DC0 deploy STEP A EXECUTED: outer apply 6/0/6 exact; G8+G9 CLOSED; convergence zero ...

Logged window dc0-deploy (as-executed log + index convention). G8 passed
in the apply session (six planes 0 leases, 0 attachments); validate
PASS; pre-apply capture equaled the recorded triple; the SAVED plan was
applied: 6 added / 0 changed / 6 destroyed. vvr1-dc0 RUNNING (108 vCPU,
416 GiB, autostart disable per D-127); vr1-dc0-uplink active; six vcloud
planes destroyed (Model B relocation); voffice1 + edge untouched (ids
1/2). Convergence re-plan: no differences (captured). CURRENT-STATE:
section 1 position, section 5 expected plan = ZERO DIFF (any diff is a
STOP), G8 + G9 rows CLOSED; active gate G10. Captures committed same
commit (C1/C2).

Revert: infra revert = runbooks/dc-dc-teardown-rollback.md decision tree
(NOT a blind destroy); docs revert = git revert this commit.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VZbUeRE8weySLSGY1odrCi

AUDIT EXIT: operator re-signed CURRENT-STATE; G3+G11 CLOSED, G9 OPEN; session close (GA-R4) ...

Batch 6 item 6: signature utterance "Reviewed, approved, continue."
recorded into section 11 (replaces 2026-07-18 per GA-R1 rule 7). All six
exit runs PASS. G3 CLOSED (all six batches); G9 OPEN (audit criteria
MET; remaining closer = the operator-gated logged apply with G8 first);
FREEZE LIFTED. Session GA-R4 close: bounded 14-line summary in the
ledger, full body rotated to docs/archive/session-20260719-phase5-sweep.md.
Repo HEAD at signing = this commit's parent (437d9d1).

Revert: git revert this commit.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VZbUeRE8weySLSGY1odrCi

Batch 6 item 3: exit probe trio 21/21 -- 7/7 on ALL THREE (bar exceeded) ...

Three independent clean-context probes (repo + verbatim charter question
set only, read-only, no shared state; fresh contexts satisfy GA-R7/G2)
scored against CURRENT-STATE with citations spot-verified against the
tree. Unanimous on every question; third-trap picks varied (all real);
zero orientation divergence (all landed CURRENT-STATE-first via the
swept skill); probe hole H1 did not recur. Full scorecard in the exit
record. Remaining before audit exit: item 6 only (operator re-read +
re-signature). G3 cell updated same commit.

Revert: git revert this commit.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VZbUeRE8weySLSGY1odrCi

Batch 6: exit runs 1/2/4/5 -- archive exclusion (operator-ruled), adjudication, plan==triple, S2 ...

6.1: docs/archive/ joins docs/audit/ as inventoried-not-counted (ruling
quoted in the exit record); record-audit + harness 35/35; per-group
adjudication = ZERO contradictory status-claim pairs on counted surfaces
(the charter's criterion as stated); group floor 9 recorded as re-run
baseline; missed patch file archived; CURRENT-STATE stale-note made
token-free. 6.2: 16 top-level docs (<25). 6.4: fresh capture
outer-plan-20260719-phase6-exit.txt = 6/0/6 == section-5 triple. 6.5:
G9 row names SEC-010's step-B dependency (S2). Exit record:
docs/audit/phase6-exit-runs-20260719.md. Items 3+6 pend operator
execution. G3 cell updated same commit.

Revert: git revert this commit.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VZbUeRE8weySLSGY1odrCi

Batch 5: skill sweep -- GA-R1..R7 implemented in openstack-cloud-ops (single commit) ...

New GA-rulings section reconciled against the RATIFIED text (draft
skill-additions cross-checked; the one draft-only item, the
reconciliation circuit-breaker, kept and marked as discipline). Stale
facts demoted to CURRENT-STATE delegation: the header's "current phase =
VR0 testcloud" and the deploy loop's "opentofu UNVALIDATED / no tofu
binary has ever run" (false since 2026-07-13). Session bookends + stage
close rewritten per GA-R4/GA-R6; change-delivery per GA-R2/D1; routing
rows re-pointed. Read-through checklist committed:
docs/audit/skill-sweep-checklist-20260719.md (every ratified rule ->
disposition). G3 cell updated same commit. repo-lint 0 fail.

