Session ledger -- in-flight work continuity record

Purpose. Long ops sessions on this cloud routinely exceed a single context window and get COMPACTED (sometimes several times). Anything living only in the chat scrollback is lost at compaction. This ledger is the durable, committed record of what is IN FLIGHT, so any session -- after a compaction, or a fresh one -- can resume without losing pending work.

How to use it (standing practice).

At session start: read this ledger AND run bash scripts/ledger-scan.sh. Reconcile.
ledger-scan.sh is the DRIFT CHECK -- it derives the open-work it reliably can (PROPOSED/OPEN decisions, OPEN security rows, next-free numbers) straight from the repo. This narrative must not claim CLOSED anything the scan shows OPEN, nor omit what it surfaces.
Update this ledger at every deliverable/commit -- it is a standing deliverable like the changelog. The changelog says what CHANGED; this ledger says what is still OPEN.
The machine-derived block below is seeded from a scan; re-run the scan and re-seed rather than editing it by hand.

SINGLE STREAM (collapsed 2026-07-13). This ledger previously carried three parallel, separately-owned stream sections (main-chat, jumphost, shared) plus ~30 append-only session narratives. Those streams are CLOSED and reconciled into the one list below. There is now ONE stream. Do not re-introduce per-stream sections.

Where the history went. The 2,189-line session-by-session narrative is NOT lost -- it is in git history (the parent of the collapse commit) and, in durable form, in the 65 docs/changelog-*.md files, docs/design-decisions.md, and the incident reports. This ledger deliberately carries only what is still OPEN, plus the facts that would otherwise be lost because they live nowhere else.

Machine-derived (re-seed from `scripts/ledger-scan.sh`; do not hand-edit)

RE-SEEDED 2026-08-02 from bash scripts/ledger-scan.sh. The prior seed was the 2026-07-27 STAGE 4 CLOSE (confirmed unchanged 2026-07-29) and had gone STALE by seven SEC rows and three D numbers -- the per-session summaries below carried the current figures while this block did not, which is the one thing this block exists to prevent. Re-run the scan to refresh.

PROPOSED / OPEN decisions (3): D-068 (Vault substrate hardening, Roosevelt -- sole remainder is Q2 path selection at Roosevelt Vault design time), D-131 (node-facing DNS for rack-only controllers [ARCH] -- sub-4 open + the pinned DNS architectural review), D-132 (Roosevelt per-DC MAAS topology [ARCH], operator-pinned to the next deployment). D-136 was ADOPTED 2026-07-27 at option (D) and correctly drops off the scan, as D-137 did before it (was 4). Status lines in docs/design-decisions.md are the only ruling authority.
OPEN security rows: 28 per bash scripts/ledger-scan.sh (was 21 at the last seed). The seven added since, verified against the register: SEC-026..-029 all 2026-07-30 (a MAAS admin-scoped key going DC-resident under D-138; the per-DC region credential class; the per-DC juju service credential, which made the RACK credential-bearing for the first time; and the Octavia PKI overlay's residency on the dc0 rack), SEC-030 2026-07-31 (local permission rules bypassing the committed ask-gating -- an ACCEPTED, recorded posture), then SEC-031 and SEC-032 on 2026-08-02 -- SEC-031 is the live one: the dc1 edge lost its FreeBSD user database to fsck and runs with NO pf ruleset, i.e. an open router serving its GUI. The SEC register of record is docs/security-ledger.md; row-level dispositions live THERE only (GA-R4/F3) -- this block carries pointer + count, never rows.
Next-free numbers: D = 141, DOCFIX = 208, BUNDLEFIX = 053. D moved 138 -> 141 as D-138 (cloud-facing client moves into the DC), D-139 (IPv6/GUA plane carve) and D-140 (tofu manages juju, PINNED) were assigned. DOCFIX-206 and -207 are both assigned: 206 was Step 2.0's non-region-scoped credential gate (2026-07-31); 207 is this session's preflight P6 plan-count correction, so ledger-scan's derived next-free of 207 is superseded by 208 until the next scan. 204 remains 2026-07-27's stale "NTP from edge" Stage-4 gate bullet.
Gates: G17 OPENED 2026-07-27 by operator ruling (node-side artifact reachability split out of Stage 4; the gate table in docs/CURRENT-STATE.md is the authority).
Standing numbering rule: never write an identifier-shaped token (D-/DOCFIX-/BUNDLEFIX-NNN) ABOVE the real high-water mark anywhere in docs/ or runbooks/ prose -- historically a decoy token in prose inflated the next-free counter (hardened in DOCFIX-174).
ledger-scan D-115 false-positive: RESOLVED. The scan keys on the LAST **Status:** line per ## D-NNN: block, not arbitrary body prose. The general hygiene -- trust the Status line over body text -- still holds.

