# Session ledger -- in-flight work continuity record

**Purpose.** Long ops sessions on this cloud routinely exceed a single context window
and get COMPACTED (sometimes several times). Anything living only in the chat scrollback
is lost at compaction. This ledger is the durable, committed record of what is IN FLIGHT,
so any session -- after a compaction, or a fresh one -- can resume without losing pending work.

**How to use it (standing practice).**
1. At session start: read this ledger AND run `bash scripts/ledger-scan.sh`. Reconcile.
2. `ledger-scan.sh` is the DRIFT CHECK -- it derives the open-work it reliably can
   (PROPOSED/OPEN decisions, OPEN security rows, next-free numbers) straight from the repo.
   This narrative must not claim CLOSED anything the scan shows OPEN, nor omit what it surfaces.
3. Update this ledger at every deliverable/commit -- it is a standing deliverable like the
   changelog. The changelog says what CHANGED; this ledger says what is still OPEN.
4. The machine-derived block below is seeded from a scan; re-run the scan and re-seed rather
   than editing it by hand.

**SINGLE STREAM (collapsed 2026-07-13).** This ledger previously carried three parallel,
separately-owned stream sections (`main-chat`, `jumphost`, `shared`) plus ~30 append-only
session narratives. Those streams are CLOSED and reconciled into the one list below. There is
now ONE stream. Do not re-introduce per-stream sections.

**Where the history went.** The 2,189-line session-by-session narrative is NOT lost -- it is in
git history (the parent of the collapse commit) and, in durable form, in the 65 `docs/changelog-*.md`
files, `docs/design-decisions.md`, and the incident reports. This ledger deliberately carries only
what is still OPEN, plus the facts that would otherwise be lost because they live nowhere else.

---

<!-- SECTION: machine-derived | OWNER: ledger-scan (regenerate; never hand-edit) -->
## Machine-derived (re-seed from `scripts/ledger-scan.sh`; do not hand-edit)

_Re-seeded from a 2026-07-25 scan (SEC-020 session; the prior seeding was the 2026-07-23 close and
had gone stale on every line -- counts and next-free both). Re-run `bash scripts/ledger-scan.sh` to refresh._

- **PROPOSED / OPEN decisions (4):** D-068 (Vault substrate hardening, Roosevelt -- sole remainder
  is Q2 path selection at Roosevelt Vault design time), D-131 (node-facing DNS strategy for
  rack-only controllers [ARCH] -- PARTIALLY RULED: sub-1 ruled + delivered 2026-07-21, sub-2 ruled
  2026-07-21 (metal-admin only), sub-3 resolved 2026-07-21 (no defect), sub-4 open + pinned DNS
  architectural review), D-132 (Roosevelt per-DC MAAS topology [ARCH] -- PROPOSED 2026-07-21,
  operator-pinned to the next deployment), D-136 (NetBox-coupled per-DC render pipeline for bundle
  overlays and tfvars [ARCH] -- PROPOSED 2026-07-25 in Chat, non-gating for the dc1 deploy).
  D-071, D-129 and now D-137 (ADOPTED 2026-07-26, all five sub-rulings ruled) are
  ADOPTED/RESOLVED and correctly drop off the scan.
  Status lines in `docs/design-decisions.md` are the only ruling authority.
- **OPEN security rows:** 19 open per `bash scripts/ledger-scan.sh` (re-seeded 2026-07-25). Since the
  last seeding this went 12 -> 19: SEC-017 (caveman plugin supply-chain re-verify), SEC-018/-019
  (per-DC MAAS API keys for the Juju cloud credentials), SEC-020 (MAAS region superuser passwords --
  the `admin` un-consolidation + the new `operator` human GUI identity), and SEC-021/-022/-023
  (2026-07-25 D-137 credential research: dc0 custody defects, unaudited shadow `*-creds/` stores on
  voffice1, sprawl-glob blind spots + a predicted Stage-5 `~/admin-openrc` exposure). The SEC register of record
  is `docs/security-ledger.md`; row-level dispositions live THERE only (GA-R4 amendment F3) --
  this block carries pointer + count, never rows. The CURRENT-STATE G14 evidence cell was
  RECONCILED to 19 in the same commit as SEC-021/-023 (its title text keeps the 07-23 figure).
- **Next-free numbers:** D = **137**, DOCFIX = **204**, BUNDLEFIX = 053.
- **Standing numbering rule:** never write an identifier-shaped token (D-/DOCFIX-/BUNDLEFIX-NNN)
  ABOVE the real high-water mark anywhere in `docs/` or `runbooks/` prose -- historically a decoy
  token in prose inflated the next-free counter (hardened in DOCFIX-174); the authoring discipline
  stands regardless.
- **`ledger-scan` D-115 false-positive: RESOLVED.** The scan now keys on the LAST `**Status:**`
  line per `## D-NNN:` block (see `scripts/ledger-scan.sh` awk), not arbitrary body prose, so D-115
  (ADOPTED) no longer shows as PROPOSED/OPEN. The general hygiene -- trust the Status line over body
  text -- still holds.

