docs: catch the org profile and repo docs up to the current fleet

CLAUDE.md

@@ -38,7 +38,7 @@ org-level operator tooling that governs the rest of the fleet.
 - **`terraform/`** — the fleet's GitHub settings as Terraform
   (`integrations/github`). Owns repo **existence** and identity, merge options,
   the topic spine, per-repo `main` rulesets, required checks, and the label
-  palette across all 15 org repos. Adding a repo to `fleet-ops/repos.json` and
+  palette across every org repo. Adding a repo to `fleet-ops/repos.json` and
   applying creates it; removing one is refused by `prevent_destroy`. Applies are
   **CI-run on merge to `main`** (phase 2, live 2026-08-17 — plan-on-PR posts to
   the PR, `gate` is required, Dependabot PRs skip plan by design). **Read `terraform/README.md` § Rails before touching it.**

README.md

@@ -70,7 +70,9 @@ Tidewater label palette — across every repo in the org.
 Adding a repo to [`fleet-ops/repos.json`](fleet-ops/repos.json) and applying
 creates it, scaffolded from `repo-template` and wired to fleet policy from its
 first second. Removing one is refused by `prevent_destroy` rather than deleting
-a live repository. Applies are operator-run today; apply-on-merge is phase 2.
+a live repository. A merge to `main` **is** an apply: `plan` posts to every
+tf-touching PR, the required `gate` check blocks a red plan, and `apply` runs on
+merge (phase 2, live 2026-08-17).
 See [`terraform/README.md`](terraform/README.md).
 
 ### [`fleet-ops/`](fleet-ops/)
@@ -153,10 +155,10 @@ This is a lab — the systems are real, the stakes are not. Pick a vector:
 **Add a fleet-wide required status check.** Edit
 [`fleet-ops/required-checks.json`](fleet-ops/required-checks.json) to add a check
 context for one repo or all of them, and open a PR — [`ci/validate.py`](ci/validate.py)
-validates the JSON shape before it can merge. Once merged, an operator applies the
+validates the JSON shape before it can merge. Once merged, CI applies the
 change with the [`terraform/`](terraform/) module, which reads that same JSON and owns
-rulesets, required checks, and labels (applies are operator-run with an admin token in
-phase 1 — see [`terraform/README.md`](terraform/README.md); `fleet-apply.sh` still
+rulesets, required checks, and labels (apply-on-merge is live — phase 2, see
+[`terraform/README.md`](terraform/README.md); `fleet-apply.sh` still
 contributes the required-context preflight, proving a check context actually reports
 before anything requires it). This is the same JSON-then-apply flow used repeatedly to
 roll checks across the fleet.
@@ -167,9 +169,10 @@ roll checks across the fleet.
 **Migrate a settings surface to Terraform.** Extend the `terraform/*.tf` modules,
 which read the same `fleet-ops/*.json`, and open a PR —
 [`.github/workflows/terraform.yml`](.github/workflows/terraform.yml) runs `fmt` +
-`validate` on it. The apply is still operator-run locally today (phase 1); apply-on-merge
-is the planned phase 2 tracked in [`terraform/README.md`](terraform/README.md), so don't
-expect a merge here to mutate GitHub settings yet.
+`validate` and posts a `plan` to the PR, with the required `gate` check blocking a red
+plan. Merging **is** the apply (phase 2, live 2026-08-17 — see
+[`terraform/README.md`](terraform/README.md)): whatever is on `main` is the live fleet
+settings, so a merge here really does mutate GitHub settings across the org.
 **Proof this works:** [PR #82 — Manage the fleet's GitHub settings with the Terraform GitHub provider](https://github.com/lentago/.github/pull/82),
 [PR #83 — terraform: rename the validate job to tf-validate](https://github.com/lentago/.github/pull/83).
 

profile/README.md

@@ -41,9 +41,10 @@ Everything is code. Every change is a pull request. Merges apply automatically.
 | [**drosera**](https://github.com/lentago/drosera) | your Grafana Cloud dashboards and alerts |
 | [**kalmia**](https://github.com/lentago/kalmia) | every Proxmox VM and LXC in the homelab |
 | [**claytonia**](https://github.com/lentago/claytonia) | the agent runner pool itself |
+| [**osmunda**](https://github.com/lentago/osmunda) | the k3s cluster's workloads — Flux pulls the merge |
 | [**solidago**](https://github.com/lentago/solidago) | the AWS platform |
 | site repos | the live sites |
-| [**.github**](https://github.com/lentago/.github) | repo settings and rulesets, via `fleet-ops` |
+| [**.github**](https://github.com/lentago/.github) | every repo's rulesets, required checks, and labels, via `terraform/` |
 
