diff --git a/.claude/skills/openstack-cloud-ops/SKILL.md b/.claude/skills/openstack-cloud-ops/SKILL.md
index c9cef78..778828d 100644
--- a/.claude/skills/openstack-cloud-ops/SKILL.md
+++ b/.claude/skills/openstack-cloud-ops/SKILL.md
@@ -1,6 +1,6 @@
 ---
 name: openstack-cloud-ops
-description: "Operate, install, extend, and troubleshoot the Omega Cloud - a commercial multi-tenant Charmed OpenStack (Caracal 2024.1) deployment managed with Juju and MAAS, with Vault TLS, OVN, Ceph, Octavia, and Magnum/CAPI tenant Kubernetes. Use this skill for ANY work touching OpenStack, Juju, MAAS, Magnum, CAPI, Ceph, OVN, Octavia, Keystone, Vault-for-OpenStack, tenant onboarding, or the openstack-caracal-ipv4 repository - including writing or reviewing bash/python operational scripts, debugging failed deploys or cluster creates, runbook work, design-decision (D-NNN) discussion, and incident triage. Use it even for seemingly simple OpenStack questions: this deployment has strict operating discipline and known charm traps that make generic answers wrong."
+description: "Operate, install, extend, and troubleshoot the Omega Cloud - a commercial multi-tenant Charmed OpenStack (Caracal 2024.1) deployment managed with Juju and MAAS, with Vault TLS, OVN, Ceph, Octavia, and Magnum/CAPI tenant Kubernetes. Use this skill for ANY work touching OpenStack, Juju, MAAS, Magnum, CAPI, Ceph, OVN, Octavia, Keystone, Vault-for-OpenStack, tenant onboarding, or the repository this skill operates against - including writing or reviewing bash/python operational scripts, debugging failed deploys or cluster creates, runbook work, design-decision (D-NNN) discussion, and incident triage. Use it even for seemingly simple OpenStack questions: this deployment has strict operating discipline and known charm traps that make generic answers wrong."
 ---
 
 # openstack-cloud-ops
@@ -14,18 +14,19 @@
 
 ## Step 0 - locate the source of truth
 
-The repository `openstack-caracal-ipv4` (GitBucket, git.baldurkeep.com) is
-authoritative for everything: bundle, runbooks, scripts, design decisions,
-as-built values. This skill is a discipline-and-routing layer OVER that repo,
-not a substitute for it.
+This repository (GitBucket, git.baldurkeep.com) is authoritative for
+everything: bundle, runbooks, scripts, design decisions, as-built values. This
+skill is a discipline-and-routing layer OVER that repo, not a substitute for
+it. Never hardcode the repo's own name/path in a command -- it has already been
+renamed/forked once (see D-110) and will again; discover it fresh each session.
 
-1. Look for a local clone (common paths: `~/openstack-caracal-ipv4`, a repo
-   dir in the working tree, `/home/claude/repo`). If found, `git log -1` to
-   note HEAD and work from it.
-2. No clone and you have shell + network: ask before cloning
-   (`https://git.baldurkeep.com/git/OpenStack/openstack-caracal-ipv4.git`).
-   The repo may be private; if the clone fails, ask the operator to provide
-   access or the relevant files.
+1. Look for a local clone: a repo dir in the working tree, or a `$HOME` entry
+   containing `bundle.yaml` + `docs/design-decisions.md`. If found, confirm
+   identity with `git remote -v`, then `git log -1` to note HEAD and work from it.
+2. No clone and you have shell + network: ask the operator for the exact clone
+   URL (org/group and repo name -- do not guess or reuse one from memory; it
+   may have moved, per this same repo's own history). The repo may be private;
+   if the clone fails, ask the operator to provide access or the relevant files.
 3. No clone obtainable (e.g. chat without sandbox network): say so, ask the
    operator to paste the relevant runbook/script, and proceed only on what is
    actually in front of you.
@@ -96,7 +97,8 @@
 
 ## Standard loops (repeatable session shapes)
 
-**Session bootstrap (jumphost):** `git -C ~/openstack-caracal-ipv4 pull` ->
+**Session bootstrap (jumphost):** `git -C "$REPO" pull` (set `$REPO` once per
+session -- see `runbooks/README.md` Conventions / `references/environment.md`) ->
 `bash scripts/repo-lint.sh` (0 fail expected) -> if touching the live cloud,
 `bash scripts/run-logged.sh <label>` to open the logged shell. Repo HEAD and a
 clean lint are the preconditions for everything else.
diff --git a/.claude/skills/openstack-cloud-ops/references/environment.md b/.claude/skills/openstack-cloud-ops/references/environment.md
index 53deeb8..1efd8aa 100644
--- a/.claude/skills/openstack-cloud-ops/references/environment.md
+++ b/.claude/skills/openstack-cloud-ops/references/environment.md
@@ -26,10 +26,17 @@
 
