# Changelog 2026-08-04 -- Stage 5 dc0 clean redeploy (Path M teardown + ovn-central cert delivery fix)

Session-scoped (GA-R2). Status claims live in docs/CURRENT-STATE.md ONLY; this file
is the review surface for the changes, each with evidence + a revert.

## 1. Path M model teardown of vr1-dc0 (operator-ruled, executed clean)

- **What:** tore down the ovn-central-degraded vr1-dc0 model to redeploy clean with the
  Step 1.2b cert fix. Graceful `juju destroy-model vr1-dc0 --no-prompt` (no --force,
  agents alive) drained 36->15; wedged on 4 error units with failed teardown hooks;
  `juju resolved --no-retry` (operator-ruled) cleared them 15->3; the last 3 records went
  to machine-state STOPPED (the genuine M.2 agents-stopped stall) and
  `juju destroy-model vr1-dc0 --force --no-wait --no-prompt` (operator-ruled) finished 3->0.
- **Evidence:** `Model destroyed.` rc=0. NO orphan (controller API healthy, no life:dead
  residue -- the 08-03 failure did not recur). M.5 cascade: MAAS profile dc0 shows 10
  machines UNCHANGED (9 Ready + 1 Deployed controller VM). Proxies survived (dc-cache-proxy
  + dc-snap-proxy check dc0 both PASS). Full as-exec: `docs/audit/stage5-dc0-redeploy-asexec-20260804.txt`.
- **Revert:** n/a (teardown intended); the model is rebuilt in this same work (add-model done).

## 2. scripts/dc-node-etchosts.sh -- DELIVERY BUG fixed: runcmd -> postruncmd

- **What & why:** Step 1.2b's live `juju model-config cloudinit-userdata=...` was REJECTED:
  "runcmd not allowed, use preruncmd or postruncmd instead". juju reserves top-level `runcmd`
  for its own machine-agent bootstrap. The render emitted `runcmd:`; changed to `postruncmd:`
  (runs after juju's bootstrap, still long before the ovn-central cert hook). The 08-04 fix
  proved the CONCEPT live but its DELIVERY was never live-tested -- the harness graded
  cloud-init YAML validity (which accepts runcmd), not juju acceptance.
- **Harness reconcile:** `tests/dc-node-etchosts` switched to postruncmd + NEW **T10** asserts
  a juju-accepted key (postruncmd/preruncmd) and REJECTS bare runcmd -- the missing gate.
  10/10 PASS; T10 MUTATION-PROVEN (revert to runcmd -> 5 FAIL incl T10).
- **Evidence:** re-run live -> `OK: set` (juju accepted), `check` OK carries 10.12.12.0/22, rc=0.
  Re-staged to the dc0 rack, sha 107fc197 verified. repo-lint 0 fail.
- **Revert:** `git checkout <this commit>~ -- scripts/dc-node-etchosts.sh tests/dc-node-etchosts/run-tests.sh`;
  live: `juju model-config -m vr1-dc0 --reset cloudinit-userdata`.

## 3. M.6 rebuild progress (add-model, gates)

- `juju add-model vr1-dc0` -> Added with credential vr1-dc0-cred. Artifact source inherited
  from model-defaults (apt-http-proxy :3142 + snap proxies :3129; apt-mirror empty -- D-135
  amendment (b): dc0 on the caching PROXY, NOT the retired mirror; Step 3.5's mirror text is
  STALE -- runbook-fold gap, flagged). Spaces gate PASS 0 fatal. Egress gate 8/8 PASS.
  Dry-run gate PASS (9 machines, correct per-DC tags). Step 1.2b applied+checked (item 2).
- **Owed (logged, not done):** DOCFIX/runbook-fold to correct phase-4 Step 3.5's mirror text
  to the D-135-(b) proxy shape; the dc-node-etchosts.sh delivery bug is a correction to the
  08-04 "PROVEN + WIRED" record (CURRENT-STATE updated this commit).
- **Revert:** `juju destroy-model vr1-dc0` (empty/partial model).

## Queued (operator request, NOT executed -- needs a ruling)

- Tailscale install on DC0/DC1: intersects D-107 (workstation path), D-128 (base-leg is the
  DC reach), and the 2026-08-02 "VPN deferred to Roosevelt" ruling. Put as a GA-R5 exchange
  (likely a D-number) before any install. See the as-exec file's QUEUED section.