diff --git a/.claude/skills/openstack-cloud-ops/SKILL.md b/.claude/skills/openstack-cloud-ops/SKILL.md
index 00a7b67..a55a019 100644
--- a/.claude/skills/openstack-cloud-ops/SKILL.md
+++ b/.claude/skills/openstack-cloud-ops/SKILL.md
@@ -93,6 +93,7 @@
 | Full-cloud restart after outage/maintenance | repo `runbooks/ops-restart-procedure.md` |
 | VR1 site unreachable after a vcloud reboot (`ssh voffice1` / `office1-*` time out) | `bash scripts/site-baseleg.sh check office1` -- `office1-local` is an ISOLATED libvirt net, so the host's base L3 leg (`10.10.0.10/24` + compose route `10.10.1.0/24 via 10.10.0.20`) is dropped every reboot; the `After=libvirtd` unit re-adds it (D-126 amendment / D-128). If MISS and the unit is not yet installed: `sudo bash scripts/site-baseleg.sh apply office1`. This is the vcloud path; the workstation reaches the same over the tailnet (D-107). |
 | Starting any consequential live session | `bash scripts/run-logged.sh <label>` first (as-executed log; docs/as-executed-log-convention.md) |
+| Octavia amphora PKI -- is it healthy, and how do I ROTATE the controller cert? | `bash scripts/octavia-pki.sh verify <site>` on **voffice1** (the PKI lives on the headend, D-109 ruling note (b) -- it REFUSES on the jumphost rather than describing the wrong machine). To rotate the LEAF: `reissue <site>` + `runbooks/phase-01-bundle-deploy.md` Step **1.0-REISSUE** -- NEVER 1.0-GEN, whose refuse-if-present escape moves the CAs and destroys the amphora trust domain. **A `PASS` verdict alone is not acceptance**: while `os-public-hostname` is unset (B5 IP-only) A12/A13 RECORD rather than fail, so grep for the literal line `DNS SANs are all in this DC's expected zone`. Run `creds-matrix.py --tier2` as well -- the two gates check different things and have disagreed in BOTH directions |
 | Credential exposures / security TODOs | repo `docs/security-ledger.md` -- add a row, never only a script comment. The credential-LIFECYCLE policy (mint -> consolidate -> audit) is **D-137**, not the ledger (SEC-009's convention block is now a pointer); the expected-state register is `creds-matrix.tsv` + `scripts/creds-matrix.py` (tier 1 static, tier 2 existence, tier 3 validity), enforced as a BLOCKING preflight `P5`. `creds-audit` CLEAN is NOT evidence of completeness -- it is declaration-based |
 | Per-DC artifact delivery (apt mirror / caching proxy); "can the nodes get packages?" | dc0 = `bash scripts/dc-mirror.sh check dc0` (full mirror); dc1 = `bash scripts/dc-cache-proxy.sh check dc1` (caching proxy). The two DCs DIFFER BY RULING (D-135 amendments) -- checking dc1 as a mirror fails by design. Both run ON the rack host over `ssh -J voffice1` with `sudo bash -s`; take rack transit IPs from `scripts/lib-hosts.sh`, never memory |
 | Resuming work / what is still in flight (esp. after compaction) | repo `docs/CURRENT-STATE.md` first, then `docs/session-ledger.md` + `bash scripts/ledger-scan.sh` to reconcile against repo ground truth |
@@ -180,6 +181,39 @@
 (the nodes are powered off), so node-side checks belong at Stage 5 first boot -- that is
 why gate G17 exists.
 
+**EVERY PER-DC SECRET NEEDS A ROTATION TOOL, NOT JUST A GENERATION RECIPE (RULED 2026-07-30,
+operator: "Full script minter now" -- standing DC-standup invariant; `runbooks/phase-01-bundle-deploy.md`
+Step 1.0-REISSUE is the worked example, `scripts/octavia-pki.sh reissue` the tool).** A generation
+step guarded by REFUSE-IF-PRESENT -- which is correct, since regenerating invalidates everything
+issued -- leaves NO sanctioned way to rotate a leaf, so its only documented escape ("move the
+existing material aside") moves the CAs and destroys the trust domain. **The dangerous path
+becomes the only path.** At every DC standup, whatever mints a per-DC secret must ship with a
+narrow rotation counterpart that touches the leaf and NOT the root. Four properties that made
+this one trustworthy, all measured rather than assumed: (i) **DERIVE per-DC identity from the
+site token, never type it** -- `${SITE%%-*}`/`${SITE#*-}` gave region and DC label, and a
+transposition is caught by a per-DC harness case rather than by review; (ii) **assert the
+ARTIFACT, never the config** -- `-extfile` is what decides an issued extension set, so a config
+that says the right thing proves nothing (a cert with NO keyUsage/EKU minted, promoted and left
+the harness fully green until an assertion read the cert); (iii) **stage, assert, then promote**
+-- the hand-pasted original overwrote the key BEFORE signing with no `set -e`, so any mid-way
+failure left a bundle whose cert and key did not match, which nothing detected; (iv) **join the
+workspace to the deploy input** -- every assertion graded the workspace while the OVERLAY is
+what reaches the charm, and an overlay carrying a different bundle read PASS. Roosevelt analog:
+per-DC IPMI/BMC and PKI credentials all need a rotation path before first deploy, not after the
+first expiry.
+
+**A HAND-PASTED `openssl` CHAIN IS A DEFECT CLASS, AND THIS REPO HAS THE RECEIPTS.** Two
+independent failures came out of ONE runbook block: F8 (an INDENTED heredoc terminator silently
+yielded a certificate with NO SANs while every command printed OK) and F9 (CN and both DNS SANs
+were baked literals that no gate read, wrong on both DCs for weeks). Build the config with
+`printf` one line per statement, passing values as `%s` ARGUMENTS -- a heredoc's correctness
+depends on invisible leading whitespace on a line nobody reads. **And the harness is a gate too:
+prove each new assertion can FAIL.** A mutation pass on 2026-07-30 deleted three freshly-written
+assertions one at a time and the suite stayed green every time; they were decoration until each
+got a failing-direction fixture. The two properties with no assertion at all were the ones that
+would have hurt most -- a missing `-days 730` (openssl defaults to **30 days**) and a dropped
+EKU (one-directional mTLS failure at LB-create time, every gate reading PASS).