Revert: git revert this commit (restores the pre-sweep skill).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VZbUeRE8weySLSGY1odrCi

Batch 4 C6: docs disposition -- 24 history docs archived, 16 retained, refs rewritten ...

DISPOSITION MANIFEST (archive, one-line justifications): clientdocs-
workflow-review (v1 tenant-docs era) / D-057-DECIDED-append +
D-057-REVIEW-ITEMS + README-D057-PACK + D-058-renumber (executed v1
decision packs) / D-068-openbao-assessment-DRAFT (supplementary; the
cited analysis retained) / DOCFIX-064-phase08-changelist + docfix-draft-
20260702 (executed/draft) / handoff-20260703 + handoff-20260705
(superseded handoffs) / incident-20260712-triplefault (trap routed to
platform-traps 1b/1c long ago) / netbox-vip-queue + phase-00-maas-
standup-notes + script-quality-findings + session-findings-2026-07-02 +
tenant-cidr-overlap-PLAN + v1-pre-deploy-fixes (v1-era executed/dated) /
repo-lint-nextfree-bug-FINDING (absorbed DOCFIX-105/107; repo_lint.py
pointer updated) / upstream-bug-draft-dashboard-tls (draft, dated) /
model-a-fallback-plan (D-123 Model B adopted; fallback preserved in
archive) / stage3-adversarial-review-20260716 (R3-F register,
dispositioned in 2.10) / dc-dc-replication-DR-seed (absorbed per
workflow) / dc-dc-ipv6-charm-research + dc-dc-netem-and-ula-gua-proposal
(stage 4+ research, refs updated). RETAINED 16 top-level, justified in
the session changelog. Live-surface refs to all moved files rewritten to
archive paths (18 files). G3 cell + ledger + changelog updated same
commit (the L10 fire on a Status-line path rewrite is satisfied by the
CURRENT-STATE touch -- the check worked as designed).

Revert: git revert this commit.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VZbUeRE8weySLSGY1odrCi

Batch 4 C1: GA-R4 rule-6 ledger rotation -- 1187 -> 131 lines (GA-F13) ...

Bodies rotated VERBATIM to docs/archive/session-ledger-rotated-20260719.md
(Live state 2026-07-13, OPEN WORK VR1+VR0, NetBox write-path bugs, PINNED
rulings, standing lessons, state facts, project-completion, NetBox import
narrative). Routed-before-rotating (durable homes): juju format=line 3.6
trap -> appendix-A; guards-are-load-bearing -> operating-discipline; VR0
operational facts + admin/controller -> maas-as-built-reference.md
(lessons 1-6 verified already covered by platform-traps/L8). Live ledger
keeps header + machine-derived fence + two compact still-live blocks
(NetBox write-path bugs pointer, project-completion) + the bounded session
summaries. 131 < 300: the F1 cap is now ENFORCEABLE. Fences OK; ledger-
scan counters unchanged; repo-lint 0 fail.

Revert: git revert this commit (restores the 1187-line ledger).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VZbUeRE8weySLSGY1odrCi

Batch 3 CLOSE: memory hygiene (GA-F05..F08 memory surfaces) + G1 review; GA-F16 registered ...

Per the recorded provenance rulings: review-after-each-step.md REMOVED
(GA-F06 -- one-time instruction, never standing) and project-posture-
closed-test.md REMOVED (GA-F07 -- "ruling" never ruled; posture NEUTRAL);
hostname -> vcloud in the Remote Control memory (GA-F05 last surface);
MEMORY.md index rebuilt (GA-F08). GA-R7 rule-6 skill line added to
SKILL.md bootstrap. First full G1 review (rules 1-4) found + fixed one
further violation: creds-folder-convention.md duplicated a repo-carried
convention and linked both removed files -- registered as GA-F16, reduced
to a pointer entry. Post-review: 3 memory files, zero violations, zero
stale refs (grep-verified). Pre-edit copies: docs/archive/memory-20260718/
(index copy ASCII-normalized, noted in the changelog). G3 cell updated
same commit (L10 satisfied).

