# Pass 1 -- ADMINISTRATOR REPORT: planning review (container-layer elimination)

**Author:** the Phase-1 administrator (multi-agent pass, `SCOPE-AND-EXECUTION-PLAN.md` Section 4).
**Date:** 2026-08-09. **Inputs:** `pass1-w1-redeploy-teardown.md`, `pass1-w2-workflow-gates.md`,
`pass1-w3-sequencing.md`, `pass1-w4-module-planning.md` -- read in full, adversarially
cross-checked against repo ground truth (checks logged in Section 1). Baseline consumed:
`pass0-admin-report.md` incl. Section 7a gate outcome -- **Option 1 CONFIRMED** (flat node VMs
on vcloud libvirt + small non-hypervisor `vr1-dcN-client` VM per DC), **cross-DC handling (a)
CONFIRMED** (new vcloud-level host isolation control + `--check` gate + SEC-NNN row), **MAAS
region stays on `vr1-dcN-maas-01`**, rack-controller-remainder placement OPEN, all riding
D-143. READ-ONLY synthesis; no mutation; findings are logged, not executed.

---

## 1. Adversarial-check results (run against repo ground truth this session)

1. **W1.2's Stage-2-vs-Stage-3 correction: CONFIRMED, load-bearing.** Read directly:
   `docs/dc-dc-deployment-workflow.md:60-88` -- Stage 2 is the Office1 SITE standup, its Owns
   line is **D-114** (site containment VM `voffice1` + MAAS-composed LXD VMs), not D-123.
   `docs/dc-dc-deployment-workflow.md:149-158` -- Stage 3 is the per-DC substrate, Build line
   verbatim: *"D-123 **Model B** (TWO OpenTofu roots + a bootstrap gate between)"* (`:154`).
   **Stage 3 is the stage container-elim restructures; Stage 2 is untouched.** D-114's
   containment pattern (voffice1) is a SEPARATE, KEPT decision -- the project carries two
   different "containment VM" patterns going forward (D-123's retired, D-114's kept) and the
   Phase-4 change-set must name that explicitly so name-similarity does not sweep Stage 2 in.
   Any earlier prompt text saying "Stage 2 restructures" is wrong; every table below keys off
   Stage 3.

2. **Root-topology fork: NOT a contradiction, but W1.3's headline over-asserts -- reconciled.**
   W1.1 Sec 5 item 1 leaves "one merged root vs shared-outer + per-DC roots" OPEN (its destroy
   commands are marked illustrative for exactly this reason). W1.3's B.4 step 8 headline says
   "ONE FLAT `tofu` root, ONE apply cycle" -- but W1.3's own risk #5 explicitly leaves
   one-state-per-DC vs one-state-total open ("this document leaves that split as a Phase-4
   decision"). Ruling of this synthesis: **the sequence holds under EITHER root shape.** The
   invariant B.4 actually establishes is: one apply CYCLE per DC, run on vcloud against local
   `qemu:///system`, no bootstrap-gate seam, no inner/outer ordering, no qemu+ssh dial. What
   the fork changes is only (i) how destroy SCOPING is achieved (`-target` set vs "pick the
   root"), (ii) per-state blast radius (~38 domains x 2 DCs under one state vs split), and
   (iii) the exact wording of the teardown primitive. Read W1.3's "ONE FLAT root" as "one flat
   apply scope," not a resolved root design. **Pointer discrepancy also reconciled:** W1.1 says
   Phase 2/W2.1 decides; W1.3 risk 5 says Phase 4 -- resolution: **W2.1 (tofu module design)
   DESIGNS the root split; Phase 4 RATIFIES it in the module-workflow synthesis.** Carried to
   Phase 2 as explicitly open (Section 7). Interaction with the (a) control: under per-DC
   roots the second DC's apply is a discrete event the control can precede; under one merged
   root the FIRST full apply may create both DCs' planes at once -- so the only fork-robust
   ordering is "control installed + verified before ANY flat substrate apply" (Section 3).

