# session-ledger rotation 2026-07-26 (GA-R4 rule 3, amendment F1)

The live ledger had grown to 413 lines against GA-R4's 300-line cap; the 2026-07-25 close
recorded the rotation as OWED and it was not performed. F1's rule is OLDEST-FIRST: "after
writing the close summary, rotate oldest closed-session summaries until under cap."

Moved here VERBATIM, oldest first: the eight closed-session summaries from 2026-07-18
through the fifth 2026-07-21 session. Nothing is lost -- each summary already points at
its own archived full body, and this file preserves the summaries themselves.

Precedent: `docs/archive/session-ledger-rotated-20260719.md` (the one-time rule-6
rotation). This is the first routine F1 rotation.

NOTE ON TIMING: F1 binds the cap AT SESSION CLOSE. This rotation was performed mid-session
at operator direction ("rotate the session ledger") rather than at a close bookend. That is
early, not late; no open session's in-flight section was moved (this session has none in
the ledger), so the rule-3 protection is not implicated.

---

## SESSION CLOSE 2026-07-18 -- grounding audit (Phases 1-4); GA-R4 bounded summary

- Audit Phases 1-4 COMPLETE, each externally reviewed; FULL FREEZE upheld (zero pre-audit surfaces edited).
- Phase 1: record-audit extractor + inventory (12 contradiction groups); outer plan CAPTURED 7/2/7; GA-F01..F15.
- Phase 2: docs/CURRENT-STATE.md authored -- the single status authority; operator SIGNED (G11, section 11).
- Phase 3: fresh-agent grounding test, 3 probes 21/21 PASS; hole H1 amended into the G9 row.
- Phase 4: GA-R1..R7 + stage-status vocabulary (Option A + H1) ALL RATIFIED, utterances quoted (docs/audit/ga-rulings.md).
- Phase 5 NOT opened: sweep plan DRAFTED (docs/audit/phase5-sweep-plan.md, commit 687dfa8) awaiting external review.
- DC0 apply remains STOPPED (G9); D-130 unruled; expected plan triple UNRESOLVED (CURRENT-STATE section 5).
- Next session: FRESH operator session, auto-memory ON (GA-R7 rule 8); read sweep plan + CURRENT-STATE.md first.
- Status lives ONLY in CURRENT-STATE.md (GA-R1); this entry is narrative + pointers, not status.
- Full session body: docs/archive/session-20260718-grounding-audit.md (GA-R4 rules 1-2, first live compliance run).
- GA-R4 F1 cap (<300 lines) not yet enforceable: the one-time rotation is Phase-5 Batch 4 (rule 6) -- noted, not skipped.
- POST-CLOSE ADDENDUM (2026-07-19): sweep plan externally reviewed PASS; amendments S1-S5 applied in
  a single commit (15ccfbd). Batch 0 was PRESENTED and HELD -- operator routed execution to the fresh
  session. Fresh session: read docs/audit/phase5-sweep-plan.md + docs/CURRENT-STATE.md, then gate Batch 0.

## SESSION CLOSE 2026-07-19 -- GA Phase-5 sweep (Batches 0-6) + AUDIT EXIT (bounded, GA-R4)

- All six sweep batches executed + closed in ONE session under per-batch operator gates.
- Tooling: L10 status-coupling lint (WARN->FAIL), SEC pointer+count scan, wrap-aware counters,
  vocab-keyed extractor + archive exclusion (operator-ruled). Gauntlet grew 69 -> 70 harnesses.
- D-130 ADOPTED (a) + implemented + v7/v8-verified; G6 state surgery (operator-ruled); expected
  triple 6/0/6 recorded and re-verified twice (postG6 + phase6-exit captures).
- Record fixes GA-F02..F05/F10..F12/F14..F16; H1 token migration; E1 gate-type tags; ARCH/OPS
  D-tags + D-129 split (operator-ruled); R3-F register fully dispositioned (S1).
- Memory hygiene per provenance rulings (2 files removed, GA-F16 found+fixed); ledger rotated
  1187->131; 96 changelogs + 25 docs consolidated to archive; top-level docs/ = 16.
- Skill swept against ratified GA-R1..R7 (checklist committed). Exit runs 1-6 ALL PASS incl.
  fresh probe trio 21/21 (7/7 on all three); operator RE-SIGNED CURRENT-STATE 2026-07-19.
- AUDIT EXITED: G3 + G11 CLOSED, FREEZE lifted, G9 OPEN (gated logged apply, G8 first).
- Full body: docs/archive/session-20260719-phase5-sweep.md. Status lives ONLY in CURRENT-STATE.md.