Revert: restore files from docs/archive/memory-20260718/ (memory side);
git revert this commit (repo side).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VZbUeRE8weySLSGY1odrCi

Batch 2 CLOSE: verification + adjudication recorded; last GA-F03 site fixed ...

Gauntlet ALL GREEN (70); repo-lint 0 fail / 1 legacy WARN (L10 at FAIL).
platform-traps:19 tofu pin (the fifth GA-F03 site) demoted; CURRENT-
STATE's known-stale-pins paragraph rotated (all sites fixed, memory copy
= Batch 3). G3 cell: Batches 0-2 CLOSED. Extractor adjudication + the
criterion-mechanics FINDING recorded in the session changelog (live-
surface vocab flags 0; residual groups history-class or mechanical;
literal ZERO-on-counted lands with Batch 4 + Batch 6.1 by construction).

Revert: git revert this commit (docs + one skill row).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VZbUeRE8weySLSGY1odrCi

Batch 1 CLOSE: gauntlet ALL GREEN (70); changelog + ledger entries ...

Post-batch verification per the sweep plan: the G7 capture equals the
section-5 recorded triple exactly (6/0/6, committed in 5a4f5eb).
Gauntlet ALL GREEN -- now 70 harnesses (tests/cloudinit-vm joined the
set); repo-lint 0 fail, 1 legacy WARN, L10 running at FAIL severity.
Session changelog carries Batch 1 items with per-item reverts; ledger
entry appended (fences OK).

Revert: git revert this commit (docs-only).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VZbUeRE8weySLSGY1odrCi

Batch 0 CLOSE: verification green; session changelog + ledger entry ...

Post-batch verification per the sweep plan: touched harnesses 42/42 +
44/44 + 33/33; full gauntlet ALL GREEN (69 harnesses); repo-lint 0 fail
1 legacy WARN, now running WITH the L10/C1 check active. Session
changelog opened (one for the whole sweep session, GA-R2/D1) with
per-item reverts; ledger gains the Batch 0 in-flight entry incl. the
L10 WARN->FAIL flip reminder due at Batch 1 open. G3 evidence cell
updated same commit (GA-R1 rule 8).

Revert: git revert this commit (docs-only).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VZbUeRE8weySLSGY1odrCi

Batch 0.2: ledger-scan SEC reporting repointed at security-ledger.md (GA-R4/F3) ...

Scan output now emits open COUNT + ID list + register-of-record pointer;
row-level dispositions dropped (they live in docs/security-ledger.md
ONLY). Session ledger's machine-derived SEC bullet re-seeded to pointer
+ count form. G14 evidence cell repointed at security-ledger.md same
commit, and its count corrected 9 -> 8 per GA-R1/C2 (measurement wins:
the cell's own enumeration and the scan both measure 8; divergence noted
in the cell, not silently harmonized).

Harness: tests/ledger-scan +4 checks (count+IDs surfaced, pointer
present, disposition text absent), 41/41 PASS; repo-lint 0 fail.

Revert: git revert this commit (restores per-row scan output, prior
ledger bullet, and the 2026-07-18 G14 cell incl. its count error).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VZbUeRE8weySLSGY1odrCi

Ledger: post-close addendum -- plan reviewed + S1-S5 applied; Batch 0 presented, HELD for fresh session ...

Keeps the GA-R4 close summary truthful about the post-close continuation
(review verdict arrived after the bookend). No other work remains in this
session.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018ZV3uqyU9oWoFTcwiE4a21

SESSION CLOSE per GA-R4: bounded 14-line summary + full body to docs/archive/ (first live compliance run) ...