 - **Jumphost:** `vopenstack-jesse` - all live commands run here. Has juju,
   the openstack CLI (SNAP - cannot read /tmp; use $HOME), jq, kubectl.
-- **Repo:** `https://git.baldurkeep.com/OpenStack/openstack-caracal-ipv4`
-  (web) / `.../git/OpenStack/openstack-caracal-ipv4.git` (clone). Operator
-  commits from Windows (PowerShell / GitHub Desktop - strips exec bits;
-  `.gitattributes` pins LF); the jumphost only pulls.
+- **Repo:** `https://git.baldurkeep.com/OpenStack/openstack-caracal-dc-dc`
+  (web) / `.../git/OpenStack/openstack-caracal-dc-dc.git` (clone) -- a
+  documented ANCHOR FACT (this repo's name/path has already changed once, see
+  D-110; re-verify with `git remote -v` before trusting it, same as any other
+  fact in this file). repo-lint: allow-selfref. Operator commits from Windows
+  (PowerShell / GitHub Desktop - strips exec bits; `.gitattributes` pins LF);
+  the jumphost only pulls.
+- **Session `$REPO` convention:** set `$REPO` once per session to your clone's
+  root (see `runbooks/README.md` Conventions); every runbook RUN block
+  references `$REPO`, never a hardcoded clone path. `repo-lint` L9 enforces
+  this for scripts/RUN-blocks/skill files.
 - **Juju model:** `openstack`. **MAAS profile:** `admin` (call
   `maas admin ...` directly; NEVER `maas list` - it prints the API key).
 - **Management substrate (verify; NEVER touch in teardown):** the MAAS
diff --git a/clientdocs/sweep-receipt.txt b/clientdocs/sweep-receipt.txt
index 84acbe5..8fe4262 100644
--- a/clientdocs/sweep-receipt.txt
+++ b/clientdocs/sweep-receipt.txt
@@ -34,7 +34,7 @@
 02fe1fd7fcf07bfc6088622d4aa8430da53e435d60006d0b81f6b9c2e720a011  policies/overrides.zip
 30919b61b2b79b33a853a29bc814558d7e0e940a3040b2f7710ea9a14333b71a  runbooks/appendix-C-identity-rbac.md
 8510402e5375a6d42cc47f28eec9698a23d88e04b22ef70ef6e129e1179f3d32  runbooks/appendix-D-magnum-trust-model.md
-927aa7261aa2d9fabe2cb7342499e6c0d0840a93ffbb323ee7003ac8eefe14a7  runbooks/tenant-onboarding-v2-DRAFT.md
+d3b9d955d81e53102c49930e9cfc66d2f8a2731a4c11dad5de452940368e0a8b  runbooks/tenant-onboarding-v2-DRAFT.md
 861c5274afd3290791aec15e8200ae39e07aa16f5ef28306bbc75358e4caffa9  scripts/tenant-acceptance.sh
 ad00be489480069d52df1b978be0360d7fb04dbf954a8cf487162872f2da0593  scripts/tenant-assert.sh
 619ba5a352ec423a1d0bf5ba919ae896d9ca09b7ce469485145a4c2df00b631f  scripts/tenant-offboard.sh
diff --git a/docs/changelog-20260709-dc-dc-repo-rename-sweep.md b/docs/changelog-20260709-dc-dc-repo-rename-sweep.md
new file mode 100644
index 0000000..904331e
--- /dev/null
+++ b/docs/changelog-20260709-dc-dc-repo-rename-sweep.md
@@ -0,0 +1,87 @@
+# Changelog 2026-07-09 -- DC-DC repo-rename sweep + repo-lint L1 Windows fix
+
+Delivered on the freshly-seeded `openstack-caracal-dc-dc` repo (seeded from
+`openstack-caracal-ipv4` at 8813efc). Executed under blanket approval; no live
+cloud mutation -- repo content only. Validation at packaging: repo-lint 0 fail
+/ 1 documented WARN; `tests/repo-lint` harness 29/29 (was 28/28; one case
+added); full `run-tests-all.sh` gauntlet shows pre-existing Windows-session
+environment gaps (missing `jq`, tty/exit-code quirks) unrelated to these
+changes -- `repo-lint`, the only touched suite, is ALL PASS standalone and in
+the gauntlet.
+
+## Items
+
+### 1. DOCFIX-139 -- stale `openstack-caracal-ipv4` references repaired to `openstack-caracal-dc-dc`
+FILES:
+- `.claude/skills/openstack-cloud-ops/SKILL.md` (repo name x2, clone path, clone
+  URL, session-bootstrap command)
+- `.claude/skills/openstack-cloud-ops/references/environment.md` (repo web +
+  clone URL)
+- `scripts/repo_lint.py` (module docstring only, cosmetic)
+- `runbooks/ops-update-procedure.md`, `runbooks/d011-batch3-window-DRAFT.md`,
+  `runbooks/phase-01-bundle-deploy.md`, `runbooks/tenant-onboarding-v2-DRAFT.md`
+  (hardcoded `~/openstack-caracal-ipv4` jumphost clone paths inside RUN blocks)
+- `clientdocs/sweep-receipt.txt` (L7 re-record; reviewed clientdocs/ for
+  drift from the tenant-onboarding-v2-DRAFT.md path edit -- no client-facing
+  file mirrors those internal jumphost lines, so no content change needed
+  there, only the pinned hash)
+
+WHY: repo was seeded under a new name for the DC-DC (VR1) phase
+(`docs/design-decisions.md` D-110); operational path/URL references still
+pointed at the old `openstack-caracal-ipv4` clone, which would 404 clones and
+break `source`/`cp`/`BUNDLE=` defaults in runbook RUN blocks on first live use.
+
+ASSUMPTION FLAGGED: the jumphost clone directory is assumed to be
+`~/openstack-caracal-dc-dc` (dir-name-equals-repo-name, matching the existing
+convention for the sibling repo). Not measured this session (no jumphost shell
+in this Windows working session) -- confirm on first live jumphost session.
+
+LEFT UNCHANGED (correct as historical/lineage record, not stale):
+- `docs/design-decisions.md` legacy D-014 entries + the new D-110 lineage note
+  ("seeded from openstack-caracal-ipv4")
+- `docs/dc-dc-buildout-design.md` lineage note (same commit-seed record)
+- `docs/v1-pre-deploy-fixes.md` (historical record of the *sibling* repo's own
+  2026-05-27 GitBucket-group move)
+- `runbooks/phase-08-workload-cluster-acceptance.md:340` (correctly refers to
+  flipping the *sibling* ipv4 repo private at ITS v1 close, SEC-004)
+- `scripts/repo_lint.py` STALE-token regex for `jesse\.austin/openstack-caracal-ipv4`
+  (an unrelated dead-path class from the pre-05-27 org move, still a live check)
+
+NOT actioned (flagged to operator, larger scope): `README.md` and
+`references/environment.md`'s body content still describe VR0 DC0/v1 single-DC
+scope wholesale (title, six-plane table, phase list) -- a content rewrite tied
+to the VR1 DC-DC design, not a name-swap. Awaiting direction.
+
+REVERT: `git checkout HEAD~ -- <file>` per file above (dropping
+`clientdocs/sweep-receipt.txt` back requires re-running
+`bash scripts/repo-lint.sh --record-clientdocs-sweep` afterward against the
+reverted tree, or L7 will FAIL on the mismatch).
+
+### 2. DOCFIX-140 -- repo_lint.py L1 Windows path-separator bug (WARN carve-out silently became FAIL)
+FILE: `scripts/repo_lint.py` (3 sites: L1 encoding check, L2 stale-token check,
+L3/L4/L6 runbook check -- all used `str(p.relative_to(R))`)
+
+WHY: found during session bootstrap -- `bash scripts/repo-lint.sh` reported
+`[FAIL] L1 docs\design-decisions.md: 239 non-ASCII byte(s)` where CLAUDE.md's
+documented bootstrap expectation is "0 fail (1 legacy WARN)". Root cause: the
+L1 carve-out compares `rel == "docs/design-decisions.md"` (forward slash
+literal) against `rel = str(p.relative_to(R))`, which yields backslashes on
+Windows (`docs\design-decisions.md`). The comparison never matched on this
+platform, so the documented legacy WARN silently escalated to FAIL. Confirmed
+this was NOT caused by the DC-DC design-doc commits (diffed: the 200 lines
+`docs/dc-dc-buildout-design.md`/2b2fa3f added contain zero non-ASCII bytes;
+the flagged 239 bytes are the pre-existing legacy D-001..018 content, unchanged
+today). Fixed by switching all three sites to `p.relative_to(R).as_posix()`,
