# Rotated session-ledger summaries -- moved 2026-08-01 (GA-R4 rule 3 / F1)

Moved VERBATIM from docs/session-ledger.md to restore the 300-line cap at this close.
These are HISTORY: they carry no status weight (status lives in docs/CURRENT-STATE.md).

## SESSION CLOSE 2026-07-29 -- arity gate, renderer, ruling 3, chain audit, OSD carve LIVE (bounded, GA-R4)

- Branch `dc-dc-stage5-preconditions`, 22 commits pushed. NO stage opened/closed. Scan unchanged: 3 decisions, SEC 21, D 138 / DOCFIX 205 / BUNDLEFIX 053.
- **VIP arity gap CLOSED + R11's three ruled gate changes.** `prefer-ipv6` is coupled to arity BOTH ways, closing the L3-9 merge order in which dropping the v6 legs exited 0.
- **RENDERER SHIPPED** (D-136 (D)), reproducing a reviewed artifact BYTE-FOR-BYTE. **RULING 3, both commits:** `bundle.yaml` is VIP-FREE; both DCs dual-family, vault `.61` / designate `.62` BUILT.
- **CHAIN AUDIT (step 6):** the adversarial lens made the chain go wrong-but-GREEN three times -- R9's ruled drift gate had never been built and dc0's overlay was gated by nothing.
  Built `tests/render-drift`, added 3 refusals, fixed 2 harness cases that could not fail.
- **LIVE, each gated and independently verified:** 8 OSD volumes + 2 controller VMs applied both DCs; 9 re-commissions with `skip_networking=1`, every diff EXACTLY the new device;
  MAC adoption applied (drift 0 across 20 nodes, both roots ZERO DIFF); both controllers commissioned; all ruled MAAS tags created. **THE STAGE-5 ALLOCATION BLOCKER IS CLOSED.**
- **R1 precondition 3 CLOSED BY MEASUREMENT** -- `skip_networking=1` is the vendor control, and the MAC check sits BETWEEN apply and re-commission, which is what makes 2026-07-20 non-repeatable.
- **RULED (GA-R5):** v6 IP SANs on the Octavia controller cert (D-109 note); juju controller at utility `.5` AND the octet map is a STANDING CROSS-DC STANDARD (D-134 amendment) --
  divergence between DCs at the same octet is now a DEFECT, not a local choice.
- **Octavia: clean negative.** juju 3.6 DEEP-MERGES overlay `options` (charm v12.1.1 source), so octavia-pki cannot clobber the VIP; and nothing inside Octavia requires IPv4.
- **OWNED:** three strict-bash quoting traps, two false-positive greps, one fabricated flag, one red-lint push. All corrected on-surface; traps in `docs/audit/queued-findings-20260729.txt`.
- **NEXT:** octavia-pki generation -- the last item hard-failing preflight, and the generator is now per-DC. Gauntlet ALL GREEN (87) vcloud; repo-lint 0 fail.
- Body: `docs/changelog-20260728-vip-arity-gate.md`. Status ONLY in CURRENT-STATE.md.

## SESSION CLOSE 2026-07-30 -- Stage-5 preconditions: 19 Phase-3 items, gate integrity, per-DC Octavia PKI LIVE (bounded, GA-R4)

- Branch `dc-dc-stage5-preconditions`, **25 commits pushed** (`ab4c842..`). NO stage opened/closed. Scan unchanged: 3 decisions, SEC 21, D 138 / DOCFIX 205 / BUNDLEFIX 053.
- **6 agents** (3 read-only recon, 4 delivery). Phase-3 re-measured **2 FIXED / 19 REMAIN / 5 NEW**, not the 21 the 07-27 doc implied; **13 items + 3.9/3.10 + R5 delivered**, phase-4 runbook 434 -> 929 lines.
- **F1 (HIGH): R7's per-DC Octavia PKI was HALF BUILT** -- subject and VIP gate per-DC, `$DC` in NO path, so generating dc1 would have DESTROYED dc0's CA and left one fixed-name overlay applying dc1's CA to dc0. Fixed end to end + REFUSE-IF-PRESENT.
- **F4:** the per-DC rename would have UN-IGNORED a CA private key in a repo SEC-004 calls PUBLIC. Glob + a `check-ignore` self-assert, proven both ways. **F2:** register was blind to a missing 2nd CA set (was RULED work, R13 Part 1). **F6:** P5 was probing the WRONG HOST'S filesystem and reporting it as fact -- 34 findings vs the true 7.
- **PKI GENERATED (operator-executed; guard blocks the mint by design, not worked around), both DCs verified PASS 29/0**, independence proven by sha256, backups **proven by restore** (PKI 12/12 vs live; tfstate byte-identical, correct serials). **E2 + E3 fully closed.**
- **`scripts/octavia-pki.sh verify` NEW** (harness 21/21): asserts the SAN set nothing asserted before (F8's SAN-less cert), and **A12 ARMS ITSELF** from `os-public-hostname` so F9 cannot be missed.
- **Gate integrity:** decorative HA, machines-overlay no-op, cloud-assert arity, G17 node check, gauntlet locale. P4 DC-aware (DC refs 1 -> 45); 3.7 closed; lib-net dc1 arm.
- **NEW ruling-shaped, now BLOCKING:** D-008 + D-106:2563 do not say whether substrate `vr1-dc1` is `dc1` by TOKEN or `dc2` by POSITION -- item 3.1's ambiguity inside a ruling, deciding cert identity. A12 REFUSES rather than picking.
  **^ WITHDRAWN 2026-07-30 (DOCFIX-205): NOT a ruling gap.** D-117 ruled it 2026-07-13 (`dc1`/`dc2` retired for `dc0`/`dc1`) and says so in its own Status line; D-106 read as open only because D-117's annotation half was never executed (zero of four) while its Status line claimed "FULLY EXECUTED". Also not blocking -- A12 measures INERT and passes. Now an assertion on the derived zone; status in CURRENT-STATE.md.
- **Headend reconcile found a gate RED ON THE ONLY HOST THAT DEPLOYS** (`opentofu-validate` fmt walking gitignored tfvars). Fixed + scoped; **both hosts now ALL GREEN (89)**, repo-lint 0 fail.
- **Three wrong records found, none catchable by any gate:** D-124 told a reader to source a provider MAC from a file holding only boot MACs (would have bridged `br-ex` onto the PXE NIC); the skill cites D-107 for a tailnet path it does not rule; `office1-tailscale` is labelled a subnet router and advertises none.
- **A "backup set" asserted on three surfaces did not exist.** Built for the PKI (1.0-GEN.e) and the inner tfstates (phase-2 step 13), declared, restores proven. Forward requirement recorded: the pinned secrets-storage solution MUST absorb both.
- OWNED: the operator's own working commands were NOT in the repo until the pre-bookend sweep asked; I waved through 664 CA certs as "harmless" (integrity, not secrecy); two silenced errors (`| grep -q` under pipefail, `git pull -q &&`); four consecutive cwd mistakes. All corrected on-surface.
- **NEXT:** F8 residue (heredoc -> printf when a real generation can be run); D-137 fork-1 guard ruling (blocked correctly once, misfired 5x); preflight still has NO verified-green reading; G17 fixture-green only; the two `phase-04-network-*` scripts.
- Sweep capture `docs/audit/queued-findings-20260730.txt` (F10-F13 + 2 ruling questions). Body: `docs/changelog-20260729-stage5-preconditions.md`. Status ONLY in CURRENT-STATE.md.