Grounding-audit session closed: Phases 1-4 complete and externally
reviewed, sweep plan drafted (687dfa8), Phase 5 deferred to a fresh
session. Fences OK post-append. F1 cap noted as not yet enforceable
pending the Batch-4 one-time rotation (GA-R4 rule 6). Revert: git revert
of this commit restores the pre-close ledger.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018ZV3uqyU9oWoFTcwiE4a21

Ledger: session-close bookend -- DC0 apply STOPPED, superseded by grounding audit charter ...

Bookend for the 2026-07-18 session. Records what was established (source-verified
autostart bounce path, the /tmp cloudinit root cause, the corrected 3-VM blast
radius), what remains open (D-130 mechanism ruling, verifications 7 and 8, the
doc-integrity list), and points at the full record in
docs/finding-20260718-voffice1-cloudinit-seed-replace.md (43b29d7).

Notes that this session is superseded by a grounding audit charter arriving via
git, to be read first by whoever picks this up.

Nothing applied, no module touched, no state written. Gate before any apply
stands: plan must read EXACTLY 5 add / 0 change / 6 destroy.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01YArUfQQe6VasfTvzzb9D6P

Findings: post-reboot outer plan would BOUNCE Office1 headend + edge -- DC0 apply STOPPED ...

Read-only orientation + pre-apply re-verification. NOTHING applied, no module
touched, no state written. Records findings only, before any fix work.

WHAT WAS FOUND

Outer `tofu plan` post-reboot = 7 add / 2 change / 7 destroy, NOT the committed
5 add / 2 in-place / 6 destroy in docs/dc0-deploy-readiness.md. The entire delta
is `voffice1` (the live headend), not DC0 scope.

1. DOMINANT RISK -- the 2 "in-place" changes bounce both guests. VERIFIED FROM
   PRIMARY SOURCE (dmacvicar/libvirt v0.9.8 internal/provider/domain_resource.go):
   Update's only no-bounce path (L1090) requires
   `domainConfigUnchanged && runningChanged && autostartUnchanged`. An
   autostart-only diff has runningChanged=FALSE, so it falls through to
   stopDomainIfRunning -> DomainUndefine -> DomainDefineXML -> DomainSetAutostart.
   The guest is STOPPED. Applies to voffice1 AND office1-opnsense.

2. `-refresh-only` CANNOT fix it. Read is self-gating (L938):
   `if isImport || (!state.Autostart.IsNull() && ...)`. State's Autostart is NULL,
   so autostart is never read back. Matches empirical `grep -c autostart` = 0 on
   both domains. (isImport DOES read it -- `tofu import` is a candidate
   bounce-free reconcile path.)

3. Seed-volume replacement is STRUCTURAL, not drift. modules/cloudinit-vm chains
   libvirt_cloudinit_disk.seed (stages the ISO in /tmp) -> libvirt_volume.seed
   (create.content.url = that /tmp path). The 2026-07-17 host reboot cleared /tmp,
   so the disk re-creates with a NEW random filename, so the url changes, so the
   volume force-replaces -- while attached to the RUNNING domain as sda. The real
   ISO is intact. Recurs after every host reboot. Warrants D-130 (next-free
   confirmed 2026-07-18).

ALSO RECONCILED

- Bookend item (a) CLOSED (measured): vcloud host patched to 6.8.0-136 and rebooted
  2026-07-17; apt clean; no reboot-required. D-127 autostart chain PROVEN by a real
  unattended reboot -- both VMs + all 3 SSH targets recovered with zero manual
  intervention; base-leg ok, NetBox 302, edge 0% loss. Item (b) STAYS OPEN (edge
  guest still on 14.3-RELEASE-p16; a host reboot does not patch it).
- Stage-3 "HELD NetBox addressing" blocker in dc-dc-deployment-workflow.md is STALE.
  Measured live against the apex: 172.31.0.0/30 (Transit, scope VR1 DC0), the
  172.31.0.0/24 container, and 10.12.8.2/22 all PRESENT. Needs DOCFIX-196.
- Version drift: OpenTofu on the jumphost is v1.12.4; README.md:41 says v1.12.3.
  Coincidental to the above -- the cause is /tmp, not the version bump.