3. **Two SEC-010 successors: CONFIRMED distinct, BOTH OPEN, neither dropped.** All three
   sources agree (pass0 Section 5 "two controls"; W1.1 phase-2 table step-B row "related but
   distinct"; W1.3 B.3 vs B.5 step 17 "do not read B.3 as closing SEC-010's full scope"):
   - **(i) The NEW vcloud-level cross-DC host-isolation control** (Phase-0 handling (a),
     gate-confirmed): asserts no inter-plane/inter-DC forwarding on vcloud's own kernel.
     Mechanism undesigned; SEC-NNN unminted; stage home resolved by recommendation in
     Section 3. Container-elim-only content.
   - **(ii) The re-authored SEC-010 transit-leg FORWARD-drop** on the new boundary: today's
     SEC-010 is interface-scoped to `vvr1-dcN`'s transit NIC (+ voffice1 peer); the qemu+ssh
     purpose dissolves but operator `ssh -J` and Office1-originated flows (e.g. MAAS rack
     enrollment traffic) still ride the transit -- WHICH ends get the drop (client VM +
     voffice1?) is OPEN (pass0 Section 6 item 5). Sequenced at W1.3 B.5 step 17, deliberately
     separate from B.3.
   Neither exists yet; both are owed artifacts (Section 6).

4. **The (a) control consolidated into ONE design requirement** -- Section 3.

5. **D-143 orthogonality: holds as "every diff attributable," NOT as "no intersections."**
   W1.1's framing (D-143 = value/data substitution; container-elim = shape change) is correct
   at the structural level and the attribution discipline is sound. But four line-items are
   genuinely `[both]` and must carry dual labels (W1.3 Part C + W1.2 Stage-4 row):
   - **G17** (per-DC artifact source): new ADDRESS family (D-143) + new HOST (container-elim
     placement) in one gate-literal edit.
   - **B.1.4 / D-143 item 4** (transit routes + DC-side statics): octet-preserving math is
     D-143; the BEARER host changes rack -> client VM (container-elim).
   - **R7 / D-143 item 5** (credential revocation): owed BY D-143; the hosts being revoked
     are container-elim-eliminated classes -- W1.1: "the SAME step wearing two decision-labels."
   - **B.7** (juju/bundle deploy): overlay literals carry 10.13 (D-143); execution-host
     identity changes rack -> client VM (container-elim).
   Plus B.1.1 (capacity re-measurement) FEEDS both axes. Everything else in W1.3's Part C
   table separates cleanly. The change-set reviewer's test stands: every diff hunk names the
   axis (or, for these four, both) it belongs to.

6. **D-128 amendment: REAL, not a doc-currency nit -- verified.** `docs/design-decisions.md:
   5354-5364` read directly: Plane 2's DEFINITION includes *"the INNER `tofu` root
   (`opentofu/vr1-dc0-substrate/`, `qemu+ssh` FROM Office1 into `vvr1-dc0`, R-5)"* executing
   on voffice1. Under Option 1 that object ceases to exist -- the entire substrate build
   becomes Plane 1 (vcloud-local), and Plane 2 shrinks to MAAS/NetBox (with juju/openstack
   already moved to the DC client by D-138). That is a substantive scope change to a RULED
   decision's own definition, not stale prose. **Flagged for the Phase-4 [ARCH] decision
   framing: the D-128 amendment rides alongside the D-123 amendment/new-D, the D-125
   retirement, and the D-138 concrete-host change.**

