diff --git a/.claude/skills/openstack-cloud-ops/SKILL.md b/.claude/skills/openstack-cloud-ops/SKILL.md
index 18b330a..0fe1d05 100644
--- a/.claude/skills/openstack-cloud-ops/SKILL.md
+++ b/.claude/skills/openstack-cloud-ops/SKILL.md
@@ -101,7 +101,10 @@
 
 ## Standard loops (repeatable session shapes)
 
-**Session bootstrap (jumphost):** `git -C "$REPO" pull` (set `$REPO` once per
+**Session bootstrap (jumphost):** Claude Code sessions launch from the repo
+root, always (GA-R7 rule 6 -- a session launched from a subdirectory gets its
+own empty project dir and a divergent auto-memory; the GA-F06 origin).
+`git -C "$REPO" pull` (set `$REPO` once per
 session -- see `runbooks/README.md` Conventions / `references/environment.md`) ->
 `bash scripts/repo-lint.sh` (0 fail expected) -> if touching the live cloud,
 `bash scripts/run-logged.sh <label>` to open the logged shell. Repo HEAD and a
diff --git a/docs/CURRENT-STATE.md b/docs/CURRENT-STATE.md
index f5dac9a..0c73a00 100644
--- a/docs/CURRENT-STATE.md
+++ b/docs/CURRENT-STATE.md
@@ -202,7 +202,7 @@
 |---|------|----------------|-------|---------------------------|
 | G1 | Audit Phase 3: fresh-agent grounding test | [V] 3 clean-context probes score the 7-question set against this doc; holes map made | session | CLOSED 2026-07-18: 3 probes, 21/21 PASS, holes H1 (amended into G9) + H2 (no action) -- `docs/audit/phase3-grounding-test-20260718.md` |
 | G2 | Audit Phase 4: GA-R1..R7 structural rulings + the stage-status vocabulary A/B | [R] ruling-type gate (GA-R6 rule 6): closes when every item carries a GA-R5 Status block | operator | CLOSED 2026-07-18: all seven GA-R + vocabulary (Option A + H1) RATIFIED, utterances quoted (`docs/audit/ga-rulings.md`, through commit `fe4f1c4` + this one) |
-| G3 | Audit Phase 5: repair sweep of GA-F01..F15 (incl. memory hygiene GA-F05..F08, skill sweep) | [R] operator-gated fix batches, each commit naming its GA-F | operator + session | Batch 0 OPENED by operator 2026-07-19; items 0.1 (repo-lint L10, GA-R1/C1), 0.2 (SEC repoint, GA-R4/F3), 0.3 (counter hardening, GA-F15), 0.4 (extractor vocab scan, GA-F10/H1) landed; Batch 0 CLOSED (verification passed 2026-07-19); Batches 0-2 CLOSED 2026-07-19 (Batch 2: items 2.1-2.10 landed per-GA-F incl. two operator rulings -- D-tags + R3-F disposition; live-surface vocab flags 0; residual extractor groups are history-class or mechanical, adjudication in the session changelog); Batches 3-6 await gates; Batches 2-6 await gates; FREEZE holds for un-gated surfaces |
+| G3 | Audit Phase 5: repair sweep of GA-F01..F15 (incl. memory hygiene GA-F05..F08, skill sweep) | [R] operator-gated fix batches, each commit naming its GA-F | operator + session | Batch 0 OPENED by operator 2026-07-19; items 0.1 (repo-lint L10, GA-R1/C1), 0.2 (SEC repoint, GA-R4/F3), 0.3 (counter hardening, GA-F15), 0.4 (extractor vocab scan, GA-F10/H1) landed; Batch 0 CLOSED (verification passed 2026-07-19); Batches 0-3 CLOSED 2026-07-19 (Batch 3: memory hygiene -- GA-F06/F07 files removed per provenance rulings, index rebuilt, skill line added, G1 review zero violations, new finding GA-F16 registered+fixed; pre-edit copies docs/archive/memory-20260718/); Batches 4-6 await gates; Batches 2-6 await gates; FREEZE holds for un-gated surfaces |
