docs: reconcile every markdown file with the current repository state

[Xore]

Problem

146 first-party markdown files. Nothing machine-checks them, so drift is silent.

The mechanical half is now fixed in #3398 (mermaid parse gate, whole-tree link
gate, the two broken diagrams, the one dead link, both wired into quality.yml).
This issue tracks what a script cannot do: the semantic drift — docs
asserting stack counts, port numbers, index names, route tables and env-var
defaults that the compose files, arcane/manifests/home-production.json and the
source have moved past. The oldest narrative docs have not been touched since
2026-07-26.

Method, per file

For each task below, compare the doc's claims against reality and correct the
doc — do not correct reality to match the doc, except where the doc is the
authoritative design record. A plan/record doc may legitimately describe intent
that is not shipped; mark it as such rather than rewriting its history.

Cheapest sources of truth, in order:

1. arcane/manifests/home-production.json — the stack inventory
2. arcane/home/*/compose.yml — services, ports, env, profiles
3. git ls-files arcane/home | cut -d/ -f3 | sort -u — the actual stack count
4. arcane/home/honeypot-dashboard/backend-service/src/main.rs — the route table
5. arcane/home/honeypot-init/ — ES templates, pipelines, ILM
6. grep -rn 'profiles:' --include='*.yml'
7. graphify query "..." / graphify explain "..." when a claim spans files

Rules:

• A task is closed when the file was corrected or explicitly re-verified as
  accurate. Record which, in the PR body. No silent skips.
• Do not restyle prose that is not wrong. Minimal diffs.
• Numbers, counts and identifiers must be checked, not eyeballed.
• If a doc is genuinely obsolete, say so and propose deletion rather than
  patching it to look current.

Task list, oldest doc first

Group A — the six oldest

• Bump esbuild from 0.25.12 to 0.28.1 in /dashboard/frontend in the frontend-compatible group #1 SECURITY.md (2026-07-26)
• Bump actions/checkout from 6 to 7 #2 docs/analysis/gpu-queue/README.md (2026-08-05)
• Bump dependabot/fetch-metadata from 2.3.0 to 3.1.0 #3 docs/personas/README.md (2026-08-05)
• Bump docker/login-action from 3 to 4 #4 docs/sandbox/windows/runner/README.md (2026-08-05)
• Bump typescript from 5.9.3 to 7.0.2 in /dashboard/frontend #5 docs/sandbox/ghosts/README.md (2026-08-06)
• Bump actions/setup-go from 6 to 7 #6 docs/analysis/ghidra/revdeck/README.md (2026-08-11)

Group B — analysis / ghidra

• Bump actions/dependency-review-action from 4 to 5 #7 docs/analysis/ghidra/DASHBOARD_INTEGRATION_PLAN.md (2026-08-06) — diagram
• Bump golang in /dashboard #8 docs/analysis/ghidra/README.md (2026-08-10) — diagram
• Bump alpine in /dashboard #9 docs/analysis/ghidra/IMPLEMENTATION_PLAN.md (2026-08-27) — diagram
• chore(deps): bump the pip group across 1 directory with 3 updates #10 docs/analysis/README.md (2026-08-27) — diagram
• chore(deps): bump docker/metadata-action from 5 to 6 #11 docs/analysis/ghidra/benchmarks/README.md (2026-08-27)
• chore(deps): bump docker/build-push-action from 6 to 7 #12 docs/analysis/ghidra/ghidrassist/README.md (2026-08-27)
• chore(deps): bump actions/checkout from 4 to 7 #13 docs/analysis/yara/README.md (2026-08-27)
• chore(deps): bump docker/setup-buildx-action from 3 to 4 #14 docs/analysis/RECOVERY.md (2026-08-26)
• chore(deps): bump actions/setup-node from 4 to 7 #15 docs/analysis/ghidra/benchmarks/corpus/README.md (2026-08-30)
• chore(deps): bump the python-compatible group across 1 directory with 5 updates #16 docs/analysis/ghidra/models/README.md (2026-08-30)
• chore(deps): bump pyod from 2.0.0 to 3.6.2 in /ml-worker #17 docs/analysis/ghidra/AI_TRIAGE.md (2026-08-31) — diagram

