# CURRENT-STATE.md -- the single status authority (Omega Cloud / VR1 DC-DC)

Authored 2026-07-18 by the grounding-audit Phase-2 ground-truth agent
(charter: `docs/audit/grounding-audit-charter.md`, section 3) at repo HEAD
`e999b03` on branch `dc-dc-stage3-phase2-dc-substrate`. Every claim below
carries its evidence (path:line, quoted command output, or commit hash).
Claims that could not be evidenced read-only are marked UNKNOWN with what
would resolve them. Nothing here is guessed.

STATUS OF THIS DOCUMENT: SIGNED by the operator 2026-07-18 (section 11;
charter Phase 6 item 5). STANDING RULE (GA-R1, RATIFIED 2026-07-18 with
amendments C1+C2 -- `docs/audit/ga-rulings.md`): no status claim is
hand-written anywhere else; other documents point HERE; this document
cites captured command output, and measurement always wins over it (C2).
Other status surfaces are pointers or history; where one still carries a
claim, it is a defect (Phase 1 proved they contradict:
`docs/audit/record-inventory.md`, 12 groups; findings GA-F01..GA-F15).

---

## 1. Where the project IS

- Project: Omega Cloud, VR1 DC-DC rehearsal -- a two-DC + Office1-headend
  virtual rehearsal on KVM (vcloud host), rehearsing the future bare-metal
  Roosevelt deployment (D-100, `docs/design-decisions.md:1946`).
- Stage: Stage 3 / Phase 2 -- "OpenTofu builds each DC substrate"
  (`docs/dc-dc-deployment-workflow.md:148`; branch name
  `dc-dc-stage3-phase2-dc-substrate`; runbook
  `runbooks/dc-dc-phase2-tofu-dc-substrate.md`). Stages 0-2 precede it;
  stages 4-7 are authored, not executed (workflow doc:873).
- Position inside Stage 3: the DC0 outer `tofu apply` (deploy step A) is
  BLOCKED at its own gate (G9) -- blocker: sweep Batches 2-6 + G8 + the
  Batch-6 exit runs incl. re-sign. Stop commit `43b29d7` (2026-07-18:
  post-reboot outer plan would bounce Office1 headend + edge). Nothing
  DC0-scoped has been applied (`tofu -chdir=opentofu state list` shows no
  `vvr1_dc0` or `vr1_dc0_uplink` resources; output quoted in section 2).
- The grounding audit: Phases 1-4 complete (charter `148dcef`; Phase-2 =
  this document, ACCEPTED `c49da79`; Phase 3 = 3 probes 21/21 PASS; Phase
  4 = GA-R1..R7 + vocabulary RATIFIED, `docs/audit/ga-rulings.md`). Phase
  5 (the repair sweep) is EXECUTING: Batches 0-1 closed 2026-07-19, per-
  batch gates; the FREEZE holds only for surfaces no batch has opened.
- The vcloud host bookend (patch + reboot onto kernel -136,
  `docs/dc0-deploy-readiness.md:107`) HAS happened: host rebooted
  ~2026-07-17 23:39, both guests self-recovered via autostart
  (`docs/audit/env-snapshot-20260718.md:10-16`; re-measured this session,
  section 2.2 below).

## 2. What is APPLIED (from tofu state + live measurement, not from docs)

### 2.1 OpenTofu outer-root state (command: `tofu -chdir=opentofu state list`,
run 2026-07-18, 20 resources)

Office1 site (live, load-bearing):
- `module.voffice1.libvirt_domain.vm` + `.libvirt_volume.disk` +
  `.libvirt_volume.seed` + `.libvirt_cloudinit_disk.seed`
  (BUT see divergence 2.3-i: the cloudinit staging ISO no longer exists
  live)
- `module.office1_opnsense.libvirt_domain.vm` + `.libvirt_volume.disk`
- `module.office1_network.libvirt_network.office1_local`
- `module.office1_storage.libvirt_pool.dc`
- `module.ubuntu_noble_base.libvirt_volume.base`

Inter-site fabric and DC scaffolding:
- `module.mesh_vr1_dc0_vr1_dc1.libvirt_network.link`,
  `module.mesh_vr1_dc0_office1.libvirt_network.link`,
  `module.mesh_vr1_dc1_office1.libvirt_network.link` (the D-100 mesh
  triangle)
- `module.vr1_dc0_planes.libvirt_network.plane["data-tenant" | "metal-admin"
  | "metal-internal" | "provider-public" | "replication" | "storage"]`
  -- applied and live, but REMOVED from config (see 2.3-iii)
- `module.vr1_dc0_storage.libvirt_pool.dc`,
  `module.vr1_dc1_storage.libvirt_pool.dc`

