docs(alloy): document the root journal-read cutover

Alloy page rewritten to the shipped root design (why root, the two
mounts that make it work, deploy-pending status); Observability current
state marks the log pipeline fixed-in-code, awaiting deploy.

serverAppConfigs-docs/Infrastructure/Observability.md

@@ -102,17 +102,18 @@ verify it through the APIs.
   installed from `shared/grafana/provisioning/`. The Loki datasource is how
   you read logs: Loki has no web UI of its own, so Grafana Explore is the
   human surface (the guarded `loki.franksdank.cloud` vhost serves only the API).
-* **Logs: configured, empty.** Alloy ships zero lines and Loki holds zero
-  streams (`GET /loki/api/v1/labels` returns no label names; no chunk files on
-  disk). The cause is source-side access, now proven, not a config bug: a
-  rootless container cannot read the journal files (`system.journal` is
-  `root:systemd-journal 0640`/`adm` and a rootless read of it returns DENIED),
-  and the container-log globs point at a root-storage path that does not exist
-  under rootless. Closing it is a permission/architecture decision, not an
-  edit — see [[Alloy]] → Delivery state and [[Loki]] → Contents.
+* **Logs: fixed in code, awaiting deploy.** The pipeline shipped nothing because
+  a rootless Alloy cannot read the `0640` journal files, and the container-log
+  globs point at a root-storage layout that does not exist here. The fix is built
+  and tested in-repo (2026-10-20): Alloy is now a **root system service on
+  `Network=host`**, reading `system.journal` + `user-*.journal` and pushing to
+  Loki's `127.0.0.1:3100` loopback publish — a throwaway root probe read 31,825
+  lines and pushed 26,966 with zero drops. The **live** instance is still the old
+  rootless unit until `deploy.sh dankclaw --service alloy` runs. Detail in
+  [[Alloy]] → Why root; Loki's store state in [[Loki]] → Contents.
 * **Not configured:** no blackbox exporter (the structural downs have no real
-  uptime signal) and no Alertmanager vhost. The log pipeline is provisioned
-  but carries no data (see *Logs* above).
+  uptime signal) and no Alertmanager vhost. The log pipeline's fix is in code but
+  not yet deployed (see *Logs* above).
 
 ## Citations