ROTATED 2026-07-19 (GA-R4 rule 6 -- the one-time rotation; F1 cap now enforceable)

The pre-rotation bodies (~1080 lines: Live state, OPEN WORK VR1/VR0, NetBox write-path bugs, PINNED rulings, standing lessons, state facts, project- completion, NetBox import narrative) moved VERBATIM to docs/archive/session-ledger-rotated-20260719.md. Standing lessons + VR0 state facts were ROUTED to durable homes first (platform-traps already carried most; juju format=line -> appendix-A; guard discipline -> operating-discipline; VR0 cloud facts -> maas-as-built-reference.md). Open work is machine-derived above + CURRENT-STATE.md; do not re-grow bodies here -- sessions append BOUNDED summaries only (15-line cap).

Retained compact blocks (still-live obligations without another home yet):

NetBox write-path bugs: ROUTED 2026-07-23 to docs/netbox-write-path-findings.md (the durable home; the rotated-body section is history). Open residue: dumper blind spot + duplicate-CIDR collapse unfixed, hardened fidelity re-run + fix re-verification owed -- ALL gated on the next NetBox WRITE campaign, none current.
Project-completion (after D-011 passes): consolidate the 10 per-phase do-documents into a v1 deploy runbook; flip repo PRIVATE (SEC-004); revoke/rotate SEC-005/006/007; v2-deferred: GitBucket SSH, IPv6 dual-stack, NetBox import bundle.
Deployment-close consideration review -- tenant-onboarding items (PINNED 2026-07-21, operator-directed): the committee review of Chat's three tenant-onboarding inserts refuted each as written but identified corrected residue; the operator DEFERRED all of it to an end-of-deployment review (posture and end goals are shifting this deployment -- reconsider fit then; nothing lands before that review). Items: (1) appendix-A symptom entry for sub-floor OR nonexistent flavor -> cluster-create rejection (capi-helm thresholds are CONFIG OPTIONS, defaults 2 vCPU / 2048 MB RAM, as-built sets neither; the RAM error also fires for mistyped flavors; command shape --public -f json, never the deprecated --long -- archive R9); (2) appendix-A entry for tenant-net-cannot-reach-public-keystone -> nodes register but stall uninitialized (auth_url in the per-cluster clouds secret is hardcoded PUBLIC at capi-helm 1.4.0; as-built carries no interface key), pointing at the phase-08 D-011.3 probe, plus a per-DC precondition line in dc-dc-phase6 Step 12; (3) tenant contract hardening list: PROPOSED -svc-only password neutralization (admin-rotate to discarded value; keystone lock_password blocks password CHANGE, not auth; NEVER lock -cluster -- it keeps PASSWORD auth permanently per D-066); (4) flavor catalog marking = commercial catalog policy, operator prioritization only. RE-VERIFY every citation at review time -- the full verdict lives in the 2026-07-21 disconnected-session transcript, not in a repo surface.

ROTATED 2026-07-26 (GA-R4 rule 3 / F1 -- oldest-first, cap restored)

The eight oldest closed-session summaries (2026-07-18 through the fifth 2026-07-21 session) moved VERBATIM to docs/archive/session-ledger-rotated-20260726.md. The live ledger was 413 lines against the 300-line cap -- a breach the 2026-07-25 close recorded as OWED. Each rotated summary still points at its own archived full body; only the summaries moved. Sessions from 2026-07-22 onward remain live below.

ROTATED 2026-07-27 (GA-R4 rule 3 / F1 -- oldest-first, cap restored at the Stage 4 close)

The three oldest live summaries (all 2026-07-23: G12 dc1 edge->commission+merge, Stage 4 OPEN+carve+mirrors, queue pass + D-068 rulings) moved VERBATIM to docs/archive/session-ledger-rotated-20260727.md. The live ledger was 317 lines against the 300-line cap. Sessions from 2026-07-24 onward remain live below.

ROTATED 2026-07-27 (second pass, GA-R4 rule 3 / F1 -- cap restored at the grounding-audit close)

The oldest remaining live summary (2026-07-24, caveman guardrails + DC1 proxy-build start) moved VERBATIM to docs/archive/session-ledger-rotated-20260727.md. The live ledger was 305 lines against the 300-line cap. Sessions from 2026-07-25 onward remain live below.