+matching the convention already used elsewhere in the same file (L7/L8 checks).
+Also fixes cosmetic backslash-vs-forward-slash inconsistency in L2/L3/L4/L6
+message output on Windows.
+
+HARNESS: added T3b to `tests/repo-lint/run-tests.sh` -- plants an em-dash in a
+fixture's `docs/design-decisions.md` and asserts rc=2 (WARN) with the
+carve-out message, not rc=1 (FAIL). This exact carve-out path had no direct
+test before (only the non-carved-out FAIL case, T2, was covered), which is how
+the platform bug went unnoticed. 29/29 green after the change.
+
+REVERT: `git checkout HEAD~ -- scripts/repo_lint.py tests/repo-lint/run-tests.sh`
+(re-arms the Windows false-FAIL; not recommended for any Windows-based
+session).
diff --git a/docs/changelog-20260709-repo-agnostic-sweep.md b/docs/changelog-20260709-repo-agnostic-sweep.md
new file mode 100644
index 0000000..6dd3e09
--- /dev/null
+++ b/docs/changelog-20260709-repo-agnostic-sweep.md
@@ -0,0 +1,90 @@
+# Changelog 2026-07-09 -- repo-agnostic sweep + repo-lint L9 self-reference guard
+
+Follow-on to DOCFIX-139/140 (the mechanical ipv4->dc-dc rename sweep). This repo
+has now been renamed/forked twice in its short life (per D-110); rather than
+sweep by hand again next time, this delivery removes the remaining hardcoded
+self-references and adds a lint rule so a NEW hardcode can't land silently.
+Executed under blanket approval; no live cloud mutation -- repo content only.
+Validation: repo-lint 0 fail / 1 documented WARN; `tests/repo-lint` harness
+34/34 (was 29/29; 5 L9 cases added); full repo-wide grep for the current repo
+name across scripts/runbooks/skill confirms only the two deliberately-exempted
+environment.md fact lines remain.
+
+## Items
+
+### 1. DOCFIX-141 -- new repo-lint rule L9: self-reference (repo-agnostic guard)
+FILE: `scripts/repo_lint.py`
+
+WHAT: a new check that FAILS when a script/RUN-block/skill file hardcodes the
+CURRENT repo's own directory name (`R.name`) as a literal path/URL token.
+Scope: whole-file for `scripts/**/*.{sh,py}` and `.claude/hooks/*.{sh,py}`;
+fenced-code-block-only for `runbooks/*.md` (prose naming a repo -- including a
+sibling repo by name -- is harmless; only an executed literal is the hazard);
+whole-file for `.claude/skills/**/*.md` (agent-operational instructions, not
+incidental prose). Opt-out marker `repo-lint: allow-selfref` for a genuine,
+reviewed exception (mirrors the existing L2 `allow-stale-tokens` convention).
+
+WHY: this repo was seeded from `openstack-caracal-ipv4` this same week (D-110)
+and DOCFIX-139 was a manual, one-time grep-and-fix sweep for the resulting
+stale references. Nothing stopped a NEW hardcode from being written today, or
+stopped this same class of bug from recurring on the next fork/rename. A lint
+rule converts "remember to grep for this" into an enforced gate.
+
+SIDE FIX: `all_text()`'s `.claude` exclusion was narrowed from "skip all of
+`.claude/`" to "skip only `.claude/worktrees/`" (matching `.gitattributes`'
+own scoping of the worktree gitignore rule). The blanket exclusion meant
+`.claude/skills/` and `.claude/hooks/` -- both real, checked-in repo content,
+not session-local worktree copies -- were invisible to L1 (and now L9) lint
+entirely. Verified no new L1 findings from widening scope (checked non-ASCII/
+CR byte counts in all 6 newly-in-scope files before narrowing: all clean).
+
+HARNESS: `tests/repo-lint/run-tests.sh` T29-T33 (script hardcode FAILS, opt-out
+marker suppresses it, runbook prose outside a code block does NOT fire, runbook
+code-block hardcode FAILS, skill file hardcode FAILS). 34/34 green.
+
+KNOWN LIMITATION (logged, not actioned -- pre-existing, not introduced here):
+L9's runbook check inherits L3/L4/L6's `in_code` detection, which only
+recognizes triple-backtick fences. `runbooks/d011-batch3-window-DRAFT.md`
+(4-space-indented pseudo-code) and `runbooks/tenant-onboarding-v2-DRAFT.md`
+(`--- BEGIN block ... --- END block ---` comment delimiters) use different
+conventions and are NOT reached by L3/L4/L6/L9 at all -- confirmed by manually
+grepping both for the DOCFIX-139 hardcodes, which lint did not flag. This is a
+real, separate lint-coverage gap (affects the existing L3/L4/L6 checks too, not
+just the new L9), logged here rather than fixed, since generalizing in-code
+detection to arbitrary block conventions is its own scoped piece of work.
+DOCFIX candidate: either teach the checks to recognize indented/BEGIN-END
+blocks, or standardize all runbooks onto triple-backtick fences.
+
+REVERT: `git checkout HEAD~ -- scripts/repo_lint.py tests/repo-lint/run-tests.sh`
+(re-arms both the self-reference blind spot and the `.claude/skills` /
+`.claude/hooks` lint-invisibility; not recommended).
+
+### 2. DOCFIX-141 (cont.) -- self-reference removal across skill + 4 runbooks
+FILES:
+- `.claude/skills/openstack-cloud-ops/SKILL.md` -- frontmatter description,
+  Step 0 identity/discovery text (now: confirm identity via `git remote -v`
+  rather than guess a clone path; ask the operator for the clone URL rather
+  than hardcode one), session-bootstrap line (now references `$REPO`).
+- `.claude/skills/openstack-cloud-ops/references/environment.md` -- the repo
+  URL is KEPT (this file's stated purpose is documenting anchor facts, exactly
+  like its VIP/version/hostname entries -- re-verify before command-use, same
+  discipline as everything else here) but tagged `repo-lint: allow-selfref`
+  with an explicit rationale; added a `$REPO` convention pointer bullet.
+- `runbooks/README.md` -- new Conventions bullet establishing `$REPO`: set once
+  per session (`export REPO=$(git rev-parse --show-toplevel)` if already `cd`'d
+  into the clone, else `export REPO=~/<wherever you cloned it>`); every RUN
+  block that needs the repo path references `$REPO`, never a literal.
+- `runbooks/ops-update-procedure.md`, `runbooks/d011-batch3-window-DRAFT.md`,
+  `runbooks/phase-01-bundle-deploy.md`, `runbooks/tenant-onboarding-v2-DRAFT.md`
+  -- the same 8 hardcoded paths fixed mechanically in DOCFIX-139 (rename) are
+  now converted to `$REPO` (required, fails loud if unset -- no hardcoded
+  fallback guess, consistent with hard rule 2 "never use an inferred value").
+- `clientdocs/sweep-receipt.txt` (L7 re-record; reviewed for drift from the
+  tenant-onboarding-v2-DRAFT.md edit -- no client-facing mirror, hash-only).
+
+WHY: converts "the clone dir must be named exactly X" from an assumption baked
+into 8 command sites into one explicit, operator-stated session input --
+exactly the "measured or carried from confirmed as-built" standard hard rule 2
+already requires for every other value in this repo.
+
+REVERT: `git checkout HEAD~ -- <file>` per file above.
diff --git a/docs/session-ledger.md b/docs/session-ledger.md
index f612f12..c6ca554 100644
--- a/docs/session-ledger.md
+++ b/docs/session-ledger.md
@@ -21,18 +21,22 @@
 <!-- SECTION: machine-derived | OWNER: ledger-scan (regenerate; never hand-edit) -->
 ## Machine-derived (re-seed from `scripts/ledger-scan.sh`; do not hand-edit)
 
