Ruling 1: vr1-dc0-maas RETIRED (repo removed); INCIDENT: pod delete cascaded to 9 machine records ...

- git rm opentofu/vr1-dc0-maas (operator-ruled 'Retire fully'); validate PASS
- maas vm-host delete 4 removed the stale pod AND the nine linked DC0
  machine records (association check ran after the delete -- agent error,
  owned; capture docs/audit/incident-20260721-pod-delete-cascade.txt)
- Substrate measured intact (10/10 domains, MAC pins config-carried);
  CURRENT-STATE corrected same commit (GA-R1 C2); recovery flow gated,
  pending operator decision; SEC-013 file cleanup HELD

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013XRtm5sDQgUsZyTJk3k7dz

Stage-close batch: ledger-scan PARTIAL fix; DOCFIX-197; D-103/D-123 pod-refutation amendments; GA-R7 memory review ...

- scripts/ledger-scan.sh: PARTIALLY-RULED decisions now surface (D-131
  blind spot); harness regression fixture, 46 checks ALL PASS
- DOCFIX-197: phase2 runbook Step 11 leg selection corrected to executed
  reality (dc0<->dc1 leg; office1 leg carries live transit)
- D-103/D-123 amendments + modules/maas-vm-host header: 2026-07-20
  measured pod refutation + per-machine-virsh ruling RECORDED (cited to
  captures; no new ruling made)
- GA-R7 memory review DONE: no memory-only facts remain
- Read-only: stale MAAS pod object confirmed (id=4 vr1-dc0-inner, virsh)
  for the pending retire-or-keep ruling

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013XRtm5sDQgUsZyTJk3k7dz

Step E netem DONE -- G10 CLOSED; netem-link local mode; G16 opened (office1 channels residual) ...

- modules/netem-link: optional local execution (empty ssh target -> bare
  sudo tc; D-128 outer root runs ON vcloud); NEW tests/netem-link harness
  (12 cases); gauntlet 76 ALL GREEN
- outer root: module netem_vr1_dc0_vr1_dc1 wired -- virbr5 (measured at
  wire time), placeholder profile 'delay 3ms 1ms loss 0.01%' (S6 lean,
  PROVISIONAL; D-100 gap #11 unruled); runbook Step-11 leg divergence
  flagged, DOCFIX queued
- 1/1/0 STOP honored; operator RULED 'Targeted netem apply (Recommended)';
  saved -target plan exact 1/0/0, applied; qdisc live on virbr5,
  virbr7/virbr3 untouched (docs/audit/stepE-netem-20260721.txt +
  outer-{plan,apply}-20260721-netem*.txt)
- Convergence 0/1/0 = office1 channels=[] residual only
  (outer-plan-20260721-postE-residual.txt) -> split per E3 into NEW gate
  G16; CURRENT-STATE section 5 expected plan re-recorded 0/1/0 (GA-R1 C1)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013XRtm5sDQgUsZyTJk3k7dz

Disconnect collapse: predecessor bookend landed; netem-tc install VERIFIED (step E unblocked) ...

- docs/audit/netem-sudo-install-20260721.txt: read-only verification of the
  operator-run install (0440 root:root, byte-identical, sudo -n -l exit 0)
- CURRENT-STATE step-E paragraph: install PENDING -> INSTALLED+VERIFIED,
  remaining path stated (GA-R1 C1/C2, same commit)
- session-ledger: bounded SESSION CLOSE for the close-and-delivery session
- changelog-20260721-netem-install-verify.md: session changelog w/ reverts;
  ledger-scan D-131 status-phrasing blind spot flagged as queued finding

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013XRtm5sDQgUsZyTJk3k7dz