memory: SVOS arc closed at step 8; fork vh/remote-ssh-mcp recorded

Step 8 executed on the operator's direct authorization with preconditions
checked before firing and the post-state read back rather than inferred. The
rollback window is closed and the arc is finished except the handle rename.

Records the remote-ssh-mcp fork and, more usefully, why it was chosen over the
far more popular alternative: it never handles key material, delegating to the
system OpenSSH client, and its dependency surface is two packages. Also records
that its denylist is four bypassable regexes and must not be counted as
security — the host allowlist is the real boundary — plus the two things to
settle before the tool is used in anger.

persistent-memory.md

@@ -245,6 +245,17 @@ below is a live commitment or a known-open risk._
   rewritten their runbook so that deletion is conditional on my confirmation
   rather than scheduled after step 8.
 
+- **SVOS ARC CLOSED — step 8 done 2026-09-05T14:28:15Z** on the operator's direct
+  authorization in my own channel (never the relay). `DELETE /admin/keys/b38932f5`
+  → 200; preconditions checked BEFORE firing (svos had a live key, ledger existed
+  and was not already revoked) and the post-state read back from `/admin/keys`
+  rather than inferred from the 200: `ledger` disabled=True, `svos` untouched,
+  deployment `/health` 200. **The rollback window is closed** — re-defining
+  `ledger:miranda` is no longer possible. ledger-dev clears the staged
+  `worldtree-api-key-ledger-legacy` vault item on this confirmation. Remaining on
+  the arc: only the `ledger-dev` → `svos-dev` handle, which is the operator's at
+  the post office.
+
 - **Original constraints on that mint** (recorded because the deletion ordering is
   a permanent trap, not a one-time step): string
   `svos` verbatim (WT tier 3 admits only `^[a-z][a-z0-9-]{2,63}$`, INV-181-15);
@@ -265,6 +276,25 @@ below is a live commitment or a known-open risk._
 - **Neither Mac nor the Studio is in `servers/` or `dns/internal.yaml`** — deliberate;
   they are the operator's personal machines. A choice to revisit, not an oversight.
 
+- **`vh/remote-ssh-mcp` forked 2026-09-05 (repo id 117, private, full 51-commit
+  history)** — our copy of `the-nine-nation/remote-ssh-mcp` (MIT), an SSH MCP
+  server chosen over the 693★ `tufantunc/ssh-mcp` on trust-surface grounds: **two
+  npm deps** (`@modelcontextprotocol/server`, `zod`), 183 KB, and it **never
+  touches key material** — it shells out to the system OpenSSH client, so
+  `~/.ssh/config`, ControlMaster, ProxyJump and `infra-ops_ed25519` all just work.
+  Shape: 2349 LOC across 11 source files, 811 LOC of tests including fake-ssh hang
+  harnesses. Complements `elway` rather than replacing it — no file transfer, no
+  idempotency; it takes ad-hoc reconnaissance with persistent cwd/env sessions,
+  elway keeps deploys and uploads. ⚠ **The denylist is NOT security**: four regexes
+  (`rm -rf /`, shutdown/reboot/poweroff/halt, mkfs, iptables -F) trivially bypassed
+  by `bash -c`, variables or base64 — the author says so. **The real containment
+  boundary is the host allowlist**, drawn from exact `Host` aliases in ssh_config
+  with wildcards deliberately ignored. Two things to settle before use: the
+  reboot/shutdown denial will block legitimate infra-ops work, and
+  `.github/workflows/star-history.yml` is upstream chore CI sitting in a repo where
+  `has_actions=True`. Left the fork pristine (no commits) so it still diffs cleanly
+  against upstream.
+
 ## Recent decisions
 
 - `[2026-09-05]` **A peer's "2.7x serving-stack effect" was a coin flip — the operator rejected it on instinct and the arithmetic backed him.** Each floor was `|b0-b1|` from n=2; the ratio is half-Cauchy, P=0.452. ⚠ The disconfirming evidence sat in brokkr's own sentence, and he named *why*: the claim was his and flattering. → `persistent-memory.d/2026-09-05-floor-claim-n2-retraction.md`