diff --git a/.claude/skills/savegame/SKILL.md b/.claude/skills/savegame/SKILL.md index e18acb0..0b5ea14 100644 --- a/.claude/skills/savegame/SKILL.md +++ b/.claude/skills/savegame/SKILL.md @@ -61,6 +61,34 @@ **A lagging clone is not a loss** (the remote has the work) **but it IS a hazard** and belongs in the summary. +### Step 1b -- PULL the inner clones up to date at close (added 2026-08-03, operator-directed) + +**A lagging clone must not merely be REPORTED -- bring it into sync.** After the durability +triad confirms this host is pushed, `git pull` every git-backed execution-host clone so all +working locations are at the same HEAD for the next session. **The next session may be a NEW +OPERATOR at a different working location; sync parity is what lets them resume without +re-deriving which clone is authoritative.** Operator, verbatim (2026-08-03): *"Add an inner +space task to the savegame to complete a pull to bring inner clones up to date at the end of +sessions. This will make sure that there is sync parody between working locations for next +session since a new session may be a new operator."* + +```bash +# every git-backed inner clone -- discover, do not hardcode the path (D-110) +ssh voffice1 "cd \"\$REPO\" && git pull --ff-only" && \ + echo "voffice1 now at: $(ssh voffice1 "cd \"\$REPO\" && git rev-parse --short HEAD")" +``` + +- **Fast-forward ONLY** (`--ff-only`). An inner clone should never hold divergent local + commits; if `--ff-only` refuses, that clone has uncommitted or divergent work -- STOP, do + not force, and surface it (it may be work that itself needs pushing). +- **The dc0/dc1 racks are NOT git clones** -- they carry `~/repo-stage/` with no `.git`. Do + not `git pull` them; RE-STAGE any drifted tracked file (`scp` + sha256-verify) as the + parent skill's D-138 note requires. A pull and a re-stage are different operations for + different host types; use the right one. +- This runs at CLOSE, after this host is pushed, so the inner clones pull the session's own + final commit. Report each clone's resulting HEAD in the summary -- "synced" is a claim that + gets quoted, not assumed. + ## Step 2 -- Gates, all of them, and quote the numbers ```bash diff --git a/docs/CURRENT-STATE.md b/docs/CURRENT-STATE.md index c579a6f..3340c7b 100644 --- a/docs/CURRENT-STATE.md +++ b/docs/CURRENT-STATE.md @@ -2125,6 +2125,24 @@ D-NNN. Both are the measure/grep-before-concluding discipline. The next session should treat any ovn-central cert hypothesis of mine as UNVERIFIED until measured, and re-derive from the captured evidence rather than this narrative. + **>>> SESSION CLOSE 2026-08-03 (GA-R4 bookend). Stage 5 remains OPEN; this is a session + bookend, NOT a stage close. <<<** DEPLOY IS MID-STAGE-5: bundle deployed + mostly converged + (9 machines started, mysql ONLINE, vault init+unseal+root-CA, ~25 units active, 0 error), + ovn-central x3 DEGRADED and DEFERRED (LP #2044324). **GATE RED AT CLOSE, recorded not hidden:** + `run-tests-all` **1/98 FAIL -- provider-bundle-check** (4 dual-family cases), a DIRECT + CONSEQUENCE of the D-141 v4-only revert leaving the deploy overlay v4-only while the harness + still asserts dual-family; LOGGED, the harness owes a reconcile to D-141 (sweep F1). repo-lint + 0 fail / 1 legacy warn. **MEASURED CONFIRMATION (operator question this session):** a dual-stack + deploy overlay whose container v6 does not populate causes the `Invalid vips` block on all 11 + API charms -- the charm HARD-ERRORS on an unplaceable VIP rather than degrading to the v4 leg -- + so v4-only-deploy + v6-reserved-in-apex (D-141) is the correct split until the