ROTATED 2026-07-27 (third pass, GA-R4 rule 3 / F1 -- cap restored at the grounding-audit close)

The TWO oldest remaining live summaries -- 2026-07-25 handoff-pack execution + recon + Chat D-136 coupling, and 2026-07-25 MAAS admin-account recovery (SEC-020) -- moved VERBATIM to docs/archive/session-ledger-rotated-20260727.md. The live ledger was 321 lines against the 300-line cap; one pass left it under. (This paragraph was left MANGLED by an earlier edit -- a sentence broke off mid-number and ran into a stray fragment of the 2026-07-25 MAAS-admin-recovery summary. Found by a 2026-07-29 sweep and repaired here; that summary's full body is at docs/archive/changelogs/changelog-20260725-maas-admin-recovery.md.)

ROTATED 2026-07-27 (fourth pass, GA-R4 rule 3 / F1 -- cap restored at this close)

The oldest remaining live summary ("POST-CLOSE ADDENDUM 2026-07-26 -- D-137 ADOPTED (GA-R4; 07-18/07-21 addendum precedent)") moved VERBATIM to docs/archive/session-ledger-rotated-20260727.md. The live ledger was 316 lines against the 300-line cap.

ROTATED 2026-07-29 (GA-R4 rule 3 / F1 -- oldest-first, cap restored at this close)

The TWO oldest live summaries -- 2026-07-26 (D-137 build + committee audit + remediation) and 2026-07-27 (creds consolidation + the STAGE 4 CLOSE-OUT) -- moved VERBATIM to docs/archive/session-ledger-rotated-20260729.md. The live ledger would otherwise have been 321 lines against the 300-line cap once this session's bookend was appended. Sessions from the 2026-07-27 grounding audit onward remain live below.

ROTATED 2026-07-30 (GA-R4 rule 3 / F1 -- oldest-first, cap restored at this close)

The TWO oldest live summaries -- the 2026-07-27 STAGE-5 GROUNDING AUDIT close and its 14-RULINGS post-close addendum -- moved VERBATIM to docs/archive/session-ledger-rotated-20260730.md. The live ledger stood at exactly 300 lines, so the next append would have breached the cap. Rotated HERE rather than leaving it owed, because the next session is directed straight at the juju deployment. Sessions from the 2026-07-27 Phase-0 close onward remain live below.

ROTATED 2026-08-02 (b) (GA-R4 rule 3 / F1 -- cap restored at this close)

The TWO oldest live summaries (2026-07-30 part 3 -- Stage 5 opened, three bootstraps, D-138 + D-132 ruled; and part 4 -- dc0 region topology built, cutover blocked on a permission wall) moved VERBATIM to docs/archive/session-ledger-rotated-20260802b.md. The live ledger stood at 294 lines and this close's summary would have breached the cap.

ROTATED 2026-08-03 (GA-R4 rule 3 / F1 -- cap restored at this close)

The oldest live summary (2026-07-30 part 5 -- dc0 migrated to its own MAAS region, 10/10 Ready, four named gates green) moved VERBATIM to docs/archive/session-ledger-rotated-20260803.md. The live ledger would have breached the 300-line cap with this close's summary.

SESSION CLOSE 2026-07-31 -- dc0 node carve COMPLETE, controller BOOTSTRAPPED, deploy blocked on prefer-ipv6 (bounded, GA-R4)