### 2.2 Live environment (measured this session, 2026-07-18, read-only)

- `hostname` -> `vcloud`; `uname -r` -> `6.8.0-136-generic`.
- `virsh list --all` -> exactly two domains, both running:
  `voffice1` (Id 1), `office1-opnsense` (Id 2).
- `virsh dominfo` -> `Autostart: enable` on BOTH domains.
- `ssh voffice1 'snap list maas lxd; uname -r'` ->
  `maas 3.7.2-17972-g.35e297c4d` rev 41649 (3.7/stable),
  `lxd 5.21.5-f2a1a0e` rev 40074 (5.21/stable, held),
  guest kernel `6.8.0-136-generic`.
- `ssh office1-netbox 'curl -s -o /dev/null -w "netbox=%{http_code}"
  http://localhost:8000/'` -> `netbox=302` (service up, redirecting to
  login).
- `ssh office1-tailscale 'tailscale status | head -1'` ->
  `100.64.0.53 office1-tailscale ... linux -` (subnet-router VM up).
- D-126 base leg: `scripts/site-baseleg.sh check office1` passed at the
  Phase-1 snapshot (`docs/audit/env-snapshot-20260718.md:16-17`); not
  re-run this session.
- OPNsense edge version: 26.7 per confirmed as-built
  (`docs/vr1-office1-as-built.md:42`, updated 2026-07-18). NOT re-measured
  this session -- measuring requires the gated API credential path; see
  section 7.

### 2.3 State vs live vs config disagreements (REPORTED, not harmonized)

i.  `module.voffice1.libvirt_cloudinit_disk.seed` is IN STATE but its
    staging ISO was deleted by the reboot -- it still plans as a benign
    re-create (1 of section 5's 6 adds). The FORCED REPLACEMENT it used
    to force on `libvirt_volume.seed` (the GA-F01 defect that stopped
    the apply) is FIXED: D-130 ADOPTED (a) + implemented 2026-07-19,
    verified by the v8/v7 captures (gate rows G4/G5). Mechanism history:
    `docs/finding-20260718-voffice1-cloudinit-seed-replace.md:186-228`.
ii. Autostart: RESOLVED 2026-07-19 by the G6 state surgery (operator-
    ruled (ii), gate row G6): state now records `autostart = true` on
    both domains (`state show | grep -c autostart` -> 1 each); the 2
    in-place changes are gone from the plan (section 5 capture). Guests
    were never touched.
iii. The six `vr1-dc0` plane networks exist live and in state but are
    REMOVED from config -- the INTENDED Model B relocation (planes get
    recreated inside `vvr1-dc0` by the inner root,
    `opentofu/vr1-dc0-substrate/main.tf:28`). Their emptiness (0 leases,
    0 attached domains) was verified in a PRIOR session
    (`docs/dc0-deploy-readiness.md:43-45`) and must be re-verified in the
    same session as any apply (finding doc:259-265).
iv. RESOLVED 2026-07-19 (Batch 2, GA-F02): the readiness doc's falsified
    deploy-ready banner and its three contradictory plan counts are
    demoted -- status and the expected triple point HERE; the fresh-
    session banner points at the G9 canonical entry doc.

## 3. What is AUTHORED-BUT-NOT-APPLIED (in the tree, not in state / live)

- `module "vvr1_dc0"` (`opentofu/main.tf:360`) -- the DC0 containment VM
  (416 GiB / 108 vCPU, D-121/D-123 sizing) + its disk, seed volume, and
  cloudinit seed. 4 of the 5 committed DC0 creates in the plan capture.
- `module "vr1_dc0_uplink"` (`opentofu/main.tf:341`) -- the D-125 simulated
  ISP NAT network `172.30.2.0/24` (capture lines 226-247). The 5th create.
- The ENTIRE inner root `opentofu/vr1-dc0-substrate/` (main/variables/
  versions.tf; no state file exists in that directory) -- inner storage
  pool, the six relocated planes, bridge-in WAN, and the rest of the
  Model B step-C build.
- The removal of `module "vr1_dc0_planes"` from the outer config (the 6
  intended destroys; see 2.3-iii).
- `autostart = true` on voffice1/office1-opnsense in config (D-127) --
  live-true but state-absent (2.3-ii).
- `scripts/opnsense-plugins.sh` + `tests/opnsense-plugins/` (D-129
  profile-installer; commit `4cefa8b`). BUILT and green; the live `apply`
  against the edge is an operator-gated firmware mutation, NOT run
  (`docs/design-decisions.md:4050-4056`).
- SEC-010 enforcement artifact (`scripts/site-headend-install.sh
  --host-nodes` writing the transit FORWARD-drop) -- COMMITTED, applies on
  `vvr1-dc0` at deploy step B; ledger row stays OPEN until applied+verified
  (`bash scripts/ledger-scan.sh` output, SEC-010 row).
- Stage 4-7 runbooks (`runbooks/dc-dc-phase3..6-*.md`) -- written, not
  executed (`docs/dc-dc-deployment-workflow.md:873`).

