# session-ledger summaries rotated 2026-07-27 (GA-R4 rule 3 / F1 -- oldest-first)

Moved VERBATIM from `docs/session-ledger.md` at the Stage 4 close, to restore the 300-line
cap (the live ledger was 317). These are the three 2026-07-23 closed-session summaries --
the oldest still-live ones. Each still points at its own archived full body; only the
summaries moved. Status is in `docs/CURRENT-STATE.md` ONLY; this file is history.

## SESSION CLOSE 2026-07-23 -- G12 dc1 edge->commission + CLOSE + MERGE (bounded, GA-R4)

- Resumed from the 07-22 handoff (edge at login prompt); drove dc1 to a commissioned fleet,
  every mutation operator-gated in `manual` permission mode (auto-mode classifier blocks
  remote sudo shapes instead of prompting -- manual mode is the fix; noted).
- Edge: D-112(c) console bootstrap (payload needed util.inc/shell_safe -- dc0 lesson iv the
  .b64 lacked) + key auth + D-113(a2) API mint (transient post-restart-sshd scp, ssh-pipe
  workaround) + v4 addressing WAN 172.30.3.2 / LAN 10.12.64.1 (egress 0%).
- dc-rack-net dc1 arm (harness 18/18) + install (forwarder answers maas-internal); region MAAS
  D-120 range + D-131 dns + DHCP primary_rack=nmpcq4 (dhcpd verified running).
- SEC-016 RULED "Mint a dedicated dc1 power key" (per-DC isolation) + wired (script=svc key,
  MAAS snap=dedicated key). Commissioning ALL 9 READY ~3.5 min, shapes exact D-121 Option C --
  dc0's two stacked faults pre-empted by pinned MACs + forwarder.
- G12 CLOSED: gauntlet 76 GREEN, repo-lint 0-fail, consolidation + skill sweep (per-DC power
  key invariant) + GA-R7 memory review; MERGED to main (merge commit a5c0a49), branch retired.
- Open after: SEC 12 rows (incl. SEC-015/-016); 3 findings (util.inc, scp readiness, snap-key
  refresh fragility); D-068 item1, D-131 sub-4, D-132 pinned. Next stage branches off main.
- Full body: docs/archive/changelogs/changelog-20260723-g12-dc1-edge.md. Status ONLY in CURRENT-STATE.md.

## SESSION CLOSE 2026-07-23 -- Stage 4 OPEN + carve + mirrors (bounded, GA-R4)

- Stage 4 OPENED (branch dc-dc-stage4-phase3-maas-deploy); discovery captured; D-133
  (flat per-NIC carve; hw-faithful NICs next deployment) + D-134 (+amendment: contiguous
  bands, Option B swap) ADOPTED, utterances quoted.
- CARVE EXECUTED both DCs (logged stage4-carve): ranges .201-.254, 10 fabrics, 90 NIC
  re-homes, subnets+spaces, 18 nodes statics + br-ex; all Ready; capture committed.
- Deploy model RULED: Ready handoff (DOCFIX-200 -- runbook Step 4 would have broken
  Stage 5); jammy images synced; per-DC tags applied 9+9.
- Mirror: exception REJECTED -> D-135 ADOPTED; dc-mirror.sh shipped (19/19, gauntlet 77);
  INSTALLED both racks; initial syncs RUNNING at last check (hours; verify
  last-sync.status before citing). INCIDENT: dc1 edge pf never regenerated post-
  addressing -- filter reload fixed; appendix-A + DoD + script amendment QUEUED.
- OWNED: pipe-masked L10 lint FAIL (repaired); dc0-only egress probe wrongly assumed
  symmetric (item 9).
- Delivery batch LANDED before close (item 11): lib-hosts VR1 arms populated (tofu-name
  keys, pinned MACs, D-134 octets, host_sysid_by_bootmac) + D-133 guards in the two VR0
  flow scripts + appendix-A pf entry + DoD items 8-9 + item-4 range fix; dc-selector 48,
  gauntlet 77 GREEN. At close: both syncs RUNNING (dc0 13G / dc1 15G pulled).
- OPEN in-stage for the NEXT session: verify last-sync.status OK both racks (this
  session's watcher dies with it -- check at open); mirror node-side reachability gate;
  set-interface-v4 reload amendment (queued OPTION, unruled); local permission-rules
  prune (`Bash(ssh *)` flag); then the stage close-out set (consolidation, skill sweep,
  GA-R7 memory review, final gauntlet, operator-gated merge).
- Details: docs/archive/changelogs/changelog-20260723-stage4-open.md. Status ONLY in CURRENT-STATE.md.

## SESSION CLOSE 2026-07-23 -- queue pass + D-068 rulings (bounded, GA-R4)

- Queue fully processed. Repo: 5 script/harness fixes (prep-image bash -s; headend hints +
  idempotent sec010 nft + staging dir; apikey readiness/retry) + DOCFIX-198 (Steps 9-10
  superseded; DC standup DoD) + DOCFIX-199 (D-112(c) payload spec). Gauntlet 76 ALL GREEN.
- Live (logged ops-sec010-reassert, all operator-approved): SEC-010 files idempotent on all
  3 hosts (double-restart proof); G13 CLOSED -- office1 qga channel 0/1/0 saved-plan apply
  (guest-ping proven), edge 26.7 -> 26.7.1, os-iperf in after a measured refusal; outer plan
  re-converged zero diff. vr1-dc0-maas cache residue deleted (association-checked FIRST).
- D-068 item 1: plan DRAFTED then Q1 (rehearsal EOL acceptance, 1b), Q2 STRUCTURE (Roosevelt
  on 1.8 + funded remediation track), Q3 (monthly checks -> ops-update-procedure 0c) ALL
  RULED -- individually confirmed after a volunteered batch answer (GA-R5 kept). Remainder:
  Q2 path at Roosevelt design time. NetBox residue -> docs/netbox-write-path-findings.md.
- Owned: one capture commit pushed with a pipe-masked L10 lint FAIL; repaired same-hour.
- GA-R7 memory review: no changes. AT CLOSE: ledger-scan FALSE-CLOSE defect found (tail-appended
  detached amendments hijack the preceding decision's last-status -- D-132 dropped); FIXED
  number-keyed + regression cases (48/48), scan re-verified, machine block re-seeded.
- Details: docs/archive/changelogs/changelog-20260723-queue-pass.md. Status ONLY in CURRENT-STATE.md.