Final configuration

docs/ROADMAP.md

@@ -128,7 +128,11 @@ a new call into the same machinery, not a new machine.
   operator decision; application deployment remains blocked on application
   code. See `STAGING-STATE.md`.
 - **Mail alerting accepted, 2026-08-17.** Delivered end to end and received
-  twice. `smartd` is now unblocked. One open exposure is recorded as F-025.
+  twice.
+- **Disk monitoring accepted, 2026-08-17.** Four P410i members explicitly
+  monitored, four test alerts received, serial numbers recorded, reboot-proven.
+- **Container SMTP egress blocked, 2026-08-17.** The project-local half of F-025
+  is corrected; the estate question about `wg-pk` client trust remains open.
 
 ### Next — the port
 
@@ -254,3 +258,9 @@ on whether it makes distributed manufacturing capacity legible.
 10. **Shared infrastructure is not ours to reconfigure.** An instance may
    configure its own client side; changes further down the chain are escalated
    with evidence.
+11. **A test must distinguish tool failure from the condition it tests.** One
+   whose failure mode is indistinguishable from success manufactures
+   confidence (F-027). Every negative assertion first establishes that it could
+   have observed the positive case.
+12. **A component surviving its own restart is not proven to survive the
+   host's.** Different machinery; assert against the one that matters (F-026).