## 4. What is RULED-BUT-NOT-BUILT (ADOPTED/RULED with no artifact yet)

- D-121/D-122/D-123/D-124/D-125 (all ADOPTED/RULED, status lines at
  `docs/design-decisions.md:3291,3474,3543,3635,3713`): the DC0 deploy
  sequence they rule (steps A-E, `docs/dc0-deploy-readiness.md:170-179`)
  exists only as config + runbook. Nothing DC0 is built.
- `vr1-dc1`: ruled at topology level (D-100/D-101 two-DC design) but HELD
  -- no ruled dc1 transit/rack addressing, no `vr1_dc1_rack_*` variables,
  no dc1 substrate root (`docs/dc0-deploy-readiness.md:100-103`). Only its
  storage pool and mesh legs exist (state list, 2.1).
- D-100 netem: mechanism authored (`opentofu/modules/netem-link`) but HELD
  as a comment in the root (`opentofu/main.tf:309-319`); placeholder
  parameters ruled for the rehearsal (readiness doc:73-75); final
  parameters unruled (section 8).
- D-129 Roosevelt metal-edge plugin profile (`os-smart`, `os-nut` |
  `os-apcupsd`, microcode, `os-lldpd`) -- recorded, inert until the
  Roosevelt edge build (`docs/design-decisions.md:4030-4031`).
- D-129 qga enablement: designed (opt-in module variable, default OFF; the
  guest-agent virtio channel is MISSING from the live edge domain) but not
  written; retrofit deferred to the edge's next scheduled restart
  (`docs/design-decisions.md:4041-4047,4057-4063`).

## 5. The outer plan count (wording per operator direction, GA-F01)

The true EXPECTED outer plan count is currently NOBODY'S:

- expected count: UNRESOLVED pending D-130;
- last captured: 7/2/7 (`docs/audit/outer-plan-20260718.txt`, line 428:
  "Plan: 7 to add, 2 to change, 7 to destroy." -- the ONLY citable
  plan-count source);
- pre-reboot gate was 5/0/6 (recorded at `docs/dc0-deploy-readiness.md:59`,
  `docs/session-ledger.md:278`).

The EXPECTED outer plan triple is **6 add / 0 change / 6 destroy**,
recorded 2026-07-19 with its evidencing capture
(`docs/audit/outer-plan-20260719-postG6.txt`, "Plan: 6 to add, 0 to
change, 6 to destroy."). WHY: 6 add = the 5 committed DC0 creates
(vvr1_dc0 domain/disk/seed/cloudinit + vr1_dc0_uplink) + voffice1's
benign staging-ISO re-create; 6 destroy = exactly the 6 empty relocated
planes; 0 change = D-130's guard suppressed the seed replace (v8) AND
the G6 state surgery recorded the already-true autostart. History: 7/2/7
was the post-reboot symptom (decomposition at
`docs/audit/env-snapshot-20260718.md:33-46`); 6/2/6 was post-D-130
pre-reconcile (v8 capture). A future plan differing from 6/0/6 is a STOP.

## 6. Open gates

Owner legend: operator (human ruling/approval), session (agent work under
gating), external (outside this repo/track). Type legend (GA-R6/E1): [V] =
verification-type (closes on its named executable check); [R] = ruling-type
(closes per a GA-R5 recorded ruling).

