update engineering/0016/SESSION-0016.0-TRANSCRIPT-2026-06-10T20-34--INPROGRESS.md

engineering/0016/SESSION-0016.0-TRANSCRIPT-2026-06-10T20-34--INPROGRESS.md

@@ -41,8 +41,42 @@ unblock (spec §7.2 SLICE-1, risk R-1). Procedure is canonical in
 Session runs isolated in worktree `gitea-vm-scope-window` (live concurrent
 SESSION-0009 in flight).
 
+## Execution record (checkpoint, ~20:50 PST)
+
+The maintenance window ran and verified clean (spec §7.2 SLICE-1, D-3, §13 Q1):
+
+- **Pre-state** (Compute API): VM RUNNING, SA
+  `1061347810527-compute@developer.gserviceaccount.com`, legacy default scopes
+  incl. `devstorage.read_only`.
+- **Auth detour:** the `gitea` gcloud config's CLI token had expired
+  (interactive reauth required). ADC was still valid, so the read-only
+  pre-check ran via the Compute REST API (project explicit in URL — §8.4
+  satisfied, no config pointer touched). Operator then ran
+  `gcloud auth login`; the window itself used the documented CLI commands.
+- **Window:** `stop` → `set-service-account --scopes=cloud-platform` →
+  `start` (operator executed the start command directly). ~3 min downtime.
+- **Post-state:** RUNNING, same SA, scopes = `cloud-platform` only.
+- **Forge health:** HTTPS 200 on https://git.wiggleverse.org/ within ~20 s of
+  start; SSH :2222 `git ls-remote` OK.
+- **Write test (the SLICE-1 proof):** on-VM ADC upload to
+  `gs://wiggleverse-gitea-backups/maintenance/scope-fix-write-test.txt` —
+  `gsutil cp` 403s (its existence check needs `objects.list`, which
+  create-only IAM denies — recorded in the runbook as a SLICE-2 note); pure
+  JSON-API `objects.insert` returned HTTP 200. Test object verified then
+  deleted from the laptop (operator creds; VM correctly cannot delete).
+- **DOC-2:** runbook `infra/deploy-gitea-on-gcp.md` updated (PENDING box →
+  build-state record; §1 + cert-rotation notes brought current) — PR #41,
+  merged to main.
+
+SLICE-1 is complete; SLICE-2 (scheduled dump + upload timer) is unblocked.
+
 ## Deferred decisions
 
+- Deleted the write-test object from the bucket with operator laptop
+  credentials rather than leaving it for the 30-day lifecycle — judged
+  trivially safe (artifact created seconds earlier by this session), but it
+  is technically an irreversible delete.
+
 _Autonomous-mode low-confidence calls the driver made and would have
 liked operator input on. Appended as the session runs; surfaced at
 finalize. Empty if none._