Re-seed (from `bash scripts/ledger-scan.sh`, 2026-07-17):
- next-free D 125 -> 128; add SEC-010 to OPEN security rows.
- correct stale "D-123 Model A" -> Model B (operator ruling R-1, supersedes);
  fold D-124..127 as ADOPTED; retire the "Stage-4 addressing HELD" flag.
- drop the D-115 "known ledger-scan defect" note: scan now keys on the last
  **Status:** line per `## D-NNN:` block, so D-115 (ADOPTED) no longer flags.

Session-scoped update (health sweep + edge cold boot):
- vcloud HOST never rebooted (uptime 8d); "bookend" only partially done --
  voffice1 + tailscale rebooted to kernel -136; host + edge were not.
- office1-opnsense cold-booted + verified clean (2.0 GiB mem, pf 80, kea up,
  LAN/egress 0% loss) -> D-127 gate met -> `virsh autostart` ENABLED.
- voffice1 autostart ALSO enabled -> both foundational VMs autostart per D-127.
- still pending: vcloud kernel -136 pending in apt (not installed) -> apt
  full-upgrade THEN reboot; edge guest OS still on p16.

Revert: `git revert <this>` (doc-only; no code/tooling touched).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CsPuN3nSP1EMzkBhh8KJQt