Branch dc-dc-stage5-preconditions, 11 commits pushed (a859352..80510f4). NO stage opened/closed. Scan: 3 decisions, SEC 25 (SEC-028, -029 opened), D 139 / DOCFIX 207 / BUNDLEFIX 053.
scripts/dc-node-carve.sh SHIPPED (harness 48/48) -- the last no-tool gap. dc0 v4 carve COMPLETE 10/10, named gate 134/0, and the diff against the pre-migration capture is EMPTY: every node's six legs match Office1 address for address. v6 carve 54/54; the controller's own v6 restored separately (the tool walks only the nine tagged role nodes).
>>> JUJU CONTROLLER LIVE: vr1-dc0-controller, active/idle. <<< FOURTH attempt, first success; the three failures were each a real defect one layer deeper, closed by D-138, the under-carve fix, and D-132 q1 respectively. Agent binaries resolved on attempt 1.
Model vr1-dc0 created, spaces gate PASS (6/6), apt-mirror set to the DC mirror -- key VERIFIED against the live client, not guessed; URL asserted on dists/jammy/Release content.
2 RULINGS (GA-R5, quoted): "Mint juju-vr1-dc0 on the new region (Recommended)"; "Copy dc0's PKI overlay to the dc0 rack (Recommended)". Both registered BEFORE use -- SEC-028 (juju service credential; vm-secret-locations gained its first rack rows) and SEC-029 (PKI overlay residency). Key proven to AUTHENTICATE before bootstrap, never printed, sha256-verified at every hop.
DOCFIX-206: Step 2.0's credential gate was NOT region-scoped, and I hit it -- credential listed, folder present, user existed, all in OFFICE1. The SKIP branch would have led to an auth failure that reads as a network fault.
>>> BUNDLE DEPLOY ATTEMPT 1 FAILED; NOTHING IS HALF-APPLIED (model measured EMPTY). <<< unknown option "prefer-ipv6" on barbican. The dry-run PASSED and the deploy did not -- --dry-run does not validate config option NAMES. Measured plan is 56 apps / 108 relations, not the 50/97 preflight still quotes.
Root cause measured against CHARMHUB's own schema: 7 of 13 VIP charms declare prefer-ipv6, 6 do not, and barbican never had it at ANY channel -- so R2's uniform application was never valid. RULED: "Research what those 6 charms do with v6 VIPs first (Recommended)" -- overlay NOT edited, R2 NOT amended. STAGE 5 IS BLOCKED ON THAT RESEARCH.
FINDING, logged not fixed: preflight.sh is REGION-BLIND -- 19 false negatives for dc0 ("not enrolled in MAAS") because it defaults to the Office1 profile. MAAS_PROFILE=vr1-dc0-region drops them to zero. A blanket refusal would be WRONG: dc1's nodes still live in Office1.
Mutation testing earned its cost again: a first pass proved less than it looked (deleting an assertion's MESSAGE only proves it exists), and the sharper pass found the br-ex static compare could not fail. Added a fixture, re-proved the kill.
OWNED -- three instrument errors, all one shape: a capture parsed at the wrong field, a systemctl poll racing an async start, and a charmhub query with a wrong field name returning a uniform "no config" across 13 charms. The last two were caught by the SHAPE of the answer being implausible, not by discipline; that detector is now in auto-memory.
Gauntlet ALL GREEN (93); repo-lint 0 fail; creds-matrix 65/65. Permission allowlist +12 read-only rules (all pinned to check/verify/assert/plan subcommands).
NEXT: the prefer-ipv6 research, then re-deploy. Steps 1-3.5 and the controller are DONE and need no repeat. Body: docs/changelog-20260730-dc0-node-carve.md (11 items). Status ONLY in CURRENT-STATE.md.

ROTATED 2026-07-31 (GA-R4 rule 3 / F1 -- cap restored at this close)

The oldest closed-session summary moved VERBATIM to docs/archive/session-ledger-rotated-20260731.md. The live ledger stood at 295 lines and this close's summary would have breached the 300-line cap.

SESSION CLOSE 2026-07-31 -- Stage 5 dc0: prefer-ipv6 ruled, deploy succeeded then torn down for a clean rebuild (bounded, GA-R4)

