docs(runbook): four rules not three, and the switch step §0 never had (#413)

[Gerrrt]

build-the-nas.md §0 is complete and §1–§7 is blocked on two drives that have
not been delivered — the last carrier event is 2026-09-11 and the estimated
window (Mon Sep 14 – Thu Sep 17) has now lapsed. So this corrects the documents
the build will be run from rather than advancing the build.

This PR was opened before three peer sessions landed overlapping work, and
has been rewritten to say what actually survives. It has since merged main
twice, dropped its own §0.2b and its own security.md change in favour of
better versions, and closed #502
as superseded after taking that PR's better idea. What is left is listed below.

What this PR still contributes

§0.6's recorded proof pointed at the wrong command — the core of it

The evidence read "167–168 before 169 on igc0.99, 194–195 before 196 on
igc0.50". Those are right for pfctl -sr | grep -n and wrong for
pfctl -sr -vv, which numbers the same four rules @148, @149, @175,
@176. Both readings came off the live ruleset in one invocation — they
disagree by however many scrub rules precede the filter set, because -vv
numbers each ruleset from zero while grep -n counts output lines.

The command §0.6 needs is the one the numbers do not match, because the
tripwire check reads a counter and counters only come from -vv. §0.6 now
proves position by rule description, with a command verified against
morpheus, and says to read the order rather than the numbers. §0.5 carries
each rule's description because §0.6 matches on it.

The tripwire wording now separates packets, which must be zero, from
evaluations, which only climb — 118,621, then 128,629, then 129,266, with
nothing wrong on any reading.

§0.5's count, and stacks/media/README.md

§0.5 was headed "Create the three rules" over a three-row table while the
callout at the top of the same file said four. Now four rows, one per port.
stacks/media/README.md called the Hicks access "the one rule"; it is two.

network.md — the count now lives in one bullet

Adopted from #502, which had the better answer: two adjacent bullets both
counted the passes and drifted apart, so the first no longer counts them at all
and the second is the authority. Correcting both would have left the drift
vector in place. Also carries the port-15 record.

Three gaps that would have bitten mid-build

• §2 offered SSH as an alternative to the console. TrueNAS ships it
  disabled, §0.5 says the port-22 pass is inert, and 10.0.40.30:22 is closed
  from the monitoring host.
• §6 said "deploy the stack" with no command.
• §6's QSV check was ls -l /dev/dri on the host, which re-confirms the
  half that was never in doubt. ADR-0040's reopen condition is whether a
  container reaches the iGPU, so the check now runs inside it and inspects
  the supplementary groups group_add exists to set.
• §7's 9100 bullet read as a step that would pass, when nothing in §1–§6
  stands up a listener and Add the scrape path for a host that pushes nothing #256 has yet to settle its shape.

One claim made true rather than softened

ADR-0040 keeps stacks/media here so that "Dependabot, the digest pins and
make validate keep reaching it", and §6 and the stack README repeat it. The
pins and make validate did reach it; Dependabot did not — there was no
/stacks/media entry, so the Jellyfin digest pin was rotting unattended.

One sentence kept from this branch's own §0.2b

main's §0.2b (PR #494) is the better section and is what survives — cable
colour, the TrueNAS test-and-confirm rollback, the port 1 / port 3 exclusions.
This branch added one thing it lacked: that the section must stay lettered,
because renumbering §0.3 onward would move §0.5, which ADR-0016 and ADR-0040
both cite by name while ADRs are immutable (ADR-0001).

What this PR dropped to peers

• §0.2b — main's is better; this branch's was deleted.
• security.md — main's rewrite into "CasaBonita's exist" / "Skids' does
  not exist" is better than this branch's split of the same sentence, and was
  taken wholesale. Both had independently found that the sentence covered two
  decisions and only one half had gone stale; checked against the live ruleset,
  ADR-0035's pass to 10.0.20.104 genuinely still does not exist.
• build-the-nas §0 has no switch step, but port 15 moved from VLAN 30 to VLAN 40 #481 was already closed by PR docs(runbook): §0 had no switch step, and port 15 had moved #494.

CI

check-docs is red on this branch entirely from main — two ADR-0041
files and README.md's ADR and runbook counts. Nothing here causes or can fix
it; #509 does. This PR goes green
once that merges.

Re-read from morpheus before pushing: four passes above Block access to
CasaBonita on their interfaces, 443 still refused from Winterfell,
igc0.40 tripwire zero packets.

Scope

Refs #413 — the build is not done; the drives are still in transit and
§1–§7 is untouched.

Found and left out, worth their own issues: make backup STACK=media dies
today for want of a backup sentinel, scripts/pin-digests.sh only ever reads
stacks/observability, and README.md:210 says 39 ADRs in a spot
check_docs.py does not guard.

🤖 Generated with Claude Code