TWO OF MY OWN CLAIMS CORRECTED IN-FLIGHT (both were inferences, per hard rule 2)

- Cited platform-traps.md 1e as the warrant for the autostart bounce. 1e was
  measured on a MEMORY change and does NOT transfer to an autostart-only diff. The
  conclusion held but the reasoning was wrong; replaced with the source evidence
  above. 1e's operational rule ("0 to change is the only assurance") stands.
- Claimed the /tmp trap hits "all 9 DC0 node VMs and every containment VM". WRONG,
  retracted. libvirt_cloudinit_disk appears in exactly ONE module (cloudinit-vm),
  instantiated TWICE (main.tf:181 voffice1, main.tf:361 vvr1_dc0). The 9 nodes use
  modules/node-vm = blank-disk PXE, NO cloud-init; edges use REST config (D-113(a2)).
  Real exposure = voffice1 + vvr1-dc0 (+vvr1-dc1) = 3.

PRIOR-SESSION ROOT CAUSE

docs/changelog-20260717-d127-iac-autostart-and-guest-updates.md asserts "the 2
in-place collapse to 0 once the bookend sets those two autostart live" and "no
forces-replacement on any existing". Both are FALSE. The collapse prediction was
wrong WHEN WRITTEN, not made wrong by the reboot -- it inferred that `virsh
autostart` would be picked up by refresh, without reading the provider's Read path.
Correcting those assertions is queued as Class 1 doc-integrity work.

OPERATOR RULING (2026-07-18): do NOT proceed to DC0 leaving these behind. Fix
scripts/data/settings to 100% correct first; the post-teardown redeploy must be
error-free from these deliverables.

repo-lint: 0 fail (1 legacy WARN).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01YArUfQQe6VasfTvzzb9D6P

Permission posture: ask-list mutation surfaces so they PROMPT (not classifier-deny) ...

Root cause (claude-code-guide, doc-cited): in auto mode, unmatched mutations
fall to the classifier and get HARD-DENIED (no approval prompt). ask/deny rules
are evaluated BEFORE the classifier, so ask-listing the mutation surfaces forces
an approve/deny/adjust prompt -- the intended gating.

.claude/settings.json (operator-applied; editing the permission file is itself
gated): + ask for *opnsense-api.sh POST, *opnsense-plugins.sh apply, *tofu
apply/destroy/import/state rm, *--commit, Edit(.claude/settings*.json); + allow
for the edge GET + opnsense-plugins.sh list. deny + guard hook unchanged.

Changelog + ledger note + carry-forward (verify prompts post-reload) added.

Revert: git revert this commit, or cp .claude/settings.json.bak over it.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JUBUyinU4sBAT4HV1b9vSz

D-129: build the OPNsense edge plugin profile-installer + sharpen pins ...

Autonomous processing of D-129 items that need no operator keyboard. Repo-only;
NOTHING applied to the cloud (live plugin install stays classifier-gated).

- NEW scripts/opnsense-plugins.sh + tests/opnsense-plugins/ (17/17): named-profile
  installer over the D-113 firmware API. Installs ONE plugin at a time + polls
  upgradestatus (the firmware-lock lesson), delegates auth to opnsense-api.sh,
  warns os-qemu-guest-agent != a working agent, offline --dry-run. Closes the
  "build the reusable installer" pin.
- D-129 + dc-dc-phase2 pin: installer recorded as BUILT (use it, not build it);
  qga channel logged as an OPT-IN-var design (default OFF -> no office1/DC0-plan
  side-effect; dmacvicar 0.9.8 mechanism-to-verify); os-git-backup operator ask.
- Gauntlet ALL GREEN (68), repo-lint 0-fail.

Revert: git rm the script+harness; revert the doc/runbook edits.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JUBUyinU4sBAT4HV1b9vSz

Ledger: RETIRE boot-race carry-forward -- D-126 base-leg PROVEN 2026-07-18 ...