<!-- END: machine-derived -->

---

## ROTATED 2026-07-19 (GA-R4 rule 6 -- the one-time rotation; F1 cap now enforceable)

The pre-rotation bodies (~1080 lines: Live state, OPEN WORK VR1/VR0, NetBox
write-path bugs, PINNED rulings, standing lessons, state facts, project-
completion, NetBox import narrative) moved VERBATIM to
`docs/archive/session-ledger-rotated-20260719.md`. Standing lessons + VR0
state facts were ROUTED to durable homes first (platform-traps already
carried most; juju format=line -> appendix-A; guard discipline ->
operating-discipline; VR0 cloud facts -> maas-as-built-reference.md).
Open work is machine-derived above + CURRENT-STATE.md; do not re-grow
bodies here -- sessions append BOUNDED summaries only (15-line cap).

Retained compact blocks (still-live obligations without another home yet):
- **NetBox write-path bugs:** ROUTED 2026-07-23 to
  `docs/netbox-write-path-findings.md` (the durable home; the rotated-body
  section is history). Open residue: dumper blind spot + duplicate-CIDR
  collapse unfixed, hardened fidelity re-run + fix re-verification owed --
  ALL gated on the next NetBox WRITE campaign, none current.
- **Project-completion (after D-011 passes):** consolidate the 10 per-phase
  do-documents into a v1 deploy runbook; flip repo PRIVATE (SEC-004);
  revoke/rotate SEC-005/006/007; v2-deferred: GitBucket SSH, IPv6
  dual-stack, NetBox import bundle.
- **Deployment-close consideration review -- tenant-onboarding items (PINNED
  2026-07-21, operator-directed):** the committee review of Chat's three
  tenant-onboarding inserts refuted each as written but identified corrected
  residue; the operator DEFERRED all of it to an end-of-deployment review
  (posture and end goals are shifting this deployment -- reconsider fit then;
  nothing lands before that review). Items: (1) appendix-A symptom entry for
  sub-floor OR nonexistent flavor -> cluster-create rejection (capi-helm
  thresholds are CONFIG OPTIONS, defaults 2 vCPU / 2048 MB RAM, as-built sets
  neither; the RAM error also fires for mistyped flavors; command shape
  `--public -f json`, never the deprecated `--long` -- archive R9); (2)
  appendix-A entry for tenant-net-cannot-reach-public-keystone -> nodes
  register but stall uninitialized (auth_url in the per-cluster clouds secret
  is hardcoded PUBLIC at capi-helm 1.4.0; as-built carries no interface key),
  pointing at the phase-08 D-011.3 probe, plus a per-DC precondition line in
  dc-dc-phase6 Step 12; (3) tenant contract hardening list: PROPOSED
  `-svc`-only password neutralization (admin-rotate to discarded value;
  keystone `lock_password` blocks password CHANGE, not auth; NEVER lock
  `-cluster` -- it keeps PASSWORD auth permanently per D-066); (4) flavor
  catalog marking = commercial catalog policy, operator prioritization only.
  RE-VERIFY every citation at review time -- the full verdict lives in the
  2026-07-21 disconnected-session transcript, not in a repo surface.


