Read-only decision package (mutates no ruling). Reevaluates all ~24 decisions/
sub-decisions held to Roosevelt / next-deployment / end-of-deployment review,
against current state (D-143 re-IP redeploy, geneve-over-v6 confirmed, deploy
method proven, the tailnet-collision lesson).

KEY FRAME: "next deployment" in these decisions = Roosevelt (the next DISTINCT
bare-metal build), NOT the intra-VR1 re-IP redeploy. The redeploy is a nested-VM
re-build, so it cannot exercise bare-metal/scale items -- but it IS a fresh-build
opportunity for build-process/credential/vault items.

HONEST YIELD: ~4 pull-forwards the redeploy makes actionable (D-137 credential
revocation=R7; D-142 vault-init QoL=R6; D-136 v6 octet-convention review; D-069
custodian assignment) + ~3 analysis-now (D-131 sub-4 node-DNS review; D-140
provider-capability read; D-068 V1-V5 probes) + 1 access-gated reconsideration
(D-129(iii) tagged-identity/star ACL -- the collision made the exposure concrete,
but the Headscale-access blocker persists). The majority (18 rows) genuinely stay
bare-metal/scale/version/Magnum-bound -- reevaluation CONFIRMS them.

Two-pass: fable advisor caught 4 unplaced/conflated inventory items (D-029,
D-068 items 2/3 unplaced; D-069 custodian-vs-auto-unseal conflation; D-136 CI-half
mis-grouped) -- all fixed, corrections in Section 8.

REVERT: git rm the review file; revert the CURRENT-STATE pointer block.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Fg98z7QyzwYUs8fsWCn728