Stage-5 grounding audit: session bookend (GA-R4) + ledger rotation ...

Close bookend for the autonomous Stage-5 grounding audit. Bounded ledger
summary (9 bullets, cap 15); full body archived in the same commit as
docs/archive/changelogs/changelog-20260727-stage5-grounding-audit.md, the ONE
changelog for this session per GA-R2/D1, carrying a per-item revert.

Ledger rotation: the bookend pushed the live ledger to 305 lines against the
300-line cap, so the oldest remaining live summary (2026-07-24, caveman
guardrails + DC1 proxy-build start) moved VERBATIM to
docs/archive/session-ledger-rotated-20260727.md as a clearly-labelled second
rotation pass. Live ledger now 289 lines. Sessions from 2026-07-25 remain live.

Reconciled against repo ground truth at close: ledger-scan reports 21 open SEC
rows and next-free D 138 / DOCFIX 205 / BUNDLEFIX 053 -- all UNCHANGED, which
is correct: this session assigned no number because it remediated nothing. The
machine-derived block needed no re-seed.

The changelog records, prominently, that a SESSION-SCOPED PERMISSION BLOCK is
live in the gitignored .claude/settings.local.json and must be removed at
close; the scope doc's section 6 is its only durable record.

Revert: git revert this commit; then restore the 2026-07-24 summary from the
rotation archive if the ledger rotation is also being undone.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HvCyrwvYTTcDYnRErfMsNf

Stage 4 close-out set: GA-R2 consolidation, skill sweep, snapshot, GA-R7 review ...

Every substantive Stage 4 item is closed or split to gate row G17. This is the GA-R6 close-out
set; only the operator-gated merge to `main` remains.

GA-R2 CONSOLIDATION: the 7 stage changelogs archived to docs/archive/changelogs/ (top-level
docs/ 25 -> 18, 113 archived total) and the stage record written at
docs/archive/stage-records/vr1-stage4-record.md. It records what the stage actually delivered
(READY handoff, not deployed nodes), the three things a future session should read first, and
the false-green pattern this stage kept surfacing. 12 stale `docs/changelog-*` paths in live
surfaces rewritten to the archive -- including several already dangling from the G12 close, so
every changelog reference in CURRENT-STATE / session-ledger / security-ledger now resolves.

SKILL SWEEP: three new INVARIANTS folded in --
  - per-DC ARTIFACT DELIVERY is a per-DC STRATEGY (dc0 full mirror / dc1 caching proxy, D-135
    amendments); checking dc1 as a mirror fails BY DESIGN. Corollary, learned the hard way: a
    per-DC utility service OWNS ITS OWN network prerequisites -- never let one strategy's
    teardown be able to break the other's.
  - Stage 4 hands off READY nodes, NOT deployed ones (DOCFIX-200). Any surface saying "nodes
    Deployed" as a Stage-4 exit is a defect; four were found and fixed. Consequence: nothing
    node-side is probeable in Stage 4, which is why G17 exists.
  - "A CHECKER THAT CANNOT FAIL IS NOT A GATE", with the working rules that came out of two
    measured false greens: assert on CONTENT not existence; an unrecognised state REFUSES;
    "could not look" is never "nothing there"; ENUMERATE what exists rather than only auditing
    what is declared, because a register cannot report the absence of a row it does not have;
    and when a test asserts a literal finding string, REPLACE the assertion, never delete it.
Plus two routing rows (per-DC artifact checks; D-137 as the credential-lifecycle authority).

SNAPSHOT REGENERATED: .claude/skills/openstack-cloud-ops-consolidated-20260727.md (1589 lines,
ASCII + LF byte-verified, all 7 sections). The superseded 20260725 snapshot is REMOVED rather
than kept alongside -- a stale snapshot being uploaded is the exact failure
docs/audit/skill-divergence-20260725.md records (a failed clone + a mis-shaped handoff), and it
is a derived artifact regenerable from any commit.