 | G4 | The two D-130 verifications | [V] run them, capture output | session | CLOSED 2026-07-19: v8 suppression CONFIRMED (7/2/7 -> 6/2/6, zero forces-replacement; `docs/audit/outer-plan-20260719-v8-ignorechanges.txt` + `-baseline.txt`); v7 no-bounce under running domain, zero residue (`docs/audit/throwaway-v7-20260719.txt`) |
 | G5 | D-130 mechanism ruling (seed-volume durable fix) | [R] operator rules in Phase 5, quoting G4's captured output | operator | CLOSED 2026-07-19: D-130 ADOPTED (a) ignore_changes (`docs/design-decisions.md` D-130, GA-R5 utterance quoted); implemented in `modules/cloudinit-vm` + `tests/cloudinit-vm` |
 | G6 | State reconcile of autostart + seed WITHOUT bouncing guests | [R] gated mechanism, operator-ruled (S3) | operator | CLOSED 2026-07-19: ruled (ii) state surgery (GA-R5); pull -> inject autostart:true on both domains -> push (serial 22->23, backup `terraform.tfstate.pre-G6-20260719`); guests never touched (ids 1/2 unchanged, running) |
diff --git a/docs/archive/memory-20260718/MEMORY.md b/docs/archive/memory-20260718/MEMORY.md
new file mode 100644
index 0000000..473f678
--- /dev/null
+++ b/docs/archive/memory-20260718/MEMORY.md
@@ -0,0 +1,6 @@
+# Memory index
+
+- [Creds folder convention](creds-folder-convention.md) -- per-site `~/<site>-creds/` consolidation; no loose env files; DC folders follow the pattern
+- [Project posture: closed test](project-posture-closed-test.md) -- VR1 is a closed in-house test; prioritize deployment tooling/runbooks over real-world security (deferred to post-teardown)
+- [Multi-workstation / Remote Control](multi-workstation-remote-control.md) -- operator hops workstations, drives ONE live jumphost session via Remote Control; attach never `--resume`; cloud mutations stay gated even during batch
+- [Review after each step](review-after-each-step.md) -- on multi-step work, operator wants a grounding review (validate + drift sweep + cross-check) after EVERY step, not just checkpoints
diff --git a/docs/archive/memory-20260718/creds-folder-convention.md b/docs/archive/memory-20260718/creds-folder-convention.md
new file mode 100644
index 0000000..a4277f8
--- /dev/null
+++ b/docs/archive/memory-20260718/creds-folder-convention.md
@@ -0,0 +1,32 @@
+---
+name: creds-folder-convention
+description: "Per-site credential/env consolidation on vcloud -- ~/<site>-creds/ folders, no loose env files"
+metadata: 
+  node_type: memory
+  type: project
+  originSessionId: 75c0e0cb-822c-4f42-ab63-04d3175865f4
+---
+
+All sensitive files AND environment/config files for a VR1 site live in ONE per-site folder on
+vcloud: `~/<site>-creds/` (dir 0700, files 0600, public keys 0644). NO loose `*.env` in `~`.
+
+- `~/vr1-office1-creds/` exists: SSH key, OPNsense api/root creds, tailscale key, and the env files
+  `vr1-netbox.env` (upstream/v1-draft NetBox token), `vr1-office1.env` (edge config), `vr1-stage1.env`
+  (OpenTofu `TF_VAR_*`, incl. `TF_VAR_maas_api_key`).
+- When DC deployment starts, `~/vr1-dc0-creds/` and `~/vr1-dc1-creds/` follow the SAME pattern FROM
+  DAY ONE -- do not let `vr1-dc0*.env` accumulate loose in `~` and consolidate later.
+- PER-ENV ACCESS KEY (D-126, operator ruling 2026-07-16): each env gets its OWN SSH access key in its
+  own creds folder -- office1 uses `office1_svc_ed25519` (~/vr1-office1-creds/, one key across office1's
+  3 VMs); each DC gets a DEDICATED key (`~/vr1-dc0-creds/`, `~/vr1-dc1-creds/`), NOT office1's, for
+  per-env blast-radius isolation. DC keys are minted at DC deploy (pubkey -> DC cloud-init), not early.
