diff --git a/docs/changelog-20260710-sweep-script-fixes.md b/docs/changelog-20260710-sweep-script-fixes.md
new file mode 100644
index 0000000..3efadf6
--- /dev/null
+++ b/docs/changelog-20260710-sweep-script-fixes.md
@@ -0,0 +1,117 @@
+# Changelog 2026-07-10 -- Full-project sweep: script logic bugs + security hardening (DOCFIX-173)
+
+No live infrastructure touched. Part of the full-project sweep (see
+DOCFIX-170 for overall scope). A dedicated agent read every `.sh` file
+under `scripts/` and found 4 confirmed logic bugs, all independently
+reproduced in isolation before being trusted -- the same discipline that
+caught the `dc-dc-prefixes-import` test bug earlier tonight. A separate
+security-audit agent found 1 real hardening gap in a script built
+earlier tonight.
+
+**Notable process point:** the FIRST proposed fix for one of these bugs
+(`scripts/phase-06-capi-stack.sh`) was itself WRONG, caught before
+committing by reproducing it in isolation: `... | cmd || true` after a
+failing pipeline, under `pipefail`, silently DISCARDS the pipeline's real
+`PIPESTATUS` array and replaces it with `true`'s own trivial exit status
+(0) -- meaning the fix would have made the script's own "GATE FAIL" check
+never fire again, silently treating every remote failure as success. That
+is WORSE than the original bug (a loud-but-blind abort vs. a silent
+false-pass). The correct fix uses the `if pipeline; then :; fi` idiom
+instead, verified via the same reproduction technique before committing.
+
+## Items (all confirmed via isolated `bash -c` reproduction, not asserted)
+
+### 1. `scripts/carve-host-interfaces.sh` -- `emit()`'s `return 1` killed apply-mode runs on the first MAAS error
+Every call site invokes `emit` as a bare, unguarded statement under this
+file's `set -euo pipefail`. `emit()`'s own `fail()` call already does the
+FATAL-count accounting its caller needs; the subsequent `return 1` was
+never consumed by any caller, and under `set -e` it terminated the WHOLE
+SCRIPT immediately on the first real MAAS mutation failure -- before
+`carve_raw`'s later plane carves, the "resulting interface tree"
+verification, or the final "Summary: N fatal" line could run, even though
+the script's own design (a FATAL accumulator + end-of-run summary) clearly
+intends to report the full picture after a partial failure. Fixed by
+removing the redundant `return 1` (with a comment explaining why, to
+prevent reintroduction).
+
+### 2. `scripts/phase-06-capi-stack.sh` -- `run_step`'s `PIPESTATUS` read was dead code
+`ssh ... | sed 's/^/  /'` as a bare statement under `set -euo pipefail`:
+a real ssh failure makes the pipeline itself fail (via `pipefail`), which
+triggers `set -e` and kills the script at THAT line, before
+`local rc=${PIPESTATUS[0]}` on the next line is ever reached -- so the
+function's own "GATE FAIL: `<label>` (remote rc=N)" diagnostic, used for
+all six phase-06 CAPI-stack sub-steps, was dead code; a real remote
+failure just aborted with ssh's raw exit code and no labeled context.
+Fixed with the verified `if pipeline; then :; fi` idiom (see the process
+note above for why the more obvious `|| true` fix was wrong).
+
+### 3. `scripts/juju-spaces-check.sh` -- one unguarded display-only pipe
+`echo "$SPJSON" | jq -r '.spaces[].name' | sort | sed 's/^/    /'` was the
+SOLE exception to this file's otherwise-consistent `|| true`-guarding of
+every other juju/jq call (the file's own DOCFIX-115 comment documents
+awareness of exactly this hazard). If `.spaces` is null/absent -- a
+genuinely empty freshly-added model, the exact scenario this script is
+meant to run against -- `jq` fails, `pipefail` propagates it, and the bare
+pipeline kills the script before the SPACES6 FATAL-accumulation loop runs.