7. **Worker-claim verification + contradictions:**
   - **W1.1's phase6 "ALREADY WRONG" claim: CONFIRMED by direct read.** `runbooks/
     dc-dc-phase6-designate-cos-magnum.md:437-444` says "Run them from the Plane-2 host
     (voffice1) per D-128" / "CHECK ... from the Office1 headend (voffice1)" before a
     `juju status` command. Its U9 measurement (2026-07-27) predates D-138 (2026-07-30);
     phase4's own RUN-LOCATION table records the correction. A pre-existing stale-D-138
     defect the rewrite sweep must also fix -- not a new container-elim delta.
   - **W1.3 step 18 wording vs the refuted vm-host mechanism -- reconciled.** W1.3 B.6
     step 18 says nodes are discovered "via the vcloud-registered virsh `vm-host`"; the
     workflow doc's Stage-3 State note (`:164-166`) records that `maas-vm-host` registration
     was REFUTED for DCs and replaced by per-machine virsh power (D-103/D-123 amendments
     2026-07-20; W1.1's Step-D row + DOCFIX-179 agree). **Correct reading: the mechanism is
     per-machine `power_type=virsh`; only the power-address VALUE re-derives** from "dial the
     containment VM's libvirtd" to "dial vcloud's own libvirtd" (`lib-hosts.sh`
     `VIRSH_POWER_ADDRESS*`, pass0 rows 4-5). The sequence position is right; the noun is not.
   - **"Migrate" vs "re-mint" credentials -- compatible, stated so it can't read as a
     contradiction.** Pass0 row 8 says residencies "MIGRATE"; W1.3 B.7.22 says credentials are
     "(re-)MINTED here, not migrated." Both true at different layers: the REGISTER rows
     (`vm-secret-locations`, SEC-026/-028/-029 pointers) re-point to the client-VM host class;
     the credential MATERIAL is revoked with the old host (Part A step 3) and freshly minted
     on the new one. No secret material moves between hosts.
   - **W1.2 vs W1.4 on the (a) control's artifact kind -- taxonomy tension, resolved in
     Section 3** ([3] in W1.2's IaC-layer sketch vs L5 in W1.4's model; W1.2's placement was
     about INVOCATION ORDER, not artifact kind -- do not let Phase 2 build it twice).
   - **W1.2 vs W1.4 on the client VM's grouping -- not a contradiction.** W1.2's sketch
     bundles the client VM into the per-DC `dc-substrate-flat` apply; W1.4 classifies it L1
     (a `cloudinit-vm` instance, same module type as voffice1/edges). Layer CLASSIFICATION vs
     apply GROUPING -- both can hold; Phase 2's module design picks the call site.
   - **Nits carried (doc-currency, ride the rewrites):** W1.3 Part E risk-2 has off-by-one
     step references ("17 (MAAS enlist target)" is step 18; "20 (juju execution host)" is
     step 21). The workflow doc's Stage-3 Build line still says "~416 GiB" -- stale vs 480
     (`variables.tf:143-150`, already flagged at pass0 check 5a). W1.2's Gap-#20 verdict
     ("probably unchanged") is properly hedged as needing re-measurement post-build -- carried
     as owed, not as fact.
   - **No inferred-value violations found** beyond the items above; spot-checked citations
     (workflow doc stage rows, D-128, D-138, phase6, W1.4's module listings vs
     `opentofu/main.tf`) resolved to the cited lines.

