# Session ledger -- in-flight work continuity record

**Purpose.** Long ops sessions on this cloud routinely exceed a single context window
and get COMPACTED (sometimes several times). Anything living only in the chat scrollback
is lost at compaction. This ledger is the durable, committed record of what is IN FLIGHT,
so any session -- after a compaction, or a fresh one -- can resume without losing pending work.

**How to use it (standing practice).**
1. At session start: read this ledger AND run `bash scripts/ledger-scan.sh`. Reconcile.
2. `ledger-scan.sh` is the DRIFT CHECK -- it derives the open-work it reliably can
   (PROPOSED/OPEN decisions, OPEN security rows, next-free numbers) straight from the repo.
   This narrative must not claim CLOSED anything the scan shows OPEN, nor omit what it surfaces.
3. Update this ledger at every deliverable/commit -- it is a standing deliverable like the
   changelog. The changelog says what CHANGED; this ledger says what is still OPEN.
4. The machine-derived block below is seeded from a scan; re-run the scan and re-seed rather
   than editing it by hand.

**SINGLE STREAM (collapsed 2026-07-13).** This ledger previously carried three parallel,
separately-owned stream sections (`main-chat`, `jumphost`, `shared`) plus ~30 append-only
session narratives. Those streams are CLOSED and reconciled into the one list below. There is
now ONE stream. Do not re-introduce per-stream sections.

**Where the history went.** The 2,189-line session-by-session narrative is NOT lost -- it is in
git history (the parent of the collapse commit) and, in durable form, in the 65 `docs/changelog-*.md`
files, `docs/design-decisions.md`, and the incident reports. This ledger deliberately carries only
what is still OPEN, plus the facts that would otherwise be lost because they live nowhere else.

---

<!-- SECTION: machine-derived | OWNER: ledger-scan (regenerate; never hand-edit) -->
## Machine-derived (re-seed from `scripts/ledger-scan.sh`; do not hand-edit)

_Re-seeded from the 2026-07-17 scan. Re-run `bash scripts/ledger-scan.sh` to refresh._

- **PROPOSED / OPEN decisions:** D-068 (Vault substrate hardening, Roosevelt -- 1.16 ruled OUT
  per amendment; the off-EOL-1.8.8 path remains OPEN), D-071 (routine update cadence + Juju
  controller patch policy -- AMENDED, still PROPOSED, awaiting operator ratification; gated on
  the pre-DC-DC controller HA/backup session), D-129 (OPNsense edge plugin/add-on base profile --
  OPEN / partially ruled 2026-07-18: VR1 profile adopted, FOUR sub-decisions still OPEN; review in
  `docs/opnsense-edge-addon-review-20260718.md`).
- **OPEN security rows:** 8 open per `bash scripts/ledger-scan.sh` (re-seeded 2026-07-19). The
  SEC register of record is `docs/security-ledger.md`; row-level dispositions live THERE only
  (GA-R4 amendment F3) -- this block carries pointer + count, never rows.
- **Next-free numbers:** D = **130**, DOCFIX = 196, BUNDLEFIX = 013.
  (Since the last re-seed D-121..128 all ADOPTED -- D-128 = VR1 operating model (2026-07-17). Load-bearing correction to the prior block:
  **D-123 = Model B** (nodes nest INSIDE `vvr1-dc0`; site-down = one `virsh destroy vvr1-dc0`) via
  operator ruling R-1 2026-07-16 -- this SUPERSEDES the earlier "D-123 Model A" this block used to
  record. Also: D-124 transit addressing PINNED (172.31.0.0/24) + imported to office1-netbox; D-125
  bridge-in single-NAT uplink; D-126 durable rootless site access; D-127 IaC autostart matrix. The
  Stage-4 rack<->region addressing the prior block flagged as HELD is now assigned.)
- **Standing numbering rule:** never write an identifier-shaped token (D-/DOCFIX-/BUNDLEFIX-NNN)
  ABOVE the real high-water mark anywhere in `docs/` or `runbooks/` prose -- historically a decoy
  token in prose inflated the next-free counter (hardened in DOCFIX-174); the authoring discipline
  stands regardless.
- **`ledger-scan` D-115 false-positive: RESOLVED.** The scan now keys on the LAST `**Status:**`
  line per `## D-NNN:` block (see `scripts/ledger-scan.sh` awk), not arbitrary body prose, so D-115
  (ADOPTED) no longer shows as PROPOSED/OPEN. The general hygiene -- trust the Status line over body
  text -- still holds.

<!-- END: machine-derived -->

---

## ROTATED 2026-07-19 (GA-R4 rule 6 -- the one-time rotation; F1 cap now enforceable)

The pre-rotation bodies (~1080 lines: Live state, OPEN WORK VR1/VR0, NetBox
write-path bugs, PINNED rulings, standing lessons, state facts, project-
completion, NetBox import narrative) moved VERBATIM to
`docs/archive/session-ledger-rotated-20260719.md`. Standing lessons + VR0
state facts were ROUTED to durable homes first (platform-traps already
carried most; juju format=line -> appendix-A; guard discipline ->
operating-discipline; VR0 cloud facts -> maas-as-built-reference.md).
Open work is machine-derived above + CURRENT-STATE.md; do not re-grow
bodies here -- sessions append BOUNDED summaries only (15-line cap).

