docs: trinity landed on the 14th, carrying Windows and a return window

README.md

@@ -343,7 +343,7 @@ Open work is tracked in
 why it is in that order.
 
 The current top items: rehearse the firewall restore on the ProDesk bought on
-2026-09-08 — on hand since 2026-09-15, so what the rehearsal waits on is the
+2026-09-08 — on hand since 2026-09-14, so what the rehearsal waits on is the
 I226 card and the installer stick and no longer the box — and then build the
 sensitive tier on that same box ([#404](https://github.com/Gerrrt/HomeLab/issues/404), [ADR-0034](adr/0034-run-the-sensitive-tier-on-the-prodesk-and-make-it-the-spare-hardware.md)). **Every purchase still outstanding is in one place**, the
 roadmap's [*Everything still to buy*](docs/roadmap.md#everything-still-to-buy):

docs/hardware.md

@@ -102,15 +102,19 @@ revisions of this repository treated `shiva` as the hypervisor itself.
 - 1U vented rack shelf, 4-post with square-hole mounting — in U4 since
   2026-09-08, carrying the unmanaged switch that feeds `prometheus` and
   `oracle` ([#110](https://github.com/Gerrrt/HomeLab/issues/110))
-- HP ProDesk 600 G4 Micro — i5-8500T, 32 GB, 512 GB SSD, the same model as
-  `morpheus` — ordered 2026-09-08, **in hand since 2026-09-15** and opened on
-  2026-09-15. This is `trinity`, and it is **one box with two jobs, not two
-  boxes**: the sensitive tier's host, and
+- HP ProDesk 600 G4 Micro[^Trinity] — i5-8500T, 32 GB, 512 GB SSD, the same
+  model as `morpheus` — ordered 2026-09-08, **in hand since 2026-09-14** and
+  opened on 2026-09-15. This is `trinity`, and it is **one box with two jobs,
+  not two boxes**: the sensitive tier's host, and
   the firewall's spare hardware in a disaster
   ([ADR-0034](adr/0034-run-the-sensitive-tier-on-the-prodesk-and-make-it-the-spare-hardware.md)).
   The documents call it "the tier's host" in one place and "the spare" in
   another, which is how it came to be read as two machines ([ADR-0038](adr/0038-name-the-nas-smaug-and-reserve-zion-for-the-box-that-does-not-exist.md));
   a second ProDesk is deferred, not ordered.
+  This entry read "in hand since 2026-09-15" until 2026-09-17. The carrier's
+  notice puts the drop-off at 15:05 local on the 14th; the commit that recorded
+  it was written that evening and dated by UTC, which had already turned over.
+  The opening date is a separate reading and stands.
   It enters the Compute table when
   [#404](https://github.com/Gerrrt/HomeLab/issues/404) builds it, after the
   firewall restore has been rehearsed on it. It ships with the onboard NIC
@@ -121,10 +125,31 @@ revisions of this repository treated `shiva` as the hypervisor itself.
   the machine on 2026-09-15, and the answer the entry below was waiting for.
   There is no drive carrier and nothing contends: the I226 card has a slot to
   land in when it arrives, and the contingency the documents carried since
-  2026-09-11 does not fire. Still the listing's claims rather than the
-  machine's, and still to be read: the i5-8500T, the 32 GB and the 512 GB
-  above, the serial and the product number off the case, and that it really
-  does have the onboard NIC alone.
+  2026-09-11 does not fire.
+  **It arrived carrying Windows 11 Pro**, sold refurbished with a licence. The
+  rehearsal's first act is to wipe it, so that licence is spent rather than
+  banked: it is OEM, it dies with the install it shipped on, and **it does not
+  move the buy table's two Windows 11 Pro keys**
+  ([`roadmap.md`](roadmap.md#everything-still-to-buy)). Those are for the lab
+  domain's two endpoints ([ADR-0029](adr/0029-size-the-lab-domain-and-separate-its-namespace-and-clock.md),
+  [#414](https://github.com/Gerrrt/HomeLab/issues/414)) — a different machine
+  and a different decision.
+  **The warranty runs to 2027-09-08** — one year from purchase, through
+  SquareTrade, applied automatically because it was sold as eBay Refurbished.
+  It is worth recording because
+  [ADR-0034](adr/0034-run-the-sensitive-tier-on-the-prodesk-and-make-it-the-spare-hardware.md)
+  accepts that the tier is down until a replacement arrives: inside that year a
+  dead `trinity` has a claim behind it, and after it the ADR's cost is the
+  whole cost.
+  **The seller-return window closes 2026-10-08**, thirty days from purchase.
+  That is a deadline on the list below rather than a fact about the machine.
+  Still the listing's claims rather than the machine's, and still to be read:
+  the i5-8500T, the 32 GB and the 512 GB above, the serial and the product
+  number off the case, and that it really does have the onboard NIC alone —
+  **read them before that date**. Installing pfSense over the Windows partition
+  is what ends the return and is the one step of the rehearsal that cannot be
+  taken back, so the machine has to be proved while sending it back is still an
+  option. That is sooner than the card arrives, and it does not wait on it.
 - Intel I226-V 2.5 GbE card on an M.2 B+M-key adapter — bought 2026-09-11,
   in transit. The second port on the ProDesk Micro above, matching the card
   in `morpheus` so a pfSense restore onto the spare brings the LAN up as
@@ -360,6 +385,7 @@ revisions of this repository treated `shiva` as the hypervisor itself.
 [^UPS]: [APC Smart-UPS](https://www.apc.com/us/en/product-range/61913-smart-ups/)
 [^Shiva]: [HPE ProLiant DL360 Gen9](https://buy.hpe.com/us/en/servers/rack-servers/proliant-dl300-servers/proliant-dl360-server/p/1010026922)
 [^ProDesk]: [HP ProDesk 600 G4 Mini](https://www.microcenter.com/product/692358/)
+[^Trinity]: [HP ProDesk 600 G4 Micro, the refurbished unit that is `trinity`](https://www.ebay.com/itm/237046034784)
 [^SM863a]: [Samsung SM863a 960 GB, MZ-7KM960N](https://www.ebay.com/itm/800210578217)
 [^KVM]: [MT-VIKI 8-port rackmount KVM](https://a.co/d/2yQl4KH)
 [^Panel]: [Jadol 24-port patch panel](https://a.co/d/izggRoK)

