CORRECTS this repo's own 2026-07-31 finding 9d, which called it a blocker.
Stage 5 can reach `add-model` TODAY, from the dc0 rack. No key movement needed.

VERIFIED INDEPENDENTLY from the main session, not accepted on the agent's word:
juju 3.6.27-genericlinux-amd64 at /snap/bin/juju on the rack; controller
vr1-dc0-controller* admin/superuser on cloud vr1-maas; the controller model reads
"Last connection: just now"; client credentials list EXACTLY ONE entry,
vr1-maas -> vr1-dc0-cred.

ROOT CAUSE OF THE ssh REFUSAL, MEASURED ON THE MACHINE: the alias is correct in
every part -- hop chain, host, port, per-hop identity, host key. subtle-grouse's
authorized_keys holds exactly two lines, both Juju's, so the office1_svc key the
alias offers is genuinely absent and the refusal is right. The obvious hypothesis
was REFUTED rather than assumed: the machine booted AFTER the 2026-07-30 key
import and still got only Juju keys, because deploy-time cloud-config carries
Juju:juju-client-key alone. `juju ssh -m controller 0` already works.

SEC-026 control (1) DISCHARGED BY MEASUREMENT on both sides -- rack lists one
credential, voffice1 lists two, so the forbidden whole-store copy did not happen.
No new credential residency; no new security-ledger row owed.

ONLY HYGIENE OWED, NOT EXECUTED (hard rule 3): a dangling current-model pointing
at the model destroyed 2026-07-31 makes bare `juju status` error. Measured NOT to
be an add-model precondition.

FOUR GAPS LOGGED NOT FIXED, in consequence order:
 G4 the `openstack` CLI is MISSING ON THE RACK -- D-138 definition-of-done gap
    blocking phase-03+. SAME item as F1 from the 2026-07-30 sweep, now confirmed
    on the D-138 host. It has survived two sweeps.
 G3 preflight CANNOT PASS on vcloud by construction: the octavia-pki overlay is
    gitignored PKI material absent from the vcloud tree, and
    pre-flight-checks.sh:161 hard-fails on it. The host-dependence class again.
 G2 the D-138 client host's deploy input has NO PROVENANCE -- ~/repo-stage on the
    rack is a hand-staged 9-file copy with no .git (8/9 byte-identical by sha256).
    A third copy beside the two clones verified at c58bf95.
 G1 phase-4 runbook :379,398 still say "voffice1" for add-model/spaces, stale vs
    D-138; voffice1 has the binary but no registered controller, so the runbook as
    written fails. DOCFIX owed.

DECLARED UNMEASURED with the reason: whether MAAS user juju-vr1-dc0 has an
imported ssh key -- no usable maas CLI profile exists anywhere (voffice1's
~/.maascli.db is ZERO BYTES). Does not change the fix; the proximate cause was
measured directly. The PreToolUse guard refused a command that would print the
MAAS API key (DOCFIX-016) and it was NOT retried in an altered shape.

Staged by explicit path; agent files still in flight are deliberately excluded.
repo-lint 0 fail.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HvCyrwvYTTcDYnRErfMsNf