# Session ledger -- in-flight work continuity record **Purpose.** Long ops sessions on this cloud routinely exceed a single context window and get COMPACTED (sometimes several times). Anything living only in the chat scrollback is lost at compaction. This ledger is the durable, committed record of what is IN FLIGHT, so any session -- after a compaction, or a fresh one -- can resume without losing pending work. **How to use it (standing practice).** 1. At session start: read this ledger AND run `bash scripts/ledger-scan.sh`. Reconcile. 2. `ledger-scan.sh` is the DRIFT CHECK -- it derives the open-work it reliably can (PROPOSED/OPEN decisions, OPEN security rows, next-free numbers) straight from the repo. This narrative must not claim CLOSED anything the scan shows OPEN, nor omit what it surfaces. 3. Update this ledger at every deliverable/commit -- it is a standing deliverable like the changelog. The changelog says what CHANGED; this ledger says what is still OPEN. 4. The machine-derived block below is seeded from a scan; re-run the scan and re-seed rather than editing it by hand. **SINGLE STREAM (collapsed 2026-07-13).** This ledger previously carried three parallel, separately-owned stream sections (`main-chat`, `jumphost`, `shared`) plus ~30 append-only session narratives. Those streams are CLOSED and reconciled into the one list below. There is now ONE stream. Do not re-introduce per-stream sections. **Where the history went.** The 2,189-line session-by-session narrative is NOT lost -- it is in git history (the parent of the collapse commit) and, in durable form, in the 65 `docs/changelog-*.md` files, `docs/design-decisions.md`, and the incident reports. This ledger deliberately carries only what is still OPEN, plus the facts that would otherwise be lost because they live nowhere else. --- ## Machine-derived (re-seed from `scripts/ledger-scan.sh`; do not hand-edit) _Re-seeded from the 2026-07-17 scan. Re-run `bash scripts/ledger-scan.sh` to refresh._ - **PROPOSED / OPEN decisions:** D-068 (Vault substrate hardening, Roosevelt -- 1.16 ruled OUT per amendment; the off-EOL-1.8.8 path remains OPEN), D-071 (routine update cadence + Juju controller patch policy -- AMENDED, still PROPOSED, awaiting operator ratification; gated on the pre-DC-DC controller HA/backup session), D-129 (OPNsense edge plugin/add-on base profile -- OPEN / partially ruled 2026-07-18: VR1 profile adopted, FOUR sub-decisions still OPEN; review in `docs/opnsense-edge-addon-review-20260718.md`). - **OPEN security rows:** 8 open per `bash scripts/ledger-scan.sh` (re-seeded 2026-07-19). The SEC register of record is `docs/security-ledger.md`; row-level dispositions live THERE only (GA-R4 amendment F3) -- this block carries pointer + count, never rows. - **Next-free numbers:** D = **130**, DOCFIX = 196, BUNDLEFIX = 013. (Since the last re-seed D-121..128 all ADOPTED -- D-128 = VR1 operating model (2026-07-17). Load-bearing correction to the prior block: **D-123 = Model B** (nodes nest INSIDE `vvr1-dc0`; site-down = one `virsh destroy vvr1-dc0`) via operator ruling R-1 2026-07-16 -- this SUPERSEDES the earlier "D-123 Model A" this block used to record. Also: D-124 transit addressing PINNED (172.31.0.0/24) + imported to office1-netbox; D-125 bridge-in single-NAT uplink; D-126 durable rootless site access; D-127 IaC autostart matrix. The Stage-4 rack<->region addressing the prior block flagged as HELD is now assigned.) - **Standing numbering rule:** never write an identifier-shaped token (D-/DOCFIX-/BUNDLEFIX-NNN) ABOVE the real high-water mark anywhere in `docs/` or `runbooks/` prose -- historically a decoy token in prose inflated the next-free counter (hardened in DOCFIX-174); the authoring discipline stands regardless. - **`ledger-scan` D-115 false-positive: RESOLVED.** The scan now keys on the LAST `**Status:**` line per `## D-NNN:` block (see `scripts/ledger-scan.sh` awk), not arbitrary body prose, so D-115 (ADOPTED) no longer shows as PROPOSED/OPEN. The general hygiene -- trust the Status line over body text -- still holds. --- ## ROTATED 2026-07-19 (GA-R4 rule 6 -- the one-time rotation; F1 cap now enforceable) The pre-rotation bodies (~1080 lines: Live state, OPEN WORK VR1/VR0, NetBox write-path bugs, PINNED rulings, standing lessons, state facts, project- completion, NetBox import narrative) moved VERBATIM to `docs/archive/session-ledger-rotated-20260719.md`. Standing lessons + VR0 state facts were ROUTED to durable homes first (platform-traps already carried most; juju format=line -> appendix-A; guard discipline -> operating-discipline; VR0 cloud facts -> maas-as-built-reference.md). Open work is machine-derived above + CURRENT-STATE.md; do not re-grow bodies here -- sessions append BOUNDED summaries only (15-line cap). Retained compact blocks (still-live obligations without another home yet): - **NetBox write-path bugs (2026-07-14 adversarial review; LOGGED, NOT FIXED):** importer/write-guard defects recorded in