Record operator approval and implement P1–P4: 4G swapfile, journald vacuum,
apt upgrade, and UFW lockdown of k3s API/flannel world-open rules. k3s node
Ready post-change; residual risk is still tight RAM.
Add close_session helpers and CLI to append vault session logs, engagement-
scoped metrics, duty Kai charges, and client reports. Rejects sensitive
summaries. Pilot smoke-closed once; prepare points operators at close-session.
Lock DEC-FDA-001 working defaults; add roles/host-operator package with
OS/security and load protocols; scaffold eng-coulomb-railiance01-ho-001
with bound agent, vault, ramp checklists, and Kai quote/ledger.
