docs: record that the lab guest is built and its log sources verified (#262)

[Gerrrt]

Closes out #262. alexander runs stacks/lab as of 2026-09-05, and §7 passed with all three Loki jobs — auth.log, syslog and journal.

That last part is the whole point. The files existing and Alloy actually tailing them are different facts, and the second is the one that fails silently — #62 and #63 were both collectors that ran healthy and produced nothing.

26.04 ships rsyslog

§0 chose Ubuntu over Debian because config.alloy tails two files a journald-only install does not have. It then had to stop claiming the LTS provides them, because Ubuntu has been narrowing its default install and a runbook cannot know what a future reader will install.

Now one LTS is confirmed: both files present, syslog:adm 0640 — which is the ownership LOG_READ_GID is derived from, so the supplementary-group mechanism has what it needs. Recorded as a data point, not a guarantee. §7 stays the check.

The status block

Follows replace-the-smart-storage-battery.md's shape, which is this repository's convention for a runbook whose job is done: what was built, what was proven, and what bit on the way.

Both things that bit are named with their fixes, because the symptoms are the kind someone hits again:

Symptom	Cause
sops: no identity matched any of the recipients	the lab's .sops.yaml rule matched nothing, so §4 encrypted to the estate's key (#321)
make validate demanding make install-timers	the estate's timers offered to a lab guest (#323)

Smaller

§5's certificate copy says garnet@ rather than a you@ placeholder. The estate's scripts already carry robo@10.0.99.20 and atropos@10.0.99.30; a runbook that must be edited before it can be pasted is one that gets pasted wrong.

The roadmap said a deploy was what remained of #264. It is not.

Verification

make validate passes. One note: observability: promtool check config failed once mid-session and passed on the two runs after, with the config itself reporting SUCCESS when run directly — an intermittent docker flake rather than a config fault. Worth an eye if it recurs.

🤖 Generated with Claude Code