Retained compact blocks (still-live obligations without another home yet):
- **NetBox write-path bugs (2026-07-14 adversarial review; LOGGED, NOT
  FIXED):** importer/write-guard defects recorded in the rotated body
  ("OPEN -- NetBox WRITE-PATH BUGS" section) -- route to a findings doc or
  fix before the next NetBox write campaign.
- **Project-completion (after D-011 passes):** consolidate the 10 per-phase
  do-documents into a v1 deploy runbook; flip repo PRIVATE (SEC-004);
  revoke/rotate SEC-005/006/007; v2-deferred: GitBucket SSH, IPv6
  dual-stack, NetBox import bundle.


## SESSION CLOSE 2026-07-18 -- grounding audit (Phases 1-4); GA-R4 bounded summary

- Audit Phases 1-4 COMPLETE, each externally reviewed; FULL FREEZE upheld (zero pre-audit surfaces edited).
- Phase 1: record-audit extractor + inventory (12 contradiction groups); outer plan CAPTURED 7/2/7; GA-F01..F15.
- Phase 2: docs/CURRENT-STATE.md authored -- the single status authority; operator SIGNED (G11, section 11).
- Phase 3: fresh-agent grounding test, 3 probes 21/21 PASS; hole H1 amended into the G9 row.
- Phase 4: GA-R1..R7 + stage-status vocabulary (Option A + H1) ALL RATIFIED, utterances quoted (docs/audit/ga-rulings.md).
- Phase 5 NOT opened: sweep plan DRAFTED (docs/audit/phase5-sweep-plan.md, commit 687dfa8) awaiting external review.
- DC0 apply remains STOPPED (G9); D-130 unruled; expected plan triple UNRESOLVED (CURRENT-STATE section 5).
- Next session: FRESH operator session, auto-memory ON (GA-R7 rule 8); read sweep plan + CURRENT-STATE.md first.
- Status lives ONLY in CURRENT-STATE.md (GA-R1); this entry is narrative + pointers, not status.
- Full session body: docs/archive/session-20260718-grounding-audit.md (GA-R4 rules 1-2, first live compliance run).
- GA-R4 F1 cap (<300 lines) not yet enforceable: the one-time rotation is Phase-5 Batch 4 (rule 6) -- noted, not skipped.
- POST-CLOSE ADDENDUM (2026-07-19): sweep plan externally reviewed PASS; amendments S1-S5 applied in
  a single commit (15ccfbd). Batch 0 was PRESENTED and HELD -- operator routed execution to the fresh
  session. Fresh session: read docs/audit/phase5-sweep-plan.md + docs/CURRENT-STATE.md, then gate Batch 0.

## SESSION CLOSE 2026-07-19 -- GA Phase-5 sweep (Batches 0-6) + AUDIT EXIT (bounded, GA-R4)

- All six sweep batches executed + closed in ONE session under per-batch operator gates.
- Tooling: L10 status-coupling lint (WARN->FAIL), SEC pointer+count scan, wrap-aware counters,
  vocab-keyed extractor + archive exclusion (operator-ruled). Gauntlet grew 69 -> 70 harnesses.
- D-130 ADOPTED (a) + implemented + v7/v8-verified; G6 state surgery (operator-ruled); expected
  triple 6/0/6 recorded and re-verified twice (postG6 + phase6-exit captures).
- Record fixes GA-F02..F05/F10..F12/F14..F16; H1 token migration; E1 gate-type tags; ARCH/OPS
  D-tags + D-129 split (operator-ruled); R3-F register fully dispositioned (S1).
- Memory hygiene per provenance rulings (2 files removed, GA-F16 found+fixed); ledger rotated
  1187->131; 96 changelogs + 25 docs consolidated to archive; top-level docs/ = 16.
- Skill swept against ratified GA-R1..R7 (checklist committed). Exit runs 1-6 ALL PASS incl.
  fresh probe trio 21/21 (7/7 on all three); operator RE-SIGNED CURRENT-STATE 2026-07-19.
- AUDIT EXITED: G3 + G11 CLOSED, FREEZE lifted, G9 OPEN (gated logged apply, G8 first).
- Full body: docs/archive/session-20260719-phase5-sweep.md. Status lives ONLY in CURRENT-STATE.md.

## SESSION 2026-07-19 (continued) -- DC0 deploy, step A (logged: dc0-deploy)

- Same session continued past the audit close at operator direction (skill re-invoked; fresh-session
  hygiene noted and waived by the operator's go).
- G8 passed in-session; validate PASS; pre-apply capture == 6/0/6; saved plan applied: 6/0/6 exact.
- vvr1-dc0 RUNNING (108 vCPU / 416 GiB / autostart off); guests untouched; convergence = no diff.
- Next: step B (bootstrap vvr1-dc0: site-headend-install --role rack --host-nodes + SEC-010 check,
  OPNsense base prep ON the VM) -- needs transit reachability + the dc0 key (D-126 DC rows).
- PAUSED at the A/B boundary (2026-07-19): operator moving to a fresh session. Step B's measured
  starting facts: vvr1-dc0 NICs = mesh-vr1-dc0-office1 + vr1-dc0-uplink (NO transit NIC yet --
  measure how reach works before wiring ssh; D-124 tfvars local+present; dc0 key minted).
  Fresh session: CURRENT-STATE first, then resume at runbook step B in the dc0-deploy logged window
  (same-day log appends).
