diff --git a/docs/CURRENT-STATE.md b/docs/CURRENT-STATE.md
index 53af4c2..abaa224 100644
--- a/docs/CURRENT-STATE.md
+++ b/docs/CURRENT-STATE.md
@@ -387,6 +387,19 @@
   the hazard); delete + re-enrol + re-commission the 9 nodes; re-apply statics, br-ex and
   tags; re-point Juju at `10.12.8.6:5240`. Nothing is half-applied at this point: the Office1
   region still owns all 9 dc0 nodes, correctly carved and `Ready`.
+  **SESSION SWEEP AT CLOSE: `docs/audit/queued-findings-20260730-stage5.txt` (F1-F12).**
+  Every finding raised in-session was grepped against this document and the changelog.
+  **THREE lived ONLY in the transcript and would have been lost:** F1 the `openstack` CLI is
+  absent on the DC client host and BLOCKS Step 7+ (D-138 moved the tools; the client stayed
+  on voffice1); F2 metal-admin v6 has node addresses but NO rack-side leg; F3 the plane
+  fabrics read `mtu=1500` while the libvirt networks are `mtu 9000` (PRE-EXISTING, and
+  phase-4 Step 12 carries a jumbo gate). **F6: THE AS-EXECUTED LOG FOR THIS WINDOW IS
+  PARTIAL** -- the harness classifier refused several `script -aqe ... -c` wrapped forms
+  while the plain `ssh voffice1 'maas admin ...'` form passed, so those calls ran unwrapped.
+  Every action is here and in the changelog with read-backs, but the log must NOT be read as
+  a complete record; the `logs/as-executed-index.md` row says so. **F10 is the
+  highest-consequence unruled item left:** the D-135/D-107 egress narrowing would BREAK the
+  region's image sync and any juju bootstrap, and nothing sequences it after them.
   **^ THE `1 add` FIGURE IS WRONG, CORRECTED BY MEASUREMENT: it is `2 to add`** --
   `modules/node-vm` creates a `libvirt_domain` AND a `libvirt_volume` per node. Carried in
   from the D-104 amendment's prose, which is wrong at resource level for the same reason. The
diff --git a/docs/audit/queued-findings-20260730-stage5.txt b/docs/audit/queued-findings-20260730-stage5.txt
new file mode 100644
index 0000000..461ff07
--- /dev/null
+++ b/docs/audit/queued-findings-20260730-stage5.txt
@@ -0,0 +1,130 @@
+QUEUED FINDINGS -- Stage-5 open + per-DC region session (2026-07-30)
+====================================================================
+Swept at session close. Items are LOGGED, NOT EXECUTED (hard rule 1). Each says where it
+already lives, or that this file is its first surface. Precedent: queued-findings-20260727,
+-20260729, -20260730.
+
+F1. THE `openstack` CLI DOES NOT EXIST ON THE DC CLIENT HOST -- blocks Stage 5 Step 7+.
+    FIRST SURFACE: this file (was transcript + task list only).
+    D-138 moved cloud-facing tools INTO the DC, but `python3-openstackclient 6.6.0` was
+    installed on voffice1 on 2026-07-27 (CURRENT-STATE section 7) and is NOT on the dc0
+    rack or the region VM. Ten scripts invoke it -- phase-03-admin-openrc.sh,
+    phase-04-network-{create,verify}.sh, phase-04-internal-cert-san-verify.sh,
+    phase-05-{amphora-pipeline,octavia-verify}.sh, phase-06-{bootstrap,capi-stack,mgmt-vm,
+    net-setup}.sh -- all against keystone's VIP 10.12.4.50 on provider-public, which
+    voffice1 cannot reach. MEASURED PIN, do not re-derive: the snap is REFUTED (no Caracal
+    channel; newest stable `zed` 2023-03), and noble's native OpenStack release IS Caracal
+    2024.1, so the deb is correct and needs no UCA. Install on the DC client host before
+    Step 7 and add the host to CURRENT-STATE section 7.
