open-items review (D/SEC/DOCFIX/BUNDLEFIX) vs the hardened end goal -- two-pass (self + fable advisor), live-grounded ...

WHAT: a read-only decision package reviewing all open items against project state
and the hardened end goal (re-IP redeploy on 10.13, IPv6-primary, min-delta-to-
Roosevelt). Rules nothing; mutates no authoritative status. New file
docs/audit/open-items-review-20260809.md + a pointer in CURRENT-STATE (GA-R1 C1).

CONCLUSION: backlog is overwhelmingly correctly-deferred (5 open D at Roosevelt/
end-of-deploy/v1-close; 28 SEC rows = rotation obligations + accepted postures,
no defects). The re-IP GA-R5 ruling (would be D-143) is the ONLY item gating the
end goal. Two re-IP-coupled gaps to build: R7 teardown credential-revocation
checklist; R16 10.13 naming-collision DOCFIX.

LIVE CONFIRMATION (operator-authorized discovery, read-only):
- re-IP owed check #2 (NetBox apex): PASS -- 10.13 = 0 objects, 10.12 = 149 control.
- re-IP owed check #1 (Headscale/tailnet): PASS -- no 10.13 overlap; the exact
  10.12 collision reproduced as positive control (vopenstack-jesse-tailscale).
- check #3 (VR0 internals): not completable from vcloud (tailnet-only) -> operator
  accept-or-run option.
- creds-matrix P5 (authoritative on voffice1, clone==HEAD): 11 findings (6 accepted
  + 5 dc1 forward-register, grew by design 101->121 rows) -- NOT a silent gate growth.
- DC-substrate credential residency measured live (R7 premise).
- dc0 checkpoint: 66 machines/162 units active (matches record).

TWO-PASS: fable advisor caught (1) a P5 instrument mismatch (vcloud vs voffice1 --
framing inverted from "silent growth" to "grew by design"); (2) a false "sums to
28" completeness claim (was 24) -> re-partitioned + new bucket 3b' (dc1 material on
persistent hosts retires at v1 close, not the re-IP); (3) a shred-hazard on a likely-
live dc1 edge token -> reframed to declare-only. Corrections recorded in Section 8.

REVERT: git rm docs/audit/open-items-review-20260809.md and revert the CURRENT-STATE
pointer block (lines added under the reip-prep pointer). No other surface touched.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Fg98z7QyzwYUs8fsWCn728