+
 **A FINDING IS AN OBSERVATION, NOT A CONCLUSION -- MEASURE BEFORE YOU PUT IT TO THE OPERATOR
 (2026-07-27 Stage-5 grounding audit; the second-most productive move after the one below).**
 A seven-lens read-only committee produced findings that were reliable AS OBSERVATIONS and
diff --git a/docs/CURRENT-STATE.md b/docs/CURRENT-STATE.md
index 6786936..a16d889 100644
--- a/docs/CURRENT-STATE.md
+++ b/docs/CURRENT-STATE.md
@@ -2466,6 +2466,44 @@
     **T21c** (`vr1-dc1` derives its own zone, proving it is not a dc0 constant).
   - The F9 reissue obligation STANDS unchanged: both live certs carry `dc0.vr0` and must be
     reissued into their DC's zone before `os-public-hostname` is set.
+  - **F9 NOW HAS AN EXECUTABLE REMEDY, 2026-07-30 (part 2 of this session; changelog
+    `docs/changelog-20260730-octavia-reissue-tool.md`). THE TOOL IS BUILT; THE MINT IS NOT YET
+    RUN.** `scripts/octavia-pki.sh reissue <site>` + `runbooks/phase-01-bundle-deploy.md` Step
+    **1.0-REISSUE**. Operator rulings (GA-R5, one exchange each, verbatim): "Controller cert
+    only (Recommended)" / "Fresh P-256 key (Recommended)" / "Script subcommand + runbook step
+    (Recommended)" / "Refuse unless --force (Recommended)" / **"Full script minter now"**.
+    Scope: controller LEAF only, signed by the EXISTING controller CA -- neither CA regenerated,
+    so the amphora trust domain is untouched and only `lb-mgmt-controller-cert` changes.
+  - **SIX GATE DEFECTS FOUND BY ADVERSARIAL + MUTATION AGENTS, ALL CLOSED.** Three new `verify`
+    assertions were added and then PROVEN capable of failing, because a mutation pass deleted
+    the first three outright and the harness stayed fully GREEN every time:
+    **A15** keyUsage/EKU on the issued cert (a cert with NEITHER minted, promoted and passed
+    everything; losing `clientAuth` breaks amphora mTLS in ONE direction only);
+    **A16** validity (`openssl x509 -req` defaults to **`-days 30`**, and `checkend`/`notAfter`/
+    `enddate` appeared ZERO times in the verify half -- a 30-day controller cert passed forever);
+    **A17** the overlay must decode to the material the workspace holds (A10 graded the overlay's
+    SHAPE, A1-A16 graded the workspace, nothing joined them -- measured, a desynced overlay read
+    PASS 0-failed, and the overlay is the half that reaches the charm).
+    Plus: **the re-run guard was refusing to fix broken certificates** (names-correct + stale IP
+    SAN => `verify` FAIL while `reissue` exited 4 "nothing to fix"); A8's negative now proves its
+    instrument loads before concluding; two pre-existing overlay defects moved pre-mint so they
+    stop producing a false exit-5 after promotion.
+  - **Harness 23/23 -> 48/48** (`tests/octavia-pki/run-tests.sh`). T22-T36 cover `reissue`;
+    **T37-T44 exist because the new assertions could not fail without them.**
+  - **MEASURED THIS SESSION, and it corrects a framing this document should not carry:**
+    `guard-destructive.py` is registered `"matcher": "Bash"` and inspects only the command
+    STRING, keyed on `.pem` -- so `bash scripts/octavia-pki.sh reissue vr1-dc0` and
+    `openssl genpkey ... -out controller.key` are both ALLOWED. It has no opinion on any script
+    wrapping openssl. **This does NOT decide anything unruled:** D-137 sub-ruling 1 (2026-07-25)
+    already ruled enforcement at "Blocking in preflight" and explicitly recorded *"NOT adopted:
+    the PreToolUse guard (so an agent is not constrained at write time, only at the deploy
+    gate)"*. `docs/audit/queued-findings-20260730.txt` Q2 calling D-137 fork 1 "still unruled" is
+    therefore the SAME stale-premise class as Q1; corrected there by appended note.
+  - STILL TRUE AND STILL NOT WIRED: `octavia-pki.sh` is invoked by NO gate -- `preflight.sh`
+    checks only that the overlay EXISTS. "Gauntlet ALL GREEN" is not evidence about the live
+    PKI; acceptance is the explicit per-DC command on voffice1, and the gate is the literal line
+    `DNS SANs are all in this DC's expected zone`, not the PASS verdict (while unarmed, A12/A13
+    RECORD rather than fail).
   - **CAPTURE: `docs/audit/docfix205-d117-annotation-20260730.txt`** -- the quoted D-117 Status
     line, D-119's selector-only discharge, annotation coverage measured 0/4 -> 4/4, the phase-6
     expansion old-vs-new run in a real shell, live A12 on the headend, and both hosts' gates
diff --git a/docs/changelog-20260730-octavia-reissue-tool.md b/docs/changelog-20260730-octavia-reissue-tool.md
new file mode 100644
index 0000000..676990a
--- /dev/null
+++ b/docs/changelog-20260730-octavia-reissue-tool.md
@@ -0,0 +1,197 @@
+# Changelog 2026-07-30 (part 2) -- the Octavia controller-cert REISSUE tool, hardened
+
+Session changelog part 2 (part 1 = `changelog-20260730-docfix205-d117-annotation.md`).
+Branch `dc-dc-stage5-preconditions`. Status claims live ONLY in `docs/CURRENT-STATE.md`.
+
+**Trigger.** Operator: "Let's reissue now. Engineer the artifact, variable, based workflow to
+reduce the chance of errors. Deploy agents to engineer, code, and valid the coding." F9's
+obligation: the controller certs on BOTH DCs carry `dc0.vr0` names -- the wrong region on both,
+and the wrong DC label on dc1.
+
+**No new D-number (GA-R3).** The naming is ruled (D-008 shape + D-117 labels); the tool is OPS.
+Next-free UNCHANGED: D 138 / DOCFIX 206 / BUNDLEFIX 053.
+
+---
+
+## Operator rulings recorded (GA-R5, one exchange each, verbatim)
+
+1. SCOPE -- **"Controller cert only (Recommended)"**. Signed by the EXISTING controller CA;
+   neither CA regenerated; only `lb-mgmt-controller-cert` changes in the overlay.
+2. KEY -- **"Fresh P-256 key (Recommended)"**.
+3. ARTIFACT -- **"Script subcommand + runbook step (Recommended)"**.
+4. RE-RUN GUARD -- **"Refuse unless --force (Recommended)"**.
+5. MINT PATH -- **"Full script minter now"**, taken after I escalated a measured concern (below).
