docs: ifrit's gate is #414, and two of its three prerequisites are done (#421)

docs/roadmap.md

@@ -872,22 +872,43 @@ what left this one unfireable for months.
   [#257](https://github.com/Gerrrt/HomeLab/issues/257): ADR-0020 decides only
   that no Alertmanager goes *inside* the stack, and the lab is otherwise being
   built to go quiet.
-- **[#96](https://github.com/Gerrrt/HomeLab/issues/96) Procure `ifrit` and build
-  the playground** — only after the main network is finished. The isolation
-  mechanism ADR-0007 deferred is settled by ADR-0014: `ifrit` is single-homed on
-  ImaginationLAN, the targets sit on a bridge with no physical port on a subnet
-  the firewall does not route, the attack VM does not forward, and the
-  hypervisor management planes close at the host. ADR-0017 settles the rest —
-  buy for IOPS and quiet rather than for threads, because the range's whole
-  operation is snapshot-and-revert and `Saruman`'s complaint is already
-  spindles; socketed RAM, because `prometheus`'s is soldered; `172.30.30.0/24`
-  on the isolated bridge with no gateway anywhere on it; and no backups, no
-  monitoring and no patching for the guests, so the least important part of the
-  lab joins none of the estate's loops. "After the main network is finished"
-  now names issues: #101 first, because an attack VM pointed at an
-  uninstrumented estate teaches nothing; #234 before the segment holds
-  attackers; #235 decided — the iLO stays, ADR-0033 — before this build makes
-  it true. What is left is the purchase itself and the build.
+- **[#421](https://github.com/Gerrrt/HomeLab/issues/421) Buy `ifrit` and build
+  the range** — only after the main network is finished. This entry was keyed to
+  [#96](https://github.com/Gerrrt/HomeLab/issues/96) until 2026-09-17, and #96
+  closed on the decision and the runbook on 2026-09-04: the purchase it ended
+  by naming had no tracker at all for five days, and this file
+  went on pointing at the closed issue for another eight after #421 was opened —
+  the same shape as #102 → #404 and #95 → #413. The isolation mechanism ADR-0007
+  deferred is settled by ADR-0014: `ifrit` is single-homed on ImaginationLAN,
+  the targets sit on a bridge with no physical port on a subnet the firewall
+  does not route, the attack VM does not forward, and the hypervisor management
+  planes close at the host. ADR-0017 settles the rest — buy for IOPS and quiet
+  rather than for threads, because the range's whole operation is
+  snapshot-and-revert and `Saruman`'s complaint is already spindles; socketed
+  RAM, because `prometheus`'s is soldered; `172.30.30.0/24` on the isolated
+  bridge with no gateway anywhere on it; and no backups, no monitoring and no
+  patching for the guests, so the least important part of the lab joins none of
+  the estate's loops. "After the main network is finished" named three issues
+  when that sentence was written, and **two of them have closed since**:
+  [#234](https://github.com/Gerrrt/HomeLab/issues/234)'s tripwire was armed and
+  verified on 2026-09-08, and
+  [#235](https://github.com/Gerrrt/HomeLab/issues/235) was decided the same day
+  — the iLO stays, [ADR-0033](adr/0033-keep-the-ilo-on-the-lab-segment.md) —
+  with the hardening that decision owed done on 2026-09-09. Both are recorded in
+  full under *Done* below, which is why this paragraph does not restate them.
+  What is left of the gate is
+  [#101](https://github.com/Gerrrt/HomeLab/issues/101), and it is an umbrella
+  rather than a thing anyone builds: what it means here is the domain
+  ([#414](https://github.com/Gerrrt/HomeLab/issues/414)) and the SOC stack
+  ([#266](https://github.com/Gerrrt/HomeLab/issues/266) Wazuh and
+  [#267](https://github.com/Gerrrt/HomeLab/issues/267) Velociraptor), because an
+  attack VM pointed at an uninstrumented estate teaches nothing. This paragraph
+  ended "what is left is the purchase itself and the build" until 2026-09-17,
+  which read as though the money were the next thing to spend. **The purchase is
+  gated on #414 being built, and it is the last purchase on the estate's list,
+  not the next** — which is what *Everything still to buy* at the top of this
+  file has said since #421 was opened, and what this entry now agrees with
+  rather than contradicts.
   → [runbook](runbooks/build-the-playground.md)
 - **[#418](https://github.com/Gerrrt/HomeLab/issues/418) Fit the two SSDs in
   `Saruman`.** Two Samsung SM863a 960 GB SATA enterprise drives, bought