## SESSION CLOSE 2026-07-18 -- grounding audit (Phases 1-4); GA-R4 bounded summary

- Audit Phases 1-4 COMPLETE, each externally reviewed; FULL FREEZE upheld (zero pre-audit surfaces edited).
- Phase 1: record-audit extractor + inventory (12 contradiction groups); outer plan CAPTURED 7/2/7; GA-F01..F15.
- Phase 2: docs/CURRENT-STATE.md authored -- the single status authority; operator SIGNED (G11, section 11).
- Phase 3: fresh-agent grounding test, 3 probes 21/21 PASS; hole H1 amended into the G9 row.
- Phase 4: GA-R1..R7 + stage-status vocabulary (Option A + H1) ALL RATIFIED, utterances quoted (docs/audit/ga-rulings.md).
- Phase 5 NOT opened: sweep plan DRAFTED (docs/audit/phase5-sweep-plan.md, commit 687dfa8) awaiting external review.
- DC0 apply remains STOPPED (G9); D-130 unruled; expected plan triple UNRESOLVED (CURRENT-STATE section 5).
- Next session: FRESH operator session, auto-memory ON (GA-R7 rule 8); read sweep plan + CURRENT-STATE.md first.
- Status lives ONLY in CURRENT-STATE.md (GA-R1); this entry is narrative + pointers, not status.
- Full session body: docs/archive/session-20260718-grounding-audit.md (GA-R4 rules 1-2, first live compliance run).
- GA-R4 F1 cap (<300 lines) not yet enforceable: the one-time rotation is Phase-5 Batch 4 (rule 6) -- noted, not skipped.
- POST-CLOSE ADDENDUM (2026-07-19): sweep plan externally reviewed PASS; amendments S1-S5 applied in
  a single commit (15ccfbd). Batch 0 was PRESENTED and HELD -- operator routed execution to the fresh
  session. Fresh session: read docs/audit/phase5-sweep-plan.md + docs/CURRENT-STATE.md, then gate Batch 0.

## SESSION CLOSE 2026-07-19 -- GA Phase-5 sweep (Batches 0-6) + AUDIT EXIT (bounded, GA-R4)

- All six sweep batches executed + closed in ONE session under per-batch operator gates.
- Tooling: L10 status-coupling lint (WARN->FAIL), SEC pointer+count scan, wrap-aware counters,
  vocab-keyed extractor + archive exclusion (operator-ruled). Gauntlet grew 69 -> 70 harnesses.
- D-130 ADOPTED (a) + implemented + v7/v8-verified; G6 state surgery (operator-ruled); expected
  triple 6/0/6 recorded and re-verified twice (postG6 + phase6-exit captures).
- Record fixes GA-F02..F05/F10..F12/F14..F16; H1 token migration; E1 gate-type tags; ARCH/OPS
  D-tags + D-129 split (operator-ruled); R3-F register fully dispositioned (S1).
- Memory hygiene per provenance rulings (2 files removed, GA-F16 found+fixed); ledger rotated
  1187->131; 96 changelogs + 25 docs consolidated to archive; top-level docs/ = 16.
- Skill swept against ratified GA-R1..R7 (checklist committed). Exit runs 1-6 ALL PASS incl.
  fresh probe trio 21/21 (7/7 on all three); operator RE-SIGNED CURRENT-STATE 2026-07-19.
- AUDIT EXITED: G3 + G11 CLOSED, FREEZE lifted, G9 OPEN (gated logged apply, G8 first).
- Full body: docs/archive/session-20260719-phase5-sweep.md. Status lives ONLY in CURRENT-STATE.md.

## SESSION 2026-07-19 (continued) -- DC0 deploy, step A (logged: dc0-deploy)

- Same session continued past the audit close at operator direction (skill re-invoked; fresh-session
  hygiene noted and waived by the operator's go).
- G8 passed in-session; validate PASS; pre-apply capture == 6/0/6; saved plan applied: 6/0/6 exact.
- vvr1-dc0 RUNNING (108 vCPU / 416 GiB / autostart off); guests untouched; convergence = no diff.
- Next: step B (bootstrap vvr1-dc0: site-headend-install --role rack --host-nodes + SEC-010 check,
  OPNsense base prep ON the VM) -- needs transit reachability + the dc0 key (D-126 DC rows).
- PAUSED at the A/B boundary (2026-07-19): operator moving to a fresh session. Step B's measured
  starting facts: vvr1-dc0 NICs = mesh-vr1-dc0-office1 + vr1-dc0-uplink (NO transit NIC yet --
  measure how reach works before wiring ssh; D-124 tfvars local+present; dc0 key minted).
  Fresh session: CURRENT-STATE first, then resume at runbook step B in the dc0-deploy logged window
  (same-day log appends).

## SESSION CLOSE 2026-07-21 -- commissioning diagnosis + repair (logged: ops-commissioning-diag; bounded, GA-R4)

- Session DISCONNECTED before its bookend; entry landed same-day by the successor session after
  read-only re-verification (9/9 Ready, forwarder active+enabled, dhcpd both controllers).
- G10 commissioning RESOLVED: ALL 9 DC0 nodes Ready, shapes exact to D-121 Option C.
- Two stacked faults, both measured: (1) the 2026-07-20 in-place apply regenerated all 9 node NIC
  MACs -- MAAS records repaired in place (operator-ruled), read-back 9/9; (2) MAAS 3.7 rack-only
  agent resolver SERVFAILs everything on an internet-isolated rack -- dc0-node-dns dnsmasq
  forwarder workaround (operator-ruled), live and proven (canary Ready ~3 min). LP report queued.
- D-131 PROPOSED (rack-only node DNS, Roosevelt-relevant); SEC-014 OPENED (rack cluster secret
  exposure); committee record closed by addendum. Phase-7 tag cleanup verified done.
- QUEUED delivery: node-vm MAC pinning + harness; forwarder + rack-legs repo persistence;
  platform-traps + appendix-A entries; stale-pod cleanup at stage close (with SEC-013).
- REMAINING in G10: netem step E only (netem-link passwordless-sudo blocker).
- Details: docs/changelog-20260721-commissioning-diag.md + docs/audit/commissioning-diag-20260721.txt.
  Status lives ONLY in CURRENT-STATE.md.

