Operator-gated merge of `dc-dc-stage4-phase3-maas-deploy` (77 commits, opened 2026-07-23).
Stage record: docs/archive/stage-records/vr1-stage4-record.md. Status authority remains
docs/CURRENT-STATE.md.

DELIVERED: 18 nodes READY (not Deployed -- MAAS-deploy is SKIPPED by the 2026-07-23
READY-handoff ruling / DOCFIX-200; Juju provisions at Stage 5), carved across 10 named plane
fabrics with pinned MACs, placement tags 9+9 verified LIVE, jammy images synced, and two
deliberately DIFFERENT per-DC artifact-delivery strategies proven: dc0 a full mirror
(949G+342M), dc1 an apt caching proxy (D-135 + its 07-24/07-27 amendments).

DoD: bullets 1-5 met with captures; bullet 6 ("NTP from the DC's own OPNsense edge") STRUCK by
DOCFIX-204 as unsatisfiable -- D-129(iv) had already ruled the MAAS hierarchy the time
authority, so a correctly-built DC could never have met it. The node-side half of bullet 5 is
split to new gate G17 by operator ruling rather than closed conditionally (GA-R6 E3 forbids a
conditional close; powered-off nodes cannot be probed). G17 triggers at Stage 5 first boot and
the phase-4 runbook owns its captures.

THE STAGE'S MOST USEFUL FINDINGS WERE IN ITS OWN CONTROLS. Two checks that had passed for days
could not fail: `dc-mirror.sh check` asserted that `last-sync.status` EXISTED, printing its
contents behind an unconditional OK (dc0 read FAIL, dc1 a four-day-stale RUNNING -- both
PASSED); and `creds-audit`, being declaration-based, read CLEAN on three sites while the D-137
matrix returned 13 findings. The D-137 six-lens committee found 8 more false greens in a
register built four days earlier. Distilled into the operating skill as "a checker that cannot
fail is not a gate", with the assert-on-content and enumerate-what-exists rules.

Decisions: D-133, D-134 (+amendment), D-135 (+two amendments), D-137 (five sub-rulings), plus
amendments to D-101, D-104 and D-113. SEC-017..SEC-025 opened (nine). DOCFIX-198..204.

Close-out: carve residue 108 fabrics -> 17 (cascade-checked, zero orphaned interfaces); dc1's
partial mirror + apparatus removed after making the proxy self-sufficient; GA-R2 consolidation;
skill sweep + dated snapshot regeneration; GA-R7 memory review (no new memory -- everything
durable graduated to the repo); gauntlet ALL GREEN (81); repo-lint 0-fail.

Travelling forward, deliberately: G17, 21 open SEC rows, and 7 residual credential-register
findings including the dc0 edge-API re-mint. Next stage branches off post-merge `main`.