+6. Scope of this batch -- **"Yes, they all need to be processed and the hardened tool driven
+   process needs to be documented and saved for future stand ups."**
+
+### The escalation, and its correction -- recorded because I got the framing wrong first
+
+Presenting ruling 3 I told the operator a `reissue` subcommand "does not touch `generate`, so
+the D-137 fork-1 ruling stays untouched." **That was wrong twice over.**
+
+First, measured: `guard-destructive.py` is registered `"matcher": "Bash"` and inspects only the
+command STRING, keyed on `.pem`. Empirically -- `bash scripts/octavia-pki.sh reissue vr1-dc0`
+**ALLOWED**, `openssl genpkey ... -out controller.key` **ALLOWED**, only the `.pem` shape
+BLOCKED. So the guard has no opinion on ANY script wrapping openssl, and the subcommand's NAME
+is irrelevant. I escalated on that basis.
+
+Second, and this is the correction: **D-137 fork 1 is NOT open.** Sub-ruling 1 RULED it
+2026-07-25 at option (b) "Blocking in preflight", explicitly recording *"NOT adopted: the
+PreToolUse guard (so an agent is not constrained at write time, only at the deploy gate)"*.
+`guard-destructive.py` is a separate, older mechanism (CLAUDE.md secrets norms / DOCFIX-006),
+not D-137's enforcement point. A scripted minter therefore decides nothing unruled -- it is
+consistent with what D-137 actually ruled. **`docs/audit/queued-findings-20260730.txt` Q2 calls
+fork 1 "still unruled", which is the same stale-premise class as Q1 in part 1 of this session.**
+Corrected there by appended note.
+
+---
+
+## 1. `scripts/octavia-pki.sh` -- the `reissue` action
+
+`reissue <site> [--force] [--dry-run]`. Exit codes: 0 ok/dry-run, 1 FAIL (measured defect or a
+staged assertion failed -- nothing promoted), 2 args, 3 REFUSE (could not evaluate / could not
+make it safe), 4 REFUSE already-correct, 5 PARTIAL (promotion interrupted -- restore command
+printed). `verify`'s 0/1/2/3 semantics unchanged.
+
+Shape, in order: precondition sweep (host authority FIRST, before any file is created) ->
+derive -> re-run guard -> backup -> `printf`-built config -> structural config assertions ->
+mint into STAGING -> post-mint assertions in staging -> promote -> single-value overlay surgery
+-> prove the surgery -> final verify.
+
+Properties that matter, each chosen against a measured failure:
+- **Zone DERIVED, never typed** (`${SITE%%-*}` / `${SITE#*-}`), so `vr1-dc0` -> `dc0.vr1` and
+  `vr1-dc1` -> `dc1.vr1`. Same code path `verify` uses -- generator and gate cannot drift.
+- **`printf` per line, no heredoc** -- the F8 payoff. Values passed as `%s` ARGUMENTS so a `%`
+  in a value cannot become a format directive.
+- **Stage, assert, promote.** 1.0-GEN.c overwrites the key BEFORE signing with no `set -e`, so
+  any mid-way failure yields a bundle whose cert and key do not match. Nothing detected that.
+- **`-CAserial`, NOT `-CAcreateserial`** -- with `-CAserial` alone openssl FAILS on a missing
+  serial file instead of silently starting a new random sequence.
+- **Overlay surgery via python3 reading both files itself** -- never `sed`/`awk` with the value
+  in argv, because the bundle holds an UNENCRYPTED private key and `/proc/<pid>/cmdline` is
+  world-readable.
+
+**Revert:** `git checkout <prev> -- scripts/octavia-pki.sh`.
+
+## 2. Three `verify` gaps closed, then three MORE found by validation
+
+Closed in the first pass: **A13** (controller cert subject CN -- asserted nowhere before;
+`check_subject` ran only on the two CAs), **A14** (cert<->key pairing + bundle integrity --
+nothing read the bundle Octavia actually consumes), and a symmetric positive in **A12**'s inert
+branch (a correct and an incorrect cert were previously distinguishable only by assertion count).
+
+Then adversarial + mutation agents found three more, all now closed:
+
+- **A15 -- keyUsage / EKU on the issued cert.** Deleting BOTH extension lines produced a cert
+  with no KU and no EKU that minted, promoted, and left the harness fully green. `keyUsage`
+  appeared exactly ONCE in the whole file -- the printf that writes it. Losing `clientAuth`
+  breaks amphora->controller mTLS ONLY: a one-directional failure at LB-create time with every
+  gate reading PASS.
+- **A16 -- validity.** `openssl x509 -req` defaults to **`-days 30`**. `checkend`, `notAfter`
+  and `enddate` appeared ZERO times in the verify half, so a 30-day controller certificate
+  passed every gate in this repo forever. Reachable by dropping one token from the hand-pasted
+  block that produced the live certs.
+- **A17 -- the overlay must carry the material the workspace holds.** A10 graded the overlay's
+  SHAPE and A1-A16 graded the workspace; nothing joined them. Measured: an overlay whose
+  embedded cert decoded to a DIFFERENT bundle reported PASS, 0 failed. The overlay is what
+  reaches the charm.
+
+Also hardened: **A8's negative proves its instrument first** -- `openssl verify -CAfile X` exits
+non-zero both for "does not verify" and "could not load X", so a corrupt issuing CA made the
+trust-domain-separation check pass VACUOUSLY (measured: it printed the reassuring line and
+promoted).
+
+## 3. The re-run guard was refusing to fix broken certificates
+
+**The most consequential validation finding.** The guard compared NAMES and treated that as "is
+the certificate right?". Measured: a cert with correct CN/SANs but a stale IP SAN made `verify`
+FAIL while `reissue` exited 4 "nothing to fix" -- the remedy refusing the defect the checker had
+just reported, same workspace, seconds apart. It does not bite today (the names ARE wrong, so it
+proceeds) but it bites every run afterwards, including the 2-year renewal this reissue starts
+the clock on, where an EXPIRED cert with correct names would be refused as already-correct.
+
+Now "already correct" means names match **AND `verify` returns clean**, so the two cannot
+disagree -- and A16/A17 put expiry and overlay desync inside that definition.
+
+## 4. Two pre-existing overlay defects moved to pre-mint
+
+Both are pure functions of state that exists BEFORE the run, but were detected only by the
+post-surgery proof -- producing exit 5 (workspace promoted, serial burned) when the honest
+answer was "your overlay was already wrong, nothing was touched": (a) exactly one
+`lb-mgmt-controller-cert` line; (b) `lb-mgmt-controller-cacert` must already decode to THIS
+DC's controller CA (an overlay from another DC is the F1 cross-DC mix-up).
