[Gerrrt]

What changed

One changelog entry. Memos on trinity now holds the household's shared plan, as a Memos 0.31 Space, and four instance settings changed to make that work: public access off, the content length limit raised from 8192 to 32768 bytes, Mekenna's account made an instance admin, and Protected as the default memo visibility on both accounts. Every change is a setting in Memos' database; compose.yaml is unchanged. After Copilot's review, the three current-state documents that said Memos holds nothing real (docs/architecture.md, docs/roadmap.md, the stack README) now say it does, what backs it up today, and that the household copy does not carry memos-data yet, so that is owed under #455.

Why

The household wanted one place for a plan the two of them had been keeping in two assistants. ADR-0059 chose Memos for notes and said it holds nothing real until ADR-0023's off-estate copy has a holder; #455 is still waiting on that person. The operator accepted the gap on 2026-10-22 because the plan also lives in both assistants and the nightly volume backup to oracle covers the rest, and the entry records that. In Memos 0.31 only a memo's author or an instance admin can edit a memo, which is why the second account is an admin rather than a user. Refs #145. Refs #455.

Blast radius

Docs only: the changelog and three current-state documents. The instance changes they record affect one container on trinity, reachable from Hicks alone through Caddy's 443, as before. Turning public access off is strictly narrower than before.

• No change to network segmentation or firewall rules
• No new port published to a VLAN that could not already reach the service
• No credential added outside secrets/*.sops.yaml

Verification

Read back on trinity without logging in, after the clicks:

docker exec sensitive-memos wget -qO- http://127.0.0.1:5230/api/v1/instance/profile
  → "accessMode":"INSTANCE_ACCESS_MODE_PRIVATE"
docker exec sensitive-memos wget -qO- http://127.0.0.1:5230/api/v1/instance/settings/GENERAL
  → "disallowUserRegistration":true
docker exec sensitive-memos wget -qO- http://127.0.0.1:5230/api/v1/instance/settings/MEMO_RELATED
  → "contentLengthLimit":32768
docker exec sensitive-memos wget -qO- 'http://127.0.0.1:5230/api/v1/memos?pageSize=5'
  → HTTP/1.1 401 Unauthorized (was an empty list)

make check-docs: docs OK — 158 Prometheus + 20 Loki rules, 8 dashboards, 156 panels, 12 assertions. ./scripts/lint.sh: passed, with yamllint, ruff and ansible-lint skipped on this host (none reads Markdown). make validate was not run in full: a docs-only change, per CLAUDE.md.

• make validate passes (not run in full; docs-only, see above)
• Deployed to the lab and confirmed working (the settings, read back above)
• Docs updated (docs/changelog.md, docs/architecture.md, docs/roadmap.md, stacks/sensitive/README.md)

🤖 Generated with Claude Code

[Copilot]

🟡 Changes recommended

Recovery coverage needs clarification, and current-state documentation must agree that Memos now holds real household notes.

2 open issues

• Document missing Memos coverage in household-copy tooling · New
• Reconcile Memos documentation and recovery exception wording · New

What changed in this PR

Records Memos’ first real household notes and the operator’s acceptance of an outstanding off-estate recovery gap.

Changes:

• Adds a dated changelog entry describing the shared Space and account, visibility, and content-limit settings.
• Records unauthenticated checks of the instance settings; no deployment configuration changes.

File	Description
docs/​changelog.md	Records Memos adoption, database settings, verification, and the accepted recovery gap.

_{Review effort: Balanced}