update 0032/SESSION-0032.0-TRANSCRIPT-2026-05-28T18-52--2026-05-28T19-13.md

0032/SESSION-0032.0-TRANSCRIPT-2026-05-28T18-52--2026-05-28T19-13.md

@@ -6,6 +6,12 @@
 > (audit-0026 L5/L9) and ship flotilla v1.2.0 — plus the minor leftovers
 > (audit I3/I4 as rfc-app v0.28.0, and the orphaned VM db files).
 >
+> Post-publish addendum: the operator merged **PR #2** (rfc-app v0.28.0)
+> immediately after this transcript first published — merge commit
+> `019c8a9` on `main`. It is **not yet tagged or deployed**; OHM still runs
+> v0.27.0 until the operator tags `v0.28.0`, deploys, and bumps the pin.
+> The cut-state, ledger, and operator-plate below are updated to match.
+>
 > Outcome: **All four tasks landed. OHM SSH is now IAP-only (L5 closed,
 > L9 residue retired); the VM was re-verified healthy end-to-end through
 > flotilla's own SSH path. flotilla v1.2.0 was found already merged +
@@ -169,7 +175,7 @@ git credential (never printed). Removed the worktree.
 | | |
 | --- | --- |
 | flotilla | `main`/`origin/main` = `ef34ffe`, tag `v1.2.0` (merged+tagged by session 0031; re-verified here, 184 tests). No change this session. |
-| rfc-app | `main` = `fe044ed` (v0.27.0). Branch `feature/v0.28.0-email-turnstile-async` = `79a447c` pushed; **PR #2 open** (awaiting operator merge+tag+deploy). |
+| rfc-app | **PR #2 merged** by the operator post-publish → `main` = `019c8a9` (v0.28.0 code, VERSION=0.28.0). **Not yet tagged/deployed** — `v0.28.0` tag + `flotilla deploy` + pin bump remain operator gestures. |
 | OHM live | `deploys` unchanged, **HTTP 200 v0.27.0 status=ok** before and after all infra changes. |
 | ohm-rfc pin | `0.27.0` (unchanged; bumps to 0.28.0 only after the operator deploys PR #2). |
 | GCP firewall | `default-allow-ssh` **deleted**; `allow-iap-ssh` (35.235.240.0/20→tcp:22) added. SSH is IAP-only. |
@@ -181,7 +187,7 @@ git credential (never printed). Removed the worktree.
 | --- | --- |
 | Task 1 — IAP SSH hardening (L5 + L9) | ✅ shipped + re-verified |
 | Task 2 — flotilla v1.2.0 | ✅ (shipped by 0031; independently re-verified) |
-| Task 3 — rfc-app v0.28.0 (I3 + I4) | 🟡 PR #2 open — operator merges + tags + deploys |
+| Task 3 — rfc-app v0.28.0 (I3 + I4) | ✅ PR #2 **merged** (019c8a9) post-publish; 🟡 tag + deploy + pin bump remain operator gestures |
 | Task 4 — orphaned VM db files | ✅ deleted |
 
 ---
@@ -205,8 +211,8 @@ git credential (never printed). Removed the worktree.
 
 ## What lands on the operator's plate
 
-1. **Merge + tag + deploy rfc-app v0.28.0** — review PR #2
+1. **Tag + deploy rfc-app v0.28.0** — PR #2 is already **merged** to
-   (`ben.stull/rfc-app/pulls/2`), merge, `git tag v0.28.0`, then
+   `main` (`019c8a9`). Remaining: `git tag v0.28.0`, then
    `flotilla deploy ohm-rfc-app` (now over IAP) and bump
    `ohm-rfc/.rfc-app-version` to `0.28.0`. No migration/secret/overlay
    change; plain code deploy.
@@ -237,9 +243,10 @@ State as of session 0032 (2026-05-28):
 
 Open item:
 - rfc-app v0.28.0 (audit-0026 I3 dead-HTML-email guard + I4 async Turnstile
-  siteverify) is PR #2 (ben.stull/rfc-app/pulls/2), backend suite 365 green,
+  siteverify) — PR #2 is MERGED to main (019c8a9), backend suite 365 green,
-  no-op upgrade. If not yet merged: review + merge + `git tag v0.28.0` +
+  no-op upgrade, but NOT yet tagged/deployed. Remaining: `git tag v0.28.0`
-  `flotilla deploy ohm-rfc-app` + bump ohm-rfc/.rfc-app-version to 0.28.0.
+  + `flotilla deploy ohm-rfc-app` + bump ohm-rfc/.rfc-app-version to 0.28.0.
+  (Skip if the operator already did this between sessions — check the pin.)
 
 Then pick up the ROADMAP (~/git/ohm-rfc/ROADMAP.md) — the audit-0026
 Critical/High/Medium remediations already shipped in v0.27.0; remaining