Batch 0.3: ledger-scan wrap-aware next-free exclusion (GA-F15) ...

The per-line "next-free"/"reproduc*" exclusion went blind when a quoted
next-free value wrapped its hyphenated token onto the following line
(happened twice live inside the 2026-07-18 audit -- CURRENT-STATE
section 9). An excluded line now suppresses itself AND the immediately
following line; the window is exactly one line and resets at every file
boundary. Chose this over assignment-site counting: DOCFIX/BUNDLEFIX
have no single register file to key assignment sites on (unlike D
headers). Live counters re-verified unchanged post-fix: D=130,
DOCFIX=197, BUNDLEFIX=052. CURRENT-STATE section 9 marked FIXED + G3
progress cell updated same commit (GA-R1 rule 8).

Harness: tests/ledger-scan +3 checks (wrapped quote excluded, wrapped
repro example excluded, two-lines-below still counts), 44/44 PASS;
repo-lint 0 fail.

Revert: git revert this commit (restores the per-line grep exclusion
and the section-9 "recorded, NOT fixed" wording).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VZbUeRE8weySLSGY1odrCi

Batch 0.2: ledger-scan SEC reporting repointed at security-ledger.md (GA-R4/F3) ...

Scan output now emits open COUNT + ID list + register-of-record pointer;
row-level dispositions dropped (they live in docs/security-ledger.md
ONLY). Session ledger's machine-derived SEC bullet re-seeded to pointer
+ count form. G14 evidence cell repointed at security-ledger.md same
commit, and its count corrected 9 -> 8 per GA-R1/C2 (measurement wins:
the cell's own enumeration and the scan both measure 8; divergence noted
in the cell, not silently harmonized).

Harness: tests/ledger-scan +4 checks (count+IDs surfaced, pointer
present, disposition text absent), 41/41 PASS; repo-lint 0 fail.

Revert: git revert this commit (restores per-row scan output, prior
ledger bullet, and the 2026-07-18 G14 cell incl. its count error).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VZbUeRE8weySLSGY1odrCi

DOCFIX-174: fix self-inflicted false positive in ledger-scan.sh next-free scan ...

DOCFIX-173's own changelog narrated its {3}->{3,} regex fix using a literal
illustrative example ("DOCFIX-1004"), which the widened regex then matched
as a real assignment -- inflating DOCFIX next-free from 174 to 1005.
Reworded the illustrative examples in prose, added a reproduc-line
exclusion to nextfree_mentions() as defense-in-depth, and added a
regression fixture to the test harness (37/37 PASS).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QrcJx8TUar7pYAvpGJw57A

DOCFIX-173: full-project sweep -- script logic bugs + security hardening ...

Four confirmed logic bugs (unguarded pipelines/function calls under
set -e+pipefail), all independently reproduced in isolation before being
trusted -- including catching that a first proposed fix for one of them
was itself wrong: `|| true` after a failing pipeline under pipefail
silently discards PIPESTATUS, which would have made phase-06-capi-stack's
own gate check never fire again. The correct `if pipeline; then :; fi`
idiom was verified via reproduction before committing.

- carve-host-interfaces.sh: emit()'s unguarded `return 1` killed apply-mode
  runs on the first MAAS error, before the FATAL-accumulator summary
  could print.
- phase-06-capi-stack.sh: run_step's PIPESTATUS read was dead code.
- juju-spaces-check.sh, osd-blank-check.sh: one unguarded display-only
  pipe each, safely `|| true`-able.
- ledger-scan.sh: DOCFIX/BUNDLEFIX next-free regex used a fixed {3} not
  {3,} -- the same bug class already fixed once for the D-series, never
  mirrored here. Dormant, not yet reachable, but a real landmine.
- dc-dc-rbd-mirror.sh: hardened the bootstrap token's default path
  (random suffix + immediate chmod 600, was a predictable /tmp filename
  with no permission hardening).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QrcJx8TUar7pYAvpGJw57A

addendum 28: operator-away batch integrated -- DOCFIX-098..105 (H4 drift detector, offboard orphan sweep + E0 guard, handover pack, cloud-snapshot, tenant-acceptance harness, lint L7 sweep rule, ledger-scan 099-boundary fix) ...

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QFdCdEuxynmM8Q6HichbHn

clearing queue

patches