docs: stop claiming neo has never answered SNMP

README.md

@@ -201,8 +201,8 @@ enforces it, and `make pin-digests` re-resolves them.
 Open work is tracked in [`docs/roadmap.md`](docs/roadmap.md). The current top
 items: finish the SNMP rotation on the switch, purge the old communities from
 git history, replace the UPS battery, and get 64-bit interface counters off the
-switch. The first and last of those share a blocker — the switch has never
-answered an SNMP poll at all.
+switch. The first and last of those share a blocker — the switch is not
+currently answering SNMP.
 
 ## License
 

SECURITY.md

@@ -38,16 +38,18 @@ is a very different thing from an overlooked one. Full detail in
 
 | What | Status |
 | --- | --- |
-| SNMP community committed in plaintext, shared across firewall, switch, UPS and BMC | Removed from `HEAD` and replaced with four distinct per-device SOPS-encrypted values. Rotated and verified on the firewall, the UPS and the BMC: each answers to its own new community and refuses the old one. **Not rotated on the switch**, which has never answered an SNMP poll at all — so whether it still accepts the old community is unknown, not proven clean. **Still present in git history.** Treat the old string as public. |
+| SNMP community committed in plaintext, shared across firewall, switch, UPS and BMC | Removed from `HEAD` and replaced with four distinct per-device SOPS-encrypted values. Rotated and verified on the firewall, the UPS and the BMC: each answers to its own new community and refuses the old one. **Not rotated on the switch**, which is not answering SNMP — so whether it still accepts the old community is unknown, not proven clean. **Still present in git history.** Treat the old string as public. |
 | Grafana `admin`/`admin` with anonymous Admin access enabled | Fixed — anonymous auth off, password from SOPS |
 | Passphrase-encrypted TLS private keys under `certificates/` | Removed from `HEAD`, still reachable in history. Purge tooling and a runbook are provided; not yet run. |
 
 The switch is the honest gap. `10.7.7.2` has returned `up == 0` for every scrape
-in the 30-day retention window, which predates the rotation — the target has
-never worked, so its failure is not evidence that the rotation broke anything,
-and its silence is not evidence that the old community was removed. It is
-reachable at layer 3 from the monitoring host on ICMP and TCP/80; only UDP/161
-fails. Tracked separately in [#22](https://github.com/Gerrrt/HomeLab/issues/22).
+the monitoring stack has ever taken — all four SNMP series begin together when
+the stack was rebuilt, so the failure predates the rotation and is not evidence
+that the rotation broke anything. Nor is its silence evidence that the old
+community was removed. It is reachable at layer 3 on ICMP and TCP/80; only
+UDP/161 fails, which is the signature of a wedged SNMP agent rather than a dead
+device. Tracked separately in
+[#22](https://github.com/Gerrrt/HomeLab/issues/22).
 
 Remediation is tracked in [`docs/roadmap.md`](docs/roadmap.md), with procedures
 in [`docs/runbooks/rotate-snmp-community.md`](docs/runbooks/rotate-snmp-community.md)

docs/roadmap.md

@@ -8,9 +8,9 @@ inventory. Ordered roughly by how much it matters.
 - [ ] **Finish the SNMP rotation on the MokerLink switch (`neo`, 10.7.7.2).**
       pfSense, the APC and iLO are done — each answers to its own new community
       and refuses the old one. The switch is not, and cannot be verified,
-      because it has never answered SNMP at all: `up{job="snmp"}` for
-      `10.7.7.2` has been `0` for the full 30-day retention window, so the
-      failure predates the rotation rather than being caused by it. Blocked on
+      because it is not answering SNMP: `up{job="snmp"}` for `10.7.7.2` has
+      been `0` for every scrape the current stack has taken, so the failure
+      predates the rotation rather than being caused by it. Blocked on
       [#22](https://github.com/Gerrrt/HomeLab/issues/22).
       → [runbook](runbooks/rotate-snmp-community.md)
 - [ ] **Purge `certificates/` and the old community string from git history**,

docs/security.md

@@ -82,8 +82,8 @@ packet. Two mitigations are in place, one only partly, and one is not:
 - **Done, with one exception:** each device has its own community, so one
   captured packet no longer grants read access to the whole fleet. Three are
   confirmed live on the hardware. The switch's exists only in SOPS — it has
-  never been proven on the device, because `10.7.7.2` has never answered a poll
-  ([#22](https://github.com/Gerrrt/HomeLab/issues/22)).
+  never been proven on the device, because `10.7.7.2` is not currently answering
+  polls ([#22](https://github.com/Gerrrt/HomeLab/issues/22)).
 - **Done:** SNMP is reachable only on the management VLAN and the
   switch-management LAN, neither of which anything but specific trusted hosts
   can enter.