docs: purge the retired workstation from the knowledge base

Second half of the purge (the first covered the persona, AGENTS.md, README.md,
and the distillation of the per-host pages). Every remaining identifier is
gone: hostname, both LAN addresses, and the Wi-Fi SSID.

34 count-checked substitutions across 22 files — indexes, tool/research pages,
the inventory census, the changelog, one generated HTML report, and five
managed skills. Facts kept, names dropped: a history entry keeps its four-page
listing as a nameless summary, the syslog excerpts keep every timestamp and
line, and the census keeps the .zcompdump rows (the zsh version stamps are the
useful part, the hostname was not).

Deliberately unchanged: install.sh's --host case list and the
packages/<hostname>.pkgs filename, where the hostname is the lookup key.

Left out of scope by Frank's call: agent/memories/** — past-session records the
learn pipeline rewrites.

kb-lint: 0 violations. Residual grep for the hostname, its two IPs, and the
SSID across omp-docs/ and agent/managed-skills/: no hits.

omp-docs/log.md

@@ -11,6 +11,18 @@ timestamp: 2026-08-28
 
 # Bundle Change Log
 
+## 2026-09-28 — Retired workstation purged from the knowledge base
+
+Frank sold the client workstation. Every identifier for it is gone from this bundle: hostname, both of its LAN addresses, and its Wi-Fi SSID. The knowledge outlives the box; the machine does not.
+
+* **Distilled, not deleted.** The four per-host system pages carried two pieces of knowledge worth keeping and one that was not:
+  * `/system/network.md` (new) — LAN topology, plus the multi-link resolver law: a client with two `+DefaultRoute` links flaps its DNS, and the fix is a static resolver pinned on each *connection* (a `resolved.conf` `DNS=` line is only a per-link fallback). Keeps the flush-caches verification loop, because one successful `dig` proves nothing on a flapping resolver.
+  * `/tools/niri/displays.md` (new) — the multi-monitor rig: portrait transforms, absolute positions, the auto-placed third panel, the iGPU render-node pin, and the three ways it breaks (duplicate output blocks, positions that do not reflow, a mode the panel cannot drive).
+  * Dropped: the machine's own spec sheet and quick-facts table. The OS and userspace facts they repeated already live in `tools/cachyos.md`.
+* **Mechanical scrub** across the rest of the bundle: indexes, tool and research pages, the inventory census, the changelog, one generated HTML report, and four managed skills. Facts kept, names dropped — `install.sh`'s `--host` case list and the `packages/<hostname>.pkgs` filename stay, because the hostname is the lookup key there.
+* `AGENTS.md` and `README.md` keep a nameless "workstation" row so the fleet tables still describe the class of box without advertising a machine that is no longer Frank's.
+* Out of scope by decision: `agent/memories/**` (past-session records the learn pipeline rewrites) and the retired pages' history — they are recoverable from `.AGENTTRASH/20260928-retired-workstation/` and from git.
+
 ## 2026-09-01 — Retry backoff and thinking default
 
 * **Retry backoff**: configured Pi's automatic agent-level retries in `settings.json` with a 10-second base delay, producing 10s, 20s, and 40s delays across three retries.
@@ -53,15 +65,15 @@ timestamp: 2026-08-28
 ## 2026-08-21 — Fleet ops: passwordless sudo, Hermes SSH keys, sibling KB links
 