Branch dc-dc-stage5-preconditions, 45 commits pushed. NO stage opened/closed. Scan: 3 decisions, SEC 26, D 139 / DOCFIX 207 / BUNDLEFIX 053.
8 RULINGS (GA-R5, all utterances quoted): prefer-ipv6 dropped from the six, then from ALL thirteen; P5's five new findings accepted; option D (explicit base on 56 apps AND a clean model); jammy-backports synced; UCA points in-DC; snaps get an in-DC forward proxy; and the MAAS proxy declined in favour of the owned one.
THE RESEARCH INVERTED ITS OWN PREMISE. Read from the charm ARTIFACTS: prefer-ipv6 is NOT what makes HAProxy bind :::port -- that is gated on the kernel disable_ipv6 sysctl, and pacemaker picks IPv6addr by family detection. Neither consults the option. vault ships no haproxy at all ([::]:8200 hardcoded).
>>> THE BUNDLE DEPLOYED (attempt 3, Deploy of bundle completed.) <<< after three failures each one layer deeper: unknown option; a missing policies/overrides.zip on the client host; and a bundle relying on default-base being deployable exactly ONCE.
FOUR ARTIFACT DEFECTS, each masked by the one before it (apt-get update --error-on=any fails on the first bad source): backports 404, upstream UCA unreachable, prefer-ipv6 fatal on containers with only link-local v6, and snaps with no path. Units tracked 22 -> 17 -> 4 -> 7-in-one-class.
THE v6 HALF IS CARVED AS ADDRESSES BUT NEVER MADE OPERATIONAL -- all six v6 plane subnets carry ZERO allocatable ranges, the rack has NO global v6 at all, the mirror does not answer on v6, and nodes have no v6 default route. Operator: dual-stack was "only a safety net". DC1 carries the IPv6 build; DC0 folds it back.
TEARDOWN STALLED AND WAS FORCED. All 26 agents were stopped, so no hook could run -- a fixed point, not backoff. --force cleared it; NOTHING was stranded. All nine nodes renamed to their ruled vr1-dc0-<role>-NN by pinned boot MAC and back to Ready.
SNAP PROXY BUILT AND INDEPENDENTLY REVIEWED, NOT APPLIED. squid at the utility .4:3129, allowlisted, 53/53 mutations killed; review says the ruled design is HONOURED on all four counts and logs FOUR real bugs. Nothing proven end to end.
OWNED: a red-lint push (| tail masked the exit code); a git add -A that swept an agent's files into an unrelated commit; two instrument misreads (a juju models summary read as progress, and stale unit logs read as current); and a wrong "immutable system_id" claim the operator corrected.
NEXT: apply the review cuts, re-run the mutation pass (S8 invalidates it), confirm BUG-3's deny shape once, install the proxy, then add-model + spaces + deploy. Sweep: docs/audit/queued-findings-20260731-stage5-deploy.txt (11 FIRST SURFACE). Bodies: docs/changelog-20260731-prefer-ipv6-research.md. Status ONLY in CURRENT-STATE.md.

ROTATED 2026-08-01 (GA-R4 rule 3 / F1 -- cap restored at this close)

The oldest closed-session summary/summaries moved VERBATIM to docs/archive/session-ledger-rotated-20260801.md. The live ledger stood at 296 lines and this close's summary would have breached the 300-line cap.

SESSION CLOSE 2026-08-01 -- snap proxy LIVE, D-139 adopted, IPv6 PROVEN on the node planes (bounded, GA-R4)

Branch dc-dc-stage5-preconditions, 8 commits pushed (d555b90..844b2e4). NO stage opened or closed. Scan: 3 open decisions, SEC 26 (none opened this session), D 140 / DOCFIX 207 / BUNDLEFIX 053.
THE dc0 SNAP PROXY IS LIVE. check dc0 PASS exit 0, 16 assertions, re-verified independently of the agent that installed it -- and a real snap payload fetched through it (HTTP 206, first bytes hsqs). No longer fixture-green. BUG-3 confirmed by measurement (no assertion changed); BUG-4 fixed at BOTH sites where the review had named one.
D-139 ADOPTED -- two rulings taken in separate exchanges: IPv6-only on the east-west planes, and the whole plane carve moved to GUA on the octet map VR0 and Willamette already use.
THEN ITS DECIDING REASON WAS REFUTED BY MY OWN VERIFICATION -- glibc 2.35 implements RFC 3484, not 6724, so ULA and GUA are EQUAL at precedence 40. Put back to the operator rather than quietly kept; ruling CONFIRMED on its other grounds and the dead rationale STRUCK IN PLACE, not deleted.
RULING A IS NOT ACHIEVABLE at current charm revisions -- ceph-osd fails a v6-only plane in BOTH directions, hacluster still ships ip_version: ipv4, OVN documents encap as IPv4-only. Narrowed by ruling ("B plus C") to a storage+replication experiment plus the upstream fix; LP draft written, operator files it.
>>> IPv6 IS PROVEN ON THE dc0 NODE PLANES <<< 6/6 addresses live on the NICs, 0% loss node-to-node on all six planes, ND resolving from a COLD neighbour table. Gate G19 built AND run live. IPv6 is also already load-bearing: node time sync runs over fd50:840e:74e2:220::6, stratum 3.
THE RECORDED ROOT CAUSE OF THE v4-ONLY CONTAINERS WAS WRONG. MAAS has 100% of every v6 /64 available; the real limit is juju taking addrs[0] from an unsorted query, family-blind, with no knob (LP #1723240, open since 2017). Corrected per GA-R1 C2.
THE "JUJU CLIENT BLOCKER" WAS NOT ONE -- the client is live and registered on the rack, exactly where D-138 puts it. Corrects this repo's own 2026-07-31 finding 9d.
D-139's OWN EXECUTION LIST WAS DEFECTIVE AND IS REPLACED. dc-node-v6-carve.py pivots on IPv4 existing, so run after v4 removal it would carve four fewer planes per node and exit clean.
OWNED: my BUG-1 fix was wrong (a secondary alias is never the kernel's chosen source); I scoped the v6 experiment wrong (ceph couples storage+replication); I stated an agent's input source wrongly; I scoped a research agent with no repo path, so 355 lines landed in /tmp and needed rescuing; and one commit went red on ASCII-only em-dashes.
Gauntlet ALL GREEN (96), repo-lint 0 fail, d139-gua-carve 71/71, dc-node-v6-verify 55/55. voffice1's clone is 36 commits BEHIND -- no loss, but a live hazard on the Plane-2 host.
AMENDED AFTER THE BOOKEND (2026-08-01): both DC containment VMs resized 416 -> 480 GiB through tofu (operator: "Option 2 look sgood me"), 128 GiB swap added (operator-run), and preflight gained gate P8, substrate drift (harness 33 -> 38, proven live at zero diff). Host used 809 -> 63 GiB. Found: dc0's MAAS region and juju controller have autostart=disable. Bodies: changelog items 21-22.
NEXT: apex CREATE-only push (tool built, independently reviewed, dry-run byte-identical), then the bundle deploy -- its blockers are cleared. network-get on a v6-only bound space is still unmeasured and gates the v4-removal experiment. Sweep: docs/audit/queued-findings-20260801-stage5-ipv6-d139.txt (6 FIRST SURFACE). Body: docs/changelog-20260731-snap-proxy-apply-ipv6.md. Status ONLY in CURRENT-STATE.md.