docs/roadmap.md

@@ -89,28 +89,40 @@ capacity are still chosen at the till and recorded in
 [`hardware.md`](hardware.md) afterwards, per the ADR — nothing is named here
 before it is bought.
 
-**Already paid for and on hand**, as of 2026-09-15: the ProDesk 600 G4 —
+**Already paid for and on hand**, as of 2026-09-17: the ProDesk 600 G4 —
 `trinity`, the tier's host and the firewall's spare hardware
 ([#404](https://github.com/Gerrrt/HomeLab/issues/404)); the TS150 NAS and its
 boot SSD with the bracket and tape that mount it in the optical bay
 ([#413](https://github.com/Gerrrt/HomeLab/issues/413)); the 2 TB USB drive
-that becomes the photo library's disk on `trinity`; and the removable medium
-the second age recipient lives on.
+that becomes the photo library's disk on `trinity`; two SM863a SSDs for
+`Saruman` ([#418](https://github.com/Gerrrt/HomeLab/issues/418)); and the
+removable medium the second age recipient lives on.
 
 **Already paid for and still moving**: the I226 card on its M.2 adapter that a
 restore onto `trinity` needs
 ([#404](https://github.com/Gerrrt/HomeLab/issues/404)) and the pfSense
 installer stick — between them, the whole of what the rehearsal now waits on;
 the two Exos X20 18 TB drives for `smaug`'s mirror
 ([#413](https://github.com/Gerrrt/HomeLab/issues/413)); the CRS326 that
-replaces `neo` ([#444](https://github.com/Gerrrt/HomeLab/issues/444)); two
-SM863a SSDs for `Saruman`
-([#418](https://github.com/Gerrrt/HomeLab/issues/418)); and the A1437 cell
-that replaces `prometheus`'s thirteen-year-old one
+replaces `neo` ([#444](https://github.com/Gerrrt/HomeLab/issues/444)); and the
+A1437 cell that replaces `prometheus`'s thirteen-year-old one
 ([#454](https://github.com/Gerrrt/HomeLab/issues/454)).
 