 * **Passwordless sudo**: added `/etc/sudoers.d/dank-nopasswd` (`dank ALL=(ALL) NOPASSWD: ALL`) on both Dankserver and Dankclaw. Verified `sudo -n true` on both. The pre-existing drop-ins (`frank-small` on Dankserver; `frank-large` + `frank-ling` on Dankclaw) grant per-command NOPASSWD for the frank restart scripts and remain in place.
-* **Hermes SSH keys**: the Hermes Agent (podman container `hermes`, project `dankclaw` in `serverAppConfigs`, gateway drops to container uid 10000 = host uid 109999, HOME `/opt/data` on a podman volume) now has a dedicated ed25519 key at `/opt/data/.ssh/id_ed25519` (`hermes-agent@dankclaw`) plus an SSH config for `dankclaw` (192.168.0.143), `dankserver` (192.168.0.235), and `dankware` (192.168.0.226). The public key is in `dank`'s `authorized_keys` on all three machines. Verified from inside the container as the hermes user: all three `ssh <host> hostname` calls succeed.
-* **Sibling KB links**: `system/index.md`, `system/dankserver.md`, `system/dankclaw.md`, and the root `index.md` now link the two sibling knowledge bases on dankware: `~/Projects/vllmScripts/` (inference fleet scripts + runbook, index `docs/index.md`) and `~/Projects/serverAppConfigs/` (Podman deploy configs for both servers, index `docs/index.md`).
+* **Hermes SSH keys**: the Hermes Agent (podman container `hermes`, project `dankclaw` in `serverAppConfigs`, gateway drops to container uid 10000 = host uid 109999, HOME `/opt/data` on a podman volume) now has a dedicated ed25519 key at `/opt/data/.ssh/id_ed25519` (`hermes-agent@dankclaw`) plus an SSH config for `dankclaw` (192.168.0.143), `dankserver` (192.168.0.235), and the workstation. The public key is in `dank`'s `authorized_keys` on all three machines. Verified from inside the container as the hermes user: all three `ssh <host> hostname` calls succeed.
+* **Sibling KB links**: `system/index.md`, `system/dankserver.md`, `system/dankclaw.md`, and the root `index.md` now link the two sibling knowledge bases on the workstation: `~/Projects/vllmScripts/` (inference fleet scripts + runbook, index `docs/index.md`) and `~/Projects/serverAppConfigs/` (Podman deploy configs for both servers, index `docs/index.md`).
 
 ## 2026-08-19 — pi-web-access: SearXNG endpoint re-pointed to dankclaw
 
 * **Config**: `~/.pi/web-search.json` — `searxngBaseUrl` moved from the dead `192.168.0.235:8081` (dankserver, connection refused) to `192.168.0.143:8081` (dankclaw; verified live: HTTP 200, 25 JSON results, 0.8 s). Deleted the redundant `provider: "all"` (the `searchProvider: "searxng"` pin already wins in v0.22). Added `maxInlineContentChars: 50000`. Kept `workflow: "none"` and `ssrf.allowRanges: ["192.168.0.0/24"]`.
 * **Docs**: `pi/packages/pi-web-access.md` bumped 0.14.0 → 0.22.0 (18-provider chain, config block, active-setup note, GitHub-clone section, yt-dlp present). `agentic-web-research/` SearXNG endpoint references repointed `.235` → `.143` (index, searxng-tuning, vpn-routing).
 * **Note**: pi-web-access caches `web-search.json` in memory per process — the new endpoint takes effect on the next Pi session, not the running one.
-* **Packages**: `yt-dlp` installed on dankware (2026.07.04) — YouTube frame extraction now works; `ffmpeg` (n9.0.1) was already present.
+* **Packages**: `yt-dlp` installed on the workstation (2026.07.04) — YouTube frame extraction now works; `ffmpeg` (n9.0.1) was already present.
 
 ## 2026-08-19 — SearXNG + Gluetun bring-up on dankclaw
 
@@ -176,10 +188,7 @@ Field notes from standing up the search stack (gluetun + searxng + valkey) and c
 **Created — System Documentation**
 
 * `system/index.md` — System documentation index with infrastructure diagram
-* `system/dankware/index.md` — System overview for dankware (Alienware m16 R2)
-* `system/dankware/hardware.md` — Complete hardware specifications
-* `system/dankware/displays.md` — Three-monitor display configuration
-* `system/dankware/network.md` — Network interfaces and topology
+* Per-host system pages (overview, hardware specifications, display configuration, network interfaces) for the workstation — retired later; see `/system/network.md` and `/tools/niri/displays.md`
 * `system/dankserver.md` — Primary llama.cpp server documentation
 * `system/dankclaw.md` — Secondary llama.cpp server documentation