# Rotated session-ledger summaries -- moved 2026-08-05 (GA-R4 rule 3 / F1)

Moved VERBATIM from `docs/session-ledger.md` at the 2026-08-05 (part 2) close to keep the
live ledger under the 300-line cap. Also folds forward the 2026-08-01 rotation pointer
(`docs/archive/session-ledger-rotated-20260801.md`, unchanged).

---

## SESSION CLOSE 2026-07-31 -- Stage 5 dc0: prefer-ipv6 ruled, deploy succeeded then torn down for a clean rebuild (bounded, GA-R4)

- Branch `dc-dc-stage5-preconditions`, **45 commits** pushed. NO stage opened/closed. Scan: 3 decisions, **SEC 26**, D 139 / DOCFIX 207 / BUNDLEFIX 053.
- **8 RULINGS (GA-R5, all utterances quoted):** prefer-ipv6 dropped from the six, then from ALL thirteen; P5's five new findings accepted; **option D** (explicit base on 56 apps AND a clean model); jammy-backports synced; UCA points in-DC; snaps get an in-DC forward proxy; and the MAAS proxy declined in favour of the owned one.
- **THE RESEARCH INVERTED ITS OWN PREMISE.** Read from the charm ARTIFACTS: `prefer-ipv6` is NOT what makes HAProxy bind `:::port` -- that is gated on the kernel `disable_ipv6` sysctl, and pacemaker picks IPv6addr by family detection. Neither consults the option. vault ships no haproxy at all (`[::]:8200` hardcoded).
- **>>> THE BUNDLE DEPLOYED (attempt 3, `Deploy of bundle completed.`) <<<** after three failures each one layer deeper: unknown option; a missing `policies/overrides.zip` on the client host; and a bundle relying on `default-base` being deployable exactly ONCE.
- **FOUR ARTIFACT DEFECTS, each masked by the one before it** (`apt-get update --error-on=any` fails on the first bad source): backports 404, upstream UCA unreachable, `prefer-ipv6` fatal on containers with only link-local v6, and snaps with no path. Units tracked 22 -> 17 -> 4 -> 7-in-one-class.
- **THE v6 HALF IS CARVED AS ADDRESSES BUT NEVER MADE OPERATIONAL** -- all six v6 plane subnets carry ZERO allocatable ranges, the rack has NO global v6 at all, the mirror does not answer on v6, and nodes have no v6 default route. Operator: dual-stack was "only a safety net". DC1 carries the IPv6 build; DC0 folds it back.
- **TEARDOWN STALLED AND WAS FORCED.** All 26 agents were `stopped`, so no hook could run -- a fixed point, not backoff. `--force` cleared it; NOTHING was stranded. All nine nodes renamed to their ruled `vr1-dc0-<role>-NN` by pinned boot MAC and back to `Ready`.
- **SNAP PROXY BUILT AND INDEPENDENTLY REVIEWED, NOT APPLIED.** squid at the utility `.4:3129`, allowlisted, 53/53 mutations killed; review says the ruled design is HONOURED on all four counts and logs FOUR real bugs. Nothing proven end to end.
- **OWNED:** a red-lint push (`| tail` masked the exit code); a `git add -A` that swept an agent's files into an unrelated commit; two instrument misreads (a `juju models` summary read as progress, and stale unit logs read as current); and a wrong "immutable system_id" claim the operator corrected.
- **NEXT:** apply the review cuts, re-run the mutation pass (S8 invalidates it), confirm BUG-3's deny shape once, install the proxy, then `add-model` + spaces + `deploy`. Sweep: `docs/audit/queued-findings-20260731-stage5-deploy.txt` (11 FIRST SURFACE). Bodies: `docs/changelog-20260731-prefer-ipv6-research.md`. Status ONLY in CURRENT-STATE.md.