-Four things crossed from the second paragraph to the first on **2026-09-15**:
-the TS150, the ProDesk, the boot SSD, and the bracket and tape that mount it.
+Four things crossed from the second paragraph to the first: the TS150, the
+ProDesk, the boot SSD, and the bracket and tape that mount it. All four were
+recorded here as **2026-09-15**; the ProDesk's is now **2026-09-14**, from the
+carrier's own notice, and the other three are unaudited. They were written in
+the same commit, that evening, and dated by UTC after it had turned over — so
+the same day may be out by one for each of them. Checking is
+[#413](https://github.com/Gerrrt/HomeLab/issues/413)'s, not this section's, and
+nothing here depends on which day it was.
+
+**2026-09-17: the two SM863a SSDs are on hand.** They were delivered
+2026-09-11 and carried above as still moving for six days. Delivery is recorded
+against the order, which was one order for the pair; that both drives were in
+it is not separately proved and is
+[#418](https://github.com/Gerrrt/HomeLab/issues/418)'s to confirm at the bays.
+
 **No row on the table above moves** — arriving is not buying, and this section
 tracks money. Nothing was racked, fitted or built by it either. What it changed
 is one sentence: the two builds stopped waiting on a van for their machines,
@@ -518,7 +530,15 @@ what left this one unfireable for months.
   wiped and built as the sensitive tier's host ([#404](https://github.com/Gerrrt/HomeLab/issues/404)), and it is the
   firewall's spare hardware in a disaster at the cost of the tier being down
   until a replacement arrives. The powered-off shelf spare is deferred to the
-  day that cost is unacceptable. Writing that procedure found the runbook's own decrypt
+  day that cost is unacceptable. **The box is in hand, and proving it has a
+  deadline the rehearsal does not**: it was sold refurbished with a one-year
+  warranty and a thirty-day return, and that return closes **2026-10-08**. The
+  spec, the serial and the NIC count are still the listing's word rather than
+  the machine's, and the step that would settle them — installing pfSense over
+  the Windows 11 Pro it arrived with — is also the step that ends the return.
+  So the machine gets proved before 2026-10-08 whether or not the card has
+  landed by then, which is the one part of this issue that is not waiting on a
+  package. Writing that procedure found the runbook's own decrypt
   command had never been run: it passed `--input-type binary`, which sops
   rejects on the first byte of a real export, so a restore following the
   runbook would have stopped at step one. Fixed, and it is the kind of thing

docs/runbooks/restore-the-firewall.md

@@ -331,17 +331,23 @@ whether the I226 card comes back as `igc0` on the spare, how long the whole
 thing takes — and to write the answers back into §3.
 
 **What the rehearsal is still missing.** This list was written on 2026-09-09
-to be lined up before the box arrived. The box arrived on 2026-09-15 and the
+to be lined up before the box arrived. The box arrived on 2026-09-14 and the
 card and the installer stick did not, so it stops being a countdown and
 becomes a list of what is blocking:
 
-- **The spare itself** — **here since 2026-09-15, opened, and not a blocker**
+- **The spare itself** — **here since 2026-09-14, opened, and not a blocker**
   ([`hardware.md`](../hardware.md)). Its 512 GB SSD is **M.2 and the second
   M.2 slot is free**, so the card below has somewhere to go and the
   drive-carrier contention this list warned about does not happen. It is a
   stock refurbished G4 that the listing says has the onboard NIC only, which
   is still the listing talking; the spec, the serial and the NIC count have
-  not been read off the machine.
+  not been read off the machine — and that reading now has a date on it.
+  **The seller-return window closes 2026-10-08.** It arrived carrying Windows
+  11 Pro, and step 2 below installs pfSense over it; that is the act that ends
+  the return, and it is the one step of this rehearsal that cannot be taken
+  back. So prove the machine — spec, serial, NIC count, disk health — before
+  that date. This is the only entry on this list with a deadline, and it is
+  not waiting on the two entries below that are.
 - **The I226 card** — bought 2026-09-11, **still in transit**
   ([`hardware.md`](../hardware.md)). One of the two things the rehearsal now
   waits on.