ROTATED 2026-08-02 (GA-R4 rule 3 / F1 -- cap restored at this close)

The oldest closed-session summary moved VERBATIM to docs/archive/session-ledger-rotated-20260802.md. The live ledger stood at 283 lines and this close's summary would have breached the 300-line cap.

SESSION CLOSE 2026-08-02 -- dc0 edge destroyed and rebuilt; D-139 steps 1-3 done; runbook fold opened (bounded, GA-R4)

Branch dc-dc-stage5-preconditions, 24 commits pushed (f79c9e8..). NO stage opened or closed. Scan: 3 open decisions, SEC 28 (SEC-031, -032 opened), D 141 / DOCFIX 207 / BUNDLEFIX 053.
D-139 STEPS 1-3 EXECUTED for dc0. Apex 139 -> 152 prefixes; MAAS 6 GUA + 5 ULA each paired on one vlan; node statics migrated GUA 54 / ULA 0 with ZERO multi-global NICs. v4 untouched, which is the ordering step 3 exists to enforce. Step 3.5 done: model created, spaces gate PASS 0 fatal, apt-mirror verified.
>>> THE dc0 EDGE WAS DESTROYED AND HAS BEEN REBUILT. <<< Root cause is NOT the update I first claimed -- zero pkg/firmware lines in the whole serial log. It was UFS soft-update damage from an unclean power cut: the 08-01 in-place tofu resize BOUNCED the containment VM, hard-cutting every inner guest. fsck salvaged 2533 unreferenced files and libcrypto/libpython did not survive.
dc1's edge took the SAME cut (76/181 vs dc0's 2533/785) and lost its user DB instead: it forwards without translating (tcpdump, both taps, source unchanged) and runs with NO pf ruleset -- an open router serving its GUI, SEC-031. Config INTACT; verdict REPAIR not rebuild, blocked on having no credential path.
Edge rebuilt by agent, dc-egress-check dc0 PASS 8/8 exit 0. Plan asserted on tofu show -json including the POSITIVE half; pfctl -s nat verified rather than assumed. SEC-032 minted.
NEW GATE dc-egress-check.sh (F9): layered route -> edge answers -> traffic leaves -> upstreams, first failure reported as the cause. Proven live on TWO different failure modes. Wired into restart Stage 0 and phase-4 Step 3.9. Two of its own defects found and fixed the same day.
RUNBOOK FOLD OPENED (docs/runbook-fold-register.md, 12 rows). D-138 and D-139 appear in no runbook; the chain as written would rebuild the pre-D-132/D-138/D-139 shape. Both Class-A rows closed -- incl. SKILL.md, which every session reads BEFORE any runbook.
6 RULINGS (GA-R5, all utterances quoted): D-139 ordering (carve before deploy); OOB dual-stack; OOB v4 10.12.40.0/22/10.12.88.0/22 superseding 10.12.60.0/22; VPN deferred to Roosevelt; D-135 amended (dc0 converges on the proxy at rebuild); D-140 PINNED (tofu manages juju AFTER a hardened, tested dc0 deploy).
OWNED: I diagnosed the edge break as a partial update from the symptom's SHAPE and was wrong; my agent brief carried a wrong base-image path where the apply destroys the volume first and no rollback exists; I guessed /srv/mirror/ubuntu and a systemd unit name the repo already defines; two harness cases I wrote never ran while the suite said ALL PASS; one assertion passed on its own comment; and I pushed a red lint once by masking the exit code.
Gauntlet ALL GREEN (97), repo-lint 0 fail / 1 warn, ledger-scan reconciled. voffice1 1 commit behind at close (not a loss).
NEXT: re-stage the rack's VIP overlay (sweep F1 -- it is STALE and is the deploy input), settle the mirror's exit-1-with-"All done" (F2), pg_dump maasdb (F6), then fold F2-F11 and the dc1 Phase-2 exercise. Sweep: docs/audit/queued-findings-20260802-stage5-edge-fold.txt (6 FIRST SURFACE). Status ONLY in CURRENT-STATE.md.

