Session ledger -- in-flight work continuity record

Purpose. Long ops sessions on this cloud routinely exceed a single context window and get COMPACTED (sometimes several times). Anything living only in the chat scrollback is lost at compaction. This ledger is the durable, committed record of what is IN FLIGHT, so any session -- after a compaction, or a fresh one -- can resume without losing pending work.

How to use it (standing practice).

1. At session start: read this ledger AND run bash scripts/ledger-scan.sh. Reconcile.
2. ledger-scan.sh is the DRIFT CHECK -- it derives the open-work it reliably can (PROPOSED/OPEN decisions, OPEN security rows, next-free numbers) straight from the repo. This narrative must not claim CLOSED anything the scan shows OPEN, nor omit what it surfaces.
3. Update this ledger at every deliverable/commit -- it is a standing deliverable like the changelog. The changelog says what CHANGED; this ledger says what is still OPEN.
4. The machine-derived block below is seeded from a scan; re-run the scan and re-seed rather than editing it by hand.

SINGLE STREAM (collapsed 2026-07-13). This ledger previously carried three parallel, separately-owned stream sections (main-chat, jumphost, shared) plus ~30 append-only session narratives. Those streams are CLOSED and reconciled into the one list below. There is now ONE stream. Do not re-introduce per-stream sections.

Where the history went. The 2,189-line session-by-session narrative is NOT lost -- it is in git history (the parent of the collapse commit) and, in durable form, in the 65 docs/changelog-*.md files, docs/design-decisions.md, and the incident reports. This ledger deliberately carries only what is still OPEN, plus the facts that would otherwise be lost because they live nowhere else.

Machine-derived (re-seed from scripts/ledger-scan.sh; do not hand-edit)

Re-seeded from the 2026-07-17 scan. Re-run bash scripts/ledger-scan.sh to refresh.

• PROPOSED / OPEN decisions: D-068 (Vault substrate hardening, Roosevelt -- 1.16 ruled OUT per amendment; the off-EOL-1.8.8 path remains OPEN), D-071 (routine update cadence + Juju controller patch policy -- AMENDED, still PROPOSED, awaiting operator ratification; gated on the pre-DC-DC controller HA/backup session), D-129 (OPNsense edge plugin/add-on base profile -- OPEN / partially ruled 2026-07-18: VR1 profile adopted, FOUR sub-decisions still OPEN; review in docs/opnsense-edge-addon-review-20260718.md).
• OPEN security rows: 8 open per bash scripts/ledger-scan.sh (re-seeded 2026-07-19). The SEC register of record is docs/security-ledger.md; row-level dispositions live THERE only (GA-R4 amendment F3) -- this block carries pointer + count, never rows.
• Next-free numbers: D = 130, DOCFIX = 196, BUNDLEFIX = 013. (Since the last re-seed D-121..128 all ADOPTED -- D-128 = VR1 operating model (2026-07-17). Load-bearing correction to the prior block: D-123 = Model B (nodes nest INSIDE vvr1-dc0; site-down = one virsh destroy vvr1-dc0) via operator ruling R-1 2026-07-16 -- this SUPERSEDES the earlier "D-123 Model A" this block used to record. Also: D-124 transit addressing PINNED (172.31.0.0/24) + imported to office1-netbox; D-125 bridge-in single-NAT uplink; D-126 durable rootless site access; D-127 IaC autostart matrix. The Stage-4 rack<->region addressing the prior block flagged as HELD is now assigned.)
• Standing numbering rule: never write an identifier-shaped token (D-/DOCFIX-/BUNDLEFIX-NNN) ABOVE the real high-water mark anywhere in docs/ or runbooks/ prose -- historically a decoy token in prose inflated the next-free counter (hardened in DOCFIX-174); the authoring discipline stands regardless.
• ledger-scan D-115 false-positive: RESOLVED. The scan now keys on the LAST **Status:** line per ## D-NNN: block (see scripts/ledger-scan.sh awk), not arbitrary body prose, so D-115 (ADOPTED) no longer shows as PROPOSED/OPEN. The general hygiene -- trust the Status line over body text -- still holds.

ROTATED 2026-07-19 (GA-R4 rule 6 -- the one-time rotation; F1 cap now enforceable)

The pre-rotation bodies (~1080 lines: Live state, OPEN WORK VR1/VR0, NetBox write-path bugs, PINNED rulings, standing lessons, state facts, project- completion, NetBox import narrative) moved VERBATIM to docs/archive/session-ledger-rotated-20260719.md. Standing lessons + VR0 state facts were ROUTED to durable homes first (platform-traps already carried most; juju format=line -> appendix-A; guard discipline -> operating-discipline; VR0 cloud facts -> maas-as-built-reference.md). Open work is machine-derived above + CURRENT-STATE.md; do not re-grow bodies here -- sessions append BOUNDED summaries only (15-line cap).

