ops(u13,fv-ml1): E2 in progress — nh3-dev app units, terminal origin via seat-host; fv-ml1 serial console + SOL logger staged

- configs/svos-apps/nh3-dev/: user units for svos-terminal (running),
  svos-postoffice, svos-miranda, svos-agent (installed, not yet started).
- configs/svos-front/Caddyfile: svos-terminal.phasefinal.com upstreams to
  https://svos-seathost.nh3.phasefinal.com now that app-terminal runs on nh3-dev.
- configs/fv-ml1-sol/: an nh3-dev user unit holding fv-ml1's BMC SOL session
  into the journal; fv-ml1's kernel console goes to ttyS1 (the SOL port,
  marker-tested) from its next boot (ZFSBootMenu commandline on zroot/ROOT).

configs/fv-ml1-sol/fv-ml1-sol-logger.service

@@ -0,0 +1,22 @@
+# eshpfi configs/fv-ml1-sol/ (infra-ops, 2026-10-11, Prime: "stage the evidence capture"): a USER unit of lkraven on
+# nh3-dev that holds fv-ml1's BMC Serial-over-LAN session and writes everything to the journal
+# (`journalctl --user -u fv-ml1-sol-logger`). fv-ml1's kernel prints to ttyS1 = the SOL port (marker-tested) from its
+# next boot (ZFSBootMenu `org.zfsbootmenu:commandline` on zroot/ROOT: `console=ttyS1,115200n8 console=tty0`), so a
+# hang's last kernel lines land here. SOL is live-only (the BMC keeps no history), which is why something must hold it.
+# A human who needs SOL wins: `ipmitool ... sol deactivate` kicks this session, and it retries every 60 s without
+# deactivating anyone (no ExecStartPre deactivate on purpose). Password: ~/.config/fv-ml1-sol/bmc.env (0600,
+# IPMI_PASSWORD, vault ana-ml2/bmc-infra-ops), never on a command line.
+[Unit]
+Description=fv-ml1 serial console logger (BMC SOL -> journal)
+After=network-online.target
+[Service]
+Type=simple
+EnvironmentFile=%h/.config/fv-ml1-sol/bmc.env
+ExecStart=/bin/sh -c 'sleep infinity | exec /usr/bin/ipmitool -I lanplus -H 10.251.250.50 -U infra-ops -E sol activate usesolkeepalive'
+StandardOutput=journal
+StandardError=journal
+SyslogIdentifier=fv-ml1-sol
+Restart=always
+RestartSec=60
+[Install]
+WantedBy=default.target

configs/svos-apps/nh3-dev/svos-agent.service

@@ -0,0 +1,22 @@
+# eshpfi configs/svos-apps/nh3-dev/ (infra-ops, U13 2026-10-11): Miranda's agent connector (persona miranda), loopback
+# only; the gateway's svos plugin calls it at connector_url http://127.0.0.1:8407 with the shared Bifrost key.
+# FIRST start only: /etc/svos/env/agent-enroll.env carries SVOS_AGENT_ENROLL_SECRET; the connector enrolls, writes
+# /etc/svos/miranda/agent.credential (0600) and refuses to start while both exist, so delete the enroll file after.
+[Unit]
+Description=SVOS agent connector for Miranda (svos-agent)
+[Service]
+Type=simple
+UMask=0077
+Restart=on-failure
+RestartSec=3
+TimeoutStopSec=20
+WorkingDirectory=/etc/svos/miranda
+EnvironmentFile=-/etc/svos/env/agent-enroll.env
+Environment=SVOS_AGENT_CONFIG=/etc/svos/miranda/agent.toml
+Environment=SVOS_AGENT_LISTEN=127.0.0.1:8407
+Environment=SVOS_KERNEL_URL=https://svos-kernel.phasefinal.com
+Environment=SVOS_BIFROST_KEY_FILE=/etc/svos/miranda/bifrost.key
+Environment=SVOS_AGENT_CREDENTIAL_FILE=/etc/svos/miranda/agent.credential
+ExecStart=/opt/svos/current/apps-env/bin/svos-agent
+[Install]
+WantedBy=default.target

