queued-findings-20260802-step6-queued-items.txt ================================================ Close sweep for the SECOND 2026-08-02 session (post-/clear): the queued-findings backlog (sweep F1-F6), the mirror root-cause, and D-139 execution step 6. Method (ruled 2026-07-31): read back over the whole session, enumerate every finding/decision/measurement/mistake, then GREP each candidate against repo surfaces. A hit = ALREADY ON SURFACE, and where. No hit = FIRST SURFACE and would have been lost on a context clear. Session body: docs/changelog-20260802-queued-items.md (items 1-12). Status claims live in docs/CURRENT-STATE.md ONLY. NUMBERING NOTE, because two registers collide: items below cite the SWEEP register (F1-F6, docs/audit/queued-findings-20260802-stage5-edge-fold.txt). The runbook fold register has its OWN F1-F12 with different meanings and is untouched this session. -------------------------------------------------------------------------------------- FIRST SURFACE -- existed ONLY in the transcript. Listed first, by consequence. -------------------------------------------------------------------------------------- G1. >>> A BROAD `Bash(ssh vr1-dc0-maas *)` ALLOW RULE WAS ADDED TO GITIGNORED STATE. <<< grep "ssh vr1-dc0-maas" in docs/: 0 hits. `.claude/settings.local.json` was MODIFIED this session (mtime 17:33) and now holds allow=310 / ask=11 / deny=0. The 2026-08-02 (first session) sweep recorded the counts as UNCHANGED from the 2026-07-30 verbatim record, so the growth is this session's. THE ITEM WORTH ATTENTION: `Bash(ssh vr1-dc0-maas *)` is a WILDCARD allow on the MAAS REGION VM -- the same shape as the broad `Bash(ssh vr1-dc0-rack *)` that the 2026-07-30 sweep flagged as "worth review". It was auto-added by an approval during the pg_dump work. It permits ANY command on the host holding the region database. Recommend narrowing to the read-only forms actually needed. The file is GITIGNORED, so this text is the only recovery copy. The 11 ASK rules verbatim (these are the gating ones and matter most): Bash(script -aqe ~/as-executed/2026-07-23-stage4-carve.log -c 'ssh voffice1 "maas admin machine *) Bash(ssh -i ~/vr1-dc0-creds/vr1-dc0_svc_ed25519 -J voffice1 jessea123@172.31.0.2 "sudo *) Bash(ssh voffice1 "maas admin interface *) Bash(ssh voffice1 "maas admin subnet *) Bash(ssh voffice1 "maas admin tags *) Bash(ssh voffice1 "maas admin tag *) Bash(ssh voffice1 "maas admin machine *) Bash(ssh *'maas * update*) Bash(ssh *"maas * update*) Bash(ssh *'maas * ipranges *) Bash(ssh *"maas * ipranges *) NOTE A GAP IN THOSE ASK RULES, measured by consequence this session: they pin the `maas admin` profile and the `ssh voffice1 "..."` double-quoted form. This session's MAAS SUBNET DELETES used `MAAS_PROFILE=vr1-dc0-region ... maas vr1-dc0-region subnet delete` in SINGLE quotes and therefore did NOT match `Bash(ssh voffice1 "maas admin subnet *)`. Four destructive deletes ran without hitting an ask rule. This is the SAME rule-fails-to-MATCH class recorded on 2026-07-30 (the DHCP cutover), and it is now recorded as recurring rather than one-off. The deletes were separately operator-approved, so nothing bypassed consent -- but the GATE did not fire, and that is the finding. G2. `--diff=none` DOES NOT MEAN "DOWNLOAD EVERYTHING", AND THE MIRROR IS INCREMENTAL. grep "diff=none": 3 hits, all either the flag itself (dc-mirror.sh:187,193) or a passing mention; NO hit explains the semantics. MEASURED this session from the sync journal: routine daily run ubuntu leg 1277 kiB the failing run ubuntu leg 2867 kiB (313s, of which 300s was one timeout) UCA leg, every run 15 kiB on-disk ubuntu 952 G, cloud-archive 342 M the 1048 MiB outlier (2026-07-31) = the day jammy-backports was ADDED to the suite list by operator ruling; adding a suite pulls