## SESSION 2026-07-19 (continued) -- DC0 deploy, step A (logged: dc0-deploy)

- Same session continued past the audit close at operator direction (skill re-invoked; fresh-session
  hygiene noted and waived by the operator's go).
- G8 passed in-session; validate PASS; pre-apply capture == 6/0/6; saved plan applied: 6/0/6 exact.
- vvr1-dc0 RUNNING (108 vCPU / 416 GiB / autostart off); guests untouched; convergence = no diff.
- Next: step B (bootstrap vvr1-dc0: site-headend-install --role rack --host-nodes + SEC-010 check,
  OPNsense base prep ON the VM) -- needs transit reachability + the dc0 key (D-126 DC rows).
- PAUSED at the A/B boundary (2026-07-19): operator moving to a fresh session. Step B's measured
  starting facts: vvr1-dc0 NICs = mesh-vr1-dc0-office1 + vr1-dc0-uplink (NO transit NIC yet --
  measure how reach works before wiring ssh; D-124 tfvars local+present; dc0 key minted).
  Fresh session: CURRENT-STATE first, then resume at runbook step B in the dc0-deploy logged window
  (same-day log appends).

## SESSION CLOSE 2026-07-21 -- commissioning diagnosis + repair (logged: ops-commissioning-diag; bounded, GA-R4)

- Session DISCONNECTED before its bookend; entry landed same-day by the successor session after
  read-only re-verification (9/9 Ready, forwarder active+enabled, dhcpd both controllers).
- G10 commissioning RESOLVED: ALL 9 DC0 nodes Ready, shapes exact to D-121 Option C.
- Two stacked faults, both measured: (1) the 2026-07-20 in-place apply regenerated all 9 node NIC
  MACs -- MAAS records repaired in place (operator-ruled), read-back 9/9; (2) MAAS 3.7 rack-only
  agent resolver SERVFAILs everything on an internet-isolated rack -- dc0-node-dns dnsmasq
  forwarder workaround (operator-ruled), live and proven (canary Ready ~3 min). LP report queued.
- D-131 PROPOSED (rack-only node DNS, Roosevelt-relevant); SEC-014 OPENED (rack cluster secret
  exposure); committee record closed by addendum. Phase-7 tag cleanup verified done.
- QUEUED delivery: node-vm MAC pinning + harness; forwarder + rack-legs repo persistence;
  platform-traps + appendix-A entries; stale-pod cleanup at stage close (with SEC-013).
- REMAINING in G10: netem step E only (netem-link passwordless-sudo blocker).
- Details: docs/changelog-20260721-commissioning-diag.md + docs/audit/commissioning-diag-20260721.txt.
  Status lives ONLY in CURRENT-STATE.md.

## SESSION CLOSE 2026-07-21 -- close-and-delivery session (bounded, GA-R4)

- Session DISCONNECTED before its bookend (second same-day disconnect); all seven deliverable
  commits were already pushed (8b3adb3..8a9c04c), so only this entry + the netem-install record
  were outstanding. Landed by the successor session after read-only re-verification.
- Delivered: predecessor (ops-commissioning-diag) close landed; node-vm MAC pinning (54 measured
  pins) + power-ownership guard ruled and APPLIED on voffice1 (0/9/0 exact, converged zero diff);
  D-131 sub-1 RULED + dc-rack-net.sh shipped AND installed on the rack (check 10/10, SOA probe);
  incident docs (appendix-A x2, platform-traps 1e corollary, LP draft -- operator to file);
  step-E netem sudo RULED (scoped NOPASSWD) + fragment shipped (gauntlet 75 ALL GREEN).
- Post-disconnect: operator ran the netem-tc install interactively; successor VERIFIED read-only
  (0440 root:root, byte-identical, sudo -n -l grant checks exit 0 --
  docs/audit/netem-sudo-install-20260721.txt). Step E is now UNBLOCKED (gated run pending).
- Details: docs/archive/changelogs/changelog-20260721-close-and-delivery.md. Status lives ONLY in CURRENT-STATE.md.

