery task:
 
 1. `espressif`
 - IP: `10.5.0.123`
 - AP: `U7 Pro`
 - SSID: `UniFi Wireless`
-- Default call: identify first; if it is smart-junk, move/quarantine off Management
+- Current call: known Protect WiFi chime; keep on the documented Management/default-SSID exception unless doing an explicit Protect-validation move
 
 2. `espressif`
 - IP: `10.5.0.189`
 - AP: `U7 Pro`
 - SSID: `UniFi Wireless`
-- Default call: identify first; if it is smart-junk, move/quarantine off Management
+- Current call: known Protect WiFi chime; keep on the documented Management/default-SSID exception unless doing an explicit Protect-validation move
 
 Operator note:
-- these are almost certainly exactly the sort of device that should not live on your infrastructure lane
+- target architecture still says these belong with security estate, but the current known-good live state keeps them on Management/default `UniFi Wireless` because the Camera override failed in Protect
 
 ## 6. Exact Core Port Move Sheet
 
@@ -272,10 +277,14 @@ Rule:
 Already true:
 - `front-doorbell` is already on Camera at `10.5.20.217`
 
-Tomorrow’s security work is therefore mainly:
+Current known-good chime exception:
-- move/clean up chimes
+- Protect WiFi Chime `upstairs landing` is intentionally on Management/default `UniFi Wireless` at `10.5.0.123`
-- tighten policy
+- Protect WiFi Chime `Living Room` is intentionally on Management/default `UniFi Wireless` at `10.5.0.189`
+
+If revisiting security work, the goal is therefore:
 - preserve the doorbell’s healthy state
+- tighten policy carefully
+- only revisit chime placement during an explicit Protect-validation test
 
 ## 9. Firewall Build Priorities
 

home/doris-dashboard/docs/network-cutover-minute-checklist.md

@@ -2,6 +2,11 @@
 
 > For Doris: this is the live change-window script. Use it like a pilot checklist, not a brainstorming prompt.
 
+Historical status note:
+- this file is a 2026-05-22 cutover script, not the current remaining-work checklist
+- do not treat unchecked boxes or "tomorrow" phrasing here as active backlog
+- current truth lives in `network-migration-remaining-checklist-2026-05-22.md` and `unifi-protect-doorbell-chime-current-state-2026-05-26.md`
+
 Goal: execute the redesign tomorrow with deliberate pauses, validation after every block of changes, and clean rollback points.
 
 Assumptions:
@@ -83,7 +88,7 @@ Stop/go check:
 - [ ] Confirm UDM, switches, and APs are mapped to Management intent.
 - [ ] Remove obvious non-infrastructure devices from Management.
 - [ ] Identify any stragglers remaining in Management and list them.
-- [ ] If Security lane is ready, prepare to move chimes immediately.
+- [ ] If revisiting Protect accessory placement, first confirm the documented chime Management exception and only move them during explicit Protect validation.
 
 Validation:
 - [ ] UniFi still sees gateway, switches, APs.
@@ -97,9 +102,9 @@ Rollback trigger:
 
 - [ ] Activate/validate Cameras VLAN 60.
 - [ ] Activate Security SSID if needed.
-- [ ] Move Protect chimes.
+- [ ] Move Protect chimes only if Protect health is validated during the move.
-- [ ] Move doorbell if ready.
+- [ ] Move doorbell only if immediate post-move validation is available.
-- [ ] Confirm no security devices remain polluting Management.
+- [ ] Confirm any remaining security-device Management exception is documented explicitly.
 
 Validation:
 - [ ] device rejoins expected lane
@@ -107,7 +112,7 @@ Validation:
 - [ ] no broad emergency rules added yet
 
 Rollback trigger:
-- [ ] If doorbell/chimes become unrecoverable fast, revert that device only.
+- [ ] If doorbell/chimes become unrecoverable fast, revert that device only; for the Wi-Fi chimes, clearing the Camera override and returning to Management/default `UniFi Wireless` is the known-good rollback.
 
 ## Minute 50-75: move core servers to Servers VLAN 30
 

home/doris-dashboard/docs/network-cutover-red-team-card.md

@@ -2,6 +2,10 @@
 
 Use this during the live window when your brain gets dumb.
 
+Historical status note:
+- this card belongs to the 2026-05-22 cutover-planning wave
+- keep it as operator evidence, but do not treat it as the current backlog without checking later migration result docs
+
 Goal:
 - make one clean change
 - validate it

home/doris-dashboard/docs/network-migration-remaining-checklist-2026-05-22.md

@@ -2,10 +2,14 @@
 
 Current intent: only safe, low-drama follow-up work remains. The easy-value client cleanup already completed should not be re-run.
 
+Current truth note:
+- use this file plus `unifi-protect-doorbell-chime-current-state-2026-05-26.md` as the source of truth for what is actually still pending
+- treat earlier cutover-prep docs with "tomorrow" language as historical planning artifacts unless they were explicitly updated later
+
 ## Already completed
 - Servers network/profile exists in UniFi
-- Protect WiFi Chime `upstairs landing` moved from Management -> Camera
+- Historical attempt moved both Protect WiFi chimes from Management -> Camera, but that change was later reversed after Protect health failed on the Camera-lane override
-- Protect WiFi Chime `Living Room` moved from Management -> Camera
+- Current known-good state keeps both Protect WiFi chimes on Management / default `UniFi Wireless`; see `unifi-protect-doorbell-chime-current-state-2026-05-26.md`
 - `LG_Smart_Laundry2_open` moved from Trusted -> IoT
 - `MyQ-29B` moved from Old IoT -> IoT
 - `LG_Smart_Dryer2_open` moved from Old IoT -> IoT
@@ -28,6 +32,7 @@ Current intent: only safe, low-drama follow-up work remains. The easy-value clie
    - keep unknown Legacy CIA devices explicitly quarantine-first
    - Trusted-lane Intellirocks cleanup is now resolved separately; see `intellirocks-triage-result-2026-05-23.md`
    - Legacy CIA leftovers are now dispositioned separately; see `unifi-legacy-cia-closeout-2026-05-23.md`
+   - Protect chime lane cleanup is intentionally deferred until Protect connectivity is explicitly re-validated on a non-Management lane
 
 3. Non-disruptive firewall planning cleanup
    - compare staged firewall objects/policies against desired rule order
@@ -96,6 +101,7 @@ Important distinction:
 - final validation sweep
 - confirm no temporary panic exceptions remain
 - document any intentionally deferred weird devices
+- keep the Protect doorbell/chime exception documented until a future validated lane migration replaces it
 
 ## Suggested execution order from here
 1. Wait for laptop session

home/doris-dashboard/docs/network-redesign-implementation-runbook.md

@@ -2,6 +2,11 @@
 
 > For Doris: use this during the live UniFi change window. Goal is a controlled cutover with explicit validation and rollback at each boundary.
 
+Historical status note:
+- this runbook came from the 2026-05-22 cutover-planning wave
+- preserve it as the detailed plan, but do not treat every "tomorrow" step as still pending without checking later result docs
+- current remaining-work truth lives in `network-migration-remaining-checklist-2026-05-22.md` and `unifi-protect-doorbell-chime-current-state-2026-05-26.md`
+
 Goal: deploy the target VLAN/SSID/firewall design with minimum drama, keep legacy CIA Via as a quarantine lane for devices that cannot yet be migrated, and finish the window with an understandable, supportable network.
 
 Architecture summary:
@@ -258,7 +263,7 @@ Exit criteria:
 ### Phase C: Management cleanup first
 1. Ensure UDM, switches, and AP management surfaces are on VLAN 10 intent.
 2. Remove obvious non-infrastructure devices from Management.
-3. Move Protect chimes out of Management as top cleanup item if Security lane is ready.
+3. Treat Protect chimes as a documented temporary Management exception unless you are explicitly re-validating their Protect health on a non-Management lane.
 4. Re-validate UniFi visibility of gateway, switches, APs.
 
 Rollback if:
@@ -272,14 +277,14 @@ Exit criteria:
 ### Phase D: Build/activate Cameras lane
 1. Activate/validate `NET-CAMERAS`.
 2. Activate `Security` SSID if used.
-3. Move doorbell and Protect chimes to Cameras/Security.
+3. Move doorbell and Protect chimes to Cameras/Security only if Protect health is explicitly validated during the move.
 4. Validate app/admin behavior.
 
 Rollback if:
 - security devices fall offline and cannot be recovered quickly
 
 Exit criteria:
-- doorbell/chimes are no longer polluting Management
+- either doorbell/chimes are healthy on Cameras/Security, or the documented Management exception is preserved intentionally
 - Camera lane exists for future growth
 
 ### Phase E: Move core servers to Servers VLAN 30
@@ -353,8 +358,8 @@ Exit criteria:
 ## 9. Explicit Device Triage
 
 Move tomorrow if practical:
-- Protect chimes
+- Protect chimes only during an explicit Protect-validation test
-- doorbell
+- doorbell only if healthy-state validation is immediate and reversible
 - PD
 - Serenity
 - Nomad
@@ -403,6 +408,7 @@ Minimum successful tomorrow outcome:
 - IoT lane exists and at least easy-value devices are moved
 - Legacy CIA is converted into explicit quarantine/sunset lane
 - no broad insecure exceptions were added out of fatigue
+- any documented temporary Protect chime exception is written down instead of being rediscovered later
 
 Nice-to-have, not mandatory tomorrow:
 - U6 LR restored and tuned

home/doris-dashboard/docs/network-redesign-plan.md

@@ -49,6 +49,11 @@ Architecture summary:
 - Contains: doorbell, Protect chimes, future cameras, NVR-adjacent accessories, security-specific Wi-Fi endpoints
 - Policy: no broad access to LAN; only specific flows to Protect/NVR services and operator/admin clients
 
+Current live exception:
+- this is still the target design, not the currently proven-safe lane for every Protect accessory
+- a 2026-05-22 client-override attempt put the Wi-Fi chimes on the Camera lane, but they later had to be returned to Management/default `UniFi Wireless` because Protect health failed there
+- future camera/security-lane work must preserve this documented exception until Protect connectivity is explicitly re-validated
+
 ## SSID Plan
 
 Preferred steady-state SSIDs:
@@ -107,7 +112,7 @@ IoT / Smart Home:
 
 Cameras / Security:
 - front-doorbell
-- Protect chimes
+- Protect chimes (target design; current live exception keeps the Wi-Fi chimes on Management/default `UniFi Wireless` until Protect validation exists on the security lane)
 - future wired/PoE cameras
 - future Wi-Fi security accessories
 
@@ -176,7 +181,7 @@ Phase 2: servers
 - update DNS/static mappings/firewall rules
 
 Phase 3: cameras/security
-- move doorbell and chimes to VLAN 60
+- move doorbell and chimes to VLAN 60 only after explicit Protect-path validation proves that the Wi-Fi chimes stay healthy there
 - prepare room for future camera growth
 
 Phase 4: IoT migration

home/doris-dashboard/docs/old-iot-tomorrow-disposition-list.md

@@ -2,6 +2,10 @@
 
 > For Doris: this is the concrete disposition call for every current live Old IoT client seen during read-only recon. This is the list to use tomorrow unless live validation proves otherwise.
 
+Historical status note:
+- this is a 2026-05-22 planning artifact
+- several "tomorrow" items here were completed later; do not use this file as the current backlog without checking `network-migration-remaining-checklist-2026-05-22.md`
+
 Source basis:
 - live UniFi read-only recon on 2026-05-22
 - all devices listed were active on SSID `CIA Via` through the `U7 Pro`

home/doris-dashboard/docs/unifi-client-cleanup-shortlist-2026-05-22.md

@@ -1,5 +1,7 @@
 # UniFi Client Cleanup Shortlist
 
+Status note: this file started as a live shortlist on 2026-05-22. Most of the appliance/thermostat cleanup in here is completed. For the current Protect doorbell/chime truth, do not rely on the original chime recommendation below without also reading `unifi-protect-doorbell-chime-current-state-2026-05-26.md`.
+
 Live basis:
 - Captured from PD with `python3 automation/bin/unifi_network.py --raw`
 - Capture time: 2026-05-22 21:45:20 UTC
@@ -40,8 +42,8 @@ These are the clearest remaining misclassifications, and the smart-appliance tar
   - Why: vendor-family clustering strongly suggests it belongs with the other low-trust embedded devices, not with human/operator endpoints.
   - Caution: identify before moving if possible; if unknown, do not promote it by leaving it in Trusted.
 
