docs(security): re-verify the nine-hour window, and decide Zeek's half elsewhere (#441)

[Gerrrt]

What changed

Records the outcome of #441 rather than implementing it: its Suricata half
landed five days ago in #459 and is live, and its Zeek half turns out to belong
to #437 as a metric, not here as a Loki rule. Comment and prose only — no alert
rule is added or altered, and the counts stay at 82 Prometheus + 18 Loki.

Three files:

• loki/rules/security.rules.yaml — the ids block comment gains the
  2026-09-17 re-measurement beside the 2026-09-12 one it was sized from.
• docs/security.md — the Suricata passage records the re-verification, and a
  new paragraph states the limit none of the three above it names: Suricata is
  not a protocol logger, that ground is Zeek's, and Zeek's absence is not
  answerable from this Loki.
• docs/roadmap.md — a Done entry for Alert on a sensor that stops logging: absence rules for Suricata and Zeek #441, which had none. Neither Alert on a sensor that stops logging: absence rules for Suricata and Zeek #441 nor
  Run Zeek on a mirror port, and see the VLAN 30 traffic the firewall never will #437 appeared anywhere in the roadmap.

Why

The window still holds, re-read rather than assumed. Measured again over the
full current retention — 27.7 days to 2026-09-17 22:25 UTC, five-minute buckets:

stream	span	gaps >1h	gaps >9h	longest
both interfaces (what the rule sees)	27.7 d	6	0	1.33 h
igc0.20 (Skids)	15.4 d	3	0	1.25 h
igc0.10 (Degens)	13.7 d	30	7	47.5 h

The worst aggregate silence grew from 75 to 80 minutes in five weeks, so nine
hours keeps nearly seven times the headroom DhcpLeaseLogsStopped settled on.
The aggregate design earned its keep: igc0.10 alone crossed nine hours seven
times, so the per-interface rule #441 opened with would have paged seven times
in a fortnight.

One number is deliberately not compared, and the comment says so: 135 gaps over
thirty minutes here against 54 on 2026-09-12. That is bucket alignment and which
streams were summed, not a change in Suricata; the long tail, which is the half
that sets the window, agrees. interface is also only stamped from 2026-09-02,
so the per-interface rows cover 13.7 days against the aggregate's 27.7.

Zeek's half is not a Loki rule. #441 proposed ZeekLogsStopped against the
lab's Loki once #437 existed. #437 existing is not sufficient:

• Run Zeek on a mirror port, and see the VLAN 30 traffic the firewall never will #437 puts Zeek's logs on alexander and never on 10.0.99.20 — ADR-0007
  requires it, ADR-0039 reaffirms it by keeping the mirror on Saruman's bridge.
• ADR-0020 gives that stack no Alertmanager on purpose. stacks/lab/loki/ ships
  no ruler and no rules/, and its config says why: a ruler with nowhere to
  deliver evaluates rules and discards the result, which reads as coverage and
  is not.
• ADR-0028 revisited that boundary, let guest liveness cross, kept guest
  telemetry in the lab, and named what stays uncovered.

#437 already carries the right instrument — a homelab_zeek_mirror_active
textfile gauge read on the hypervisor, crossing as guest state under ADR-0028.
So Zeek's liveness is answered where Zeek is built, and #441 is being closed
separately rather than held behind a Wave 2 dependency that itself waits on #414.

Blast radius

None. Documentation and one YAML comment; no rule, no query, no port, no
credential. The rules file is a directory bind mount, so the comment reaches the
container on the next converge — and converge is report-only, so merging deploys
nothing.

• No change to network segmentation or firewall rules
• No new port published to a VLAN that could not already reach the service
• No credential added outside secrets/*.sops.yaml

Verification

• make validate passes

./scripts/validate.sh            all checks passed (3 skipped — not the deployment checkout)
make check-loki-rules            PASS 18 Loki rule(s) and 30 dashboard expression(s) parsed, 48 evaluated
python3 scripts/check_docs.py    docs OK — 82 Prometheus + 18 Loki rules, 7 dashboards, 141 panels, 10 assertions
./scripts/lint.sh --require-all  lint passed

The live ruler, before and after — the rule is untouched and in its good state:

ids   SuricataLogsStopped   state=inactive   health=ok

• Docs updated (docs/security.md, docs/roadmap.md)

What this does not prove. Loki rules still have no unit-test harness, so
check_loki_rules.sh shows the rule parses and the ruler evaluates it — not
that it fires.

🤖 Generated with Claude Code