[Gerrrt]

What changed

Docs only. The UPS shutdown runbook was re-read against the estate as it stands after the rack move, so the window for steps 5 to 7 proves the right sequence. New ADR-0107 makes trinity a third NUT secondary and caps Saruman's ordered guests at down=90. Nothing was changed on a host.

Why

Refs #574. Steps 0 to 4 were built on 2026-09-23, and three things have moved since:

• trinity is on the PDU since the 2026-11-07 rack move (Move the estate into the 32U rack #919), along with gandalf, the console and the KVM. ADR-0049 left trinity's row "to be decided when it is placed", and nothing told it to halt.
• Saruman runs 13 guests, not 2. Four are in ordered stages. With a hung guest per stage, the default timeouts add up to about 15 min, against the card's 8-min low-battery duration (read 2026-10-09 on No host shuts down on the UPS's signal, and nothing records what powers smaug #574).
• The UPS's outlet groups were read for the first time, but their shedding settings were not. Load shedding on group 1 would cut the whole PDU before any host is told to halt.

What the runbook gains:

• Step 4b: rules on igc0.99 first, then LISTEN 10.0.99.1 3493, a block proved from prometheus with 53 as the control, then nut-client on trinity.
• Step 3.6: reads the startup: lines and sets down=90 on the four ordered guests. That leaves a worst case of about 9½ min.
• Before you start: two new boxes, the outlet-group and load-shedding read, and trinity's LUKS passphrase.
• Step 5: trinity in the timing loop, the expected order, the alert table, and power-on, which follows the move runbook's §7.
• §6.5: the final low-battery duration is now the larger of the measured run and the worst-case bound, plus half again. Today's worked example gives 15 min.
• Step 7 and troubleshooting: rows and an entry for the new pieces.

ADR-0049 is accepted and stays as written. It gains only a pointer note, the same pattern ADR-0106 used on 0007, 0014 and 0017. hardware.md, security.md, the roadmap and the changelog say the same thing. The README's ADR count goes from 106 to 107.

Blast radius

None until the window. This changes text only. When it is applied, it adds one pass/block pair on Winterfell (igc0.99, 10.0.99.40 → 10.0.99.1:3493), a listener on 10.0.99.1, and shorter guest stop timeouts on Saruman.

• No change to network segmentation or firewall rules (this PR documents a pair to be added, nothing is applied)
• No new port published to a VLAN that could not already reach the service
• No credential added outside secrets/*.sops.yaml

Verification

• python scripts/check_docs.py: docs OK.

• ./scripts/lint.sh: passed, with 11 tools skipped and not run, because there's no Docker daemon or pipx on this Windows machine. The skipped tools include markdownlint-cli2, shellcheck and editorconfig-checker, and CI runs them.

• Grepped the runbook for leftover two-guest, three-host and alexander/phoenix-only text.

• make validate passes (not run: see the skipped tools above)

• Deployed to the lab and confirmed working (the window does this)

• Docs updated

🤖 Generated with Claude Code

[Copilot]

🟡 Changes recommended

Unresolved battery-threshold timing, runtime-based shedding, and rebuilds that discard down=90 can cut power before guest shutdown completes.

5 open issues

• Rebuild paths omit the 90-second guest shutdown timeout · New
• Runtime shedding can leave too little time for shutdown · New
• Low-battery threshold is too short for the revised shutdown bound · New
• Winterfell listener is enabled before its firewall rules are installed · New
• HOSTSYNC cannot prevent early monitor logout during guest teardown · New

What changed in this PR

This documentation-only PR updates the UPS shutdown plan for the post-rack-move estate and the remaining #574 maintenance window. No host configuration is changed.

Changes:

• Adds ADR-0107 to make trinity a third NUT secondary and cap Saruman’s ordered guest shutdown timeouts.
• Expands the runbook with firewall rules, outlet-shedding checks, timing verification, recovery steps, and worst-case battery budgeting.
• Updates supporting documentation and the README’s ADR count.

File	Description
README.md	Increases the ADR count to 107.
docs/​security.md	Adds the planned trinity shutdown policy.
docs/​runbooks/​shut-down-on-the-ups.md	Updates configuration, shutdown proof, recovery, and battery-budget procedures.
docs/​roadmap.md	Expands the remaining UPS maintenance-window gate.
docs/​hardware.md	Records the pending subscription and outlet-shedding checks.
docs/​changelog.md	Records the runbook revision and new decision.
docs/​adr/​0107-subscribe-trinity-to-the-ups-and-bound-saruman-s-guest-stop.md	Defines the third secondary, guest timeout caps, and battery-budget policy.
docs/​adr/​0049-shut-down-on-the-ups-from-a-nut-server-on-the-firewall.md	Adds a pointer to ADR-0107 without rewriting the original decision.

_{Review effort: Balanced}