GA-R4 session close: bounded bookend + the 2026-07-29 findings sweep ...

Bookend is 14 content lines against the 15-line cap, measured. Ledger 263
lines against the 300 cap, so no rotation is owed this close.

Close sweep captured docs/audit/queued-findings-20260729.txt -- transcript-
only material preserved before compaction, per the queued-findings-20260726
and -20260727 precedent. The substantive content:

- A strict-bash quoting trap FAMILY with three measured instances in one
  session: IFS=$'\n\t' defeats word-splitting on a space-separated string
  (killed pre-flight-checks CHECK 1 silently); a bare  under
  inherit_errexit ABORTS the run instead of reaching a refusal branch; and an
  apostrophe inside the single-quoted shell string wrapping embedded python
  makes bash parse python.
- Two greps that looked like findings and were not: 'grep mac' matches
  type_machine, and grep -c 'macs = [' counts COMMENTS -- the same class as
  the ledger-scan defect where a doc quoting a token inflated a counter.
- Five MAAS behaviours, including that enlistment is NOT commissioning and
  that MAAS auto-configures power only for IPMI machines, so a virsh VM must
  be power-configured out of band first.
- Two guards defeatable by accident: lib_hosts_select_dc's one-DC-per-shell
  guard muted by 2>&1, and NetBox's ?site= filter silently not filtering.
- A process note on two parallel live-ops agents: safety came from agents
  working the voffice1 clone while the orchestrator edited vcloud's, so no git
  race was possible -- at the cost that agents barred from repo writes cannot
  leave captures, and dc1's evidence had to be promoted by hand from /tmp.

The skill sweep stays DEFERRED to the Stage-5 close per the 2026-07-27
operator direction; this capture is its input, not a substitute.

Gauntlet ALL GREEN (87) on vcloud; repo-lint 0 fail / 614 files.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HvCyrwvYTTcDYnRErfMsNf