docs(infra): document codex appliance vm topology

README.md

@@ -65,7 +65,7 @@ This walkthrough shows how the Dreame vacuum package became a real Home Assistan
 **Docker add-ons & utilities**
 | Container | Repo/Docs | Purpose |
 | --- | --- | --- |
-| Duplicati | [duplicati/duplicati](https://github.com/duplicati/duplicati) | Off-box, versioned backups for HA config and media; docker config backups land in OneDrive. |
+| Duplicati | [duplicati/duplicati](https://github.com/duplicati/duplicati) | Off-box, versioned backups for HA config, media, and infrastructure compose/config trees. |
 | Dozzle | [amir20/dozzle](https://github.com/amir20/dozzle) | Lightweight Docker log viewer (useful for quick tailing across the homelab stacks). |
 | Cloudflared | [cloudflare/cloudflared](https://hub.docker.com/r/cloudflare/cloudflared) | Secure tunnel/edge access to Home Assistant without opening inbound ports. |
 | WordPress | [wordpress](https://hub.docker.com/_/wordpress) | Hosts [vCloudInfo.com](https://www.vcloudinfo.com) for docs, how-tos, videos, and long-form writeups that accompany this config. |

docs/diagrams/bear-stone-proxmox-docker-topology.md

@@ -2,6 +2,7 @@
 
 - This is a deployment inventory diagram for blog and documentation use.
 - `docker10` is pinned to ProxMox1 (`qemu/105`) based on the current workspace inventory.
+- `codex-appliance` is pinned to ProxMox1 (`qemu/113`) and owns the BearClaw/Codex runtime, OneNote indexer, MCP stdio wrappers, Portainer agent, and Dozzle agent.
 - `docker14`, `docker17`, and `docker69` are shown as cluster-managed Docker VMs on shared storage because the current AGENTS inventory does not pin them to a single Proxmox node.
 - The diagram is intentionally hierarchy-first. It shows hosts and containers, not every runtime network edge between services.
 - Infra Info is omitted because it was removed; BearClaw Admin owns the replacement infrastructure planning view.

docs/diagrams/bear-stone-proxmox-docker-topology.mmd

@@ -7,6 +7,7 @@ flowchart TD
     end
 
     P1 --> D10VM[docker10 VM]
+    P1 --> CODEXVM[codex-appliance VM]
     P1 --> FLOAT
     P2 --> FLOAT
     NFS --> D10VM
@@ -17,6 +18,14 @@ flowchart TD
     FLOAT --> D17VM
     FLOAT --> D69VM
 
+    subgraph CODEX[codex-appliance - BearClaw and MCP runtime]
+        CX_CODEX[codex_appliance]
+        CX_ONENOTE[onenote-indexer]
+        CX_MCP[MCP stdio wrappers]
+        CX_PORT[portainer_agent]
+        CX_DOZZLE[dozzle_agent_13]
+    end
+
     subgraph D10[docker10 - primary home stack]
         D10_HA[home-assistant]
         D10_PI[pihole]
@@ -44,7 +53,6 @@ flowchart TD
     end
 
     subgraph D17[docker17 - internal apps and tooling]
-        D17_CODEX[codex_appliance]
         D17_DASHY[dashy]
         D17_DOZZLE[dozzle]
         D17_TUG_UI[tugtainer]