-## Management offenders
+## Management offenders (historical identification, but not current next-step guidance)
-These are now identified and should not remain on Management.
+These were correctly identified on 2026-05-22, but the original recommendation to re-home them immediately to `Camera` / security is no longer the standing advice.
 
 - `58:d6:1f:54:e5:6d` (`10.5.0.123`, hostname `espressif`)
   - Identified as: UniFi Protect WiFi Chime
@@ -56,7 +58,9 @@ These are now identified and should not remain on Management.
 Notes:
 - Both are Wi-Fi clients on `UniFi Wireless`.
 - UniFi fingerprint metadata reports `product_line=unifi-protect` and `product_model=Protect WiFi Chime`.
-- This means they are not mystery ESP junk anymore; they are known Protect accessories that should be treated like camera/security estate, not management-plane clients.
+- This means they are not mystery ESP junk anymore; they are known Protect accessories.
+- Current known-good live state keeps them on Management/default `UniFi Wireless` because the Camera-lane override caused them to show offline in Protect.
+- Do not re-home these two chimes again unless Protect connectivity is explicitly validated during the move.
 
 ## Old IoT move-now set
 These still look like the cleanest deliberate moves from `CIA Via` into `IoT`.
@@ -88,7 +92,7 @@ Leave these in legacy quarantine unless/until they are identified better.
 If doing a low-drama cleanup pass, use this order:
 
 1. Move `LG_Smart_Laundry2_open` out of `Trusted` into `IoT`
-2. Re-home the two identified Protect chimes out of `Management` into `Camera` / security
+2. Leave the two identified Protect chimes on their current known-good Management/default-SSID path unless you are doing an explicit Protect-validation test
 3. Migrate the approved Old IoT move-now set into `IoT`, one app-validated batch at a time
 4. Leave Google/cast-class gear for later unless everything else is stable
 5. Keep unknown leftovers quarantined; do not “clean them up” by granting `Trusted`
@@ -98,5 +102,5 @@ The clearest remaining lane problems are now:
 - one approved LG appliance still sitting in `Trusted`
 - one likely Google cast/display-class client in `Trusted`
 - one likely Intellirocks smart-home client in `Trusted`
-- two now-identified Protect chimes still sitting in `Management`
+- the Protect chimes are a documented temporary exception, not a rediscovery task
 - the approved appliance/thermostat/MyQ devices still lingering in `Old IoT`

home/doris-dashboard/docs/unifi-client-rehome-results-2026-05-22.md

@@ -1,13 +1,15 @@
 # UniFi Client Rehome Results
 
+Historical execution note: this file records what was applied on 2026-05-22, not the final lasting truth for every device. For the current known-good Protect doorbell/chime state, see `unifi-protect-doorbell-chime-current-state-2026-05-26.md`.
+
 Executed from PD against the live UniFi controller using per-client virtual network overrides plus targeted `kick-sta` reconnects.
 
-## Requested changes completed
+## Requested changes applied on 2026-05-22
 
 ### Trusted -> IoT
 - `LG_Smart_Laundry2_open` (`60:ab:14:5f:b4:ba`) -> `IoT` -> `10.5.10.141`
 
-### Management -> Camera
+### Management -> Camera (historical attempt; later reverted for the chimes)
 - Protect WiFi Chime `upstairs landing` (`58:d6:1f:54:e5:6d`) -> `Camera` -> `10.5.20.191`
 - Protect WiFi Chime `Living Room` (`58:d6:1f:54:e5:af`) -> `Camera` -> `10.5.20.8`
 
@@ -18,11 +20,23 @@ Executed from PD against the live UniFi controller using per-client virtual netw
 - `Main-Floor` ecobee (`44:61:32:1d:ee:8f`) -> `IoT` -> `10.5.10.160`
 - `Upstairs` ecobee (`44:61:32:3f:0b:4c`) -> `IoT` -> `10.5.10.64`
 
-## Validation result
+## Validation result at the time
-All 8 targeted clients were re-read live from `stat/sta` and matched their intended target lanes.
+All 8 targeted clients were re-read live from `stat/sta` and matched their intended target lanes during the 2026-05-22 apply window.
+
+Important caveat:
+- lane placement success in UniFi Network did not prove Protect health for the chimes
+- a later follow-up showed the two chimes could appear associated in UniFi Network while still showing offline in Protect
+
+## Follow-up result that supersedes the chime portion
+
+Later known-good state:
+- Protect WiFi Chime `upstairs landing` was returned to `Management` / default `UniFi Wireless` -> `10.5.0.123`
+- Protect WiFi Chime `Living Room` was returned to `Management` / default `UniFi Wireless` -> `10.5.0.189`
+- the Camera-lane virtual-network override for the chimes should now be treated as a failed experiment in this environment, not as the standing recommendation
 
 ## Notes
 - Rehome mechanism used: `PUT /rest/user/<id>` with `network_id`, `virtual_network_override_enabled=true`, and `virtual_network_override_id=<target_network_id>`
 - Reconnect mechanism used: `POST /cmd/stamgr` with `cmd=kick-sta`
 - `LG_Smart_Laundry2_open` had a temporary probe note during discovery; it was cleared during the live apply
 - Some clients still show their original SSID names in UniFi telemetry even after landing on the target virtual network override; the authoritative validation point for this pass was the live `network` / `network_id` state
+- The Protect lesson learned here is specific and important: a client can look correctly placed in UniFi Network while still being unhealthy in Protect.

home/doris-dashboard/docs/unifi-live-preflight-snapshot-2026-05-22.md

@@ -1,5 +1,10 @@
 # UniFi Live Preflight Snapshot
 
+Historical snapshot note:
+- this file is a dated preflight capture from 2026-05-22
+- preserve it as evidence, but do not treat it as the current source of truth for remaining work or final device placement
+- later results and reversals are documented in `network-migration-remaining-checklist-2026-05-22.md` and `unifi-protect-doorbell-chime-current-state-2026-05-26.md`
+
 Date: 2026-05-22
 Mode: read-only live pull from PD using the Doris UniFi operator account
 Controller: `https://10.5.0.1`
@@ -82,7 +87,7 @@ Interpretation:
 - `58:d6:1f:54:e5:6d` -> `10.5.0.123`
 - `58:d6:1f:54:e5:af` -> `10.5.0.189`
 
-These are still the two management-lane ESP-class offenders to identify or evict.
+Historical interpretation only: these were later identified as the two Protect WiFi chimes, so this section is evidence of the pre-identification state, not an open rediscovery task.
 
 ## Fresh anomalies vs the earlier planning assumptions
 

home/doris-dashboard/docs/unifi-protect-doorbell-chime-current-state-2026-05-26.md

@@ -0,0 +1,60 @@
+# UniFi Protect Doorbell / Chime Current State — 2026-05-26
+
+Purpose: capture the current known-good state for the adopted doorbell and the two Protect WiFi chimes so future cleanup work does not accidentally re-run a reverted change.
+
+## Status summary
+
+Current known-good state:
+- `front-doorbell` remains the Protect doorbell endpoint
+- Protect WiFi Chime `upstairs landing` is intentionally on `Management` / default `UniFi Wireless`
+- Protect WiFi Chime `Living Room` is intentionally on `Management` / default `UniFi Wireless`
+- per-client Camera virtual-network overrides for the chimes should remain disabled unless a later validation proves a safe Protect path on the Camera/Security lane
+
+Current chime IPs from the last known-good state:
+- `upstairs landing` -> `10.5.0.123`
+- `Living Room` -> `10.5.0.189`
+
+## What changed from the earlier migration notes
+
+Historical 2026-05-22 action:
+- both chimes were moved from `Management` to `Camera` using per-client virtual network overrides
+- UniFi Network showed them associated on the target lane
+
+Why that is not the source of truth anymore:
+- in this environment, the Camera-lane override made the chimes show offline in Protect even though UniFi Network still showed them connected
+- the working fix was to remove the Camera override and let the chimes return to the known-good Management/default-SSID path
+
+Operational conclusion:
+- treat the 2026-05-22 chime move as a historical experiment, not a standing recommendation
+- do not re-home the chimes to `Camera` / `Security` as routine cleanup without fresh Protect validation
+
+## Doorbell adoption note
+
+After a doorbell is re-adopted:
+- verify the chimes are still logically bound to the current adopted doorbell object
+- if chime ringing breaks even though the devices are online, check whether each chime's `ringSettings.cameraId` still points at the old doorbell object instead of the current adopted one
+
+This is separate from the network-lane issue:
+- network-lane failure symptom: chime looks connected in UniFi Network but offline in Protect
+- adoption-binding failure symptom: doorbell is adopted and devices are online, but the chimes do not ring for the current doorbell object
+
+## Future-state intent versus current safe state
+
+Long-term design intent still favors a dedicated Camera/Security lane and SSID for Protect accessories.
+
+Current safe live state is narrower:
+- doorbell can stay where it is if healthy
+- chimes stay on Management/default `UniFi Wireless` until Protect connectivity is explicitly re-validated on the Camera/Security lane
+- future migration is blocked on proving the required Protect path, not on re-discovering the device identities
+
+## Files that were updated to reflect this
+
+Key current-truth docs:
+- `network-migration-remaining-checklist-2026-05-22.md`
+- `unifi-client-cleanup-shortlist-2026-05-22.md`
+- `unifi-client-rehome-results-2026-05-22.md`
+- `unifi-ssid-cleanup-proposal-2026-05-23.md`
+- `network-redesign-plan.md`
+- `network-redesign-implementation-runbook.md`
+
+Historical planning/snapshot docs were also marked so they are not mistaken for current next-step instructions.

home/doris-dashboard/docs/unifi-readonly-recon-2026-05-22.md

@@ -1,5 +1,10 @@
 # UniFi Read-Only Recon Notes
 
+Historical snapshot note:
+- this file records the 2026-05-22 read-only discovery pass
+- preserve it as evidence, but do not use it as the current next-step checklist without checking later outcome docs
+- later results and reversals are documented in `network-migration-remaining-checklist-2026-05-22.md` and `unifi-protect-doorbell-chime-current-state-2026-05-26.md`
+
 Date: 2026-05-22
 Mode: read-only only
 Auth status: verified working with upgraded Doris admin login
@@ -79,9 +84,9 @@ Likely quarantine until identified better:
 ### 6. Camera lane live state
 - `front-doorbell` is already on Camera network at `10.5.20.217`
 
-Interpretation:
+Interpretation at the time:
-- the doorbell is already where it belongs logically
+- the doorbell was already in the expected camera lane during this snapshot
-- tomorrow’s security cleanup work is mainly about chimes and future policy tightening
+- later follow-up changed the chime guidance, so do not treat this paragraph as the final remaining-work instruction set
 
 ### 7. Trusted lane still carrying infrastructure-class hosts
 Trusted currently includes:
@@ -131,8 +136,8 @@ Interpretation:
 - Rocinante needs a quick extra look because the client is live on port 2 but that port did not show an explicit profile name in the returned record
 
 ## Recommended next actions for tomorrow
-1. identify the two Management `espressif` devices before or during the window
+1. historical note: the two Management `espressif` devices were later identified as Protect WiFi chimes; do not treat this as an open rediscovery task
 2. move/changeprofile for server ports on the USW Pro HD 24 one at a time
 3. treat Google devices as late-batch or defer
 4. treat unknown Old IoT clients as quarantine by default, not migration by default
-5. keep Camera cleanup focused on chimes and policy, because the doorbell is already in the correct lane
+5. keep Camera cleanup focused on validated policy and documented exceptions; the doorbell was already in the correct lane during this snapshot, but later chime guidance changed

home/doris-dashboard/docs/unifi-ssid-cleanup-proposal-2026-05-23.md

@@ -2,6 +2,10 @@
 
 Purpose: turn the remaining SSID cleanup into an exact low-risk keep/retire proposal before any live Wi-Fi changes.
 
+Status note:
+- this remains useful as a keep/retire proposal, but the Protect chime portion must now be read together with `unifi-protect-doorbell-chime-current-state-2026-05-26.md`
+- current known-good chime behavior is on Management/default `UniFi Wireless`, not on the Camera/Security lane
+
 ## Basis
 Artifact-based planning only. No live SSID edits were made in this pass.
 