Operator-forced test reboot (host boot 2026-07-17 23:38:41) exercised the
After=libvirtd+poll race. All four checks PASS; the unit journal logs
"added leg" (leg absent at boot -> unit created it), the strong proof. The
D-126 base-leg oneshot self-heals office1-local's dropped L3 leg unattended.

jessea123 added to systemd-journal group + relog so future sessions read
unit journals without sudo.

Revert: restore the prior carry-forward wording (informational only).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JUBUyinU4sBAT4HV1b9vSz

D-129 verify: qga installed-but-non-functional; iperf lost to firmware lock ...

Reconcile records to the measured 2026-07-18 install verification (operator ran
the firmware POSTs via `!`; agent verified read-only). No cloud mutation here.

- os-qemu-guest-agent: package installed, NON-FUNCTIONAL -- daemon off + the
  opnsense-edge module defines no org.qemu.guest_agent.0 libvirt channel
  (guest-ping fails). Functional enablement = channel-in-module + service-enable
  + edge restart -> DEFERRED; new DC edges born with the channel.
- os-iperf: did NOT install -- back-to-back firmware POSTs collided on the
  OPNsense firmware lock. Re-run pending; profile-installer must be 1-at-a-time
  + poll upgradestatus.
- D-129 Verification note + phase2 pin + as-built row + ledger reconciled.

Revert: git revert; nothing installed/applied by this commit.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JUBUyinU4sBAT4HV1b9vSz

D-129 partial-rule: adopt VR1 edge plugin profile + pin the rest at deploy steps ...

Operator directive 2026-07-18 ("install the recommendations + pin the rest").
Doc/runbook-only; the LIVE install is operator-gated (auto-mode classifier
blocked the agent POST) and pending verification -- no cloud mutation here.

- D-129 PARTIALLY RULED (status line kept OPEN so ledger-scan still tracks the
  4 sub-decisions: COS-edge scope, os-frr, os-tailscale, edge-NTP). VR1 profile
  {os-qemu-guest-agent, os-iperf} adopted; pinned-at-steps mapping added.
- dc-dc-phase2 (DC-edge section): pin the VR1 profile at edge bring-up + build
  the reusable opnsense-api profile-installer there.
- dc-dc-phase6 Step 10: pin os-node_exporter gated on the COS-edge scope call.
- vr1-office1-as-built: FreeBSD base 14.3->15.1 recorded; directed plugins noted.
- session-ledger + machine block synced.

Revert: git revert this commit; nothing was installed/applied on the cloud.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JUBUyinU4sBAT4HV1b9vSz

Ledger+D-129: OPNsense 26.7 edge review + version drift + key-push record ...

Doc-only recording (nothing installed/applied on the live cloud):
- docs/opnsense-edge-addon-review-20260718.md (NEW): full 104-plugin catalog
  review of office1-opnsense @ 26.7, sorted by minimize-delta-to-Roosevelt.
  Findings: os-git-backup installed but UNCONFIGURED (no backup running).
- D-129 (PROPOSED): edge plugin/add-on base profile; operator rules buckets.
- vr1-office1-as-built.md: edge version drift 26.1.11 -> 26.7 recorded.
- session-ledger.md: 26.7 update + review note; operator personal key pushed
  to the 3 Office1 Linux VMs + edge (GUI, durable); machine-block re-seeded
  (next-free D=130, D-129 PROPOSED).

Revert: delete the review doc + D-129 entry; revert the as-built/ledger notes.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JUBUyinU4sBAT4HV1b9vSz

Ledger: forced test-reboot marker for the base-leg boot-race proof ...

Operator is forcing a vcloud reboot to prove site-baseleg-office1.service
self-heals the base leg at boot (carry-forward #1). The rebooting session dies
with the host; this marker gives the post-reboot session the exact 4-step
verification (status=0 / journal 'added leg' / check ok / ssh voffice1 live) and
the retire-or-fix decision. Continuity lives in the committed ledger.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QMKdXCquMnh1jKH2sWXPMg

Ledger: mark 2026-07-17 base-leg/D-128 session CLOSED (two carry-forwards recorded) ...