+Fixed with `|| true` (safe here, unlike case #2 above: this line is
+PURELY for display, and the `HAVE` array used by the actual pass/fail
+logic is built by its own, separate, independent `jq` call on the next
+line -- nothing needs this line's `PIPESTATUS`).
+
+### 4. `scripts/osd-blank-check.sh` -- same class, lower likelihood
+`echo "$info" | grep -E 'virtual size|disk size' | sed 's/^/  /'`,
+unguarded, same `set -euo pipefail` hazard as #3. Low likelihood in
+practice (`qemu-img info`'s standard fields make a total match-miss
+unlikely) but the same bug class as three other confirmed instances in
+this same sweep -- fixed with `|| true` for consistency/defense in depth
+(same safety reasoning as #3: nothing downstream needs this line's exit
+status).
+
+### 5. `scripts/ledger-scan.sh` -- DOCFIX/BUNDLEFIX next-free regex, dormant landmine
+`nextfree_mentions 'DOCFIX-[0-9]{3}' ...` and the `BUNDLEFIX` equivalent
+used a FIXED `{3}` quantifier, not `{3,}` -- the exact same bug class this
+repo already got bitten by once for the D-series (a fixed-width pattern
+going blind at a digit-count boundary; that incident's own fix, `{3,}`,
+was never mirrored onto the DOCFIX/BUNDLEFIX patterns in this file).
+Reproduced: `echo "DOCFIX-1004" | grep -oE 'DOCFIX-[0-9]{3}' | grep -oE
+'[0-9]+'` yields `100`, truncating a 4-digit number and silently proposing
+an already-used next-free number. Not yet reachable (repo is at
+DOCFIX-17x as of this fix) but a real, confirmed-via-reproduction dormant
+landmine. Fixed to `{3,}`, matching `repo_lint.py`'s own L5 check
+convention. Re-verified `bash scripts/ledger-scan.sh` still reports the
+correct current next-free numbers after the fix.
+
+### 6. `scripts/dc-dc-rbd-mirror.sh` -- bootstrap token file hardening (security)
+Flagged by the security-audit agent: the default rbd-mirror bootstrap
+token path (`TOKEN_OUT`) was a fixed, predictable filename in world-
+writable `/tmp` on the remote unit, with no `chmod` applied after
+creation -- inheriting the remote user's default umask (commonly 0644,
+world-readable). This token is genuinely secret-adjacent material (it
+"grants cluster access" per the script's own header comment). Fixed: the
+default path now includes 4 random bytes from `/dev/urandom` (falling
+back to the script's own PID if `/dev/urandom`/`od` are unavailable), and
+the remote command now `chmod 600`s the file immediately after creation,
+in the SAME command (via `&&`), closing the window where it could be
+briefly world-readable. Updated the script's own "transfer OUT OF BAND"
+reminder to describe the hardened posture and to remind the operator to
+remove the file from the source unit after transfer.
+
+## Verification
+
+`bash scripts/repo-lint.sh`: 0 fail, 1 documented legacy warn. `bash
+tests/dc-dc-rbd-mirror/run-tests.sh`: 19/19 PASS (unaffected by the token-
+path hardening -- no test hardcodes the exact old path/command string).
+Every fix above was independently reproduced via an isolated `bash -c`
+snippet BEFORE being applied to the real file, confirming both that the
+bug is real and that the chosen fix actually resolves it (not just
+"looks right") -- full reproduction transcripts are in this session's own
+working history, not restated here. Full test gauntlet re-run: 23/51
+FAILED, identical pre-existing environment gaps as every prior check
+tonight (jq missing on this workstation) -- zero regressions, including
+`phase-06-capi-stack`'s own harness (`ALL PASS`).
