Rotated session-ledger summaries -- moved 2026-08-01 (GA-R4 rule 3 / F1)

Moved VERBATIM from docs/session-ledger.md to restore the 300-line cap at this close. These are HISTORY: they carry no status weight (status lives in docs/CURRENT-STATE.md).

SESSION CLOSE 2026-07-29 -- arity gate, renderer, ruling 3, chain audit, OSD carve LIVE (bounded, GA-R4)

• Branch dc-dc-stage5-preconditions, 22 commits pushed. NO stage opened/closed. Scan unchanged: 3 decisions, SEC 21, D 138 / DOCFIX 205 / BUNDLEFIX 053.
• VIP arity gap CLOSED + R11's three ruled gate changes. prefer-ipv6 is coupled to arity BOTH ways, closing the L3-9 merge order in which dropping the v6 legs exited 0.
• RENDERER SHIPPED (D-136 (D)), reproducing a reviewed artifact BYTE-FOR-BYTE. RULING 3, both commits: bundle.yaml is VIP-FREE; both DCs dual-family, vault .61 / designate .62 BUILT.
• CHAIN AUDIT (step 6): the adversarial lens made the chain go wrong-but-GREEN three times -- R9's ruled drift gate had never been built and dc0's overlay was gated by nothing. Built tests/render-drift, added 3 refusals, fixed 2 harness cases that could not fail.
• LIVE, each gated and independently verified: 8 OSD volumes + 2 controller VMs applied both DCs; 9 re-commissions with skip_networking=1, every diff EXACTLY the new device; MAC adoption applied (drift 0 across 20 nodes, both roots ZERO DIFF); both controllers commissioned; all ruled MAAS tags created. THE STAGE-5 ALLOCATION BLOCKER IS CLOSED.
• R1 precondition 3 CLOSED BY MEASUREMENT -- skip_networking=1 is the vendor control, and the MAC check sits BETWEEN apply and re-commission, which is what makes 2026-07-20 non-repeatable.
• RULED (GA-R5): v6 IP SANs on the Octavia controller cert (D-109 note); juju controller at utility .5 AND the octet map is a STANDING CROSS-DC STANDARD (D-134 amendment) -- divergence between DCs at the same octet is now a DEFECT, not a local choice.
• Octavia: clean negative. juju 3.6 DEEP-MERGES overlay options (charm v12.1.1 source), so octavia-pki cannot clobber the VIP; and nothing inside Octavia requires IPv4.
• OWNED: three strict-bash quoting traps, two false-positive greps, one fabricated flag, one red-lint push. All corrected on-surface; traps in docs/audit/queued-findings-20260729.txt.
• NEXT: octavia-pki generation -- the last item hard-failing preflight, and the generator is now per-DC. Gauntlet ALL GREEN (87) vcloud; repo-lint 0 fail.
• Body: docs/changelog-20260728-vip-arity-gate.md. Status ONLY in CURRENT-STATE.md.

SESSION CLOSE 2026-07-30 -- Stage-5 preconditions: 19 Phase-3 items, gate integrity, per-DC Octavia PKI LIVE (bounded, GA-R4)

• Branch dc-dc-stage5-preconditions, 25 commits pushed (ab4c842..). NO stage opened/closed. Scan unchanged: 3 decisions, SEC 21, D 138 / DOCFIX 205 / BUNDLEFIX 053.
• 6 agents (3 read-only recon, 4 delivery). Phase-3 re-measured 2 FIXED / 19 REMAIN / 5 NEW, not the 21 the 07-27 doc implied; 13 items + 3.9/3.10 + R5 delivered, phase-4 runbook 434 -> 929 lines.
• F1 (HIGH): R7's per-DC Octavia PKI was HALF BUILT -- subject and VIP gate per-DC, $DC in NO path, so generating dc1 would have DESTROYED dc0's CA and left one fixed-name overlay applying dc1's CA to dc0. Fixed end to end + REFUSE-IF-PRESENT.
• F4: the per-DC rename would have UN-IGNORED a CA private key in a repo SEC-004 calls PUBLIC. Glob + a check-ignore self-assert, proven both ways. F2: register was blind to a missing 2nd CA set (was RULED work, R13 Part 1). F6: P5 was probing the WRONG HOST'S filesystem and reporting it as fact -- 34 findings vs the true 7.
• PKI GENERATED (operator-executed; guard blocks the mint by design, not worked around), both DCs verified PASS 29/0, independence proven by sha256, backups proven by restore (PKI 12/12 vs live; tfstate byte-identical, correct serials). E2 + E3 fully closed.
• scripts/octavia-pki.sh verify NEW (harness 21/21): asserts the SAN set nothing asserted before (F8's SAN-less cert), and A12 ARMS ITSELF from os-public-hostname so F9 cannot be missed.
• Gate integrity: decorative HA, machines-overlay no-op, cloud-assert arity, G17 node check, gauntlet locale. P4 DC-aware (DC refs 1 -> 45); 3.7 closed; lib-net dc1 arm.
• NEW ruling-shaped, now BLOCKING: D-008 + D-106:2563 do not say whether substrate vr1-dc1 is dc1 by TOKEN or dc2 by POSITION -- item 3.1's ambiguity inside a ruling, deciding cert identity. A12 REFUSES rather than picking. ^ WITHDRAWN 2026-07-30 (DOCFIX-205): NOT a ruling gap. D-117 ruled it 2026-07-13 (dc1/dc2 retired for dc0/dc1) and says so in its own Status line; D-106 read as open only because D-117's annotation half was never executed (zero of four) while its Status line claimed "FULLY EXECUTED". Also not blocking -- A12 measures INERT and passes. Now an assertion on the derived zone; status in CURRENT-STATE.md.
• Headend reconcile found a gate RED ON THE ONLY HOST THAT DEPLOYS (opentofu-validate fmt walking gitignored tfvars). Fixed + scoped; both hosts now ALL GREEN (89), repo-lint 0 fail.
• Three wrong records found, none catchable by any gate: D-124 told a reader to source a provider MAC from a file holding only boot MACs (would have bridged br-ex onto the PXE NIC); the skill cites D-107 for a tailnet path it does not rule; office1-tailscale is labelled a subnet router and advertises none.
• A "backup set" asserted on three surfaces did not exist. Built for the PKI (1.0-GEN.e) and the inner tfstates (phase-2 step 13), declared, restores proven. Forward requirement recorded: the pinned secrets-storage solution MUST absorb both.
• OWNED: the operator's own working commands were NOT in the repo until the pre-bookend sweep asked; I waved through 664 CA certs as "harmless" (integrity, not secrecy); two silenced errors (| grep -q under pipefail, git pull -q &&); four consecutive cwd mistakes. All corrected on-surface.
• NEXT: F8 residue (heredoc -> printf when a real generation can be run); D-137 fork-1 guard ruling (blocked correctly once, misfired 5x); preflight still has NO verified-green reading; G17 fixture-green only; the two phase-04-network-* scripts.
• Sweep capture docs/audit/queued-findings-20260730.txt (F10-F13 + 2 ruling questions). Body: docs/changelog-20260729-stage5-preconditions.md. Status ONLY in CURRENT-STATE.md.