## SESSION CLOSE 2026-07-21 -- close-and-delivery session (bounded, GA-R4)

- Session DISCONNECTED before its bookend (second same-day disconnect); all seven deliverable
  commits were already pushed (8b3adb3..8a9c04c), so only this entry + the netem-install record
  were outstanding. Landed by the successor session after read-only re-verification.
- Delivered: predecessor (ops-commissioning-diag) close landed; node-vm MAC pinning (54 measured
  pins) + power-ownership guard ruled and APPLIED on voffice1 (0/9/0 exact, converged zero diff);
  D-131 sub-1 RULED + dc-rack-net.sh shipped AND installed on the rack (check 10/10, SOA probe);
  incident docs (appendix-A x2, platform-traps 1e corollary, LP draft -- operator to file);
  step-E netem sudo RULED (scoped NOPASSWD) + fragment shipped (gauntlet 75 ALL GREEN).
- Post-disconnect: operator ran the netem-tc install interactively; successor VERIFIED read-only
  (0440 root:root, byte-identical, sudo -n -l grant checks exit 0 --
  docs/audit/netem-sudo-install-20260721.txt). Step E is now UNBLOCKED (gated run pending).
- Details: docs/archive/changelogs/changelog-20260721-close-and-delivery.md. Status lives ONLY in CURRENT-STATE.md.

## SESSION CLOSE 2026-07-21 -- STAGE 3 CLOSED + MERGED (third session; bounded, GA-R4)

- Bookend landed at stage close while the session may continue (two same-day disconnects argued
  for durable-early); any further work appends a POST-CLOSE ADDENDUM (07-18 precedent).
- Step E netem DONE (targeted apply at an operator-ruled 1/1/0 STOP; placeholder live on virbr5)
  -> G10 CLOSED. G16 opened for the office1 channels residual, then CLOSED same-day
  (operator-ruled state surgery; outer plan back to ZERO DIFF).
- Ruling 1 retire-fully EXECUTED: vr1-dc0-maas removed, stale pod + SEC-013 key file + tfstate
  deleted. INCIDENT: the pod delete cascaded to the 9 machine records (association check ran
  post-delete -- owned); recovered same-hour via re-enlist/power/commission, 9/9 Ready, shapes
  exact, NEW MAAS hostnames. Appendix-A entry shipped (check pod machine list BEFORE delete).
- Also: ledger-scan PARTIAL fix, DOCFIX-197, D-103/D-123 amendments, GA-R7 memory review.
- STAGE 3 CLOSED (operator-ruled): consolidation + skill sweep + gauntlet 76 ALL GREEN; merge
  commit 8d0d155 on main; branch retired local+remote. Next stage branches off main.
- Open queue unchanged: D-131 sub-2..4, SEC-014 rotation, D-068/D-071/D-129, G12 (dc1), G15.
- Details: docs/archive/changelogs/changelog-20260721-netem-install-verify.md (archived at the
  successor's bookend). Status lives ONLY in CURRENT-STATE.md.

## SESSION CLOSE 2026-07-21 -- queue-pass session (fourth same-day; bounded, GA-R4)

- Recovered the predecessor's undelivered committee verdict from its transcript; the
  tenant-onboarding items are PINNED to a deployment-close consideration review (operator-directed;
  self-contained block in the retained section above).
- Queue pass, one GA-R5 ruling per exchange, each committed+pushed: D-131 sub-2 ruled
  (metal-admin-only) + sub-3 RESOLVED by measurement (no dhcpd option-6 defect; stale read;
  operator-run capture); D-129 subs (i)-(iv) ALL RULED -- decision-complete, G13 execution-only;
  D-071 ADOPTED (all four points); D-068 items 2-3 RULED; D-100 netem placeholder CONFIRMED.
- Filed/pinned: D-132 PROPOSED (per-DC MAAS topology, operator verbatim); DNS architectural
  review pinned to D-131 sub-4. Delivered: cloud-assert A9 vault-kv AppRole probe
  (harness 15/15; gauntlet 76 ALL GREEN).
- G12 [R] leg CLOSED: vr1-dc1 addressing RATIFIED (D-124 amendment; apex confirm-free at
  authoring). Remaining [V]: vars + substrate root + build.
- Open after this session: D-068 item 1 (draft), D-131 sub-4 (LP + pinned review), D-132
  (pinned), G12 [V], G13 execution, 10 SEC rows, LP filing (operator).
- Details: docs/archive/changelogs/changelog-20260721-tenant-review-pin.md. Status lives ONLY
  in CURRENT-STATE.md.