SESSION CLOSE 2026-08-02 (part 2) -- queued backlog cleared; mirror ROOT-CAUSED; D-139 step 6 EXECUTED (bounded, GA-R4)

Branch dc-dc-stage5-preconditions, 9 commits pushed (1cdd607..56b37f8). NO stage opened or closed. Scan: 3 open decisions, SEC 28 (none opened this session), D 141 / DOCFIX 208 / BUNDLEFIX 053 -- DOCFIX moved 207->208, reconciling with the one number assigned.
Sweep F1 and F6 CLOSED; F2 diagnosed then ROOT-CAUSED; F3/F4/F5 graduated to platform-traps + script-authoring; DOCFIX-207 corrected preflight P6's plan count (50/97, stale since 2026-07-10, against a measured 56/108).
F6 PASS -- the dc0 region DB is proven uncorrupted: pg_dump read every page of maasdb (23,878,796 bytes / 37,199 lines / exit 0 / completion marker). F6's own stated blocker was WRONG -- the discriminators are ROLE and TRANSPORT, not snap confinement; over the unix socket the maas role needs no credential at all.
F2 ROOT CAUSE IS UPSTREAM: one of NINE archive.ubuntu.com backends (91.189.92.23) hangs on ONE dep11 object while serving its directory siblings in 0.5s; the resolver rotates, and 11 of 12 fetches succeed. "Not transient" WITHDRAWN. apt is unaffected -- it fetches the .xz, which is present; apt-get update against the mirror returns rc=0.
4 rulings, exact utterances: "Re-trigger the sync first, decide after"; "Root-cause the curl/debmirror anomaly first"; "Full step 6 first, then deploy"; "Deprecate both, delete nothing". Both step-6 rulings were pushed BEFORE the dependent work (934a1f0, 53aae78) and correctly classed OPS, not new D-numbers.
>>> D-139 STEP 6 EXECUTED -- the deploy's last stated blocker. <<< Apex: 26 GUA VIP addresses created, 26 ULA addresses + 9 ULA prefixes deprecated, nothing deleted; idempotent on re-run. The 26 CREATE targets diff EXACTLY against the deploy overlay's 26 GUA VIP legs.
MAAS half: 4 of 5 ULA subnets deleted, 1 HELD. fd50:840e:74e2:220::/64 carries the juju controller (::5) and the MAAS region VM (::6), neither with a GUA counterpart -- deleting it would strip the deploy client's only recorded v6.
Two tools shipped: netbox/d139-step6-vip-rehome.py (harness 20 cases) and dc-plane-ipam.sh retire-v6-ula (harness 25->32). An adversarial review returned FIX FIRST on four defects, two CRITICAL (a dc1 orphan-create; a dropped apex-identity guard) -- all fixed and verified live.
OWNED -- THREE of my checkers COULD NOT FAIL, every one written AFTER I landed that exact rule into script-authoring this session: an assertion satisfied by a traceback; a grep covering one file while the tool inherited the other; and a sid="'$id'" comparison that returned a clean ZERO, on which four deletes proceeded. None was caught by re-reading my own work -- two by an adversarial reviewer, one by the live run.
Also owned: called the four deletes "proven safe twice" when half that proof was inert (the OUTCOME was safe -- measured afterwards, nodes read v4=6 v6=6); wrote status=active into a ruling by inference (measured: reserved); and inflated the DOCFIX counter with a decoy token TWICE, the second time inside the sentence correcting the first.
Durability: vcloud 0 uncommitted / 0 unpushed; voffice1 synced (was 1 behind); dc0 rack ~/repo-stage all 13 tracked files MATCH the repo. Gates: gauntlet ALL GREEN (98), repo-lint 0 fail / 1 legacy warn.
NEXT: the preflight-P2 / phase4 machines-overlay asymmetry -- P2 validates a merged input the deploy never passes -- then the bundle deploy. The held subnet needs the controller's v6 re-homed to GUA first and is NOT deploy-blocking.
Sweep: docs/audit/queued-findings-20260802-step6-queued-items.txt (6 FIRST SURFACE, incl. a broad Bash(ssh vr1-dc0-maas *) allow rule, and four destructive MAAS deletes that matched NO ask rule -- the rule-fails-to-MATCH class, now recurring). Body: docs/changelog-20260802-queued-items.md. Status ONLY in CURRENT-STATE.md.

