2026-07-16 -- Stage-3 review sweep, Phase A (record amendments) + Phase B (whole-host calculator)

Context

Implements the gated fix-sweep from docs/stage3-adversarial-review-20260716.md after the operator ruled the review's blocking decisions step-by-step (R-1..R-4, logged in docs/session-ledger.md). Phase A = record amendments only (doc-coherence). Phase B = the committed whole-host capacity calculator + re-validation (R3-F06). NO cloud mutation; nothing applied. Phase C (the Model B OpenTofu reshape) is NOT in this change -- it is the next, separately-gated phase.

What changed

Phase A -- record amendments (docs/design-decisions.md, docs/security-ledger.md). Encodes the operator's 2026-07-16 rulings + the review's record fixes as dated AMENDMENT blocks (append-only convention) + targeted status-line corrections:

D-123 AMENDMENT: ADOPTED = Model B (operator ruling), overturning the inferred Model A (R3-F01). Status line corrected. Records the accepted cascade (supersede D-103/D-114; D-124 sizing void; depth-4 nested virt accepted; fallback preserved).
D-103 / D-114 AMENDMENTS: node-placement / containment-scope superseded for the DCs (nodes now inside vvr1-dc0).
D-121 AMENDMENT + status: storage 3->4/DC (R-3, node layout now 3+2+4=9/DC, ceph-osd=4); vault v-a re-attributed to the operator's 2026-07-16 ruling (was agent-authored, R3-F01); body's stale "Operator sub-ruling needed" reconciled; re-validation logged (done in Phase B).
D-124 AMENDMENT: rack sizing (4/8192/80) VOID under Model B; transit addressing (Scheme A) stands.
D-122 AMENDMENT: MAAS-controller bullet superseded (C1); single-object site-down VINDICATED for DCs by Model B (C3 -- the operator's original intent, not amended away).
D-107 AMENDMENT: "node artifacts" scoped to the supply-chain mirror, excluding the intra-MAAS provisioning-image channel (C4); DR-independence claim made honest -- provisioning unavailable during an Office1-region outage is a PERMANENT design property, and the drill exercises workload failover, not redeploy (C5).
D-115 status line: "Originally PROPOSED/OPEN" moved off the ADOPTED status line so ledger-scan reads the ADOPTED token cleanly (R3-F09; verified -- D-115 no longer flagged PROPOSED).
SEC-011: CLOSED (operator ruling -- keep uniform 6-NIC; A2's Roosevelt-delta refutation accepted).

Phase B -- scripts/dc-dc-whole-host-budget.py + tests/dc-dc-whole-host-budget/ (R3-F06). The committed, harnessed replacement for the lost scratchpad/optc-calc.py. Read-only arithmetic; sums the RAM/vCPU/disk of both DC node fleets + containment VMs (Model B) or rack headends (Model A) + Office1 + edges, compares to the MEASURED host budget (256/1024/10240), reports the binding resource + FIT verdict. Parameterised (layout/model/host all overridable); defaults encode the ruled Option C (3+2+4) under Model B. Cross-checks against D-121's known figures: the old 3-storage shape returns 790 GiB (matches the original D-121 record). Harness 13/13 PASS.

Re-validation result (R3-F06 closed): ruled shape (Model B, 3+2+4) = 838 GiB / 1024 (82%), FIT, 186 GiB headroom (vCPU 238/256 = 93%, overcommits in-sim; disk 62%, thin). Model A fallback = 822 GiB.

Tests / verification

bash tests/dc-dc-whole-host-budget/run-tests.sh -> 13/13 PASS.
bash scripts/repo-lint.sh -> 0 fail, 1 legacy WARN.
bash scripts/run-tests-all.sh -> GAUNTLET ALL GREEN (63 harnesses, +1).
bash scripts/ledger-scan.sh -> D-115 no longer falsely PROPOSED (only D-068/D-071 remain, both genuinely open).
Byte hygiene: 0 non-ASCII / 0 CR added.

Revert

Phase A: git checkout <pre-sweep> -- docs/design-decisions.md docs/security-ledger.md (removes the 2026-07-16 AMENDMENT blocks + the SEC-011 close + the D-115/D-121/D-123 status edits).
Phase B: git rm scripts/dc-dc-whole-host-budget.py && git rm -r tests/dc-dc-whole-host-budget.
No cloud state touched.