Group C — sandbox

• chore(deps): bump redis from 5.0.4 to 8.0.1 in /ml-worker #18 docs/sandbox/windows/packer-golden-image-guide.md (2026-08-06) — diagram
• chore(deps): bump pandas from 2.2.2 to 3.0.5 in /ml-worker #19 docs/sandbox/windows-guest-risk-config-model.md (2026-08-12)
• chore(deps): bump numpy from 1.26.4 to 2.5.1 in /ml-worker #20 docs/sandbox/ghosts/IMPLEMENTATION_PLAN.md (2026-08-27)
• chore(deps): bump elasticsearch from 8.13.0 to 9.4.1 in /ml-worker #21 docs/sandbox/cape/IMPLEMENTATION_PLAN.md (2026-08-28)
• chore(deps): bump actions/setup-python from 5 to 7 #22 docs/sandbox/windows/IMPLEMENTATION_PLAN.md (2026-08-29) — diagram

Group D — core architecture / operations

• chore(deps): bump actions/setup-go from 5 to 7 #23 docs/STACK-REBUILD.md (2026-08-16)
• chore(deps): bump github/codeql-action from 3 to 4 #24 docs/GEOIP-THREAT-INTEL.md (2026-08-22)
• chore(deps): bump python-dateutil from 2.9.0 to 2.9.0.post0 in /ml-worker #25 docs/RECOVERY.md (2026-08-23)
• Align dashboard theme and modal rendering #26 docs/NETWORK.md (2026-08-27) — diagram
• Document direct deployment paths #27 docs/TESTING.md (2026-08-27)
• Fix home SSHFS mounts at boot #28 docs/persona-design.md (2026-08-27)
• Add homeserver login health dashboard #29 docs/settings-operations.md (2026-08-27)
• Fix empty sandbox analysis reports #30 docs/KEYCLOAK-OPERATIONS.md (2026-08-29)
• Normalize legacy sandbox timeout reports #31 docs/ARCHITECTURE.md (2026-08-30) — diagram
• Fix EveBox search stalls and resource limits #32 docs/ROCKY-10-MIGRATION.md (2026-08-31)
• Coordinate ML and GPU implementation roadmap #33 docs/PIPELINES.md (2026-09-02) — diagram
• Relay SSHFS events into EveBox #34 docs/gpu-docker-passthrough.md (2026-09-02) — diagram
• Boot sandbox guests deterministically #35 docs/gpu-ml-worker-acceleration.md (2026-09-02)
• feat(sandbox): expose result evidence differences #36 docs/knowledge-store-design.md (2026-09-02)
• fix(dashboard): keep modal host out of app grid #37 docs/STORAGE.md (2026-09-03) — diagram
• fix(dashboard): refresh corrected layout stylesheet #38 docs/DASHBOARD-CUTOVER.md (2026-09-04)
• fix(sandbox): merge DNS evidence from both captures #39 docs/ES-CONSUME-PATTERNS.md (2026-09-04)
• Add themed sandbox PDF reports #40 docs/KEYCLOAK-CUTOVER.md (2026-09-04)
• Plan user settings and configuration system #41 docs/OPERATIONS.md (2026-09-04)
• Keep PDF sections with their content #42 docs/canarytoken-live-fire-checklist.md (2026-09-04)
• Verify dashboard roles with auth backend #43 docs/community-threat-intel-sharing.md (2026-09-04)
• Coordinate auth and dashboard deployments #44 docs/container-writable-layer-audit-2026-09-03.md (2026-09-04)
• Document system architecture and analysis flows #45 docs/dionaea-bistreams-retention.md (2026-09-04)
• docs: plan dashboard profile action menu #46 docs/honeypot-network-isolation.md (2026-09-04)
• Windows sandbox Phase 1: build the Windows 11 golden image #47 docs/ip-reporting-plan.md (2026-09-04) — diagram
• Packer: fix the template so a Windows 11 build can start #48 docs/kvm-network-traffic-analysis.md (2026-09-04)
• Obtain the Windows 11 evaluation ISO (operator action required) #49 docs/kvm-snapshot-vs-golden-image.md (2026-09-04)
• Install Packer on the analysis host #50 docs/llm-inference-backend-comparison.md (2026-09-04)
• Run the Packer build and produce win11-analysis.qcow2 #51 docs/ml-gpu-coordinated-roadmap.md (2026-09-04) — diagram
• Define the libvirt domain and take the GOLDEN_READY snapshot #52 docs/security-fixes.md (2026-09-04)
• End-to-end smoke test: dashboard submit to Windows sandbox report #53 README.md (2026-09-05) — diagram