## SESSION CLOSE 2026-07-21 -- STAGE 3 CLOSED + MERGED (third session; bounded, GA-R4)

- Bookend landed at stage close while the session may continue (two same-day disconnects argued
  for durable-early); any further work appends a POST-CLOSE ADDENDUM (07-18 precedent).
- Step E netem DONE (targeted apply at an operator-ruled 1/1/0 STOP; placeholder live on virbr5)
  -> G10 CLOSED. G16 opened for the office1 channels residual, then CLOSED same-day
  (operator-ruled state surgery; outer plan back to ZERO DIFF).
- Ruling 1 retire-fully EXECUTED: vr1-dc0-maas removed, stale pod + SEC-013 key file + tfstate
  deleted. INCIDENT: the pod delete cascaded to the 9 machine records (association check ran
  post-delete -- owned); recovered same-hour via re-enlist/power/commission, 9/9 Ready, shapes
  exact, NEW MAAS hostnames. Appendix-A entry shipped (check pod machine list BEFORE delete).
- Also: ledger-scan PARTIAL fix, DOCFIX-197, D-103/D-123 amendments, GA-R7 memory review.
- STAGE 3 CLOSED (operator-ruled): consolidation + skill sweep + gauntlet 76 ALL GREEN; merge
  commit 8d0d155 on main; branch retired local+remote. Next stage branches off main.
- Open queue unchanged: D-131 sub-2..4, SEC-014 rotation, D-068/D-071/D-129, G12 (dc1), G15.
- Details: docs/archive/changelogs/changelog-20260721-netem-install-verify.md (archived at the
  successor's bookend). Status lives ONLY in CURRENT-STATE.md.

## SESSION CLOSE 2026-07-21 -- queue-pass session (fourth same-day; bounded, GA-R4)

- Recovered the predecessor's undelivered committee verdict from its transcript; the
  tenant-onboarding items are PINNED to a deployment-close consideration review (operator-directed;
  self-contained block in the retained section above).
- Queue pass, one GA-R5 ruling per exchange, each committed+pushed: D-131 sub-2 ruled
  (metal-admin-only) + sub-3 RESOLVED by measurement (no dhcpd option-6 defect; stale read;
  operator-run capture); D-129 subs (i)-(iv) ALL RULED -- decision-complete, G13 execution-only;
  D-071 ADOPTED (all four points); D-068 items 2-3 RULED; D-100 netem placeholder CONFIRMED.
- Filed/pinned: D-132 PROPOSED (per-DC MAAS topology, operator verbatim); DNS architectural
  review pinned to D-131 sub-4. Delivered: cloud-assert A9 vault-kv AppRole probe
  (harness 15/15; gauntlet 76 ALL GREEN).
- G12 [R] leg CLOSED: vr1-dc1 addressing RATIFIED (D-124 amendment; apex confirm-free at
  authoring). Remaining [V]: vars + substrate root + build.
- Open after this session: D-068 item 1 (draft), D-131 sub-4 (LP + pinned review), D-132
  (pinned), G12 [V], G13 execution, 10 SEC rows, LP filing (operator).
- Details: docs/archive/changelogs/changelog-20260721-tenant-review-pin.md. Status lives ONLY
  in CURRENT-STATE.md.

## SESSION CLOSE 2026-07-21 -- G12 dc1-authoring session (fifth same-day; bounded, GA-R4)

- Session DISCONNECTED before its bookend; entry landed by the successor session 2026-07-22
  after read-only re-verification (tree, branch, harnesses). No cloud state was touched.
- Delivered pre-drop (commit cbc1104 on branch dc-dc-g12-dc1-substrate -- branch UNPUSHED at
  the drop): dc1 apex confirm-free capture (transit /30 + rack 10.12.68.2 FREE, planes already
  consistent) + dc-rack-mgmt-import per-site --site support (117/117; live dry-run PASS).
- INTERRUPTED mid-item-3, authored UNCOMMITTED in tree: vr1_dc1 vars + vvr1-dc1 module +
  vr1-dc1-uplink, inner root opentofu/vr1-dc1-substrate/ (54 MACs pre-pinned 52:54:01:d1),
  lib-net.sh dc1 arm + selection guard, dc-selector 40/40. Drop point: BEFORE the gauntlet --
  successor run = 6/76 FAILED, six harnesses still assert the retired vr1-dc1 fail-loud arm
  (docs/audit/gauntlet-20260722-g12-dropstate.txt). Owed: reconcile -> ALL GREEN -> delivery
  entry -> commit+push; THEN the operator-gated apex --commit stays G12's next gated step.
- Details: docs/changelog-20260721-g12-dc1-authoring.md (item 3 = drop-state record). Status
  lives ONLY in CURRENT-STATE.md.