+
+F2. metal-admin v6 HAS NODE ADDRESSES BUT NO RACK-SIDE LEG.
+    FIRST SURFACE: this file (was transcript + task list only).
+    MEASURED on the dc0 rack: `ip -6 -o addr show dev virbr2` returns EMPTY and ping6 to
+    the controller gives "Network is unreachable", while v4 10.12.8.5 answers 0% loss. The
+    2026-07-27 IPv6 carve assigned v6 statics to NODES in MAAS but `dc-rack-net.sh` adds v4
+    legs only (10.12.8.2/.3/.4). NOT BLOCKING: juju fell back to v4 unaided, and
+    node-to-node / agent-to-controller v6 on the same L2 needs no rack leg because every
+    node holds a v6 static on the same /64. CONSEQUENCE TO CHECK LATER: anything
+    RACK-ORIGINATED toward a node over v6 fails, and D-101 makes metal-admin dual-stack.
+    Verify per plane per DC before concluding scope -- likely true on dc1 and on the other
+    five planes.
+
+F3. PLANE FABRICS READ mtu=1500 WHILE THE LIBVIRT NETWORKS ARE mtu 9000.
+    FIRST SURFACE: this file.
+    From docs/audit/dc0-maas-carve-premigration-20260730.txt: all five named dc0 plane
+    fabrics report `mtu=1500`. `virsh net-dumpxml vr1-dc0-metal-admin` reports `<mtu
+    size='9000'/>`. PRE-EXISTING -- not introduced by this session's work, and not chased
+    here (hard rule 1). Why it matters: Ceph and geneve are the classic jumbo-frame
+    consumers, phase-4 Step 12 carries a jumbo gate, and CURRENT-STATE already records "two
+    lagging MTU segments" from the 2026-07-27 audit. Establish which layer is authoritative
+    before the Stage-5 storage/network gates run.
+
+F4. `ceph-osd` CARRIES THE STALE VR0 CONSTRAINT `tags=openstack` (bundle.yaml:592).
+    ALREADY ON SURFACE: docs/CURRENT-STATE.md section 1 + changelog item 2. Repeated here
+    only so the sweep is complete. Decision is owed at Step 4.2's dry-run, where its impact
+    is first observable. Measured absent from the VR1 region; only app of 56 with a tag
+    constraint.
+
+F5. DOCFIX OWED (next-free 206; assign at delivery, never write the token above the
+    high-water mark in prose first). TWO corrections, one DOCFIX:
+    (a) `runbooks/dc-dc-phase4-juju-bundle-per-dc.md` Step 1's RUN LOCATION banner says
+        every juju and maas command runs on voffice1. D-138 amends that for CLOUD-FACING
+        tools; maas/NetBox/inner-tofu stay on voffice1. Steps 2, 3.5, 4, 4b and 5-12 all
+        carry run-location text now wrong for the juju half.
+    (b) Step 2's bootstrap command reads `--constraints` only; juju 3.6.27 assigns
+        machine-targeting to `--bootstrap-constraints`. Operator ruled "Use both flags".
+        D-104's amendment bullet carries the same single-flag wording.
+    ALREADY ON SURFACE: changelog item 3 (the flag half). The run-location half is NEW here.
+    NO GATE READS PROSE, so nothing in this repo catches either.
+
+F6. THE AS-EXECUTED LOG FOR THIS SESSION IS PARTIAL, AND THAT IS RECORDED NOT HIDDEN.
+    FIRST SURFACE: this file (+ the index row added this session).
