# Environment snapshot -- grounding audit Phase 1 (measured 2026-07-18, read-only)

Every value below was measured THIS session on the live environment or repo.
Nothing is carried from prior-session memory. Command outputs are quoted or
cited to their capture file. This snapshot + `outer-plan-20260718.txt` are the
Phase-1 "repo-vs-live divergence" record (charter section 2 item 5).

## Host (vcloud)

- `hostname` -> `vcloud`; `uname -r` -> `6.8.0-136-generic` (the bookend
  kernel); `uptime` at 08:45 UTC -> up 9:06 (host rebooted ~2026-07-17 23:39).
  The BOOKEND (patch + reboot, dc0-deploy-readiness.md) has HAPPENED.
- `virsh list --all`: `voffice1` running, `office1-opnsense` running -- both
  `autostart=enable` (per-domain `virsh dominfo`). Cold-boot autostart path
  self-recovered both guests, as designed.
- `bash scripts/site-baseleg.sh check office1` -> ok leg `10.10.0.10/24` on
  virbr2, ok route `10.10.1.0/24 via 10.10.0.20` (D-126 unit survived reboot).

## voffice1 (via `ssh voffice1`, read-only)

- `uname -r` -> `6.8.0-136-generic` (guest matches host kernel).
- `snap list`: MAAS `3.7.2-17972-g.35e297c4d`; LXD `5.21.5-f2a1a0e`.

## Toolchain

- `tofu version` -> `OpenTofu v1.12.4` on linux_amd64.
  (README.md pins 1.12.3 -- stale; see findings register GA-F03.)

## Outer plan (THE citable plan-count source from here forward)

- Command: `tofu -chdir=opentofu plan -no-color -input=false`
- Captured in full: `docs/audit/outer-plan-20260718.txt`
- Result: **Plan: 7 to add, 2 to change, 7 to destroy** -- does NOT match any
  recorded gate count (5/0/6 nor 5/2/6). Decomposition, from the capture:
  - Refresh-detected live drift: `module.voffice1.libvirt_cloudinit_disk.seed`
    HAS BEEN DELETED (live volume gone since the reboot);
    `module.voffice1.libvirt_domain.vm` and
    `module.office1_opnsense.libvirt_domain.vm` have changed.
  - 2 change (in-place): the voffice1 + office1-opnsense domains.
  - 7 add = the 5 committed DC0 creates (`vvr1_dc0` domain/disk/seed-volume/
    cloudinit + `vr1_dc0_uplink`) PLUS voffice1 cloudinit seed (re-create)
    PLUS voffice1 `libvirt_volume.seed` (replace-create).
  - 7 destroy = the 6 empty `vr1-dc0` plane networks (intended Model B
    relocation) PLUS voffice1 `libvirt_volume.seed` (replace-destroy;
    `create.content.url` **forces replacement** -- the volume-replace-under-
    running-domain bounce risk that STOPPED the DC0 apply on 2026-07-18).
- The two charter-exempted read-only verifications (v0.9.8 volume-replace
  behavior on a throwaway domain; `ignore_changes` suppression) remain TO RUN;
  they inform the D-130 mechanism ruling in Phase 5.

## Repo state

- HEAD at session start: `148dcef` (branch `dc-dc-stage3-phase2-dc-substrate`),
  `git status` clean; `git pull` -> already up to date.
- `bash scripts/repo-lint.sh` -> 0 fail, 1 documented legacy WARN.
- `bash scripts/run-tests-all.sh` -> GAUNTLET ALL GREEN (69 harnesses,
  including the new `tests/record-audit/`).
- `bash scripts/ledger-scan.sh` -> PROPOSED/OPEN: D-068, D-071, D-129; OPEN
  SEC rows: SEC-001, -003..-008, -010 (9 rows); next-free D-130 / DOCFIX-197 /
  BUNDLEFIX-052. `--fences` -> 1 fence, 0 errors, 0 warnings, OK.
- Auto-memory: DISABLED this session by design; the memory directory was read
  as on-disk evidence only (5 files; see findings GA-F05..GA-F08).