## SESSION CLOSE 2026-07-21 -- G12 dc1-authoring session (fifth same-day; bounded, GA-R4)

- Session DISCONNECTED before its bookend; entry landed by the successor session 2026-07-22
  after read-only re-verification (tree, branch, harnesses). No cloud state was touched.
- Delivered pre-drop (commit cbc1104 on branch dc-dc-g12-dc1-substrate -- branch UNPUSHED at
  the drop): dc1 apex confirm-free capture (transit /30 + rack 10.12.68.2 FREE, planes already
  consistent) + dc-rack-mgmt-import per-site --site support (117/117; live dry-run PASS).
- INTERRUPTED mid-item-3, authored UNCOMMITTED in tree: vr1_dc1 vars + vvr1-dc1 module +
  vr1-dc1-uplink, inner root opentofu/vr1-dc1-substrate/ (54 MACs pre-pinned 52:54:01:d1),
  lib-net.sh dc1 arm + selection guard, dc-selector 40/40. Drop point: BEFORE the gauntlet --
  successor run = 6/76 FAILED, six harnesses still assert the retired vr1-dc1 fail-loud arm
  (docs/audit/gauntlet-20260722-g12-dropstate.txt). Owed: reconcile -> ALL GREEN -> delivery
  entry -> commit+push; THEN the operator-gated apex --commit stays G12's next gated step.
- Details: docs/changelog-20260721-g12-dc1-authoring.md (item 3 = drop-state record). Status
  lives ONLY in CURRENT-STATE.md.

## SESSION CLOSE 2026-07-22 -- G12 dc1 build session (bounded, GA-R4)

- Opened from the drop-state; predecessor's owed reconcile DELIVERED (six harnesses + two sighted
  surfaces; gauntlet 76 ALL GREEN; landed as authoring-changelog item 4). Duplicate idle Claude
  session checked at operator request -- already exited, nothing culled.
- G12 [V] leg executed through the D-125 gate, every mutation operator-gated, all pushed:
  apex --commit (transit /30 + rack IP, read-back idempotent); dc1 svc key minted (audit CLEAN);
  outer step A 5/0/0 exact; cloudinit-vm interface_macs shipped + voffice1 dc1-transit NIC 0/2/0
  (full MAC pins, post-bounce battery ALL PASS); transit .5<->.6 live; rack ENROLLED (nmpcq4) with
  SEC-010 both ends + 26.7 base (hash-verified dc0 copy); inner step C 28/28 from voffice1 (one
  fix-forward: serial-staging dir), 10/10 domains RUNNING, edge at the 26.7 login prompt; D-125
  egress gate PASS (two identical runs). Queued findings: changelog items 7/9 (four tool gaps).
- NEXT session: edge bootstrap (D-112(c) driver rebuild -- v6 + five measured lessons at
  changelog-20260719-dc0-deploy-stepB.md:241-260; edge keypair mint first) -> API key -> v4
  addressing -> rack standup DoD -> commissioning 9/9 -> G12 close-out; operator-gated merge to
  main is the hard new-session gate after that.
- Details: docs/changelog-20260722-g12-dc1-build.md (items 1-10). Status lives ONLY in CURRENT-STATE.md.