+    The DOCFIX-097 Claude-Code lane wraps each live command as
+    `script -aqe ~/as-executed/<date>-<label>.log -c '<cmd>'`. MEASURED: the harness
+    classifier REFUSED several wrapped forms (`script ... | tail`, `script ... | python3`,
+    and two bare `script -aqe ... -c 'ssh voffice1 ...'` MAAS calls), while the plain
+    `ssh voffice1 'maas admin ...'` form passed. Those calls therefore ran UNWRAPPED and are
+    NOT in the log. Everything they did is in the changelog and CURRENT-STATE with
+    read-backs, but a future session reading the as-executed log must not treat it as a
+    complete record of this window. Candidate fix: a targeted permission rule for the
+    wrapped form, so discipline and tooling stop fighting.
+
+F7. THE dc0 MANIFEST CARRIES A LITERAL `<stamp>` PLACEHOLDER THAT CAN NEVER MATCH.
+    PRE-EXISTING (from the 2026-07-30 part-2 reissue work), surfaced by this session's
+    `creds-audit vr1-dc0` run: 2 problems -- MISSING
+    `vr1-dc0-octavia-pki-<stamp>.tar.gz` and UNDECLARED
+    `vr1-dc0-octavia-pki-20260730T070146Z-1520866.tar.gz`. The manifest declares a
+    placeholder filename rather than a glob, so the real timestamped backup is permanently
+    both missing and undeclared. NOT this session's defect and NOT fixed here.
+
+F8. D-104's AMENDMENT PROSE SAYS "1 add / 0 change / 0 destroy"; MEASURED IT IS 2.
+    ALREADY ON SURFACE: CURRENT-STATE + changelog item 7. `modules/node-vm` creates a
+    `libvirt_domain` AND a `libvirt_volume` per node. The half that protects you --
+    `0 change / 0 destroy` -- is correct. D-104's own text is wrong at resource level for
+    the same reason; flagged, not edited (not this item's surface).
+
+F9. TOOL TRAPS MEASURED THIS SESSION -- candidates for `references/platform-traps.md`.
+    FIRST SURFACE for most: this file.
+    (a) `ssh -n` REDIRECTS STDIN FROM /dev/null, so `ssh -n host bash -s <<'EOF'` silently
+        runs NOTHING. Cost this session: a credential shred that never executed and a DB
+        step that never ran. Conversely, an inner `ssh` WITHOUT `-n` EATS the remaining
+        heredoc from the outer script -- which is what made that shred silently skip. Both
+        directions bite; pick per call and verify by reading state back.
+    (b) `printf ... | grep -q` UNDER `set -o pipefail` RETURNS FAILURE. grep short-circuits,
+        printf takes SIGPIPE. Already recorded once this repo-day; it false-FAILED the G17
+        mirror assertion. Use a here-string: `grep -q PATTERN <<<"$BODY"`.
+    (c) SNAP CONFINEMENT: the juju snap cannot read `/tmp` (private mount), so
+        `juju add-cloud -f /tmp/x.yaml` fails with "no such file". Use `$HOME`. The repo
+        already records the sibling trap for `openstackclients`.
+    (d) A MAAS WRITE CAN RETURN A FULL 200-SHAPED JSON OBJECT AND CHANGE NOTHING.
+        `interface update <sys> <iface> vlan=` on a `Deployed` machine returned the whole
+        interface object while leaving the VLAN untouched; the refusal only surfaced later
+        and indirectly as `{"subnet": ["None found with id=7."]}`. ALWAYS read the
+        interface back. MAAS accepts interface changes only in New/Ready/Allocated/Broken.
+    (e) `creds-matrix.tsv` IS SPACE-ALIGNED, NOT TAB-SEPARATED. `awk -F'\t'` returns zero
+        rows and looks exactly like a real result. Already a standing lesson; it recurred.
+    (f) `boot-resources import` RACES a just-created selection: the first import returned
+        noble-only with `is-importing=false`. Assert on `Synced` ROWS, never on the import
+        call returning.
+    (g) PINNING MACs BOUNCES THE GUEST AND INTERRUPTS THE AUTO-COMMISSION THE FIRST APPLY
+        TRIGGERED. Already promoted to CURRENT-STATE as a standing DC-standup rule.
