Stage 5 dc0: vault init DONE + ovn-central RESOLVED; D-142 vault-init QoL saved ...

Live (operator-run one-shot, recorded no-secrets): phase-02-vault-bringup Steps
2.1-2.3 on the dc0 rack (-m vr1-dc0), vault active/idle, root CA generated
(valid 2026-08-05 -> 2036-08-02). ovn-central/3,4,5 ALL active -- OVN NB/SB
cluster formed; the multi-session cert saga is closed by the two fixes landed
this cycle (dc-node-etchosts Step 1.2b CN delivery + D-052 '' -> metal-admin).

Engineering saved (PROPOSED, not executed -- operator: run current commands now,
test QoL next opportunity):
- D-142 PROPOSED: vault-init workflow QoL sweep (APPROVED-IN-PRINCIPLE, IMPL
  DEFERRED; R2 off-host transport UNRESOLVED). Distinct from D-068 (substrate) /
  D-011.6 (manual-unseal bar).
- docs/audit/vault-init-qol-proposal-20260805.md: R1-R5 + full hidden-prompt
  safety analysis + tee-write residual + pre-init writability probe + R3 harness
  constraints + operator's verbatim safety constraint.
- runbook-fold-register F13: -m openstack -> -m vr1-dc0 / run-location = DC rack
  (D-138) on phase-02-vault-bringup (scope stretch stated).

CURRENT-STATE + as-exec updated (L10 coupling). Security hygiene: child token in
operator paste was ttl=10m/expired -> benign, not stored. Remaining (separate):
ceph-mon/2 + ceph-radosgw/0 allocating (apt-wedge) cascade.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Fg98z7QyzwYUs8fsWCn728

Fold: open the register, close both Class-A rows (F1 phase4, F12 SKILL.md) ...

Operator ruled fold-before-exercise, start at Phase 2, all DCs come up in their own
region. Register: docs/runbook-fold-register.md, 12 rows classed A/B/C.

Measured gap: D-138 and D-139 appear in NO runbook. Nothing in the chain builds a per-DC
MAAS region, a snap proxy, or the GUA carve. Running it as written would rebuild the
pre-D-132/D-138/D-139 shape and fail where we already fixed things by hand.

F1 (Class A): phase4 asserted "Both DCs deploy from the Office1 headend by the SAME
procedure" and "Every juju and maas command runs there". The 2026-07-27 ruling it cited
was about DC ordering, not run location; D-138 reversed the location half. Replaced with
a tool-split table; superseded text struck in place, not deleted.

F12 (Class A, worse): SKILL.md -- loaded by every session before any runbook -- had ZERO
mentions of D-138 while stating Plane 2 executes on voffice1. Now carries the split, the
structural reason, and the measured test: juju controllers on voffice1 -> "No controllers
registered"; on the dc0 rack -> the live vr1-dc0-controller.

Both record the racks-have-no-repo-clone trap and the sha256-verify-staged-copies rule.

A row closes on the edit AND on being exercised by the dc1 Phase-2 rebuild; an edit alone
is a ruled-but-not-built claim.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HvCyrwvYTTcDYnRErfMsNf