log: homepage model docs, fleet sweep, guard audit, sightsound runner lockout fix

serverAppConfigs-docs/log.md

@@ -848,3 +848,40 @@ timestamp: 2026-09-14
   self-committed as `23f0978`/`74dda30` — nothing lost.
 - **Live after deploy:** `n_slots = 4, n_ctx_slot = 262144`, idle
   23,300 MiB, e2e gate 32 passed.
+
+## 2026-09-17 (late) — homepage: live model info + user docs; deploy-runner lockout fixed
+
+- **Reported "www unreachable internally" — server side healthy end to end.**
+  LAN DNS → 192.168.0.143, TCP 443 open, Anubis challenge served, `@home`
+  200 from inside Caddy, apex/www redirects correct, no 5xx in the journal.
+  Fault pattern matches the known client-side split-DNS issue (client off
+  Pi-hole → WAN IP, no 443 forward). `frank-large`'s 5 s health timeout
+  during the audit was the documented halogen PING stall — 200/1 s minutes
+  later, self-recovered; no restart performed.
+- **Fleet sweep:** dankclaw 30 containers up (all with enabled quadlet units
+  except `systemd-hermes`, a running container with no quadlet — logged as a
+  boot-persistence gap); dankserver media stack + frank-medium all up,
+  units enabled; FrankBook-Pro *arr/qB ports all answering (302/200).
+  Undeclared stopped container `test-vllm` on dankserver — stray leftover,
+  held for approval, not removed.
+- **Security audit:** every vhost classified against the guard policy.
+  Guarded (Anubis→Authentik): www, search, grafana, prometheus, loki,
+  seerr, marreta, romm, files. Documented exemptions verified
+  behaviorally: books anon `/all` → 302 login (gated), ai lands on sign-in,
+  WAN 443 still unforwarded from LAN peers, and all admin-only names
+  (prowlarr/lidarr/readarr/qb/pihole/hermes/hermesadmin) NXDOMAIN on
+  public resolvers. No new exposure found; nothing to secure further.
+- **Homepage shipped (`32751c0`):** the three LLM cards moved to the user
+  page with live descriptions (halogen w4b iGPU / 35:30 layer-split MTP
+  27B / Gemma4-12B QAT vision path) and `docs: /docs#models`; new static
+  user docs page at `/docs` (access chain, model guide, media how-tos,
+  troubleshooting), routed in the post-auth listener, shipped by
+  `deploy_homepage`, covered by new pages-seam tests.
+- **Runner lockout fixed (`02a7876`+):** a stale `pending` state entry for
+  the retired `frank-default-sightsound` endpoint made every `--pending`
+  run exit 2 at the dispatcher before the e2e gate. The pending pass now
+  prunes entries the target no longer allows into `~/.AGENTTRASH` and
+  keeps going; behavioral seam test added, superseded scoping test migrated.
+- **Deploy verified live:** sightsound pruned (state 0, trashed 20260917),
+  `/docs` 200 on the post-auth listener, all three model cards `up`,
+  bats 329 green, e2e gate 32 passed.