esh-pfi-infrastructure/persistent-memory.d/2026-10-11-u13-cutover-executed.md

2026-10-11-u13-cutover-executed

[2026-10-11] Prime 0721: stage fv-ml1 evidence capture; run U13; Mac keys on vh stay full access; delete stale snapshots. Done: fv-ml1 ZFSBootMenu cmdline quiet console=ttyS1,115200n8 console=tty0 (SOL = ttyS1, marker-tested; next boot) + nh3-dev user unit fv-ml1-sol-logger holding SOL into the journal (marker verified); ERST pstore was already registered, so the 10-11 hang was not a kernel panic. esh-nas-pve pre-upgrade-20260818 and subvol-105@pre-vaapi-20260911 destroyed (2.5 GB). U13 E1 (highseat-dev 0733) and E2 steps 1–6 done 0734–0816: reload A a439431771dd013e, kernel env (Matrix token + relay credential, kernel restarted), terminal on nh3-dev (Prime approved 0.0.3 at 0813 after the first card's 15-min TTL lapsed), reload B 44be73a252d85fbb (13 seats adopted), miranda + agent up, Hermes swapped to svos (gateway restart 0814:58), bridge on nh3-dev (Prime approved 0.0.2 ~0816; miranda handle push). Open: Prime raises + approves the bridge's 3 runtime grants (owner-only, svos-dev's console snippet), then acceptance (bus test; URGENT page test on his word). ⚠ A local-transcript slip printed the High Seat's Bifrost dispatch key (leaving use with U13).

The edit, step by step (2026-10-11, PT)

• 0721 go (Prime, "run u13"). His charter review (B8) is treated as covered by the go (highseat-dev agreed: nothing in the edit depends on it).
• E0/E1 (highseat-dev): zero pending cards; svos 987746d deletes the High Seat's miranda: AND hermes: blocks (the config parses miranda whenever hermes is on); restart 0733:00, board back 0734:43; journal matrix inbound DISABLED 0734:41, app-high-seat REGISTERED rev 5c466c9f1f0c (pinned directly, no card); miranda handle → pull.
• E2.1 reload A (scratchpad u13-reload-A.yaml shape: back up instance.toml.pre-u13-A, two exact base_url swaps asserted once each, append the payload's additions with the three enrollment sha256s filled from the vault, check-config, restore the backup on refusal, systemctl reload): 1bd948c754e571da → a439431771dd013e.
• Enrollments over svos-kernel.phasefinal.com (POST /auth/enroll, Authorization: Bearer sve_… → {"credential":"svc_…"}): app-miranda → vault nh3-svos/svos-miranda-credential → /etc/svos/env/miranda.env; persona matrix-relay → vault nh3-svos/matrix-relay-credential. ⚠ The kernel reads SVOS_MATRIX_TOKEN / SVOS_RELAY_CREDENTIAL only at START: /etc/svos/kernel.env (root 0600; there was none before) needed a kernel RESTART (~0738), which the payload did not place. svos-dev confirmed the Matrix transport live from 0734:48 (it logs only failures).
• E2.2 terminal: nh3-svos unit stopped + disabled, hold drop-in removed; /var/lib/svos/apps/terminal copied by sudo tar | tar -xpf (tar is exempt from sudo-io log_output), byte-identical. svos-terminal 0.0.3 as an lkraven USER unit. ⚠ Manifest cards expire after 15 min: the first lapsed at 0753 unapproved and the kernel discarded that revision; svos-dev re-raised by restarting the user unit (0811); Prime approved rev 3 at 0813. The browser origin svos-terminal.phasefinal.com now upstreams to https://svos-seathost.nh3.phasefinal.com with header_up Host {upstream_hostport} (the payload omitted this; without it the pane breaks).
• E2.3 reload B: a439431771dd013e → 44be73a252d85fbb; /seats complete, profiles configured, 13 seats adopted live (dev-* ×12 + ops-infra).
• E2.4: svos-miranda + svos-agent user units; the agent enrolled on first start from /etc/svos/env/agent-enroll.env (then deleted; it refuses to start with both) and wrote /etc/svos/miranda/agent.credential. app-miranda registered + pinned directly (0.0.3, up). Spent enrollment secrets removed from the vault.
• E2.5 Hermes swap (scratchpad u13-hermes-swap.py: two svos_miranda list items → svos, an entries.svos.settings block, top-level tools.tool_search.enabled: "off", YAML asserted, backup config.yaml.pre-u13); systemctl --user restart hermes-gateway 08:14:58; svos-agent logged handshake session=hermes-nh3-dev tools=23.
• E2.6 bridge: nh3-svos postoffice stopped/disabled, hold drop-in removed; /var/lib/svos/apps/postoffice (journal + wal/shm, mail, provider) copied byte-identical; svos-postoffice on nh3-dev 10.100.10.50:8406, push route miranda: live, postbox --handle miranda status → push/reachable. Prime approved 0.0.2 (~0816). The three bridge runtime grants are owner-only (kernel/grant is a human principal over the front door): Prime raised them with svos-dev's browser-console snippet and approved (three /verbs/kernel/grant 202 + three card decisions, before 1350).
• Acceptance (1350): URGENT mail from infra-ops → bridge ingested and dispatched (200) → svos reply on the thread at 1350:54 saying the page fired (text, then speech, per the connector receipt). Miranda's explicit reply to infra-ops is held on card 05cf119e…, because the payload grants miranda → app:app-postoffice write WITHOUT autonomous. Two observations to svos-dev (thread 01M4NNGCM3X75DANGXQEQ1EQGX): the text on the thread reads as written to Prime; is every bus reply meant to need Prime's approval? Health 1416: up 6, degraded 1 (the terminal; reason not surfaced), down 0.

Gotchas paid for during the edit

• nh3-dev's fleet Caddy shared admin localhost:2019 with ttyd-caddy through SO_REUSEPORT, so reload landed on either process; it now uses admin localhost:2021 (see servers/nh3-dev/README.md).
• A caddy validate of a file under a 0700 staging dir fails "permission denied" as user caddy; a | tail hid it once. Validate from /etc/caddy/Caddyfile.check and check the exit code (positive-controlled with a bogus directive → rc 1).
• secret (Vaultwarden via bw) calls are serialized and can take minutes each when another session is reading the vault; run them in the background.
• Printing ~/.hermes/config.yaml sections exposed the High Seat's Bifrost dispatch key in the local transcript; Prime ruled no rotation (10-11) since the key leaves use with U13.