@@ -87,8 +91,11 @@ Long-term, the network should converge on:
   - doorbell and Protect-chime estate justify a distinct security SSID
   - keeping security separate from generic IoT matches the redesign intent and future camera growth plan
 - Preconditions to call it final:
-  - doorbell/chimes remain healthy
+  - doorbell/chimes remain healthy after explicit Protect validation on that lane
   - no evidence that merging them into general IoT would be safer or simpler
+- Current caution:
+  - treat the Security SSID as future-state design intent, not proof that the Wi-Fi chimes are safe there today
+  - the current known-good live path for the chimes is still Management/default `UniFi Wireless`
 
 ### 5) Guest SSID
 - Proposed role: `create or enable separately when ready`
@@ -116,6 +123,7 @@ This is the safest order based on current evidence:
 - do not rename and repurpose a live SSID in one step if disabling/creating separately would be clearer
 - do not infer that Google/cast is solved globally from one successful pilot reassociation
 - do not collapse Security into generic IoT unless there is a deliberate design change
+- do not assume that because `UNEF's Playhouse` exists, the Protect chimes are already proven safe on it
 
 ## Practical one-page operator version
 If you want the shortest operator call:

home/doris-dashboard/docs/usw-pro-hd-24-cutover-port-sheet.md

@@ -2,6 +2,10 @@
 
 > For Doris: this is the mechanical switch-port sheet for tomorrow. Do not freestyle. Change one thing, validate, then continue.
 
+Historical status note:
+- this is a 2026-05-22 cutover sheet, preserved as evidence of the original plan
+- do not treat its "tomorrow" wording as active backlog without checking later migration result docs
+
 Source basis:
 - live UniFi read-only recon on 2026-05-22
 - /home/fizzlepoof/repos/truenas-stacks/home/doris-dashboard/docs/unifi-readonly-recon-2026-05-22.md

home/doris-kitchen/app/templates/base.html

@@ -21,7 +21,7 @@
           <a class="nav-link" href="http://10.5.30.7:8787/">Dashboard</a>
           <a class="nav-link" href="http://10.5.30.7:8787/services.html">Services</a>
           <a class="nav-link" href="https://schoolhouse.paccoco.com/">Schoolhouse</a>
-          <a class="nav-link" href="http://10.5.30.6:8093/">Barbell</a>
+          <a class="nav-link" href="https://gym.paccoco.com/">Barbell</a>
         </nav>
       </div>
       <div class="casefile-title-row">
@@ -137,7 +137,7 @@
             <strong>Doris Schoolhouse</strong>
             <small>Assignments, recordings, and archive intake.</small>
           </a>
-          <a class="family-app-card" href="http://10.5.30.6:8093/">
+          <a class="family-app-card" href="https://gym.paccoco.com/">
             <span class="family-app-kicker">Training desk</span>
             <strong>Doris Barbell</strong>
             <small>Weights, routines, workouts, and progression snapshots.</small>

home/doris-schoolhouse/app/routes/api_assignments.py

@@ -1,6 +1,7 @@
 import hashlib
 from pathlib import Path
 from typing import Any
+from urllib.parse import quote_plus
 
 from fastapi import APIRouter, File, Form, HTTPException, Request, UploadFile
 from fastapi.responses import RedirectResponse
@@ -40,33 +41,49 @@ def _confirm_submission_to_paperless(current: dict) -> dict:
         if value:
             fields[optional_key] = value
     artifact_kind = handoff.get("artifact_kind") or "document"
-    if artifact_kind == "source_bundle":
+    response: dict[str, Any]
-        paperless_response = paperless.upload_source_bundle_receipt(current)
+    body_obj: dict[str, Any]
-        enrichment = paperless.enrich_direct_submission(current, paperless_response)
+    ok = False
+    error_detail = None
+    try:
+        if artifact_kind == "source_bundle":
+            paperless_response = paperless.upload_source_bundle_receipt(current)
+            enrichment = paperless.enrich_direct_submission(current, paperless_response)
+            response = {
+                "ok": True,
+                "status_code": 200,
+                "body": paperless_response,
+                "mode": "direct-paperless",
+                "enrichment": enrichment,
+            }
+            task_id = paperless_response.get("task_id") or paperless_response.get("id")
+            body_obj = {
+                "paperless_document_id": enrichment.get("document_id"),
+                "paperless_title": enrichment.get("title") or paperless.build_submission_title(current),
+                "paperless_task_id": task_id,
+                "paperless_metadata": enrichment.get("metadata_payload"),
+            }
+            ok = True
+        else:
+            if handoff.get("artifact_kind"):
+                fields["artifact_kind"] = str(handoff["artifact_kind"])
+            if handoff.get("file_count"):
+                fields["file_count"] = str(handoff["file_count"])
+            response = webhooks.post_multipart(handoff["target_url"], fields, "document", file_path)
+            body = response.get("body", {}) if isinstance(response, dict) else {}
+            body_obj = body[0] if isinstance(body, list) and body and isinstance(body[0], dict) else (body if isinstance(body, dict) else {})
+            ok = bool(response.get("ok", False)) if isinstance(response, dict) else False
+        if not ok:
+            error_detail = str(response.get("error") or response.get("body") or "Paperless confirmation failed.")
+    except Exception as exc:
+        error_detail = f"{type(exc).__name__}: {exc}"
         response = {
-            "ok": True,
+            "ok": False,
-            "status_code": 200,
+            "status_code": 500,
-            "body": paperless_response,
+            "mode": "direct-paperless" if artifact_kind == "source_bundle" else "webhook",
-            "mode": "direct-paperless",
+            "error": error_detail,
-            "enrichment": enrichment,
         }
-        task_id = paperless_response.get("task_id") or paperless_response.get("id")
+        body_obj = {}
-        body_obj = {
-            "paperless_document_id": enrichment.get("document_id"),
-            "paperless_title": enrichment.get("title") or paperless.build_submission_title(current),
-            "paperless_task_id": task_id,
-            "paperless_metadata": enrichment.get("metadata_payload"),
-        }
-        ok = True
-    else:
-        if handoff.get("artifact_kind"):
-            fields["artifact_kind"] = str(handoff["artifact_kind"])
-        if handoff.get("file_count"):
-            fields["file_count"] = str(handoff["file_count"])
-        response = webhooks.post_multipart(handoff["target_url"], fields, "document", file_path)
-        body = response.get("body", {}) if isinstance(response, dict) else {}
-        body_obj = body[0] if isinstance(body, list) and body and isinstance(body[0], dict) else (body if isinstance(body, dict) else {})
-        ok = bool(response.get("ok", False)) if isinstance(response, dict) else False
     updates = {
         "status": "paperless-queued" if ok else "paperless-error",
         "confirmed_at": store.now(),
@@ -76,6 +93,7 @@ def _confirm_submission_to_paperless(current: dict) -> dict:
         "paperless_task_id": body_obj.get("paperless_task_id"),
     }
     updated = repo.update_submission(str(current.get("id")), updates) or current
+    updated["paperless_error_detail"] = error_detail
     grade_note = None
     if ok and updated.get("assignment_id"):
         grade_note = paperless.append_grade_note_if_available(str(updated.get("assignment_id")))
@@ -87,6 +105,7 @@ def _confirm_submission_to_paperless(current: dict) -> dict:
         "webhook": [response],
         "grade_note": grade_note,
         "file_count": handoff.get("file_count") or 1,
+        "error_detail": error_detail,
     }
 
 
@@ -220,7 +239,10 @@ async def intake_assignment(
         "backend": repo.backend,
     }
     if "text/html" in accept:
-        redirect_url = "/assignments/upload?submitted=" + str(created["id"]) + "&file_count=" + str(bundle["file_count"]) + "&artifact_kind=" + str(created.get("artifact_kind", "document")) + "&paperless_status=" + str(created.get("status", "uploaded-local"))
+        status_value = str(created.get("status", "uploaded-local"))
+        redirect_url = "/assignments/upload?submitted=" + str(created["id"]) + "&file_count=" + str(bundle["file_count"]) + "&artifact_kind=" + str(created.get("artifact_kind", "document")) + "&paperless_status=" + status_value
+        if auto_confirmed and auto_confirmed.get("error_detail"):
+            redirect_url += "&paperless_error=" + quote_plus(str(auto_confirmed["error_detail"]))
         return RedirectResponse(url=redirect_url, status_code=303)
     return response_payload
 

home/doris-schoolhouse/app/templates/assignment_upload.html

@@ -1,12 +1,19 @@
 {% extends 'base.html' %}
 {% block content %}
 {% if request.query_params.get('submitted') %}
-<section class="card form-card notice-card success-card evidence-board">
+{% set paperless_status = request.query_params.get('paperless_status', 'uploaded-local') %}
-  <div class="case-legend"><span class="section-label">Submission packet</span><span class="pill">Filed</span></div>
+<section class="card form-card notice-card {{ 'success-card' if paperless_status == 'paperless-queued' else '' }} evidence-board">
-  <h2>Submission Created</h2>
+  <div class="case-legend"><span class="section-label">Submission packet</span><span class="pill">{{ 'Filed' if paperless_status == 'paperless-queued' else 'Saved locally' }}</span></div>
+  <h2>{{ 'Submission Created' if paperless_status == 'paperless-queued' else 'Submission Saved, Archive Pending' }}</h2>
   <p>Submission {{ request.query_params.get('submitted') }} was created successfully.</p>
   <p class="muted">Artifact: {{ request.query_params.get('artifact_kind', 'document') }} · Files: {{ request.query_params.get('file_count', '1') }}</p>
-  <p class="muted">Paperless status: {{ request.query_params.get('paperless_status', 'uploaded-local') }}</p>
+  <p class="muted">Paperless status: {{ paperless_status }}</p>
+  {% if paperless_status != 'paperless-queued' %}
+  <p class="muted">Schoolhouse kept the submission locally, but the archive handoff failed this time.</p>
+  {% if request.query_params.get('paperless_error') %}
+  <p class="muted">Error: {{ request.query_params.get('paperless_error') }}</p>
+  {% endif %}
+  {% endif %}
 </section>
 {% endif %}
 <section class="card form-card evidence-board">

home/doris-schoolhouse/app/templates/base.html

@@ -21,7 +21,7 @@
           <a class="nav-link" href="http://10.5.30.7:8787/">Dashboard</a>
           <a class="nav-link" href="http://10.5.30.7:8787/services.html">Services</a>
           <a class="nav-link" href="http://10.5.30.7:8092/">Kitchen</a>
-          <a class="nav-link" href="http://10.5.30.6:8093/">Barbell</a>
+          <a class="nav-link" href="https://gym.paccoco.com/">Barbell</a>
         </nav>
       </div>
       <div class="casefile-title-row">
@@ -134,7 +134,7 @@
             <strong>Doris Kitchen</strong>
             <small>Meal discovery, import repair, and planner triage.</small>
           </a>
-          <a class="family-app-card" href="http://10.5.30.6:8093/">
+          <a class="family-app-card" href="https://gym.paccoco.com/">
             <span class="family-app-kicker">Training desk</span>
             <strong>Doris Barbell</strong>
             <small>Workout logs, body metrics, and progression dossiers.</small>

home/minerva-dashboard/.env.example

@@ -0,0 +1,5 @@
+TZ=America/Chicago
+MINERVA_HOST=0.0.0.0
+MINERVA_PORT=8094
+MINERVA_STATE_DIR=/data/state
+MINERVA_SHARED_PASSWORD=

home/minerva-dashboard/.gitignore

@@ -0,0 +1,6 @@
+.env
+.venv/
+__pycache__/
+.pytest_cache/
+/data/
+*.pyc

home/minerva-dashboard/Dockerfile

@@ -0,0 +1,19 @@
+FROM python:3.12-slim
+
+ENV PYTHONDONTWRITEBYTECODE=1 \
+    PYTHONUNBUFFERED=1
+
+WORKDIR /app
+
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends curl \
+    && rm -rf /var/lib/apt/lists/*
+
+COPY requirements.txt ./
+RUN pip install --no-cache-dir -r requirements.txt
+
+COPY app ./app
+
+EXPOSE 8094
+
+CMD ["uvicorn", "app.main:app", "--host", "0.0.0.0", "--port", "8094"]

