=====================================================================
SESSION-CLOSE SWEEP -- transcript-only content, Stage-5 grounding audit
Date: 2026-07-27   Branch: dc-dc-stage5-grounding-audit
Precedent: docs/audit/queued-findings-20260726.txt and -20260727.txt
Operator direction: "complete a session sweep for anything missed that
should be committed that would be lost on session end".
=====================================================================

PART A -- STALE SURFACES THIS SESSION ITSELF CREATED (all fixed in the
same commit as this file; recorded because they are the exact defect class
the audit was convened to find, committed by the audit)

A1. `docs/audit/stage5-readiness-20260727.md` carried THIRTEEN `NEEDS-RULING`
    markers after every one of R1-R15 had been ruled or withdrawn. It is the
    "read this first" artifact, so it was the single most misleading surface in
    the repo at that moment. FIXED: a supersession banner at the top states that
    every `NEEDS-RULING` marker is historical, names the three authorities in
    order, and says what in the document is STILL true and worth reading (the
    ordered precondition sequence, the evidence column, the what-breaks column).
    The row-level markers were deliberately NOT rewritten -- they are the record
    of what was owed at the time, and rewriting them would destroy that.

A2. `docs/audit/queued-rulings-20260727.md` still opened with "**Nothing here is
    adopted.**" after fourteen adoptions. FIXED: a STATUS block now states all
    questions are closed and names `design-decisions.md` / `CURRENT-STATE.md` as
    the ruling authorities rather than that file. The original sentence is struck
    through, not deleted.

A3. SIX sections of that file had BLANK `OPERATOR UTTERANCE:` lines -- R8, R9,
    R10, R12, R13, R15 -- for rulings that WERE properly recorded in
    design-decisions.md and CURRENT-STATE.md. GA-R5 was satisfied; the question
    sheet was not. A future session reading only that file would have believed
    six questions were still open. FIXED: all six filled with the exact utterance
    plus where the ruling lives.
    NOTE: `R14-ORIGINAL` still has a blank line and that is CORRECT -- it is the
    superseded original question text kept for the audit trail, and its outcome
    is recorded in the `R14 WITHDRAWN` section immediately above it.

PART B -- OPERATIONAL FACTS THAT LIVED ONLY IN THE TRANSCRIPT

B1. **repo-lint L5 will reject a heading that LEADS with a D-number.** The rule
    (`scripts/repo_lint.py:355`) is
    `^##+\s+(D-\d{3,})\b(?!.*AMENDMENT|.*RESOLVED)` -- ANY heading level leading
    with `D-NNN` counts as a second DEFINITION of that decision unless the same
    line also contains `AMENDMENT` or `RESOLVED`. This bit this session TWICE
    (the R5 note, then the R13 sub-ruling) and cost two fix-forward cycles.
    The safe forms, both already used in-repo:
      `### RULING NOTE <date> -- D-NNN: ...`   (number AFTER the words)
      `## D-NNN -- AMENDMENT (<date>): ...`    (contains AMENDMENT)
    NOT recorded on any author-facing surface today. Worth a line in the
    decision-record conventions wherever those live -- this is a trap that only
    fires at commit time, after the writing is done.

B2. **Gate your commits on lint, do not merely run lint near them.** Early in
    this session a red-lint commit was pushed because lint ran in the same
    compound command as the commit but the commit did not DEPEND on its result.
    Every later commit used
    `if bash scripts/repo-lint.sh >/dev/null 2>&1 || [ $? -eq 2 ]; then ... fi`
    (exit 2 = WARN-only, which is the expected steady state here). That guard
    then caught B1's second occurrence BEFORE it landed.

B3. **Polling the live NetBox apex, read-only, without exposing the token.**
    `set -a; . ~/vr1-office1-creds/vr1-netbox-sandbox.env; set +a`
    `python3 netbox/office1-record-dump.py --out <path>`
    The script reads `NETBOX_URL` + `NETBOX_TOKEN` from the environment and
    prints neither; it states "NOTHING was written to NetBox". This is the
    correct way to answer an apex question and it is what should have been done
    BEFORE putting R2a to the operator.

B4. **Probe path determines the answer -- the office1 VMs are reachable from
    vcloud, NOT from voffice1.** A clone check run via
    `ssh voffice1 'ssh office1-netbox ...'` returned "unreachable"; run directly
    from vcloud it returned a real NO-CLONE. "Unreachable" is not "absent", and
    the first result must never be recorded as a negative finding. Same rule that
    turned `/root/maas-secrets` from "does not exist" into UNREADABLE on
    2026-07-26.

B5. **`creds-matrix.tsv` is SPACE-ALIGNED, not tab-separated** despite the
    extension. Parsing it with `awk -F'\t'` returns ZERO rows and looks like a
    real result. The repo's own tooling splits on default whitespace. This nearly
    produced a published figure contradicting a correct earlier finding.

PART C -- THE META-FINDING, recorded because it should shape the NEXT committee

C1. **The lenses' OBSERVATIONS were reliable; their CONCLUSIONS were not.**
    Three of this audit's own premises had to be corrected by measurement, each
    time in the direction of LESS work or a DIFFERENT problem:
      - R2a: the v6 literals were already assigned under D-111. The question
        should never have been asked; lens 2 had explicitly warned the apex was
        UNMEASURED and that warning was not acted on.
      - R9: there is ONE failure mode, not two, and the Stage-5 blast radius is
        TWO scripts, not twenty.
      - R14: the register already attributed AND explained the findings, and the
        notes file already warned against the exact suppression the question
        contemplated.
    Additionally R3 shrank to two lagging segments, R1 narrowed from 18 volumes
    to 8, and R8's entire evidence base collapsed on reading the cited bugs.
    **Standing lesson for the next committee: a lens finding is an OBSERVATION,
    not a conclusion. Measure before putting it to the operator as a question.**
    The operator's own instruction is the sharpest statement of it: "Research is
    cheap, guesswork is expensive."

C2. **A citation is an existence claim; only its CONTENT is evidence.** The
    v4-only lb-mgmt draft rested on two Launchpad numbers in a comment block.
    Read: one was a different installer's bug, Fix Released in 2021; the other
    was not an IPv6 defect at all but an OVN/LXD/MAAS FQDN binding bug whose fix
    shipped in OVS 2.15 (our nodes install 2.17.9). Nothing in the repo could
    catch this, because no gate reads prose. Same family as the two
    ruled-but-never-built decisions this audit found (D-134's bands, D-020's
    vault VIP): a plausible in-repo statement that nothing verifies.

PART D -- NOT DONE, and deliberately so
- The skill (`.claude/skills/openstack-cloud-ops/`) was NOT swept this session.
  Stage-close discipline normally folds new invariants in and regenerates the
  dated Chat snapshot. This session closed no STAGE -- it produced rulings and
  findings against an open one -- so the skill sweep is not owed yet. B1, C1 and
  C2 above are the candidates when Stage 5 does close.
- The 21-item DOCFIX batch and every ruling's execution remain LOGGED NOT
  EXECUTED. No D-/DOCFIX-/BUNDLEFIX- number was consumed this session.