GA-R7 MEMORY REVIEW: NO new memory written -- everything durable from this stage graduated to
the skill and the repo, which is the correct GA-R7 outcome, not an omission. Both existing
entries verified against the repo (the finding-class baseline they cite does exist) and extended
with the two reasoning traps this stage produced: the register cannot see a credential it has no
ROW for, so enumerate what exists; and diagnose a denied call by checking whether an existing
rule failed to MATCH before blaming the classifier (the measured 2026-07-26 root cause). Also
marked the ask-vs-allow precedence claim UNVERIFIED so no future session relies on it.

Noted, not actioned (hard rule 1): T24's finding-class baseline covers TIER 1 only, so tier-2/3
classes have no baselined red state and a future false green there would not be caught.

Gauntlet ALL GREEN (81), repo-lint 0-fail.

Revert: git revert this commit; the changelog moves are renames and the snapshot is derived.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HvCyrwvYTTcDYnRErfMsNf

Session bookend: queue-pass CLOSED (ledger summary, changelog archived, scan fix) ...

Bounded GA-R4 close entry; changelog-20260723-queue-pass.md -> docs/archive/
changelogs/; as-executed index row broadened to the window's full scope.
AT CLOSE: ledger-scan false-close defect (detached-amendment status hijack,
D-132 dropped) found by the close reconciliation itself -- fixed number-keyed
with regression cases (48/48; gauntlet 76 ALL GREEN), machine block re-seeded,
scan re-verified truthful. GA-R7 memory review: no changes.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VUjEb7onHpdqFHUnio6iVw

G12 dc1 close-out: consolidation + skill sweep + CURRENT-STATE (G12 CLOSED) ...

- GA-R2 consolidation: 3 dc1 session changelogs (07-21 authoring, 07-22 build,
  07-23 edge) archived to docs/archive/changelogs/; Stage 3 record gains a
  "G12 CLOSED 2026-07-23" section + table rows
- CURRENT-STATE: G12 gate CLOSED, section-1 stage narrative updated
- skill sweep: per-DC dedicated MAAS->libvirt power key (SEC-012/SEC-016)
  added as a standing DC-standup invariant
- GA-R7 memory review: clean (no changes)

Close-out set complete; ready for operator-gated merge to main.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VUjEb7onHpdqFHUnio6iVw

Session bookend: queue-pass session closed (9 rulings, A9 delivery, dc1 addressing ratified) ...

Bounded GA-R4 summary appended; both same-day changelogs archived in
this close commit; netem changelog pointer updated.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019aLU6j24tjquxgYQaAHgsV

STAGE 3 CLOSE (operator-ruled): GA-R2 consolidation + skill sweep; gauntlet 76 ALL GREEN ...

- Four execution-session changelogs -> docs/archive/changelogs/;
  vr1-stage3-record.md finalized (close summary + session table)
- CURRENT-STATE stage line CLOSED (vr1-dc0 scope; dc1 = HELD G12);
  workflow Stage-3 State row + runbooks/README corrected
- Skill sweep: D-131 forwarder invariant + MAAS pod traps + merge
  precedent folded; no stale facts found
- Close-out evidence: gauntlet 76 ALL GREEN, repo-lint 0 fail, GA-R7
  memory review done (changelog items 11, 17)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013XRtm5sDQgUsZyTJk3k7dz

Batch 4 C2: v1/VR0-era changelog consolidation (GA-R2, GA-F09) ...

v1-redeploy-changelog.md was the era's own running record; its
"completion consolidation" TODO stays open in the ledger block.
Consolidated record: docs/archive/stage-records/v1-era-record.md. Files moved verbatim (git mv, history
preserved). MANIFEST of consolidated sources (GA-R2/D2):
  changelog-20260703-process-hardening.md
  v1-redeploy-changelog.md

Revert: git revert this commit (restores top-level paths).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VZbUeRE8weySLSGY1odrCi