Ledger summaries rotated 2026-08-02 (GA-R4 rule 3 / F1 -- cap restored at this close)

Moved VERBATIM from docs/session-ledger.md. The live ledger stood at 283 lines and this close's summary would have breached the 300-line cap.

SESSION CLOSE 2026-07-30 (part 2) -- F9 CLOSED live, the reissue tool, P7, lib-identity (bounded, GA-R4)

• Branch dc-dc-stage5-preconditions, 19 commits pushed (1ddb078..). NO stage opened/closed. Scan unchanged: 3 decisions, SEC 21, D 138 / DOCFIX 206 / BUNDLEFIX 053.
• >>> OPERATOR DIRECTIVE, STANDING: THE NEXT SESSION PROCEEDS TO THE JUJU DEPLOYMENT (Stage 5), NO MATTER WHAT. Verbatim: "we have to continue to juju deployment next session no matter what". Precondition polishing is DONE; further hardening is OUT OF SCOPE unless it blocks the deploy. This is the GA-F06 circuit-breaker made explicit -- do not spend the session on records.
• DOCFIX-205: Q1 WITHDRAWN -- D-117 ruled it 2026-07-13; it resurfaced only because D-117's annotation half was never executed (0 of 4) while its own Status claimed "FULLY EXECUTED". All four annotated; Status corrected. Q2 withdrawn too (D-137 fork 1 ruled 2026-07-25). Third stale premise in one findings file.
• F9 CLOSED LIVE, both DCs (gated per DC, never batched): controller certs reissued into their own zones -- omega.dc0.vr1 / omega.dc1.vr1, fresh P-256 keys, CAs untouched. Capture docs/audit/octavia-reissue-executed-20260730.txt.
• octavia-pki.sh reissue SHIPPED (operator: "Full script minter now"): derived zone, printf config (F8 paid off), stage-assert-promote, single-value overlay surgery, backup-before-mint.
• VALIDATION AGENTS EARNED THEIR COST. Mutation testing deleted my three new assertions and the harness stayed GREEN every time. Six defects closed: A15 (no keyUsage/EKU minted + passed everything), A16 (-days defaults to 30 and verify had NO validity check), A17 (overlay/workspace desync read PASS), the re-run guard REFUSING to fix broken certs, A8's vacuous negative, two overlay checks moved pre-mint.
• F8 + F9 FIXED AT SOURCE in 1.0-GEN.c -- the generation path would otherwise recreate both at the next DC standup. F10 handled: 13 mint-refs re-anchored single-pass by row id; S4 clean.
• P7: the PKI is now an actual GATE in preflight.sh -- headend-only, NOT EVALUATED elsewhere, rc3 mapped explicitly, and it requires the literal zone line because verify exits 0 on a wrong-zone cert while inert.
• scripts/lib-identity.sh -- CLOUD_NAME + CLOUD_DOMAIN in ONE file; a rebuild that renames the estate edits one file. T47 catches shell-vs-OpenTofu drift, proven able to fail.
• Backup custody done + REGISTERED (2 rows, manifests, n-reissue-backup); the secrets-storage PIN now covers this step's creds and certs. Hazard recorded: these archives carry CA issuance state -- never restore over a workspace that has issued since.
• OWNED: I withdrew two of my own recommendations after measuring (the vr0-dc0 retirement, and the D-137 escalation framing); pushed one red-lint commit via ; instead of &&; two harness stub bugs. All corrected on-surface.
• Guard misfire tally now SEVEN -- it blocked a command that only TESTED it, then the heredoc documenting its own misfires. Hardening it needs no ruling (fork 1 is ruled).
• Gauntlet ALL GREEN (89) BOTH hosts; repo-lint 0 fail; octavia-pki 51/51; preflight 33/33; creds-matrix 65/65 + 5 pre-existing findings. verify 37/0 and P7 [ok] on both DCs.
• NEXT (Stage 5 entry): preflight is RED only on P5's pre-existing credential register -- decide accept-or-remediate at the gate, do not re-audit it. G17 arms at first boot. Bodies: docs/changelog-20260730-docfix205-d117-annotation.md, -octavia-reissue-tool.md. Status ONLY in CURRENT-STATE.md.