Same fix as orchestration-flow-patterns.svg (8772564), applied after a
comprehensive re-check that found the bug wasn't limited to the 6 files
originally caught by a narrower pattern match - architecture-overview.svg
and firewall-and-network-docker-bypass.svg were also affected.
Confirmed via a control test on orchestration-flow-patterns.svg that the
.drawio source's labelBackgroundColor property was never the actual
cause (reverted it, re-exported, still broken, still fixed cleanly by
the same strip) - this is a draw.io export-time quirk, not a content or
convention problem, so no CLAUDE.md changes needed.
Each file: stripped the same broken wrapper-div background-color
declarations (flat #1C1D1E / #ffffff, or the equivalent light-dark()/
var(--ge-adaptive-bg) variants - not consistent across exports of the
same file), verified 0 remain, valid XML, and the correct adaptive span
background count unchanged before/after in every file.
Files: architecture-overview.svg, firewall-and-network-docker-bypass.svg,
iac-pipeline-tools-flow.svg, observability-pipeline.svg,
readme-trust-boundaries-blast-radius.svg, secret-distribution-flows.svg,
secrets-and-pki-lifecycle.svg
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Sonnet 5 <[email protected]>
1. Live-verify: journald persistent-storage config confirmed on two
hosts (1G vs 500M cap, matches the doc's claim exactly), Alloy
active confirmed across all 11 fleet hosts.
2. Fix KB: Alloy Agent Model was stale - version had moved from
v1.18.0 to v1.18.1 on all 8 'newer' hosts since last checked,
role's own default still unreconciled at 1.17.1. Fixed and
confirmed via re-fetch.
3. Pulled the full Observability Pipeline tree: Alloy Agent Model,
Log Flow, Metrics Flow.
4. Replaced both mermaid diagrams (broke this repo's Nextcloud-SVG
convention) with real diagrams built through the proper round-trip.
5. Evidence: real journald config dumps, plus 3 real Grafana
screenshots (host metrics dashboard, detailed Loki log stream
showing job=technitium-dns/docker/system, and the fleet-wide log
volume dashboard) - one screenshot round caught and fixed an
unredacted internal IP before being used.
6/7. Compelling-proof test passes; sanitize-check clean.
thesabearandClaude Sonnet 5
