add 0046/SESSION-0046.0-TRANSCRIPT-2026-05-30T06-28--2026-05-30T10-29.md + replace placeholder/variant SESSION-0046.0-TRANSCRIPT-2026-05-30T06-28--2026-05-30T06-49.md

0046/SESSION-0046.0-TRANSCRIPT-2026-05-30T06-28--2026-05-30T10-29.md

@@ -13,6 +13,15 @@
 > `e2e/` Tier-1 scaffold authored (PR #4, left OPEN for review). No
 > deploys, no tags, no pin bumps — docs + groundwork only.**
 >
+> Late addendum (post-first-publish): the operator settled four design
+> decisions, recorded (not built — all v1-gated): **#42 auto-rollback =
+> always-on VM-side watcher**; **#37 PPE = completely separate infra**
+> (own micro VM + separate gcloud stack + own Gitea at
+> `ppe.git.wiggleverse.org`, not colocated on prod); **#37 OAuth caveat
+> resolved** (e2e via OTC); **#38 Tier-1 Gitea = stub inner loop, real
+> Gitea for the gate**. Landed in handbook §10.1/§10.5 (eng PR #2) +
+> ROADMAP #37/#42 (ohm-rfc PR #7) + the rfc-app scaffold README.
+>
 > Texture note: this session ran amid the harness-corruption /
 > parallel-execution conditions flagged at launch (the prior advisory
 > "0046" hit Bash/Read garbling). Concretely: ROADMAP commits appeared
@@ -145,15 +154,44 @@ Updated `project_engineering_handbook.md` memory (repo exists/canonical;
 §10.3 = two-tier; open items refreshed). Surfaced the open decisions
 (below). Wrote + published this transcript.
 
+### Arc 6 — operator design decisions (post-first-publish)
+
+After the first finalize, the operator engaged the surfaced open
+decisions and settled them. Recorded across the docs (not built — all
+gated on flotilla v1):
+
+1. **#42 auto-rollback → always-on VM-side watcher** (chose option (a)
+   over my (b)-leaning recommendation). A systemd daemon arms on cutover,
+   disarms on promote, trips ONLY the DB-free rollback. Framed as a
+   bounded carve-out from flotilla's laptop-only model. (handbook §10.5 +
+   ROADMAP #42)
+2. **#37 PPE → completely separate infra.** A real architecture pivot off
+   the original "three instances on one VM": PPE gets its own GCP micro
+   instance, its own separate gcloud stack (project + config), and its
+   own Gitea at `ppe.git.wiggleverse.org` colocated on the PPE VM. Only
+   flotilla's code-deploy gesture crosses over. flotilla
+   multi-deployment becomes "2nd record at a different host+project," not
+   a 2nd install dir. (handbook §10.1 reframed + ROADMAP #37 rewritten)
+3. **#37 OAuth caveat → resolved** (e2e logs in via OTC; #5 shipped).
+4. **#38 Tier-1 Gitea → stub for the inner loop, real Gitea for the
+   gate** (Tier 2 = PPE's own real Gitea). (rfc-app scaffold README)
+5. **Open follow-on captured:** self-host prod Gitea on the prod VM too
+   ("we can do that for prod, too") — flagged as its own decision, not
+   committed.
+
+Merges: eng PR #2 (`4259df3`), ohm-rfc PR #7 (`f2a661f`), rfc-app PR #4
+updated (`a3f48ba`). The Gitea merge-queue had recovered by this arc
+(all three merged HTTP 200 cleanly). Memory updated.
+
 ---
 