| # | Gate | What closes it | Owner | Evidence of current state |
|---|------|----------------|-------|---------------------------|
| G1 | Audit Phase 3: fresh-agent grounding test | [V] 3 clean-context probes score the 7-question set against this doc; holes map made | session | CLOSED 2026-07-18: 3 probes, 21/21 PASS, holes H1 (amended into G9) + H2 (no action) -- `docs/audit/phase3-grounding-test-20260718.md` |
| G2 | Audit Phase 4: GA-R1..R7 structural rulings + the stage-status vocabulary A/B | [R] ruling-type gate (GA-R6 rule 6): closes when every item carries a GA-R5 Status block | operator | CLOSED 2026-07-18: all seven GA-R + vocabulary (Option A + H1) RATIFIED, utterances quoted (`docs/audit/ga-rulings.md`, through commit `fe4f1c4` + this one) |
| G3 | Audit Phase 5: repair sweep of GA-F01..F15 (incl. memory hygiene GA-F05..F08, skill sweep) | [R] operator-gated fix batches, each commit naming its GA-F | operator + session | Batch 0 OPENED by operator 2026-07-19; items 0.1 (repo-lint L10, GA-R1/C1), 0.2 (SEC repoint, GA-R4/F3), 0.3 (counter hardening, GA-F15), 0.4 (extractor vocab scan, GA-F10/H1) landed; Batch 0 CLOSED (verification passed 2026-07-19); Batch 1 all items landed + close verification passed (G4/G5/G6/G7 CLOSED; triple 6/0/6 recorded); Batch 2 OPEN (record fixes landing per-GA-F); Batches 2-6 await gates; FREEZE holds for un-gated surfaces |
| G4 | The two D-130 verifications | [V] run them, capture output | session | CLOSED 2026-07-19: v8 suppression CONFIRMED (7/2/7 -> 6/2/6, zero forces-replacement; `docs/audit/outer-plan-20260719-v8-ignorechanges.txt` + `-baseline.txt`); v7 no-bounce under running domain, zero residue (`docs/audit/throwaway-v7-20260719.txt`) |
| G5 | D-130 mechanism ruling (seed-volume durable fix) | [R] operator rules in Phase 5, quoting G4's captured output | operator | CLOSED 2026-07-19: D-130 ADOPTED (a) ignore_changes (`docs/design-decisions.md` D-130, GA-R5 utterance quoted); implemented in `modules/cloudinit-vm` + `tests/cloudinit-vm` |
| G6 | State reconcile of autostart + seed WITHOUT bouncing guests | [R] gated mechanism, operator-ruled (S3) | operator | CLOSED 2026-07-19: ruled (ii) state surgery (GA-R5); pull -> inject autostart:true on both domains -> push (serial 22->23, backup `terraform.tfstate.pre-G6-20260719`); guests never touched (ids 1/2 unchanged, running) |
| G7 | New captured plan == the expected triple recorded in section 5 | [V] re-plan to a capture file after G5+G6 | session | CLOSED 2026-07-19: capture `docs/audit/outer-plan-20260719-postG6.txt` = 6/0/6, equals section 5 exactly |
| G8 | Same-session pre-apply re-verify: 6 planes still empty (0 leases / 0 attached domains) | [V] run in the SAME session as the apply | session | Last verified in a prior session only (finding doc:259-265) |
| G9 | DC0 outer apply (deploy step A) | [V] operator-gated, logged (`run-logged.sh`), after G1-G8; audit exit criteria met (charter Phase 6). CANONICAL ENTRY DOC (probe hole H1): `runbooks/dc-dc-phase2-tofu-dc-substrate.md`, with `docs/dc0-deploy-readiness.md` section E as the step table | operator | BLOCKED -- blocker: Batches 2-6 + G8 + Batch-6 exit runs incl. re-sign (G11); stop commit `43b29d7`; state shows nothing DC0 applied |
| G10 | Deploy steps B-E in-sequence gates: SEC-010 `--host-nodes --check` on vvr1-dc0; depth-4 nested boot; D-125 foreign-MAC egress test; MAAS reachability + `TF_VAR_maas_api_key` before step D; netem placeholder step E | [V] exercised during the gated deploy | session (each mutation operator-approved) | Not reached (`docs/dc0-deploy-readiness.md:67-84,170-179`) |
| G11 | Operator signs THIS document | [R] read top-to-bottom; discrepancies resolved in the document | operator | CLOSED: SIGNED 2026-07-18, section 11 (post-probe version, per sequencing directive) |
| G12 | `vr1-dc1` build | [R] operator rules dc1 transit/rack addressing; then vars + substrate authored | operator | HELD (`docs/dc0-deploy-readiness.md:100-103`) |
| G13 | D-129 residuals | [R] operator-gated live plugin install on the edge; qga channel retrofit at next scheduled edge restart; 4 sub-decisions (section 8) | operator | OPEN / PARTIALLY RULED (`docs/design-decisions.md:4017`) |
| G14 | 8 OPEN SEC rows (SEC-001, -003..-008, -010; prior cell said 9, enumeration + scan both measure 8 -- corrected per GA-R1/C2) | [R] per-row: rotations/flips at v1 close (external to VR1 track) except SEC-010 = apply+verify at G10 | operator / external | `docs/security-ledger.md` (register of record, GA-R4/F3); count cross-checked vs `bash scripts/ledger-scan.sh` 2026-07-19 |
| G15 | D-068 / D-071 rulings | [R] operator rules (section 8); neither blocks the VR1 substrate | operator | PROPOSED/OPEN (status lines, section 8) |