container-v6 gate + (LP #1723240 + per-charm) clears; this validates D-141 with the measured reason. **DURABILITY:** + vcloud 0 uncommitted / 0 unpushed; voffice1 was 36 behind, PULLED to sync (new savegame Step 1b, + operator-directed); dc0 rack `~/repo-stage` matches HEAD. **CLOSE SWEEP:** + `docs/audit/queued-findings-20260803-stage5-deploy-ovn.txt` (4 FIRST SURFACE: the red gate, + gitignored settings.local.json growth 310->313, the voffice1 lag, the live resume snapshot). + **NEXT SESSION:** escalate LP #2044324 + decide accept-degraded vs the unverified `os-*-network` + avenue; reconcile provider-bundle-check to D-141; then phase-03 core verify. **>>> PRE-VAULT-INIT END STATE REACHED; VAULT PREFLIGHT PASSES `PROCEED` 2026-08-03. <<<** After the stall fix, the model converged: `scripts/phase-02-vault-preflight.sh vr1-dc0` (staged + sha256-verified on the rack, `90910dfb`) reports **PROCEED** -- mysql cluster 3/3 diff --git a/docs/archive/session-ledger-rotated-20260803.md b/docs/archive/session-ledger-rotated-20260803.md new file mode 100644 index 0000000..21c7e3a --- /dev/null +++ b/docs/archive/session-ledger-rotated-20260803.md @@ -0,0 +1,16 @@ +# Session-ledger summaries rotated 2026-08-03 (GA-R4 rule 3) + +## SESSION CLOSE 2026-07-30 (part 5) -- dc0 MIGRATED to its own MAAS region: 10/10 Ready, 4 named gates green (bounded, GA-R4) + +- Branch `dc-dc-stage5-preconditions`, **24 commits** pushed (`0ec9c97..`). NO stage opened/closed. Scan: 3 decisions, SEC 23, D 139 / DOCFIX 206 / BUNDLEFIX 053. **SUPERSEDES part 4**, which closed with the cutover blocked. +- **THE dc0 MACHINE MIGRATION IS DONE.** Office1 holds **ZERO dc0 machines** (23 -> 13). The per-DC region holds **all ten, `Ready`**, shapes EXACT to D-121 Option C, 6 interfaces each, every one matched to its libvirt domain by PINNED BOOT MAC (system_id AND hostname are both re-minted -- only the MAC is stable). +- **FOUR NAMED GATES GREEN:** `dc-region-topology.sh check` **40/0**; `maas-region-power-key.sh check` **9/0** (ends on a real virsh enumerating 12 domains); `maas-role-tags.sh check` **0 missing / 0 needing / 0 not-in-MAAS**; `dc-plane-ipam.sh check` **24/0** (was 7/17). +- **DHCP CUTOVER EXECUTED** in the ruled order, verified BY PROCESS at both ends (`pgrep -c dhcpd` = 0 on the rack, 2 on the region). The permission wall was a rule that FAILED TO MATCH -- existing ask rules pin the double-quote form and the `maas admin` profile; commands used single quotes and `maas vr1-dc0-region`. Operator ruled **ask** (not allow), added to gitignored local settings. +- **THREE TOOLS THE REPO NEVER HAD:** `maas-profile-assert.sh` (region identity by RACK identity -- a machine count is not proof), `maas-region-power-key.sh`, `dc-region-topology.sh`. A survey found the named fabrics, v4 subnets and site tag were built ad-hoc in the Stage-4 window, logged only to a file not in the repo. +- **FINDINGS THAT CHANGE THE STANDUP PROCEDURE:** (1) a fresh region has **ZERO SSH keys** -- MAAS injects them into deployed machines and juju needs SSH, so this was the same signature that burned three bootstraps today; found by accident, now imported. (2) enlistment does **not** scale to 9 concurrent nodes (15 min, zero records) -- batches of three; egress/proxy/region-load all measured healthy first. (3) **never `commission` a machine whose `power_type` is unset** -- it passes every script and drops to `New`. (4) the node carve is **ROLE-DEPENDENT**: role nodes get 6 planes + `br-ex`; the juju controller gets 2 planes, no `br-ex`. +- **A GREEN GATE ON AN INCOMPLETE STATE:** `maas-role-tags.sh` PASSed while all ten still