-_As of 2026-07-09 scan (post-addendum-54, DOCFIX-138); re-run the scan to refresh:_
+_As of 2026-07-09 scan (post-DOCFIX-140, new repo `openstack-caracal-dc-dc`);
+re-run the scan to refresh:_
 
 - **PROPOSED / OPEN decisions:** D-068 (Vault substrate hardening, Roosevelt -- 1.16
   ruled out per amendment; off-EOL path OPEN), D-071 (routine update cadence +
   controller patch policy -- operator to rule; gated on the pre-DC-DC HA/backup
-  session). _(D-050 RESOLVED/CLOSED 2026-07-06 via D-051; D-073 APPLIED live
-  2026-07-06 -- not scan-tracked as open.)_
+  session), D-100..D-110 (DC-DC/VR1 originating design -- ALL PROPOSED, awaiting
+  operator redline per `docs/dc-dc-buildout-design.md` Section 10/11). _(D-050
+  RESOLVED/CLOSED 2026-07-06 via D-051; D-073 APPLIED live 2026-07-06 -- not
+  scan-tracked as open. D-076..D-099 are a RESERVED source-project band, never
+  assigned in this repo, per D-110.)_
 - **OPEN security rows:** SEC-001 (rotate at v1 close, re-ruled 2026-07-06),
   SEC-003 (custodians + second-person unseal -- DEFERRED; keeps d011-06 MANUAL),
   SEC-004 (flip repo to private at v1 close -- deferral reaffirmed).
-- **Next-free numbers:** D = 076, DOCFIX = 139, BUNDLEFIX = 012.
-  (Seeded from the 2026-07-09 scan.)
+- **Next-free numbers:** D = 111, DOCFIX = 141, BUNDLEFIX = 012.
+  (Seeded from the 2026-07-09 scan, post repo-rename sweep.)
 
