memory: snapshot — 2026-10-06 fv-ml1 rebalance, backup checker, Scriberr diarization, albok 0.1.12, gateway retention; in-flight compacted; 17 entries archived

persistent-memory.d/2026-09-27-restic-repository-file-fleetwide.md

@@ -23,3 +23,18 @@ independent check across all 8 found 0 leaking units. nh3-docker's scheduled uni
   does not un-expose what was readable.
 - Before the edit, esh-docker-vm's and irv-ml1's live profiles had drifted ahead of the repo, and were
   pulled in first (`c698751`).
+
+## In-flight state at retirement (moved here at the 2026-10-06 snapshot)
+
+- Seven hosts were moved from `env-file` to `repository-file` (`playbooks/restic-repository-file.yaml`),
+  so the systemd units no longer carry the rest-server password. Secrets are vaulted as
+  `<host>/etc/restic/{repository,password}`. `restic.env` is KEPT for manual snippets, so
+  **a rotation must update the vault, `restic.env` and `repository`.**
+- **vm-esh-nas done too** (Prime bootstrapped infra-ops there at uid 850, NOPASSWD). **All 8 hosts are clean
+  and vaulted.**
+- The passwords were readable until today, so the rotation (Prime's) remains the real fix.
+- 2026-09-27 0859 freshness check: all restic and PBS repos ✅. Those 0100 runs PRE-date the move
+  (done ~0140–0200).
+- **VERIFIED 2026-09-28 (infra-hermes, read-only):** the first nightly on `repository-file` (0100 PT)
+  succeeded on all 8 hosts (unit Result=success AND a today-dated snapshot in each repo), and the
+  0800 freshness check was all-green, PBS included. nh3-dev also passed a content restore (`af5580c3`).