 ## Cut state (end of session)
 
 | repo | state |
 | --- | --- |
-| engineering | `main` @ `4bab7a0` (PR #1 merge of `1f3c8e7`) — §10.3 two-tier testing + §10.6 touch-up |
-| ohm-rfc | `main` @ `5760b5d` (PR #5 merge of `30326e3`, atop PR #4 `2e403dd`) — full two-tier #38 (table+narrative) + #40 (narrative+row). PR #6 closed (superseded). |
-| rfc-app | branch `session-0046/e2e-tier1-scaffold` @ `a5a66e5`, **PR #4 OPEN** — `e2e/` Tier-1 scaffold. No release. |
+| engineering | `main` @ `4259df3` (PR #1 two-tier §10.3; PR #2 §10.1 PPE-separate-infra + §10.5 always-on watcher) |
+| ohm-rfc | `main` @ `f2a661f` (PR #4+#5 two-tier #38/#40; PR #7 #37 separate-infra + #42 watcher). PR #6 closed (superseded). |
+| rfc-app | branch `session-0046/e2e-tier1-scaffold` @ `a3f48ba`, **PR #4 OPEN** — `e2e/` Tier-1 scaffold + Gitea decision. No release. |
 | OHM live | **untouched** — no deploy this session (docs + groundwork). |
 | ohm-rfc pin | **unchanged** (`.rfc-app-version` not bumped). |
 | memory | `project_engineering_handbook.md` updated. |
@@ -191,23 +229,23 @@ Updated `project_engineering_handbook.md` memory (repo exists/canonical;
 
 ## What lands on the operator's plate
 
-1. **#42 auto-rollback model — GENUINELY OPEN, surfaced not defaulted.**
-   (a) always-on VM-side watcher (relaxes flotilla's laptop-only model for
-   one purpose) vs. (b) bounded bake during the operator's session
-   (10–15 min post-cutover, no daemon). Needed before #42 is built
-   (post-v1, after #41). Handbook §10.5 + ROADMAP #42 both flag it.
-2. **#37 OAuth-per-host caveat — effectively RESOLVED, confirm.** Because
-   #5 email/OTC shipped (v0.7.0), PPE + the e2e suite log in via OTC, so
-   no per-host OAuth app is needed. The scaffold encodes OTC-only auth.
-   Flagging in case you still want an OAuth path tested on PPE.
-3. **v1 timing.** Track Δ's live PPE-on-VM parts are gated on flotilla v1.
-   I stood up **nothing** on the VM (local scaffold only). Confirm v1
-   timing before any VM stand-up for #37.
-4. **rfc-app PR #4 (e2e scaffold)** — review when ready; its README poses
-   the Tier-1 **Gitea-dependency decision** (real disposable Gitea +
-   bootstrap vs. stub the gitea client) that #38 must settle.
-5. **Gitea merge-queue** may be wedged (see §19.2 #1) — a queue/Gitea
-   restart may be warranted; could affect session 0045 too.
+1. **#42 watcher — DECIDED (always-on VM-side), build is v1-gated.** The
+   systemd watcher itself is built when #42 lands (post-v1, after #41).
+2. **#37 PPE — DECIDED (separate infra), live stand-up is v1-gated.** The
+   real work waiting: provision the micro VM in its own gcloud project,
+   stand up its Gitea at `ppe.git.wiggleverse.org`, DNS for `ppe.*` +
+   `ppe.git.*`, flotilla 2nd deployment record at the new host/project.
+   None done — all v1-gated.
+3. **v1 timing — the gating question.** Confirm flotilla v1 timing before
+   ANY PPE VM stand-up. I stood up nothing (local scaffold only).
+4. **rfc-app PR #4 (e2e scaffold)** — review / merge when ready. The
+   Tier-1 Gitea decision is now recorded in its README; #38 still builds
+   both seams (stub + real-Gitea bootstrap).
+5. **Open follow-on:** self-host prod Gitea on the prod VM too — captured
+   in §10.1 + ROADMAP #37, needs its own decision before any move.
+6. **Gitea merge-queue wedge** (§19.2 #1) happened mid-session and
+   recovered; if it recurs, a queue/Gitea restart is the fix — may affect
+   parallel sessions (0045 was in flight).
 
 ---
 
@@ -218,34 +256,36 @@ OHM driver session. Read ~/git/ohm-infra/SESSION-PROTOCOL.md and
 ~/projects/wiggleverse/ohm-rfc/ROADMAP.md (Phase F / Track Δ, #37–#42)
 first. Claim your session id via claim-session-id.sh --start <now>.
 