## SESSION CLOSE 2026-07-23 -- G12 dc1 edge->commission + CLOSE + MERGE (bounded, GA-R4)

- Resumed from the 07-22 handoff (edge at login prompt); drove dc1 to a commissioned fleet,
  every mutation operator-gated in `manual` permission mode (auto-mode classifier blocks
  remote sudo shapes instead of prompting -- manual mode is the fix; noted).
- Edge: D-112(c) console bootstrap (payload needed util.inc/shell_safe -- dc0 lesson iv the
  .b64 lacked) + key auth + D-113(a2) API mint (transient post-restart-sshd scp, ssh-pipe
  workaround) + v4 addressing WAN 172.30.3.2 / LAN 10.12.64.1 (egress 0%).
- dc-rack-net dc1 arm (harness 18/18) + install (forwarder answers maas-internal); region MAAS
  D-120 range + D-131 dns + DHCP primary_rack=nmpcq4 (dhcpd verified running).
- SEC-016 RULED "Mint a dedicated dc1 power key" (per-DC isolation) + wired (script=svc key,
  MAAS snap=dedicated key). Commissioning ALL 9 READY ~3.5 min, shapes exact D-121 Option C --
  dc0's two stacked faults pre-empted by pinned MACs + forwarder.
- G12 CLOSED: gauntlet 76 GREEN, repo-lint 0-fail, consolidation + skill sweep (per-DC power
  key invariant) + GA-R7 memory review; MERGED to main (merge commit a5c0a49), branch retired.
- Open after: SEC 12 rows (incl. SEC-015/-016); 3 findings (util.inc, scp readiness, snap-key
  refresh fragility); D-068 item1, D-131 sub-4, D-132 pinned. Next stage branches off main.
- Full body: docs/archive/changelogs/changelog-20260723-g12-dc1-edge.md. Status ONLY in CURRENT-STATE.md.

## SESSION CLOSE 2026-07-23 -- Stage 4 OPEN + carve + mirrors (bounded, GA-R4)

- Stage 4 OPENED (branch dc-dc-stage4-phase3-maas-deploy); discovery captured; D-133
  (flat per-NIC carve; hw-faithful NICs next deployment) + D-134 (+amendment: contiguous
  bands, Option B swap) ADOPTED, utterances quoted.
- CARVE EXECUTED both DCs (logged stage4-carve): ranges .201-.254, 10 fabrics, 90 NIC
  re-homes, subnets+spaces, 18 nodes statics + br-ex; all Ready; capture committed.
- Deploy model RULED: Ready handoff (DOCFIX-200 -- runbook Step 4 would have broken
  Stage 5); jammy images synced; per-DC tags applied 9+9.
- Mirror: exception REJECTED -> D-135 ADOPTED; dc-mirror.sh shipped (19/19, gauntlet 77);
  INSTALLED both racks; initial syncs RUNNING at last check (hours; verify
  last-sync.status before citing). INCIDENT: dc1 edge pf never regenerated post-
  addressing -- filter reload fixed; appendix-A + DoD + script amendment QUEUED.
- OWNED: pipe-masked L10 lint FAIL (repaired); dc0-only egress probe wrongly assumed
  symmetric (item 9).
- Delivery batch LANDED before close (item 11): lib-hosts VR1 arms populated (tofu-name
  keys, pinned MACs, D-134 octets, host_sysid_by_bootmac) + D-133 guards in the two VR0
  flow scripts + appendix-A pf entry + DoD items 8-9 + item-4 range fix; dc-selector 48,
  gauntlet 77 GREEN. At close: both syncs RUNNING (dc0 13G / dc1 15G pulled).
- OPEN in-stage for the NEXT session: verify last-sync.status OK both racks (this
  session's watcher dies with it -- check at open); mirror node-side reachability gate;
  set-interface-v4 reload amendment (queued OPTION, unruled); local permission-rules
  prune (`Bash(ssh *)` flag); then the stage close-out set (consolidation, skill sweep,
  GA-R7 memory review, final gauntlet, operator-gated merge).
- Details: docs/changelog-20260723-stage4-open.md. Status ONLY in CURRENT-STATE.md.

## SESSION CLOSE 2026-07-23 -- queue pass + D-068 rulings (bounded, GA-R4)

- Queue fully processed. Repo: 5 script/harness fixes (prep-image bash -s; headend hints +
  idempotent sec010 nft + staging dir; apikey readiness/retry) + DOCFIX-198 (Steps 9-10
  superseded; DC standup DoD) + DOCFIX-199 (D-112(c) payload spec). Gauntlet 76 ALL GREEN.
- Live (logged ops-sec010-reassert, all operator-approved): SEC-010 files idempotent on all
  3 hosts (double-restart proof); G13 CLOSED -- office1 qga channel 0/1/0 saved-plan apply
  (guest-ping proven), edge 26.7 -> 26.7.1, os-iperf in after a measured refusal; outer plan
  re-converged zero diff. vr1-dc0-maas cache residue deleted (association-checked FIRST).
- D-068 item 1: plan DRAFTED then Q1 (rehearsal EOL acceptance, 1b), Q2 STRUCTURE (Roosevelt
  on 1.8 + funded remediation track), Q3 (monthly checks -> ops-update-procedure 0c) ALL
  RULED -- individually confirmed after a volunteered batch answer (GA-R5 kept). Remainder:
  Q2 path at Roosevelt design time. NetBox residue -> docs/netbox-write-path-findings.md.
- Owned: one capture commit pushed with a pipe-masked L10 lint FAIL; repaired same-hour.
- GA-R7 memory review: no changes. AT CLOSE: ledger-scan FALSE-CLOSE defect found (tail-appended
  detached amendments hijack the preceding decision's last-status -- D-132 dropped); FIXED
  number-keyed + regression cases (48/48), scan re-verified, machine block re-seeded.
- Details: docs/archive/changelogs/changelog-20260723-queue-pass.md. Status ONLY in CURRENT-STATE.md.

