docs+units: fix every claim my own changes made false

Retiring dankclaw/compose.yaml and adding alert rules invalidated claims across
the repo, including in the rule file agents read first. Clean cutover includes
the prose.

**Tests that had gone hollow.** Four assertions grepped dankclaw/compose.yaml
for a service name. With the file gone they passed by *absence* — a gate that
can no longer fail. Each now asserts the real invariant ("no dankclaw compose
file competes with the quadlet units") and keeps a live check for a re-added
entry, so it still fails when one appears: verified by recreating a compose file
with a comfyui service and watching three tests go red, then removing it.

**AGENTS.md, which was wrong about ComfyUI.** It said ComfyUI runs CPU-only
("no ROCm wheels for gfx1151, CUDA images wrong"). That was true in the
compose era and is false now: the restored unit runs with /dev/kfd + /dev/dri and
must NOT pass --cpu. An agent trusting the rule file would have re-broken it.
Also corrected: the observability paragraph ("RUNNING BUT UNCONFIGURED, no
datasource, no rules" — all three have been configured since 2026-09-16), the
Active runbook row that still named halogen for frank-large, halogen's absence
from the Retired table, the benchmark policy naming halogen's harness, and the
seam list.

**Unit and page claims.** prometheus.container said "no alerting rules anywhere
in this stack"; node-exporter.container said Dankserver runs from its compose
stack; Prometheus.md documented three jobs as working (they scrape HTML: they
can never report up) and said no dashboard existed; index.md and the three
authentik service pages pointed at the retired file; Authentik.md's upgrade
instruction told you to bump an image tag in it.

One bad edit of my own on the way (a stale line number clobbered a See Also
entry in Prometheus.md) — caught by reading back, fixed, and the vault link
checker now proves the cross-references hold.

tests/authentik.bats

@@ -18,7 +18,8 @@
 
 load helpers
 
-COMPOSE="$REPO_ROOT/dankclaw/compose.yaml"
+# (no COMPOSE here: dankclaw/compose.yaml is retired — every container on that
+# host is unit-managed, and this seam reads the units.)
 CADDYFILE="$REPO_ROOT/dankclaw/Caddyfile"
 ENV_EXAMPLE="$REPO_ROOT/dankclaw/.env.example"
 

tests/caddyfile.bats

@@ -78,8 +78,11 @@ CADDYFILE="$REPO_ROOT/dankclaw/Caddyfile"
 @test "compose no longer defines the quadlet-replaced services" {
     # gitea, its postgres, open-webui, and caddy run as boot-persistent
     # quadlets on dankclaw (see dankclaw/gitea/quadlet,
-    # dankclaw/open-webui/quadlet, dankclaw/caddy/quadlet).
-    ! grep -qE '^\s+(gitea|postgres|openwebui|caddy):\s*$' "$REPO_ROOT/dankclaw/compose.yaml"
+    # dankclaw/open-webui/quadlet, dankclaw/caddy/quadlet). The compose file
+    # itself is retired and observability_quadlet.bats asserts that; here the
+    # regression is a re-added entry, so the check must not pass by absence.
+    local cf="$REPO_ROOT/dankclaw/compose.yaml"
+    [ ! -f "$cf" ] || ! grep -qE '^\s+(gitea|postgres|openwebui|caddy):\s*$' "$cf"
 }
 
 @test "the caddy quadlet healthcheck probes the bare-IP catch-all" {
@@ -174,9 +177,12 @@ CADDYFILE="$REPO_ROOT/dankclaw/Caddyfile"
 
 # --- Observability configs (deployed by deploy.sh step 3) ---
 
-@test "no legacy .local service names remain in shared configs or compose" {
+@test "no legacy .local service names remain in deployed config" {
+    # Scans the surfaces that are actually deployed — shared configs and every
+    # dankclaw unit — rather than a file that no longer exists. A missing path
+    # makes grep exit 2 and the negation pass, which is how this went hollow.
     ! grep -rn 'dankclaw\.local\|dankserver\.local' \
-        "$REPO_ROOT/shared" "$REPO_ROOT/dankclaw/compose.yaml"
+        "$REPO_ROOT/shared" "$REPO_ROOT/dankclaw"
 }
 
 @test "loki compactor has a delete_request_store (required when retention is on)" {

tests/comfyui_rocm.bats

@@ -32,8 +32,12 @@ load helpers
     grep -q '^Image=localhost/comfyui-rocm:gfx1151$' "$unit" \
         || { echo "unit must run the locally built image"; return 1; }
     # One owner per container name: a surviving compose service would fight the
-    # unit for the container, which is how the stale one stayed alive.
-    ! grep -qE '^\s+comfyui:' "$REPO_ROOT/dankclaw/compose.yaml"
+    # unit for the container, which is how the stale one stayed alive. The file
+    # itself is retired (observability_quadlet.bats asserts that), so here the
+    # regression to catch is a re-added entry — the check must not go hollow
+    # just because the file is absent.
+    local cf="$REPO_ROOT/dankclaw/compose.yaml"
+    [ ! -f "$cf" ] || ! grep -qE '^\s+comfyui:' "$cf"
 }
 
 @test "comfyui Containerfile is based on the gfx1151 torch image" {

tests/observability_quadlet.bats

@@ -263,14 +263,19 @@ PAIRS
     grep -q 'build_compose_image alloy' "$REMOTE_DEPLOY"
 }
 
-@test "the five are no longer compose services" {
+@test "no dankclaw compose file competes with the quadlet units" {
     # Two owners for one container name is how a compose run resurrects a
-    # stale duplicate next to the quadlet-managed one.
-    local svc
-    for svc in "${UNITS[@]}"; do
-        ! services_in "$REPO_ROOT/dankclaw/compose.yaml" | grep -qx "$svc" \
-            || { echo "$svc is still a compose service"; return 1; }
-    done
+    # stale duplicate next to the quadlet-managed one. This file was retired on
+    # 2026-09-16 — every container on the host reports a PODMAN_SYSTEMD_UNIT
+    # label — and the invariant is that it stays retired: the four assertions
+    # that used to grep it passed against the missing file, which is how a gate
+    # goes hollow.
+    local cf="$REPO_ROOT/dankclaw/compose.yaml"
+    [ ! -f "$cf" ] || {
+        echo "$cf is back: every dankclaw container is unit-managed, so a"
+        echo "compose path can only spawn a duplicate fighting a unit for a name"
+        return 1
+    }
 }
 
 @test "changes under dankclaw/observability/ run this seam" {