+
+## 5. Smaller hardening, each from a measured failure
+
+- Backup filename gains `$$` -- the 1-second stamp plus `tar czf` overwriting was measured
+  destroying 3 of 12 pre-images, worst exactly in an exit-5-then-retry sequence.
+- Leftover `.reissue-<site>.*` staging dirs are REPORTED (not deleted): SIGKILL between signing
+  and promotion leaves a valid CA-signed cert and an unencrypted key that no register declares.
+- Two overstated in-file claims corrected: the "hoist is PURE, proven by diffing" comment was
+  backed by nothing executable; and "the other four values are byte-identical" is a line-diff
+  result, which proves the RESULT unchanged, not that they were never rewritten.
+
+## 6. `tests/octavia-pki/run-tests.sh` -- 21/21 -> 48/48
+
+T22-T36 cover `reissue`. **T37-T44 exist because mutation testing proved the new assertions
+could not fail:** deleting A13, A14 or the A12 positive outright left the suite fully green.
+An assertion with no failing-direction fixture is decoration.
+
+T37/T37b (no KU/EKU; partial EKU loss), T38 (short-dated cert), T39/T39b (overlay desync;
+empty value), T40 (cert/key mismatch), T41 (A13 armed, correct SANs + wrong CN -- the half-fix),
+T42 (the inert positive must not be vacuous -- a SAN-less cert must not earn it), T43 (a stale
+THIRD DNS SAN must be reissued down to two; mutation refuted the assumption that T25 covered
+the count guard), T44 (names-correct-but-verify-FAILS must reissue, not refuse).
+
+**Revert:** `git checkout <prev> -- tests/octavia-pki/run-tests.sh`.
+
+## 7. `runbooks/phase-01-bundle-deploy.md` -- Step 1.0-REISSUE
+
+Appended AFTER 1.0-GEN.e **deliberately**: F10 records that `creds-matrix` S4 mint-refs are
+line-anchored and only checked within-EOF, so inserting above would have silently misaligned 20
+octavia refs. Verified after the append -- `creds-matrix.py` reports **no S4 findings**.
+
+Four sub-steps: read-only decide -> `--dry-run` -> the mint ONE DC AT A TIME -> verify + backup
+hygiene. Carries the exit-code table as an action table, and the standing warning that **a PASS
+verdict alone is not acceptance** -- while unarmed, A12/A13 RECORD rather than fail, so the gate
+is the literal line `DNS SANs are all in this DC's expected zone`.
+
+## 8. Skill sweep -- saved for future standups (operator-directed)
+
+`.claude/skills/openstack-cloud-ops/SKILL.md` gains two standing invariants and a routing row:
+
+- **EVERY PER-DC SECRET NEEDS A ROTATION TOOL, NOT JUST A GENERATION RECIPE.** A generation step
+  guarded by REFUSE-IF-PRESENT leaves no sanctioned way to rotate a leaf, so its only documented
+  escape moves the CAs -- **the dangerous path becomes the only path**. Carries the four
+  properties that made this tool trustworthy (derive identity; assert the artifact not the
+  config; stage-assert-promote; join workspace to deploy input) and the Roosevelt analog.
+- **A HAND-PASTED `openssl` CHAIN IS A DEFECT CLASS, AND THIS REPO HAS THE RECEIPTS** -- F8 and
+  F9 from one block; plus "prove each new assertion can FAIL", with the two properties that had
+  no assertion at all (`-days` defaulting to 30, and a dropped EKU).
+
+**Revert:** `git checkout <prev> -- .claude/skills/openstack-cloud-ops/SKILL.md`.
+
+---
+
+## Verification
+
+    bash tests/octavia-pki/run-tests.sh   -> 48/48 PASS
+    bash scripts/repo-lint.sh             -> 0 fail, 1 warn (legacy L1, unchanged)
+    bash scripts/run-tests-all.sh         -> GAUNTLET: ALL GREEN (89 harnesses)
+    python3 scripts/creds-matrix.py       -> 5 findings, ALL pre-existing and named
+                                             (dc0-edge-api SEC-021, three power-key
+                                             asymmetries, maas-region-admin conflation);
+                                             NO S4 findings, so mint-ref anchors are intact
+
+## NOT done, deliberately
+
+- **The mint itself has not been run.** This changelog ships the tool; the reissue is a gated
+  operator action per 1.0-REISSUE.
+- `generate` remains unimplemented. `reissue` REFUSES when there is no existing certificate,
+  precisely so it cannot become a `generate` backdoor.
+- The backup archive is still an unregistered credential class (it holds both CA keys plus
+  passphrases). Logged, not actioned -- it needs a `creds-matrix.tsv` row and a retention rule,
+  which is its own gated change.
+- `octavia-pki.sh` is still called by NO gate: `preflight.sh` checks only that the overlay
+  EXISTS. So "gauntlet ALL GREEN" remains not-evidence about the live PKI. Wiring `verify` into
+  preflight is a gate change with its own blast radius -- proposed, not smuggled in here.
diff --git a/runbooks/phase-01-bundle-deploy.md b/runbooks/phase-01-bundle-deploy.md
index 2697139..f490f54 100644
--- a/runbooks/phase-01-bundle-deploy.md
+++ b/runbooks/phase-01-bundle-deploy.md
@@ -695,3 +695,131 @@
 backup** -- corrected 2026-07-30, because this line previously said "both ... and the overlay"
 and implied a gap that does not exist: 1.0-GEN.d regenerates the overlay ENTIRELY from the
 archived workspace files, so backing up the workspace covers it.
+
+---
+
+## Step 1.0-REISSUE -- rotate the CONTROLLER LEAF certificate (tool-driven)  DISCRETE / SECRET
+
+**Use this, NOT 1.0-GEN, whenever the controller certificate is wrong or expiring.** 1.0-GEN's
+REFUSE-IF-PRESENT gate (1.0-GEN.0) deliberately blocks re-running generation, and its only
+stated escape -- "move the existing material aside first" -- moves the **CAs** aside, which
+regenerates the trust domain and invalidates every amphora already issued against it. That is
+the opposite of what a leaf rotation needs. This step exists so the sanctioned path is not the
+dangerous one.
+
+**WHAT IT DOES.** Mints a FRESH EC P-256 key and a new controller certificate signed by the
+**EXISTING** controller CA, then rewrites exactly ONE value in
+`overlays/${DC}-octavia-pki.yaml` (`lb-mgmt-controller-cert`). **No CA is regenerated.** The
+amphora trust domain is untouched, so anything already issued stays valid.