+  The agent reaches these via `scripts/site-ssh-config.sh` (ssh_config ProxyJump aliases; office1 shell
+  access EXERCISED/working). See [[review-after-each-step]] discipline when adding DC rows.
+
+This is a DATA-LOSS / continuity control first, security second: scattered creds get lost between
+sessions and after compaction. Established 2026-07-15 (SEC-009) after three env files were found
+loose in `~`, one (`vr1-stage1.env`) holding a MAAS API key at world-readable 0664.
+
+The SANDBOX NetBox token is NOT on vcloud -- it lives on office1-netbox at `/root/netbox-secrets/`
+(v2 wire form `nbt_<key>.<plaintext>`). `vr1-netbox.env` is the UPSTREAM token only.
+
+Ties to [[project-posture-closed-test]] (why security hygiene is data-loss-framed, not lockdown).
diff --git a/docs/archive/memory-20260718/multi-workstation-remote-control.md b/docs/archive/memory-20260718/multi-workstation-remote-control.md
new file mode 100644
index 0000000..ebf971b
--- /dev/null
+++ b/docs/archive/memory-20260718/multi-workstation-remote-control.md
@@ -0,0 +1,34 @@
+---
+name: multi-workstation-remote-control
+description: Operator hops workstations; drives ONE live jumphost session via Remote Control (claude.ai/code or mobile); batch tasks OK but cloud mutations stay gated
+metadata: 
+  node_type: memory
+  type: user
+  originSessionId: e5fa05aa-1418-4d5c-80ab-b4d6c72e8fe9
+  modified: 2026-07-19T07:50:20.711Z
+---
+
+The operator works across multiple workstations and likes to keep a session productive
+during the time between desks by having batch tasks run. The durable setup for this:
+
+- Claude Code runs on the **jumphost** (vopenstack-jesse); workstations are just the
+  control surface. `remoteControlAtStartup: true` is set in the jumphost's
+  `~/.claude/settings.json`, so every session auto-registers with **Remote Control** --
+  drive the SAME live session from claude.ai/code (web) or the mobile app, no re-attach.
+- To pick up a **still-running** session from a new workstation: ATTACH (Remote Control,
+  or SSH + `claude agents`), never `claude --resume` (that forks a SECOND session -- the
+  fragmentation that spawned the runaway agent at the start of the 2026-07-15 session).
+- **ONE session** against the live clone at a time. Between workstations: push before
+  switching; never leave an auto-permission background agent running.
+- Batch/unattended work is fine for read-only/safe tasks, but **live-cloud mutations must
+  stay GATED** -- they queue for approval, which the operator grants from Remote Control on
+  check-in. This is the line between "productive batch" and "runaway agent". See also the
+  session-open hygiene (process/daemon scan before `claude`; `claude daemon stop --any`).
+- **Walls vs gates (ruled 2026-07-19):** the operator cannot always run commands in a
+  second terminal, so a classifier HARD-DENY is a wall that stalls work. When a tool call
+  gets classifier-denied, do NOT work around it -- add a TARGETED `ask` rule for that
+  surface to `.claude/settings.json` (the Edit itself prompts; self-service is by design)
+  so it arrives as an approve prompt in Remote Control. Never a catch-all `Bash(*)` ask
+  (kills frictionless reads; ask appears to preempt allow), never additions to `allow`
+  for mutations. Posture history: repo changelogs 2026-07-18 (ask-preempts-classifier)
+  and 2026-07-19 (session changelog, out-of-batch item).
diff --git a/docs/archive/memory-20260718/project-posture-closed-test.md b/docs/archive/memory-20260718/project-posture-closed-test.md
new file mode 100644
index 0000000..ae8c60b
--- /dev/null
+++ b/docs/archive/memory-20260718/project-posture-closed-test.md
@@ -0,0 +1,28 @@
+---
+name: project-posture-closed-test
+description: VR1 is a closed in-house test -- prioritize deployment tooling/runbooks/hardening over real-world security
+metadata: 
+  node_type: memory
+  type: feedback
+  originSessionId: 75c0e0cb-822c-4f42-ab63-04d3175865f4
+---
+
+VR1 (the DC-DC buildout) is a CLOSED IN-HOUSE TEST cloud, not a live/shared/production environment.