its content ONCE. `--diff=none` disables PDIFFS -- the incremental-patch mechanism for INDEX files -- so debmirror fetches each Release/Packages/dep11 index in full every run. The POOL sync is still differential throughout. So a re-trigger costs seconds and single-digit MB, not a 950 G pull. WHY IT MATTERS: someone reading the flag name could refuse to re-trigger a sync believing it means a full re-download, or could budget hours for it. G3. LWP SYNTHESISES HTTP 500 FOR CLIENT-SIDE FAILURES -- IT IS NOT A SERVER 500. grep "synthesises 500": 1 hit, in this session's own root-cause capture only; grep "synthesizes 500": 0 hits. Not on any DURABLE surface (platform-traps). debmirror's `500 read timeout` is LWP reporting ITS OWN timeout (/usr/bin/debmirror:629, `our $timeout=300;`), not archive.ubuntu.com returning an error. Reading it as a server-side 500 sends the investigation upstream for the wrong reason, which is exactly what happened here before it was corrected. Belongs in platform-traps' verbatim-error index. LOGGED, NOT FIXED (hard rule 1). G4. dc1's GUA CARVE IS INCOMPLETE, AND IT IS A dc1 BLOCKER NOT JUST A TOOL FIXTURE. grep "f03:20" / "dc1.*GUA.*incomplete": hits only inside this session's own changelog item 10 and CURRENT-STATE, i.e. recorded as the REASON for a tool guard rather than as a dc1 WORK ITEM. MEASURED: only FOUR rows exist under `2602:f3e2:f03::/48`, all provider-public. No `:f03:20::/64`, no `:f03:21::/64`. So for dc1, D-139 steps 1 and 2 have NOT been run. Anyone reaching dc1's Stage 5 must run `d139-gua-carve.py --dc vr1-dc1 --commit` (and the MAAS half) BEFORE step 6 -- the step-6 tool now refuses, so the failure is loud, but the WORK is unregistered. G5. THE STEP-6 END STATE IS NOT RE-DERIVABLE FROM THE CARVE TOOL'S REPORT. grep "counts existence, not status": 2 hits, both this session's own records. `d139-gua-carve.py --dc vr1-dc0` STILL reports `RETIRE-REPORT 9` and `dependent objects ... 26 ip-address(es)` AFTER step 6 completed successfully. That is correct -- the rows still EXIST, deprecated not deleted, per the ruling -- but a future session running the carve tool to check progress will read it as "step 6 never ran". The carve tool has no status awareness and was not extended (hard rule 1). A `--commit`-less step-6 run is the correct instrument: it reports `CREATE 0 | ALREADY 26 | DEPRECATE-ADDR 0 | DEPRECATE-PFX 0`. G6. NO AS-EXECUTED LOG COVERS THIS WINDOW. `run-logged.sh` was NOT used -- it needs an interactive shell. The newest file in ~/as-executed/ is 2026-07-30-stage5-dc0-deploy.log. This session executed LIVE MUTATIONS (26 apex creates, 35 apex deprecations, 4 MAAS subnet deletes, one mirror sync trigger, one rack file copy) with NO as-executed coverage. All evidence is in docs/audit/* captures and the commit messages. DECLARED here rather than left to be discovered -- a log that looks complete and is not is worse than one declaring its gap. -------------------------------------------------------------------------------------- ALREADY ON SURFACE -- verified by grep, recorded for completeness -------------------------------------------------------------------------------------- A1. DOCFIX-207, preflight P6 plan count 50/97 -> 56/108 -- scripts/preflight.sh + changelog item 1 + CURRENT-STATE. A2. sweep F3 (`systemctl show` is not an existence check) -- platform-traps 5c. A3. sweep F4 (assert the harness CASE COUNT moved) + sweep F5 (two scripts probing one endpoint must share the probe definition) -- script-authoring. A4. sweep F1 CLOSED, rack deploy input re-staged, full 14-file enumeration -- docs/audit/repo-stage-drift-dc0-20260802.txt + changelog items 4-5. A5. sweep F6 CLOSED PASS, maasdb proven uncorrupted, and F6's own diagnosis being wrong (role + transport, not