 ---
 
@@ -666,6 +670,52 @@
   handover pack with dev-team intake answers (7 questions in the DOCFIX-101
   entry). Also still open: foil1 Horizon manual checks (contract 5.1/5.3).
 
+## Jumphost stream -- session 2026-07-09: new repo `openstack-caracal-dc-dc` first load (repo-rename sweep)
+
+- **Environment note:** this session's shell is Windows (win32), not the Linux
+  jumphost (`vopenstack-jesse`) CLAUDE.md describes -- flagged to operator.
+  `run-tests-all.sh` gauntlet on this box shows 23/39 pre-existing failures
+  (missing `jq`, tty/exit-code quirks) unrelated to any change made this
+  session; `repo-lint` (the only suite touched) is ALL PASS standalone and in
+  the gauntlet. Confirm actual jumphost behavior at next Linux session.
+- **DONE -- DOCFIX-139 + DOCFIX-140 (changelog
+  `docs/changelog-20260709-dc-dc-repo-rename-sweep.md`):** repo-rename sweep
+  (stale `openstack-caracal-ipv4` path/URL references repaired to
+  `openstack-caracal-dc-dc` across the skill, 4 runbook RUN blocks, and the
+  repo_lint.py docstring; clientdocs L7 receipt re-recorded after confirming no
+  client-facing drift) + a real repo_lint.py bug fix (L1 Windows
+  path-separator: the `docs/design-decisions.md` legacy-carve-out comparison
+  used `str(p.relative_to(R))`, which never matches on Windows, so the
+  documented WARN silently became a FAIL -- fixed to `.as_posix()` at all 3
+  affected sites; harness gained T3b covering the carve-out path directly,
+  29/29 green). NOT actioned (flagged, larger scope): README.md and
+  environment.md's body content still describe VR0 DC0/v1 single-DC scope
+  wholesale -- awaiting operator direction on whether/when to rewrite for VR1
+  DC-DC. Uncommitted -- operator has not yet asked to commit.
+- **DONE -- DOCFIX-141 (changelog `docs/changelog-20260709-repo-agnostic-sweep.md`):**
+  operator asked to scope the "make scripts repo-agnostic" idea as its own
+  sweep + a lint rule, following directly from the DOCFIX-139/140 experience.
+  New repo-lint check L9 (self-reference guard) FAILS any script/RUN-block/
+  skill file that hardcodes the current repo's own directory name; added with
+  a 5-case harness (34/34 green). Along the way, narrowed `all_text()`'s
+  `.claude` exclusion from "skip all of `.claude/`" to "skip only
+  `.claude/worktrees/`" -- the blanket exclusion meant checked-in
+  `.claude/skills/` and `.claude/hooks/` content was invisible to lint
+  entirely (why the SKILL.md hardcode from DOCFIX-139 wasn't caught).
+  Established a `$REPO` session-variable convention (documented in
+  `runbooks/README.md` Conventions) and converted the 8 remaining hardcoded
+  clone-path references (SKILL.md + 4 runbooks) to require it explicitly
+  (fail loud if unset, no inferred fallback, per hard rule 2). environment.md's
+  repo URL is KEPT (documented anchor fact, same as its other facts) but
+  tagged with the new `repo-lint: allow-selfref` opt-out. LOGGED, NOT ACTIONED:
+  L3/L4/L6/L9 only recognize triple-backtick fences for "in code" detection;
+  `d011-batch3-window-DRAFT.md` (indented pseudo-code) and
+  `tenant-onboarding-v2-DRAFT.md` (BEGIN/END block comments) use different
+  conventions and are invisible to these checks -- a pre-existing gap, not
+  introduced here, DOCFIX candidate (teach the checks the other conventions,
+  or standardize runbooks onto fences). Uncommitted -- operator has not yet
+  asked to commit.
+
 <!-- END: jumphost -->
 
 <!-- SECTION: shared | OWNER: shared -- append-only; never rewrite another stream's line -->
diff --git a/runbooks/README.md b/runbooks/README.md
index a0a9233..fbbd4fc 100644
--- a/runbooks/README.md
+++ b/runbooks/README.md
@@ -25,6 +25,12 @@
 - **Dynamic lookups.** VIPs, project names, IDs, and version constellations are
   discovered at run time, not hardcoded. Site-specific literals are tagged `ENV(...)`
   for the eventual generalization pass toward Roosevelt.
+- **Repo clone path.** Never a literal (this repo has already been renamed/forked
+  once -- DOCFIX-139/141). Set `$REPO` once per session to your clone's root
+  (`export REPO=$(git rev-parse --show-toplevel)` if already `cd`'d into it, else
+  `export REPO=~/<wherever you cloned it>`); every RUN block that needs the repo
+  path below references `$REPO`, never a hardcoded name. `repo-lint` L9 fails a
+  script/RUN-block/skill file that hardcodes the current repo's own directory name.
 - **ASCII only.** All runbook content is ASCII (a mod_wsgi UnicodeDecodeError lesson);
   keep it that way on edit.
 
