queued-findings-20260802-step6-queued-items.txt
================================================
Close sweep for the SECOND 2026-08-02 session (post-/clear): the queued-findings
backlog (sweep F1-F6), the mirror root-cause, and D-139 execution step 6.

Method (ruled 2026-07-31): read back over the whole session, enumerate every
finding/decision/measurement/mistake, then GREP each candidate against repo
surfaces. A hit = ALREADY ON SURFACE, and where. No hit = FIRST SURFACE and would
have been lost on a context clear.

Session body: docs/changelog-20260802-queued-items.md (items 1-12).
Status claims live in docs/CURRENT-STATE.md ONLY.

NUMBERING NOTE, because two registers collide: items below cite the SWEEP register
(F1-F6, docs/audit/queued-findings-20260802-stage5-edge-fold.txt). The runbook fold
register has its OWN F1-F12 with different meanings and is untouched this session.

--------------------------------------------------------------------------------------
FIRST SURFACE -- existed ONLY in the transcript. Listed first, by consequence.
--------------------------------------------------------------------------------------

G1. >>> A BROAD `Bash(ssh vr1-dc0-maas *)` ALLOW RULE WAS ADDED TO GITIGNORED STATE. <<<
    grep "ssh vr1-dc0-maas" in docs/: 0 hits.
    `.claude/settings.local.json` was MODIFIED this session (mtime 17:33) and now
    holds allow=310 / ask=11 / deny=0. The 2026-08-02 (first session) sweep recorded
    the counts as UNCHANGED from the 2026-07-30 verbatim record, so the growth is
    this session's.
    THE ITEM WORTH ATTENTION: `Bash(ssh vr1-dc0-maas *)` is a WILDCARD allow on the
    MAAS REGION VM -- the same shape as the broad `Bash(ssh vr1-dc0-rack *)` that
    the 2026-07-30 sweep flagged as "worth review". It was auto-added by an approval
    during the pg_dump work. It permits ANY command on the host holding the region
    database. Recommend narrowing to the read-only forms actually needed.
    The file is GITIGNORED, so this text is the only recovery copy. The 11 ASK rules
    verbatim (these are the gating ones and matter most):
      Bash(script -aqe ~/as-executed/2026-07-23-stage4-carve.log -c 'ssh voffice1 "maas admin machine *)
      Bash(ssh -i ~/vr1-dc0-creds/vr1-dc0_svc_ed25519 -J voffice1 jessea123@172.31.0.2 "sudo *)
      Bash(ssh voffice1 "maas admin interface *)
      Bash(ssh voffice1 "maas admin subnet *)
      Bash(ssh voffice1 "maas admin tags *)
      Bash(ssh voffice1 "maas admin tag *)
      Bash(ssh voffice1 "maas admin machine *)
      Bash(ssh *'maas * update*)
      Bash(ssh *"maas * update*)
      Bash(ssh *'maas * ipranges *)
      Bash(ssh *"maas * ipranges *)
    NOTE A GAP IN THOSE ASK RULES, measured by consequence this session: they pin the
    `maas admin` profile and the `ssh voffice1 "..."` double-quoted form. This
    session's MAAS SUBNET DELETES used `MAAS_PROFILE=vr1-dc0-region ... maas
    vr1-dc0-region subnet delete` in SINGLE quotes and therefore did NOT match
    `Bash(ssh voffice1 "maas admin subnet *)`. Four destructive deletes ran without
    hitting an ask rule. This is the SAME rule-fails-to-MATCH class recorded on
    2026-07-30 (the DHCP cutover), and it is now recorded as recurring rather than
    one-off. The deletes were separately operator-approved, so nothing bypassed
    consent -- but the GATE did not fire, and that is the finding.

G2. `--diff=none` DOES NOT MEAN "DOWNLOAD EVERYTHING", AND THE MIRROR IS INCREMENTAL.
    grep "diff=none": 3 hits, all either the flag itself (dc-mirror.sh:187,193) or a
    passing mention; NO hit explains the semantics.
    MEASURED this session from the sync journal:
      routine daily run   ubuntu leg  1277 kiB
      the failing run     ubuntu leg  2867 kiB (313s, of which 300s was one timeout)
      UCA leg, every run  15 kiB
      on-disk             ubuntu 952 G, cloud-archive 342 M
      the 1048 MiB outlier (2026-07-31) = the day jammy-backports was ADDED to the
      suite list by operator ruling; adding a suite pulls its content ONCE.
    `--diff=none` disables PDIFFS -- the incremental-patch mechanism for INDEX files
    -- so debmirror fetches each Release/Packages/dep11 index in full every run. The
    POOL sync is still differential throughout. So a re-trigger costs seconds and
    single-digit MB, not a 950 G pull.
    WHY IT MATTERS: someone reading the flag name could refuse to re-trigger a sync
    believing it means a full re-download, or could budget hours for it.