Session deliverables closed + committed (1958063, 6f26b55): post-restart sweep,
site-baseleg.sh + D-126 amendment, D-128 operating model, gap register item 20,
skill per-DC discipline. Two honest carry-forwards kept OPEN, NOT marked done:
(1) boot-race proof (unit installed+enabled; unproven until an actual reboot);
(2) DC leg rows (deferred-until-measured per hard rule 2). Machine-derived block
re-seeded: next-free D = 129 (D-128 ADOPTED).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QMKdXCquMnh1jKH2sWXPMg

D-126 base-leg oneshot (site-baseleg.sh) + D-128 operating model; post-restart sweep ...

vcloud post-restart health sweep all-green (host on 6.8.0-136, patch+reboot done;
libvirt/pools/autostart clean; Office1 stack self-recovered end-to-end). Sweep
surfaced a recurring break: office1-local is an ISOLATED libvirt net, so the host's
base L3 leg (10.10.0.10/24 on the bridge + compose route 10.10.1.0/24 via 10.10.0.20)
lives nowhere in the XML and drops on every reboot -- the un-persisted foundation
D-126 assumed but never owned.

- NEW scripts/site-baseleg.sh + tests/site-baseleg/ (24/24): root Type=oneshot unit,
  After=libvirtd (+virtnetworkd for modular hosts; ordering MEASURED here = monolithic
  libvirtd), re-adds the leg at boot. Bridge DISCOVERED from the stable net name (never
  a baked virbrN, PATTERN-1); apply idempotent + root-guarded; check = session-verify.
  INSTALLED + enabled this session; boot-race UNPROVEN until an actual reboot.
- docs/design-decisions.md: D-126 amendment (base-leg durability) + NEW D-128 (operating
  model -- Claude on the vcloud jumphost; Plane-1 substrate on vcloud / Plane-2 executes
  on voffice1; workstation tailnet is the human path; D-107 untouched).
- Skill invariant + routing row (SKILL.md), Cross-cutting bullet (dc-dc-deployment-workflow.md),
  session-ledger + changelog.

Gauntlet ALL GREEN (67 harnesses), repo-lint 0-fail. Nothing merged to main (stage-close).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QMKdXCquMnh1jKH2sWXPMg

Ledger: record LXD service-VM autostart verification (2026-07-17) ...

Measured this session: office1-netbox + office1-tailscale (LXD VMs inside
voffice1) both already carry boot.autostart=true (confirms the D-127
guest-update note; no change made). Documents the autostart chain now proven
end to end -- vcloud->voffice1/edge via virsh autostart; voffice1->netbox/
tailscale via LXD boot.autostart -- so a host reboot self-recovers Office1.

Revert: `git revert <this>` (doc-only).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CsPuN3nSP1EMzkBhh8KJQt

Ledger: re-seed machine-derived block + record 2026-07-17 edge cold boot ...

Re-seed (from `bash scripts/ledger-scan.sh`, 2026-07-17):
- next-free D 125 -> 128; add SEC-010 to OPEN security rows.
- correct stale "D-123 Model A" -> Model B (operator ruling R-1, supersedes);
  fold D-124..127 as ADOPTED; retire the "Stage-4 addressing HELD" flag.
- drop the D-115 "known ledger-scan defect" note: scan now keys on the last
  **Status:** line per `## D-NNN:` block, so D-115 (ADOPTED) no longer flags.

Session-scoped update (health sweep + edge cold boot):
- vcloud HOST never rebooted (uptime 8d); "bookend" only partially done --
  voffice1 + tailscale rebooted to kernel -136; host + edge were not.
- office1-opnsense cold-booted + verified clean (2.0 GiB mem, pf 80, kea up,
  LAN/egress 0% loss) -> D-127 gate met -> `virsh autostart` ENABLED.
- voffice1 autostart ALSO enabled -> both foundational VMs autostart per D-127.
- still pending: vcloud kernel -136 pending in apt (not installed) -> apt
  full-upgrade THEN reboot; edge guest OS still on p16.

