docs: F-OPS1 resolved (self-managing root)

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

DECISIONS-LOG.md

@@ -334,7 +334,15 @@ record DNS Name". `--domain-filter=home.keithjackson.dev` filtered OUT the real
 (keithjackson.dev) and set `domainFilters: [${DNS_ZONE}]`. Scope stays effectively home.keithjackson.dev
 (only suffix services request) and `policy=sync`+txt-registry never touch non-owned records.
 
-### FINDING F-OPS1 — cluster-vars changes need a manual `kubectl apply -k clusters/dev` (gap)
+### FINDING F-OPS1 — cluster-vars changes need a manual `kubectl apply -k` — **RESOLVED (main @ 4381a71)**
+Added `clusters/dev/sync.yaml`: a self-managing ROOT Kustomization (flux2 gotk-sync pattern, name
+`flux-system`) that reconciles `./clusters/dev` from git — cluster-vars, the GitRepository, platform/
+platform-config/apps, and itself (inventory = 6 objects, confirmed). Bootstrap unchanged
+(`kubectl apply -k clusters/dev` creates it once). Verified: root → Ready, adopts the graph without
+disruption, all Kustomizations settle green; a git push now auto-applies overlay/cluster-vars changes.
+prod needs its own sync.yaml (→ ./clusters/prod) when built. Original gap description below:
+
+
 Adding `DNS_ZONE` didn't take effect until I re-ran `kubectl apply -k clusters/dev` (the on-cluster
 `cluster-vars` ConfigMap isn't reconciled by Flux — this bootstrap model has NO self-managing root
 Kustomization that watches `clusters/dev`). Then a `platform` Kustomization reconcile re-ran the