G3. LWP SYNTHESISES HTTP 500 FOR CLIENT-SIDE FAILURES -- IT IS NOT A SERVER 500.
    grep "synthesises 500": 1 hit, in this session's own root-cause capture only;
    grep "synthesizes 500": 0 hits. Not on any DURABLE surface (platform-traps).
    debmirror's `500 read timeout` is LWP reporting ITS OWN timeout
    (/usr/bin/debmirror:629, `our $timeout=300;`), not archive.ubuntu.com returning
    an error. Reading it as a server-side 500 sends the investigation upstream for
    the wrong reason, which is exactly what happened here before it was corrected.
    Belongs in platform-traps' verbatim-error index. LOGGED, NOT FIXED (hard rule 1).

G4. dc1's GUA CARVE IS INCOMPLETE, AND IT IS A dc1 BLOCKER NOT JUST A TOOL FIXTURE.
    grep "f03:20" / "dc1.*GUA.*incomplete": hits only inside this session's own
    changelog item 10 and CURRENT-STATE, i.e. recorded as the REASON for a tool
    guard rather than as a dc1 WORK ITEM.
    MEASURED: only FOUR rows exist under `2602:f3e2:f03::/48`, all provider-public.
    No `:f03:20::/64`, no `:f03:21::/64`. So for dc1, D-139 steps 1 and 2 have NOT
    been run. Anyone reaching dc1's Stage 5 must run `d139-gua-carve.py --dc vr1-dc1
    --commit` (and the MAAS half) BEFORE step 6 -- the step-6 tool now refuses, so
    the failure is loud, but the WORK is unregistered.

G5. THE STEP-6 END STATE IS NOT RE-DERIVABLE FROM THE CARVE TOOL'S REPORT.
    grep "counts existence, not status": 2 hits, both this session's own records.
    `d139-gua-carve.py --dc vr1-dc0` STILL reports `RETIRE-REPORT 9` and `dependent
    objects ... 26 ip-address(es)` AFTER step 6 completed successfully. That is
    correct -- the rows still EXIST, deprecated not deleted, per the ruling -- but a
    future session running the carve tool to check progress will read it as "step 6
    never ran". The carve tool has no status awareness and was not extended (hard
    rule 1). A `--commit`-less step-6 run is the correct instrument: it reports
    `CREATE 0 | ALREADY 26 | DEPRECATE-ADDR 0 | DEPRECATE-PFX 0`.

G6. NO AS-EXECUTED LOG COVERS THIS WINDOW.
    `run-logged.sh` was NOT used -- it needs an interactive shell. The newest file in
    ~/as-executed/ is 2026-07-30-stage5-dc0-deploy.log. This session executed LIVE
    MUTATIONS (26 apex creates, 35 apex deprecations, 4 MAAS subnet deletes, one
    mirror sync trigger, one rack file copy) with NO as-executed coverage. All
    evidence is in docs/audit/* captures and the commit messages. DECLARED here
    rather than left to be discovered -- a log that looks complete and is not is
    worse than one declaring its gap.

--------------------------------------------------------------------------------------
ALREADY ON SURFACE -- verified by grep, recorded for completeness
--------------------------------------------------------------------------------------