• 10.8.0.1 (the WireGuard tunnel peer) is counted as an attacker source on /ips #54 docs/ROADMAP.md (2026-09-05)
• Phase 4: author docker-compose.sandbox.yml (INetSim, mitmproxy, Zeek, Suricata on the isolated bridge) #55 docs/agent-intrusion-threat-model.md (2026-09-05)
• Run-cycle step 13: orchestrate/generate_report.py is referenced but missing #56 docs/benchmarks/claim-pools/README.md (2026-09-05)
• Gate 0: restore authorized management access and recover the home Compose stack #57 docs/dashboard-manual-ip-block-design.md (2026-09-05)
• CSP cutover: thread a per-request nonce through every page data struct #58 docs/ml-worker-plan.md (2026-09-05) — diagram
• Complete the modal inventory: event detail, payload preview, exports, destructive actions #59 docs/gpu-llm-analysis-worker.md (2026-09-07) — diagram
• Dashboard regression tests and the dark/light visual acceptance matrix #60 docs/sandbox/README.md (2026-09-08) — diagram
• ML worker v0.1: reconcile the scaffold against its plan and decide if it is runnable #61 docs/payload-analysis-workbench.md (2026-09-09) — diagram
• ML worker v0.2: feature engineering and HBOS fast filtering #62 docs/BACKUP-ESSENTIALS.md (2026-09-10)
• ML worker v0.3-v0.4: temporal and composite scoring with explainable output #63 docs/HOMESERVER-DISK-LAYOUT.md (2026-09-10)
• ML worker v0.5-v0.7: deliver scores to the dashboard #64 docs/HOST-TUNING.md (2026-09-10)
• ML worker v0.8-v1.0: retraining, versioning, drift detection and threshold controls #65 docs/analysis/ghidra/benchmarks/injection-gate-protocol.md (2026-09-10)
• Guarded GPU LLM analysis worker, offline and dry-run only #66 docs/benchmarks/2026-08-30-injection-gate-recalibration.md (2026-09-10)
• CUDA selection, GPU sharing budget, and embedding clustering #67 docs/benchmarks/plans/2026-09-05-1947-resume-plan.md (2026-09-10)
• IP reporter Phase 1: file tailing, SQLite dedup, whitelist, dry-run by default #68 docs/benchmarks/plans/2026-09-06-round7-hermes-init.md (2026-09-10)
• IP reporter Phase 2: Suricata and Blocklist.de validation with metrics #69 docs/benchmarks/plans/2026-09-06-round7-unsloth-train-requant-ollama.md (2026-09-10)
• Reconcile the KVM and network-analysis guides against the implemented sandbox tooling #70 docs/DECEPTION-EXTENSIONS.md (2026-09-13)
• Design a background-noise generator that cannot contaminate evidence #71 docs/SENSORS.md (2026-09-13)
• Verify archive candidates and repair inbound links before moving any doc #72 docs/design-lab/README.md (2026-09-14)
• Sync the upstream auto-generated YARA corpus from Xore/honeypot into the local scanner #73 docs/design-lab/design-notes.md (2026-09-14)
• Manual, admin-only GitHub-analysis publisher with a dashboard button #74 docs/ml-worker-evaluation.md (2026-09-25)
• Close the source-recovery gap on the VPS so fewer events land unattributed #75 docs/ARCANE-GIT-SYNC.md (2026-09-26)
• Build the Ghidra request spool, then add the payload-page entry points #76 docs/CGNAT-DEPLOYMENT.md (2026-09-26) — diagram
• Authenticated profile action menu, route settings, admin settings and logout #77 docs/CI-CD.md (2026-09-26) — diagram
• Ghidra analysis pipeline phases 3-5: GhidrAssist, plugin selection, report generation #78 docs/README.md (2026-09-26)
• Suricata eve.json grows unbounded on the VPS (4.4 GB and climbing) #79 docs/llm-worker/README.md (2026-09-26)
• Triage the five open CodeQL alerts; three are new from the Phase 7 sandbox routing #80 docs/local-llm-model-evaluation.md (2026-09-26)
• Verify the settings subsystem on the deployed stack: introspection token rollout and the 72-hour soak #81 docs/deploy-profiles/README.md (2026-09-27)