lacked `openstack-vr1-dc0` -- it is not in its `ROLES` set and has no creator in the repo. `bundle.yaml` places on it and `dc-node-v6-carve.py` dies without it. Caught ONLY by diffing against the pre-migration snapshot, which earned its keep. +- **OWNED -- five instrument errors, all the same shape** (a confident negative from an under-checked instrument): a cold-cache DNS probe, a `head -5`-truncated listener list, a nine-day-stale serial log read as current, a bad elapsed-time estimate, and counting DHCP renewals as cloud-init progress. Also batched nine destructive deletes into a loop (the guard stopped me; hard rule 3 forbids it), and twice over-claimed in the records -- writing the re-enrolment ordering as proven before any machine reached `Ready`, and "no `New` detour" when I had aborted them there myself. All corrected on-surface. +- **NEXT, and it is the ONLY thing between here and the deploy:** `scripts/dc-node-carve.sh` does not exist -- 60 NIC re-homes + 9 `br-ex` + 54 v4 statics. Its hard inputs are now MEASURED and guarded: `NIC_PLANE_ORDER` (NOT `PLANE_CIDRS` order -- walking that positionally strands PXE on provider-public), the role asymmetry, and `carve-host-interfaces.sh:211-236`'s `build_ovs_brex()` call sequence. Then `dc-node-v6-carve.py --profile vr1-dc0-region`, then re-point Juju at `10.12.8.6:5240` (needs a region-scoped API key + `juju unregister vr1-dc0-controller` on the rack). +- **CLOSE SWEEP: `docs/audit/queued-findings-20260730-dc0-region-migration.txt` (F1-F10).** THREE items lived ONLY in the transcript: **F1** this session's permission rules exist only in GITIGNORED `settings.local.json` (verbatim text now recorded, incl. a broad `Bash(ssh vr1-dc0-rack *)` auto-added by an approval and worth review); **F2** Office1 STILL registers a rack controller on the dc0 rack (`vvr1-dc0`/`7chphy`) and still holds the region VM's machine record; **F10** the five instrument errors as one pattern. F9 carries the next session's first commands and every measured input the carve tool needs. +- Gauntlet **ALL GREEN (92)**; repo-lint 0 fail. Body: `docs/changelog-20260730-dc0-region-migration.md` (24 items). Status ONLY in CURRENT-STATE.md. + diff --git a/docs/audit/queued-findings-20260803-stage5-deploy-ovn.txt b/docs/audit/queued-findings-20260803-stage5-deploy-ovn.txt new file mode 100644 index 0000000..953ebb4 --- /dev/null +++ b/docs/audit/queued-findings-20260803-stage5-deploy-ovn.txt @@ -0,0 +1,84 @@ +queued-findings-20260803-stage5-deploy-ovn.txt +============================================== +SAVEGAME SWEEP for the 2026-08-03 session (Stage-5 dc0 deploy: DOCFIX-208, deploy +executed, controller rebuilt, vault brought up, ovn-central cert issue deferred). +Method (ruled 2026-07-31): read the whole session, enumerate every finding/decision/ +measurement/mistake, grep each against repo surfaces. Hit = ALREADY ON SURFACE. No hit += FIRST SURFACE, would be lost on /clear. + +Status claims live in docs/CURRENT-STATE.md ONLY. + +-------------------------------------------------------------------------------------- +FIRST SURFACE -- existed ONLY in the transcript. Listed first, by consequence. +-------------------------------------------------------------------------------------- + +F1. >>> GAUNTLET IS RED AT CLOSE: provider-bundle-check 1/98 FAILED (4 cases). <<< + `bash scripts/run-tests-all.sh` -> "GAUNTLET: 1/98 FAILED -- provider-bundle-check". + The 4 failing cases are ALL dual-family assertions: T19 (every app dual-family in the + real deploy input), T21 (v6 legs without the option passes), T25 (dual-family + unreadable + apex REFUSES), T45 (six dual-family vips with no prefer-ipv6 pass). + CAUSE, measured: this session reverted the dc0 VIP overlay to IPv4-ONLY (D-141 / the + render values `family: v4`), so the real deploy input is no longer dual-family -- but the + provider-bundle-check HARNESS still asserts it is. This is the "remediating a finding turns + the harness red -- REPLACE the assertion with the new invariant" class (repo's own rule). + LOGGED NOT FIXED (savegame hard rule 1). NEXT SESSION: reconcile tests/provider-bundle-check + to the v4-only deploy input under D-141 (the four dual-family fixtures/expectations), OR + gate them behind the family so a v4-only overlay is expected to be v4-only. A built-surface + change (v4 revert) shipped WITHOUT its companion harness update -- that is the defect. + grep "T19 every app is dual-family" tests/: hit (the test exists); grep the RED result in + docs/: 0 hits before this file -> FIRST SURFACE. + +F2. settings.local.json (GITIGNORED) grew 310 -> 313 allow rules this session; the added + ones include BROAD wildcards `Bash(ssh vr1-dc0-rack *)` and `Bash(ssh vr1-dc0-maas *)` + -- ANY command on the dc0 rack (the D-138 deploy client) and the MAAS region VM. Same + broad-ssh-allow class flagged on 2026-07-30 and 2026-08-02, now recurring a third time. + ask=11, deny=0 (unchanged). Gitignored, so this text is the only recovery copy. Recommend + narrowing to the read-only + specific-mutation forms actually used. (SEC-030 posture: the + real gate is operator presentation-approval, not the rule engine.) + +F3. voffice1 clone was 36 COMMITS BEHIND at close (it was not used this session -- all deploy + work ran on the dc0 rack via juju). BROUGHT INTO SYNC by the new savegame Step 1b + (`git pull --ff-only`), now at HEAD 46f3ab2 lag 0. It will need ONE more pull for the + bookend commit itself. dc0 rack ~/repo-stage MATCHES HEAD (bundle 2af8a358, vips cf42b937, + machines e8ca794c). Recorded because a lagging clone is a hazard even when synced at close. + +F4. LIVE MODEL STATE carried to next session (the deploy is MID-STAGE-5, not closed): + 9 machines started; mysql-innodb-cluster ONLINE 3/3; vault INITIALISED+UNSEALED+root-CA + (active); ~25+ units active, 0 in error; v4 VIPs live on the 11 API charms; ovn-central x3 + DEGRADED (no server cert, OVN NB/SB cluster not formed, 6641/6642 not listening); + certificates relation is certificates:142 (bounced this session); ovn-central "" default = + metal-internal (bundle+live). Expected-tail blocked: ceph-rbd-mirror (cross-DC), + designate (Stage 7), octavia (awaiting-configure). All in CURRENT-STATE; consolidated here + as the single resume snapshot. + +-------------------------------------------------------------------------------------- +ALREADY ON SURFACE (grep-confirmed) -- recorded for completeness, not first-surface. +-------------------------------------------------------------------------------------- +- DOCFIX-208 (machines overlay missing from dc0 deploy cmd): CURRENT-STATE + changelog-20260802-deploy-input.md + phase-4 runbook. +- Dry-run prints no options at any verbosity: references/platform-traps.md (Juju section) + memory instrument-currency #14. +- Designate "contradiction" withdrawn (D-106 additive): CURRENT-STATE + memory vr0-to-vr1-is-additive.md. +- D-135 amendment (b) dc0 converges on proxy; D-141 IPAM dual-stack reserved-until-capable: design-decisions.md + CURRENT-STATE. +- UCA signing-key failure + proxy convergence: CURRENT-STATE + changelog-20260802-deploy-input.md + docs/audit/uca-*. +- Controller --force orphaned the model / Path M + Path C teardown-rebuild: runbooks/dc-dc-teardown-rollback.md + CURRENT-STATE. +- cloud-init apt stall on 3 units (fix): CURRENT-STATE. +- ovn-central LP #2044324 (missing common_name), D-052 amendment (metal-internal), binding sweep: CURRENT-STATE + design-decisions.md + docs/audit/binding-plane-purpose-sweep-20260803.txt. +- MAAS region installed-not-migrated correction: SKILL.md + design-decisions.md D-132 annotation. +- tool-index.md, CLAUDE.md hard rule 4, repo-rebuild-project-brief.md, charm-ip-family-compatibility.md: all committed. + +-------------------------------------------------------------------------------------- +OWNED (mistakes this session -- the first thing a clear destroys) +-------------------------------------------------------------------------------------- +- TWICE asserted an ovn-central cert root cause the evidence did not support: (i) that the + metal-admin default binding caused it (the rebind did nothing); (ii) implicitly, by ruling + the D-052 amendment on that premise. The categorization (metal-internal) is right; the + cert-fix rationale was wrong. Owned in CURRENT-STATE. +- Flagged openstack-dashboard:cluster as a binding deviation; it is D-072/BUNDLEFIX-011, a + RULED exception documented in a comment right above the line. Caught by reading the bundle + before applying, NOT by the sweep -- I classified by binding VALUE without grepping the + governing D-NNN (which CLAUDE.md requires). Nearly reverted a fix that would have killed + Horizon HTTPS. +- Shipped the D-141 v4 revert without updating the provider-bundle-check harness (F1) -- a + built-surface change without its companion test reconcile, caught by the gauntlet at close. +- Nested-quote / paren shell errors bit several remote one-liners (harmless, re-run). +- Guard hook blocked two commit MESSAGES (kill-controller, vault-init command names) -- correct + conservative behaviour; reworded via a message file. diff --git a/docs/session-ledger.md b/docs/session-ledger.md index 88fac4d..20c539c 100644 --- a/docs/session-ledger.md +++ b/docs/session-ledger.md @@ -179,19 +179,11 @@ permission wall) moved VERBATIM to `docs/archive/session-ledger-rotated-20260802b.md`. The live ledger stood at 294 lines and this close's summary would have breached the cap. -## SESSION CLOSE 2026-07-30 (part 5) -- dc0 MIGRATED to its own MAAS region: 10/10 Ready, 4 named gates green (bounded, GA-R4) +## ROTATED 2026-08-03 (GA-R4 rule 3 / F1 -- cap restored at this close) -- Branch `dc-dc-stage5-preconditions`, **24 commits** pushed (`0ec9c97..`). NO stage opened/closed. Scan: 3 decisions, SEC 23, D 139 / DOCFIX 206 / BUNDLEFIX 053. **SUPERSEDES part 4**, which closed with the cutover blocked. -- **THE dc0 MACHINE MIGRATION IS DONE.** Office1 holds **ZERO dc0 machines** (23 -> 13). The per-DC region holds **all ten, `Ready`**, shapes EXACT to D-121 Option C, 6 interfaces each, every one matched to its libvirt domain by PINNED BOOT MAC (system_id AND hostname are both re-minted -- only the MAC is stable). -- **FOUR NAMED GATES GREEN:** `dc-region-topology.sh check` **40/0**; `maas-region-power-key.sh check` **9/0** (ends on a real virsh enumerating 12 domains); `maas-role-tags.sh check` **0 missing / 0 needing / 0 not-in-MAAS**; `dc-plane-ipam.sh check` **24/0** (was 7/17). -- **DHCP CUTOVER EXECUTED** in the ruled order, verified BY PROCESS at both ends (`pgrep -c dhcpd` = 0 on the rack, 2 on the region). The permission wall was a rule that FAILED TO MATCH -- existing ask rules pin the double-quote form and the `maas admin` profile; commands used single quotes and `maas vr1-dc0-region`. Operator ruled **ask** (not allow), added to gitignored local settings. -- **THREE