vh
cd941f7bf9
Pre-clear snapshot. Rewrote Current state / in-flight to the post-rebalance topology (cyberprev is the sec seat, gen-small stood up, char/coder retuned, all generative seats native 262K in-band, catalog+bench shipped) and added a Recent decisions index entry + detail file 2026-09-14-fv-seat-rebalance-gen-small.md. Also commits two previously-untracked durable artifacts (fv-to-ana-nat runbook + its memory detail) so memory does not lag the work. Archival: file is over the ~300-line soft cap (377) but 0 entries archived — the 4 age-eligible (>14d) entries all carry open deferred-work pointers (guarded), and all other entries are <14 days old. Reported per the archival discipline.
940 B
FV→ANA NAT repaired safely
Operator approved narrow fix, caution not to strand subnet. OPNsense MESH/opt6 (tailscale0 100.64.0.8) lacked outbound NAT for forwarded LAN traffic. Temporary fv-ml1→hub /32 NAT proved diagnosis; persisted hybrid NAT rule source 10.251.50.54/32 destination 10.250.0.0/16 translate interface address. Existing WAN NAT retained, filter rules byte-identical, no routes/mesh/host changes. Both stages guarded by independent rollback timers, disarmed after verification.
Verified hub HTTP200, ANA PostgreSQL TCP, Internet HTTPS200, reverse SSH, gateway management; Beszel18/18 up. Agent intentionally stops SSH45876 when WebSocket connects. BMC ping failed with no pre-change baseline; no BMC-health claim. Other FV sources and other remote subnets not covered by this narrow fix. Backup + rollback helper on gateway /root/fv-nat-repair-20260913. Full details: docs/runbooks/fv-to-ana-nat.md. No commit made.