# 2026-07-16 -- Stage-3 review sweep, Phase A (record amendments) + Phase B (whole-host calculator)

## Context

Implements the gated fix-sweep from `docs/stage3-adversarial-review-20260716.md` after the operator
ruled the review's blocking decisions step-by-step (R-1..R-4, logged in `docs/session-ledger.md`).
Phase A = record amendments only (doc-coherence). Phase B = the committed whole-host capacity
calculator + re-validation (R3-F06). NO cloud mutation; nothing applied. Phase C (the Model B
OpenTofu reshape) is NOT in this change -- it is the next, separately-gated phase.

## What changed

**Phase A -- record amendments (`docs/design-decisions.md`, `docs/security-ledger.md`).** Encodes the
operator's 2026-07-16 rulings + the review's record fixes as dated AMENDMENT blocks (append-only
convention) + targeted status-line corrections:
- **D-123 AMENDMENT:** ADOPTED = **Model B** (operator ruling), overturning the inferred Model A
  (R3-F01). Status line corrected. Records the accepted cascade (supersede D-103/D-114; D-124 sizing
  void; depth-4 nested virt accepted; fallback preserved).
- **D-103 / D-114 AMENDMENTS:** node-placement / containment-scope superseded for the DCs (nodes now
  inside `vvr1-dc0`).
- **D-121 AMENDMENT + status:** storage 3->4/DC (R-3, node layout now 3+2+4=9/DC, ceph-osd=4); vault
  v-a re-attributed to the operator's 2026-07-16 ruling (was agent-authored, R3-F01); body's stale
  "Operator sub-ruling needed" reconciled; re-validation logged (done in Phase B).
- **D-124 AMENDMENT:** rack sizing (4/8192/80) VOID under Model B; transit addressing (Scheme A) stands.
- **D-122 AMENDMENT:** MAAS-controller bullet superseded (C1); single-object site-down VINDICATED for
  DCs by Model B (C3 -- the operator's original intent, not amended away).
- **D-107 AMENDMENT:** "node artifacts" scoped to the supply-chain mirror, excluding the intra-MAAS
  provisioning-image channel (C4); DR-independence claim made honest -- provisioning unavailable during
  an Office1-region outage is a PERMANENT design property, and the drill exercises workload failover,
  not redeploy (C5).
- **D-115 status line:** "Originally PROPOSED/OPEN" moved off the ADOPTED status line so `ledger-scan`
  reads the ADOPTED token cleanly (R3-F09; verified -- D-115 no longer flagged PROPOSED).
- **SEC-011:** CLOSED (operator ruling -- keep uniform 6-NIC; A2's Roosevelt-delta refutation accepted).

**Phase B -- `scripts/dc-dc-whole-host-budget.py` + `tests/dc-dc-whole-host-budget/` (R3-F06).** The
committed, harnessed replacement for the lost `scratchpad/optc-calc.py`. Read-only arithmetic; sums the
RAM/vCPU/disk of both DC node fleets + containment VMs (Model B) or rack headends (Model A) + Office1 +
edges, compares to the MEASURED host budget (256/1024/10240), reports the binding resource + FIT verdict.
Parameterised (layout/model/host all overridable); defaults encode the ruled Option C (3+2+4) under
Model B. Cross-checks against D-121's known figures: the old 3-storage shape returns 790 GiB (matches
the original D-121 record). Harness **13/13 PASS**.

**Re-validation result (R3-F06 closed):** ruled shape (Model B, 3+2+4) = **838 GiB / 1024 (82%), FIT,
186 GiB headroom** (vCPU 238/256 = 93%, overcommits in-sim; disk 62%, thin). Model A fallback = 822 GiB.

## Tests / verification

- `bash tests/dc-dc-whole-host-budget/run-tests.sh` -> 13/13 PASS.
- `bash scripts/repo-lint.sh` -> 0 fail, 1 legacy WARN.
- `bash scripts/run-tests-all.sh` -> GAUNTLET ALL GREEN (**63** harnesses, +1).
- `bash scripts/ledger-scan.sh` -> D-115 no longer falsely PROPOSED (only D-068/D-071 remain, both genuinely open).
- Byte hygiene: 0 non-ASCII / 0 CR added.

## Revert

- Phase A: `git checkout <pre-sweep> -- docs/design-decisions.md docs/security-ledger.md` (removes the
  2026-07-16 AMENDMENT blocks + the SEC-011 close + the D-115/D-121/D-123 status edits).
- Phase B: `git rm scripts/dc-dc-whole-host-budget.py && git rm -r tests/dc-dc-whole-host-budget`.
- No cloud state touched.