Session ledger -- in-flight work continuity record

Purpose. Long ops sessions on this cloud routinely exceed a single context window and get COMPACTED (sometimes several times). Anything living only in the chat scrollback is lost at compaction. This ledger is the durable, committed record of what is IN FLIGHT, so any session -- after a compaction, or a fresh one -- can resume without losing pending work.

How to use it (standing practice).

At session start: read this ledger AND run bash scripts/ledger-scan.sh. Reconcile.
ledger-scan.sh is the DRIFT CHECK -- it derives the open-work it reliably can (PROPOSED/OPEN decisions, OPEN security rows, next-free numbers) straight from the repo. This narrative must not claim CLOSED anything the scan shows OPEN, nor omit what it surfaces.
Update this ledger at every deliverable/commit -- it is a standing deliverable like the changelog. The changelog says what CHANGED; this ledger says what is still OPEN.
The machine-derived block below is seeded from a scan; re-run the scan and re-seed rather than editing it by hand.

SINGLE STREAM (collapsed 2026-07-13). This ledger previously carried three parallel, separately-owned stream sections (main-chat, jumphost, shared) plus ~30 append-only session narratives. Those streams are CLOSED and reconciled into the one list below. There is now ONE stream. Do not re-introduce per-stream sections.

Where the history went. The 2,189-line session-by-session narrative is NOT lost -- it is in git history (the parent of the collapse commit) and, in durable form, in the 65 docs/changelog-*.md files, docs/design-decisions.md, and the incident reports. This ledger deliberately carries only what is still OPEN, plus the facts that would otherwise be lost because they live nowhere else.

Machine-derived (re-seed from `scripts/ledger-scan.sh`; do not hand-edit)

Re-seeded from the 2026-07-21 evening scan (post-stage-3-close). Re-run bash scripts/ledger-scan.sh to refresh.

PROPOSED / OPEN decisions: D-068 (Vault substrate hardening, Roosevelt), D-071 (routine update cadence + Juju controller patch policy), D-129 (OPNsense edge plugin/add-on base profile -- OPEN / partially ruled, four sub-decisions), D-131 (node-facing DNS strategy for rack-only controllers -- PARTIALLY RULED: sub-1 ruled + delivered 2026-07-21, sub-2..4 open; now surfaced by the scan itself after the PARTIAL fix). Status lines in docs/design-decisions.md are the only ruling authority.
OPEN security rows: 10 open per bash scripts/ledger-scan.sh (re-verified at stage close; SEC-013 surface NARROWED 2026-07-21, row still open for rotation). The SEC register of record is docs/security-ledger.md; row-level dispositions live THERE only (GA-R4 amendment F3) -- this block carries pointer + count, never rows.
Next-free numbers: D = 132, DOCFIX = 198, BUNDLEFIX = 052.
Standing numbering rule: never write an identifier-shaped token (D-/DOCFIX-/BUNDLEFIX-NNN) ABOVE the real high-water mark anywhere in docs/ or runbooks/ prose -- historically a decoy token in prose inflated the next-free counter (hardened in DOCFIX-174); the authoring discipline stands regardless.
ledger-scan D-115 false-positive: RESOLVED. The scan now keys on the LAST **Status:** line per ## D-NNN: block (see scripts/ledger-scan.sh awk), not arbitrary body prose, so D-115 (ADOPTED) no longer shows as PROPOSED/OPEN. The general hygiene -- trust the Status line over body text -- still holds.

ROTATED 2026-07-19 (GA-R4 rule 6 -- the one-time rotation; F1 cap now enforceable)

The pre-rotation bodies (~1080 lines: Live state, OPEN WORK VR1/VR0, NetBox write-path bugs, PINNED rulings, standing lessons, state facts, project- completion, NetBox import narrative) moved VERBATIM to docs/archive/session-ledger-rotated-20260719.md. Standing lessons + VR0 state facts were ROUTED to durable homes first (platform-traps already carried most; juju format=line -> appendix-A; guard discipline -> operating-discipline; VR0 cloud facts -> maas-as-built-reference.md). Open work is machine-derived above + CURRENT-STATE.md; do not re-grow bodies here -- sessions append BOUNDED summaries only (15-line cap).

Retained compact blocks (still-live obligations without another home yet):

NetBox write-path bugs (2026-07-14 adversarial review; LOGGED, NOT FIXED): importer/write-guard defects recorded in the rotated body ("OPEN -- NetBox WRITE-PATH BUGS" section) -- route to a findings doc or fix before the next NetBox write campaign.
Project-completion (after D-011 passes): consolidate the 10 per-phase do-documents into a v1 deploy runbook; flip repo PRIVATE (SEC-004); revoke/rotate SEC-005/006/007; v2-deferred: GitBucket SSH, IPv6 dual-stack, NetBox import bundle.