home/minerva-dashboard/README.md

@@ -0,0 +1,87 @@
+# Minerva Dashboard
+
+Private-first household and personal-assistant dashboard for Manndra, with a Ravenclaw common-room feel and phone-first layout.
+
+## Purpose
+
+Minerva Dashboard is meant to be a calm, useful front page for Manndra's household flow. V1 keeps the data model simple and JSON-backed so the first live slice can be exercised quickly before deeper integrations arrive.
+
+The first pass focuses on:
+
+- agenda and reminders
+- household lists
+- quick notes
+- useful links
+- meal ideas and shortcuts
+- Minerva quick actions for fast capture from a phone
+
+## Runtime shape
+
+- **Repo source:** `home/minerva-dashboard`
+- **Expected live PD runtime:** `/mnt/docker-ssd/docker/compose/minerva-dashboard`
+- **Expected first exposure:** private-first on PD unless later changed
+- **Published app port:** `8094`
+
+Do not run production from an agent workspace.
+
+## V1 defaults
+
+Unless John or Manndra changes direction later, V1 assumes:
+
+- Manndra is the primary active user
+- mobile-friendly first, desktop-usable second
+- elegant Ravenclaw/common-room styling instead of playful novelty clutter
+- JSON-backed state first for speed and easy inspection
+- practical household wording over infra/operator language
+- no live deploy in this scaffold task
+
+## Current scaffold
+
+The scaffold already provides:
+
+- seeded Manndra profile and dashboard copy
+- seeded agenda, reminders, lists, notes, links, meal ideas, shortcuts, and quick actions
+- server-rendered homepage for phone use
+- real themed graphics in visible UI locations (library hero, owl medallion, blue-interior art, Art Nouveau ornament)
+- provenance notes for vendored imagery in `docs/ASSET_SOURCES.md`
+- API endpoints for health, summary, and quick note capture
+- form-based quick note capture from the dashboard
+- Docker, compose, env example, local run helper, and pytest coverage for initial flows
+
+## Current API surface
+
+- `GET /api/health`
+- `GET /api/dashboard/summary`
+- `POST /api/notes/quick-add`
+- `POST /quick-actions/notes`
+
+## Local run
+
+```bash
+cd /home/fizzlepoof/repos/truenas-stacks/home/minerva-dashboard
+python3 -m venv .venv
+. .venv/bin/activate
+pip install -r requirements.txt
+uvicorn app.main:app --reload --port 8094
+```
+
+Or:
+
+```bash
+cd /home/fizzlepoof/repos/truenas-stacks/home/minerva-dashboard
+bin/run-local.sh
+```
+
+## Verification targets
+
+```bash
+curl -fsS http://127.0.0.1:8094/api/health
+curl -fsS http://127.0.0.1:8094/api/dashboard/summary
+curl -fsS http://127.0.0.1:8094/ | grep 'Minerva Dashboard'
+```
+
+## Assumptions captured in scaffold
+
+- Manndra is the first and primary user for this app
+- agenda/reminders are seeded locally until a calendar or Donetick-style integration is chosen
+- the quick-add mutation writes notes first because quick capture from a phone is a strong default for this product shape

home/minerva-dashboard/app/config.py

@@ -0,0 +1,11 @@
+from __future__ import annotations
+
+import os
+from dataclasses import dataclass
+from pathlib import Path
+
+
+@dataclass(slots=True)
+class Settings:
+    app_name: str = 'Minerva Dashboard'
+    default_state_dir: Path = Path(os.environ.get('MINERVA_STATE_DIR', '/tmp/minerva-dashboard-state'))

home/minerva-dashboard/app/main.py

@@ -0,0 +1,27 @@
+from __future__ import annotations
+
+from pathlib import Path
+
+from fastapi import FastAPI
+from fastapi.staticfiles import StaticFiles
+
+from app.config import Settings
+from app.routes.api import router as api_router
+from app.routes.ui import router as ui_router
+from app.services.store import JSONStore
+
+BASE_DIR = Path(__file__).resolve().parent
+
+
+def create_app(state_dir: Path | str | None = None) -> FastAPI:
+    settings = Settings()
+    app = FastAPI(title=settings.app_name)
+    resolved_state_dir = Path(state_dir) if state_dir is not None else settings.default_state_dir
+    app.state.store = JSONStore(resolved_state_dir)
+    app.mount('/static', StaticFiles(directory=BASE_DIR / 'static'), name='static')
+    app.include_router(ui_router)
+    app.include_router(api_router)
+    return app
+
+
+app = create_app()

home/minerva-dashboard/app/models.py

@@ -0,0 +1,26 @@
+from __future__ import annotations
+
+from typing import Any
+
+from pydantic import BaseModel, Field
+
+
+class QuickAddNotePayload(BaseModel):
+    title: str = Field(min_length=1, max_length=120)
+    body: str = Field(min_length=1, max_length=1000)
+    category: str = Field(default='note', min_length=1, max_length=40)
+    source: str = Field(default='quick-add', min_length=1, max_length=40)
+    pinned: bool = False
+
+
+class DashboardSummary(BaseModel):
+    profile: dict[str, Any]
+    counts: dict[str, int]
+    agenda: list[dict[str, Any]]
+    reminders: list[dict[str, Any]]
+    lists: list[dict[str, Any]]
+    notes: list[dict[str, Any]]
+    links: list[dict[str, Any]]
+    meal_ideas: list[dict[str, Any]]
+    shortcuts: list[dict[str, Any]]
+    quick_actions: list[dict[str, Any]]

home/minerva-dashboard/app/routes/api.py

@@ -0,0 +1,22 @@
+from __future__ import annotations
+
+from fastapi import APIRouter, Request, status
+
+from app.models import DashboardSummary, QuickAddNotePayload
+
+router = APIRouter(prefix='/api')
+
+
+@router.get('/health')
+def health() -> dict[str, str]:
+    return {'status': 'ok'}
+
+
+@router.get('/dashboard/summary', response_model=DashboardSummary)
+def dashboard_summary(request: Request) -> dict:
+    return request.app.state.store.dashboard_summary()
+
+
+@router.post('/notes/quick-add', status_code=status.HTTP_201_CREATED)
+def quick_add_note(payload: QuickAddNotePayload, request: Request) -> dict:
+    return request.app.state.store.add_quick_note(payload.model_dump())

home/minerva-dashboard/app/routes/ui.py

@@ -0,0 +1,42 @@
+from __future__ import annotations
+
+from pathlib import Path
+
+from fastapi import APIRouter, Form, Request, status
+from fastapi.responses import HTMLResponse, RedirectResponse
+from fastapi.templating import Jinja2Templates
+
+BASE_DIR = Path(__file__).resolve().parents[1]
+templates = Jinja2Templates(directory=str(BASE_DIR / 'templates'))
+router = APIRouter()
+
+
+@router.get('/', response_class=HTMLResponse)
+def dashboard(request: Request) -> HTMLResponse:
+    summary = request.app.state.store.dashboard_summary()
+    return templates.TemplateResponse(
+        request,
+        'dashboard.html',
+        {
+            'summary': summary,
+        },
+    )
+
+
+@router.post('/quick-actions/notes')
+def quick_add_note_form(
+    request: Request,
+    title: str = Form(...),
+    body: str = Form(...),
+    category: str = Form('note'),
+) -> RedirectResponse:
+    request.app.state.store.add_quick_note(
+        {
+            'title': title,
+            'body': body,
+            'category': category,
+            'source': 'dashboard-form',
+            'pinned': False,
+        }
+    )
+    return RedirectResponse(url='/', status_code=status.HTTP_303_SEE_OTHER)

home/minerva-dashboard/app/services/store.py

@@ -0,0 +1,172 @@
+from __future__ import annotations
+
+import json
+from copy import deepcopy
+from datetime import datetime, timezone
+from pathlib import Path
+from typing import Any
+from uuid import uuid4
+
+DEFAULT_STATE = {
+    'profile': {
+        'id': 'manndra',
+        'display_name': 'Manndra',
+        'role': 'Primary household user',
+        'persona': 'Minerva',
+        'house_style': 'Ravenclaw common room',
+        'tone': 'Elegant, magical, useful',
+        'primary_color_story': 'Midnight blue, parchment, and warm bronze',
+        'notes': 'Seeded as the primary user for the Minerva household dashboard scaffold.',
+    },
+    'agenda': [
+        {
+            'id': 'agenda-1',
+            'title': 'Morning check-in',
+            'time_label': '8:30 AM',
+            'detail': 'Review the day, any errands, and which household lane needs attention first.',
+        },
+        {
+            'id': 'agenda-2',
+            'title': 'After-lunch reset',
+            'time_label': '1:30 PM',
+            'detail': 'Tidy loose notes, review reminders, and confirm dinner direction.',
+        },
+        {
+            'id': 'agenda-3',
+            'title': 'Evening wind-down',
+            'time_label': '8:00 PM',
+            'detail': 'Wrap tomorrow notes, shortlist meals, and leave one clean next action.',
+        },
+    ],
+    'reminders': [
+        {'id': 'reminder-1', 'title': 'Check school and household messages', 'urgency': 'today'},
+        {'id': 'reminder-2', 'title': 'Restock one comfort-snack shelf item', 'urgency': 'this week'},
+        {'id': 'reminder-3', 'title': 'Set aside one graceful task for future Minerva automation', 'urgency': 'someday'},
+    ],
+    'lists': [
+        {
+            'id': 'list-1',
+            'title': 'Errands',
+            'items': [
+                {'label': 'Pick up household basics', 'done': False},
+                {'label': 'Confirm any school supply gaps', 'done': False},
+                {'label': 'Check gift / occasion queue', 'done': False},
+            ],
+        },
+        {
+            'id': 'list-2',
+            'title': 'House reset',
+            'items': [
+                {'label': 'Clear one surface', 'done': True},
+                {'label': 'Run a fast room sweep', 'done': False},
+                {'label': 'Stage tomorrow launch pad', 'done': False},
+            ],
+        },
+    ],
+    'notes': [
+        {
+            'id': 'note-1',
+            'title': 'Minerva welcome',
+            'body': 'This front page should feel calm, capable, and immediately useful from a phone.',
+            'category': 'welcome',
+            'source': 'seed',
+            'pinned': True,
+            'created_at': '2026-05-23T09:00:00Z',
+        },
+        {
+            'id': 'note-2',
+            'title': 'Household rhythm',
+            'body': 'Keep the wording practical: what matters now, what can wait, and what would make the day easier.',
+            'category': 'guidance',
+            'source': 'seed',
+            'pinned': False,
+            'created_at': '2026-05-23T10:15:00Z',
+        },
+    ],
+    'links': [
+        {'id': 'link-1', 'label': 'Calendar', 'url': '#', 'note': 'Placeholder until live integration is chosen.'},
+        {'id': 'link-2', 'label': 'School hub', 'url': '#', 'note': 'Quick route for classes, due dates, and messages.'},
+        {'id': 'link-3', 'label': 'Household notes', 'url': '#', 'note': 'Pin common references in one predictable place.'},
+    ],
+    'meal_ideas': [
+        {'id': 'meal-1', 'title': 'Easy comfort dinner', 'detail': 'One low-friction weeknight fallback with leftovers.'},
+        {'id': 'meal-2', 'title': 'Snack board night', 'detail': 'Small-prep option for a busier day.'},
+        {'id': 'meal-3', 'title': 'Tomorrow prep idea', 'detail': 'Something that makes the next day easier.'},
+    ],
+    'shortcuts': [
+        {'id': 'shortcut-1', 'label': 'Quick note', 'hint': 'Capture the thing before it evaporates.'},
+        {'id': 'shortcut-2', 'label': 'Meal spark', 'hint': 'Write one dinner idea without overthinking it.'},
+        {'id': 'shortcut-3', 'label': 'Errand add', 'hint': 'Drop a list item while already on the move.'},
+    ],
+    'quick_actions': [
+        {'id': 'action-1', 'label': 'Capture note', 'detail': 'Fast jot for reminders, ideas, and school fragments.'},
+        {'id': 'action-2', 'label': 'Review day', 'detail': 'One-tap habit: scan agenda, reminders, and lists.'},
+        {'id': 'action-3', 'label': 'Choose dinner lane', 'detail': 'Decide between comfort, fast, or leftovers.'},
+    ],
+}
+
+
+class JSONStore:
+    def __init__(self, state_dir: Path) -> None:
+        self.state_dir = Path(state_dir)
+        self.state_path = self.state_dir / 'state.json'
+        self.state_dir.mkdir(parents=True, exist_ok=True)
+        if not self.state_path.exists():
+            self._write(deepcopy(DEFAULT_STATE))
+
+    def _read(self) -> dict[str, Any]:
+        return json.loads(self.state_path.read_text())
+
+    def _write(self, payload: dict[str, Any]) -> None:
+        self.state_path.write_text(json.dumps(payload, indent=2, sort_keys=True))
+
+    def dashboard_summary(self) -> dict[str, Any]:
+        state = self._read()
+        notes = self._sorted_notes(state['notes'])
+        return {
+            'profile': state['profile'],
+            'counts': {
+                'agenda': len(state['agenda']),
+                'reminders': len(state['reminders']),
+                'lists': len(state['lists']),
+                'notes': len(notes),
+                'links': len(state['links']),
+                'meal_ideas': len(state['meal_ideas']),
+                'shortcuts': len(state['shortcuts']),
+                'quick_actions': len(state['quick_actions']),
+            },
+            'agenda': state['agenda'],
+            'reminders': state['reminders'],
+            'lists': state['lists'],
+            'notes': notes,
+            'links': state['links'],
+            'meal_ideas': state['meal_ideas'],
+            'shortcuts': state['shortcuts'],
+            'quick_actions': state['quick_actions'],
+        }
+
+    def add_quick_note(self, payload: dict[str, Any]) -> dict[str, Any]:
+        state = self._read()
+        saved = {
+            'id': uuid4().hex,
+            'title': payload['title'].strip(),
+            'body': payload['body'].strip(),
+            'category': payload.get('category', 'note').strip() or 'note',
+            'source': payload.get('source', 'quick-add').strip() or 'quick-add',
+            'pinned': bool(payload.get('pinned', False)),
+            'created_at': datetime.now(timezone.utc).replace(microsecond=0).isoformat().replace('+00:00', 'Z'),
+        }
+        state['notes'].append(saved)
+        self._write(state)
+        return saved
+
+    @staticmethod
+    def _sorted_notes(notes: list[dict[str, Any]]) -> list[dict[str, Any]]:
+        return sorted(
+            notes,
+            key=lambda item: (
+                not item.get('pinned', False),
+                item.get('created_at', ''),
+            ),
+            reverse=False,
+        )[::-1]

