docs(adr): ADR-0041 — the CRS326 runs RouterOS, keeps neo, and serves TLS

[Gerrrt]

What changed

Nothing, to the running lab. neo is still the MokerLink and still on plain
HTTP. This adds ADR-0041, which decides how the already-bought CRS326 is
configured, and swap-the-switch.md, the three-phase procedure for the
cabling window. ADR-0018's banner is amended to point at both.

Why

#444 has already moved past the
decision its body asks for: the switch was bought on 2026-09-13 and recorded by
#463, the buy table is down to two rows, and the correction comment narrowed the
justification to one property — the TLS management interface, with #84 riding
along. What is left is a cabling window, and the device is not here (delivery
estimate slipped to 2026-09-23).

ADR-0018's note said the successor ADR would be written when the switch was
racked. That is the wrong time. neo carries every VLAN, so the swap is a
house-wide outage, and an outage is not when to weigh a dual-boot device's two
operating systems. This decides the half that cannot be changed later; the
serial, MAC and shipped firmware go to hardware.md at the bench.

What ADR-0041 decides: RouterOS over SwOS (SwOS is HTTP-only and v1/v2c-only
— it reproduces the limit the purchase exists to escape). The name neo and
10.7.7.2 are inherited and the switch LAN stays, for a reason it did not
originally have: network.md explains that LAN as a workaround for a UI that
would not bind to a tagged interface, which is the MokerLink's limit and leaves
with it — it survives because an untagged link to morpheus is the way back in
after a bad bridge VLAN-filtering commit. www-ssl from an estate-CA leaf, not
the tier's (a switch cannot ask for an ACME renewal, and blackbox already
verifies estate-CA leaves by ca_file). SNMPv3 authPriv, v2c off. Mirroring
stays disabled per ADR-0006 — buying a device that can mirror was never a
decision to mirror.

Two things the issue's own cutover list does not mention, both in the
runbook:

• network.md:251 blocks the switch LAN apart from 10.7.7.2:80. Disabling
  plain www before widening that pass to 443 leaves a correctly configured
  switch that Hicks — the workstation running the window — is not allowed to
  reach. Widen, prove, then close 80.
• SECURITY.md records that the MokerLink's SNMP community leaked into a
  session transcript on 2026-08-20 and was deliberately not rotated, because
  rotating it meant repeating the residual. That reasoning expires with the
  hardware only if the value does too, so commissioning derives nothing from it.
  (Raised by the session working Retire the MokerLink switch's previous SNMP community #84; verified against SECURITY.md before
  writing.)

Also: no per-port VLAN map exists anywhere in this repository, so capturing one
off the MokerLink is the first bench step — 26 cables and no map is how the
house comes back wrong.

Blast radius

None now. The estate runs unchanged until the window. The runbook's Phase 3 is
where network.md, generator.yaml, the SNMP and blackbox targets and
snmp-verify.sh change, and none of them are touched here — two peer sessions
own #84 and #85 and those files are theirs until then.

One thing that could still imply a purchase, flagged rather than assumed: 26
copper ports are replaced by 24 plus two SFP+. If the port census shows more
than 24 populated, an SFP+ copper module edits Everything still to buy in the
same commit. The buy table is unchanged by this PR — #463 already took the
switch's row off it.

• No change to network segmentation or firewall rules
• No new port published to a VLAN that could not already reach the service
• No credential added outside secrets/*.sops.yaml

Verification

• python3 scripts/check_docs.py — green at 10 assertions. It caught
  the README counts, as it did on ADR-0039 and ADR-0040: 40 ADRs → 41 and
  25 runbooks → 26. The tree comment at README.md:210 was separately stale
  at 39 and is corrected to 41.
• ./scripts/lint.sh --require-all — all five linters pass. markdownlint
  is the gate that matters here: ADR-0018's supersede note is folded into
  its existing blockquote, because two adjacent blockquotes are MD028.
• Every relative link in both new files resolves. One was wrong on the first
  pass — ADR-0013 is superseded by ADR-0025, which is the current firewall
  record.
• make validate — via CI, not locally. Validate configs, Lint and
  Secret scan are all green on this head. Locally it did not finish: a run
  was killed by its own 25-minute budget inside check_dashboard_roundtrip,
  which boots Grafana, after every prior step passed — a known slow step on
  this host under a busy shared docker daemon, and unrelated to a change
  that touches no stack, rule, dashboard or compose file.
• Deployed to the lab and confirmed working — n/a, nothing deploys.
• Docs updated

Refs #444, #84, #85 — none of them close here. #444 and #84 close at the window.

🤖 Generated with Claude Code