+
+**WHY IT IS A SCRIPT AND NOT A PASTE BLOCK.** 1.0-GEN.c is a hand-pasted `openssl` chain, and
+that shape has failed twice in measurable ways: F8 (an indented heredoc terminator silently
+produced a certificate with **NO SANs** while every command printed OK) and F9 (the CN and both
+DNS SANs are baked `dc0.vr0` literals that no gate read). The reissue path derives every value,
+asserts the artifact it produced, and stages before it promotes. Operator ruling 2026-07-30,
+exact utterance: **"Full script minter now"** -- taken with the measured fact that
+`guard-destructive.py` is a Bash-command-string matcher that has no opinion on any script
+wrapping `openssl`, and that D-137 sub-ruling 1 (2026-07-25, "Blocking in preflight") had
+already declined to constrain agents at write time. This step does not change that posture.
+
+> ## CAUTION -- this consumes a CA serial and rotates a private key
+>
+> A reissue burns one serial from `controller-ca.cert.srl` and replaces `controller.key`. Both
+> are irreversible forward. A pre-reissue archive is taken automatically **before** the first
+> byte is minted and its path + sha256 are printed; record them. **Never restore that archive
+> over a workspace that has issued since** -- it carries the CA's issuance state, so restoring
+> it rolls the serial backwards and the next mint reuses a serial the estate already holds.
+
+### 1.0-REISSUE.0 -- decide, read-only, and look before you mint
+
+**CHECK (read-only) -- voffice1 (the D-128 Plane-2 headend; the PKI lives here, RULED D-109 (b))**
+```bash
+# RUN: voffice1
+cd "$REPO" || exit 1
+bash scripts/octavia-pki.sh verify vr1-dc0
+bash scripts/octavia-pki.sh verify vr1-dc1
+```
+**Expect:** a verdict line per DC. Read `A12`/`A13` -- they name this DC's DERIVED expected zone
+(`omega.dc0.vr1.cloud.neumatrix.local` / `omega.dc1.vr1.cloud.neumatrix.local`), and say whether
+the certificate is in it. `A15` covers keyUsage/EKU, `A16` expiry, `A17` whether the deploy
+overlay actually carries the material this workspace holds.
+
+**GATE:** you know, per DC, WHY you are reissuing. "verify said something" is not a reason.
+
+### 1.0-REISSUE.1 -- dry run (mints nothing)
+
+**CHECK (read-only) -- voffice1**
+```bash
+# RUN: voffice1
+bash scripts/octavia-pki.sh reissue vr1-dc0 --dry-run
+```
+**Expect:** every precondition reported, the derived zone echoed, and the full openssl config
+printed. It writes no key, no cert, no backup and no staging directory. Read the config: the CN,
+`DNS.1`, `DNS.2` and the IP SANs are what the certificate will carry.
+
+**GATE:** the printed zone is THIS DC's. `vr1-dc0` must print `dc0.vr1`, `vr1-dc1` must print
+`dc1.vr1`. If those are transposed, STOP -- do not proceed, and do not "fix" it by hand.
+
+### 1.0-REISSUE.2 -- the mint, ONE DC at a time  > CAUTION: mutation
+
+**RUN -- voffice1**
+```bash
+# RUN: voffice1
+bash scripts/octavia-pki.sh reissue vr1-dc0
+```
+**Expect:** exit 0, the archive path + sha256, `serial <old> -> <new>`, and the new SANs.
+
+**Exit codes -- act on them, do not re-run blindly:**
+
+| rc | meaning | what to do |
+|----|---------|-----------|
+| 0 | reissued and every post-mint assertion passed | proceed to 1.0-REISSUE.3 |
+| 1 | FAIL -- a measured defect blocked it, or a staged assertion failed | **nothing was promoted.** Fix what it names |
+| 2 | bad arguments | fix the command |
+| 3 | REFUSE -- could not evaluate or could not make it safe | **nothing was minted.** Wrong host, unreadable CA, unparseable VIPs |
+| 4 | REFUSE -- already correct | nothing to do. `--force` only if you intend a rotation anyway |
+| 5 | **PARTIAL -- ROLLBACK REQUIRED** | the workspace moved and the overlay did not. Run the printed restore command, then **record the burned serial** |
+
+**GATE:** exit 0. Do NOT run the second DC until the first is verified in 1.0-REISSUE.3 --
+one DC at a time is what keeps a wrong `$DC` from being a two-DC incident.
+
+Then repeat for the other DC:
+```bash
+# RUN: voffice1
+bash scripts/octavia-pki.sh reissue vr1-dc1
+```
+
+### 1.0-REISSUE.3 -- verify, per DC
+
+**CHECK (read-only) -- voffice1**
+```bash
+# RUN: voffice1
+bash scripts/octavia-pki.sh verify vr1-dc0
+bash scripts/octavia-pki.sh verify vr1-dc1
+python3 scripts/creds-matrix.py --tier2
+```
+**GATE:** each DC PASSes with **0 failed**, AND the output carries the literal line
+`A12 DNS SANs are all in this DC's expected zone '<this DC's zone>'`.
+
+> **THE COUNT IS NOT THE GATE, THE LINE IS.** A `PASS` verdict alone is compatible with the
+> wrong certificate: in today's unarmed posture (`os-public-hostname` set nowhere, B5 IP-only)
+> A12 and A13 RECORD rather than fail, so a wrong-zone cert also reports PASS -- it just
+> carries a "(recorded, not failed)" line instead of the positive one. Grep for the positive.
+>
+> **Both gates, not either.** `creds-matrix` (P5) and `octavia-pki.sh verify` check different
+> things and have disagreed before in BOTH directions -- a cert at 644 passes A3 and fails P5;
+> one at 660 passes P5 and fails A3. That disagreement is the point of running both.
+
+**GATE:** `creds-matrix --tier2` shows no NEW finding attributable to this change.
+
+### 1.0-REISSUE.4 -- backup hygiene
+
+The reissue wrote `~/octavia-pki/backups/<site>-octavia-pki-<stamp>-<pid>.tar.gz` on the
+headend. It contains **both CA private keys, both passphrases, and the overlay** -- treat it as
+live key material. Pull it to the jumphost creds folder and remove the headend copy, exactly as
+1.0-GEN.e does for the generation archive; compare sha256 before deleting.