home/minerva-dashboard/app/static/app.css

@@ -0,0 +1,343 @@
+:root {
+  --bg: #0f1728;
+  --bg-elevated: #18233b;
+  --card: rgba(19, 31, 54, 0.86);
+  --card-strong: rgba(17, 28, 49, 0.94);
+  --text: #e7edf9;
+  --muted: #b7c3db;
+  --line: rgba(198, 169, 102, 0.18);
+  --accent: #8bb8ff;
+  --bronze: #c6a966;
+  --shadow: 0 18px 40px rgba(3, 8, 20, 0.35);
+}
+
+* { box-sizing: border-box; }
+html, body { margin: 0; padding: 0; }
+body {
+  font-family: Inter, system-ui, -apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif;
+  background:
+    radial-gradient(circle at top, rgba(93, 129, 194, 0.16), transparent 32%),
+    linear-gradient(180deg, #0d1524 0%, var(--bg) 100%);
+  color: var(--text);
+  min-height: 100vh;
+}
+
+a { color: var(--accent); text-decoration: none; }
+a:hover { text-decoration: underline; }
+
+.page-shell {
+  width: min(1120px, calc(100vw - 1.5rem));
+  margin: 0 auto;
+  padding: 1rem 0 2.5rem;
+}
+
+.card {
+  background: var(--card);
+  border: 1px solid var(--line);
+  border-radius: 20px;
+  box-shadow: var(--shadow);
+  padding: 1rem;
+  backdrop-filter: blur(8px);
+}
+
+.glow-card {
+  background: linear-gradient(135deg, rgba(23, 37, 65, 0.96), rgba(26, 40, 68, 0.9));
+}
+
+.masthead {
+  display: grid;
+  grid-template-columns: minmax(0, 1.15fr) minmax(260px, 0.85fr);
+  gap: 1rem;
+  margin-bottom: 1rem;
+  overflow: hidden;
+  position: relative;
+}
+
+.masthead::before {
+  content: "";
+  position: absolute;
+  inset: 0;
+  background:
+    linear-gradient(120deg, rgba(10, 18, 32, 0.9) 0%, rgba(10, 18, 32, 0.82) 44%, rgba(12, 20, 34, 0.58) 100%),
+    radial-gradient(circle at top right, rgba(139, 184, 255, 0.18), transparent 32%);
+  pointer-events: none;
+}
+
+.masthead > * {
+  position: relative;
+  z-index: 1;
+}
+
+.masthead-copy {
+  display: grid;
+  gap: 1rem;
+  align-content: space-between;
+}
+
+.masthead h1, .section-heading h2, .spotlight h2, .subcard h3, .note-item h3 {
+  font-family: Georgia, 'Times New Roman', serif;
+  letter-spacing: 0.01em;
+  margin: 0;
+}
+
+.masthead-meta, .section-heading, .note-head {
+  display: flex;
+  gap: 0.5rem;
+  justify-content: space-between;
+  align-items: flex-start;
+  flex-wrap: wrap;
+}
+
+.masthead-hero-frame,
+.visual-medallion,
+.inline-ornament {
+  margin: 0;
+}
+
+.masthead-hero-frame {
+  display: grid;
+  gap: 0.5rem;
+  align-content: start;
+}
+
+.masthead-hero-image {
+  width: 100%;
+  aspect-ratio: 16 / 10;
+  object-fit: cover;
+  border-radius: 18px;
+  border: 1px solid rgba(198, 169, 102, 0.22);
+  box-shadow: 0 14px 34px rgba(3, 8, 20, 0.32);
+}
+
+.masthead-hero-frame figcaption,
+.visual-medallion figcaption,
+.inline-ornament figcaption {
+  color: var(--muted);
+  font-size: 0.78rem;
+}
+
+.eyebrow {
+  margin: 0 0 0.35rem;
+  color: var(--bronze);
+  text-transform: uppercase;
+  letter-spacing: 0.12em;
+  font-size: 0.72rem;
+}
+
+.lede, .muted {
+  color: var(--muted);
+}
+
+.badge, .pill {
+  display: inline-flex;
+  align-items: center;
+  border-radius: 999px;
+  padding: 0.3rem 0.7rem;
+  font-size: 0.78rem;
+  border: 1px solid rgba(139, 184, 255, 0.26);
+  background: rgba(139, 184, 255, 0.08);
+}
+
+.badge.bronze, .pill.subtle {
+  border-color: rgba(198, 169, 102, 0.28);
+  background: rgba(198, 169, 102, 0.1);
+}
+
+.badge.outline {
+  background: transparent;
+}
+
+.hero-grid,
+.dashboard-grid {
+  display: grid;
+  gap: 1rem;
+}
+
+.hero-grid {
+  grid-template-columns: repeat(auto-fit, minmax(280px, 1fr));
+  margin-bottom: 1rem;
+}
+
+.dashboard-grid {
+  grid-template-columns: repeat(auto-fit, minmax(240px, 1fr));
+}
+
+.spotlight {
+  min-height: 100%;
+}
+
+.spotlight-visuals {
+  display: grid;
+  grid-template-columns: repeat(2, minmax(0, 1fr));
+  gap: 0.85rem;
+  margin-top: 1rem;
+}
+
+.visual-medallion {
+  display: grid;
+  gap: 0.45rem;
+  background: rgba(13, 22, 38, 0.76);
+  border: 1px solid rgba(198, 169, 102, 0.12);
+  border-radius: 16px;
+  padding: 0.65rem;
+}
+
+.visual-medallion img,
+.inline-ornament img {
+  width: 100%;
+  display: block;
+}
+
+.visual-medallion img {
+  border-radius: 14px;
+  aspect-ratio: 1 / 1;
+  object-fit: cover;
+}
+
+.framed-medallion {
+  background:
+    linear-gradient(180deg, rgba(27, 42, 70, 0.96), rgba(18, 29, 50, 0.92)),
+    url('/static/images/art-nouveau-frame.svg') center / cover no-repeat;
+}
+
+.room-medallion img {
+  object-position: center 22%;
+}
+
+.stats-grid {
+  display: grid;
+  grid-template-columns: repeat(2, minmax(0, 1fr));
+  gap: 0.75rem;
+  margin-top: 1rem;
+}
+
+.stats-grid div,
+.subcard,
+.note-item {
+  background: var(--card-strong);
+  border: 1px solid rgba(198, 169, 102, 0.12);
+  border-radius: 16px;
+  padding: 0.85rem;
+}
+
+.stats-grid span,
+.tiny {
+  color: var(--muted);
+  font-size: 0.8rem;
+}
+
+.stats-grid strong {
+  display: block;
+  font-size: 1.25rem;
+  margin-top: 0.2rem;
+}
+
+.stack-form {
+  display: grid;
+  gap: 0.85rem;
+}
+
+label {
+  display: grid;
+  gap: 0.4rem;
+  font-size: 0.92rem;
+}
+
+input,
+textarea,
+button {
+  width: 100%;
+  border-radius: 14px;
+  border: 1px solid rgba(139, 184, 255, 0.16);
+  padding: 0.85rem 0.95rem;
+  font: inherit;
+}
+
+input,
+textarea {
+  background: rgba(10, 18, 33, 0.88);
+  color: var(--text);
+}
+
+button {
+  background: linear-gradient(135deg, #5c78b7, #7ea6ef);
+  color: #09111e;
+  font-weight: 700;
+  cursor: pointer;
+}
+
+button:hover {
+  filter: brightness(1.04);
+}
+
+.timeline-list,
+.plain-list,
+.check-list {
+  list-style: none;
+  margin: 0;
+  padding: 0;
+  display: grid;
+  gap: 0.75rem;
+}
+
+.timeline-list li,
+.plain-list li,
+.check-list li {
+  background: rgba(15, 24, 42, 0.72);
+  border: 1px solid rgba(198, 169, 102, 0.1);
+  border-radius: 14px;
+  padding: 0.8rem;
+}
+
+.check-list li.done {
+  text-decoration: line-through;
+  opacity: 0.72;
+}
+
+.notes-card {
+  grid-column: span 2;
+}
+
+.note-item.pinned {
+  border-color: rgba(198, 169, 102, 0.34);
+}
+
+.quick-add-card {
+  align-self: start;
+}
+
+.inline-ornament {
+  margin-top: 1rem;
+  display: grid;
+  gap: 0.4rem;
+}
+
+.inline-ornament img {
+  max-height: 96px;
+  object-fit: cover;
+  border-radius: 12px;
+  border: 1px solid rgba(198, 169, 102, 0.16);
+  background: linear-gradient(135deg, rgba(198, 169, 102, 0.18), rgba(139, 184, 255, 0.12));
+}
+
+@media (max-width: 800px) {
+  .page-shell {
+    width: min(100vw - 1rem, 100%);
+  }
+
+  .masthead {
+    grid-template-columns: 1fr;
+  }
+
+  .masthead-hero-image {
+    aspect-ratio: 16 / 9;
+  }
+
+  .spotlight-visuals {
+    grid-template-columns: 1fr;
+  }
+
+  .notes-card {
+    grid-column: span 1;
+  }
+}

home/minerva-dashboard/app/templates/base.html

@@ -0,0 +1,38 @@
+<!DOCTYPE html>
+<html lang="en">
+  <head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>{{ summary.profile.persona if summary is defined else 'Minerva' }} Dashboard</title>
+    <link rel="stylesheet" href="/static/app.css">
+  </head>
+  <body>
+    <div class="page-shell">
+      <header class="masthead card glow-card">
+        <div class="masthead-copy">
+          <div>
+            <p class="eyebrow">Ravenclaw common room</p>
+            <h1>Minerva Dashboard</h1>
+            <p class="lede">Elegant household focus for {{ summary.profile.display_name if summary is defined else 'Manndra' }}: agenda, lists, notes, and one calm place to decide what matters now.</p>
+          </div>
+          <div class="masthead-meta">
+            <span class="badge">Private-first</span>
+            <span class="badge bronze">Phone friendly</span>
+            <span class="badge outline">{{ summary.profile.tone if summary is defined else 'Elegant, magical, useful' }}</span>
+          </div>
+        </div>
+        <figure class="masthead-hero-frame">
+          <img
+            class="masthead-hero-image"
+            src="/static/images/library-hero.jpg"
+            alt="Grand library interior with high shelves and warm lamplight"
+          >
+          <figcaption>Library study-hall artwork grounding the dashboard in a scholarly common-room mood.</figcaption>
+        </figure>
+      </header>
+      <main>
+        {% block content %}{% endblock %}
+      </main>
+    </div>
+  </body>
+</html>