+
+REVERT: `git checkout HEAD~ -- scripts/carve-host-interfaces.sh
+scripts/phase-06-capi-stack.sh scripts/juju-spaces-check.sh
+scripts/osd-blank-check.sh scripts/ledger-scan.sh
+scripts/dc-dc-rbd-mirror.sh` (safe -- all six are logic/hardening fixes
+with no behavior change for the success path).
diff --git a/scripts/carve-host-interfaces.sh b/scripts/carve-host-interfaces.sh
index 60393f5..321fde5 100644
--- a/scripts/carve-host-interfaces.sh
+++ b/scripts/carve-host-interfaces.sh
@@ -122,7 +122,18 @@
     if ! out="$(maas "$MAAS_PROFILE" "$@" 2>&1)"; then
       fail "$desc"
       echo "       MAAS said: $(printf '%s' "$out" | grep -viE '^(Success|Machine-readable)' | head -3 | tr '\n' ' ')" >&2
-      return 1
+      # FIXED 2026-07-10 (full-project sweep): this used to `return 1` here.
+      # Every call site below invokes emit() as a bare, unguarded statement,
+      # and this file runs under `set -euo pipefail` -- a bare function call
+      # returning non-zero terminates the WHOLE script immediately, before
+      # the FATAL-accumulator's own "Summary: N fatal" line (and the exit-1
+      # gate that follows it) ever runs. `fail()` two lines up already does
+      # the accounting this function's caller needs; nothing downstream
+      # checks emit()'s own return value, so returning non-zero here bought
+      # nothing except silently truncating apply-mode runs on the FIRST
+      # MAAS error instead of reporting the full carve-attempt picture.
+      # Do not reintroduce `return 1` here without also either wrapping
+      # every call site in `|| true` or removing `set -e` for this function.
     fi
   else
     echo "  WOULD: $desc"
diff --git a/scripts/dc-dc-rbd-mirror.sh b/scripts/dc-dc-rbd-mirror.sh
index 2983cb9..2876abf 100644
--- a/scripts/dc-dc-rbd-mirror.sh
+++ b/scripts/dc-dc-rbd-mirror.sh
@@ -85,7 +85,7 @@
 
 DC=""; MODEL="${MODEL:-openstack}"; UNIT=""; APPLY=0
 POOL=""; SITE_NAME=""; DIRECTION=""
-TOKEN_OUT="/tmp/rbd-mirror-bootstrap-token"
+TOKEN_OUT="/tmp/rbd-mirror-bootstrap-token.$(od -An -N4 -tx1 /dev/urandom 2>/dev/null | tr -d ' \n' || echo "$$")"
 TOKEN_IN=""
 
 while [ $# -gt 0 ]; do
@@ -149,7 +149,7 @@
 case "$SUBCMD" in
   bootstrap-primary)
     SSH_CMDS+=("rbd mirror pool enable $POOL image")
-    SSH_CMDS+=("rbd mirror pool peer bootstrap create --site-name $SITE_NAME $POOL > $TOKEN_OUT")
+    SSH_CMDS+=("rbd mirror pool peer bootstrap create --site-name $SITE_NAME $POOL > $TOKEN_OUT && chmod 600 $TOKEN_OUT")
     ;;
   bootstrap-secondary)
     SSH_CMDS+=("rbd mirror pool enable $POOL image")
@@ -164,7 +164,7 @@
   note "STEP $n: juju ssh -m $MODEL $UNIT -- \"$cmd\""
 done
 if [ "$SUBCMD" = "bootstrap-primary" ]; then
-  note "NOTE: the token now lives at $TOKEN_OUT ON THE REMOTE UNIT -- transfer it to the DC2 unit OUT OF BAND (never printed/piped through this session), then run bootstrap-secondary there"
+  note "NOTE: the token now lives at $TOKEN_OUT ON THE REMOTE UNIT, chmod 600'd immediately after creation (random-suffixed path, not a fixed guessable name) -- transfer it to the DC2 unit OUT OF BAND (never printed/piped through this session), then run bootstrap-secondary there, then remove it from this unit"