Deliberately out of scope

• Vendored / decoy-fs copies — arcane/home/honeypot-cowrie/cowrie/honeyfs/**,
  sandbox/ghosts/vendor/**. Someone else's README, inside a fake filesystem an
  attacker is meant to explore.
• Frozen records — docs/sandbox/windows/vm-detection-results/* (14 files),
  docs/benchmarks/runs/*, docs/research/*, *-record.md,
  approval-record.md, docs/sandbox/windows_kimi/*, dev/sensing-lab/. A
  record's value is that it says what was true on the day; reconciling it
  destroys it.
• One-off working notes at the repo root — DIFF.md, EVIDENCE.md,
  HANDOFF-3097.md. These look like they should just be deleted, but that is a
  separate call, not a docs fix.

Acceptance

• mermaid parse gate in CI, all 40 blocks pass (docs: reconcile 43 markdown files with the current repository state, and gate diagram/link rot #3398)
• whole-tree link gate in CI, all 388 local refs resolve (docs: reconcile 43 markdown files with the current repository state, and gate diagram/link rot #3398)
• every task above closed as corrected or as verified-current
• docs/README.md (Ghidra analysis pipeline phases 3-5: GhidrAssist, plugin selection, report generation #78) updated last, after the tree it indexes is accurate

[Xore]

First pass merged to PR #3398 — 43 of 146 files reconciled, plus the two CI gates.

Slice results (2 opencode/stealth agents, isolated worktrees):

Slice	Commits	Files	Outcome
legacy-core (#1–#22)	4	19	19 corrected, 3 verified-no-drift, 0 obsolete
core-graphs (#23–#55)	9	24	24 corrected
total	13	43	+1,258 / −601

Gates re-run on the merged tree: mermaid 40/40, links 412/412, paths-exist 489 tokens, reachability 85. The one FAIL () reproduces identically on origin/main and every hit is inside .grit/worktrees/* — untracked agent scratch, pre-existing, out of scope.

Highest-value corrections (details in the PR):

• KEYCLOAK-OPERATIONS.md said to pin the Keycloak image; it is :latest + pull_policy: always by design, and that step would have re-pinned CVE-2026-18963 into production. Actively harmful, not just stale.
• STACK-REBUILD.md ran docker stop portbridge-log-rotate — removed in fix: four ingestion defects behind the duplicated events, the WAN address and the deaf SIP sensor #1779, and both that and the matching compose up fail quietly.
• Count contradiction resolved from the manifest: 39 sync entries, 33 under arcane/home/, 20 sensor stacks — fixed in prose and in mermaid node labels.
• Windows sandbox trigger chain was wrong in both docs that described it.
• qwen3:8b@16384 → qwen3:14b@32768 in two files (Re-evaluate LLM model selection (ghidra/revdeck/sessions) now that GPU VRAM is confirmed ~20GB, not 8GB #568).