+
+**GATE:** the headend carries no `octavia-pki/backups/` residue once the jumphost copy is
+sha256-verified. If the run also NOTED leftover `.reissue-<site>.*` staging directories, inspect
+and remove them deliberately -- each may hold a CA-signed certificate and an unencrypted key
+that no register declares.
diff --git a/scripts/octavia-pki.sh b/scripts/octavia-pki.sh
index 894cf9d..51e12db 100755
--- a/scripts/octavia-pki.sh
+++ b/scripts/octavia-pki.sh
@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# scripts/octavia-pki.sh verify <site> -- assert a DC's Octavia amphora control-plane PKI
+# scripts/octavia-pki.sh -- assert (and reissue) a DC's Octavia amphora control-plane PKI
 #
 # WHY THIS EXISTS. The PKI is minted by runbooks/phase-01-bundle-deploy.md Step 1.0-GEN,
 # a copy-paste block chain. On 2026-07-29 that chain was executed for both DCs and TWO
@@ -15,19 +15,35 @@
 # the assertions below are the executable form of what the runbook only hoped for.
 #
 # SCOPE, DELIBERATELY NARROW (operator direction 2026-07-29: "Build the verify mode
-# first, then we'll rule the guard fork"). This script VERIFIES ONLY. It mints nothing,
-# writes nothing, and moves nothing. A `generate` mode is NOT built here: minting is
-# operator-executed under the PreToolUse guard, and whether a sanctioned script may mint
-# is D-137 open fork 1 -- an UNRULED decision (option (c) would have the guard refuse
-# secret-writing shapes OUTSIDE a sanctioned minter). Building `generate` before that
-# ruling would convert the guard from "blocks secret minting" into "blocks secret minting
-# except through any script" as a SIDE EFFECT. That is a posture change and it belongs to
-# the operator, not to this script.
+# first, then we'll rule the guard fork"). `verify` VERIFIES ONLY -- it mints nothing,
+# writes nothing and moves nothing.
 #
-# IT CANNOT LEAK KEY MATERIAL, BY CONSTRUCTION. Every openssl call uses `-noout`; the
-# only file contents ever read are counted or pattern-matched, never printed. There is no
-# `cat`, no `base64`, and no unredirected read of any key, passphrase or overlay value.
-# That property is what makes it safe to run from an agent session; keep it true.
+# `reissue` (added 2026-07-30) replaces the CONTROLLER LEAF certificate and its key,
+# signed by the EXISTING controller CA. It is NOT `generate` and does not become a route
+# to it: no CA is ever regenerated, and it REFUSES unless a controller certificate is
+# already there to be replaced. `generate` remains UNIMPLEMENTED and still exits 2 --
+# minting a FIRST key pair is D-137 open fork 1, an UNRULED decision (option (c) would
+# have the guard refuse secret-writing shapes OUTSIDE a sanctioned minter). Building
+# `generate` before that ruling would convert the guard from "blocks secret minting" into
+# "blocks secret minting except through any script" as a SIDE EFFECT. That is a posture
+# change and it belongs to the operator, not to this script.
+#
+# WHY REISSUE HAD TO EXIST. A12/A13 ARM THEMSELVES from D-106's hostname work, and both
+# will fail on both DCs the moment they arm, because 1.0-GEN.c bakes `dc0.vr0` names as
+# literals. An armed assertion with no executable remedy behind it is a tripwire wired to
+# nothing. `reissue` is that remedy, and it is held to the same standard as the checker:
+# every precondition before any side effect, a full backup before the first minted byte,
+# the mint asserted in STAGING before anything is promoted, and the whole result graded at
+# the end by an INDEPENDENT re-run of `verify`.
+#
+# IT NEVER PRINTS KEY MATERIAL. This is the invariant that makes the file safe to run from
+# an agent session, and it survives `reissue`: private bytes flow only into `sha256sum`,
+# into `openssl` via `-passin file:`, or into a 0600 file -- never to stdout, never through
+# argv (the overlay surgery has python3 read both files itself precisely because
+# /proc/<pid>/cmdline is world-readable). The one thing printed verbatim is the openssl
+# CONFIG under --dry-run, which contains only hostnames and VIPs. Do not weaken this: the
+# harness asserts it executably by grepping a full successful run's stdout+stderr for PEM
+# headers, the passphrase, and long base64 runs.
 #
 # RELATION TO THE REGISTER. D-137's `creds-matrix.py` checks that declared artifacts
 # EXIST and are not world-readable. It cannot check that a certificate is the RIGHT
@@ -41,7 +57,11 @@
 # generate half and this file keeps only `verify`.
 #
 # USAGE
-#   bash scripts/octavia-pki.sh verify <site>      # site = vr1-dc0 | vr1-dc1 (region-qualified)
+#   bash scripts/octavia-pki.sh verify  <site>                    # read-only, mutates nothing
+#   bash scripts/octavia-pki.sh reissue <site> [--force] [--dry-run]
+#   site = vr1-dc0 | vr1-dc1 (region-qualified; a bare `dc0` is REJECTED)
+#   --force    overrides the already-correct REFUSE (exit 4) and NOTHING else
+#   --dry-run  builds and asserts the openssl config, prints it, mints nothing
 #
 # RUNS ON the host the PKI lives on, which is RULED: the D-128 Plane-2 headend
 # (D-109 ruling note (b), 2026-07-29 -- "Generate on voffice1"). The binding is READ from
@@ -49,8 +69,14 @@
 # this script cannot drift from the register. On any other host it REFUSES rather than
 # reporting a filesystem it should not be measuring -- the F6 lesson.
 #
-# EXIT: 0 all assertions pass | 1 an assertion FAILED | 2 bad args | 3 REFUSED (could not
-# evaluate). Three outcomes, never two: "could not look" is never "nothing there".
+# EXIT (verify):  0 all assertions pass | 1 an assertion FAILED | 2 bad args | 3 REFUSED
+# (could not evaluate). Three outcomes, never two: "could not look" is never "nothing
+# there". These four are UNCHANGED by the reissue work and must stay that way.
+# EXIT (reissue): 0 ok or dry-run | 1 FAIL (measured defect, or a STAGED assertion failed
+# -- nothing promoted) | 2 bad args | 3 REFUSE (could not evaluate, or could not make it
+# safe) | 4 REFUSE, already correct | 5 PARTIAL, rollback required -- the restore command
+# is printed. 4 and 5 exist because "did nothing because nothing was wrong" and "did half
+# of it" are the two outcomes an operator most needs to tell apart from success.
