- dc-rack-net install dc1 on the rack: check 10/10, forwarder answers
  authoritative maas-internal SOA (D-131 fix; audit capture committed)
- region MAAS: D-120 range 10.12.68.100-.200, D-131 dns_servers=10.12.68.3
  allow_dns=false, DHCP dhcp_on=true primary_rack=nmpcq4; dhcpd verified
  RUNNING on virbr6 (behavioral, no Temporal incident)
- dc1 enlistment PROVEN via canary (machines 11->12 in ~2 min)
- SEC-016: operator-ruled "Mint a dedicated dc1 power key" (per-DC
  isolation, not SEC-012 reuse) -- recorded before dependent wiring (GA-R5)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VUjEb7onHpdqFHUnio6iVw