## 7. Version pins (measured; the authority for every pin)

| Component | Measured value | Command (run 2026-07-18) | Where measured |
|---|---|---|---|
| OpenTofu | v1.12.4 | `tofu version` | vcloud (also `docs/audit/env-snapshot-20260718.md:26`) |
| libvirt provider | dmacvicar/libvirt 0.9.8 (pinned) | `grep -A2 'provider' opentofu/.terraform.lock.hcl` | repo lock file |
| MAAS provider | canonical/maas 2.7.2 (pinned) | same | repo lock file |
| MAAS | 3.7.2-17972-g.35e297c4d (3.7/stable) | `ssh voffice1 'snap list maas'` | voffice1 |
| LXD | 5.21.5-f2a1a0e (5.21/stable, held) | `ssh voffice1 'snap list lxd'` | voffice1 |
| Kernel (host) | 6.8.0-136-generic | `uname -r` | vcloud |
| Kernel (voffice1) | 6.8.0-136-generic | `ssh voffice1 'uname -r'` | voffice1 |
| OPNsense edge | 26.7 (FreeBSD base 15.1) | not re-measured (gated API creds); per confirmed as-built `docs/vr1-office1-as-built.md:42`, 2026-07-18 | office1-opnsense |
| NetBox (Office1 apex) | 4.6.4 per as-built `docs/vr1-office1-as-built.md:44`; service UP verified (HTTP 302) this session | `ssh office1-netbox 'curl ... localhost:8000'` | office1-netbox |
| Juju | NOT part of VR1 substrate yet (arrives Stage 5). Last recorded VR0 value 3.6.25 -- historical, unverified here | n/a | n/a |

Known-stale pins that this table supersedes (do NOT trust them; Phase-5
fixes them): OpenTofu 1.12.3 at `opentofu/README.md:41` (historical Stage-1
prose), `docs/dc-dc-deployment-workflow.md:47,360,875`,
`.claude/skills/.../platform-traps.md:19` (GA-F03); OPNsense 26.1 across
the skill references (GA-F04); jumphost name `vopenstack-jesse` in
`CLAUDE.md:4` and the skill -- the host is `vcloud`, measured (GA-F05).

## 8. Open decision queue (the exact questions the operator must answer)

1. D-130: RULED 2026-07-19, ADOPTED (a) ignore_changes -- rotated to
   `docs/design-decisions.md` D-130 (question + utterance + captures).
2. D-100 netem parameter sub-item (gap #11). Already ruled: same-metro
   dark-fiber default lean (D-100 sub-items, `docs/design-decisions.md:
   1962`) and placeholder-for-the-rehearsal (readiness doc:73-75, operator
   ruling 2026-07-16). OPEN QUESTION: the final latency/jitter/loss/rate
   numbers -- supply the Roosevelt inter-DC target, or confirm the
   placeholder stands until that target exists. Evidence needed: the
   Roosevelt link spec (external input; nothing in-repo can answer it).
3. D-068 -- Vault substrate hardening (PROPOSED/OPEN,
   `docs/design-decisions.md:1457`). QUESTION: rule items 2 (Vault
   listener TLS) and 3 (AppRole secret_id lifecycle) for Roosevelt; item 1
   (Vault version) needs a re-scoped migration plan since the 1.16
   forward-pin was proven NOT viable (amendment, :1650). Evidence in
   `docs/D-068-vault-1.8-vs-1.16-analysis.md`.
4. D-071 -- update cadence + controller patch policy (PROPOSED,
   `docs/design-decisions.md:1605`). QUESTION: adopt policy points 1-4
   (monthly-review window trigger; patch-only controller jumps; order;
   acceptable single-controller risk) as amended by the confirmed backup
   posture (:1677).
5. D-129 -- four OPEN sub-decisions (OPEN / PARTIALLY RULED,
   `docs/design-decisions.md:4017`): (i) is the boundary edge in-scope for
   COS scraping (D-105 scope)? (ii) `os-frr` dynamic routing -- Roosevelt
   question? (iii) consolidate the Tailscale subnet-router onto the edge
   vs keep D-107 as-is? (iv) does the edge anchor site NTP? Plus the
   operator-gated live install of the ruled VR1 profile
   (`scripts/opnsense-plugins.sh apply vr1-edge`).
6. Audit Phase 4 rulings: GA-R1..GA-R6 individually, plus the legal
   stage-status vocabulary A/B (GA-F10 operator note) -- each gated, one
   ruling per exchange.