-Context from session 0046: the two-tier testing refinement is fully
-landed — engineering handbook §10.3 (eng PR #1) and ohm-rfc ROADMAP
-#38/#40 (ohm-rfc PR #4 + #5) both on main. The e2e suite is
-environment-agnostic (one BASE_URL + mail-sink API URL): Tier 1 local
-Docker per-PR (no VM), Tier 2 PPE as the deploy gate; the #40 compat
-gate runs first in Tier-1 Docker.
+Session 0046 recorded the operator's Track-Δ design decisions into the
+docs (engineering handbook §10 + ohm-rfc ROADMAP). Nothing was built —
+all of Track Δ is GATED ON flotilla v1. The decided shape:
 
-A Tier-1 e2e scaffold is OPEN for review at rfc-app PR #4 (branch
-session-0046/e2e-tier1-scaffold, new e2e/ dir, NOT a release). Its
-README poses the one real #38 design decision to settle FIRST: how
-Tier 1 satisfies the backend's hard Gitea dependency — a real
-disposable Gitea container + bootstrap (high fidelity) vs. stubbing
-the gitea client (fast). Auth in tests is OTC, not OAuth (the #37
-OAuth caveat dissolved once #5/OTC shipped).
+- Two-tier testing (handbook §10.3 / ROADMAP #38, #40): env-agnostic
+  suite (one BASE_URL + mail-sink API URL). Tier 1 = local Docker per-PR
+  (no VM); Tier 2 = PPE as the deploy gate. The #40 N−1/N compat gate
+  runs first in Tier-1 Docker, PPE as prod-like confirmation.
+- #37 PPE = COMPLETELY SEPARATE infra (handbook §10.1 / ROADMAP #37):
+  own GCP micro instance + separate gcloud stack (own project/config) +
+  own Gitea at ppe.git.wiggleverse.org colocated on the PPE VM. NOT
+  colocated on prod; only flotilla's code-deploy gesture crosses over.
+  Auth in tests = OTC (OAuth caveat resolved, #5 shipped).
+- #38 Tier-1 Gitea = stub for the fast inner loop, real Gitea for the
+  gate (Tier 2 uses PPE's own Gitea). Scaffold OPEN at rfc-app PR #4
+  (branch session-0046/e2e-tier1-scaffold, e2e/ dir, NOT a release).
+- #42 auto-rollback = always-on VM-side watcher (systemd daemon, DB-free
+  rollback only; bounded carve-out from flotilla laptop-only).
+- Open follow-on (not decided): self-host PROD Gitea on the prod VM too.
 
-Possible next moves:
-- Decide the Tier-1 Gitea approach, then flesh out rfc-app PR #4
-  (Dockerfiles + gitea bootstrap + real selectors) toward a passing
-  Tier-1 suite — this is #38 and does NOT need the VM.
-- #37 (PPE on the VM) + everything live in Track Δ is GATED ON
-  flotilla v1 — confirm v1 timing with the operator before any VM work.
-- #42 auto-rollback has an OPEN model decision (always-on VM watcher
-  vs bounded-bake-during-session) — surface it, don't default.
+CONFIRM flotilla v1 timing with the operator before standing up ANYTHING
+on a VM (PPE micro instance, the PPE/prod Gitea, DNS). Work that does NOT
+need the VM and can proceed now: flesh out rfc-app PR #4 toward a passing
+Tier-1 suite (Dockerfiles + the (B) gitea stub + the (A) gitea bootstrap
++ real selectors) — that's #38.
 
-Heads-up: session 0046 hit a wedged Gitea merge-queue (persistent 405
-"please try again later") and harness Bash/Read corruption — verify
-git state against committed blobs (git show origin/main:<path>), put
---max-time on every curl, and check `git branch -r --contains <your
-commit>` before assuming your own PR is the merge path (0046 had its
-commit merged via someone else's PR). Session 0045 was also in flight.
+Heads-up: 0046 hit a wedged Gitea merge-queue (persistent 405 "please
+try again later"; recovered later) and harness Bash/Read corruption —
+verify git state against committed blobs (git show origin/main:<path>),
+put --max-time on every curl, and check `git branch -r --contains <your
+commit>` before assuming your own PR is the merge path. Session 0045 was
+also in flight.
 ```