 
 set -uo pipefail          # deliberately NOT -e: a failing assertion must be COUNTED, not abort the run
 
@@ -69,58 +95,72 @@
 nrefuse() { echo "  REFUSE  $1"; NREFUSE=1; }
 
 usage() {
-  echo "usage: bash scripts/octavia-pki.sh verify <site>"
+  echo "usage: bash scripts/octavia-pki.sh verify  <site>"
+  echo "       bash scripts/octavia-pki.sh reissue <site> [--force] [--dry-run]"
   echo "  site: region-qualified, e.g. vr1-dc0 or vr1-dc1 (bare 'dc0' is REJECTED)"
   exit 2
 }
 
-ACTION="${1:-}"; SITE="${2:-}"
-[ -n "$ACTION" ] || usage
-[ "$ACTION" = "verify" ] || { echo "unknown action '$ACTION' (only 'verify' is implemented; see the header on why 'generate' is not)"; usage; }
-[ -n "$SITE" ] || usage
-# Region-qualified only. A bare `dc0` has been a live defect class in this repo.
-case "$SITE" in
-  vr1-dc0|vr1-dc1) : ;;
-  dc0|dc1|dc2) echo "REJECT: site '$SITE' is not region-qualified -- use vr1-dc0 / vr1-dc1"; exit 2 ;;
-  *) echo "REJECT: unknown site '$SITE'"; exit 2 ;;
-esac
-
-echo "=== octavia-pki verify: $SITE ==="
-
-# ---------------------------------------------------------------- preconditions (REFUSE)
-command -v openssl >/dev/null 2>&1 || nrefuse "openssl is not on PATH -- cannot evaluate any certificate (this is a MISSING TOOL, not a bad PKI)"
-command -v python3 >/dev/null 2>&1 || nrefuse "python3 is not on PATH -- needed to normalise IPv6 literals and parse the VIP overlay"
+# ================================================================= SHARED DERIVATIONS
+# Hoisted 2026-07-30 when `reissue` was built. These four were INLINE in `verify`; the
+# minter needs the SAME answers, and two copies of a derivation is how a checker and the
+# thing it checks drift apart until neither is wrong about its own copy. ONE derivation,
+# TWO consumers.
+#
+# ON THE PURITY CLAIM, stated accurately (corrected 2026-07-30). This comment previously
+# asserted the hoist was "PURE -- verify's output is byte-identical, proven by diffing the
+# pre-refactor script against this one". That claim was NOT backed by anything executable:
+# no pre-refactor artifact is kept, and no harness case pins it, so a reader could not check
+# it and a future edit could not break it visibly. What was actually done, and all that is
+# claimed: the hoisted bodies are TEXTUALLY IDENTICAL to the inline versions they replaced,
+# and an independent pass compared this file against the previous commit over 17 fixtures
+# (PASS, FAIL, REFUSE, no-SAN, v4-only, wrong-v4, wrong CA label, wrong host, no binding,
+# missing/unparseable VIP overlay, un-generated DC, armed-correct, armed-wrong-region,
+# armed+no-SAN, vr1-dc1, group-writable CA cert, un-gitignored overlay) and found the exit
+# code and output identical once the deliberately-new A13/A14/A15/A16/A17 lines are removed.
+# ONE KNOWN BEHAVIOUR CHANGE beyond the new assertions: the flag preamble now rejects
+# unknown options before dispatch, so `verify <site> <extra-arg>` exits 2 where it used to
+# ignore the extra argument. Deliberate; no caller in the repo passes one (grepped).
 
 # HOST BINDING, read from the register rather than hardcoded (one source of truth; F6).
-HOST_ID_FILE="$REPO_ROOT/creds-manifests/host-identity"
-THIS_HOST="${OCTAVIA_PKI_THIS_HOST:-$(hostname)}"
-EXPECT_HOST=""
-if [ -r "$HOST_ID_FILE" ]; then
-  # `headend` is the role the D-109 ruling note (b) binds the Octavia PKI to.
-  EXPECT_HOST="$(awk '!/^[[:space:]]*#/ && NF==2 && $1=="headend" {print $2; exit}' "$HOST_ID_FILE")"
-fi
-if [ -z "$EXPECT_HOST" ]; then
-  nrefuse "no 'headend' binding in creds-manifests/host-identity -- cannot tell whether this host should hold the PKI, and will not assume it does"
-elif [ "${EXPECT_HOST%%.*}" != "${THIS_HOST%%.*}" ]; then
-  nrefuse "this run is on '$THIS_HOST' but the PKI lives on '$EXPECT_HOST' (D-109 ruling note (b)); measuring this host's filesystem would describe the wrong machine"
-else
+# Returns 0 when this host is the declared headend; 1 otherwise, with the REFUSE already
+# recorded. `reissue` calls this FIRST, before it creates any file: a minter that writes to
+# the wrong machine's filesystem has already done the damage by the time it notices.
+assert_host_authority() {
+  HOST_ID_FILE="$REPO_ROOT/creds-manifests/host-identity"
+  THIS_HOST="${OCTAVIA_PKI_THIS_HOST:-$(hostname)}"
+  EXPECT_HOST=""
+  if [ -r "$HOST_ID_FILE" ]; then
+    # `headend` is the role the D-109 ruling note (b) binds the Octavia PKI to.
+    EXPECT_HOST="$(awk '!/^[[:space:]]*#/ && NF==2 && $1=="headend" {print $2; exit}' "$HOST_ID_FILE")"
+  fi
+  if [ -z "$EXPECT_HOST" ]; then
+    nrefuse "no 'headend' binding in creds-manifests/host-identity -- cannot tell whether this host should hold the PKI, and will not assume it does"
+    return 1
+  fi
+  if [ "${EXPECT_HOST%%.*}" != "${THIS_HOST%%.*}" ]; then
+    nrefuse "this run is on '$THIS_HOST' but the PKI lives on '$EXPECT_HOST' (D-109 ruling note (b)); measuring this host's filesystem would describe the wrong machine"
+    return 1
+  fi
   ok "host: '$THIS_HOST' is the declared headend, so its filesystem is the right one to measure"
-fi
+  return 0
+}
 
-if [ "$NREFUSE" -ne 0 ]; then
-  echo "octavia-pki verify ($SITE): REFUSE -- preconditions unmet; this is NOT a pass"; exit 3
-fi
-
-# ---------------------------------------------------------------- expected values, DERIVED
-# NEVER a hardcoded VIP: the ruled value lives in the per-DC overlay, and R11/ruling-3
-# moved these once already. Deriving means a future re-ruling updates this check for free.
-VIP_OVERLAY="$REPO_ROOT/overlays/${SITE}-vips.yaml"
-if [ ! -r "$VIP_OVERLAY" ]; then
-  nrefuse "VIP overlay not readable at $VIP_OVERLAY -- the expected SANs are derived from it and will not be guessed"
-  echo "octavia-pki verify ($SITE): REFUSE"; exit 3
-fi
-
-read -r EXP_V4 EXP_V6 <<EOF
+# EXPECTED IP SANs, DERIVED. Never a hardcoded VIP: the ruled value lives in the per-DC
+# overlay, and R11/ruling-3 moved these once already. Deriving means a future re-ruling
+# updates both the checker and the minter for free.
