diff --git a/docs/runbooks/build-the-nas.md b/docs/runbooks/build-the-nas.md
index 350ae5b6..538f53bd 100644
--- a/docs/runbooks/build-the-nas.md
+++ b/docs/runbooks/build-the-nas.md
@@ -22,10 +22,12 @@ and the two Exos X20 drives for §1 onward.
 > below. `node_exporter` answered the three §6.1 checks from the monitoring
 > host and the target in `targets/node.yaml` is live. Inside the container the
 > render node is present and the process carries GID 107 — the two halves of
-> ADR-0040's condition that a shell can check. **Still open in §7:** the
-> transcode itself, a television playing something, the two extended
-> self-tests (about 28 hours each, started 2026-09-18), and the tripwire and
-> port-15 re-reads.
+> ADR-0040's condition that a shell can check. **By the evening of 2026-09-19
+> the transcode had passed, a television had played something, and the
+> tripwire and port 15 were re-read** (§6.1, §7). **Still open in §7, and the
+> one line between this runbook and done:** the two extended self-tests,
+> about 28 hours each, started 2026-09-18 and at **10 % remaining** that
+> evening.
 >
 > **Status — 2026-09-16: §0 is the work that can be done before the drives
 > land, and it is the whole of what is blocking.**
@@ -623,10 +625,16 @@ measurement.
 > the rule order were re-read from `morpheus` after the stack came up:
 > 143,780 evaluations, **0 packets**, all four passes still above the block.
 > **Port 15 re-read in the switch UI the same evening: VLAN 40, PVID 40,
-> untagged only.** **Not yet read:** a television playing — this block said
-> it had, for about an hour on 2026-09-19, on a report that was withdrawn
-> before the evening was out — and the two extended self-tests, 20 % through
-> at six lifetime hours and due around the evening of 2026-09-20.
+> untagged only.** **A television on CasaBonita played something on the
+> evening of 2026-09-19**, read by the operator on the screen and with no
+> firewall rule in the path — this line had been claimed once earlier that
+> day and withdrawn within the hour, so this is the reading and that was not.
+> **Not yet read:** the two extended self-tests, at **10 % remaining** the
+> same evening (20 % through at six lifetime hours that morning), so they
+> complete overnight or the next morning. Read them at the console with
+> `smartctl -l selftest` on both drives; the result goes in
+> [`hardware.md`](../hardware.md)'s Exos entry and closes
+> [#413](https://github.com/Gerrrt/HomeLab/issues/413).
 
 - A television on CasaBonita finds Jellyfin and plays something **without** any
   firewall rule being involved
diff --git a/stacks/media/.env.example b/stacks/media/.env.example
index 54165af2..f40597d1 100644
--- a/stacks/media/.env.example
+++ b/stacks/media/.env.example
@@ -1,10 +1,12 @@
 # Non-sensitive tunables for the media stack.
 #
-# Edit this file, not .env — scripts/render-config.sh regenerates .env from it
-# on every `make up STACK=media`. Secrets do NOT belong here; see
-# secrets/README.md. This stack currently has none: Jellyfin's admin account is
-# created through its own setup wizard on first run and lives in its database,
-# not in an environment variable.
+# Edit this file, not .env. On smaug this file IS the .env: build-the-nas.md §6
+# copies it there unchanged, because every value in it is a plain host fact —
+# `make up STACK=media` and scripts/render-config.sh do not run on that host
+# (README.md says why). Secrets do NOT belong here; see secrets/README.md. This
+# stack currently has none: Jellyfin's admin account is created through its own
+# setup wizard on first run and lives in its database, not in an environment
+# variable. Whether the stack ever gets a secrets file at all is #528's.
 
 # The user Jellyfin runs as. Not root — the image declares no user and would
 # run as root if this were unset, and nothing else in this estate does.
@@ -30,10 +32,13 @@ JELLYFIN_GID=65534
 # ADR-0040's reopen condition turns on this working, and build-the-nas.md §6
 # is where it gets tested rather than assumed.
 #
-# Read off smaug on 2026-09-16: `107 render`. That the node exists at all is
-# worth noting — it means the kernel bound a driver to the P630 and exposed a
-# render node, which is one more step of ADR-0040's condition standing up. The
-# step it is NOT is a container using it, which is still §6's to prove.
+# Read off smaug on 2026-09-16: `107 render`, and re-read on 2026-09-19 before
+# the deploy. That the node exists at all is worth noting — it means the kernel
+# bound a driver to the P630 and exposed a render node, which is one step of
+# ADR-0040's condition standing up. The step it is NOT is a container using
+# it, and that one was proved on 2026-09-19 (build-the-nas.md §6.1): the node
+# is listed inside media-jellyfin, `id` there carries group 107, and a forced
+# transcode ran through VAAPI and h264_qsv.
 RENDER_GID=107
 
 # The library on erebor, mounted read-only into the container at /media.
diff --git a/stacks/media/compose.yaml b/stacks/media/compose.yaml
index 7db40925..dc1d2a0b 100644
--- a/stacks/media/compose.yaml
+++ b/stacks/media/compose.yaml
@@ -2,11 +2,17 @@
 # The media tier: ADR-0008's media server, placed with the screens it serves.
 #
 # Deployed on: smaug (10.0.40.30, VLAN 40 / CasaBonita) — the ThinkServer TS150
-#              of #413, running TrueNAS per ADR-0040.
-#              NOT DEPLOYED YET. docs/runbooks/build-the-nas.md §6 deploys it,
-#              after the ZFS mirror exists. Authored before the pool does, as
+#              of #413, running TrueNAS per ADR-0040. DEPLOYED 2026-09-19, from
+#              a copy of this directory's two files at /mnt/erebor/apps/stack,
+#              under TrueNAS's own Docker — docs/runbooks/build-the-nas.md §6.
+#              Authored on 2026-09-16, before the pool existed, as
 #              stacks/sensitive was authored before trinity was built.
-# Deploy with:  make up STACK=media      (from the repository root)
+# Deploy with:  NOT `make up STACK=media`. That target renders a secrets file
+#              this stack does not have, on a box with neither make nor sops.
+#              A change here reaches smaug by re-fetching compose.yaml and
+#              .env.example from main into that folder and running
+#              `docker compose up -d` there, by hand — nothing on smaug pulls
+#              from main on its own. README.md has the procedure.
 #
 # ---------------------------------------------------------------------------
 # Why this stack is one service
@@ -103,8 +109,10 @@ services:
     # The Intel HD P630 in the E3-1225 v6. ADR-0040 made a live iGPU the
     # HARDWARE half of its reopen condition and said explicitly that a P630 the
     # host can see and a P630 a container can use are different claims — this
-    # device line is where the second claim is made, and
-    # build-the-nas.md §6 is where it is tested.
+    # device line is where the second claim is made. build-the-nas.md §6.1 is
+    # where it was tested, on 2026-09-19, and it passed: the node is listed
+    # inside the container, `id` there carries the render group, and a forced
+    # transcode ran through VAAPI and h264_qsv at about five times real time.
     devices:
       - /dev/dri:/dev/dri
     # A ceiling to catch a leak, not a measurement — the same position