home/minerva-dashboard/app/templates/dashboard.html

@@ -0,0 +1,160 @@
+{% extends 'base.html' %}
+{% block content %}
+<section class="hero-grid">
+  <article class="card spotlight">
+    <div class="section-heading">
+      <div>
+        <p class="eyebrow">Primary profile</p>
+        <h2>{{ summary['profile']['display_name'] }} / {{ summary['profile']['persona'] }}</h2>
+      </div>
+      <span class="badge bronze">{{ summary['profile']['house_style'] }}</span>
+    </div>
+    <p class="muted">{{ summary['profile']['notes'] }}</p>
+    <div class="stats-grid">
+      <div><span>Agenda</span><strong>{{ summary['counts']['agenda'] }}</strong></div>
+      <div><span>Reminders</span><strong>{{ summary['counts']['reminders'] }}</strong></div>
+      <div><span>Lists</span><strong>{{ summary['counts']['lists'] }}</strong></div>
+      <div><span>Notes</span><strong>{{ summary['counts']['notes'] }}</strong></div>
+    </div>
+    <div class="spotlight-visuals" aria-label="Ravenclaw common-room imagery">
+      <figure class="visual-medallion framed-medallion">
+        <img src="/static/images/owl-engraving.jpg" alt="Vintage owl engraving used as a scholarly crest substitute">
+        <figcaption>Owl engraving crest</figcaption>
+      </figure>
+      <figure class="visual-medallion room-medallion">
+        <img src="/static/images/blue-interior.jpg" alt="Blue-toned interior painting with elegant room details">
+        <figcaption>Blue interior study corner</figcaption>
+      </figure>
+    </div>
+  </article>
+
+  <article class="card quick-add-card">
+    <div class="section-heading">
+      <div>
+        <p class="eyebrow">Quick action</p>
+        <h2>Capture a note before it disappears</h2>
+      </div>
+      <span class="badge">Minerva quick add</span>
+    </div>
+    <form method="post" action="/quick-actions/notes" class="stack-form">
+      <label>Title
+        <input type="text" name="title" placeholder="School follow-up, errand, reminder..." required>
+      </label>
+      <label>Note
+        <textarea name="body" rows="4" placeholder="Write the useful fragment and keep moving." required></textarea>
+      </label>
+      <label>Category
+        <input type="text" name="category" value="note" placeholder="note, reminder, meal, school">
+      </label>
+      <button type="submit">Save quick note</button>
+    </form>
+    <figure class="inline-ornament">
+      <img src="/static/images/art-nouveau-frame.svg" alt="Art Nouveau ornamental frame accent">
+      <figcaption>Ornamental frame accent for the quick-capture panel.</figcaption>
+    </figure>
+  </article>
+</section>
+
+<section class="dashboard-grid">
+  <article class="card">
+    <div class="section-heading"><div><p class="eyebrow">Agenda</p><h2>Today at a glance</h2></div></div>
+    <ul class="timeline-list">
+      {% for item in summary['agenda'] %}
+      <li>
+        <strong>{{ item.time_label }}</strong>
+        <span>{{ item.title }}</span>
+        <p class="muted">{{ item.detail }}</p>
+      </li>
+      {% endfor %}
+    </ul>
+  </article>
+
+  <article class="card">
+    <div class="section-heading"><div><p class="eyebrow">Reminders</p><h2>Loose ends</h2></div></div>
+    <ul class="plain-list">
+      {% for item in summary['reminders'] %}
+      <li>
+        <strong>{{ item.title }}</strong>
+        <span class="pill subtle">{{ item.urgency }}</span>
+      </li>
+      {% endfor %}
+    </ul>
+  </article>
+
+  <article class="card">
+    <div class="section-heading"><div><p class="eyebrow">Lists</p><h2>Household lanes</h2></div></div>
+      {% for block in summary['lists'] %}
+    <div class="subcard">
+      <h3>{{ block['title'] }}</h3>
+      <ul class="check-list">
+        {% for item in block['items'] %}
+        <li class="{{ 'done' if item['done'] else '' }}">{{ item['label'] }}</li>
+        {% endfor %}
+      </ul>
+    </div>
+    {% endfor %}
+  </article>
+
+  <article class="card notes-card">
+    <div class="section-heading"><div><p class="eyebrow">Notes</p><h2>Recent captures</h2></div></div>
+    {% for item in summary['notes'][:5] %}
+    <div class="note-item {{ 'pinned' if item['pinned'] else '' }}">
+      <div class="note-head">
+        <h3>{{ item['title'] }}</h3>
+        <span class="pill subtle">{{ item['category'] }}</span>
+      </div>
+      <p>{{ item['body'] }}</p>
+      <p class="muted tiny">{{ item['source'] }}{% if item['created_at'] %} · {{ item['created_at'] }}{% endif %}</p>
+    </div>
+    {% endfor %}
+  </article>
+
+  <article class="card">
+    <div class="section-heading"><div><p class="eyebrow">Useful links</p><h2>Launch points</h2></div></div>
+    <ul class="plain-list links-list">
+      {% for item in summary['links'] %}
+      <li>
+        <a href="{{ item.url }}">{{ item.label }}</a>
+        <p class="muted">{{ item.note }}</p>
+      </li>
+      {% endfor %}
+    </ul>
+  </article>
+
+  <article class="card">
+    <div class="section-heading"><div><p class="eyebrow">Meal ideas</p><h2>Dinner sparks</h2></div></div>
+    <ul class="plain-list">
+      {% for item in summary['meal_ideas'] %}
+      <li>
+        <strong>{{ item.title }}</strong>
+        <p class="muted">{{ item.detail }}</p>
+      </li>
+      {% endfor %}
+    </ul>
+  </article>
+
+  <article class="card">
+    <div class="section-heading"><div><p class="eyebrow">Shortcuts</p><h2>Fast household moves</h2></div></div>
+    <ul class="plain-list">
+      {% for item in summary['shortcuts'] %}
+      <li>
+        <strong>{{ item.label }}</strong>
+        <p class="muted">{{ item.hint }}</p>
+      </li>
+      {% endfor %}
+    </ul>
+  </article>
+
+  <article class="card">
+    <div class="section-heading"><div><p class="eyebrow">Quick actions</p><h2>Minerva prompts</h2></div></div>
+    <ul class="plain-list">
+      {% for item in summary['quick_actions'] %}
+      <li>
+        <strong>{{ item.label }}</strong>
+        <p class="muted">{{ item.detail }}</p>
+      </li>
+      {% endfor %}
+    </ul>
+  </article>
+</section>
+{% endblock %}

home/minerva-dashboard/bin/run-local.sh

@@ -0,0 +1,12 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+cd "$(dirname "$0")/.."
+
+if [ ! -d .venv ]; then
+  python3 -m venv .venv
+fi
+
+. .venv/bin/activate
+pip install -r requirements.txt
+exec uvicorn app.main:app --reload --host 0.0.0.0 --port 8094

home/minerva-dashboard/docker-compose.yaml

@@ -0,0 +1,31 @@
+services:
+  minerva-dashboard:
+    container_name: minerva-dashboard
+    build:
+      context: .
+      dockerfile: Dockerfile
+    restart: unless-stopped
+    ports:
+      - "8094:8094"
+    env_file:
+      - .env
+    environment:
+      TZ: ${TZ}
+      MINERVA_HOST: ${MINERVA_HOST:-0.0.0.0}
+      MINERVA_PORT: ${MINERVA_PORT:-8094}
+      MINERVA_STATE_DIR: ${MINERVA_STATE_DIR:-/data/state}
+      MINERVA_SHARED_PASSWORD: ${MINERVA_SHARED_PASSWORD:-}
+    volumes:
+      - /mnt/docker-ssd/docker/appdata/minerva-dashboard:/data
+    healthcheck:
+      test: ["CMD-SHELL", "curl -fsS http://127.0.0.1:8094/api/health || exit 1"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 20s
+    networks:
+      - minerva-dashboard-net
+
+networks:
+  minerva-dashboard-net:
+    driver: bridge

home/minerva-dashboard/docs/ASSET_SOURCES.md

@@ -0,0 +1,41 @@
+# Minerva Dashboard asset sources
+
+This scaffold vendors a small set of real graphics so the Ravenclaw/common-room theme is visible in the UI rather than existing only as CSS treatment.
+
+## Vendored assets
+
+### `app/static/images/library-hero.jpg`
+- Title: Interior of a Library - Google Art Project
+- Source URL: https://commons.wikimedia.org/wiki/File:Interior_of_a_Library_-_Google_Art_Project.jpg
+- Download URL used: https://commons.wikimedia.org/wiki/Special:Redirect/file/Interior_of_a_Library_-_Google_Art_Project.jpg
+- License: Public domain in the US / faithful reproduction of a public-domain 2D work per Wikimedia Commons listing
+- UI placement: masthead hero image at the top of the dashboard
+- Notes: used with dark overlay and cropped responsively for phone readability
+
+### `app/static/images/blue-interior.jpg`
+- Title: Harriet Backer - Blue Interior - Google Art Project
+- Source URL: https://commons.wikimedia.org/wiki/File:Harriet_Backer_-_Blue_Interior_-_Google_Art_Project.jpg
+- Download URL used: https://commons.wikimedia.org/wiki/Special:Redirect/file/Harriet_Backer_-_Blue_Interior_-_Google_Art_Project.jpg
+- License: Public domain in the US / faithful reproduction of a public-domain 2D work per Wikimedia Commons listing
+- UI placement: secondary visual medallion inside the primary profile spotlight card
+- Notes: intentionally cropped tighter so it reads on phone screens
+
+### `app/static/images/owl-engraving.jpg`
+- Title: The owl copper engraving 1800
+- Source URL: https://commons.wikimedia.org/wiki/File:The_owl_copper_engraving_1800.jpg
+- Download URL used: https://commons.wikimedia.org/wiki/Special:Redirect/file/The_owl_copper_engraving_1800.jpg
+- License: Public domain / free of known restrictions per Wikimedia Commons listing
+- UI placement: crest-style medallion inside the primary profile spotlight card
+- Notes: used as the strongest explicit Ravenclaw-adjacent motif without copying franchise crests
+
+### `app/static/images/art-nouveau-frame.svg`
+- Title: Art Nouveau pond frame, Serões, 1901
+- Source URL: https://commons.wikimedia.org/wiki/File:Art_Nouveau_pond_frame,_Ser%C3%B5es,_1901.svg
+- Download URL used: https://commons.wikimedia.org/wiki/Special:Redirect/file/Art_Nouveau_pond_frame,_Ser%C3%B5es,_1901.svg
+- License: Public domain per Wikimedia Commons listing
+- UI placement: subtle framed backdrop on the owl medallion plus a visible ornament in the quick-add card
+- Notes: SVG keeps the accent crisp while staying lightweight and easy to recolor later if needed
+
+## Implementation intent
+
+The asset pass favors elegant library/interior/owl imagery over childish or direct Harry Potter franchise art. The goal is "Ravenclaw/common-room inspired household dashboard" rather than a copied fan site.

home/minerva-dashboard/pytest.ini

@@ -0,0 +1,2 @@
+[pytest]
+pythonpath = .