## SESSION CLOSE 2026-08-01 -- snap proxy LIVE, D-139 adopted, IPv6 PROVEN on the node planes (bounded, GA-R4)

- Branch `dc-dc-stage5-preconditions`, **8 commits** pushed (`d555b90..844b2e4`). NO stage opened or closed. Scan: 3 open decisions, SEC **26** (none opened this session), D **140** / DOCFIX 207 / BUNDLEFIX 053.
- **THE dc0 SNAP PROXY IS LIVE.** `check dc0` PASS exit 0, 16 assertions, re-verified independently of the agent that installed it -- and **a real snap payload fetched through it** (HTTP 206, first bytes `hsqs`). No longer fixture-green. BUG-3 confirmed by measurement (no assertion changed); BUG-4 fixed at BOTH sites where the review had named one.
- **D-139 ADOPTED** -- two rulings taken in separate exchanges: IPv6-only on the east-west planes, and the whole plane carve moved to GUA on the octet map VR0 and Willamette already use.
- **THEN ITS DECIDING REASON WAS REFUTED BY MY OWN VERIFICATION** -- glibc 2.35 implements RFC **3484**, not 6724, so ULA and GUA are EQUAL at precedence 40. Put back to the operator rather than quietly kept; ruling CONFIRMED on its other grounds and the dead rationale STRUCK IN PLACE, not deleted.
- **RULING A IS NOT ACHIEVABLE at current charm revisions** -- `ceph-osd` fails a v6-only plane in BOTH directions, `hacluster` still ships `ip_version: ipv4`, OVN documents encap as IPv4-only. Narrowed by ruling ("B plus C") to a storage+replication experiment plus the upstream fix; LP draft written, operator files it.
- **>>> IPv6 IS PROVEN ON THE dc0 NODE PLANES <<<** 6/6 addresses live on the NICs, 0% loss node-to-node on all six planes, ND resolving from a COLD neighbour table. Gate **G19** built AND run live. **IPv6 is also already load-bearing: node time sync runs over `fd50:840e:74e2:220::6`, stratum 3.**
- **THE RECORDED ROOT CAUSE OF THE v4-ONLY CONTAINERS WAS WRONG.** MAAS has 100% of every v6 `/64` available; the real limit is juju taking `addrs[0]` from an unsorted query, family-blind, with no knob (LP #1723240, open since 2017). Corrected per GA-R1 C2.
- **THE "JUJU CLIENT BLOCKER" WAS NOT ONE** -- the client is live and registered on the rack, exactly where D-138 puts it. Corrects this repo's own 2026-07-31 finding 9d.
- **D-139's OWN EXECUTION LIST WAS DEFECTIVE AND IS REPLACED.** `dc-node-v6-carve.py` pivots on IPv4 existing, so run after v4 removal it would carve four fewer planes per node **and exit clean**.
- **OWNED:** my BUG-1 fix was wrong (a secondary alias is never the kernel's chosen source); I scoped the v6 experiment wrong (ceph couples storage+replication); I stated an agent's input source wrongly; I scoped a research agent with no repo path, so 355 lines landed in `/tmp` and needed rescuing; and one commit went red on ASCII-only em-dashes.
- Gauntlet **ALL GREEN (96)**, repo-lint 0 fail, `d139-gua-carve` 71/71, `dc-node-v6-verify` 55/55. **voffice1's clone is 36 commits BEHIND** -- no loss, but a live hazard on the Plane-2 host.
- **AMENDED AFTER THE BOOKEND (2026-08-01):** both DC containment VMs resized **416 -> 480 GiB** through tofu (operator: *"Option 2 look sgood me"*), **128 GiB swap** added (operator-run), and preflight gained **gate P8, substrate drift** (harness 33 -> 38, proven live at zero diff). Host used **809 -> 63 GiB**. Found: dc0's MAAS region and juju controller have `autostart=disable`. Bodies: changelog items 21-22.
- **NEXT:** apex CREATE-only push (tool built, independently reviewed, dry-run byte-identical), then the bundle deploy -- its blockers are cleared. `network-get` on a v6-only bound space is still unmeasured and gates the v4-removal experiment. Sweep: `docs/audit/queued-findings-20260801-stage5-ipv6-d139.txt` (**6 FIRST SURFACE**). Body: `docs/changelog-20260731-snap-proxy-apply-ipv6.md`. Status ONLY in CURRENT-STATE.md.