+
+**What to prioritize** (operator ruling, 2026-07-15): deployment steps, configuration tuning,
+OpenTofu/juju/deployment-tool scripting and hardening, and runbook draft updates.
+
+**What is DEFERRED:** real-world deployment security -- credential rotation/revocation, non-shared
+tokens, flip-to-private, second-person unseal, etc. Those come AFTER the tests are complete, during
+the teardown-and-redeploy cycles (test2/3/4/...). The security-ledger rows (SEC-001..008) stay OPEN
+as tracked obligations but are NOT blockers on test progress.
+
+**Why:** validating the deployment mechanics, tooling, and runbooks is the point of this phase;
+locking down credentials on a closed test would spend effort where it does not yet matter. Security
+hygiene that IS done now is the DATA-LOSS-preventing kind (see [[creds-folder-convention]]), not the
+lockdown kind.
+
+**How to apply:** when weighing a security hardening task vs a deployment/tooling/runbook task in
+VR1, prefer the latter unless the security item is also a data-loss or continuity risk. Do not gate
+test progress on the deferred SEC obligations. Still surface real exposures to the ledger (don't
+hide them), just don't treat them as must-fix-now.
diff --git a/docs/archive/memory-20260718/review-after-each-step.md b/docs/archive/memory-20260718/review-after-each-step.md
new file mode 100644
index 0000000..633e6df
--- /dev/null
+++ b/docs/archive/memory-20260718/review-after-each-step.md
@@ -0,0 +1,24 @@
+---
+name: review-after-each-step
+description: Operator wants a grounding review after EVERY step (not just big checkpoints) to prevent drift
+metadata: 
+  node_type: memory
+  type: feedback
+  originSessionId: 839ad1a8-37aa-4459-9679-2cc95d507e2a
+---
+
+On multi-step work (e.g. the Stage-3 review sweep, phased implementations), the operator
+wants a **review completed after each step** to stay grounded and stop drift accumulating.
+
+**Why:** drift compounds silently across steps -- a number, a comment, or a status that
+disagrees between code, the decision record, and the docs. The after-each-step review is
+what caught the 32-vs-16 GiB containment-overhead drift between the Phase-C code and the
+Phase-A record (design-decisions), before it propagated.
+
+**How to apply:** after each step, before moving to the next -- (1) validate/test the
+change (tofu validate, harness, repo-lint); (2) grounding check against the agreed
+decisions + structure (does it still implement the ruling faithfully?); (3) drift sweep --
+reconcile code vs the decision record vs the docs/ledger (numbers, comments, statuses,
+line refs must agree); (4) for non-trivial steps, an independent agent cross-check
+(read-only) as the operator asked for [[stage3 sweep]]. Fix what the review finds THEN
+proceed. Log the review outcome in the session-ledger step by step.
diff --git a/docs/audit/grounding-audit-20260718.md b/docs/audit/grounding-audit-20260718.md
index e414475..47d3a7b 100644
--- a/docs/audit/grounding-audit-20260718.md
+++ b/docs/audit/grounding-audit-20260718.md
@@ -306,3 +306,18 @@
   doc-integrity items, env reconcile) remains EVIDENCE to be folded in and
   re-verified during Phase 5 per the charter; items already covered above:
   seed-volume diff (GA-F01), tofu pin (GA-F03), OPNsense 26.1 refs (GA-F04).
+
+## GA-F16 -- LOW -- memory entry duplicated a repo-carried convention and linked removed entries (found by the first GA-R7/G1 review, 2026-07-19)
+
+**Evidence:** memory `creds-folder-convention.md` (pre-edit copy:
+`docs/archive/memory-20260718/creds-folder-convention.md`) carried the full
+per-site creds convention in prose -- a convention whose durable homes are
+`creds-manifests/`, D-126, SEC-009, and the site tooling -- violating GA-R7
+rule 1/G3 (memory is never the durable home), and linked
+[[review-after-each-step]] + [[project-posture-closed-test]], both removed
+under GA-F06/GA-F07.
+**Fix (applied same review):** reduced to a POINTER entry naming the repo
+authorities, origin-scoped per rule 4; one possibly-unduplicated fact (the
+sandbox NetBox token's off-vcloud location) retained with a
+verify-then-graduate note.
