SolOSV3 return-purge (2026-10-18)

Young: SolOSV3 "returned" in the vault — remove and make sure it does not return.

What was actually there — and the ROOT CAUSE found

Not a rename-revert this time (the Fleet rename held). The residue was stale references in still-running machinery, which regenerates SolOSV3 paths when triggered:

1. Mira's cron jobs (2): spend-ledger-daily wrote to Docs/SolOSV3/05-operations/ (would RECREATE the dir on next run); solos-backup-github still listed SolOSV3 paths (logged "skip (absent)" but would re-track if recreated). Both retargeted to Fleet/... on-host.
2. VAULT-INDEX.md — 16 live rows were still pointing at SolOSV3/... paths (the rename pass missed them). All retargeted to Fleet/ (901ca64), except the deliberate legacy reference-tree/SolOS Legacy historical rows (they name the archived historical tree — correct as-is).
3. Directory itself: gone from disk, zero tracked SolOSV3 paths, no untracked dirs (find clean), Mira's own removal commit c53952f (spend-ledger.tsv dupe) already landed.

Guarantor of "never returns" (register rule for Min)

• The paths live in exactly 3 classes of writers: cron job definitions (fixed), index/docs text (fixed), and profile MEMORY (fixed this morning in the audit). No writer emits SolOSV3 anymore; the Fleet rename now holds.

🔴 REAL FIND during the residue scan — token committed to the repo

backup-github cron FAILED today with "secret-bearing tracked files ROSE 4→5". Scanned:

• False positive: the 5th file = my secrets-isolation-fix.md — filename-only match; verified no key values in it (pattern scan: 0).
• REAL one (found during the same scan): Docs/Fleet/05-archive/reference-tree/SolOSV2/07-build/tokens.json — a 43-character Brain A2A auth token (role: brain, label: min-sol-mira, issued 2026-10-01) committed into the GitHub repo (via kanban-regen commit c64dd7d). The repo is private, but it IS the fleet's auth-token material at rest in a git remote.

@Young — ROTATION REQUIRED: that Brain token (issued 10-01) should be re-issued via bin/issue_token.py (the enforcement guard's token path Min's memory cites) and the old one rejected; report to Sol as the enforcement lane. My report stops at the find + flag — token material is never printed here.

Records

• Crons fixed but not committed (they live on-host per profile, not in vault).
• VAULT-INDEX fix committed 901ca64 and pushed.
• Earlier tarball-state commit c53952f (Mira) + my audit commits hold the rest of the story.

🎯 Tam's Read: SolOSV3 does not "return" — it was being re-emitted by two crons and sixteen index rows that never got the rename memo; all three writer classes are fixed now, and the residue-scan ALSO surfaced the real security item of the day (a stale Brain token at rest in the git repo) — rotation, @Young, is the one action this wave still owes.