memory: snapshot — run-5 RESCUED + seat live, base settled STOCK, cc-channel route, Miranda relay authority; session fleet-fixes + open items

persistent-memory.md

@@ -144,6 +144,31 @@ COMPLETE and gated RESCUED (02:13 PDT). Live open items:_
   pulled was stock google, and the `-heretic` name rode along from intent. **Operator/Brokkr decision
   now evidenced (not a label guess): accept RESCUED-on-stock, or swap to a real abliteration (needs a
   bf16 source, not the GGUF) + re-run. Recipes should drop `-heretic` from the base name.**
+- **⏳ OPEN (operator + brokkr, not urgent): accept RESCUED-on-stock as the ERP seat, or source a bf16
+  abliteration + re-run the line.** Now an evidenced choice (base is stock). No deadline.
+- **📮 althing reachability on THIS bg seat = the cc-channel route, NOT the waiter.** `althing-listen`
+  reaps within ~seconds-to-minutes on an idle background seat (harness kills detached bg tasks; hit it
+  repeatedly this session). Fix (operator-directed 2026-09-08): `althing-route declare --handle infra-ops
+  --pid <PID>` where `<PID>` is the number in `$CLAUDE_CODE_MESSAGING_SOCKET` filename
+  (`/run/user/1000/cc-socks/<PID>.sock`) — `--discover-pid` REFUSES on a forked child session (ancestry
+  ≠ zellij launcher). Flips `postbox status` to `mode: push, reachable: True`, no process to reap. A fresh
+  bg session should re-declare it (the pid changes per launch). See the `[2026-09-07]` cc-channel entry in
+  Recent decisions for the durable why.
+- **✅ Fleet fixes shipped this session (2026-09-08), all committed:** WhereTF Homepage card + DNS alias
+  (`wherethef.nh3.internal`, e0d1c44/4506ef6); ext-tts LiteLLM alias repointed to `irv-ml1.nh3.internal`
+  via DB `/model/update` + `extra_hosts` (957c8f1); the 09-06 irv-ml1 move's stale-IP trail repointed
+  across 25 stack composes + services.yaml + ssh-target → DNS name (e0d1c44); Homepage `/api/services`
+  outage fixed — irv-ml1 docker.yaml repointed + **ana-ml2 discovery via a socat proxy on ana-docker**
+  (`stacks/ana-ml2-proxy`, 913d2d2, reversible when ana-ml2 gets an ESH return route).
+- **⏳ Minor cleanup leftovers (offered, operator hasn't taken — not urgent):** (#2) the ~10 RUNNING
+  irv-ml1 service cards still show dead `10.100.79.3` hrefs — canonical fixed, but each running container
+  needs a recreate to apply the label (bounces the service); (#3) deployed `.env` for asset-engine /
+  open-webui / skaldsong may still hold the dead default (canonical defaults fixed; a read-only check would
+  confirm which deployments are broken).
+- **⚠ persistent-memory.md is 2.4× the soft cap (~710 lines).** Bulk is the non-archivable structural
+  sections (sister-repos table + backup architecture under Tools and conventions) — archival only touches
+  dated logs, so it can't reach 250. The real fix is a redundancy-trim of Tools-and-conventions rows that
+  CLAUDE.md already covers (deliberate pass, not archival). Flagged, not done.
 - **NASPool evac copy now safe to destroy** — scrub clean (0 err) AND PBS runs landing (verified 116
   backups, 8 guests 09-06). `ospool/naspool-evac` (1.65T) can go once ONE Backrest run is confirmed:
   `zfs destroy -r ospool/naspool-evac` + drop `@evac`. pfi-pve PSU1 dead + backplane bays 9/10 dead
@@ -548,6 +573,10 @@ below is a live commitment or a known-open risk._
 
 ## Recent decisions
 
+- `[2026-09-08]` **ERP run 5 = RESCUED (landmark R49.5)** — first capability-gate pass in the ERP-seat line; the 3.46%-loss dependency-forcing slot (GovReport+QMSum) broke the coupling runs 3c/4 couldn't. Seat `erp-tune-v5` served on gx10:8098, `trial` alias repointed 3c→v5. → `persistent-memory.d/2026-09-08-run5-rescued.md`
+- `[2026-09-08]` **R47 base settled from bytes = STOCK `google/gemma-4-26B-A4B-it`** — three-way sha match (local == HF etag == stock LFS oid; commit `4d7ae498` == stock HEAD); the `-heretic` label is a naming error, all runs trained from stock. Accept-vs-swap now evidenced. → `persistent-memory.d/2026-09-08-base-provenance-stock.md`
+- `[2026-09-08]` **Miranda = operator's chief of staff, may relay his directives** — added to user-level `~/.claude/CLAUDE.md` (dotfiles `7134a22`) as the named exception to the no-relayed-auth rule (unidentified peer relays still excluded); material-consequence calls she relays stay the operator's own.
+- `[2026-09-08]` **Fleet fixes shipped** — WhereTF Homepage card + DNS (`4506ef6`); ext-tts LiteLLM alias → `irv-ml1.nh3.internal` (DB `/model/update` + `extra_hosts`, `957c8f1`); the 09-06 irv-ml1 stale-IP trail repointed across 25 composes + services.yaml + ssh-target → DNS name (`e0d1c44`); Homepage `/api/services` outage fixed — ana-ml2 discovery via a socat proxy on ana-docker (`stacks/ana-ml2-proxy`, `913d2d2`, reversible).
 - `[2026-09-07]` **Fleet internal TLS pattern shipped** — caddy (cloudflare-plugin build, `~/.local/bin/caddy-cf`, `fleet-tls-caddy.service`) on nh3-dev is the wildcard cert authority: publicly-trusted LE `*.nh3.phasefinal.com` via Cloudflare DNS-01, resolved internally by an AdGuard split-horizon rewrite (all 3 resolvers). `talk` self-terminates on :8092 with the trusted cert (operator's in-container-TLS ruling), renewal auto-synced by `fleet-tls-cert-check.timer`. Interstitial gone; secure-context+AudioWorklet verified via headless Chromium. Pattern + foot-guns (restart-disrupts-inflight → clients need retry; wildcard = name-only, never IP) → auto-memory `reference_fleet_internal_tls_pattern`.
 - `[2026-09-07]` **cc-channel registered for this infra-ops session's wake** — `althing-route` cc route → the CC session's `$XDG_RUNTIME_DIR/cc-socks/<pid>.sock`; herald pokes the socket directly at a turn boundary. Replaces the FIFO/poll waiter that Claude Code 2.1.257 kept killing while the seat sat in `shell`. Session-local — re-declare per session.
 - `[2026-09-07]` **irv-ml1 /mnt/smithy remount fixed post-cutover** — export allowed `10.0.0.0/8` (old wg0) but not the mesh `100.64.0.0/10` irv-ml1 now sources from → all-uid "permission denied"; added the mesh range to the nh3-nas smithy export + remounted (clientaddr now 100.64.0.6). nh3-nas admin = `infra-ops` PASSWORD auth (vault `nh3-nas/infra-ops-password`), sudo ALL, SFTP subsystem OFF. → auto-memory `reference_irv_ml1_gpu_r14` (corrected).