confinement) -- docs/audit/maasdb-pgdump-integrity-dc0-20260802.txt sections 7-11. A6. sweep F2 diagnosed R1, and the sweep's premise being wrong (it quoted the PASSING UCA leg) -- docs/audit/mirror-exitcode-diagnosis-dc0-20260802.txt. A7. The mirror root cause: archive.ubuntu.com backend 91.189.92.23 hangs on one object while serving its siblings; resolver rotates; 11/12 succeed -- docs/audit/mirror-500-timeout-rootcause-20260802.txt. A8. Four GA-R5/operational rulings with exact utterances -- "Re-trigger the sync first, decide after"; "Root-cause the curl/debmirror anomaly first"; "Full step 6 first, then deploy"; "Deprecate both, delete nothing" -- design-decisions.md + CURRENT-STATE. Plus the two approvals ("Queue up the MAAS half ... Go ahead with both now"; "Proceed with 1 and 2") in changelog items 11-12. A9. The step-6 tool, its adversarial review and all four DEFects -- docs/audit/d139-step6-tool-review-20260802.txt + changelog item 10. A10. Step 6 EXECUTED, 4 MAAS subnets deleted, 1 HELD on the juju-controller / region-VM hazard -- changelog item 11 + CURRENT-STATE. A11. `retire-v6-ula` and the broken by-hand link check it caught -- changelog item 12 + CURRENT-STATE + tests/dc-plane-ipam R1-R7. A12. The preflight-P2 / phase4 machines-overlay asymmetry -- changelog item 5. A13. SEC-029(3) recording ~/repo-stage as nine files when it is fourteen -- changelog item 5. A14. The netbox env FILENAME INVERSION (vr1-netbox-sandbox.env is the LIVE apex; vr1-netbox.env is the v1 reference) -- CURRENT-STATE:4638-4641, pre-existing. A15. The DOCFIX decoy-token counter inflation, twice, and its correction -- CURRENT-STATE + commit 93973b6. -------------------------------------------------------------------------------------- THE FIVE STRUCTURAL SWEEPS -------------------------------------------------------------------------------------- S1. GITIGNORED STATE. `.claude/settings.local.json` MODIFIED this session: allow=310 / ask=11 / deny=0. Verbatim ask rules and the broad-allow finding are in G1 above. This sweep file is the only recovery copy. S2. DANGLING REFERENCES. Every docs/audit path cited by this session's commits resolves; the four new captures are committed (repo-stage-drift, maasdb-pgdump-integrity, mirror-exitcode-diagnosis, mirror-500-timeout-rootcause, d139-step6-tool-review). S3. RULING FIDELITY. Four rulings + two approvals this session, each with its EXACT utterance quoted, dated, and -- for the two GA-R5 step-6 rulings -- committed and pushed BEFORE the dependent work began (934a1f0, 53aae78). None paraphrased. Both step-6 rulings were correctly classed OPS (GA-R3) rather than new D-numbers. S4. AS-EXECUTED LOG. NOT USED. See G6 -- this window is uncovered and it is declared. S5. CONTRADICTION DETECTOR. (a) The 2026-08-01 ordering ruling's stated premise ("the per-DC VIP overlays carry v6 VIPs in the ULA range") is FALSE as of 2026-08-02; the overlay was re-rendered onto GUA. Corrected in the 2026-08-02 ordering ruling itself rather than left to contradict silently. (b) The step-6 amendment first said the GUA records would be `status=active`; MEASURED, the originals are `reserved`. Corrected in both design-decisions and CURRENT-STATE under GA-R1 C2. (c) "The gate is FLAKY, not stuck" (written mid-session about the mirror) does NOT extend to the dep11 failure, which is persistent-per-backend. Withdrawn and corrected in commit 4f65c09 rather than left standing. (d) "Every action this tool takes is reversible" (step-6 docstring) was wrong for the 26 CREATES. Corrected in the docstring and in the presentation. (e) "Proven safe twice" (the four MAAS deletes) was HALF FALSE -- the link half of that proof was an inert checker. Corrected in changelog item 12 and CURRENT-STATE, with the safe OUTCOME recorded separately from the unsound VERIFICATION.