home/minerva-dashboard/requirements.txt

@@ -0,0 +1,6 @@
+fastapi==0.115.0
+uvicorn[standard]==0.30.6
+jinja2==3.1.4
+python-multipart==0.0.9
+httpx==0.27.2
+pytest==8.3.3

home/minerva-dashboard/tests/test_app.py

@@ -0,0 +1,110 @@
+from pathlib import Path
+
+from fastapi.testclient import TestClient
+
+from app.main import create_app
+
+
+def make_client(tmp_path: Path) -> TestClient:
+    app = create_app(state_dir=tmp_path)
+    return TestClient(app)
+
+
+def test_health_endpoint_reports_ok(tmp_path: Path) -> None:
+    client = make_client(tmp_path)
+
+    response = client.get('/api/health')
+
+    assert response.status_code == 200
+    assert response.json() == {'status': 'ok'}
+
+
+def test_dashboard_summary_seeds_manndra_first(tmp_path: Path) -> None:
+    client = make_client(tmp_path)
+
+    response = client.get('/api/dashboard/summary')
+
+    assert response.status_code == 200
+    payload = response.json()
+    assert payload['profile']['id'] == 'manndra'
+    assert payload['profile']['display_name'] == 'Manndra'
+    assert payload['profile']['persona'] == 'Minerva'
+    assert payload['counts'] == {
+        'agenda': 3,
+        'reminders': 3,
+        'lists': 2,
+        'notes': 2,
+        'links': 3,
+        'meal_ideas': 3,
+        'shortcuts': 3,
+        'quick_actions': 3,
+    }
+    assert payload['agenda'][0]['title'] == 'Morning check-in'
+    assert payload['lists'][0]['title'] == 'Errands'
+    assert payload['meal_ideas'][0]['title'] == 'Easy comfort dinner'
+
+
+def test_quick_add_note_updates_summary_and_persists_newest_first(tmp_path: Path) -> None:
+    client = make_client(tmp_path)
+
+    response = client.post(
+        '/api/notes/quick-add',
+        json={
+            'title': 'Field trip forms',
+            'body': 'Check whether anything needs signing tonight.',
+            'category': 'school',
+            'source': 'api-test',
+            'pinned': False,
+        },
+    )
+
+    assert response.status_code == 201
+    saved = response.json()
+    assert saved['title'] == 'Field trip forms'
+    assert saved['category'] == 'school'
+    assert saved['source'] == 'api-test'
+
+    summary = client.get('/api/dashboard/summary')
+    assert summary.status_code == 200
+    payload = summary.json()
+    assert payload['counts']['notes'] == 3
+    assert payload['notes'][0]['title'] == 'Field trip forms'
+    assert payload['notes'][0]['body'] == 'Check whether anything needs signing tonight.'
+
+
+def test_homepage_renders_ravenclaw_common_room_dashboard(tmp_path: Path) -> None:
+    client = make_client(tmp_path)
+
+    response = client.get('/')
+
+    assert response.status_code == 200
+    body = response.text
+    assert 'Minerva Dashboard' in body
+    assert 'Ravenclaw common room' in body
+    assert 'Capture a note before it disappears' in body
+    assert 'Dinner sparks' in body
+    assert '/static/images/library-hero.jpg' in body
+    assert '/static/images/owl-engraving.jpg' in body
+    assert '/static/images/blue-interior.jpg' in body
+    assert '/static/images/art-nouveau-frame.svg' in body
+
+
+def test_form_post_redirects_after_note_capture(tmp_path: Path) -> None:
+    client = make_client(tmp_path)
+
+    response = client.post(
+        '/quick-actions/notes',
+        data={
+            'title': 'Gift reminder',
+            'body': 'Look for one elegant but practical option.',
+            'category': 'household',
+        },
+        follow_redirects=False,
+    )
+
+    assert response.status_code == 303
+    assert response.headers['location'] == '/'
+
+    summary = client.get('/api/dashboard/summary').json()
+    assert summary['counts']['notes'] == 3
+    assert summary['notes'][0]['title'] == 'Gift reminder'

localsend-nomad/.env.example

@@ -0,0 +1,9 @@
+TZ=America/Chicago
+TRUSTED_PARENT_INTERFACE=enp5s0.51
+TRUSTED_SUBNET=10.5.1.0/24
+TRUSTED_GATEWAY=10.5.1.1
+LOCALSEND_BIND_IP=10.5.1.16
+LOCALSEND_DEVICE_NAME="Doris Trusted Inbox"
+LOCALSEND_CLI_REF=54702513990eeb763e1615f274d5365442e3e393
+APPDATA_LOCALSEND_ROOT=/opt/localsend-nomad/data
+INBOX_DIR=/home/fizzlepoof/private/inbox-secrets

localsend-nomad/Dockerfile

@@ -0,0 +1,19 @@
+FROM golang:1.25-alpine AS build
+
+ARG LOCALSEND_CLI_REF=54702513990eeb763e1615f274d5365442e3e393
+
+RUN apk add --no-cache git patch
+WORKDIR /src
+RUN git clone https://github.com/0w0mewo/localsend-cli.git . \
+    && git checkout "$LOCALSEND_CLI_REF"
+COPY patches/localsend-cli-doris.patch /tmp/localsend-cli-doris.patch
+RUN git apply /tmp/localsend-cli-doris.patch \
+    && CGO_ENABLED=0 go build -trimpath -ldflags='-s -w' -o /out/localsend .
+
+FROM alpine:3.22
+RUN apk add --no-cache ca-certificates tzdata \
+    && adduser -D -u 1000 doris
+WORKDIR /app
+COPY --from=build /out/localsend /usr/local/bin/localsend
+USER doris
+ENTRYPOINT ["/usr/local/bin/localsend"]

localsend-nomad/README.md

@@ -0,0 +1,81 @@
+# LocalSend trusted-lane receiver on N.O.M.A.D.
+
+Repo-tracked Docker stack that runs a headless LocalSend receiver on N.O.M.A.D. with its own Trusted-LAN IP.
+
+- Repo stack path: `/home/fizzlepoof/repos/truenas-stacks/localsend-nomad`
+- Live stack path: `/opt/localsend-nomad`
+- Trusted bind IP: `10.5.1.16`
+- Trusted VLAN: `51`
+- LocalSend ports: `53317/tcp`, `53317/udp`
+- Inbox path on host: `/home/fizzlepoof/private/inbox-secrets`
+- Advertised device name: `Doris Trusted Inbox`
+
+## Why this exists
+
+N.O.M.A.D. lives on the `Servers` VLAN (`10.5.30.7`), but some operator handoff flows need a LocalSend receiver directly reachable from the `Trusted` LAN (`10.5.1.0/24`). This stack gives LocalSend its own Trusted-LAN address without moving the host itself off the Servers network.
+
+## Network model
+
+- Docker uses a `macvlan` network with parent `enp5s0.51`.
+- `enp5s0.51` is the Trusted VLAN subinterface on N.O.M.A.D.'s primary NIC.
+- Docker will create the VLAN subinterface automatically when the macvlan network is created.
+- Same-host testing from N.O.M.A.D. to `10.5.1.16` is unreliable because macvlan isolates the host from the container's address on the same parent interface.
+- Verify reachability from another Trusted-LAN peer instead. Do not rely on PD's old `10.5.1.6` identity; use any current Trusted-LAN test client that can reach `10.5.1.16`.
+
+## LocalSend build provenance
+
+The image is built locally from upstream `0w0mewo/localsend-cli` at:
+
+- commit: `54702513990eeb763e1615f274d5365442e3e393`
+
+Then it applies `patches/localsend-cli-doris.patch`, which keeps the receiver compatible with the LocalSend endpoint behavior already working in the existing Doris receiver flow.
+
+## Files
+
+- `docker-compose.yaml` — live stack definition
+- `Dockerfile` — reproducible CLI build from upstream + patch
+- `.env.example` — deployment variables
+- `bin/prepare_nomad.sh` — creates runtime dirs, validates config, optional `--up`
+- `patches/localsend-cli-doris.patch` — repo-tracked patch applied during image build
+
+## Deploy / refresh on NOMAD
+
+```bash
+cd /opt/localsend-nomad
+cp .env.example .env
+./bin/prepare_nomad.sh --up
+```
+
+## Verification
+
+From N.O.M.A.D.:
+
+```bash
+docker compose --env-file .env ps
+sudo docker logs --tail 50 localsend-trusted
+systemctl --user status minerva-localsend-autosort.path --no-pager
+systemctl --user status minerva-localsend-autosort.service --no-pager
+```
+
+From another Trusted-LAN host:
+
+```bash
+ping 10.5.1.16
+nc -vz 10.5.1.16 53317
+```
+
+Then confirm `Doris Trusted Inbox` appears as a LocalSend target from a Trusted-LAN device.
+
+## Shared inbox / Minerva handoff
+
+- The receiver writes into `/home/fizzlepoof/private/inbox-secrets`.
+- Minerva's staging flow watches that shared inbox via `minerva-localsend-autosort.path` and runs `/home/fizzlepoof/.local/bin/minerva-localsend-autosort.py`.
+- Sender-specific routing lives in `/home/fizzlepoof/private/minerva-dropbox/sender-map.json`.
+- Metadata/manifests for staged items land under `/home/fizzlepoof/private/minerva-dropbox/manifests/`.
+- If you need to confirm sender attribution, check both `journalctl --user -u doris-localsend.service` and `docker logs localsend-trusted`; the autosort helper reads both so Trusted-LAN receives keep sender-IP-aware routing.
+
+## Notes
+
+- The container writes directly into `/home/fizzlepoof/private/inbox-secrets` on the host so the existing autosort / intake flow can keep using the same inbox path.
+- This stack does not publish host ports; the dedicated Trusted-LAN IP is the service endpoint.
+- If the upstream CLI behavior changes later, rebuild from a reviewed newer commit and update the patch or drop it if upstream no longer needs the workaround.

localsend-nomad/bin/prepare_nomad.sh

@@ -0,0 +1,33 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+STACK_DIR="$(cd "$SCRIPT_DIR/.." && pwd)"
+ENV_FILE="${ENV_FILE:-$STACK_DIR/.env}"
+DO_UP="${1:-}"
+
+if [[ ! -f "$ENV_FILE" ]]; then
+  echo "Missing $ENV_FILE — copy .env.example to .env and fill in real values first." >&2
+  exit 1
+fi
+
+set -a
+# shellcheck disable=SC1090
+source "$ENV_FILE"
+set +a
+
+if [[ -z "${APPDATA_LOCALSEND_ROOT:-}" || -z "${INBOX_DIR:-}" ]]; then
+  echo "APPDATA_LOCALSEND_ROOT and INBOX_DIR must be set in .env" >&2
+  exit 1
+fi
+
+mkdir -p \
+  "$APPDATA_LOCALSEND_ROOT/state" \
+  "$INBOX_DIR"
+
+docker compose --env-file "$ENV_FILE" -f "$STACK_DIR/docker-compose.yaml" config >/dev/null
+
+if [[ "$DO_UP" == "--up" ]]; then
+  docker compose --env-file "$ENV_FILE" -f "$STACK_DIR/docker-compose.yaml" up -d --build
+  docker compose --env-file "$ENV_FILE" -f "$STACK_DIR/docker-compose.yaml" ps
+fi

localsend-nomad/docker-compose.yaml

@@ -0,0 +1,35 @@
+services:
+  localsend:
+    build:
+      context: .
+      args:
+        LOCALSEND_CLI_REF: ${LOCALSEND_CLI_REF}
+    image: localsend-nomad:local
+    container_name: localsend-trusted
+    hostname: localsend-trusted
+    restart: unless-stopped
+    environment:
+      TZ: ${TZ}
+    networks:
+      trusted_macvlan:
+        ipv4_address: ${LOCALSEND_BIND_IP}
+    working_dir: /app/state
+    volumes:
+      - ${APPDATA_LOCALSEND_ROOT}/state:/app/state
+      - ${INBOX_DIR}:/data/inbox
+    command:
+      - recv
+      - --devname
+      - ${LOCALSEND_DEVICE_NAME}
+      - --dir
+      - /data/inbox
+
+networks:
+  trusted_macvlan:
+    driver: macvlan
+    driver_opts:
+      parent: ${TRUSTED_PARENT_INTERFACE}
+    ipam:
+      config:
+        - subnet: ${TRUSTED_SUBNET}
+          gateway: ${TRUSTED_GATEWAY}

