docs(nas): the transcode passed, ADR-0040's condition is closed, and the share is television-only

docs/hardware.md

@@ -204,8 +204,10 @@ revisions of this repository treated `shiva` as the hypervisor itself.
   `MJ05N4NK`. Xeon E3-1225 v6 at 3.30 GHz, four cores, and `Active Video: IGD`
   — so the P630 this box was chosen for is live, which is the hardware half of
   [ADR-0040](adr/0040-run-truenas-on-smaug-and-keep-the-media-stack-in-this-repository.md)'s
-  reopen condition and not the whole of it; whether Quick Sync reaches a
-  container is still untested. 8192 MB at 2133 MHz, which is **one** Samsung
+  reopen condition and not the whole of it; **whether Quick Sync reaches a
+  container was tested on 2026-09-19 and it does** — a hardware decode,
+  scale and `h264_qsv` encode inside the Jellyfin container, per
+  [`build-the-nas.md`](runbooks/build-the-nas.md) §6.1. 8192 MB at 2133 MHz, which is **one** Samsung
   `M391A1G43EB1-CPBQ` — 8 GB 2Rx8 PC4-2133P, ECC unbuffered, date code 1728 —
   in one of four slots. More memory is therefore an add and not a replace, and
   the part to match is ECC **unbuffered**: a registered DIMM will not run on

docs/roadmap.md

@@ -803,9 +803,10 @@ what left this one unfireable for months.
   drives landed 2026-09-18**, both at zero hours by the FARM log and not only
   by SMART, and the rest followed: the mirror `erebor`, its two datasets, the
   household share `media`, and the stack running under TrueNAS's Docker with
-  the scrape live on 2026-09-19. Of ADR-0040's reopen condition, the render
-  node reaches the container and the process carries the render group; the
-  transcode itself is the half still unrun.
+  the scrape live on 2026-09-19. **ADR-0040's reopen condition is closed**:
+  the render node reaches the container, the process carries the render
+  group, and a forced transcode ran through VAAPI and `h264_qsv` at about
+  five times real time the same day. The stack stays on this host.
   Reading the enforced ruleset first changed two of the answers, and both were
   borne out when the rules were created. **50→40 is not simply a rule to add**:
   Hicks and Winterfell each carry an explicit *Block access to

docs/runbooks/build-the-nas.md

@@ -466,6 +466,17 @@ compression stays on and costs nothing on already-compressed media.
 > which is nobody's group and not `builtin_users` — so one entry was added:
 > `everyone@`, Allow, Basic Read, Inherit. The list now has five entries, the
 > four the preset wrote and that one.
+>
+> **No workstation can mount this share, and that was found by trying.** The
+> Hicks rules from §0.5 pass `443` and `8096` to `smaug` and nothing else;
+> SMB is `445`, so a Hicks machine that reaches the TrueNAS UI and Jellyfin
+> gets nothing from `\\10.0.40.30\media`. Only devices already on
+> CasaBonita can mount it, and those are televisions. Getting a film onto the
+> library today means the console shell — `mkdir` and `curl` under
+> `/mnt/erebor/media/` — which is how the test clip in §6.1 arrived. Whether
+> the answer is a fifth Hicks rule on `445` or something else is
+> [#523](https://github.com/Gerrrt/HomeLab/issues/523)'s; it is recorded
+> here because the share exists and looks usable and is not.
 
 **Shares → Windows (SMB) → Add**, pointed at `erebor/media`.
 
@@ -561,8 +572,16 @@ minutes: no restart, no deploy, no `--force-recreate`.
 > target was uncommented the same morning. Inside the container:
 > `renderD128` listed as `root 107` and `id` read
 > `uid=65534(nobody) gid=65534(nogroup) groups=65534(nogroup),107` — both
-> halves of the check below that a shell can make. The transcode is the one
-> it cannot, and is still to run.
+> halves of the check below that a shell can make. **The transcode passed
+> the same day**, read off the ffmpeg command line Jellyfin logged rather
+> than off the dashboard, which hides the answer behind a hover: libva
+> opened the `iHD` driver, the input was decoded with `-hwaccel vaapi`,
+> scaled on the GPU with `scale_vaapi`, and encoded by **`h264_qsv`** —
+> 300 frames of 1080p to 540p in 0.76 s, about five times real time, on a
+> 10-second Big Buck Bunny clip played at a forced 480p. **ADR-0040's
+> reopen condition is closed and decision 2 stands.** The log is
+> `/config/log/FFmpeg.Transcode-*.log` inside the container; `docker top
+> media-jellyfin` shows the same line while a stream is running.
 
 Expect **no** `node_network_*` series from this host. Those collectors are
 disabled on purpose, because a bridged container reads its own veth and would
@@ -599,9 +618,12 @@ measurement.
 ## §7 — Verify
 
 > **As of 2026-09-19:** the monitoring-host line holds in both halves, the
-> device checks hold, and `zpool status erebor` is `ONLINE` with no errors.
-> **Not yet read:** a television playing, the QSV transcode, the two extended
-> self-tests, and the post-deploy re-reads of the tripwire and port 15.
+> QSV transcode passed (§6.1), `zpool status erebor` is `ONLINE` with no
+> errors, `up{job="node",instance="smaug"}` reads 1, and the tripwire and
+> the rule order were re-read from `morpheus` after the stack came up:
+> 143,780 evaluations, **0 packets**, all four passes still above the block.
+> **Not yet read:** a television playing, the two extended self-tests, and
+> port 15 in the switch UI.
 
 - A television on CasaBonita finds Jellyfin and plays something **without** any
   firewall rule being involved

stacks/media/README.md

@@ -134,7 +134,7 @@ Every non-obvious line in `compose.yaml` came off the pinned image on
   is a restart loop.
 - **65 MiB idle RSS**, which is what the 2 GiB ceiling is a ceiling over.
 
-## The check that is half done
+## The check that passed
 
 [ADR-0040] keeps the media stack in this repository on the strength of Quick
 Sync working, and names its own reopen condition: **the iGPU reaching a
@@ -144,11 +144,13 @@ different claims. `devices: /dev/dri` and `RENDER_GID` are where the second
 claim is made; [`build-the-nas.md`] §6 is where it gets tested, **before the
 library exists**, because moving a populated library is a weekend.
 
-**On 2026-09-19 the shell half passed**: `renderD128` is listed inside the
-container as `root 107`, and `id` there reads
-`groups=65534(nogroup),107`. What that does not prove is a transcode, which
-is a claim only Jellyfin's playback settings and a played file can make, and
-that is the half still open.
+**On 2026-09-19 both halves passed.** `renderD128` is listed inside the
+container as `root 107`, `id` there reads `groups=65534(nogroup),107`, and
+a 1080p clip played at a forced 480p was decoded with `-hwaccel vaapi` on
+the `iHD` driver, scaled by `scale_vaapi` and encoded by `h264_qsv` at about
+five times real time — read off the ffmpeg command line in
+`/config/log/FFmpeg.Transcode-*.log`, not off the dashboard. [ADR-0040]'s
+reopen condition is closed; the stack stays here.
 
 [ADR-0008]: ../../docs/adr/0008-place-services-by-data-trust.md
 [ADR-0012]: ../../docs/adr/0012-publish-only-ports-with-an-off-host-consumer.md