diff --git a/persistent-memory.md b/persistent-memory.md
index 8732607..605db79 100644
--- a/persistent-memory.md
+++ b/persistent-memory.md
@@ -596,6 +596,7 @@ below is a live commitment or a known-open risk._
 
 - `[2026-09-08]` **ERP run 5 = RESCUED (landmark R49.5)** — first capability-gate pass in the ERP-seat line; the 3.46%-loss dependency-forcing slot (GovReport+QMSum) broke the coupling runs 3c/4 couldn't. Seat `erp-tune-v5` served on gx10:8098, `trial` alias repointed 3c→v5. → `persistent-memory.d/2026-09-08-run5-rescued.md`
 - `[2026-09-08]` **R47 base settled from bytes = STOCK `google/gemma-4-26B-A4B-it`** — three-way sha match (local == HF etag == stock LFS oid; commit `4d7ae498` == stock HEAD); the `-heretic` label is a naming error, all runs trained from stock. Accept-vs-swap now evidenced. → `persistent-memory.d/2026-09-08-base-provenance-stock.md`
+- `[2026-09-08]` **yt-voice-clipper back UP** — dead since the 09-06 danted retirement (every job failed at yt-dlp, bot-gated on the Irvine datacenter IP). Fix: danted on **nh3-scale** (CT107) at `socks5h://100.64.0.1:1080`, fleet-ACL'd, residential egress 70.230.226.88 measured; `YTVC_PROXY` repointed, worker recreated, end-to-end job DONE with positive (proxied) + negative (direct = bot-gate) controls. Homepage card href/siteMonitor → `irv-ml1.nh3.internal:8000` (was dead wg0 IP). Script `scripts/setup-nh3-scale-socks-egress.sh`. → auto-memory `reference_nh3_egress_proxy`, `reference_ytvc_autodeploy`.
 - `[2026-09-08]` **ESH WAN static `128.177.138.182/30` (gw .181) is LIVE** — the Cityside /30 that was 'not provisioned' on 09-04 now carries traffic; egress verified from esh-docker-vm. CGNAT at ESH is over. Added to the crowdsec `esh` allowlist. All three follow-ups LANDED same day: FortiGate trusthost3 → the static (login from ESH verified), dormant esh-ana IPsec rebound to wan1/static, UDP 41641 forward → esh-scale now peers DIRECT (was DERP).
 - `[2026-09-08]` **ERP run 6 LAUNCHED on pfi-gx10 on the jenerallee78 ARA-abliterated base** (index `33c59654…`, 32/32 shards byte-verified vs brokkr pins, stock tokenizer set installed over the repo's 256-token-truncating one, run-5 recipe byte-held, free check exact). Operator's direct grant `operator-2026-09-08-rnd-run6`; run-5 seat unloaded (`trial` dark). Gate names: `erp-seat-base-ara` / `erp-tune-v6`. → `docs/runbooks/gx10-run-06.md`, commit `3fec668`.
 - `[2026-09-08]` **Miranda = operator's chief of staff, may relay his directives** — added to user-level `~/.claude/CLAUDE.md` (dotfiles `7134a22`) as the named exception to the no-relayed-auth rule (unidentified peer relays still excluded); material-consequence calls she relays stay the operator's own.
diff --git a/scripts/setup-nh3-scale-socks-egress.sh b/scripts/setup-nh3-scale-socks-egress.sh
new file mode 100755
index 0000000..7528003
--- /dev/null
+++ b/scripts/setup-nh3-scale-socks-egress.sh
@@ -0,0 +1,60 @@
+#!/usr/bin/env bash
+# nh3-scale (CT107): SOCKS5 egress proxy over the mesh — fleet-internal only.
+# Successor to the retired nh3-dev danted (2026-09-06): same residential NH3 egress,
+# now hosted ON the exit-node router so mesh peers reach it at 100.64.0.1:1080.
+set -euo pipefail
+export DEBIAN_FRONTEND=noninteractive
+dpkg -s dante-server >/dev/null 2>&1 || { apt-get update -qq; apt-get install -y -qq dante-server; }
+cat > /etc/danted.conf <<'CONF'
+# Fleet egress proxy on nh3-scale (PFI infra) — SOCKS5, INTERNAL-ONLY.
+# Egress via NH3's residential line. Managed from eshpfi-management
+# (scripts/setup-nh3-scale-socks-egress.sh) — edit there, not here.
+logoutput: syslog
+internal: 0.0.0.0 port = 1080
+external: eth0
+socksmethod: none
+clientmethod: none
+user.privileged: root
+user.unprivileged: nobody
+# Client ACL — mesh + fleet RFC1918 only. NOT an open proxy.
+client pass {
+    from: 100.64.0.0/10 to: 0.0.0.0/0
+    log: error
+}
+client pass {
+    from: 10.0.0.0/8 to: 0.0.0.0/0
+    log: error
+}
+client block {
+    from: 0.0.0.0/0 to: 0.0.0.0/0
+    log: connect error
+}
+socks pass {
+    from: 100.64.0.0/10 to: 0.0.0.0/0
+    protocol: tcp udp
+    log: error
+}
+socks pass {
+    from: 10.0.0.0/8 to: 0.0.0.0/0
+    protocol: tcp udp
+    log: error
+}
+socks block {
+    from: 0.0.0.0/0 to: 0.0.0.0/0
+}
+CONF
+mkdir -p /etc/systemd/system/danted.service.d
+cat > /etc/systemd/system/danted.service.d/override.conf <<'UNIT'
+[Unit]
+After=network-online.target tailscaled.service
+Wants=network-online.target
+[Service]
+Restart=on-failure
+RestartSec=5
+UNIT
+systemctl daemon-reload
+systemctl enable --now danted
+systemctl restart danted
+sleep 1
+systemctl is-active danted
+ss -ltn | grep ":1080 "