SESSION CLOSE 2026-08-03 -- Stage 5 dc0: bundle DEPLOYED, controller rebuilt, vault up; ovn-central cert DEFERRED (bounded, GA-R4)

Branch dc-dc-stage5-preconditions, ~23 commits pushed. NO stage opened/closed. Scan: 3 decisions, SEC 28, D 142 / DOCFIX 209 / BUNDLEFIX 053 (D-141 + DOCFIX-208 assigned this session).
THE dc0 BUNDLE IS DEPLOYED and mostly converged: 9 machines started, mysql cluster ONLINE, vault init+unseal+root-CA (operator-run), ~25 units active, 0 in error. DOCFIX-208 fixed the machines-overlay omission; UCA signing-key failure root-caused; D-135 amendment (b) converged dc0 onto the apt caching proxy; the v4 VIP revert (D-141) cleared keystone's Invalid vips.
CONTROLLER REBUILT (Path C): a --force model destroy orphaned the model (missing status doc) and took the controller API down; rebuilt fresh from MAAS end to end. New runbook Paths M + C (juju model + controller teardown/rebuild), plus the measured kill-controller-fails-when-API-down + --no-wait guidance.
RULINGS: D-141 (IPAM dual-stack, v4 active / v6 reserved-until-capable); D-052 AMENDED (ovn-central "" default -> metal-internal, architecturally correct -- OVN NB/SB DB is a metal-internal service).
>>> ovn-central x3 DEGRADED, DEFERRED: charm-ovn-central LP #2044324 -- cert request carries NO common_name -> vault issues no server cert -> OVN NB/SB cluster not formed. Three remedies exhausted (reissue-certificates / rebind / relation bounce). Only OVN/tenant-networking is gated. <<<
GATE RED AT CLOSE: gauntlet 1/98 FAIL (provider-bundle-check) -- the D-141 v4 revert broke 4 dual-family harness cases; LOGGED, harness owes a reconcile to the v4-only input. repo-lint 0 fail.
CONFIRMED (operator Q): a dual-stack deploy overlay with unpopulated container v6 causes the Invalid vips block on all 11 API charms (the charm hard-errors on an unplaceable VIP) -- so v4-only-deploy + v6-reserved-in-apex (D-141) is the correct split until the container-v6 gate clears.
OWNED: twice asserted a wrong ovn-central cert root cause (the binding); flagged a RULED binding exception (D-072 dashboard) I'd have reverted without grepping the D-NNN (would have killed Horizon HTTPS); shipped the v4 revert without its harness update.
DURABILITY: vcloud 0/0; voffice1 was 36 behind, PULLED to sync (new savegame Step 1b, operator-directed); dc0 rack ~/repo-stage matches HEAD.
NEXT: escalate LP #2044324 + decide accept-degraded vs the unverified os-*-network avenue; reconcile provider-bundle-check to D-141; then continue Stage-5 (phase-03 core verify). Sweep: docs/audit/queued-findings-20260803-stage5-deploy-ovn.txt (4 FIRST SURFACE). Status ONLY in CURRENT-STATE.md.