Mark TB-005 Obsidian hardening complete.

Record deployed internal_only gate and update plan brief gaps.

plans/homelab-improvements/tasks/README.md

@@ -38,7 +38,7 @@ Parent: [PLAN-BRIEF.md](../PLAN-BRIEF.md) · Template: [_TEMPLATE.md](_TEMPLATE.
 | TB-002 | jd.ginnoir.com | [→](TB-002-jd-caddy-block.md) |
 | TB-003 | Recyclarr | [→](TB-003-recyclarr.md) |
 | TB-004 | Pin infra tags | [→](TB-004-pin-infra-tags.md) |
-| TB-005 | Obsidian hardening | [→](TB-005-obsidian-hardening.md) |
+| TB-005 | Obsidian hardening ✓ | [→](TB-005-obsidian-hardening.md) |
 | TB-006 | Authentik admin login | [→](TB-006-authentik-forward-auth.md) |
 | TB-007 | Romhacks handoff | [→](TB-007-romhacks-handoff.md) |
 | TB-008 | Retire Deluge | [→](TB-008-retire-deluge.md) |

plans/homelab-improvements/tasks/TB-005-obsidian-hardening.md

@@ -1,7 +1,7 @@
 # TB-005 — Obsidian / CouchDB hardening
 
-**Status:** done (pending deploy)  
-**Your call:** Do it — LAN/tailnet only via `internal_only`
+**Status:** done — deployed 2026-06-10  
+**Your call:** **Do it** — LAN/tailnet only via `internal_only`
 
 ---
 
@@ -34,8 +34,8 @@
 | | |
 |---|---|
 | **Decision** | Do it — `internal_only` (LAN + tailnet); no public access |
-| **Notes** | All LiveSync clients on tailnet; Authentik not needed |
-| **Date** | 2026-06-10 |
+| **Notes** | `import internal_only` on obsidian.ginnoir.com. All LiveSync clients on tailnet; Authentik not needed. CouchDB password rotation deferred. |
+| **Date** | 2026-06-10 (decided + deployed) |
 
 ---
 
@@ -54,7 +54,7 @@ Caddyfile, stacks/notes/
 
 ### Done when
 
-- [ ] You can still sync where you need to
-- [ ] Admin/_utils not wide open
+- [x] You can still sync where you need to (tailnet)
+- [x] Admin/_utils not wide open (`internal_only` — LAN + 100.64.0.0/10 only)
 
 </details>