Tier 5 mid: portainer/portainer-agent/otelcollector done; watchtower retired

docs/inventory.md

@@ -37,19 +37,34 @@ State: May 3, 2026 — end of Tier 4.
 | `audiobookshelf` | `audiobookshelf/` | upstream | audiobooks |
 | `directoryadmin` | `directoryadmin/` | gitea-registry `directoryadmin:latest` | LDAP admin UI |
 
+### Singleton — morgott
+
+| Charlie repo | Stack path | Image source | Notes |
+|---|---|---|---|
+| `portainer` | `portainer/` | upstream | container UI; CSRF trusted-origins set via CLI |
+
+### Shared — multi-host
+
+| Charlie repo | Hosts | Layout | Notes |
+|---|---|---|---|
+| `portainer-agent` | morgott, melina, mohg, miquella | `docker-compose.yml` + `docker-compose.miquella.yml` | DSM gets a per-host compose (no `/var/lib/docker/volumes` bind) |
+| `otelcollector` | morgott, melina, miquella | `docker-compose.yml` (shared) | malenia (`launchd` + `install-mac.sh`) deferred — see roadmap |
+
 ## Pending (Tier 5 — long tail)
 
 | Charlie repo | Old path | Owner | Repo type | Status |
 |---|---|---|---|---|
-| `portainer` | `home/portainer/` | morgott | init | not started |
-| `portainer-agent` | `home/portainer-agent/` | morgott + melina (shared) | init | not started |
-| `otelcollector` | `home/otelcollector/` | morgott + melina (shared) | init | not started |
-| `watchtower` | `home/watchtower/` | morgott | init | not started — archive after Diun |
 | `shell` | `home/shell/` | — (config, all hosts) | init | not started |
 | `first-time-setup` | `home/first-time-setup.md` | — (docs) | init | not started |
 | `server-mgmt-utils` | `home/ServerManagementUtils/` | morgott | rewrite | mostly dead — extract temp/storage scripts (move to `otelcollector/scripts/` or `host-scripts`), then archive |
 | `plist` | `home/plist/` | ? | TBD | classify before deciding |
 
+## Decommissioned
+
+| Stack | Old path | Notes |
+|---|---|---|
+| `watchtower` | `home/watchtower.retired/` | Retired May 3, 2026 without replacement. Diun-based image-update flow is planned (roadmap Phase 3). |
+
 ## Mirrors (Gitea pull-mirror, no host action)
 
 Naming: `Charlie/<name>-mirror`.

docs/repos.md

@@ -16,19 +16,19 @@ See [inventory.md](inventory.md) for the canonical state. Migration recipe: [mig
 ### Tier 4 — was upstream-cloned, collapsed to canonical (Day 1)
 `mealie`, `paperless-ngx`, `victoriametrics`, `searxng`, `invidious`
 
-## Pending — Tier 5
+### Tier 5 — long tail (Day 1–2)
+`portainer`, `portainer-agent` (shared, 4 hosts), `otelcollector` (shared, 3 hosts — malenia deferred)
 
-Order:
+### Decommissioned
+`watchtower` — retired without replacement (May 3, 2026). Diun-based image-update flow planned (see roadmap Phase 3).
+
+## Pending — Tier 5 long tail
 
 | # | Repo | Owner | Notes |
 |---|---|---|---|
-| 1 | `portainer` | morgott | mechanical |
-| 2 | `portainer-agent` | shared | mechanical; one repo, deployed on every host |
-| 3 | `watchtower` | morgott | trivial; will archive after Diun is up |
-| 4 | `otelcollector` | shared | one compose, multi-host. Design decision: how do we host-pin `.env`? |
-| 5 | `shell` | — (no docker) | clone target: `/usr/local/share/charlie-shell/` |
-| 6 | `first-time-setup` | — (docs) | bootstrap docs / scripts |
-| 7 | `server-mgmt-utils` | morgott | mostly dead. Extract temp/storage scripts to `otelcollector/scripts/` or new `host-scripts` repo, then archive the original. |
+| 1 | `shell` | — (no docker) | clone target: `/usr/local/share/charlie-shell/` |
+| 2 | `first-time-setup` | — (docs) | bootstrap docs / scripts |
+| 3 | `server-mgmt-utils` | morgott | mostly dead. Extract temp/storage scripts to `otelcollector/scripts/` or new `host-scripts` repo, then archive the original. |
 | ? | `plist` | TBD | classify before deciding |
 
 ## Build pipelines (deferred)

docs/roadmap.md

@@ -26,8 +26,8 @@
 
 ## Phase 3 — Automation
 
-- [ ] Diun watching registries → webhook → `redeploy` workflow with `force-pull`.
-- [ ] Retire `watchtower`.
+- [ ] Diun watching registries → webhook → `redeploy` workflow with `force-pull` (replaces the role watchtower used to play).
+- [x] Retire `watchtower` (decommissioned May 3, 2026 — dir at `/mnt/nas/home/watchtower.retired/`, no replacement yet).
 - [ ] Drift detection: running compose vs repo compose.
 - [ ] Backup verification against miquella.
 - [ ] Cert/secret expiry checks (authentik, caddy, signing CA).