session-ledger summaries rotated 2026-07-27 (GA-R4 rule 3 / F1 -- oldest-first)
Moved VERBATIM from docs/session-ledger.md at the Stage 4 close, to restore the 300-line cap (the live ledger was 317). These are the three 2026-07-23 closed-session summaries -- the oldest still-live ones. Each still points at its own archived full body; only the summaries moved. Status is in docs/CURRENT-STATE.md ONLY; this file is history.
SESSION CLOSE 2026-07-23 -- G12 dc1 edge->commission + CLOSE + MERGE (bounded, GA-R4)
- Resumed from the 07-22 handoff (edge at login prompt); drove dc1 to a commissioned fleet, every mutation operator-gated in
manual permission mode (auto-mode classifier blocks remote sudo shapes instead of prompting -- manual mode is the fix; noted).
- Edge: D-112(c) console bootstrap (payload needed util.inc/shell_safe -- dc0 lesson iv the .b64 lacked) + key auth + D-113(a2) API mint (transient post-restart-sshd scp, ssh-pipe workaround) + v4 addressing WAN 172.30.3.2 / LAN 10.12.64.1 (egress 0%).
- dc-rack-net dc1 arm (harness 18/18) + install (forwarder answers maas-internal); region MAAS D-120 range + D-131 dns + DHCP primary_rack=nmpcq4 (dhcpd verified running).
- SEC-016 RULED "Mint a dedicated dc1 power key" (per-DC isolation) + wired (script=svc key, MAAS snap=dedicated key). Commissioning ALL 9 READY ~3.5 min, shapes exact D-121 Option C -- dc0's two stacked faults pre-empted by pinned MACs + forwarder.
- G12 CLOSED: gauntlet 76 GREEN, repo-lint 0-fail, consolidation + skill sweep (per-DC power key invariant) + GA-R7 memory review; MERGED to main (merge commit a5c0a49), branch retired.
- Open after: SEC 12 rows (incl. SEC-015/-016); 3 findings (util.inc, scp readiness, snap-key refresh fragility); D-068 item1, D-131 sub-4, D-132 pinned. Next stage branches off main.
- Full body: docs/archive/changelogs/changelog-20260723-g12-dc1-edge.md. Status ONLY in CURRENT-STATE.md.
SESSION CLOSE 2026-07-23 -- Stage 4 OPEN + carve + mirrors (bounded, GA-R4)
- Stage 4 OPENED (branch dc-dc-stage4-phase3-maas-deploy); discovery captured; D-133 (flat per-NIC carve; hw-faithful NICs next deployment) + D-134 (+amendment: contiguous bands, Option B swap) ADOPTED, utterances quoted.
- CARVE EXECUTED both DCs (logged stage4-carve): ranges .201-.254, 10 fabrics, 90 NIC re-homes, subnets+spaces, 18 nodes statics + br-ex; all Ready; capture committed.
- Deploy model RULED: Ready handoff (DOCFIX-200 -- runbook Step 4 would have broken Stage 5); jammy images synced; per-DC tags applied 9+9.
- Mirror: exception REJECTED -> D-135 ADOPTED; dc-mirror.sh shipped (19/19, gauntlet 77); INSTALLED both racks; initial syncs RUNNING at last check (hours; verify last-sync.status before citing). INCIDENT: dc1 edge pf never regenerated post- addressing -- filter reload fixed; appendix-A + DoD + script amendment QUEUED.
- OWNED: pipe-masked L10 lint FAIL (repaired); dc0-only egress probe wrongly assumed symmetric (item 9).
- Delivery batch LANDED before close (item 11): lib-hosts VR1 arms populated (tofu-name keys, pinned MACs, D-134 octets, host_sysid_by_bootmac) + D-133 guards in the two VR0 flow scripts + appendix-A pf entry + DoD items 8-9 + item-4 range fix; dc-selector 48, gauntlet 77 GREEN. At close: both syncs RUNNING (dc0 13G / dc1 15G pulled).
- OPEN in-stage for the NEXT session: verify last-sync.status OK both racks (this session's watcher dies with it -- check at open); mirror node-side reachability gate; set-interface-v4 reload amendment (queued OPTION, unruled); local permission-rules prune (
Bash(ssh *) flag); then the stage close-out set (consolidation, skill sweep, GA-R7 memory review, final gauntlet, operator-gated merge).
- Details: docs/archive/changelogs/changelog-20260723-stage4-open.md. Status ONLY in CURRENT-STATE.md.
SESSION CLOSE 2026-07-23 -- queue pass + D-068 rulings (bounded, GA-R4)
- Queue fully processed. Repo: 5 script/harness fixes (prep-image bash -s; headend hints + idempotent sec010 nft + staging dir; apikey readiness/retry) + DOCFIX-198 (Steps 9-10 superseded; DC standup DoD) + DOCFIX-199 (D-112(c) payload spec). Gauntlet 76 ALL GREEN.
- Live (logged ops-sec010-reassert, all operator-approved): SEC-010 files idempotent on all 3 hosts (double-restart proof); G13 CLOSED -- office1 qga channel 0/1/0 saved-plan apply (guest-ping proven), edge 26.7 -> 26.7.1, os-iperf in after a measured refusal; outer plan re-converged zero diff. vr1-dc0-maas cache residue deleted (association-checked FIRST).
- D-068 item 1: plan DRAFTED then Q1 (rehearsal EOL acceptance, 1b), Q2 STRUCTURE (Roosevelt on 1.8 + funded remediation track), Q3 (monthly checks -> ops-update-procedure 0c) ALL RULED -- individually confirmed after a volunteered batch answer (GA-R5 kept). Remainder: Q2 path at Roosevelt design time. NetBox residue -> docs/netbox-write-path-findings.md.
- Owned: one capture commit pushed with a pipe-masked L10 lint FAIL; repaired same-hour.
- GA-R7 memory review: no changes. AT CLOSE: ledger-scan FALSE-CLOSE defect found (tail-appended detached amendments hijack the preceding decision's last-status -- D-132 dropped); FIXED number-keyed + regression cases (48/48), scan re-verified, machine block re-seeded.
- Details: docs/archive/changelogs/changelog-20260723-queue-pass.md. Status ONLY in CURRENT-STATE.md.