As-executed log convention (DOCFIX-076)

The verbatim-retrieval rule -- "for irreversible / one-shot / secret steps, retrieve the exact prior working command verbatim, never improvise" (the DOCFIX-006 vault-init loss is the cautionary tale) -- is only as strong as the artifact it retrieves from. Until now "the as-executed log" was a habit with no defined location, format, or retention. This defines it.

WHERE: jumphost, ~/as-executed/<UTC date>-<label>.log (dir 0700, files 0600). NEVER in the repo: sessions are secret-adjacent (tokens print, paths leak, hidden-prompt secrets do NOT echo but everything around them does).

HOW: start every consequential session (any RUN/CAUTION work) with bash scripts/run-logged.sh <label> -- it opens a logged subshell via script(1); exit to close. Labels: phase-NN-<topic> for deploy work, ops-<topic> for operations, incident-<date>-<topic> for incidents.

INDEX (this IS committed): logs/as-executed-index.md -- one line per session: date, label, operator, one-phrase scope. No content, no hostnames beyond the jumphost, no secrets. The index is what makes a two-year-old one-shot command findable by a Roosevelt operator who knows only "vault was initialized around June 2026".

RETENTION: keep indefinitely on the jumphost; include ~/as-executed in the jumphost backup set. A log that would age out is exactly the one the verbatim rule will someday need.

WHAT STILL GOES IN RUNBOOKS: the PROCEDURE. Logs capture what actually ran (with its warts); runbooks capture what SHOULD run. When they diverge, that divergence is a DOCFIX.