SESSION CLOSE 2026-07-18 -- grounding audit (Phases 1-4); GA-R4 bounded summary

Audit Phases 1-4 COMPLETE, each externally reviewed; FULL FREEZE upheld (zero pre-audit surfaces edited).
Phase 1: record-audit extractor + inventory (12 contradiction groups); outer plan CAPTURED 7/2/7; GA-F01..F15.
Phase 2: docs/CURRENT-STATE.md authored -- the single status authority; operator SIGNED (G11, section 11).
Phase 3: fresh-agent grounding test, 3 probes 21/21 PASS; hole H1 amended into the G9 row.
Phase 4: GA-R1..R7 + stage-status vocabulary (Option A + H1) ALL RATIFIED, utterances quoted (docs/audit/ga-rulings.md).
Phase 5 NOT opened: sweep plan DRAFTED (docs/audit/phase5-sweep-plan.md, commit 687dfa8) awaiting external review.
DC0 apply remains STOPPED (G9); D-130 unruled; expected plan triple UNRESOLVED (CURRENT-STATE section 5).
Next session: FRESH operator session, auto-memory ON (GA-R7 rule 8); read sweep plan + CURRENT-STATE.md first.
Status lives ONLY in CURRENT-STATE.md (GA-R1); this entry is narrative + pointers, not status.
Full session body: docs/archive/session-20260718-grounding-audit.md (GA-R4 rules 1-2, first live compliance run).
GA-R4 F1 cap (<300 lines) not yet enforceable: the one-time rotation is Phase-5 Batch 4 (rule 6) -- noted, not skipped.
POST-CLOSE ADDENDUM (2026-07-19): sweep plan externally reviewed PASS; amendments S1-S5 applied in a single commit (15ccfbd). Batch 0 was PRESENTED and HELD -- operator routed execution to the fresh session. Fresh session: read docs/audit/phase5-sweep-plan.md + docs/CURRENT-STATE.md, then gate Batch 0.

SESSION CLOSE 2026-07-19 -- GA Phase-5 sweep (Batches 0-6) + AUDIT EXIT (bounded, GA-R4)

All six sweep batches executed + closed in ONE session under per-batch operator gates.
Tooling: L10 status-coupling lint (WARN->FAIL), SEC pointer+count scan, wrap-aware counters, vocab-keyed extractor + archive exclusion (operator-ruled). Gauntlet grew 69 -> 70 harnesses.
D-130 ADOPTED (a) + implemented + v7/v8-verified; G6 state surgery (operator-ruled); expected triple 6/0/6 recorded and re-verified twice (postG6 + phase6-exit captures).
Record fixes GA-F02..F05/F10..F12/F14..F16; H1 token migration; E1 gate-type tags; ARCH/OPS D-tags + D-129 split (operator-ruled); R3-F register fully dispositioned (S1).
Memory hygiene per provenance rulings (2 files removed, GA-F16 found+fixed); ledger rotated 1187->131; 96 changelogs + 25 docs consolidated to archive; top-level docs/ = 16.
Skill swept against ratified GA-R1..R7 (checklist committed). Exit runs 1-6 ALL PASS incl. fresh probe trio 21/21 (7/7 on all three); operator RE-SIGNED CURRENT-STATE 2026-07-19.
AUDIT EXITED: G3 + G11 CLOSED, FREEZE lifted, G9 OPEN (gated logged apply, G8 first).
Full body: docs/archive/session-20260719-phase5-sweep.md. Status lives ONLY in CURRENT-STATE.md.

SESSION 2026-07-19 (continued) -- DC0 deploy, step A (logged: dc0-deploy)

Same session continued past the audit close at operator direction (skill re-invoked; fresh-session hygiene noted and waived by the operator's go).
G8 passed in-session; validate PASS; pre-apply capture == 6/0/6; saved plan applied: 6/0/6 exact.
vvr1-dc0 RUNNING (108 vCPU / 416 GiB / autostart off); guests untouched; convergence = no diff.
Next: step B (bootstrap vvr1-dc0: site-headend-install --role rack --host-nodes + SEC-010 check, OPNsense base prep ON the VM) -- needs transit reachability + the dc0 key (D-126 DC rows).
PAUSED at the A/B boundary (2026-07-19): operator moving to a fresh session. Step B's measured starting facts: vvr1-dc0 NICs = mesh-vr1-dc0-office1 + vr1-dc0-uplink (NO transit NIC yet -- measure how reach works before wiring ssh; D-124 tfvars local+present; dc0 key minted). Fresh session: CURRENT-STATE first, then resume at runbook step B in the dc0-deploy logged window (same-day log appends).

