correct note about puppet change rate: it *does* converge within 4h.

howto/puppet.md

@@ -1801,8 +1801,14 @@ handled by a systemd timer/service unit pair: `puppet-run.timer` and
 `puppet-run.service`. These are managed via the `profile::puppet` class and the
 `puppet` module.
 
-The runs are executed every 4 hours, with a random 4 hour jitter, so the actual
-frequency is somewhere between 4 and 8 hours.
+The runs are executed every 4 hours, with a random (but fixed per
+host, using `FixedRandomDelay`) 4 hour delay to spread the runs across
+the fleet.
+
+Because the additional delay is fixed, changes should propagate to the
+entire Puppet fleet within 4 hours. A Prometheus alert
+(`PuppetCatalogStale`) will raise an alarm for hosts that have not run
+for more than 24 hours.
 
 ### LDAP integration