---

## 2. The planning change-set (per-runbook, per-stage, per-gate)

### 2.1 Runbooks

| Runbook | Verdict | Change (all against confirmed Option 1) |
|---|---|---|
| `dc-dc-teardown-rollback.md` | **REWRITE** (same weight as its own 2026-07-16 "MODEL B RESHAPE" banner) | Two-clones/two-hosts preamble DELETED (one clone, vcloud); Path A root-choice becomes shared-outer vs per-DC-flat (per root-fork resolution); Step-4 verify collapses to ONE vcloud-local `virsh` block (the "vcloud grep passes against an intact DC" trap goes moot); Path B "everything" = N+1 roots on ONE host, qemu+ssh guard branch dropped; rollback-tree Question 0 redrawn (fewer roots); **item 5's `virsh destroy vvr1-dcN` lever needs a REPLACEMENT artifact** (Section 6 #2); mesh-leg caveat REWORDED (no qemu+ssh path; still carries client-VM reach + `ssh -J`); Paths **M and C are UNCHANGED as procedures** (above the substrate); footer needs a fresh re-measurement pass against the new module tree at delivery |
| `dc-dc-phase0-vcloud-prep.md` | NO CHANGE | Zero containment hits (W1.1-verified) |
| `dc-dc-phase1-office1-standup.md` | NO CHANGE | Its containment VM is `voffice1` under **D-114** -- out of scope (check 1) |
| `dc-dc-phase2-tofu-dc-substrate.md` | **HEAVIEST REWRITE** | Step B (bootstrap gate) ELIMINATED WHOLESALE; Step C (inner apply) MERGES into Step A (one apply, one root-scope, one host, one state); the DC-substrate USAGE of `expose_nested_virt` drops (`vvr1-dcN`'s true-setting; the module VARIABLE stays -- `voffice1` consumes it per the Stage-2 Build line, and the client VM sets it false); D-125 bridge-in rows DELETED (`modules/wan-bridge` dead for VR1; edge WAN -> direct `vr1_dcN_uplink` NAT, same /24); Step D loses the "inner virsh" framing (DOCFIX-179 deferral stands); netem caveat reworded only; step list re-grouped fresh-linear (no A-E lettering needed); definition-of-done re-homed off `--host-nodes`; Step-13 backup = ONE state file on vcloud |
| `dc-dc-phase3-maas-enlist-deploy.md` | LOW DELTA | Two SSH-jump-target lines (`:424,430`): far end becomes the ruled placement host (client VM OR maas-01 -- **OPEN, do not pre-pick**); mechanics otherwise topology-agnostic (per-machine virsh power; only the power-address VALUE changes) |
| `dc-dc-phase4-juju-bundle-per-dc.md` | MODERATE | RUN-LOCATION table gets its THIRD correction: row 1 juju/openstack CLI -> `vr1-dcN-client` ("the rack" is retired vocabulary); row 2 (voffice1: maas/NetBox/tofu*) and row 3 ("never vcloud") unchanged -- *tofu's Plane-2 half shrinks per the D-128 amendment; staged-scripts caveat re-points its noun (client VM still has no repo clone); below-juju-destroy caution re-points at the rewritten teardown runbook |
| `dc-dc-phase5-dr-failover-drill.md` | NO DIRECT CHANGE | Inherits phase4's table |
| `dc-dc-phase6-designate-cos-magnum.md` | RIDE-ALONG FIX | `:437-444` pre-existing stale-D-138 defect (verified, check 7) -- fix in the same sweep as phase4's table; not a container-elim delta |
| `dc-dc-office1-service-reip.md` | OUT OF SCOPE | D-114 territory |

### 2.2 Workflow doc (`docs/dc-dc-deployment-workflow.md`)

| Stage | Change |
|---|---|
| Stage 1 | Gate content UNCHANGED (nested-KVM still needed for Stage 2's voffice1). Relationship note: the six per-DC planes RETURN to vcloud level -- Stage 3 reconverges onto Stage 1's own execution shape. **Recommended new owner of the (a) control** (Section 3) |
| Stage 2 | **NONE** (D-114; check 1). Phase-4 change-set must state the two-containment-patterns distinction explicitly |
| Stage 3 | **THE restructured stage.** Build line: Model-B two-root text -> single flat apply (planes + edge + 12 node VMs + client VM); also fix stale "~416 GiB" en route to deleting the sizing. Gate line: depth-4 boot gate -> depth-2; bridge-in isolation test -> direct-NAT egress assertion; add the (a) `--check`. Owns line: D-123/D-125 phrasing VOID pending the Phase-4 ruling; D-124 survives only for the client VM's transit leg. Reuse-vs-new: "NEW, no precedent" should be revisited -- the flat shape is MORE reusable, closer to Stage 1's |
| Stage 4 | Placement, not mechanism: gate-line prose + G17 literal need the ruled artifact-source host + 10.13 address (dual-cause, check 5) |
| Stage 5 | No gate-content change; every literal naming the containment VM's transit IP re-points to the client VM (e.g. `docs/CURRENT-STATE.md:7829` "openstackclient ... ON THE dc0 RACK (172.31.0.2)"). D-140 keeps Stage 5 a PROCEDURE module -- settled constraint, not open |
| Stages 6-7 | No container-layer dependency found (verified by W1.2, not assumed) |
| Gap register | #2 reshapes (first Stage-3 exercise becomes a single flat apply; wan-bridge deleted; inner roots retire); #17 closing-mechanism note becomes HISTORICAL (doc-currency addendum owed at ruling time); #19b unaffected; #20 verdict RE-VERIFY post-build (its own expiry clause triggers); #21, #22 unaffected (checked, excluded); **NEW register entry owed for the (a) control** (no entry exists today) |

