diff --git a/0060/SESSION-0060.0-TRANSCRIPT-2026-06-01T06-30--2026-06-01T10-03.md b/0060/SESSION-0060.0-TRANSCRIPT-2026-06-01T06-30--2026-06-01T10-16.md
similarity index 81%
rename from 0060/SESSION-0060.0-TRANSCRIPT-2026-06-01T06-30--2026-06-01T10-03.md
rename to 0060/SESSION-0060.0-TRANSCRIPT-2026-06-01T06-30--2026-06-01T10-16.md
index 0e9e31d..6e35ddc 100644
--- a/0060/SESSION-0060.0-TRANSCRIPT-2026-06-01T06-30--2026-06-01T10-03.md
+++ b/0060/SESSION-0060.0-TRANSCRIPT-2026-06-01T06-30--2026-06-01T10-16.md
@@ -262,35 +262,63 @@ republished.
 
 ---
 
+## Session close
+
+Stopped here at the operator's call — Slice 2 shipped + merged across three
+repos, the OHM shim merged + dep-pinned (Arc 12), and `flotilla-core` tagged
+`v0.3.0`. **Done this session:** Slice 2 (engineering #3, flotilla-core #1), the
+shim merge (former follow-up #c), and the dep pin to v0.3.0 (part of #b). No live
+OHM deploy. The next-session launch prompt below is the closing handoff.
+
 ## Next-session prompt
 
-> **State (after Slice 2, 2026-06-01):** launch-app SPEC is **v0.0.2**;
-> `define-deployment` (§6.6) + `scaffold-gcp-project` (§6.5) skills exist;
-> `flotilla-core` is **v0.3.0** on `wiggleverse/flotilla-core` `main`
-> (private repo now created) with `deployment scaffold|validate|import` +
-> `gcloud.describe_config`, tagged **`v0.3.0`**, sitting atop the merged
-> preview-environments line. `ohm-rfc-app-flotilla` `main` is now the **thin
-> shim** (v1.8.0) pinned to `flotilla-core>=0.3.0`. wiggle-snip has a validated
-> `deployment.toml`.
->
-> **Next: Slice 3 — `provision-vm` + `scaffold-gitea-repos`** (SPEC §2, §6.7,
-> §6.8). `provision-vm` gates on `deployment validate` (§4.2) — built + proven.
-> wiggle-snip needs its GCP foundation first (`scaffold-gcp-project`), which
-> clears the one dogfood WARN.
->
-> **Open follow-ups:** (a) install/symlink the launch-app suite skills for
-> invocation; (b) **CI installability of the private `flotilla-core`** — the
-> shim's `pip install -e .[test]` can't fetch a private, index-less dep without
-> SSH/token wiring (deploys run from the laptop, so this is a CI gap, not a
-> deploy blocker); (b2) add `flotilla-core` to the Patchwatch runner build
-> context before its next rebuild; (c) Slice-5 backlog: `scaffold` emits an
-> unused `APP_URL` overlay key by default. **Done this session:** the shim merge
-> (former #c) and the dep pin to v0.3.0 (part of former #b).
->
-> **Coordination:** a parallel preview-environments line shares `flotilla-core`.
-> Work each line in its own **worktree**; never run mutating git in the shared
-> main checkout while it's active. Both lines touch `cli.py` (additive command
-> groups) — expect trivial conflicts only.
->
-> **Scope guard:** pre-prod only, single environment. Slots / ramp / canary /
-> rollback are guide §10, out of scope (SPEC §10).
+```
+# launch-app Slice 3 — provision-vm + scaffold-gitea-repos (SPEC §2, §6.7, §6.8)
+
+## State (after Slice 2 / session 0060, 2026-06-01)
+- launch-app SPEC is v0.0.2; ROADMAP Slice 2 closed.
+- Skills exist: scaffold-gcp-project (§6.5), define-deployment (§6.6,
+  ~/projects/wiggleverse/engineering/launch-app/skills/define-deployment/).
+- flotilla-core v0.3.0 on wiggleverse/flotilla-core main (private, tagged
+  v0.3.0): deployment scaffold|validate|import + gcloud.describe_config, 371
+  tests green. It sits ATOP a parallel preview-environments line (still active).
+- ohm-rfc-app-flotilla main is the v1.8.0 thin shim, dep pinned flotilla-core>=0.3.0.
+- wiggle-snip (~/projects/wiggleverse/wiggle-snip, NOT a git repo) has a
+  validated deployment.toml. The §5.3 `validate` gate is built + proven.
+
+## Read first
+- SPEC: ~/projects/wiggleverse/engineering/launch-app/SPEC.md (§2 topology, §6.7
+  provision-vm, §6.8 scaffold-gitea-repos)
+- ROADMAP: same dir, Slice 3
+- Session 0060 transcript (wiggleverse/ohm-session-history, 0060/) for context.
+
+## Task
+1. wiggle-snip has no GCP foundation yet — run scaffold-gcp-project for it FIRST
+   (clears the one dogfood WARN and gives provision-vm a project to target).
+2. Build `provision-vm` (§6.7): create the micro VM (IAP-only, no public :22),
+   install the runtime (Python, Node, nginx, systemd unit), TLS via Cloudflare.
+   Idempotent / re-runnable. It gates on `flotilla-core deployment validate`.
+3. Build `scaffold-gitea-repos` (§6.8): the repo set + bot user/token; record
+   whether pre-prod uses its own Gitea or shares.
+4. Proof: a fresh micro VM comes up, /api/health reachable through nginx after a
+   hand-run deploy, re-running the skill is a no-op.
+
+## Constraints
+- Scope: pre-prod, single environment. NO slots/ramp/promote/rollback (guide §10).
+- Hard secrets rule (SPEC §8.3): stdin-piped `secret set` gestures only; NEVER
+  ask for secret bytes.
+- gcloud isolation: pin CLOUDSDK_ACTIVE_CONFIG_NAME per-process; never touch the
+  shared on-disk active-config pointer.
+- A parallel preview-environments line shares flotilla-core — if you touch that
+  repo, use an isolated git worktree; never run mutating git in a checkout the
+  parallel session holds.
+- Spec-driven; cite section numbers in commits; branch + PR (Gitea, no gh CLI).
+
+## Open follow-ups (pick up if relevant, not blocking)
+- CI installability of the private flotilla-core for the shim's runner
+  (SSH/token wiring or a package index).
+- Add flotilla-core to the Patchwatch runner build context before its rebuild.
+- Install/symlink the launch-app skills so they're invocable.
+- Slice-5 backlog: define-deployment's scaffold emits an unused APP_URL overlay
+  key by default — make derived-but-optional overlay keys a choice.
+```