docs(nas): the television played, the stack headers stop saying undeployed, one reading left (#413)

[Gerrrt]

What this is

The build of smaug is one reading from done, and three files still described it as two days behind. This brings them up to what is true and records the reading that landed this evening.

Changes

• stacks/media/compose.yaml — the header said NOT DEPLOYED YET and Deploy with: make up STACK=media, two days after feat(nas): the drives are in, erebor exists, the stack runs and the scrape is on #522 deployed the stack under TrueNAS's Docker and docs(nas): the transcode passed, ADR-0040's condition is closed, and the share is television-only #524 wrote the opposite in the README beside it. It now says how it was deployed, that make up does not run on that host, and how a change reaches smaug (by hand — nothing there pulls from main). The devices: comment now says the container-half test ran on 2026-09-19 and passed, rather than pointing at a test still to run.
• stacks/media/.env.example — said render-config.sh regenerates .env on every make up; on smaug this file is the .env, copied unchanged (build-the-nas.md §6). And the RENDER_GID comment said whether a container can use the render node was "still §6's to prove"; it was proved 2026-09-19 (§6.1). stacks/media has no secrets file: Jellyfin's admin credential lives only in a password manager #528 is named as the owner of whether this stack ever gets a secrets file.
• docs/runbooks/build-the-nas.md — the two status blocks. A television on CasaBonita played something on the evening of 2026-09-19, read by the operator with no firewall rule in the path; the same-day claim that was withdrawn is kept as history. The top block's "still open" list is cut from five items to one.

What is still open on #413

The two Exos extended self-tests, at 10 % remaining this evening. They are read at the console with smartctl -l selftest — not from the monitoring host, which reaches 9100 and nothing else — and the result goes in hardware.md's Exos entry. That reading is the follow-up to this PR and is what ends the tracker; this PR does not, and its message carries Refs, not Closes.

Read live from the monitoring host while writing this: up{job="node",instance="smaug"} is 1, 1,061 samples in the last 24 h, no alert carries instance="smaug", 9100 answers, 22 refused, 443 unreachable, and erebor, erebor/media and erebor/apps all report through node_filesystem_*.

Verification

• make validate in the worktree: all checks passed, 3 skipped (the deployment-checkout-only ones).
• docker compose --env-file stacks/media/.env.example -f stacks/media/compose.yaml config -q parses.
• The commit message was grepped multiline for close keywords before pushing.

Refs #413

🤖 Generated with Claude Code