Retained compact blocks (still-live obligations without another home yet):

• NetBox write-path bugs (2026-07-14 adversarial review; LOGGED, NOT FIXED): importer/write-guard defects recorded in the rotated body ("OPEN -- NetBox WRITE-PATH BUGS" section) -- route to a findings doc or fix before the next NetBox write campaign.
• Project-completion (after D-011 passes): consolidate the 10 per-phase do-documents into a v1 deploy runbook; flip repo PRIVATE (SEC-004); revoke/rotate SEC-005/006/007; v2-deferred: GitBucket SSH, IPv6 dual-stack, NetBox import bundle.

SESSION CLOSE 2026-07-18 -- grounding audit (Phases 1-4); GA-R4 bounded summary

• Audit Phases 1-4 COMPLETE, each externally reviewed; FULL FREEZE upheld (zero pre-audit surfaces edited).
• Phase 1: record-audit extractor + inventory (12 contradiction groups); outer plan CAPTURED 7/2/7; GA-F01..F15.
• Phase 2: docs/CURRENT-STATE.md authored -- the single status authority; operator SIGNED (G11, section 11).
• Phase 3: fresh-agent grounding test, 3 probes 21/21 PASS; hole H1 amended into the G9 row.
• Phase 4: GA-R1..R7 + stage-status vocabulary (Option A + H1) ALL RATIFIED, utterances quoted (docs/audit/ga-rulings.md).
• Phase 5 NOT opened: sweep plan DRAFTED (docs/audit/phase5-sweep-plan.md, commit 687dfa8) awaiting external review.
• DC0 apply remains STOPPED (G9); D-130 unruled; expected plan triple UNRESOLVED (CURRENT-STATE section 5).
• Next session: FRESH operator session, auto-memory ON (GA-R7 rule 8); read sweep plan + CURRENT-STATE.md first.
• Status lives ONLY in CURRENT-STATE.md (GA-R1); this entry is narrative + pointers, not status.
• Full session body: docs/archive/session-20260718-grounding-audit.md (GA-R4 rules 1-2, first live compliance run).
• GA-R4 F1 cap (<300 lines) not yet enforceable: the one-time rotation is Phase-5 Batch 4 (rule 6) -- noted, not skipped.
• POST-CLOSE ADDENDUM (2026-07-19): sweep plan externally reviewed PASS; amendments S1-S5 applied in a single commit (15ccfbd). Batch 0 was PRESENTED and HELD -- operator routed execution to the fresh session. Fresh session: read docs/audit/phase5-sweep-plan.md + docs/CURRENT-STATE.md, then gate Batch 0.

SESSION CLOSE 2026-07-19 -- GA Phase-5 sweep (Batches 0-6) + AUDIT EXIT (bounded, GA-R4)

• All six sweep batches executed + closed in ONE session under per-batch operator gates.
• Tooling: L10 status-coupling lint (WARN->FAIL), SEC pointer+count scan, wrap-aware counters, vocab-keyed extractor + archive exclusion (operator-ruled). Gauntlet grew 69 -> 70 harnesses.
• D-130 ADOPTED (a) + implemented + v7/v8-verified; G6 state surgery (operator-ruled); expected triple 6/0/6 recorded and re-verified twice (postG6 + phase6-exit captures).
• Record fixes GA-F02..F05/F10..F12/F14..F16; H1 token migration; E1 gate-type tags; ARCH/OPS D-tags + D-129 split (operator-ruled); R3-F register fully dispositioned (S1).
• Memory hygiene per provenance rulings (2 files removed, GA-F16 found+fixed); ledger rotated 1187->131; 96 changelogs + 25 docs consolidated to archive; top-level docs/ = 16.
• Skill swept against ratified GA-R1..R7 (checklist committed). Exit runs 1-6 ALL PASS incl. fresh probe trio 21/21 (7/7 on all three); operator RE-SIGNED CURRENT-STATE 2026-07-19.
• AUDIT EXITED: G3 + G11 CLOSED, FREEZE lifted, G9 OPEN (gated logged apply, G8 first).
• Full body: docs/archive/session-20260719-phase5-sweep.md. Status lives ONLY in CURRENT-STATE.md.