Session permissions: allow ledger-scan + opentofu-validate (read-only; gates untouched) ...

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VUjEb7onHpdqFHUnio6iVw

Queue pass: vr1-dc0-maas cache residue deleted (association-checked, operator-approved) ...

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VUjEb7onHpdqFHUnio6iVw

G13 CLOSED: office1 edge bundle -- qga channel live, 26.7.1, os-iperf in (operator-approved) ...

Saved-plan 0/1/0 channel apply (bounce = the ruled restart; guest-ping proven),
REST update 26.7->26.7.1 (no reboot), vr1-edge profile complete (both plugins
installed=1 by read-back), outer plan re-converged zero diff. Close capture
docs/audit/g13-close-20260723.txt; G13 row + section 5/7 + as-built updated.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VUjEb7onHpdqFHUnio6iVw

G13 plugin leg PARTIAL: qga installed, os-iperf refused pending 26.7.1 (measured) ...

Operator-approved vr1-edge apply on office1-opnsense: os-qemu-guest-agent 1.3
verified installed; os-iperf refused by the edge (upgradestatus: "update to
opnsense-26.7.1 is required") -- new gated maintenance decision, nothing
further mutated. G13 row updated in the same commit.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VUjEb7onHpdqFHUnio6iVw

SEC-010 live re-assert: idempotent nft file on voffice1 + both DC racks (operator-approved) ...

Declare-then-delete preamble inserted in place on all three hosts; sec010-fw
double-restart converged (4/2/2 drops, no duplication). Pre/post capture
docs/audit/sec010-reassert-20260723.txt; logged window ops-sec010-reassert;
per-host revert = restore .pre-reassert-20260723 backup + restart.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VUjEb7onHpdqFHUnio6iVw

Queue pass: post-G12 queued findings delivered (5 script/harness fixes + DOCFIX-198/-199) ...

- opnsense-prep-image.sh: survives bash -s (BASH_SOURCE unbound fix; T3b)
- site-headend-install.sh: version/site-neutral hints; nftables-sec010
  idempotent reload preamble; serial-log staging dir in --host-nodes (+check)
- opnsense-bootstrap-apikey.sh: sshd readiness wait + first-scp retry +
  ssh -n stdin guard + minter-beside-script usage note (T9/T10)
- DOCFIX-198: phase2 runbook Steps 9-10 SUPERSEDED banners (pod route refuted,
  D-103/D-123 amendments) + DC standup definition-of-done section (lands the
  staging-dir + SEC-016 snap-refresh re-assert DoD obligations)
- DOCFIX-199: D-112(c) console-bootstrap payload requirements (util.inc et al)

Gauntlet ALL GREEN (76); repo-lint 0 fail. Per-item reverts in
docs/changelog-20260723-queue-pass.md. No cloud mutation this session;
queued: gated live re-assert of the nftables-sec010 files on all three hosts.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VUjEb7onHpdqFHUnio6iVw