TOOLS THE REPO NEVER HAD:** `maas-profile-assert.sh` (region identity by RACK identity -- a machine count is not proof), `maas-region-power-key.sh`, `dc-region-topology.sh`. A survey found the named fabrics, v4 subnets and site tag were built ad-hoc in the Stage-4 window, logged only to a file not in the repo. -- **FINDINGS THAT CHANGE THE STANDUP PROCEDURE:** (1) a fresh region has **ZERO SSH keys** -- MAAS injects them into deployed machines and juju needs SSH, so this was the same signature that burned three bootstraps today; found by accident, now imported. (2) enlistment does **not** scale to 9 concurrent nodes (15 min, zero records) -- batches of three; egress/proxy/region-load all measured healthy first. (3) **never `commission` a machine whose `power_type` is unset** -- it passes every script and drops to `New`. (4) the node carve is **ROLE-DEPENDENT**: role nodes get 6 planes + `br-ex`; the juju controller gets 2 planes, no `br-ex`. -- **A GREEN GATE ON AN INCOMPLETE STATE:** `maas-role-tags.sh` PASSed while all ten still lacked `openstack-vr1-dc0` -- it is not in its `ROLES` set and has no creator in the repo. `bundle.yaml` places on it and `dc-node-v6-carve.py` dies without it. Caught ONLY by diffing against the pre-migration snapshot, which earned its keep. -- **OWNED -- five instrument errors, all the same shape** (a confident negative from an under-checked instrument): a cold-cache DNS probe, a `head -5`-truncated listener list, a nine-day-stale serial log read as current, a bad elapsed-time estimate, and counting DHCP renewals as cloud-init progress. Also batched nine destructive deletes into a loop (the guard stopped me; hard rule 3 forbids it), and twice over-claimed in the records -- writing the re-enrolment ordering as proven before any machine reached `Ready`, and "no `New` detour" when I had aborted them there myself. All corrected on-surface. -- **NEXT, and it is the ONLY thing between here and the deploy:** `scripts/dc-node-carve.sh` does not exist -- 60 NIC re-homes + 9 `br-ex` + 54 v4 statics. Its hard inputs are now MEASURED and guarded: `NIC_PLANE_ORDER` (NOT `PLANE_CIDRS` order -- walking that positionally strands PXE on provider-public), the role asymmetry, and `carve-host-interfaces.sh:211-236`'s `build_ovs_brex()` call sequence. Then `dc-node-v6-carve.py --profile vr1-dc0-region`, then re-point Juju at `10.12.8.6:5240` (needs a region-scoped API key + `juju unregister vr1-dc0-controller` on the rack). -- **CLOSE SWEEP: `docs/audit/queued-findings-20260730-dc0-region-migration.txt` (F1-F10).** THREE items lived ONLY in the transcript: **F1** this session's permission rules exist only in GITIGNORED `settings.local.json` (verbatim text now recorded, incl. a broad `Bash(ssh vr1-dc0-rack *)` auto-added by an approval and worth review); **F2** Office1 STILL registers a rack controller on the dc0 rack (`vvr1-dc0`/`7chphy`) and still holds the region VM's machine record; **F10** the five instrument errors as one pattern. F9 carries the next session's first commands and every measured input the carve tool needs. -- Gauntlet **ALL GREEN (92)**; repo-lint 0 fail. Body: `docs/changelog-20260730-dc0-region-migration.md` (24 items). Status ONLY in CURRENT-STATE.md. +The oldest live summary (2026-07-30 part 5 -- dc0 migrated to its own MAAS region, 10/10 +Ready, four named gates green) moved VERBATIM to `docs/archive/session-ledger-rotated-20260803.md`. +The live ledger would have breached the 300-line cap with this close's summary. ## SESSION CLOSE 2026-07-31 -- dc0 node carve COMPLETE, controller BOOTSTRAPPED, deploy blocked on prefer-ipv6 (bounded, GA-R4) @@ -285,3 +277,16 @@ - **Durability:** vcloud 0 uncommitted / 0 unpushed; **voffice1 synced** (was 1 behind); dc0 rack `~/repo-stage` all 13 tracked files MATCH the repo. Gates: gauntlet **ALL GREEN (98)**, repo-lint 0 fail / 1 legacy warn. - **NEXT:** the preflight-P2 / phase4 machines-overlay asymmetry -- P2 validates a merged input the deploy never passes -- then the bundle deploy. The held subnet needs the controller's v6 re-homed to GUA first and is NOT deploy-blocking. - Sweep: `docs/audit/queued-findings-20260802-step6-queued-items.txt` (**6 FIRST SURFACE**, incl. a broad `Bash(ssh vr1-dc0-maas *)` allow rule, and four destructive MAAS deletes that matched NO ask rule -- the rule-fails-to-MATCH class, now recurring). Body: `docs/changelog-20260802-queued-items.md`. Status ONLY in CURRENT-STATE.md. + +## SESSION CLOSE 2026-08-03 -- Stage 5 dc0: bundle DEPLOYED, controller rebuilt, vault up; ovn-central cert DEFERRED (bounded, GA-R4) + +- Branch `dc-dc-stage5-preconditions`, ~23 commits pushed. NO stage opened/closed. Scan: 3 decisions, **SEC 28**, **D 142 / DOCFIX 209 / BUNDLEFIX 053** (D-141 + DOCFIX-208 assigned this session). +- **THE dc0 BUNDLE IS DEPLOYED and mostly converged:** 9 machines started, mysql cluster ONLINE, vault init+unseal+root-CA (operator-run), ~25 units active, 0 in error. DOCFIX-208 fixed the machines-overlay omission; UCA signing-key failure root-caused; **D-135 amendment (b)** converged dc0 onto the apt caching proxy; the **v4 VIP revert (D-141)** cleared keystone's `Invalid vips`. +- **CONTROLLER REBUILT (Path C):** a `--force` model destroy orphaned the model (missing status doc) and took the controller API down; rebuilt fresh from MAAS end to end. New runbook **Paths M + C** (juju model + controller teardown/rebuild), plus the measured `kill-controller`-fails-when-API-down + `--no-wait` guidance. +- **RULINGS:** **D-141** (IPAM dual-stack, v4 `active` / v6 `reserved`-until-capable); **D-052 AMENDED** (ovn-central `""` default -> metal-internal, architecturally correct -- OVN NB/SB DB is a metal-internal service). +- **>>> ovn-central x3 DEGRADED, DEFERRED:** charm-ovn-central **LP #2044324** -- cert request carries NO `common_name` -> vault issues no server cert -> OVN NB/SB cluster not formed. Three remedies exhausted (reissue-certificates / rebind / relation bounce). Only OVN/tenant-networking is gated. <<< +- **GATE RED AT CLOSE:** gauntlet **1/98 FAIL (provider-bundle-check)** -- the D-141 v4 revert broke 4 dual-family harness cases; LOGGED, harness owes a reconcile to the v4-only input. repo-lint 0 fail. +- **CONFIRMED (operator Q):** a dual-stack deploy overlay with unpopulated container v6 causes the `Invalid vips` block on all 11 API charms (the charm hard-errors on an unplaceable VIP) -- so v4-only-deploy + v6-reserved-in-apex (D-141) is the correct split until the container-v6 gate clears. +- **OWNED:** twice asserted a wrong ovn-central cert root cause (the binding); flagged a RULED binding exception (D-072 dashboard) I'd have reverted without grepping the D-NNN (would have killed Horizon HTTPS); shipped the v4 revert without its harness update. +- **DURABILITY:** vcloud 0/0; voffice1 was **36 behind, PULLED to sync** (new savegame **Step 1b**, operator-directed); dc0 rack `~/repo-stage` matches HEAD. +- **NEXT:** escalate LP #2044324 + decide accept-degraded vs the unverified `os-*-network` avenue; reconcile provider-bundle-check to D-141; then continue Stage-5 (phase-03 core verify). Sweep: `docs/audit/queued-findings-20260803-stage5-deploy-ovn.txt` (**4 FIRST SURFACE**). Status ONLY in CURRENT-STATE.md.