Revert: `git revert <this>` (doc-only; no code/tooling touched).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CsPuN3nSP1EMzkBhh8KJQt

D-127 IaC autostart matrix baked into deploy tooling + Office1 guest updates ...

Operator directive: bake the autoboot-vs-manual matrix into the IaC so DC0/DC1 get
correct autostart at creation, not by hand. Added an `autostart` bool var to modules
cloudinit-vm/opnsense-edge/node-vm (wired to libvirt_domain.autostart); set explicitly
per instance (shared modules => IaC is source of truth): voffice1=true,
office1-opnsense=true, vvr1-dc0=FALSE, vr1-dc0-opnsense=true, node-vm=FALSE.

HARD GATE verified: the two existing Office1 domains (voffice1, office1-opnsense) plan
as autostart false->true UPDATE-IN-PLACE, NOT replacement (replacement would destroy the
live host/edge). vvr1-dc0 is a new create with autostart=false baked in. Outer plan now
5 add / 2 in-place / 6 destroy; the 2 collapse to 0 once the bookend sets those two
autostart live pre-apply. tests/opentofu-validate T11-T15 pin the matrix against drift.

Standup runbook records the composed service VMs' LXD boot.autostart step. Confirmed
DC0/DC1 create NO LXD instances (inner root = node-vm + opnsense-edge + planes/pool/
wan-bridge) -- DC side is purely this VM matrix.

Office1 guest updates (agent sudo inside the guests): office1-netbox apt upgrade (no
reboot, netbox healthy); office1-tailscale full-upgrade -> kernel 6.8.0-136 + reboot
(back, re-advertising 10.10.0.0/22); voffice1 0-upgradable; LXD boot.autostart=true set
on both. vcloud + office1-opnsense stay in the operator's bookend.

Gauntlet ALL GREEN (66); opentofu-validate clean; repo-lint 0-fail.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ck6xh3jWQi5b3Su8Dx1LEH

Block B complete: d124-transit-seed tooling + full D-124 NetBox import ...

Operator chose "write the seeder". netbox/d124-transit-seed.py (NEW) + harness
(21/21, incl. a cross-file consistency check so the seeded role/container can't
drift from dc-rack-mgmt-import's required ROLE_SLUG/CONTAINER) -- mirrors
d115-office-carve (NB client, sandbox gate, WAF UA, dry-by-default). Seeds ONLY
the transit role + the 172.31.0.0/24 UNSCOPED container (mirrors edge's /16).

Ran on the apex (gated, dry-run-verified, token server-side, sandbox-only):
seed -> role transit (id=30) + 172.31.0.0/24 (id=137); then dc-rack-mgmt-import
placed 172.31.0.0/30 (transit, vr1-dc0) + 10.12.8.2/22 (rack, dns=vvr1-dc0),
matching the vr1_dc0_rack_* tfvars. Full D-124/edge-WAN IPAM now in the apex.

changelog/ledger/readiness updated (Blocks A+B DONE).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ck6xh3jWQi5b3Su8Dx1LEH

NetBox apex recovery + restart policy + edge-WAN import (Block A) ...

Found the IPAM apex (office1-netbox, netbox-docker) DOWN -- cleanly exited ~3h prior,
no auto-restart. Operator-approved: brought it up (docker compose up -d, HTTP 302) and
added restart: unless-stopped to all 5 services so it survives instance reboots (incl.
the bookend); override backed up on host, config-validated before apply.

Block A committed (gated, dry-run-verified): dc-edge-wan-import created 172.30.2.0/24
(vr1-dc0) + 172.30.3.0/24 (vr1-dc1), role edge. Token read server-side on the apex host
(never in agent context); sandbox-only, upstream untouched.

Block B (D-124 rack) BLOCKED: dc-rack-mgmt-import dies on 'role transit absent' -- the
transit role + 172.31.0.0/24 container have no seeder. Pending operator tooling decision
(decoupled from the deploy). as-built + ledger updated; changelog added.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ck6xh3jWQi5b3Su8Dx1LEH