### 2.3 G-series gates (`docs/CURRENT-STATE.md` section 6)

| Gate | Status |
|---|---|
| G9/G10 | CLOSED/historical; their SUCCESSOR for the 10.13 rebuild is a SINGLE apply-and-verify gate (no outer/inner pair): substrate apply + (a) `--check` + depth-2 boot proof + direct-NAT egress test. The retired `--host-nodes --check` sub-item is replaced by the (a) control's check -- which is host-scoped, hence the Stage-1 home (Section 3) |
| G12 | CLOSED/historical -- read as "the shape being replaced," never a template |
| G17 | OPEN; the one dual-cause edit (D-143 address + container-elim placement) -- record as two line-items landing in one edit |
| G14 | Indirect: residency re-points + >=1 new SEC row are COUNT-affecting; flag for the next `ledger-scan.sh` reader (instrument-currency lesson #25) |
| G18, G1-G8, G11, G13, G15, G16 | No container-layer dependency (verified per-gate by W1.2) |

---

## 3. The (a) cross-DC isolation control -- ONE consolidated design requirement

Consolidating Phase-0 7a (confirmed deliverable: `--check` gate + SEC-NNN row), W1.2 (no
stage home, no register entry, risk of ad-hoc under-gated build), and W1.3 (must precede
co-residency; E.1):

**Requirement.** A vcloud-level host isolation artifact (nftables, SEC-010's proven pattern
one layer up) asserting no inter-plane / inter-DC forwarding on vcloud's own kernel, shipping
with: a mechanical `--check` gate, its own `tests/<name>/run-tests.sh` harness, a new SEC-NNN
ledger row, a NEW workflow-doc gap-register entry, and a gate row in the rebuild's G-series
successor. Parameterized by site token (W1.4 principle 1), never DC-hardcoded.

**Ordering invariant (fork-robust).** The control must be installed and `--check`-verified
**BEFORE the first flat substrate apply that can make any two DCs' planes co-resident** --
i.e. before ANY per-DC flat apply, since under a merged single root the first apply may create
both DCs' planes at once (check 2). "Before the second DC's apply" (W1.3's phrasing) is the
minimum; "before any flat apply" is the only ordering that survives the open root fork.

**Stage placement recommendation: Stage 1 (vcloud host prep), as a host-level control**,
re-verified (i) at each per-DC substrate apply's close and (ii) at Stage-5 verify-live
(W1.3 B.7 step 24 -- the first point real traffic tests the claim). Rationale: it is
host-scoped, not per-DC-apply-scoped (W1.2's G10 analysis); Stage 1 gives it a named stage
owner so it cannot be orphaned; and the placement is indifferent to the root-topology fork.

**Artifact kind (resolves W1.2-vs-W1.4):** SEC-010's actual pattern -- a script-installed
nftables control + `--check` + harness, i.e. a **procedure/L5 verify artifact**, NOT an
OpenTofu module. W1.2's sketch slot "[3]" expressed invocation ORDER (before any DC apply),
not artifact kind. Phase 2 builds ONE artifact.

**Distinct from** the re-authored transit-leg FORWARD-drop (check 3) -- two controls, two SEC
rows, both owed.

---

## 4. Ordered teardown -> redeploy sequence (consolidated from W1.3, corrected per Section 1)

Two axes tagged throughout: `[D-143]` (value substitution) / `[CE]` (container-elim, shape) /
`[both]` (dual-labeled per check 5).

