Batch 4 C6: docs disposition -- 24 history docs archived, 16 retained, refs rewritten ...

DISPOSITION MANIFEST (archive, one-line justifications): clientdocs-
workflow-review (v1 tenant-docs era) / D-057-DECIDED-append +
D-057-REVIEW-ITEMS + README-D057-PACK + D-058-renumber (executed v1
decision packs) / D-068-openbao-assessment-DRAFT (supplementary; the
cited analysis retained) / DOCFIX-064-phase08-changelist + docfix-draft-
20260702 (executed/draft) / handoff-20260703 + handoff-20260705
(superseded handoffs) / incident-20260712-triplefault (trap routed to
platform-traps 1b/1c long ago) / netbox-vip-queue + phase-00-maas-
standup-notes + script-quality-findings + session-findings-2026-07-02 +
tenant-cidr-overlap-PLAN + v1-pre-deploy-fixes (v1-era executed/dated) /
repo-lint-nextfree-bug-FINDING (absorbed DOCFIX-105/107; repo_lint.py
pointer updated) / upstream-bug-draft-dashboard-tls (draft, dated) /
model-a-fallback-plan (D-123 Model B adopted; fallback preserved in
archive) / stage3-adversarial-review-20260716 (R3-F register,
dispositioned in 2.10) / dc-dc-replication-DR-seed (absorbed per
workflow) / dc-dc-ipv6-charm-research + dc-dc-netem-and-ula-gua-proposal
(stage 4+ research, refs updated). RETAINED 16 top-level, justified in
the session changelog. Live-surface refs to all moved files rewritten to
archive paths (18 files). G3 cell + ledger + changelog updated same
commit (the L10 fire on a Status-line path rewrite is satisfied by the
CURRENT-STATE touch -- the check worked as designed).

Revert: git revert this commit.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VZbUeRE8weySLSGY1odrCi

S1/2.10: R3-F residual disposition -- none unaccounted ...

Full register accounting (13 items): F01 CLOSED (R-1/R-2 rulings +
re-attributions, Phase A 2026-07-16); F02 CLOSED (SEC-010 artifact
committed + G10 gate names the pre-apply check; the SEC row itself stays
open on apply); F03/F04/F05 CLOSED (D-107/D-122 amendments, Phase A);
F06/F07 CLOSED (whole-host-budget.py committed + re-validation 838/1024
FIT); F09 CLOSED (D-115 status line, scan-verified); F10 CLOSED (SEC-011
operator ruling). Residuals dispositioned NOW: F08 CLOSED-SUPERSEDED --
the 3-OSD-host premise fell when R-3 added the 4th storage node/DC (one
host of rebuild headroom exists in the ruled 3+2+4); F11 FIXED -- the
workflow authoring cell's "D-101 supernet unassigned" clause dropped
(10.12.64.0/19 assigned by D-115; vr1-dc1 stays HELD on transit/rack
addressing, G12); F12 CLOSED -- the observation's blocker (uncommitted
model) resolved by the committed calculator; transient N+1 amphora churn
sits well inside the measured 186 GiB headroom, and the Stage-6 drill
exercises the real failover; F13 CLOSED as recorded observation (wording
cosmetic; D-122's bullet already amended). Also: readiness C5 queue was
STALE (queued amendments that landed 2026-07-16) -- corrected. Batch 2
item 2.10 (amendment S1).

Revert: git revert this commit.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VZbUeRE8weySLSGY1odrCi

GA-F10/H1 + GA-R1/R6: token migration, State-line demotions, E1 type tags (2.5+2.6) ...

Mapping record: docs/audit/h1-token-map-20260719.md -- all distinct
tokens dispositioned, none unmapped. Live-surface migration: workflow
doc (26 flags -> 0; header drops the tracker model, 8 State lines demote
to identity + CURRENT-STATE pointers), runbooks (18 -> 0; close-out
instructions RETARGETED to record status in CURRENT-STATE, not the
workflow tracker), readiness doc (5 -> 0), CURRENT-STATE itself (6 -> 0:
G9 STOPPED -> BLOCKED with named blocker; stale "GA-R1 NOT yet ratified"
header + pre-D-130 divergence rows corrected per C2). Gate rows gain
GA-R6/E1 type tags ([V]/[R]) with legend. CLAUDE.md expectation line
demoted per S5b. History classes (ledger, changelogs, design-decisions)
deliberately untouched -- their disposition is Batch 4/GA-R3 structural.
Extractor re-run: zero flagged occurrences on live non-history surfaces.
Batch 2 items 2.5 + 2.6.

Revert: git revert this commit.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VZbUeRE8weySLSGY1odrCi

GA-F02: readiness doc demoted -- plan counts point at CURRENT-STATE, banner points at G9 entry ...

All three contradictory plan-count forms (5/2/6, 5/0/6, 5-add/(0-or-2)-
change/6-destroy) replaced with pointers at CURRENT-STATE.md section 5;
the falsified DEPLOY-READY status blockquote reframed as an explicitly
historical prep record; the "A FRESH session starts the deployment from
here" banner demoted to a one-line pointer at the G9 canonical entry doc
(runbooks/dc-dc-phase2-tofu-dc-substrate.md) per the operator's
post-Phase-3 scope addition (probe hole H1). Batch 2 item 2.1.

Revert: git revert this commit.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VZbUeRE8weySLSGY1odrCi

dc0-readiness: add BOOKEND vcloud host patch+reboot block ...

Persists the exact gated sequence to close the last bookend item: apt
full-upgrade onto kernel 6.8.0-136 (pending in apt, not installed; running
-134) then reboot. Ordered patch-with-VMs-up -> quiesce -> reboot; STEP 4
ends the session. Records the preconditions measured 2026-07-17: both
foundational VMs autostart=enable, libvirt-guests default suspend (so
explicit virsh shutdown for the verified cold-boot path), no qemu/libvirt in
the pending set. Includes post-reboot verify feeding section D.