SESSION CLOSE 2026-07-21 -- commissioning diagnosis + repair (logged: ops-commissioning-diag; bounded, GA-R4)

Session DISCONNECTED before its bookend; entry landed same-day by the successor session after read-only re-verification (9/9 Ready, forwarder active+enabled, dhcpd both controllers).
G10 commissioning RESOLVED: ALL 9 DC0 nodes Ready, shapes exact to D-121 Option C.
Two stacked faults, both measured: (1) the 2026-07-20 in-place apply regenerated all 9 node NIC MACs -- MAAS records repaired in place (operator-ruled), read-back 9/9; (2) MAAS 3.7 rack-only agent resolver SERVFAILs everything on an internet-isolated rack -- dc0-node-dns dnsmasq forwarder workaround (operator-ruled), live and proven (canary Ready ~3 min). LP report queued.
D-131 PROPOSED (rack-only node DNS, Roosevelt-relevant); SEC-014 OPENED (rack cluster secret exposure); committee record closed by addendum. Phase-7 tag cleanup verified done.
QUEUED delivery: node-vm MAC pinning + harness; forwarder + rack-legs repo persistence; platform-traps + appendix-A entries; stale-pod cleanup at stage close (with SEC-013).
REMAINING in G10: netem step E only (netem-link passwordless-sudo blocker).
Details: docs/changelog-20260721-commissioning-diag.md + docs/audit/commissioning-diag-20260721.txt. Status lives ONLY in CURRENT-STATE.md.

SESSION CLOSE 2026-07-21 -- close-and-delivery session (bounded, GA-R4)

Session DISCONNECTED before its bookend (second same-day disconnect); all seven deliverable commits were already pushed (8b3adb3..8a9c04c), so only this entry + the netem-install record were outstanding. Landed by the successor session after read-only re-verification.
Delivered: predecessor (ops-commissioning-diag) close landed; node-vm MAC pinning (54 measured pins) + power-ownership guard ruled and APPLIED on voffice1 (0/9/0 exact, converged zero diff); D-131 sub-1 RULED + dc-rack-net.sh shipped AND installed on the rack (check 10/10, SOA probe); incident docs (appendix-A x2, platform-traps 1e corollary, LP draft -- operator to file); step-E netem sudo RULED (scoped NOPASSWD) + fragment shipped (gauntlet 75 ALL GREEN).
Post-disconnect: operator ran the netem-tc install interactively; successor VERIFIED read-only (0440 root:root, byte-identical, sudo -n -l grant checks exit 0 -- docs/audit/netem-sudo-install-20260721.txt). Step E is now UNBLOCKED (gated run pending).
Details: docs/archive/changelogs/changelog-20260721-close-and-delivery.md. Status lives ONLY in CURRENT-STATE.md.

SESSION CLOSE 2026-07-21 -- STAGE 3 CLOSED + MERGED (third session; bounded, GA-R4)

Bookend landed at stage close while the session may continue (two same-day disconnects argued for durable-early); any further work appends a POST-CLOSE ADDENDUM (07-18 precedent).
Step E netem DONE (targeted apply at an operator-ruled 1/1/0 STOP; placeholder live on virbr5) -> G10 CLOSED. G16 opened for the office1 channels residual, then CLOSED same-day (operator-ruled state surgery; outer plan back to ZERO DIFF).
Ruling 1 retire-fully EXECUTED: vr1-dc0-maas removed, stale pod + SEC-013 key file + tfstate deleted. INCIDENT: the pod delete cascaded to the 9 machine records (association check ran post-delete -- owned); recovered same-hour via re-enlist/power/commission, 9/9 Ready, shapes exact, NEW MAAS hostnames. Appendix-A entry shipped (check pod machine list BEFORE delete).
Also: ledger-scan PARTIAL fix, DOCFIX-197, D-103/D-123 amendments, GA-R7 memory review.
STAGE 3 CLOSED (operator-ruled): consolidation + skill sweep + gauntlet 76 ALL GREEN; merge commit 8d0d155 on main; branch retired local+remote. Next stage branches off main.
Open queue unchanged: D-131 sub-2..4, SEC-014 rotation, D-068/D-071/D-129, G12 (dc1), G15.
Details: docs/changelog-20260721-netem-install-verify.md (top-level until this session ends). Status lives ONLY in CURRENT-STATE.md.