### Part A -- teardown of the CURRENT 10.12 Model-B checkpoint (today's tooling; the runbook
already describes this shape correctly and needs no rewrite to tear it down)

1. `[D-143]` Back up state -- BOTH roots, BOTH hosts (outer on vcloud; each inner on voffice1).
2. `[D-143]` MAAS machine census FIRST, from voffice1 (Step 2, both lenses).
3. `[both]` **R7 credential-revocation checklist (OWED BUILD -- Section 6 #5), run BEFORE any
   substrate destroy** (revoking after the hosts are gone degrades to "assume it's moot"):
   SEC-026 client credential, SEC-028 service credential, SEC-029 rack-local PKI copy (shred;
   headend canonical unaffected), D-126 per-env qemu+ssh keys (clean RETIREMENT -- no
   successor exists), rack enroll-secret residue. Enumerate from EVERY `vm-secret-locations`
   row keyed to the rack host class, not just the named examples; mark rows RETIRED
   (append-only). Each revocation individually confirmed with captured output.
4. `[D-143]` **MAAS machine-record release/delete (OWED sequenced step -- Section 6 #6)**:
   guaranteed non-zero LENS-2 on a live checkpoint; release/delete per record
   (operator-gated), re-run both lenses to zero; ALSO clean the region-side residue -- the
   `vvr1-dcN` rack-controller's own enrollment record + the region's `primary_rack`/DHCP
   reference.
5. `[D-143]` Plan destroy, INNER first (from voffice1), capturing the pre-destroy virsh
   baseline while the containment VM is still reachable.
6. `[D-143]` Plan destroy, OUTER second (vcloud): `vvr1_dcN` + uplink + storage modules only.
   Do NOT target mesh/netem legs (working assumption: mesh triangle SURVIVES the pivot --
   confirm at Phase 2, do not destroy speculatively).
7. `[D-143]` Apply destroys, INNER then OUTER; verify each half from the host that can see it.
8. `[D-143]` Untargeted `tofu plan` drift gate: zero unexpected drift.
9. `[D-143]` NetBox DCIM decommission of the `vvr1-dcN` device records.
10. Repeat per DC (Path A) or batched (Path B).

### Part B -- redeploy on flat 10.13 (Option 1)

- **B.1 prerequisites (once, before any apply):** `[both]` vcloud capacity re-measurement +
  FIT-calculator extension (the "~176 GiB freed" stays directional until then); `[D-143]`
  NetBox B2 apex re-carve (10.13.0.0/16, octet-preserving); `[D-143]` `lib-net.sh` 10.13
  literal blocks; `[both]` D-124 transit re-point -- octet math is D-143, the bearer host
  changes rack -> client VM (CE).
- **B.2:** `[unchanged]` vcloud host prep; Office1 headend (if not already up). voffice1
  remains MAAS-region + Plane-2 host for what still needs it.
- **B.3:** `[CE]` **Install + verify the (a) isolation control -- BEFORE ANY flat substrate
  apply** (Section 3's fork-robust invariant; supersedes W1.3's "before the second DC's
  apply" as the minimum reading).
- **B.4:** `[CE]` **One flat apply CYCLE per DC** (root shape per the OPEN fork, Section 7),
  vcloud-local `qemu:///system`: mesh legs + uplink NAT `[unchanged]`; per-DC storage pool
  collapses to one; six planes re-homed (same CIDRs/families/MTU -- D-139/D-143 own the
  values); edge re-homed, WAN -> direct NAT; 12 node VMs re-homed (**MAC re-pinning is a
  likely force-replace -- re-measure every MAC after apply, before B.6 trusts one**); `[new]`
  the `vr1-dcN-client` VM. VANISHES: `vvr1_dcN` modules + sizing/addressing/pubkey vars, the
  two inner roots AS ROOTS, the qemu+ssh dial + D-126 keys (no successor), `wan-bridge` +
  netplan bridge, the bootstrap gate's `--host-nodes` duty.
- **B.5 (surviving duties, re-targeted -- placement OPEN, a real sequencing dependency, not a
  footnote):** rack enrollment (`site-headend-install.sh --role rack`, WITHOUT `--host-nodes`)
  onto the ruled host; D-131 forwarder (`dc-rack-net.sh`) -- must land SOMEWHERE or the
  SERVFAIL bug returns; artifact service (`.4`); **the re-authored transit-leg FORWARD-drop
  (control (ii), Section 3 -- distinct from B.3, ends still open)**.
- **B.6:** `[unchanged*]` MAAS discovery/commission/carve -- mechanism is per-machine
  `power_type=virsh` (check 7 wording correction); *only the power-address VALUE re-derives
  to vcloud's own libvirtd (`lib-hosts.sh` re-derivation + every invocation-site example).
- **B.7:** `[unchanged]` Juju bootstrap + bundle from the `vr1-dcN-client` VM ("never the
  vcloud jumphost" doctrine intact); SEC-026/028/029 freshly MINTED here (register rows
  re-point; no material migrates -- check 7 reconciliation); verify-live gates: Ceph-over-v6
  (new literals per D-143), `geneve-encap-assert.sh` (MTU budget analytically unchanged --
  live assert still OWED), **plus the (a) control's `--check` re-run now that both DCs'
  planes are actually co-resident**.
- **B.8 close-out:** `[CE]` NetBox DCIM registration of the client VM + flat roster;
  `[deferred]` the container-elim [ARCH] ruling (Phase 4 frames, operator rules) -- the
  redeploy is NOT "done" while that ruling is owed.