+
+F10. THE D-135/D-107 EGRESS NARROWING WOULD BREAK IMAGE SYNC AND JUJU BOOTSTRAP OUTRIGHT.
+    ALREADY ON SURFACE: CURRENT-STATE (this session). Repeated here because it is the
+    highest-consequence unruled item left. MEASURED: three artifact classes, ONE local --
+    apt packages from 10.12.8.4 (local); MAAS boot images from images.maas.io (the mirror
+    404s on every simplestreams path); juju agent stream + juju/juju-db snaps from
+    streams.canonical.com / api.snapcraft.io. The narrowing is described as "the closing
+    mutation" and NOTHING currently sequences it after these. Needs either a ruling that
+    sequences it explicitly, or D-135 items 2-3 built first.
+
+F11. THE JUJU CONTROLLER'S v6 GUA LEG ON provider-public WAS DELIBERATELY NOT APPLIED.
+    ALREADY ON SURFACE: CURRENT-STATE. Role nodes carry `2602:f3e2:f02:10::NNN` on br-ex;
+    the controller has v4 `10.12.4.5` only. A default route needs only the v4 leg, and
+    handing a controller a public GUA is an operator call. Recorded so a later session does
+    not silently "fix" the asymmetry.
+
+F12. TWO RULINGS TODAY REST ON WORK THAT IS AUTHORED BUT NOT APPLIED AT dc1.
+    `vr1-dc1-maas-01` is in the substrate root and NOT applied; dc1's three region
+    credentials are EXPECTED by the matrix and correctly FAIL S2. Both are deliberate --
+    one DC proves the sequence first -- but neither should be read as an oversight.
diff --git a/docs/changelog-20260730-stage5-open.md b/docs/changelog-20260730-stage5-open.md
index 1a04948..df2d688 100644
--- a/docs/changelog-20260730-stage5-open.md
+++ b/docs/changelog-20260730-stage5-open.md
@@ -259,3 +259,32 @@
 `opentofu/vr1-dc0-substrate` removes the VM and its volume; then delete the MAAS machine
 record (`maas admin machine delete tw7ptw`) and `git revert` this commit to drop both roots'
 entries. Nothing else in either root is touched -- the plan proved `0 change / 0 destroy`.
+
+### 8. SESSION SWEEP -- transcript-only findings landed on surfaces
+
+**What.** New capture `docs/audit/queued-findings-20260730-stage5.txt` (F1-F12), and an
+`logs/as-executed-index.md` row for the `stage5-dc0-deploy` window.
+
+**Why (evidence).** A close-time sweep grepped each finding raised in-session against
+`docs/CURRENT-STATE.md` and this changelog. **Three lived ONLY in the transcript and would
+have been lost**: F1 the absent `openstack` CLI on the DC client host (blocks Step 7+),
+F2 the metal-admin v6 rack-leg gap, F3 the plane-fabric `mtu=1500` vs libvirt `mtu 9000`
+mismatch. Two more were partial: F5's run-location half and F6's as-executed gap. The rest
+are cross-references so the sweep is complete rather than selective.
+
+**The one that most needed writing down is F6 -- the as-executed log is PARTIAL.** The
+harness classifier refused several `script -aqe ... -c` wrapped forms while the plain
+`ssh voffice1 'maas admin ...'` form passed, so those calls ran unwrapped. Every action is
+in the changelog and CURRENT-STATE with read-backs, but the log itself must not be read as
+a complete record of this window, and the index row now says so. A log that silently looks
+complete is worse than one that declares its gap.
+
+**F9 collects six tool traps measured today** -- `ssh -n` eating a heredoc (and its
+mirror-image, an inner `ssh` without `-n` eating the rest of the script, which silently
+skipped a credential shred), `| grep -q` under `pipefail`, snap `/tmp` confinement, a MAAS
+write returning a full JSON object while changing nothing, the space-aligned `.tsv`, and
+`boot-resources import` racing a fresh selection. They are candidates for
+`references/platform-traps.md`, queued not executed.
