Record operator approval and implement P1–P4: 4G swapfile, journald vacuum, apt upgrade, and UFW lockdown of k3s API/flannel world-open rules. k3s node Ready post-change; residual risk is still tight RAM.
Live observe session verified SSH access, captured baseline and Critical health/load findings (memory pressure, k3s API unavailable). RU checklist closed; engagement phase operating; schedule enabled; no privileged changes.