 fi
 
 if [ "$APPLY" -ne 1 ]; then
diff --git a/scripts/juju-spaces-check.sh b/scripts/juju-spaces-check.sh
index 1a32281..4b26fea 100644
--- a/scripts/juju-spaces-check.sh
+++ b/scripts/juju-spaces-check.sh
@@ -50,7 +50,19 @@
 echo
 echo "=== spaces in model '$MODEL' (want six; none of the five stale) ==="
 SPJSON="$(juju spaces -m "$MODEL" --format json)" || { fail "juju spaces failed (auth/macaroon? re-login or append </dev/tty)"; echo; echo "Summary: 1 fatal"; exit 1; }
-echo "$SPJSON" | jq -r '.spaces[].name' | sort | sed 's/^/    /'
+# FIXED 2026-07-10 (full-project sweep): appended `|| true`. This file runs
+# under `set -e`+pipefail (see the DOCFIX-115 comment elsewhere in this
+# file about this exact hazard) -- every other juju/jq call here is already
+# `|| true`-guarded, this one line was the sole exception. If `.spaces` is
+# null/absent (a genuinely empty freshly-added model -- exactly the
+# scenario this script is meant to be run against), jq exits non-zero,
+# pipefail propagates it, and the bare pipeline kills the whole script
+# before the SPACES6 FATAL-accumulation loop below ever runs. Safe to use
+# `|| true` here specifically (unlike a case needing PIPESTATUS
+# afterward): this line is PURELY for display, and the HAVE array used by
+# the actual pass/fail logic below is built by its own, independent jq
+# call (the next line), not by inspecting this line's exit status.
+echo "$SPJSON" | jq -r '.spaces[].name' | sort | sed 's/^/    /' || true
 
 mapfile -t HAVE < <(echo "$SPJSON" | jq -r '.spaces[].name')
 have_has() { local x; for x in "${HAVE[@]}"; do [ "$x" = "$1" ] && return 0; done; return 1; }
diff --git a/scripts/ledger-scan.sh b/scripts/ledger-scan.sh
index 20aa291..0c3287c 100644
--- a/scripts/ledger-scan.sh
+++ b/scripts/ledger-scan.sh
@@ -106,11 +106,19 @@
   DHI="$(grep -oE '^## D-[0-9]+' "$DD" | grep -oE '[0-9]+' | sort -n | tail -1)"
   if [ -n "$DHI" ]; then printf '  D: highest-header=%s  next-free=%03d\n' "$DHI" "$((10#$DHI + 1))"; else echo "  D: none"; fi
 else echo "  D: design-decisions.md not found"; fi
-# [0-9]{3}: the old 0[0-9]{2} pattern went blind at the 100 boundary
+# [0-9]{3,}: the old 0[0-9]{2} pattern went blind at the 100 boundary
 # (DOCFIX-100+ invisible -> next-free frozen at 100; hit live 2026-07-06,
-# fixed as DOCFIX-105)
-nextfree_mentions 'DOCFIX-[0-9]{3}' "DOCFIX"
-nextfree_mentions 'BUNDLEFIX-[0-9]{3}' "BUNDLEFIX"
+# fixed as DOCFIX-105). FIXED 2026-07-10 (full-project sweep): a fixed
+# [0-9]{3} (not {3,}) is the SAME bug class one boundary further out --
+# DOCFIX-1000+ would truncate to its first 3 digits (e.g. "DOCFIX-1004"
+# matches "DOCFIX-100", silently proposing an already-used next-free
+# number). Not yet reachable (repo is at DOCFIX-16x as of this fix), but a
+# real, confirmed-via-reproduction dormant landmine of the exact class
+# already fixed once for the D-series (repo_lint.py's L5 check already
+# uses [0-9]{3,}) -- this file's own DOCFIX/BUNDLEFIX patterns were never
+# updated to match.