 ### 🧰   What the estate is built on
 
@@ -81,6 +82,10 @@ Everything is code. Every change is a pull request. Merges apply automatically.
 <td>Reference three-tier AWS platform — 100% Terraform: VPC, ECS Fargate, RDS, WAF.</td>
 </tr>
 <tr>
+<td><img src="./assets/marks/lentago-mark-square.svg" width="22" height="22" align="absmiddle" alt="" />&nbsp; <a href="https://github.com/lentago/osmunda"><b>osmunda</b></a><br/><sub><a href="https://deepwiki.com/lentago/osmunda">DeepWiki&nbsp;↗</a></sub></td>
+<td>Kubernetes platform — standing k3s on lab guests, an ephemeral EKS overlay, Flux GitOps throughout.</td>
+</tr>
+<tr>
 <td><img src="./assets/marks/drosera-mark-square.svg" width="22" height="22" align="absmiddle" alt="" />&nbsp; <a href="https://github.com/lentago/drosera"><b>drosera</b></a><br/><sub><a href="https://deepwiki.com/lentago/drosera">DeepWiki&nbsp;↗</a></sub></td>
 <td>Git-driven observability into Grafana Cloud — one Alloy container, Terraform-provisioned dashboards.</td>
 </tr>
@@ -97,6 +102,10 @@ Everything is code. Every change is a pull request. Merges apply automatically.
 <td>Full-volume log capture &amp; archive → Axiom, at zero query cost.</td>
 </tr>
 <tr>
+<td><img src="./assets/marks/lentago-mark-square.svg" width="22" height="22" align="absmiddle" alt="" />&nbsp; <a href="https://github.com/lentago/monarda"><b>monarda</b></a><br/><sub><a href="https://deepwiki.com/lentago/monarda">DeepWiki&nbsp;↗</a></sub></td>
+<td>Campaign-site kit — an Astro template, intake, and a timed dry-run, deploying to the client's own GitHub Pages or S3.</td>
+</tr>
+<tr>
 <td><img src="./assets/marks/lentago-mark-square.svg" width="22" height="22" align="absmiddle" alt="" />&nbsp; <a href="https://github.com/lentago/asclepias"><b>asclepias</b></a><br/><sub><a href="https://deepwiki.com/lentago/asclepias">DeepWiki&nbsp;↗</a></sub></td>
 <td>The field guide — operations manual, day-one path, hands-on labs.</td>
 </tr>
@@ -120,22 +129,23 @@ Three ways in, depending on why you're here.
 
 1. [**solidago**](https://github.com/lentago/solidago) — the reference AWS platform, 100% Terraform.
 2. [**claytonia**](https://github.com/lentago/claytonia) — the self-hosted agent fleet that does the directed work.
-3. [**homeassistant-config**](https://github.com/lentago/homeassistant-config) — physical-world monitoring, version-controlled.
+3. [**epigaea**](https://github.com/lentago/epigaea) — physical-world monitoring, version-controlled.
 
 Then the [incident register](https://github.com/lentago/.github/blob/main/fleet-reports/incidents.md) for how things break, and the [field-guide glossary](https://github.com/lentago/asclepias/blob/main/manual/glossary.md) to map it all onto enterprise practice.
 
 **Evaluating the practice** &nbsp;<sub>(mission-driven organizations)</sub>
 
 1. **The pledge** (above) — you own every piece, we teach your people, firing us is a runbook.
-2. [**site-pondviewlane-com**](https://github.com/lentago/site-pondviewlane-com) — a community organization's public-record fact base with a grounded Ask box.
-3. [**homeassistant-config**](https://github.com/lentago/homeassistant-config) — physical-world monitoring on a donated-scale budget.
-4. [**Incident register**](https://github.com/lentago/.github/blob/main/fleet-reports/incidents.md) — post-mortems published verbatim.
+2. [**monarda**](https://github.com/lentago/monarda) — the campaign-site kit: a fundraising site in a day, deployed into *your* GitHub or AWS account.
+3. [**site-pondviewlane-com**](https://github.com/lentago/site-pondviewlane-com) — a community organization's public-record fact base with a grounded Ask box.
+4. [**epigaea**](https://github.com/lentago/epigaea) — physical-world monitoring on a donated-scale budget.
+5. [**Incident register**](https://github.com/lentago/.github/blob/main/fleet-reports/incidents.md) — post-mortems published verbatim.
 
 ### 📊 &nbsp; Fleet in numbers
 
 <sub>Regenerated weekly from the repos themselves — we operate in the open.</sub>
 
-- **[Fleet report](https://github.com/lentago/.github/blob/main/fleet-reports/fleet-report.md)** — open issues by repo, a 7-day activity snapshot, and a code census that counts the `CLAUDE.md`-family instruction files as natural-language code.
+- **[Fleet report](https://github.com/lentago/.github/blob/main/fleet-reports/fleet-report.md)** — open issues by repo, a 30-day activity snapshot, and a code census that counts the `CLAUDE.md`-family instruction files as natural-language code.
 - **[Language census](https://github.com/lentago/.github/blob/main/metrics/language-census.md)** — the canonical all-languages breakdown.
 - **[Incident register](https://github.com/lentago/.github/blob/main/fleet-reports/incidents.md)** — post-mortems from lab operations, with what broke, what did *not*, and the governance lessons.
 - **[Lock-in ledger](https://github.com/lentago/.github/blob/main/fleet-reports/lock-in-ledger.md)** — our own vendor dependencies, each scored on export fidelity, format openness, custody, and a documented exit. The receipt behind *"firing us is a runbook."*