## SESSION CLOSE 2026-07-24 -- caveman guardrails + DC1 proxy-build start (bounded, GA-R4)

- caveman plugin DISABLED (enabled:false both scopes) + SEC-017 + guardrails (repo-lint L11
  *.original.md detector; deny compress; CLAUDE.md norm). commits up to 338c919..d0db020.
- DC-mirror: DC0 full mirror still syncing; DC1 debmirror PAUSED ~330G (bandwidth NOT the
  bottleneck, measured) + switched to an INTERIM apt caching proxy (D-135 AMENDED 2026-07-24):
  scripts/dc-cache-proxy.sh shipped + INSTALLED on dc1 (serves archive+UCA 200). Two per-DC
  Stage-5 test methods (dc0 full-mirror / dc1 proxy) = gates on ONE branch, not sub-branches.
- DC1 Stage-5 deploy STARTED: per-DC MAAS creds (SEC-018/-019); Juju 3.6.25 on voffice1
  (headend, D-128); add-cloud vr1-maas + add-credential both DCs; VIP overlay
  overlays/vr1-dc1-vips.yaml; phase-4 Step 2.0 (MAAS-cred task) added. commits ..116e9b2.
- **BLOCKED before bootstrap (committee-reviewed):** committed bundle.yaml is still VR0 4-node
  HYPERCONVERGED; VR1 dc1 is 9 ROLE-SEPARATED (D-121 Option C). Architecture DECIDED, deploy
  ARTIFACTS not rendered (dc-ha-scaleup.yaml partial/unrendered/dc0-named/stale/unwired; tag/
  placement/num_units unhandled; phase-4 runbook stale). DNS confirmed GREEN for bootstrap
  (D-131 forwarder resolves external; hang can't recur) -- but bootstrap needs edge egress OPEN
  (juju agents/snaps unmirrored); do NOT narrow egress until after bootstrap.
- OWNED: I fabricated a "D-193" reference in analysis (cardinal sin) -- corrected to D-121;
  verified NOT persisted to repo. NEXT SESSION: render vr1-dc1 role-separated HA bundle +
  wire overlays + de-stale phase-4, THEN bootstrap. Full detail: CURRENT-STATE Stage-4 bullet.
- Status ONLY in CURRENT-STATE.md. Changelog: docs/changelog-20260724-caveman-disable.md.

## SESSION CLOSE 2026-07-25 -- handoff-pack execution + recon + Chat D-136 coupling (bounded, GA-R4)
- ~~**IMMEDIATE NEXT (do FIRST):** MAAS WEB-GUI login does NOT exist -- SEC-018/019 are API/Juju-only
  keys; the juju-vr1-dc0/dc1 superusers have RANDOM UNSTORED passwords, so the operator is locked
  out of the MAAS webpage (never minted; no prior task did it). Fix, operator-run on voffice1:
  `sudo maas createadmin --username=<you> --email=<you>` (or `maas changepassword <user>`); +SEC row.~~
  **-> FALSIFIED + RESOLVED 2026-07-25 (SEC-020).** The premise was wrong: GUI login DID exist. The
  `admin` superuser's password was minted 2026-07-13 by `site-headend-install.sh:452` and MEASURED
  working this session (login 204 with the stored value vs 400 wrong-password control) -- it was
  merely root-only on voffice1 and un-consolidated (the SEC-009 miss class, not a missing account).
  Only the two `juju-*` clause was correct. DONE under operator-ruled scope "New account +
  consolidate only": `admin` password consolidated byte-identical to `~/vr1-office1-creds/`
  (VM copy stays source-of-record, NOT rotated); NEW `operator` superuser minted for human GUI
  login (stdin, never argv); dc0/dc1 manifest backfill -> `creds-audit` CLEAN all three sites.
  The `juju-vr1-dc0/dc1` passwords remain random+unstored BY RULING -- their API keys are
  load-bearing for the blocked Stage-5 bootstrap, and `operator` removes any need to log in as them.
- RECORD PHASE DONE + pushed (thru 87cec53): Rulings 1/2/3 (GA-R5 verbatim), D-136 PROPOSED (NetBox
  render pipeline, opt C, non-gating), DOCFIX-201 (D-020 not D-036, 7 sites)/-202/-203; pack-review
  committee + Chat open-Q5 (Jenkins IS the runner) folded in. DC0 mirror COMPLETE (949G+342M). lint 0.
- GATED EXECUTION pending (each gated): verify MAAS role tags LIVE (deploy-blocking) -> 10th
  controller VM -> dc0 VIP extract (2 commits) -> vault-VIP repair (BLOCKER-1/2 + VIP_OCTET_MAX) ->
  DC-aware gates -> bootstrap. KEEP _handoff-not-committed/ (item 60 vault values not yet consumed).
- Open sub-rulings: octavia family, reserved-range registry, vault-vip-derivation file. Deferred:
  CURRENT-STATE s4 stale-HIGH, G14 SEC 12->15, phase-4 designate. Chat skill pkg:
  .claude/skills/openstack-cloud-ops-consolidated-20260725.md. Detail: changelog items 1-17.

