The full, exhaustive table lives in claude-md/operational-rules.md (with the incident history behind each one). This page is the shortlist of things worth knowing before you touch the fleet.
/16 — Proxmox masquerades IPs between VLANs; 10.10.0.0/16, not a narrower range.wg syncconf doesn't install kernel routes — it applies crypto-routing live but you still need a manual ip route add for a newly widened AllowedIPs range, or wait for the next wg-quick cycle.docker compose restart caddy from /opt/stacks/caddy/ — kill -USR1 and the admin API both fail here.log line in every site block — the global options block only defines where logs go, not which sites get logged.OnCalendar, never OnBootSec/OnUnitActiveSec alone — see Backups & Alerting.import sso (the generic wall) only works under house-of-trae.com — see Identity, DNS & Email.access_code_lifespan to 300s on any child realm broker — the 60s default causes expired-code errors.cores=2, permanently — hot-bm-nl hangs at guest SMP bring-up above 2 vCPUs, a real limitation of its nested-virtualization depth, not a config bug. Don't re-investigate from scratch if this resurfaces.qm reboot/qm shutdown time out and need a forced power-cycle.chmod 644 (not 600) for secrets read by non-root container users — root-owned 600 files are silently unreadable to them.