## 9. Additional defect found while authoring (FIXED in sweep Batch 0.3,
2026-07-19 -- wrap-aware exclusion, GA-F15; history below)

`ledger-scan.sh`'s mention-derived next-free counters (DOCFIX, BUNDLEFIX)
are SELF-INFLATED by any doc that quotes a "next-free" value and lets the
hyphenated token wrap onto a line without the words "next-free" -- the
per-line exclusion filter (`scripts/ledger-scan.sh:121-129`, the
`grep -viE 'next[- ]free'` at :124) then counts the quote as a real
assignment; the script's own CAUTION comment (:112-120) documents exactly
this failure class. It happened TWICE inside the audit itself on
2026-07-18: the Phase-1 env snapshot's wrapped next-free line inflated the
BUNDLEFIX counter (051 -> reported 052), and this document's own first
draft of this very section inflated the DOCFIX counter the same way while
asserting DOCFIX was unaffected. Both audit surfaces were reworded
token-free the same day and the counters re-verified at their true values
(D=130, DOCFIX=197, BUNDLEFIX=052 -- see GA-F15). The D counter is
header-authoritative and was never affected. Batch 0.3 hardened the
scanner: an excluded line now also suppresses the immediately following
line (the wrap case); counters re-verified unchanged post-fix. The
authoring discipline stands regardless: never write a hyphenated
register-token quote of a next-free value into any doc; state the numbers
token-free as this section does.

## 10. How to verify this document (cold-session re-derivation)

Run read-only, from the repo root:

- Repo identity: `git rev-parse HEAD; git status --short`
  (this doc was authored at `e999b03`, clean tree).
- Applied set: `tofu -chdir=opentofu state list` (expect the 20 resources
  in section 2.1); `virsh list --all`; `virsh dominfo voffice1 | grep -i
  autostart` (and office1-opnsense).
- Authored-not-applied: `grep -n '^module ' opentofu/main.tf` (12 blocks;
  `vvr1_dc0` + `vr1_dc0_uplink` absent from state list);
  `ls opentofu/vr1-dc0-substrate/` (no *.tfstate).
- Plan count: read `docs/audit/outer-plan-20260718.txt` line 428. Do NOT
  re-run `tofu plan` casually against live state; if a fresh capture is
  taken, it must be written to a new dated capture file and cited here.
- Versions: `tofu version`; `ssh voffice1 'snap list maas lxd; uname -r'
  </dev/null`; `uname -r`; `grep -A2 provider
  opentofu/.terraform.lock.hcl`.
- Open decisions + SEC + next-free: `bash scripts/ledger-scan.sh`
  (BUNDLEFIX caveat: section 9); decision status lines:
  `grep -n '^## D-' docs/design-decisions.md` then read each Status line
  -- a decision's Status line in that file is the ONLY ruling authority.
- Gates: sections 1a and 4-7 of `docs/audit/grounding-audit-charter.md`;
  `docs/audit/grounding-audit-20260718.md` for GA-F01..F14.
- Live service probes: `ssh office1-netbox 'curl -s -o /dev/null -w
  "%{http_code}" http://localhost:8000/' </dev/null` (expect 302);
  `ssh office1-tailscale 'tailscale status | head -1' </dev/null`.

What this document is NOT built from and you must not rebuild it from:
the prose of the 95 `docs/changelog-*.md` files, the
`docs/session-ledger.md` narrative, or auto-memory -- all proven to carry
false status (GA-F14, GA-F06..F08).

## 11. Operator signature (G11)

SIGNED 2026-07-18. The operator personally reviewed the section-10
verification run (outputs at repo HEAD `8cdbf4a`; zero divergences, match
table in the session record) and read this document top to bottom. Exact
utterance: "SIGNED Reviewed and all signoff conditions are met. I reviewed
the section-10 run outputs at 8cdbf4a. Jesse 7/18/2026". This document is
the signed status authority (charter Phase 6 item 5 MET at this baseline).