Revert: `git revert <this>` (doc-only).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CsPuN3nSP1EMzkBhh8KJQt

D-127 IaC autostart matrix baked into deploy tooling + Office1 guest updates ...

Operator directive: bake the autoboot-vs-manual matrix into the IaC so DC0/DC1 get
correct autostart at creation, not by hand. Added an `autostart` bool var to modules
cloudinit-vm/opnsense-edge/node-vm (wired to libvirt_domain.autostart); set explicitly
per instance (shared modules => IaC is source of truth): voffice1=true,
office1-opnsense=true, vvr1-dc0=FALSE, vr1-dc0-opnsense=true, node-vm=FALSE.

HARD GATE verified: the two existing Office1 domains (voffice1, office1-opnsense) plan
as autostart false->true UPDATE-IN-PLACE, NOT replacement (replacement would destroy the
live host/edge). vvr1-dc0 is a new create with autostart=false baked in. Outer plan now
5 add / 2 in-place / 6 destroy; the 2 collapse to 0 once the bookend sets those two
autostart live pre-apply. tests/opentofu-validate T11-T15 pin the matrix against drift.

Standup runbook records the composed service VMs' LXD boot.autostart step. Confirmed
DC0/DC1 create NO LXD instances (inner root = node-vm + opnsense-edge + planes/pool/
wan-bridge) -- DC side is purely this VM matrix.

Office1 guest updates (agent sudo inside the guests): office1-netbox apt upgrade (no
reboot, netbox healthy); office1-tailscale full-upgrade -> kernel 6.8.0-136 + reboot
(back, re-advertising 10.10.0.0/22); voffice1 0-upgradable; LXD boot.autostart=true set
on both. vcloud + office1-opnsense stay in the operator's bookend.

Gauntlet ALL GREEN (66); opentofu-validate clean; repo-lint 0-fail.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ck6xh3jWQi5b3Su8Dx1LEH

Block B complete: d124-transit-seed tooling + full D-124 NetBox import ...

Operator chose "write the seeder". netbox/d124-transit-seed.py (NEW) + harness
(21/21, incl. a cross-file consistency check so the seeded role/container can't
drift from dc-rack-mgmt-import's required ROLE_SLUG/CONTAINER) -- mirrors
d115-office-carve (NB client, sandbox gate, WAF UA, dry-by-default). Seeds ONLY
the transit role + the 172.31.0.0/24 UNSCOPED container (mirrors edge's /16).

Ran on the apex (gated, dry-run-verified, token server-side, sandbox-only):
seed -> role transit (id=30) + 172.31.0.0/24 (id=137); then dc-rack-mgmt-import
placed 172.31.0.0/30 (transit, vr1-dc0) + 10.12.8.2/22 (rack, dns=vvr1-dc0),
matching the vr1_dc0_rack_* tfvars. Full D-124/edge-WAN IPAM now in the apex.

changelog/ledger/readiness updated (Blocks A+B DONE).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ck6xh3jWQi5b3Su8Dx1LEH

DC0 prep COMPLETE (2026-07-17): lock deploy-ready state ...

Final gate re-verified: opentofu-validate clean, the four vr1_dc0_rack_* +
vr1_dc0_ssh_pubkey_path tfvars in place, creds-audit vr1-dc0 CLEAN, gauntlet ALL
GREEN (65), repo-lint 0-fail. netem clarified as deploy-time (Step 11, the module
isn't pre-instantiated -- no prep tfvar). NetBox import clarified as decoupled
hygiene (importer not on the apex host; no netbox provider in the tree).

Remaining is NOT prep: the bookend restart (vcloud + voffice1 + opnsense patched
and rebooted together -- voffice1 is load-bearing like vcloud, so it defers with
it, not mid-prep) as the boundary into the new session; then fresh-session re-verify
of the plan + logged shell + gated outer apply. Readiness doc + ledger marked
PREP COMPLETE.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ck6xh3jWQi5b3Su8Dx1LEH

DC0 deploy-readiness handoff: per-env-key ruling implemented + netem ruled + prep checklist ...

Prep for a fresh session to run the Stage-3 Phase-2 DC0 build. Nothing applied;
the outer tofu apply remains the first (operator-gated) mutation.

Per-env-key (D-126, operator ruling 2026-07-16, option a): vvr1-dc0 gets its OWN
access key, not office1's. Minted ~/vr1-dc0-creds/vr1-dc0_svc_ed25519 (creds-audit
CLEAN); added variable vr1_dc0_ssh_pubkey_path; vvr1-dc0 cloud-init now installs the
dc0 pubkey (voffice1 keeps office1's key -- only the vvr1_dc0 block changed). Re-
validated + re-planned: outer plan UNCHANGED at 5 add / 0 change / 6 destroy (the
cloud-init edit is create-only content, no new destroys/replaces of live infra).

netem (D-100 gap #11): RULED = placeholder for the rehearsal; final values deferred.

docs/dc0-deploy-readiness.md (NEW): the full readiness state (outer plan verified
safe -- vvr1-dc0 416GiB/108vcpu, 6 empty-plane relocation, 980GiB RAM headroom),
remaining prep (pre-apply / mid-deploy / non-blocking), fresh-session bootstrap, and
the gated A-E deploy sequence. Ledger points at it.

Gauntlet ALL GREEN (65 harnesses incl. the 2 new access harnesses); repo-lint 0-fail;
opentofu-validate clean (both roots + 12 modules). The dc0 private key + local tfvars
stay gitignored/off-repo.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ck6xh3jWQi5b3Su8Dx1LEH