the rotated body ("OPEN -- NetBox WRITE-PATH BUGS" section) -- route to a findings doc or fix before the next NetBox write campaign. - **Project-completion (after D-011 passes):** consolidate the 10 per-phase do-documents into a v1 deploy runbook; flip repo PRIVATE (SEC-004); revoke/rotate SEC-005/006/007; v2-deferred: GitBucket SSH, IPv6 dual-stack, NetBox import bundle. ## SESSION CLOSE 2026-07-18 -- grounding audit (Phases 1-4); GA-R4 bounded summary - Audit Phases 1-4 COMPLETE, each externally reviewed; FULL FREEZE upheld (zero pre-audit surfaces edited). - Phase 1: record-audit extractor + inventory (12 contradiction groups); outer plan CAPTURED 7/2/7; GA-F01..F15. - Phase 2: docs/CURRENT-STATE.md authored -- the single status authority; operator SIGNED (G11, section 11). - Phase 3: fresh-agent grounding test, 3 probes 21/21 PASS; hole H1 amended into the G9 row. - Phase 4: GA-R1..R7 + stage-status vocabulary (Option A + H1) ALL RATIFIED, utterances quoted (docs/audit/ga-rulings.md). - Phase 5 NOT opened: sweep plan DRAFTED (docs/audit/phase5-sweep-plan.md, commit 687dfa8) awaiting external review. - DC0 apply remains STOPPED (G9); D-130 unruled; expected plan triple UNRESOLVED (CURRENT-STATE section 5). - Next session: FRESH operator session, auto-memory ON (GA-R7 rule 8); read sweep plan + CURRENT-STATE.md first. - Status lives ONLY in CURRENT-STATE.md (GA-R1); this entry is narrative + pointers, not status. - Full session body: docs/archive/session-20260718-grounding-audit.md (GA-R4 rules 1-2, first live compliance run). - GA-R4 F1 cap (<300 lines) not yet enforceable: the one-time rotation is Phase-5 Batch 4 (rule 6) -- noted, not skipped. - POST-CLOSE ADDENDUM (2026-07-19): sweep plan externally reviewed PASS; amendments S1-S5 applied in a single commit (15ccfbd). Batch 0 was PRESENTED and HELD -- operator routed execution to the fresh session. Fresh session: read docs/audit/phase5-sweep-plan.md + docs/CURRENT-STATE.md, then gate Batch 0. ## SESSION 2026-07-19 -- Phase-5 sweep, Batch 0 (IN FLIGHT; this session continues per S5a) - Bootstrap clean (pull up-to-date at 16af82a; repo-lint 0-fail/1-legacy-WARN; scan reconciled). - Operator OPENED Batch 0 (gate point per the sweep plan). Items landed, one commit each with revert notes: 0.1 repo-lint L10 (0b991a5), 0.2 SEC repoint (b504cb6), 0.3 wrap-aware counters (527f1fd), 0.4 extractor vocab scan (f7580fd). What/why: docs/changelog-20260719-phase5-sweep.md. - Status of gates/batches lives in docs/CURRENT-STATE.md ONLY (G3 row updated per-commit). - L10 severity flip (WARN -> FAIL, one constant) is DUE AT BATCH 1 OPEN -- do not forget. - Next gate: operator opens Batch 1 (D-130 verification pair v8/v7 -> ruling -> reconcile -> re-plan). - BATCH 1 COMPLETE (2026-07-19, same session): L10 flipped to FAIL (9683a18); v8 + v7 verifications captured (suppression confirmed; no-bounce fact); D-130 ADOPTED (a) + implemented with harness (dac10e0); G6 state surgery executed per operator ruling (ii), backup terraform.tfstate.pre-G6-20260719; G7 re-plan = 6/0/6 == recorded triple (5a4f5eb). Gate status lives in CURRENT-STATE.md. - Next gate: operator opens Batch 2 (record fixes, GA-F backlog, repo-only). - BATCH 2 COMPLETE (2026-07-19, same session): items 2.1-2.10 landed per-GA-F (9 commits), two operator rulings recorded GA-R5-style (D-tags: "Tags as proposed + D-122 amendment"; R3-F disposition none-unaccounted). Live-surface vocab flags 0; residual extractor groups adjudicated history-class/mechanical -- see the session changelog's Batch-2 verification note, incl. the criterion-mechanics FINDING (Batch-2 literal ZERO is Batch-4-dependent by construction). - Next gate: operator opens Batch 3 (memory hygiene; edits shown per-file, memory is outside the repo). - BATCH 3 COMPLETE (2026-07-19, same session): memory hygiene per GA-R7 rule 6 -- two files removed per the recorded provenance rulings (GA-F06/GA-F07), hostname fixed, index rebuilt, skill line added; first full G1 review ran (rules 1-4): one further violation found + corrected + registered (GA-F16, creds pointer reduction). Pre-edit copies: docs/archive/memory-20260718/. Zero violations remain (3 files). Next gate: operator opens Batch 4 (consolidation + rotation -- the big one). - BATCH 4 COMPLETE (2026-07-19, same session): ledger rotated (this file, 131 lines -- F1 cap live); 96 changelogs + 24 history docs consolidated to docs/archive/ (4 stage records, manifest commits C2-C5); top-level docs/ = 16 (< 25); live refs rewritten. Verification in the close commit. - Next gate: operator opens Batch 5 (skill sweep) then Batch 6 (exit runs). - BATCH 5 COMPLETE (2026-07-19, same session): skill swept against ratified GA-R1..R7 + vocabulary; checklist committed (docs/audit/skill-sweep-checklist-20260719.md); repo-lint 0-fail. Single commit. - Next gate: operator opens Batch 6 (exit runs) -- NOTE the flagged extractor-semantics decision (docs/archive/ exclusion) wants ruling at Batch 6 open.