docs(security): #84 ends with the hardware, not another window

[Gerrrt]

What changed

Three documents, no device, no code.

• SECURITY.md — the 2026-08-20 transcript-leak row justified not rotating
  the switch community on the grounds that rotating it "means the neo residual
  above all over again". That reasoning is spent, and the row now says so.
  Gave the accepted residual a stated horizon. Sharpened "the string … was not
  to hand in the window", which read as not yet, to what is actually true: it
  is not recoverable, so the previous community's row retires with the hardware
  rather than by measurement.
• docs/security.md — corrected a stale claim that contradicted
  SECURITY.md. Its credentials-in-history table still asserted that neo
  "still accepts its previous community, and the stock public and private
  besides — measured 2026-09-06 and 2026-09-09". Those are precisely the GETBULK
  artefacts withdrawn on 2026-09-12. Mirrored the transcript-leak update and
  added the delivery estimate.
• docs/roadmap.md — the Retire the MokerLink switch's previous SNMP community #84 entry block only.

Plus issue #84 rewritten (body,
comment),
and its dead links to #231 and #232 dropped — neither issue exists in this
repository.

Why

#84 was holding a reboot window open for an overwrite that had already been
carried out on 2026-09-12, and holding it on the strength of STILL ACCEPTED
verdicts that the same day's measurement withdrew: neo does not check the
community on GETBULK at or below sixteen characters, so every earlier sighting
of the old string — and of stock public/private — was that bypass rather
than a table row.

SECURITY.md, docs/security.md and docs/roadmap.md were meant to move
together at the time. Two of the three did. The issue was the last artefact
still directing a reader to overwrite a community row and reboot the switch the
whole house runs through, and docs/security.md had been contradicting
SECURITY.md for five days — the rotation runbook names that file as the one
that must move with it, and warns that "leaving this one stale makes the two
disagree, which is worse than either being stale alone."

What is actually left on #84 is not a window. It is one unmeasurable thing: the
pre-rotation string was purged from git history and the operator confirms it is
not recoverable, so --old has nothing to type. Worth recording that measuring
it was never the expensive part either — --old is a single GET, and the agent
outage the issue warned about belonged to the deletion attempts.

So #84 closes when the MokerLink hardware leaves the rack. It stays open until
then.

Blast radius

• No segmentation or firewall change
• No new port
• No credential outside secrets/*.sops.yaml

Nothing was run against a device: no make render, no make reload, no
rotation, no reboot. Documentation only.

docs/hardware.md, README.md, ADR-0018 and ADR-0041 are deliberately
untouched — a concurrent session owns those for #444 and was sent the delivery
estimate and the commissioning requirement directly. It confirmed the leaked
community is handled there: per ADR-0041 the CRS326 comes up with v2c off
entirely, so the value is retired along with the PDU that served it rather than
replaced by a fresh one.

Verification

• make validate passes — all checks passed (3 skipped), exit 0, zero
  FAILs, run against these exact files. Notable sections: documents agree with the configs (docs OK — 82 Prometheus + 18 Loki rules, 7 dashboards, 141 panels, 10 assertions), all six Lint checks including markdownlint,
  and snmp inventory consistent across targets, generator, render and example. The 3 skips are validate's standard ones, not new.
• Not deployed, because there is nothing to deploy.
• Docs updated — the docs are the change.
• git diff --stat shows only the three intended files.

Refs #84

🤖 Generated with Claude Code