docs/runbooks/build-the-lab-guest.md

@@ -37,7 +37,7 @@ is already built and validated; what is missing is somewhere to run it.
 | | Decision | Why this and not the obvious alternative |
 | --- | --- | --- |
 | Name | `alexander` | A Final Fantasy summon, like `shiva` and `ifrit` already on this segment. A fortress, which is what the defended estate's own observer is |
-| Address | `10.0.30.40/24` | Statics on this segment live **below `.100`**; the pool is `.100–.200`. Continues the decade spacing — `shiva` .10, `Saruman` .20 (after #96), `ifrit` .30 |
+| Address | `10.0.30.40/24` | Statics on this segment live **below `.100`**; the pool is `.100–.200`. Continues the decade spacing — `shiva` .10, `Saruman` .20 (after #421), `ifrit` .30 |
 | Kind | **VM, not LXC** | `stacks/lab` uses `cgroup: host`, `cap_drop: [ALL]` and a Docker socket mount. Docker in an LXC needs nesting and keyctl workarounds, and those settings behave differently under one. A VM has no such asterisks |
 | OS | **Ubuntu Server LTS** — `alexander` runs 26.04 | See below. This is the one that would have bitten quietly |
 | Disk | 64 GB | Prometheus is capped at 4 GB and Loki keeps 15 days of a small estate. 64 GB leaves room without pretending the spindles are free |

docs/runbooks/build-the-playground.md

@@ -29,13 +29,23 @@ than assumed"; §8 is that check, and it is the reason this file exists.
 
 ## 0. Before you start
 
-Three things belong ahead of this work, per ADR-0017:
+ADR-0017 put three things ahead of this work, and **two of them are done**.
+This table read as three open to-dos until 2026-09-17, by which point two of
+its rows had been closed for over a week. The tracker for the buy and the build
+is [#421](https://github.com/Gerrrt/HomeLab/issues/421); #96 closed on the
+decision and on this runbook.
 
-| | Why it is first |
-| --- | --- |
-| [#101](https://github.com/Gerrrt/HomeLab/issues/101) — `stacks/lab/` on `Saruman` | An attack VM pointed at an estate with no Wazuh, no Velociraptor and no domain teaches nothing. This is the half that carries the value |
-| [#234](https://github.com/Gerrrt/HomeLab/issues/234) — the ImaginationLAN tripwire | The only thing watching the boundary this build creates. It is a no-op until the segment holds attackers, which is what §5 makes it |
-| [#235](https://github.com/Gerrrt/HomeLab/issues/235) — whether `shiva` stays on VLAN 30 | Decided: it stays ([ADR-0033](../adr/0033-keep-the-ilo-on-the-lab-segment.md)). Before §5 puts a Kali VM in its broadcast domain, do the iLO hardening that ADR lists — IPMI-over-LAN and unused services off |
+| | State | Why it is ahead of §1 |
+| --- | --- | --- |
+| [#101](https://github.com/Gerrrt/HomeLab/issues/101) — the defended estate on `Saruman` | **The one that still gates this build.** The umbrella is not a thing anyone builds: what this waits on is the lab domain ([#414](https://github.com/Gerrrt/HomeLab/issues/414)) and the SOC stack — [#266](https://github.com/Gerrrt/HomeLab/issues/266) Wazuh and [#267](https://github.com/Gerrrt/HomeLab/issues/267) Velociraptor, in `stacks/soc/` on `odin` per [ADR-0030](../adr/0030-give-the-security-tooling-its-own-guest-and-its-own-stack.md). Whether each is built is on its own issue | An attack VM pointed at an estate with no Wazuh, no Velociraptor and no domain teaches nothing. This is the half that carries the value |
+| [#234](https://github.com/Gerrrt/HomeLab/issues/234) — the ImaginationLAN tripwire | **Armed and verified 2026-09-08**, and nothing here re-arms it. §8 and §9 assume it is already live | The only thing watching the boundary this build creates. It is a no-op until the segment holds attackers, which is what §5 makes it |
+| [#235](https://github.com/Gerrrt/HomeLab/issues/235) — whether `shiva` stays on VLAN 30 | **Decided: it stays** ([ADR-0033](../adr/0033-keep-the-ilo-on-the-lab-segment.md)), **and the hardening that decision named was done 2026-09-09** — IPMI-over-LAN, SSH and iLO Federation off, the BMC's credential shared with nothing in the house, its security log read for a baseline, and the redundant `10.0.30.10 → 10.0.99.20/udp` return-path rule deleted from `morpheus`. Read [`SECURITY.md`](../../SECURITY.md)'s row for it rather than doing it again | Before §5 puts a Kali VM in its broadcast domain, the BMC already in that domain has to be the hardened one. A decision taken afterwards is taken under a fact that is already true |
+
+So what genuinely remains ahead of §1 is the estate and the machine. `ifrit` is
+unpurchased, and the purchase is gated on #414's domain being built: it is the
+**last** purchase on the estate's list, not the next. ADR-0017 and #421 carry
+the spec to buy against, and nothing below this section can be started without
+the box.
 
 You will also need a free Green access port on `neo` and an outlet on the PDU.
 `ifrit` does **not** hang off the unmanaged shelf switch: that switch is fed