savegame 2026-08-08: dc0 .7 tailscale FIXED (advertise-only) + 10.13 re-IP PIVOT + dc0 checkpoint plan ...

GA-R4 bookend + sweep for the session that fixed the dc0 .7 tailscale install
(advertise-only, --authkey=file:, check guards -- committed 02e0b12/faef662) and
surfaced the 10.12->10.13 re-IP pivot.

- CURRENT-STATE: 2026-08-08 pivot callout -- 10.12 collides with the live IPv4
  cloud; drive dc0 to full deployment as a CHECKPOINT, then teardown+redeploy on
  10.13; the re-IP is a D-115 supersession + D-101 termination, NOT YET RULED.
- Sweep docs/audit/queued-findings-20260808-...reip-pivot.txt (F1-F16): the pivot,
  the D-115 conflict, MAAS profiles missing on the racks (fix existing+rebuild),
  no service migration (DC0>MAAS-regional>MAAS-rack), dc0 live inventory,
  checkpoint scope, + instrument-currency #22 (F3 wrong-store retraction; pkill
  self-match).
- 10.13 NetBox subnetting DRAFT (Task #2; octet-preserving proposal, not ruled).
- changelog-20260807 F3 retraction/correction; bounded ledger close summary.

Gauntlet ALL GREEN (102); repo-lint 0 fail. Tasks #1-#4 pinned.
Status ONLY in CURRENT-STATE.md.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Fg98z7QyzwYUs8fsWCn728

site-tailscale: advertise-only subnet router + authkey=file: + check guards ...

Fixes the 2026-08-07 install incident where bringing .7 up as a subnet router
with --accept-routes blackholed its own L3 (it imported a route sending its
own return traffic for the advertised /22 into tailscale0) and locked us out.

- install: DROP --accept-routes (a subnet router advertises, it does not need
  to consume routes); pass the pre-auth key via --authkey=file:<path> so the
  secret never lands on argv / in ps (the key leaked that way during the
  incident).
- check: add two assertions, each with a failing-direction fixture --
  own-subnet-not-routed-via-tailscale0 (the blackhole guard) and control-plane
  reachability (live HTTP from $LOGIN_SERVER, not just DNS).

Validated LIVE: advertise-only re-join brought .7 up Running/Online (TSIP
100.64.0.57) with its own subnet NOT hijacked and no lockout; route now awaits
Headscale approval. Harness 27/0, gauntlet ALL GREEN (102), repo-lint 0-fail.
Body: docs/changelog-20260807-dc0-tailscale-install.md (UPDATE section).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Fg98z7QyzwYUs8fsWCn728

site-tailscale: prep verb + untagged VR1 (office1-mirrored) + forwarding assertion ...

Extends scripts/site-tailscale.sh to three verbs (prep|install|check) so the
per-DC .7 subnet router is brought up exactly as the working Office1 router.

- prep <site>: install the tailscale .deb from a rack-staged copy ($TS_DEB;
  the .7 has no external egress) + enable IP forwarding (/etc/sysctl.d/
  99-tailscale.conf, sysctl --system) and ASSERT it took.
- tag now OPTIONAL: TS_TAG defaults empty = untagged (office1-mirrored, VR1);
  install omits --advertise-tags and adds --accept-routes (office1 RouteAll);
  TS_TAG=tag:subnet-router restores the D-129(iii) tagged design (Roosevelt).
- check now ASSERTS IP forwarding -- the load-bearing subnet-router property
  that 'tailscale up --advertise-routes' warns-and-succeeds without, so the
  route could be approved while nothing forwards to Horizon (advisor 2026-08-07).

Harness: 23/23 (new failing-direction fixtures prep-noforward, check-noforward,
check-tag-notag, prep-fromdeb, install-tag-happy). Gauntlet ALL GREEN (102);
repo-lint 0 fail.

Records the operator's untagged/office1-mirror deferral as a D-129(iii)
amendment ([OPS], tags/autoApprovers/star ACL -> bare-metal) with the verbatim
utterance. Body: docs/changelog-20260807-dc0-tailscale-install.md.

Live install NOT yet executed (staged .deb -> dpkg -> prep -> install ->
operator Headscale approval -> check).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Fg98z7QyzwYUs8fsWCn728