G12 dc1: apex confirm-free captured; dc-rack-mgmt-import gains per-site (--site) dc1 support ...

Confirm-free vs live apex (read-only): dc1 planes already assigned+consistent,
transit 172.31.0.4/30 + rack 10.12.68.2 free, uplink 172.30.3.0/24 registered.
Importer harness 117/117; live dc1 dry-run preflight PASS (captures committed).
The apex --commit remains an operator-gated step.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VifVpH3XQQxQz8NQ1VxNau

D-124 addressing pinned: transit supernet 172.31.0.0/24 (operator-ratified); importer CONTAINER + harness ...

Operator ruled the three dc-rack-mgmt-import.py scoping flags + ratified the
values (2026-07-16): seed a dedicated `transit` role; CARVE a dedicated transit
supernet (not Cloud) = 172.31.0.0/24; scope vr1-dc0 ("mirror the edge"); transit
/30 172.31.0.0/30; rack IP 10.12.8.2.

- netbox/dc-rack-mgmt-import.py: CONTAINER "10.12.0.0/16" -> "172.31.0.0/24"
  (+ header note, RULED scope flags, ratified usage example). Still takes
  --transit-cidr/--rack-ip as required inputs; still fail-loud on missing/
  collision container (the backstop for a block picked against a stale draft).
- tests/dc-rack-mgmt-import/{run-tests.sh,test_logic.py}: CONTAINER assertion +
  every transit fixture rebased Cloud->172.31.0.x (shapes/host-bits preserved so
  rejections still die for the right reason). 96/96 PASS.
- docs: D-124 AMENDMENT (carve + ratified addressing) + changelog-20260716-
  d124-addressing-pin.md (the exact on-host --commit sequence) + session-ledger.

NOT DONE (cannot from here): the NetBox --commit. office1-netbox (10.10.1.10) is
UNREACHABLE from the vcloud jumphost (ping/TCP:8000/HTTP all fail, no SSH/tunnel)
and the apex token is a secret on that host -- the write is an on-host operator
step. NO apex mutation in this commit.

Gauntlet ALL GREEN (63); repo-lint 0 fail.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ck6xh3jWQi5b3Su8Dx1LEH

Stage 3 (vr1-dc0) prep batch: D-121..D-124 rulings + substrate/rack wiring, HA overlay, NetBox importers ...

Prepares the VR1 Stage-3 DC substrate so the live steps reduce to review-plan-and-apply.
Authoring + offline validation only -- NO cloud mutation; every tofu apply, NetBox --commit,
and rack install stays operator-gated. Four decisions ruled this batch, all recorded:

- D-121 (ADOPTED): make the decorative single-unit control plane REAL. 14 services scale 1->3
  (D-009's mechanical scale-up pulled into VR1); node layout = Option C (3 control + 2 compute +
  3 storage/DC, sizing set) after a whole-host resource validation (256 vCPU/1024 GiB/10 TiB);
  vault sub-ruling = v-a (MySQL-backed, charm-verify gated). Placement-balance rule for Stage 5.
- D-122 (ADOPTED): VR1 site shape -- nested-per-site containment, dark fiber East-West only,
  dedicated per-site L3 ISP uplink, 2-NIC fabric-routed DC edge (LAN=provider-public, WAN=uplink),
  per-site MAAS. Edge NIC count baremetal-matched (nodes 6, edge 2).
- D-123 (ADOPTED Model A): DC nodes vcloud-level; site-down = destroy the vr1-dc0-* group; MAAS
  region on Office1 + a rack controller per DC (vvr1-dc0).
- D-124 (ADOPTED Scheme A): the Office1-region<->DC-rack management overlay -- a transit link on
  the office1<->dc0 mesh leg; rack sizing 4/8192/80.

Code (all validated, NOT applied):
- OpenTofu: new modules/site-wan (NAT /24 uplink, provider-schema-confirmed); main.tf Stage-3
  section -- vr1_dc0_wan, the 2-NIC edge, 8 Option C node VMs (for_each), the vvr1-dc0 rack
  (two legs, static IPs from new vr1_dc0_rack_* tfvars -- NetBox-assigned, not invented), netem
  held, mesh-link network_name output; stale vr1_dc1_planes comment fixed. Step-9 maas-vm-host
  deliberately deferred (DOCFIX-179: its maas provider would force every plan to demand creds).
  tofu validate Success; opentofu-validate 11/11.
- NetBox: dc-edge-wan-import.py (58/58) + dc-rack-mgmt-import.py (96/96) -- register the DC-edge
  /24s + the rack transit/IP, dry-by-default, whole-plan preflight, operator-supplied literals.
- overlays/dc-ha-scaleup.yaml: the D-121 14-service HA scale-up (Stage-5), placement tokens +
  rabbitmq min-cluster-size + hacluster cluster_count + re-declared vault-hacluster.
- scripts/site-headend-install.sh: rack-only mode (enrolls a DC rack to Office1's region).
- runbooks/dc-dc-phase2-tofu-dc-substrate.md: fix-forward (D-119 naming, Steps 4-5 REST-API,
  D-121/122 folded in, stale gate corrected).

docs/session-ledger.md + dc-dc-deployment-workflow.md reconciled; three changelogs added.
Gauntlet ALL GREEN; repo-lint 0-fail (1 documented legacy WARN).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ck6xh3jWQi5b3Su8Dx1LEH