diff --git a/runbooks/d011-batch3-window-DRAFT.md b/runbooks/d011-batch3-window-DRAFT.md
index 5373468..ff5b59a 100644
--- a/runbooks/d011-batch3-window-DRAFT.md
+++ b/runbooks/d011-batch3-window-DRAFT.md
@@ -30,7 +30,9 @@
 
 ## 0. Window open (operator)
 
-    git -C ~/openstack-caracal-ipv4 pull
+    REPO="${REPO:?REPO not set -- export REPO=<path to your clone> (see runbooks/README.md Conventions)}"
+    cd "$REPO"
+    git pull
     bash scripts/repo-lint.sh                  # expect 0 fail / 1 legacy warn
     bash scripts/run-tests-all.sh              # ALL GREEN expected
     bash scripts/run-logged.sh d011-batch3
@@ -39,7 +41,7 @@
 ## 1. D-073 live apply (GATED mutation: keystone policy resource)
 
     # stage under $HOME -- the openstack/juju snaps cannot read /tmp
-    cp ~/openstack-caracal-ipv4/policies/overrides.zip ~/overrides-d073.zip
+    cp "$REPO/policies/overrides.zip" ~/overrides-d073.zip
     juju attach-resource -m openstack keystone policyd-override=~/overrides-d073.zip
     # wait for keystone workload message to show "PO:" (NOT "PO (broken):")
     juju status -m openstack keystone
diff --git a/runbooks/ops-update-procedure.md b/runbooks/ops-update-procedure.md
index 35077b3..c698201 100644
--- a/runbooks/ops-update-procedure.md
+++ b/runbooks/ops-update-procedure.md
@@ -63,7 +63,9 @@
 
