# VR1 Stage 3 record -- CLOSED 2026-07-21 (dc0 substrate); G12 dc1 remainder CLOSED 2026-07-23

**G12 CLOSED 2026-07-23 (dc1 substrate; operator-ruled "Merge to main + full close").**
The HELD dc1 remainder was built to a commissioned fleet on branch
`dc-dc-g12-dc1-substrate` and merged to `main`. Sequence (all operator-gated,
`docs/CURRENT-STATE.md` G12 row is the status authority): apex `--commit` + outer
step-A (5/0/0) + step-B transit/rack/SEC-010 + step-C inner 28/28 + D-125 egress
gate (2026-07-22); then edge bootstrap D-112(c)/D-113(a2) on 26.7 + v4 addressing,
`dc-rack-net` dc1 arm (harness 18/18) + install (forwarder answers `maas-internal`),
region MAAS (D-120 range + D-131 forwarder DNS + DHCP primary_rack=nmpcq4), SEC-016
dedicated per-DC MAAS->libvirt power key (operator-ruled), and **commissioning 9/9
READY in ~3.5 min, shapes exact to D-121 Option C** (2026-07-23). dc0's two stacked
commissioning faults (MAC regen, rack-resolver SERVFAIL) were pre-empted by pinned
MACs (step C) + the pre-installed forwarder. New SEC rows: SEC-015 (transient edge
key on rack, remediated), SEC-016 (dedicated dc1 power key). Three findings logged
(edge-bootstrap `util.inc`/`shell_safe()`, transient post-restart-sshd scp,
MAAS-snap-key refresh fragility). dc1 session changelogs added to the table below.

# VR1 Stage 3 record -- dc0 substrate CLOSED 2026-07-21 (original title preserved)

**Stage close (operator-ruled 2026-07-21, "Close and merge"):** all dc0 gates CLOSED with captures
-- G9 (outer apply), G10 (deploy steps B-E: bootstrap, depth-4 boot, D-125 egress, MAAS + all 9
nodes Ready, netem step E on virbr5), G16 (office1 channels state surgery, outer plan ZERO DIFF).
The dc1 remainder is split into HELD gate G12 per the stage's own vr1-dc0-first design (E3
satisfied). Merged to `main` as a merge commit; branch `dc-dc-stage3-phase2-dc-substrate` retired.
Notable en-route: the 2026-07-21 commissioning double-fault (MAC regen + rack agent-resolver
SERVFAIL, both fixed + doc'd), the pod-mechanism refutation (D-103/D-123 amendments; vr1-dc0-maas
retired), and the same-day pod-delete-cascade incident + full recovery
(docs/audit/incident-20260721-*). Durable content: rulings in design-decisions D-121..D-131 +
ga-rulings; traps in platform-traps + appendix-A; status ONLY in CURRENT-STATE.

Sessions 2026-07-16..18 (adversarial review sweep, Model B reshape, D-121..D-129 era, grounding
audit) were consolidated while the stage was open; the close adds the 2026-07-19..21 execution
sessions below. The closing session's changelog (changelog-20260721-netem-install-verify.md)
stays top-level until that session closes (per this record's own precedent).

Closing-era sessions (now docs/archive/changelogs/):

| file | scope | lines |
|---|---|---|
| changelog-20260719-phase5-sweep.md | GA Phase-5 sweep Batches 0-6 + audit exit | 292 |
| changelog-20260719-dc0-deploy-stepB.md | deploy steps A-D: transit, bootstrap, inner apply, edge, enlistment, power | 838 |
| changelog-20260721-commissioning-diag.md | commissioning double-fault diagnosis + repair (9/9 Ready) | 132 |
| changelog-20260721-close-and-delivery.md | MAC pinning + dc-rack-net + incident docs + netem sudo mechanism | 140 |
| changelog-20260721-g12-dc1-authoring.md | G12 dc1: apex confirm-free + importer dc1 support + vars/substrate authoring (drop-state) | -- |
| changelog-20260722-g12-dc1-build.md | G12 dc1: apex write + outer step A + step B/C + D-125 egress gate | 257 |
| changelog-20260723-g12-dc1-edge.md | G12 dc1: edge bootstrap/addressing + rack-net + region MAAS + SEC-016 + commissioning 9/9 | 240 |

| file (now docs/archive/changelogs/) | title line | lines |
|---|---|---|
| changelog-20260716-d124-addressing-pin.md | 2026-07-16 -- D-124 addressing pinned: transit supernet 172.31.0.0/24 + ratified rack values | 65 |
| changelog-20260716-d124-rack-addressing.md | 2026-07-16 -- D-124 adopted; vr1-dc0 MAAS rack (vvr1-dc0) wired; rack-mgmt NetBox importer | 92 |
| changelog-20260716-d126-durable-forward.md | 2026-07-16 -- D-126: durable, rootless vcloud->service-VM access (SSH local-forward via systemd --user) | 111 |
| changelog-20260716-review-sweep-phaseAB.md | 2026-07-16 -- Stage-3 review sweep, Phase A (record amendments) + Phase B (whole-host calculator) | 59 |
| changelog-20260716-review-sweep-phaseC.md | 2026-07-16 -- Stage-3 review sweep, Phase C (D-123 Model B OpenTofu reshape + node-host bootstrap) | 64 |
| changelog-20260716-review-sweep-phaseC2-D125.md | 2026-07-16 -- D-125: Model B per-DC ISP egress (bridge-in, single-NAT) -- resolves OBS-3's design gap; egress  | 73 |
| changelog-20260717-d126-baseleg-oneshot-d128-operating-model.md | 2026-07-17 -- vcloud post-restart sweep + D-126 base-leg oneshot + D-128 operating model | 75 |
| changelog-20260717-d127-iac-autostart-and-guest-updates.md | 2026-07-17 -- D-127 IaC autostart matrix (baked into the deploy tooling) + Office1 guest updates | 68 |
| changelog-20260717-netbox-apex-recovery-edge-wan-import.md | 2026-07-17 -- office1-netbox apex recovery + restart policy + full D-124/edge-WAN import (Blocks A + B) | 54 |
| changelog-20260718-opnsense-plugins-installer.md | Changelog 2026-07-18 -- OPNsense edge plugin profile-installer (D-129) | 40 |
| changelog-20260718-permission-posture-ask-preempts-classifier.md | Changelog 2026-07-18 -- permission posture: mutations PROMPT, not classifier-deny | 40 |