+nextfree_mentions 'DOCFIX-[0-9]{3,}' "DOCFIX"
+nextfree_mentions 'BUNDLEFIX-[0-9]{3,}' "BUNDLEFIX"
 
 echo "-- reconcile against docs/session-ledger.md --"
 if [ -r "$REPO/docs/session-ledger.md" ]; then
diff --git a/scripts/osd-blank-check.sh b/scripts/osd-blank-check.sh
index 5379ab4..426d7b8 100644
--- a/scripts/osd-blank-check.sh
+++ b/scripts/osd-blank-check.sh
@@ -25,7 +25,17 @@
   echo "== $h ($img) =="
   if [ ! -f "$img" ]; then echo "  FAIL: image not found"; RC=2; continue; fi
   info="$(sudo qemu-img info "$img")"
-  echo "$info" | grep -E 'virtual size|disk size' | sed 's/^/  /'
+  # FIXED 2026-07-10 (full-project sweep): appended `|| true`. This file runs
+  # under `set -euo pipefail` (line 11) -- if a real `qemu-img info` output
+  # ever lacked both matched strings, grep would exit non-zero, pipefail
+  # would propagate it, and this bare pipeline (inside the per-host loop)
+  # would kill the WHOLE SCRIPT mid-loop rather than reaching the correctly
+  # guarded gate logic below (lines 29-33, which do their own independent
+  # awk extraction and don't depend on this line's exit status). Low
+  # likelihood in practice (qemu-img's standard fields make this unlikely
+  # to fire) but the same unguarded-pipe class as two other confirmed bugs
+  # found in this same sweep -- fixed for consistency and defense in depth.
+  echo "$info" | grep -E 'virtual size|disk size' | sed 's/^/  /' || true
   dsize="$(echo "$info" | awk -F': ' '/disk size/{print $2; exit}')"
   case "$dsize" in
     *KiB*|*bytes*) : ;;
diff --git a/scripts/phase-06-capi-stack.sh b/scripts/phase-06-capi-stack.sh
index e5f8e6e..8f01015 100644
--- a/scripts/phase-06-capi-stack.sh
+++ b/scripts/phase-06-capi-stack.sh
@@ -51,7 +51,31 @@
 run_step() {
   local label="$1"; shift
   echo "=== $label ==="
-  ssh "${SSH_OPTS[@]}" ubuntu@"$MGMT_VM" bash -s "$@" 2>&1 | sed 's/^/  /'
+  # FIXED 2026-07-10 (full-project sweep). This file runs under
+  # `set -euo pipefail` (line 29). The ORIGINAL code (a bare
+  # `ssh ... | sed ...` statement) had a real bug: a failing pipeline
+  # triggers `set -e` and kills the WHOLE SCRIPT right here, before
+  # `local rc=${PIPESTATUS[0]}` on the next line is ever reached -- so this
+  # function's own "GATE FAIL: <label> (remote rc=N)" diagnostic, used for
+  # all six phase-06 sub-steps, was dead code; a real remote failure just
+  # aborted with ssh's raw exit code and no labeled context.
+  #
+  # A first attempted fix (`... | sed ... || true`) was ITSELF WRONG and was
+  # caught before committing, by reproducing it in isolation: under
+  # `pipefail`, appending `|| true` to a failing pipeline causes bash to
+  # DISCARD the pipeline's real per-command PIPESTATUS array and replace it
+  # with `true`'s own trivial exit status (0) -- so `$rc` would ALWAYS read
+  # 0 and the gate would never fire, silently treating every remote failure
+  # as success. That is worse than the original bug (a loud but blind
+  # abort vs. a silent false-pass). Confirmed via a real subprocess
+  # reproduction, not just the simpler `false | cmd` case, which does NOT
+  # show this loss and would have hidden the problem.
+  #
+  # The correct, verified idiom: use the pipeline as an `if` condition
+  # (POSIX/bash's own standard way to exempt one command from `errexit`
+  # while still inspecting its result afterward) -- PIPESTATUS is preserved
+  # correctly this way, confirmed via the same reproduction technique.
+  if ssh "${SSH_OPTS[@]}" ubuntu@"$MGMT_VM" bash -s "$@" 2>&1 | sed 's/^/  /'; then :; fi
   local rc=${PIPESTATUS[0]}
   [ "$rc" -eq 0 ] || { echo "GATE FAIL: $label (remote rc=$rc)" >&2; exit 1; }
   echo "[OK] $label"