[Gerrrt]

What changed

security.md's mains-loss row now says the UPS shutdown is armed and not proved. Before, it said nothing shuts down on the signal. network.md now lists the two NUT pass/block pairs to the gateway's own address on 3493, one on igc0.30 for Saruman and one on igc0.40 for smaug. The runbook's step-7 row for security.md now names what the rack visit will change next. There is also a changelog entry. Documentation only: nothing on the lab changes.

Why

Refs #574. The issue text predates ADR-0049. Since then:

• The decision is made. ADR-0049, amended by ADR-0107, says who shuts down on the UPS's signal.
• hardware.md records each host's power. Its Rack table has a Powered by column, and smaug is on PDU outlet 3.
• The S3520's unsafe-shutdown count is watched, by SmartDriveUnsafeShutdownsGrowing.
• Steps 0–4 of shut-down-on-the-ups.md were built on 2026-09-23.

Two current-state documents had not caught up with that build, so they stated things that are no longer true.

What still owes the close is the rack visit, runbook §5–§7:

• read the outlet groups' settings
• apply step 4b (trinity) and steps 3.6–3.8
• run the upsmon -c fsd proof
• do one mains pull, to replace the card's 47-minute estimate

Blast radius

None on the hosts. The two NUT pairs network.md now describes were built on 2026-09-23, and the Saruman pass was re-made for .20 on 2026-11-07. This PR only writes them down.

• No change to network segmentation or firewall rules
• No new port published to a VLAN that could not already reach the service
• No credential added outside secrets/*.sops.yaml

Verification

• python scripts/check_docs.py: docs OK (159 Prometheus + 20 Loki rules, 8 dashboards).

• ./scripts/lint.sh: passed, but 11 checks were skipped, not run: markdownlint-cli2, shellcheck, actionlint, zizmor, packer ×2, tofu ×3, ansible-lint and editorconfig-checker. There was no docker daemon or pipx on this Windows box. yamllint and ruff passed using local binaries, not the pinned versions. CI's markdownlint is the real check for this diff.

• make validate: not run, for the same reason.

• Grep of the current-state docs for "nothing shuts down": the only hit left is the rewritten runbook step-7 row.

• TrueNAS API, 2026-11-09: smaug reports no active alerts. Its UPS reporting graphs hold no data points, which is expected for a NUT secondary and doesn't show whether it is subscribed.

• Not run: upsc -c mjolnir@localhost on morpheus, which would show whether smaug logged in again after the 2026-11-06 rack move.

• make validate passes

• Deployed to the lab and confirmed working

• Docs updated (docs/, service README, or docs/roadmap.md)

🤖 Generated with Claude Code

[Copilot]

🟢 Approval recommended

No active review issues remain for this documentation-only clarification of UPS shutdown behavior and pending verification.

No open issues 🎉

What changed in this PR

This documentation-only PR aligns the UPS shutdown documentation with the existing NUT deployment for #574, distinguishing configured shutdown behavior from the proof and runtime measurement still pending. No host configuration or firewall rules change.

Changes:

• Clarifies that UPS shutdown is armed but unproved, with trinity still awaiting subscription.
• Documents the existing NUT firewall pass/block pairs for Saruman and smaug.
• Updates the runbook’s post-verification documentation requirements and records the correction in the changelog.

File	Description
docs/​security.md	Corrects the mains-loss protection status and identifies remaining work.
docs/​runbooks/​shut-down-on-the-ups.md	Specifies documenting the proved sequence and measured runtime after verification.
docs/​network.md	Records existing NUT access rules on both subscriber segments.
docs/​changelog.md	Adds a dated record of the documentation corrections and outstanding proof.

_{Review effort: Balanced}