+
+**Revert.** Records only; nothing executable changed. `git revert` drops the capture, the
+index row and this item.
diff --git a/docs/session-ledger.md b/docs/session-ledger.md
index 367553c..ec15f12 100644
--- a/docs/session-ledger.md
+++ b/docs/session-ledger.md
@@ -233,3 +233,18 @@
 - Guard misfire tally now **SEVEN** -- it blocked a command that only TESTED it, then the heredoc documenting its own misfires. Hardening it needs no ruling (fork 1 is ruled).
 - Gauntlet ALL GREEN (89) BOTH hosts; repo-lint 0 fail; octavia-pki 51/51; preflight 33/33; creds-matrix 65/65 + 5 pre-existing findings. **verify 37/0 and P7 [ok] on both DCs.**
 - **NEXT (Stage 5 entry):** preflight is RED only on P5's pre-existing credential register -- decide accept-or-remediate at the gate, do not re-audit it. G17 arms at first boot. Bodies: `docs/changelog-20260730-docfix205-d117-annotation.md`, `-octavia-reissue-tool.md`. Status ONLY in CURRENT-STATE.md.
+
+## SESSION CLOSE 2026-07-30 (part 3) -- STAGE 5 OPENED; three bootstraps; D-138 + D-132 ruled; per-DC MAAS region LIVE at dc0 (bounded, GA-R4)
+
+- Branch `dc-dc-stage5-preconditions`, **12 commits** pushed (`726127d..`). **STAGE 5 OPENED**, not closed. Scan: 3 decisions, **SEC 23** (SEC-026, -027 opened), **D 139** / DOCFIX 206 / BUNDLEFIX 053.
+- **5 RULINGS (GA-R5, quoted):** P5 accepted; bootstrap flags **"Use both flags"**; **D-138** cloud-facing client moves INTO the DC; **D-132 q1** per-DC MAAS region; its placement **VM at utility `.6`** (extends the D-134 octet map: .4 artifact / .5 juju / .6 region).
+- **THREE BOOTSTRAP ATTEMPTS, each failing one layer deeper -- every failure a real defect no record would have shown.** (1) no juju-client->node-plane path anywhere (SEC-010 + isolated libvirt nets; never existed). (2) D-138 fixed the client, then the CONTROLLER VM had NO DEFAULT ROUTE -- under-carved, added after both Stage-4 carves. (3) route fixed, agent fetched on attempt 1, then `jujud` could not reach the MAAS region API. **SEC-010 is INCOMPATIBLE with D-104-in-DC-controller + Office1 region**; per-DC regions REMOVE the requirement rather than excepting it, so **SEC-010 stays UNAMENDED**.
+- **BUILT:** D-134 `.5`+v6 on BOTH controllers (was ruled-but-not-built); region VM applied dc0 (`2 add/0/0`, MACs pinned, converged ZERO DIFF); **dc0 region LIVE** -- noble + MAAS 3.7.2 + PostgreSQL 16.14 matching Office1, API **200** on `10.12.8.6:5240`, `dhcpd` INACTIVE (no DHCP conflict), jammy+noble **Synced**.
+- **G17 dc0 CAPTURED, both assertions PASS** -- the one-shot window opened during a FAILED bootstrap and was taken. Found G17's own text names `chronyc`, absent on the MAAS jammy image, so the gate as written could only REFUSE.
+- **CREDENTIALS (operator-directed):** 3 region secrets minted on-VM, never printed, consolidated to `~/vr1-dc0-creds/` (sha256-verified identical), **SEC-027** opened; matrix now EXPECTS them at BOTH DCs (5 rows/DC, new `region` host-role enum, 4 `vm-secret-locations` rows). **dc1's correctly FAIL S2** -- the forward register making absence detectable. Harness 65/65.