 **RUN -- jumphost**
 ```bash
-git -C ~/openstack-caracal-ipv4 pull
+REPO="${REPO:?REPO not set -- export REPO=<path to your clone> (see runbooks/README.md Conventions)}"
+cd "$REPO"
+git pull
 bash scripts/repo-lint.sh
 bash scripts/run-logged.sh ops-update-$(date -u +%Y%m%d)
 ```
diff --git a/runbooks/phase-01-bundle-deploy.md b/runbooks/phase-01-bundle-deploy.md
index 84c36f1..0f397ba 100644
--- a/runbooks/phase-01-bundle-deploy.md
+++ b/runbooks/phase-01-bundle-deploy.md
@@ -333,7 +333,8 @@
   # vip triple), never a literal -- the old baked 10.12.4.233 went stale when R14
   # relocated the VIPs to .50-.60. Measured value is echoed; confirm it before
   # the sign. BUNDLE may be overridden if the hardened bundle lives elsewhere.
-  BUNDLE="${BUNDLE:-$HOME/openstack-caracal-ipv4/bundle.yaml}"
+  REPO="${REPO:?REPO not set -- export REPO=<path to your clone> (see runbooks/README.md Conventions)}"
+  BUNDLE="${BUNDLE:-$REPO/bundle.yaml}"
   [ -r "$BUNDLE" ] || { echo "FAIL: bundle not readable at $BUNDLE (set BUNDLE=)"; exit 1; }
   OCTAVIA_VIP=$(python3 -c "import yaml;print(yaml.safe_load(open('$BUNDLE'))['applications']['octavia']['options']['vip'].split()[0])" 2>/dev/null || true)
   echo "measured octavia provider VIP: ${OCTAVIA_VIP:-<none>}"
@@ -363,7 +364,7 @@
 ```bash
 ( {
   WORKDIR="$HOME/octavia-pki"; cd "$WORKDIR" || exit 1   # dir from 1.0-GEN.a
-  REPO="${REPO:-$HOME/openstack-caracal-ipv4}"   # adjust to the actual clone path
+  REPO="${REPO:?REPO not set -- export REPO=<path to your clone> (see runbooks/README.md Conventions)}"
   mkdir -p "$REPO/overlays"
   ISS_CERT=$(base64 -w0 issuing-ca/issuing-ca.cert.pem)
   ISS_KEY=$(base64 -w0 issuing-ca/issuing-ca.key.enc)
diff --git a/runbooks/tenant-onboarding-v2-DRAFT.md b/runbooks/tenant-onboarding-v2-DRAFT.md
index 87a02f9..ca8f665 100644
--- a/runbooks/tenant-onboarding-v2-DRAFT.md
+++ b/runbooks/tenant-onboarding-v2-DRAFT.md
@@ -336,10 +336,11 @@
 
 # 4.0 CIDR guard pre-check (D-074: reserved ranges + RFC1918 only; read-only as admin)
 # The old cloud-wide uniqueness check is retired -- overlap with other tenants is fine.
+: "${REPO:?REPO not set -- export REPO=<path to your clone> (see runbooks/README.md Conventions)}"
 source ~/admin-openrc
 CAPI_CIDR=$(openstack subnet show capi-mgmt-subnet -f value -c cidr </dev/null 2>&1)
-source ~/openstack-caracal-ipv4/scripts/lib-net.sh
-if python3 ~/openstack-caracal-ipv4/scripts/net_overlap.py "$TENANT_CIDR" "${PLANE_CIDRS[@]}" "$CAPI_CIDR" 169.254.169.254/32; then
+source "$REPO/scripts/lib-net.sh"
+if python3 "$REPO/scripts/net_overlap.py" "$TENANT_CIDR" "${PLANE_CIDRS[@]}" "$CAPI_CIDR" 169.254.169.254/32; then
   echo "$TENANT_CIDR clear of reserved ranges"; COLL=0
 else echo "*** $TENANT_CIDR rejected (reserved-range overlap or not RFC1918) -- STOP ***"; COLL=1; fi
 
diff --git a/scripts/repo_lint.py b/scripts/repo_lint.py
index 64d56bc..08f6374 100644
--- a/scripts/repo_lint.py
+++ b/scripts/repo_lint.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 """
-repo_lint.py -- static hygiene lint for the openstack-caracal-ipv4 repo (DOCFIX-074).
+repo_lint.py -- static hygiene lint for this repo (DOCFIX-074).
 
 Read-only. Catches the drift classes that accumulated silently between the D-052
 rebuild and the 2026-07-02 redeploy-readiness sweep (46 findings), so they are
@@ -42,6 +42,20 @@
                     kubernetes.md + troubleshooting.md) is reviewed for the same
                     update and the pin is re-recorded: bash scripts/repo-lint.sh
                     --record-guide-skill-coupling. Skipped when the guide is absent.
+  L9  self-ref      repo-agnostic guard (DOCFIX-141): a script/RUN-block/skill
+                    file must never hardcode the CURRENT repo's own directory
+                    name (a fork or rename breaks every hardcoded copy at once --
+                    this repo IS itself the second such rename). Scope: whole
+                    file for scripts/**/*.{sh,py}, .claude/hooks/*.{sh,py}, and
+                    .claude/skills/**/*.md (agent-operational, not incidental
+                    prose); fenced code blocks only for runbooks/*.md (prose
+                    naming a repo, incl. a SIBLING repo by name, is fine -- only
+                    an executed literal path/URL is the hazard). Opt out with
+                    'repo-lint: allow-selfref' in the file for a genuine,
+                    reviewed exception. Self-locate instead: BASH_SOURCE-derived
+                    $HERE in scripts (see scripts/repo-lint.sh), $REPO set once
+                    per session (via git rev-parse --show-toplevel or an
+                    explicit export) threaded through runbook RUN blocks.
 
 Exit: 0 clean | 1 FAIL findings | 2 warnings only.  ASCII + LF.
 Usage: python3 scripts/repo_lint.py [--record-clientdocs-sweep] [--record-guide-skill-coupling] [repo-root]
@@ -158,12 +172,13 @@
         skip_names = {"overrides.zip"}
         out = []
         for p in R.rglob("*"):
-            # .claude/ holds session-local agent worktrees (full repo copies:
-            # their design-decisions.md mirror trips the L1 carve-out, which
-            # keys on the exact repo-relative path) plus hooks config -- all
-            # non-repo-content; lint the repo, not the session (DOCFIX-111)
+            # .claude/worktrees/ holds session-local agent worktrees (full repo
+            # copies: their design-decisions.md mirror trips the L1 carve-out,
+            # which keys on the exact repo-relative path) -- session-local, not
+            # repo content (DOCFIX-111). The rest of .claude/ (hooks, skills) IS
+            # checked-in repo content and stays in scope for L1/L9.
             if not p.is_file() or ".git" in p.parts or "__pycache__" in p.parts \
-               or ".claude" in p.parts:
+               or (".claude" in p.parts and "worktrees" in p.parts):
                 continue
             if p.suffix.lower() == ".zip" or p.name in skip_names:
                 continue
@@ -174,7 +189,7 @@
     # ---- L1 encoding ----
     for p in all_text():
         data = p.read_bytes()
-        rel = str(p.relative_to(R))
+        rel = p.relative_to(R).as_posix()
         cr = data.count(b"\x0d")
         na = sum(1 for b in data if b > 127)
         if cr:
@@ -207,7 +222,7 @@
         if "repo-lint: allow-stale-tokens" in txt:
             continue
         lines = txt.splitlines()
-        rel = str(p.relative_to(R))
+        rel = p.relative_to(R).as_posix()
         for i, ln in enumerate(lines, 1):
