memory: snapshot — fv-ml1 rebalance (cyberprev→sec, gen-small A3B, all seats native 262K)

Pre-clear snapshot. Rewrote Current state / in-flight to the post-rebalance topology
(cyberprev is the sec seat, gen-small stood up, char/coder retuned, all generative
seats native 262K in-band, catalog+bench shipped) and added a Recent decisions index
entry + detail file 2026-09-14-fv-seat-rebalance-gen-small.md.

Also commits two previously-untracked durable artifacts (fv-to-ana-nat runbook + its
memory detail) so memory does not lag the work.

Archival: file is over the ~300-line soft cap (377) but 0 entries archived — the 4
age-eligible (>14d) entries all carry open deferred-work pointers (guarded), and all
other entries are <14 days old. Reported per the archival discipline.

persistent-memory.d/2026-09-13-fv-to-ana-nat.md

@@ -0,0 +1,15 @@
+# FV→ANA NAT repaired safely
+
+Operator approved narrow fix, caution not to strand subnet. OPNsense MESH/opt6
+(tailscale0 100.64.0.8) lacked outbound NAT for forwarded LAN traffic. Temporary
+fv-ml1→hub /32 NAT proved diagnosis; persisted hybrid NAT rule source
+10.251.50.54/32 destination 10.250.0.0/16 translate interface address. Existing
+WAN NAT retained, filter rules byte-identical, no routes/mesh/host changes.
+Both stages guarded by independent rollback timers, disarmed after verification.
+
+Verified hub HTTP200, ANA PostgreSQL TCP, Internet HTTPS200, reverse SSH, gateway
+management; Beszel18/18 up. Agent intentionally stops SSH45876 when WebSocket
+connects. BMC ping failed with no pre-change baseline; no BMC-health claim.
+Other FV sources and other remote subnets not covered by this narrow fix.
+Backup + rollback helper on gateway /root/fv-nat-repair-20260913. Full details:
+docs/runbooks/fv-to-ana-nat.md. No commit made.