Two findings I am not fixing without a decision:

1. vault-worker/ is a 7th root-level stack not in the manifest. Manifest has 39 entries, 6 at root paths. vault-worker/ ships a tracked compose + Dockerfile, but nothing in the manifest or the manifest-driven installer deploys it — while docs/PIPELINES.md:216 documents its loop as running. Either that loop doc describes something that does not deploy, or a stack runs by a path I could not find from the repo. Does vault-worker run on the live homeserver? If yes it needs a manifest entry; if no, PIPELINES.md is wrong and Vault-ingest worker: render knowledge-store notes from the analysis indices #2290's closure is overstated.

2. docs/ARCANE-GIT-SYNC.md says "37 stacks" in four places vs 39 in the manifest. That is task Close the source-recovery gap on the VPS so fewer events land unattributed #75 below — queued for the next pass, not silently skipped.

Remaining: tasks #56–#81 (benchmark plans/records, design-lab, llm-worker, local-llm-evaluation, deploy-profiles, ARCANE-GIT-SYNC, CGNAT-DEPLOYMENT, CI-CD, docs/README.md). Same method, next dispatch. #78 (docs/README.md) is deliberately last so it indexes an accurate tree.

[Xore]

First pass merged to PR #3398 — 43 of 146 files reconciled, plus the two CI gates.

Slice results (2 opencode/stealth agents, isolated worktrees):

Slice	Commits	Files	Outcome
legacy-core (#1–#22)	4	19	19 corrected, 3 verified-no-drift, 0 obsolete
core-graphs (#23–#55)	9	24	24 corrected
total	13	43	+1,258 / −601

Gates re-run on the merged tree: mermaid 40/40, links 412/412, paths-exist 489 tokens, reachability 85. The one FAIL (check-doc-stale-paths.py) reproduces identically on origin/main and every hit is inside .grit/worktrees/* — untracked agent scratch, pre-existing, out of scope.

Highest-value corrections (details in the PR):

• KEYCLOAK-OPERATIONS.md said to pin the Keycloak image; it is :latest + pull_policy: always by design, and that step would have re-pinned CVE-2026-18963 into production. Actively harmful, not just stale.
• STACK-REBUILD.md ran docker stop portbridge-log-rotate — removed in fix: four ingestion defects behind the duplicated events, the WAN address and the deaf SIP sensor #1779, and both that and the matching compose up fail quietly.
• Count contradiction resolved from the manifest: 39 sync entries, 33 under arcane/home/, 20 sensor stacks — fixed in prose and in mermaid node labels.
• Windows sandbox trigger chain was wrong in both docs that described it.
• qwen3:8b@16384 → qwen3:14b@32768 in two files (Re-evaluate LLM model selection (ghidra/revdeck/sessions) now that GPU VRAM is confirmed ~20GB, not 8GB #568).

Two findings I am not fixing without a decision:

1. vault-worker/ is a 7th root-level stack not in the manifest. Manifest has 39 entries, 6 at root paths. vault-worker/ ships a tracked compose + Dockerfile, but nothing in the manifest or the manifest-driven installer deploys it — while docs/PIPELINES.md:216 documents its loop as running. Either that loop doc describes something that does not deploy, or a stack runs by a path I could not find from the repo. Does vault-worker run on the live homeserver? If yes it needs a manifest entry; if no, PIPELINES.md is wrong and Vault-ingest worker: render knowledge-store notes from the analysis indices #2290's closure is overstated.

2. docs/ARCANE-GIT-SYNC.md says "37 stacks" in four places vs 39 in the manifest. That is task Close the source-recovery gap on the VPS so fewer events land unattributed #75 below — queued for the next pass, not silently skipped.

Remaining: tasks #56–#81 (benchmark plans/records, design-lab, llm-worker, local-llm-evaluation, deploy-profiles, ARCANE-GIT-SYNC, CGNAT-DEPLOYMENT, CI-CD, docs/README.md). Same method, next dispatch. #78 (docs/README.md) is deliberately last so it indexes an accurate tree.