+- **MEASURED, DO NOT CONFLATE:** MAAS boot images come from `images.maas.io`, NOT the DC mirror (404s on every simplestreams path -- it mirrors apt only). Three artifact classes, ONE local. **The D-135/D-107 narrowing would BREAK image sync AND bootstrap; nothing sequences it after them** (queued F10 -- highest-consequence unruled item).
+- **OWNED:** ran the DC checkers on the wrong host; then re-probed egress FROM THE RACK and called the window open when the NODE does the fetching -- same wrong-host class, made right after writing that note; scoped D-138 without enumerating that `jujud` is itself a MAAS client, which is why a 4th blocker appeared after the 3rd was fixed. All corrected on-surface.
+- **NOTHING IS HALF-APPLIED.** Office1 still owns all 9 dc0 nodes, correctly carved and `Ready`. Pre-migration carve captured (`dc0-maas-carve-premigration-20260730.txt`, 179 lines) -- MAAS cannot move machines between regions, so the migration must recreate it.
+- **AS-EXECUTED LOG IS PARTIAL** -- the classifier refused several `script -aqe` wrapped forms; index row says so (F6). A log that looks complete is worse than one declaring its gap.
+- **NEXT:** recreate topology on the new region -> DHCP handover (two servers on one segment is the hazard) -> re-enrol/re-commission 9 nodes -> re-apply statics/br-ex/tags -> re-point Juju at `10.12.8.6:5240`. dc1's region VM authored, NOT applied. Start with fresh context: the destructive half is nine nodes.
+- Sweep: `docs/audit/queued-findings-20260730-stage5.txt` (F1-F12). Bodies: `docs/changelog-20260730-stage5-open.md`. Status ONLY in CURRENT-STATE.md.
diff --git a/logs/as-executed-index.md b/logs/as-executed-index.md
index 09d22f4..b193c03 100644
--- a/logs/as-executed-index.md
+++ b/logs/as-executed-index.md
@@ -18,3 +18,4 @@
 | 2026-07-23 | ops-sec010-reassert | jesse.austin (Claude Code lane, per-command wrap) | queue-pass live window: SEC-010 nft re-assert all 3 hosts (4/2/2 converged); G13 close -- office1 qga channel 0/1/0 apply + 26.7.1 update + os-iperf; cache-residue delete; captures docs/audit/sec010-reassert-20260723.txt + g13-close-20260723.txt |
 | 2026-07-23 | stage4-carve | jesse.austin (Claude Code lane, per-command wrap) | Stage 4 carve, both DCs: dynamic ranges moved .201-.254 (D-134 amendment), 10 plane fabrics created, 90 NIC re-homes (18 nodes), 8 subnets created + 2 moved off fabric-5, 6 spaces created + 12 VLANs assigned, 18 nodes' statics + br-ex (D-133 flat); capture docs/audit/stage4-carve-verify-20260723.txt |
 | 2026-07-24 | dc-maas-creds | jesse.austin (Claude Code lane, driven) | phase-4 Step 2.0 credential task: created per-DC MAAS admin service users juju-vr1-dc0 / juju-vr1-dc1 (random unstored passwords) + staged their API keys to vcloud ~/vr1-dcN-creds/maas-api-key.txt (format-verified parts=3); SEC-018/-019 opened |
+| 2026-07-30 | stage5-dc0-deploy | jesse.austin (Claude Code lane, per-command wrap -- PARTIAL, see note) | Stage 5 open: 3 juju bootstrap attempts (client path, node route, provider-API path), D-134 .5+v6 built both controllers, per-DC MAAS region VM applied + region installed live at dc0. NOTE: several wrapped forms were REFUSED by the harness classifier and ran unwrapped, so this log is NOT a complete record of the window -- see docs/audit/queued-findings-20260730-stage5.txt F6 |