## SESSION CLOSE 2026-07-25 -- MAAS admin-account recovery (SEC-020; bounded, GA-R4)
- **PREMISE FALSIFIED before any mutation:** MAAS GUI login DID exist -- `admin` pw minted
  2026-07-13 by site-headend-install.sh:452, MEASURED working (204 vs 400 wrong-pw control).
  Defect was root-only + un-consolidated on voffice1 (SEC-009 class), NOT a missing account.
- Scope RE-RULED by operator: "New account + consolidate only" -- no existing password rotated.
- DONE: `operator` superuser minted (pw via stdin, never argv); `admin` pw consolidated
  byte-identical to ~/vr1-office1-creds/ (**VM copy stays source-of-record**); dc0/dc1 manifest
  backfill -> creds-audit CLEAN x3; README index lists both. juju-* UNTOUCHED by ruling (their
  SEC-018/019 keys gate the blocked Stage-5 bootstrap). SEC-020 opened (open rows 15->16);
  falsified IMMEDIATE NEXT struck; machine-derived block re-seeded.
- OWNED: called a login probe read-only; it authenticated, writing last_login twice (benign).
- LOGGED not executed: headend-install consolidate-at-mint; conflation proposable as next-free D
  [ARCH]; 3 /root secrets unmoved. **GA-R4 F1: ledger 370 lines at OPEN vs 300 cap -- rotation OWED.**
- Gauntlet 79 GREEN, repo-lint 0-fail, b2b0c80 pushed. Bookend EARLY (07-21 precedent); further
  work appends a POST-CLOSE ADDENDUM. Details: docs/changelog-20260725-maas-admin-recovery.md.

## POST-CLOSE ADDENDUM 2026-07-26 -- D-137 ADOPTED (GA-R4; 07-18/07-21 addendum precedent)
- The 2026-07-25 close bookend landed early by design; this addendum records the work that
  followed it rather than re-opening the entry.
- Operator asked for a better mint/save method + "a durable rule ... so credentials aren't
  misplaced or lost". Committee review (5 lenses) run; the operator's own insight drove the
  design: a discovery sweep can NEVER detect a credential that was never minted -- absence
  is invisible to discovery -- so an expected-state credential MATRIX is the missing half.
- **D-137 ADOPTED 2026-07-26**, all five sub-rulings RULED individually (GA-R5, each pushed
  before the next was asked): enforcement = blocking in preflight; manifests DERIVED from
  the matrix; --remote bounded to declared locations; D-137 is the policy authority
  (SEC-009 demotes to a pointer); identity conflation FOLDED IN as the one-identity-one-
  principal invariant. Implementation UNBLOCKED, not started.
- Research: 3 read-only agents. Capture `docs/audit/creds-creation-points-20260725.md` --
  55 MINT sites, and **12 declared secrets have NO mint command anywhere** (`ssh-keygen`
  = ZERO hits repo-wide), plus three credential dirs outside the SEC-009 convention.
- **SEC-021/-022/-023 OPENED** (rows 16 -> 19): a consolidated dc0 credential ABSENT from
  its recorded location; two UNAUDITED shadow *-creds/ stores on the headend; sprawl-glob
  blind spots incl. a PREDICTED Stage-5 admin-openrc exposure. All logged-not-actioned.
- NEXT (fresh session, operator-directed): build per **`docs/D-137-implementation-plan.md`**
  (the repo-carried build spec -- the design originated in an out-of-repo plan file, which
  this bookend path would not surface). First run expected RED BY DESIGN; going green is a
  separate remediation project, do not scope-creep it into the build.
- Status ONLY in CURRENT-STATE.md. Detail: docs/changelog-20260725-maas-admin-recovery.md.