A1.  DOCFIX-207, preflight P6 plan count 50/97 -> 56/108 -- scripts/preflight.sh +
     changelog item 1 + CURRENT-STATE.
A2.  sweep F3 (`systemctl show` is not an existence check) -- platform-traps 5c.
A3.  sweep F4 (assert the harness CASE COUNT moved) + sweep F5 (two scripts probing
     one endpoint must share the probe definition) -- script-authoring.
A4.  sweep F1 CLOSED, rack deploy input re-staged, full 14-file enumeration --
     docs/audit/repo-stage-drift-dc0-20260802.txt + changelog items 4-5.
A5.  sweep F6 CLOSED PASS, maasdb proven uncorrupted, and F6's own diagnosis being
     wrong (role + transport, not confinement) --
     docs/audit/maasdb-pgdump-integrity-dc0-20260802.txt sections 7-11.
A6.  sweep F2 diagnosed R1, and the sweep's premise being wrong (it quoted the
     PASSING UCA leg) -- docs/audit/mirror-exitcode-diagnosis-dc0-20260802.txt.
A7.  The mirror root cause: archive.ubuntu.com backend 91.189.92.23 hangs on one
     object while serving its siblings; resolver rotates; 11/12 succeed --
     docs/audit/mirror-500-timeout-rootcause-20260802.txt.
A8.  Four GA-R5/operational rulings with exact utterances -- "Re-trigger the sync
     first, decide after"; "Root-cause the curl/debmirror anomaly first"; "Full step
     6 first, then deploy"; "Deprecate both, delete nothing" -- design-decisions.md
     + CURRENT-STATE. Plus the two approvals ("Queue up the MAAS half ... Go ahead
     with both now"; "Proceed with 1 and 2") in changelog items 11-12.
A9.  The step-6 tool, its adversarial review and all four DEFects --
     docs/audit/d139-step6-tool-review-20260802.txt + changelog item 10.
A10. Step 6 EXECUTED, 4 MAAS subnets deleted, 1 HELD on the juju-controller /
     region-VM hazard -- changelog item 11 + CURRENT-STATE.
A11. `retire-v6-ula` and the broken by-hand link check it caught -- changelog item
     12 + CURRENT-STATE + tests/dc-plane-ipam R1-R7.
A12. The preflight-P2 / phase4 machines-overlay asymmetry -- changelog item 5.
A13. SEC-029(3) recording ~/repo-stage as nine files when it is fourteen --
     changelog item 5.
A14. The netbox env FILENAME INVERSION (vr1-netbox-sandbox.env is the LIVE apex;
     vr1-netbox.env is the v1 reference) -- CURRENT-STATE:4638-4641, pre-existing.
A15. The DOCFIX decoy-token counter inflation, twice, and its correction --
     CURRENT-STATE + commit 93973b6.

--------------------------------------------------------------------------------------
THE FIVE STRUCTURAL SWEEPS
--------------------------------------------------------------------------------------

S1. GITIGNORED STATE. `.claude/settings.local.json` MODIFIED this session:
    allow=310 / ask=11 / deny=0. Verbatim ask rules and the broad-allow finding are
    in G1 above. This sweep file is the only recovery copy.
S2. DANGLING REFERENCES. Every docs/audit path cited by this session's commits
    resolves; the four new captures are committed
    (repo-stage-drift, maasdb-pgdump-integrity, mirror-exitcode-diagnosis,
    mirror-500-timeout-rootcause, d139-step6-tool-review).
S3. RULING FIDELITY. Four rulings + two approvals this session, each with its EXACT
    utterance quoted, dated, and -- for the two GA-R5 step-6 rulings -- committed
    and pushed BEFORE the dependent work began (934a1f0, 53aae78). None paraphrased.
    Both step-6 rulings were correctly classed OPS (GA-R3) rather than new D-numbers.
S4. AS-EXECUTED LOG. NOT USED. See G6 -- this window is uncovered and it is declared.
S5. CONTRADICTION DETECTOR.
    (a) The 2026-08-01 ordering ruling's stated premise ("the per-DC VIP overlays
        carry v6 VIPs in the ULA range") is FALSE as of 2026-08-02; the overlay was
        re-rendered onto GUA. Corrected in the 2026-08-02 ordering ruling itself
        rather than left to contradict silently.
    (b) The step-6 amendment first said the GUA records would be `status=active`;
        MEASURED, the originals are `reserved`. Corrected in both design-decisions
        and CURRENT-STATE under GA-R1 C2.
    (c) "The gate is FLAKY, not stuck" (written mid-session about the mirror) does
        NOT extend to the dep11 failure, which is persistent-per-backend. Withdrawn
        and corrected in commit 4f65c09 rather than left standing.
    (d) "Every action this tool takes is reversible" (step-6 docstring) was wrong for
        the 26 CREATES. Corrected in the docstring and in the presentation.
    (e) "Proven safe twice" (the four MAAS deletes) was HALF FALSE -- the link half
        of that proof was an inert checker. Corrected in changelog item 12 and
        CURRENT-STATE, with the safe OUTCOME recorded separately from the unsound
        VERIFICATION.