+**Traces to:** GA-R7 rules 1/4/G3, sweep Batch 3.
diff --git a/docs/changelog-20260719-phase5-sweep.md b/docs/changelog-20260719-phase5-sweep.md
index 8d89b6e..a917614 100644
--- a/docs/changelog-20260719-phase5-sweep.md
+++ b/docs/changelog-20260719-phase5-sweep.md
@@ -187,3 +187,38 @@
 among LIVE-surface status claims (mechanical classification script in the
 session record); final ZERO-on-counted comes with Batch 4's rotation +
 Batch 6.1 as the plan already sequences.
+
+## Batch 3 -- memory hygiene (OPENED by operator 2026-07-19; edits per-file gated)
+
+Pre-edit evidence: full memory dir copied to docs/archive/memory-20260718/.
+1. **GA-F06**: `review-after-each-step.md` REMOVED. Repo copy of the
+   provenance ruling: grounding-audit-20260718.md GA-F06 ("It was not a
+   standing instruction. It was only supposed to be for a one time / very
+   short sequence of steps."). No durable observation survives it -- the
+   drift-catch anecdote is repo-recorded in the review changelogs.
+2. **GA-F07**: `project-posture-closed-test.md` REMOVED. Repo copy of the
+   provenance ruling: GA-F07 (stance never ruled; posture returns NEUTRAL;
+   the closed-test FACT is repo-carried; SEC gates were never deferred).
+3. **GA-F05**: hostname -> vcloud in `multi-workstation-remote-control.md`
+   (the last of the four surfaces).
+4. **GA-F08**: MEMORY.md index rebuilt -- two defective lines gone, the two
+   surviving entries re-described accurately.
+5. **GA-R7 rule 6 skill line**: "Claude Code sessions launch from the repo
+   root, always" added to SKILL.md's session-bootstrap loop with the
+   GA-F06-origin rationale (subdirectory launch = divergent auto-memory).
+6. **G1 full review (rules 1-4)**: `creds-folder-convention.md` found
+   duplicating a repo-carried convention + linking both removed entries --
+   registered as **GA-F16** and reduced to a pointer entry (one
+   possibly-unduplicated fact retained with a verify-then-graduate note).
+   `multi-workstation-remote-control.md` reviewed: workflow facts operator-
+   confirmed (the 2026-07-19 walls-vs-gates entry quotes a same-session
+   directive; policy copy lives in the repo changelog it points at).
+   Post-review state: 3 files, zero rule-1..4 violations, zero stale refs
+   (grep-verified).
+REVERT: restore any file from docs/archive/memory-20260718/ (pre-edit
+copies); git revert the batch commit for the repo surfaces.
+Note on the archive copies: `memory-20260718/MEMORY.md`'s em-dashes were
+ASCII-normalized (`--`) to satisfy the repo L1 rule; the transform is
+whitespace/punctuation-only and content-faithful (this note is the record
+of it). No gauntlet run for this batch: zero script/tooling changes
+(memory + docs + one skill prose line); repo-lint 0-fail + fence check OK.
diff --git a/docs/session-ledger.md b/docs/session-ledger.md
index b1ff13e..ab9697b 100644
--- a/docs/session-ledger.md
+++ b/docs/session-ledger.md
@@ -1179,3 +1179,9 @@
   history-class/mechanical -- see the session changelog's Batch-2 verification note, incl. the
   criterion-mechanics FINDING (Batch-2 literal ZERO is Batch-4-dependent by construction).
 - Next gate: operator opens Batch 3 (memory hygiene; edits shown per-file, memory is outside the repo).
+
+- BATCH 3 COMPLETE (2026-07-19, same session): memory hygiene per GA-R7 rule 6 -- two files removed
+  per the recorded provenance rulings (GA-F06/GA-F07), hostname fixed, index rebuilt, skill line
+  added; first full G1 review ran (rules 1-4): one further violation found + corrected + registered
+  (GA-F16, creds pointer reduction). Pre-edit copies: docs/archive/memory-20260718/. Zero violations
+  remain (3 files). Next gate: operator opens Batch 4 (consolidation + rotation -- the big one).