[Xore]

Reconciled — 81/81 files, all PRs green in CI

Every task in this issue is closed. Five PRs, all stacked on
docs/3395-doc-reconciliation:

PR	Slice	Files
#3398	round 1 — core graphs + legacy	43
#3404	round 2 — map	13
#3405	round 2 — infra	20
#3409	round 3 — policy/host	6
#3411	round 3 — analysis/inference	6

CI verified green on the rebased branches: all six documentation gates pass,
including Mermaid diagrams parse (#3395) — the gate added in #3398, which
could not pass until #3398's own follow-up (commits bae4706f / 836bec0c)
warmed the npx cache it depends on.

The corrections that mattered most

Instructions that would have caused harm, not just confusion.

• KEYCLOAK-OPERATIONS.md told operators to pin the Keycloak image. It is
  :latest by deliberate design, and the runbook would have re-pinned the
  CVE-2026-18963 exposure into production.
• STACK-REBUILD.md told operators to docker stop portbridge-log-rotate,
  removed in fix: four ingestion defects behind the duplicated events, the WAN address and the deaf SIP sensor #1779. The matching compose up also fails quietly, so the reset
  step looked successful while never pruning rotated files.
• BACKUP-ESSENTIALS.md listed short volume names; four of the five real
  volumes carry an Arcane project prefix, so following that table would have
  "restored" into volumes no stack is mounted against.
• KEYCLOAK-CUTOVER.md asserted a group-to-role grant. The committed
  keycloak/realm/apiary-realm.json defines users and administrators with
  empty roleMappings — which human holds which role is an operator-side
  decision, not a repository fact.

A host that no longer exists. HOMESERVER-DISK-LAYOUT.md documented an
Ubuntu install; the host is now Rocky Linux 10.2 with different disks, LVM
where the doc recorded "no LVM" as a design decision, /mnt-1 and /mnt-2
decommissioned, and 45 stack directories instead of 23. Found only by
re-measuring read-only over ssh.

Diagrams that were fiction. ip-reporting-plan.md drew a Python reporter
tree (reporter.py, dedup.py, metrics.py) that does not exist — the real
implementation is 13 Go files. Both diagrams passed the mermaid gate while
being entirely wrong: parse validity is not factual accuracy.

Contradictions that made the docs unusable. Stack counts were mutually
impossible (31 / 37 / 38 / 32 across four docs); the manifest holds 39.

Undocumented absence. The vault-worker has code, a compose, a Dockerfile
and two real issues (#2289 / #2290), but has never been deployed: no
container, not among the 40 Dockge stack directories, and zero
knowledge-vault* indices among 1015 live ones. Documented as
authored-but-unbuilt rather than presented as running or deleted.

Findings moved to their own issues rather than folded into docs PRs

• IP-block export sidecar fetches an unauthenticated 200 that serves zero bytes #3403 — the manual IP-block export sidecar fetches a URL that returns an
  unauthenticated 200 with zero bytes, so operator IP blocks silently never
  reach portbridge. A 404 would have been caught; a 200 that is an auth
  redirect cannot be.

Left deliberately untouched, for the maintainer

• branding/design-lab/design-notes.md contains a real attacker IP. The
  docs/design-lab/ copy is redacted, but the redaction buys nothing while the
  unredacted original sits in the same public repository, and
  check-public-leaks.py does not flag it. A judgement call about attack
  data, not a documentation error.

One process note

This took three rounds and four agent dispatches because two separate
infrastructure problems masqueraded as agent failures. Mermaid's headless
browser is ~1G resident, and running the gate per file alongside a second
agent exhausted a 30G host — that one was real. The repeated exit 130 at a
ten-minute boundary was not: it was my own dispatch timeout, and I misread it
as an OOM for two rounds before checking. Raising it to fifty minutes fixed it.
Worth recording because the symptom pointed at the agents and the cause was the
harness.

Merge order

All five target docs/3395-doc-reconciliation. #3398 first, then #3404 and
#3405 (independent of each other), then #3409 and #3411.