             if EXEMPT.search(ln):
                 continue
@@ -215,7 +230,7 @@
                 if rx.search(ln):
                     fails.append("L2 %s:%d %s: %s" % (rel, i, why, ln.strip()[:80]))
 
-    # ---- L3 ghost script refs / L4 deprecated / L6 bare invocation ----
+    # ---- L3 ghost script refs / L4 deprecated / L6 bare invocation / L9 self-ref (runbooks) ----
     DEPRECATED = ["phase-00-teardown.sh", "phase-00-maas-recidr.sh",
                   "provider-vip-standup.sh", "d057-bundle-check.py",
                   "review-bundle.py",
@@ -224,11 +239,16 @@
                             re.IGNORECASE)
     ref_rx = re.compile(r"scripts/([a-z0-9_\-]+\.(?:sh|py))")
     bare_rx = re.compile(r"^(?!.*\b(?:bash|source|python3?)\b)[^#]*(?<![\w/.])(?:\./)?scripts/[a-z0-9_\-]+\.sh\b")
+    reponame = R.name
+    selfref_rx = re.compile(r"\b" + re.escape(reponame) + r"\b")
+    SELFREF_OPTOUT = "repo-lint: allow-selfref"
     rb_dir = R / "runbooks"
     for p in (sorted(rb_dir.glob("*.md")) if rb_dir.is_dir() else []):
-        rel = str(p.relative_to(R))
+        rel = p.relative_to(R).as_posix()
+        txt = p.read_text(errors="replace")
+        opted_out = SELFREF_OPTOUT in txt
         in_code = False
-        for i, ln in enumerate(p.read_text(errors="replace").splitlines(), 1):
+        for i, ln in enumerate(txt.splitlines(), 1):
             if ln.strip().startswith("```"):
                 in_code = not in_code
                 continue
@@ -242,6 +262,42 @@
             if in_code and bare_rx.search(ln):
                 fails.append("L6 %s:%d bare script invocation (no exec bits in repo; "
                              "use 'bash scripts/...'): %s" % (rel, i, ln.strip()[:70]))
+            if in_code and not opted_out and selfref_rx.search(ln):
+                fails.append("L9 %s:%d RUN block hardcodes the repo's own name %r -- "
+                             "use $REPO (session bootstrap), never a literal clone "
+                             "path/URL: %s" % (rel, i, reponame, ln.strip()[:70]))
+
+    # ---- L9 self-ref: scripts + hooks (whole file) ----
+    selfref_script_dirs = []
+    if (R / "scripts").is_dir():
+        selfref_script_dirs += list((R / "scripts").rglob("*.sh")) + list((R / "scripts").rglob("*.py"))
+    if (R / ".claude" / "hooks").is_dir():
+        selfref_script_dirs += list((R / ".claude" / "hooks").glob("*.sh")) \
+                             + list((R / ".claude" / "hooks").glob("*.py"))
+    for p in selfref_script_dirs:
+        rel = p.relative_to(R).as_posix()
+        txt = p.read_text(errors="replace")
+        if SELFREF_OPTOUT in txt:
+            continue
+        for i, ln in enumerate(txt.splitlines(), 1):
+            if selfref_rx.search(ln):
+                fails.append("L9 %s:%d hardcodes the repo's own name %r -- self-locate "
+                             "instead (BASH_SOURCE-derived $HERE, git rev-parse "
+                             "--show-toplevel): %s" % (rel, i, reponame, ln.strip()[:70]))
+
+    # ---- L9 self-ref: .claude/skills/ (whole file -- agent-operational, not incidental prose) ----
+    skill_dir = R / ".claude" / "skills"
+    if skill_dir.is_dir():
+        for p in skill_dir.rglob("*.md"):
+            rel = p.relative_to(R).as_posix()
+            txt = p.read_text(errors="replace")
+            if SELFREF_OPTOUT in txt:
+                continue
+            for i, ln in enumerate(txt.splitlines(), 1):
+                if selfref_rx.search(ln):
+                    fails.append("L9 %s:%d skill hardcodes the repo's own name %r -- "
+                                 "describe 'this repository' / discover via git remote, "
+                                 "never bake in the name: %s" % (rel, i, reponame, ln.strip()[:70]))
 
     # ---- L5 identifier numbering ----
     heads = collections.Counter()
diff --git a/tests/repo-lint/run-tests.sh b/tests/repo-lint/run-tests.sh
index 05545ac..ea29758 100644
--- a/tests/repo-lint/run-tests.sh
+++ b/tests/repo-lint/run-tests.sh
@@ -33,6 +33,9 @@
                               run 1 'L1 .*non-ASCII' "T2 L1 non-ASCII FAILS" "$D"
 D=$(mkrepo l1b); printf 'crlf line\r\n' >> "$D/scripts/real.sh"
                               run 1 'L1 .*CR byte' "T3 L1 CRLF FAILS" "$D"
+D=$(mkrepo l1d); printf 'line with \xe2\x80\x94 dash\n' >> "$D/docs/design-decisions.md"
+                              run 2 'L1 docs/design-decisions.md.*non-ASCII.*legacy D-001\.\.018 carve-out' \
+                                    "T3b L1 design-decisions.md carve-out WARNs (not FAILs)" "$D"
 D=$(mkrepo l2); printf 'bind to provider-vip here\n' >> "$D/runbooks/phase-x.md"
                               run 1 'L2 .*retired space' "T4 L2 stale space FAILS" "$D"
 D=$(mkrepo l2b); printf 'the provider-vip plane is retired (D-060)\n' >> "$D/runbooks/phase-x.md"
@@ -46,6 +49,22 @@
 D=$(mkrepo l6); printf '```bash\nscripts/real.sh --apply\n```\n' >> "$D/runbooks/phase-x.md"
                               run 1 'L6 .*bare script invocation' "T9 L6 bare invoke FAILS" "$D"
 
+# ---- L9 self-reference (repo-agnostic guard, DOCFIX-141) ----
+D=$(mkrepo l9a); printf 'REPO="$HOME/l9a"\n' >> "$D/scripts/real.sh"
+                              run 1 'L9 scripts/real.sh.*hardcodes the repo.s own name' \
+                                    "T29 L9 script hardcodes own repo name FAILS" "$D"
+D=$(mkrepo l9b); printf 'REPO="$HOME/l9b"  # repo-lint: allow-selfref\n' >> "$D/scripts/real.sh"
+                              run 0 'PASS: repo lint' "T30 L9 opt-out marker suppresses script self-ref" "$D"
+D=$(mkrepo l9c); printf 'This runbook applies to the l9c repository.\n' >> "$D/runbooks/phase-x.md"
+                              run 0 'PASS: repo lint' "T31 L9 runbook prose mention (outside code block) does NOT fire" "$D"
+D=$(mkrepo l9d); printf '\n```bash\ncd ~/l9d\n```\n' >> "$D/runbooks/phase-x.md"
+                              run 1 'L9 runbooks/phase-x.md.*RUN block hardcodes the repo.s own name' \
+                                    "T32 L9 runbook code-block hardcode FAILS" "$D"
+D=$(mkrepo l9e); mkdir -p "$D/.claude/skills/foo"
+printf '# skill\nThe repo l9e is authoritative.\n' > "$D/.claude/skills/foo/SKILL.md"
+                              run 1 'L9 .claude/skills/foo/SKILL.md.*skill hardcodes the repo.s own name' \
+                                    "T33 L9 skill file hardcodes own repo name FAILS" "$D"
+
 # ---- L7 clientdocs sweep-on-change receipt (DOCFIX-104) ----
 mkcd() { # mkcd <name> -> clean fixture WITH clientdocs + tenant-facing files
   local d; d=$(mkrepo "$1")