# Rotated session-ledger summaries -- moved 2026-08-07 (GA-R4 rule 3 / F1)

Moved VERBATIM from `docs/session-ledger.md` at the 2026-08-06/07 close to keep the live
ledger under the 300-line cap (rule 3). Oldest-first.

---

## SESSION CLOSE 2026-08-03 -- Stage 5 dc0: bundle DEPLOYED, controller rebuilt, vault up; ovn-central cert DEFERRED (bounded, GA-R4)

- Branch `dc-dc-stage5-preconditions`, ~23 commits pushed. NO stage opened/closed. Scan: 3 decisions, **SEC 28**, **D 142 / DOCFIX 209 / BUNDLEFIX 053** (D-141 + DOCFIX-208 assigned this session).
- **THE dc0 BUNDLE IS DEPLOYED and mostly converged:** 9 machines started, mysql cluster ONLINE, vault init+unseal+root-CA (operator-run), ~25 units active, 0 in error. DOCFIX-208 fixed the machines-overlay omission; UCA signing-key failure root-caused; **D-135 amendment (b)** converged dc0 onto the apt caching proxy; the **v4 VIP revert (D-141)** cleared keystone's `Invalid vips`.
- **CONTROLLER REBUILT (Path C):** a `--force` model destroy orphaned the model (missing status doc) and took the controller API down; rebuilt fresh from MAAS end to end. New runbook **Paths M + C** (juju model + controller teardown/rebuild), plus the measured `kill-controller`-fails-when-API-down + `--no-wait` guidance.
- **RULINGS:** **D-141** (IPAM dual-stack, v4 `active` / v6 `reserved`-until-capable); **D-052 AMENDED** (ovn-central `""` default -> metal-internal, architecturally correct -- OVN NB/SB DB is a metal-internal service).
- **>>> ovn-central x3 DEGRADED, DEFERRED:** charm-ovn-central **LP #2044324** -- cert request carries NO `common_name` -> vault issues no server cert -> OVN NB/SB cluster not formed. Three remedies exhausted (reissue-certificates / rebind / relation bounce). Only OVN/tenant-networking is gated. <<<
- **GATE RED AT CLOSE:** gauntlet **1/98 FAIL (provider-bundle-check)** -- the D-141 v4 revert broke 4 dual-family harness cases; LOGGED, harness owes a reconcile to the v4-only input. repo-lint 0 fail.
- **CONFIRMED (operator Q):** a dual-stack deploy overlay with unpopulated container v6 causes the `Invalid vips` block on all 11 API charms (the charm hard-errors on an unplaceable VIP) -- so v4-only-deploy + v6-reserved-in-apex (D-141) is the correct split until the container-v6 gate clears.
- **OWNED:** twice asserted a wrong ovn-central cert root cause (the binding); flagged a RULED binding exception (D-072 dashboard) I'd have reverted without grepping the D-NNN (would have killed Horizon HTTPS); shipped the v4 revert without its harness update.
- **DURABILITY:** vcloud 0/0; voffice1 was **36 behind, PULLED to sync** (new savegame **Step 1b**, operator-directed); dc0 rack `~/repo-stage` matches HEAD.
- **NEXT:** escalate LP #2044324 + decide accept-degraded vs the unverified `os-*-network` avenue; reconcile provider-bundle-check to D-141; then continue Stage-5 (phase-03 core verify). Sweep: `docs/audit/queued-findings-20260803-stage5-deploy-ovn.txt` (**4 FIRST SURFACE**). Status ONLY in CURRENT-STATE.md.