localsend-nomad/patches/localsend-cli-doris.patch

@@ -0,0 +1,92 @@
+diff --git a/internal/localsend/localsend.go b/internal/localsend/localsend.go
+index e30e6f5..c0c2b8e 100644
+--- a/internal/localsend/localsend.go
++++ b/internal/localsend/localsend.go
+@@ -2,6 +2,7 @@ package localsend
+ 
+ import (
+ 	"encoding/json"
++	"fmt"
+ 	"net"
+ 
+ 	"github.com/0w0mewo/localsend-cli/internal/localsend/constants"
+@@ -13,41 +14,53 @@ import (
+ func GetDeviceInfo(ip string, https bool) (models.DeviceInfo, error) {
+ 	remoteAddr := net.JoinHostPort(ip, "53317")
+ 
+-	agent := fiber.AcquireAgent()
+-	defer fiber.ReleaseAgent(agent)
+-
+ 	scheme := "http"
+ 	if https {
+ 		scheme = "https"
+ 	}
+ 
+-	req := agent.Request()
+-	req.URI().SetScheme(scheme)
+-	req.URI().SetHost(remoteAddr)
+-	req.URI().SetPath(constants.InfoPath)
+-	req.Header.SetMethod(fiber.MethodGet)
+-	err := agent.Parse()
+-	if err != nil {
+-		return models.DeviceInfo{}, err
+-	}
++	paths := []string{constants.InfoPath, "/api/localsend/v2/info", constants.InfoPathLegacy}
++	var lastErr error
+ 
+-	status, b, errs := agent.InsecureSkipVerify().Bytes()
+-	if len(errs) != 0 {
+-		return models.DeviceInfo{}, errs[0]
+-	}
+-	err = constants.ParseError(status)
+-	if err != nil {
+-		return models.DeviceInfo{}, err
+-	}
++	for _, path := range paths {
++		agent := fiber.AcquireAgent()
++		req := agent.Request()
++		req.URI().SetScheme(scheme)
++		req.URI().SetHost(remoteAddr)
++		req.URI().SetPath(path)
++		req.Header.SetMethod(fiber.MethodGet)
++		err := agent.Parse()
++		if err != nil {
++			fiber.ReleaseAgent(agent)
++			return models.DeviceInfo{}, err
++		}
+ 
+-	var res models.DeviceInfo
+-	err = json.Unmarshal(b, &res)
+-	if err != nil {
+-		return models.DeviceInfo{}, err
++		status, b, errs := agent.InsecureSkipVerify().Bytes()
++		fiber.ReleaseAgent(agent)
++		if len(errs) != 0 {
++			lastErr = errs[0]
++			continue
++		}
++		err = constants.ParseError(status)
++		if err != nil {
++			lastErr = err
++			continue
++		}
++
++		var res models.DeviceInfo
++		err = json.Unmarshal(b, &res)
++		if err != nil {
++			lastErr = err
++			continue
++		}
++		res.IP = ip
++		return res, nil
+ 	}
+-	res.IP = ip
+ 
+-	return res, nil
++	if lastErr == nil {
++		lastErr = fmt.Errorf("device info not found on known endpoints")
++	}
++	return models.DeviceInfo{}, lastErr
+ }
+ 
+ func NewFileSender(useDownloadAPI ...bool) send.FileSender {

media/.env.example

@@ -12,3 +12,30 @@ CWA_PGID=1001
 SEERR_DB_NAME=seerr
 SEERR_DB_USER=seerr
 SEERR_DB_PASS=changeme
+
+# GameVault dedicated postgres target on the PD media stack
+GAMEVAULT_DB_NAME=gamevault
+GAMEVAULT_DB_USER=gamevault
+GAMEVAULT_DB_PASS=changeme
+METADATA_IGDB_CLIENT_ID=changeme
+METADATA_IGDB_CLIENT_SECRET=changeme
+
+# RomM dedicated MariaDB target on the PD media stack
+ROMM_DB_ROOT_PASSWORD=changeme
+ROMM_DB_NAME=romm
+ROMM_DB_USER=romm
+ROMM_DB_PASS=changeme
+STEAMGRIDDB_API_KEY=changeme
+MOBYGAMES_API_KEY=changeme
+IGDB_CLIENT_ID=changeme
+IGDB_CLIENT_SECRET=changeme
+ROMM_AUTH_SECRET_KEY=changeme
+ENABLE_SCHEDULED_RESCAN=true
+GUNICORN_WORKERS=2
+RESCAN_ON_FILESYSTEM_CHANGE_DELAY=5
+ENABLE_SCHEDULED_UPDATE_SWITCH_TITLEDB=true
+SCHEDULED_UPDATE_SWITCH_TITLEDB_CRON=0 4 * * *
+SCHEDULED_RESCAN_CRON=0 3 * * *
+SCAN_TIMEOUT=14400
+DISABLE_CSRF_PROTECTION=false
+DISABLE_DOWNLOAD_ENDPOINT_AUTH=false

media/docker-compose.yaml

@@ -8,6 +8,45 @@ networks:
 
 services:
 
+  romm-db:
+    container_name: romm-db
+    image: mariadb:12.2
+    restart: unless-stopped
+    networks:
+      - media-net
+    environment:
+      MARIADB_ROOT_PASSWORD: ${ROMM_DB_ROOT_PASSWORD}
+      MARIADB_DATABASE: ${ROMM_DB_NAME}
+      MARIADB_USER: ${ROMM_DB_USER}
+      MARIADB_PASSWORD: ${ROMM_DB_PASS}
+    volumes:
+      - /mnt/docker-ssd/docker/appdata/romm-db/mysql:/var/lib/mysql
+    healthcheck:
+      test: ["CMD", "healthcheck.sh", "--connect", "--innodb_initialized"]
+      interval: 30s
+      timeout: 10s
+      retries: 5
+      start_period: 30s
+
+  gamevault-db:
+    container_name: gamevault-db
+    image: postgres:17
+    restart: unless-stopped
+    networks:
+      - media-net
+    environment:
+      POSTGRES_USER: ${GAMEVAULT_DB_USER}
+      POSTGRES_PASSWORD: ${GAMEVAULT_DB_PASS}
+      POSTGRES_DB: gamevault
+    volumes:
+      - /mnt/docker-ssd/docker/appdata/gamevault-db/postgres:/var/lib/postgresql/data
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U ${GAMEVAULT_DB_USER} -d gamevault"]
+      interval: 30s
+      timeout: 10s
+      retries: 5
+      start_period: 30s
+
   plex:
     container_name: ix-plex-plex-1
     image: lscr.io/linuxserver/plex:latest
@@ -88,6 +127,94 @@ services:
       retries: 3
       start_period: 30s
 
+  gamevault:
+    container_name: gamevault
+    user: "99:100"
+    image: phalcode/gamevault-backend:latest
+    restart: unless-stopped
+    networks:
+      - media-net
+      - ix-databases_shared-databases
+      - pangolin
+    ports:
+      - "8785:8080"
+    environment:
+      TZ: ${TZ}
+      PUID: 99
+      PGID: 100
+      NODE_ENV: production
+      DB_HOST: gamevault-db
+      DB_PORT: 5432
+      DB_USERNAME: ${GAMEVAULT_DB_USER}
+      DB_PASSWORD: ${GAMEVAULT_DB_PASS}
+      SAVEFILES_ENABLED: "true"
+      MEDIA_GC_INTERVAL_IN_MINUTES: 60
+      METADATA_IGDB_ENABLED: "true"
+      METADATA_IGDB_CLIENT_ID: ${METADATA_IGDB_CLIENT_ID}
+      METADATA_IGDB_CLIENT_SECRET: ${METADATA_IGDB_CLIENT_SECRET}
+      RAWG_API_URL: https://rawg2steam.phalco.de/api
+      RAWG_API_CACHE_DAYS: 36500
+      SERVER_PORT: 8080
+      SERVER_HTTPS_PORT: 8443
+      YES: "yes"
+    volumes:
+      - /mnt/unraid/data/media/Games-Apps Isos:/files
+      - /mnt/unraid/data/media/Saved Games:/savefiles
+      - /mnt/docker-ssd/docker/appdata/gamevault/media:/media
+      - /mnt/docker-ssd/docker/appdata/gamevault/logs:/logs
+    healthcheck:
+      test: ["CMD-SHELL", "curl -f http://localhost:$${SERVER_PORT}/api/status || exit 1"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 300s
+
+  romm:
+    container_name: romm
+    image: rommapp/romm:latest
+    restart: unless-stopped
+    depends_on:
+      romm-db:
+        condition: service_healthy
+    networks:
+      - media-net
+      - pangolin
+    ports:
+      - "8457:8080"
+    environment:
+      TZ: ${TZ}
+      DB_HOST: romm-db
+      DB_PORT: 3306
+      DB_USER: ${ROMM_DB_USER}
+      DB_NAME: ${ROMM_DB_NAME}
+      DB_PASSWD: ${ROMM_DB_PASS}
+      STEAMGRIDDB_API_KEY: ${STEAMGRIDDB_API_KEY}
+      ENABLE_SCHEDULED_RESCAN: ${ENABLE_SCHEDULED_RESCAN}
+      GUNICORN_WORKERS: ${GUNICORN_WORKERS}
+      MOBYGAMES_API_KEY: ${MOBYGAMES_API_KEY}
+      IGDB_CLIENT_ID: ${IGDB_CLIENT_ID}
+      RESCAN_ON_FILESYSTEM_CHANGE_DELAY: ${RESCAN_ON_FILESYSTEM_CHANGE_DELAY}
+      ENABLE_SCHEDULED_UPDATE_SWITCH_TITLEDB: ${ENABLE_SCHEDULED_UPDATE_SWITCH_TITLEDB}
+      SCHEDULED_UPDATE_SWITCH_TITLEDB_CRON: ${SCHEDULED_UPDATE_SWITCH_TITLEDB_CRON}
+      DISABLE_DOWNLOAD_ENDPOINT_AUTH: ${DISABLE_DOWNLOAD_ENDPOINT_AUTH}
+      ROMM_AUTH_SECRET_KEY: ${ROMM_AUTH_SECRET_KEY}
+      IGDB_CLIENT_SECRET: ${IGDB_CLIENT_SECRET}
+      SCHEDULED_RESCAN_CRON: ${SCHEDULED_RESCAN_CRON}
+      SCAN_TIMEOUT: ${SCAN_TIMEOUT}
+      DISABLE_CSRF_PROTECTION: ${DISABLE_CSRF_PROTECTION}
+    volumes:
+      - /mnt/unraid/data/media/RomM:/romm/library
+      - /mnt/docker-ssd/docker/appdata/romm/resources:/romm/resources
+      - /mnt/docker-ssd/docker/appdata/romm/assets:/romm/assets
+      - /mnt/docker-ssd/docker/appdata/romm/config:/romm/config
+      - /mnt/docker-ssd/docker/appdata/romm/redis-data:/redis-data
+    healthcheck:
+      test: ["CMD-SHELL", "curl -fsS http://127.0.0.1:8080/ >/dev/null || exit 1"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 60s
+
   seerr:
     container_name: seerr
     image: ghcr.io/seerr-team/seerr:latest

meshtastic/docker-compose.yaml

@@ -5,10 +5,13 @@ services:
     ports:
       - "8081:3001"
       - "4404:4404"
+      - "1883:1883"
     restart: unless-stopped
     volumes:
       - /mnt/tank/docker/appdata/meshmonitor/data:/data
       - /mnt/docker-ssd/docker/compose/meshtastic/scripts:/data/scripts
+    devices:
+      - /dev/ttyACM0:/dev/ttyACM0
     env_file: .env
     environment:
       - NODE_ENV=production
@@ -68,28 +71,6 @@ services:
     networks:
       - default
       - pangolin
-  mqtt-proxy:
-    image: ghcr.io/ln4cy/mqtt-proxy:master
-    container_name: meshmonitor-mqtt-proxy
-    restart: unless-stopped
-    environment:
-      - INTERFACE_TYPE=tcp
-      - TCP_NODE_HOST=meshmonitor
-      - TCP_NODE_PORT=4404
-      - LOG_LEVEL=INFO
-      - TCP_TIMEOUT=300
-      - CONFIG_WAIT_TIMEOUT=60
-      - HEALTH_CHECK_ACTIVITY_TIMEOUT=300
-    depends_on:
-      - meshmonitor
-    healthcheck:
-      test: ["CMD-SHELL", "test -f /tmp/healthy && find /tmp/healthy -mmin -1 | grep -q healthy"]
-      interval: 30s
-      timeout: 10s
-      retries: 3
-      start_period: 60s
-    networks:
-      - default
 networks:
   ix-databases_shared-databases:
     external: true