---

## 5. The layer model (adopted from W1.4 -- the Phase-4 module-workflow backbone)

L0 host/inter-site substrate (IaC: mesh, pools, office1-network -- Stage 1) -> L1 site/edge
nodes (IaC: voffice1, DC edges, **+ the client VM as a new instance of the SAME
`cloudinit-vm` module type**) -> L2 DC substrate (IaC: planes + node VMs; **the two-root
split collapses INTO L2 -- the one place the layer-boundary rule was violated** (inner root
dialing a cross-host provider) **and Option 1 removes that violation structurally**) -> L3
enlist/commission (procedure; rack-remainder placement OPEN) -> L4 Juju/OpenStack deploy
(procedure; **D-140 PINS it as procedure for this redeploy -- settled, do not fold into
IaC**) -> L5 verify/gate (cross-cutting; the (a) control is a NEW L5 artifact per Section 3).

Design principles carried to Phase 4: site-token parameterization (never DC-hardcoded);
every module ships its harness; idempotence at every layer; no layer reaches past the one
below; findings logged at their true layer; D-140 is a distinct axis (its later adoption
would make L4 IaC WITHOUT reshaping L0-L3); Roosevelt-transfer judged per layer (L0's
node-VM shim does NOT transfer; L1's client-VM pattern + L3/L4 procedures ARE the
pre-Roosevelt deliverable). D-143 is a PARAMETER change threaded through every layer, not a
layer -- the model keeps the two axes structurally distinguishable.

---

## 6. OWED ARTIFACTS surfaced this phase (feed Phase 2 tools / Phase 3 tests)

The five core artifacts:

1. **Teardown-primitive** -- module/root-scoped `tofu` group-destroy procedure (+ harness)
   re-earning D-122's one-command site-down for the flat shape (final form depends on the
   root fork; Phase 2 designs, Phase 4 ratifies).
2. **The (a) cross-DC host isolation control** -- nftables artifact + `--check` gate +
   harness + new SEC-NNN row + new gap-register entry + gate row (full spec Section 3).
3. **Re-authored SEC-010 transit-leg FORWARD-drop** -- control (ii); endpoint set (client
   VM + voffice1?) still open; own check + SEC-row disposition.
4. **R7 credential-revocation checklist** -- built by enumerating `vm-secret-locations`
   rows for the rack host class; gates Part A step 3.
5. **MAAS machine-record release/delete step** -- promoted from runbook contingency to a
   sequenced, operator-gated Part-A step, incl. region-side rack-controller record +
   `primary_rack`/DHCP-reference cleanup.

