docs(prometheus): the A1437 cell is fitted, and the swap corrected two documents (#454)

[Gerrrt]

What changed

The cell went into prometheus on 2026-09-18. Every document still said it was
in hand and unfitted; they now describe the machine that exists. Nothing here
changes a rule expression, adds a metric or needs a deploy.

Metric	Old cell, 2026-09-17	New cell, 2026-09-18
charge_full	6.196 Ah	6.889 Ah
charge_full_design	6.6 Ah	6.8 Ah
ratio	0.9388 (94 %)	1.013 (101 %)
cyclecount	108	1
voltage_min_design	11.21 V	11.4 V
info manufacturer / model_name	SMP / bq20z451	unchanged

HostBatteryNotReported is quiet, every scrape target is up, and the firing set
came back identical to the pre-swap snapshot — ScheduledJobFailed
(backup-volumes), SecretsKeyBackupUnproven, RebootRequired and
GatewayMonitorUnreliable had all been firing continuously for the four days
before, so none of them is this work.

#454 stays open

The runbook names step 8 — mains pulled on a fully charged cell with the
runtime measured — as the step that settles the issue, and it has not been run.
The pack was still charging when these readings were taken. Every commit here
says Refs, and there is deliberately no ## Done entry on the roadmap; the
precedent for work landed against an open issue is #418.

What fired on the day was accidental: the machine came back from the swap
unplugged at 41 %, so HostOnBattery went pending and then firing for
prometheus and nothing else, with UpsOnBattery quiet throughout. That is the
discriminator the runbook wanted, arrived at by accident, on a clock that was
three hours wrong. It is not a bounded test and it measured no runtime.

Step 2 was never performed and now cannot be. HostOnBattery had never
fired for prometheus across the whole 30-day retention, and the old cell is
gone, so the discrimination step 2 was written to buy — a step 8 failure being
the cell or the adapter and nothing else — is unavailable. Recorded rather than
glossed, and worth running properly when the page is reused on oracle.

Two things the swap showed the documents had wrong

The design figures moved, and the runbook said they could not. Step 1's
table marked charge_full_design and voltage_min_design "must not move". Both
did. They are figures the pack's own gas gauge reports, not properties of the
model, and an aftermarket A1437 reports its own. The expectation is inverted
rather than restated, because on a machine that exports no serial number
that movement is the only proof the part changed at all — the gauge identifiers
came back byte-identical, exactly as step 7 warned. Step 7's three proof rows
become four. Nothing in the rules depends on either figure:
HostBatteryHealthLow reads the ratio, so the movement is absorbed.

Disconnecting the cell reset the RTC, and nothing noticed — filed as
#519. The post-swap boot opens
2026-07-28 15:04:45; systemd-timesyncd restored the clock to 14:53:37, the
second the machine went down, and the stack then ran ~14 minutes writing samples
at backdated timestamps before NTP stepped it forward to the true 18:12.

So the 184-minute "hole" at 15:08–18:12 is not downtime, real post-swap
operation is filed inside the outage, and the true window — 14:53:37 to about
18:12, roughly 3 h 18 m — is over this page's own two-hour bound and not
recoverable from the series at all. Step 6's measure the hole query therefore
gives a confident wrong answer after a battery swap, and now says to take the
window from journalctl --list-boots. HostClockSkew could not have caught it:
it reads abs(node_timex_offset_seconds), which peaked at 0.004 s, because
the kernel's correction says nothing about a clock that is wrong but stable.
node_timex_sync_status was 0 for exactly the backdated window and is read by
no rule — that is #519's question, and no rule lands here.

Blast radius

• No rule expression changed — one YAML comment block and one added test case
• No change to network segmentation or firewall rules
• No new port, no new image, no new credential
• Nothing to deploy; the running rules are byte-identical

Verification

• ./scripts/validate.sh passes — promtool test rules over 11
  observability files through the pinned image, documents agree with the configs, 3 expected host-only skips
• The new test case was proved non-vacuous: flipping its exp_alerts: [] to
  expect a firing alert makes the run FAIL with got:[], confirming the
  rule is genuinely quiet at a ratio of 1.013. Flipped back and re-run green.
• python3 scripts/check_docs.py — docs OK, 83 Prometheus + 18 Loki rules,
  7 dashboards, 141 panels, 10 assertions. No counted claim moves: the buy
  table keeps its row count, no runbook file is added, and adding a case for
  an already-tested alert leaves the coverage sentences alone.
• npx markdownlint-cli2 clean across all 92 files (MD028 caught and fixed)
• Commit messages and this description scanned multiline for GitHub's
  close keywords — none present, so merging leaves the issue open. Worth
  knowing: the parser does not read negation, so a sentence saying the
  change does not close an issue still closes it. An earlier draft of
  this description did exactly that, twice.

One fact here is not a measurement: the old cell's recycling date,
2026-09-18, comes from the operator rather than from an instrument.

What stays with the operator

Step 8, once status reads Full: pull prometheus's brick only, expect
HostOnBattery within four minutes and UpsOnBattery silent, measure the
runtime, stop at 20 minutes or 50 %. That is what settles #454.

🤖 Generated with Claude Code