configs/svos-apps/nh3-dev/svos-miranda.service

@@ -0,0 +1,21 @@
+# eshpfi configs/svos-apps/nh3-dev/ (infra-ops, U13 2026-10-11): app-miranda beside the Hermes gateway it calls on
+# loopback (:8765). Reached by the kernel through https://svos-miranda.nh3.phasefinal.com (fleet Caddy -> :8408).
+# Credential /etc/svos/env/miranda.env (vault nh3-svos/svos-miranda-credential, from enrolling app-miranda).
+[Unit]
+Description=SVOS Miranda (app-miranda, U9a/U11)
+ConditionPathExists=/etc/svos/env/miranda.env
+[Service]
+Type=simple
+UMask=0077
+Restart=on-failure
+RestartSec=3
+TimeoutStopSec=20
+WorkingDirectory=/var/lib/svos/apps/miranda
+EnvironmentFile=/etc/svos/env/miranda.env
+Environment=SVOS_MIRANDA_CONFIG=/etc/svos/miranda/miranda.toml
+Environment=SVOS_DATA_ROOT=/var/lib/svos/apps/miranda
+Environment=SVOS_APP_LISTEN=127.0.0.1:8408
+Environment=SVOS_KERNEL_URL=https://svos-kernel.phasefinal.com
+ExecStart=/opt/svos/current/apps-env/bin/svos-miranda
+[Install]
+WantedBy=default.target

configs/svos-apps/nh3-dev/svos-postoffice.service

@@ -0,0 +1,21 @@
+# eshpfi configs/svos-apps/nh3-dev/ (infra-ops, U13 2026-10-11): the althing bridge (app-postoffice) as lkraven, the
+# herald's user, because it owns the miranda handle's box-local push route. The kernel calls it over plain LAN HTTP.
+# Config /var/lib/svos/config/apps/postoffice.toml; credential /etc/svos/env/postoffice.env (vault nh3-svos/svos-postoffice-credential).
+[Unit]
+Description=SVOS Post office bridge (app-postoffice, U9a)
+ConditionPathExists=/etc/svos/env/postoffice.env
+[Service]
+Type=simple
+UMask=0077
+Restart=on-failure
+RestartSec=3
+TimeoutStopSec=20
+WorkingDirectory=/var/lib/svos
+EnvironmentFile=/etc/svos/env/postoffice.env
+Environment=SVOS_KERNEL_URL=https://svos-kernel.phasefinal.com
+Environment=SVOS_DATA_ROOT=/var/lib/svos
+Environment=SVOS_APP_LISTEN=10.100.10.50:8406
+Environment=ALTHING_POST_OFFICE=http://10.100.50.40:8390
+ExecStart=/opt/svos/current/apps-env/bin/svos-postoffice
+[Install]
+WantedBy=default.target

configs/svos-apps/nh3-dev/svos-terminal.service

@@ -0,0 +1,21 @@
+# eshpfi configs/svos-apps/nh3-dev/ (infra-ops, U13 2026-10-11): app-terminal as a USER unit of lkraven on nh3-dev.
+# It must be a user unit: its seat launcher runs `systemctl --user start zellij-fleet@Claude` and never parents the
+# zellij server. The kernel reaches it through https://svos-seathost.nh3.phasefinal.com (fleet Caddy -> :8404).
+# Config /var/lib/svos/config/apps/terminal.toml; credential /etc/svos/env/terminal.env (vault nh3-svos/svos-terminal-credential).
+[Unit]
+Description=SVOS Terminal connector + seat host (app-terminal, U8/U5b)
+ConditionPathExists=/etc/svos/env/terminal.env
+[Service]
+Type=simple
+UMask=0077
+Restart=on-failure
+RestartSec=3
+TimeoutStopSec=20
+WorkingDirectory=/var/lib/svos
+EnvironmentFile=/etc/svos/env/terminal.env
+Environment=SVOS_KERNEL_URL=https://svos-kernel.phasefinal.com
+Environment=SVOS_DATA_ROOT=/var/lib/svos
+Environment=SVOS_APP_LISTEN=127.0.0.1:8404
+ExecStart=/opt/svos/current/apps-env/bin/svos-terminal
+[Install]
+WantedBy=default.target

configs/svos-front/Caddyfile

@@ -138,8 +138,12 @@ https://svos.phasefinal.com:443 {
 #   it passes through unmodified. /terminal/stream is a long-lived ndjson stream: no buffering (flush_interval -1)
 #   and no write/idle deadline (none is set anywhere in this file). Same 1 MiB body cap.
 # - Mesh-only like the main site: headscale MagicDNS extra record -> 100.64.0.9; nh3-svos resolves it via /etc/hosts.
+# U13 (2026-10-11): app-terminal now runs on nh3-dev, loopback-only. This origin reaches it through nh3-dev's seat-host
+# origin (fleet Caddy, allowlisted to this box's 10.100.50.43); Host must be the upstream's name or the fleet Caddy's
+# host matcher misses it. The old upstream was 127.0.0.1:8404 here.
 (svos_terminal_upstream) {
-	reverse_proxy 127.0.0.1:8404 {
+	reverse_proxy https://svos-seathost.nh3.phasefinal.com {
+		header_up Host {upstream_hostport}
 		flush_interval -1
 	}
 }