Additional owed items surfaced (kept separate so the core count stays legible):
6. **Emergency site-down lever** -- scripted `virsh destroy` loop over the DC's domain set,
   roster-derived from `lib-hosts.sh` (rollback-tree item-5 replacement; W1.1 Sec 1(b)) --
   distinct from #1 (emergency vs gated path).
7. **FIT-calculator extension** (3 utility-node classes) + fresh vcloud capacity measurement.
8. **MAC re-measurement pass** post-B.4, before B.6 (likely force-replace).
9. **NetBox DCIM migration** -- decommission `vvr1-dcN` records; register client VM + roster.
10. **Post-build live asserts** -- geneve/jumbo (`geneve-encap-assert.sh`) on the vcloud-level
    planes; gap-#20 `site-baseleg` verdict re-verification (its own expiry clause triggered).

---

## 7. Settled vs OPEN

**SETTLED (do not re-open):** Option-1 target; handling (a) as a required deliverable; MAAS
region stays on `vr1-dcN-maas-01`; Stage 2/D-114 out of scope; Paths M + C unchanged;
D-140 pins Stage 5/L4 as a procedure module for this redeploy; mesh triangle persists as the
working assumption (Phase-2 confirmation, not speculation-destroy); the two-axis attribution
discipline (with the four named `[both]` items); the (a)-control ordering invariant
(before ANY flat apply) and its recommended Stage-1 home; the teardown ORDER of the current
checkpoint (Part A -- unchanged by container-elim).

**OPEN -- carried to Phase 2 (design):**
1. **Root topology** -- merged single root vs shared-outer + per-DC roots (W2.1 designs;
   Phase 4 ratifies; the sequence is invariant to it, the teardown primitive's wording and
   state blast radius are not).
2. **Rack-controller remainder + D-131 forwarder + artifact-service (`.4`) placement**
   (client VM vs maas-01 vs retire-with-evidence) -- blocks B.5, the phase3 SSH-target
   edits, and G17's host half. THE highest-leverage open item: three sequence steps and two
   runbook edits key off it.
3. **The (a) control's concrete mechanism** (nftables rule set, check shape, SEC number).
4. **Transit-drop endpoints** for control (ii).
5. **Client VM octet + name** (D-134 standing map needs a ruled octet; name must NOT be
   `vvr1-dcN`).
6. **Mesh-triangle survival through the pivot** -- confirm module shape at Phase 2.
7. **`site-headend-install.sh` refactor scope** (rack-role remainder vs dead `--host-nodes`).

**OPEN -- carried to Phase 4 (decision framing; operator rules, GA-R5):**
8. The container-elim [ARCH] ruling itself -- D-123 amendment vs new D-number.
9. **The D-128 amendment** (verified real, check 6): Plane 2 shrinks to MAAS/NetBox; the
   substrate build becomes wholly Plane 1.
10. Ride-alongs on the same ruling: D-125 bridge-in retirement, D-138 concrete-host change,
    D-122 site-down re-earn, D-124 sizing-void re-cause, Stage-3 Owns/Reuse-vs-new rewrite.
11. State-blast-radius weighing (rides open item 1).

**OPEN -- operator inputs (SCOPE Section 8):** pre-Roosevelt hardware specs (plug into B.1.1
capacity + B.4 sizing only -- and B.5's placement should be RE-DECIDED for bare metal, not
carried blindly); any external "module deployment project" artifacts.

---

## 8. Verification note

Author = "the administrator" (no model name asserted, operator instruction). Direct reads
this session: `docs/dc-dc-deployment-workflow.md:36-200` (Stage 1/2/3 identity), `docs/
design-decisions.md:5344-5373` (D-128), `runbooks/dc-dc-phase6-designate-cos-magnum.md:
430-450` (the "ALREADY WRONG" claim), plus the six pass documents in full. Worker citations
were spot-checked, not re-derived wholesale; every correction in Section 1 names its source
lines. Findings are LOGGED only; nothing here was executed.