+# Sets VIP_OVERLAY, EXP_V4, EXP_V6. Exit: 0 ok | 2 overlay unreadable | 3 unparseable.
+derive_vips() {
+  VIP_OVERLAY="$REPO_ROOT/overlays/${SITE}-vips.yaml"
+  if [ ! -r "$VIP_OVERLAY" ]; then
+    nrefuse "VIP overlay not readable at $VIP_OVERLAY -- the expected SANs are derived from it and will not be guessed"
+    return 2
+  fi
+  # A HERE-DOC, deliberately not `python3 ... | read`: a pipeline runs `read` in a SUBSHELL,
+  # so EXP_V4/EXP_V6 would come back EMPTY in the caller and every downstream assertion
+  # would compare against "". Both terminators sit at column 0 -- F8 is exactly what an
+  # indented terminator does to a heredoc.
+  read -r EXP_V4 EXP_V6 <<EOF
 $(python3 - "$VIP_OVERLAY" <<'PY'
 import sys, ipaddress, yaml
 try:
@@ -134,15 +174,880 @@
 PY
 )
 EOF
-EXP_V4="${EXP_V4:-}"; EXP_V6="${EXP_V6:-}"
-if [ -z "$EXP_V4" ]; then
-  nrefuse "could not derive octavia's provider v4 VIP from $VIP_OVERLAY -- refusing rather than asserting against an empty expectation"
-  echo "octavia-pki verify ($SITE): REFUSE"; exit 3
+  EXP_V4="${EXP_V4:-}"; EXP_V6="${EXP_V6:-}"
+  if [ -z "$EXP_V4" ]; then
+    nrefuse "could not derive octavia's provider v4 VIP from $VIP_OVERLAY -- refusing rather than asserting against an empty expectation"
+    return 3
+  fi
+  return 0
+}
+
+# IP-LITERAL NORMALISER. openssl prints IPv6 EXPANDED AND UPPERCASE
+# (`2602:F3E2:F02:11:0:0:0:57`) while the overlay carries the compressed form, so a literal
+# string compare would FAIL a CORRECT certificate (the T13 false-fail guard). stdin: one
+# literal per line; stdout: the compressed form, or UNPARSEABLE:<x> which can never match.
+norm_ips() {
+  python3 -c '
+import sys, ipaddress
+for line in sys.stdin:
+    s = line.strip()
+    if not s: continue
+    try: print(ipaddress.ip_address(s).compressed)
+    except ValueError: print("UNPARSEABLE:"+s)
+'
+}
+
+# THE DNS ZONE, DERIVED AND NEVER TYPED (D-008 shape, D-117 labels -- see A12's block for
+# why the label question is settled). Sets REGION, DC_DNS, EXP_ZONE.
+#   REGION = ${SITE%%-*}   vr1-dc0 -> vr1     (D-008 <region>)
+#   DC_DNS = ${SITE#*-}    vr1-dc0 -> dc0     (D-008 <dc>, 0-indexed per D-117)
+#   zone   = omega.<dc>.<region>.cloud.neumatrix.local
+# `omega` is D-008's <cloud> label, carried unchanged by D-106's VR1 instantiation.
+derive_zone() {
+  REGION="${SITE%%-*}"
+  DC_DNS="${SITE#*-}"
+  EXP_ZONE="omega.${DC_DNS}.${REGION}.cloud.neumatrix.local"
+}
+
+# The subject CN of a certificate, or "" if unreadable. `-nameopt multiline` is used rather
+# than parsing the one-line form because the one-liner's separator is ", " -- which is also
+# legal INSIDE a CN value, so splitting it can silently truncate a name.
+cn_of() {
+  openssl x509 -in "$1" -noout -subject -nameopt multiline 2>/dev/null \
+    | sed -n 's/^ *commonName *= *//p' | head -1
+}
+
+# The DC-label CA-subject token, derived the same way the runbook derives it. Hoisted with
+# the rest: `reissue` must recognise the CA it is about to sign with by the SAME name the
+# checker recognises it by, or the two can disagree about which DC's CA this is.
+derive_dc_label() { DC_LABEL="$(printf '%s' "$SITE" | tr 'a-z-' 'A-Z ')"; }
+
+ACTION="${1:-}"; SITE="${2:-}"
+[ -n "$ACTION" ] || usage
+case "$ACTION" in
+  verify|reissue) : ;;
+  # `generate` stays UNIMPLEMENTED and still exits 2. `reissue` is not a backdoor to it: it
+  # REFUSES unless an existing controller certificate is already there to be replaced, and
+  # it regenerates NO CA. Minting a FIRST key pair remains D-137 open fork 1's to rule.
+  *) echo "unknown action '$ACTION' ('verify' and 'reissue' are implemented; 'generate' deliberately is not -- see the header)"; usage ;;
+esac
+[ -n "$SITE" ] || usage
+# Region-qualified only. A bare `dc0` has been a live defect class in this repo.
+case "$SITE" in
+  vr1-dc0|vr1-dc1) : ;;
+  dc0|dc1|dc2) echo "REJECT: site '$SITE' is not region-qualified -- use vr1-dc0 / vr1-dc1"; exit 2 ;;
+  *) echo "REJECT: unknown site '$SITE'"; exit 2 ;;
+esac
+
+# Flags exist for `reissue` ONLY. `verify` takes none, and is REJECTED rather than silently
+# ignoring one -- a `verify --force` that quietly did nothing would read as an approval.
+FORCE=0; DRYRUN=0
+shift 2 2>/dev/null || true
+for a in "$@"; do
+  case "$a" in
+    --force)   FORCE=1 ;;
+    --dry-run) DRYRUN=1 ;;
+    *) echo "REJECT: unknown option '$a'"; usage ;;
+  esac
+done
+if [ "$ACTION" = "verify" ] && { [ "$FORCE" = 1 ] || [ "$DRYRUN" = 1 ]; }; then
+  echo "REJECT: --force / --dry-run apply to 'reissue' only; 'verify' never mutates anything"; exit 2
 fi
+
+# ============================================================================= reissue
+# THE MINTER. Scope is RULED and narrow: it replaces the CONTROLLER LEAF certificate and
+# its key, signed by the EXISTING controller CA. It regenerates NO CA, and it changes
+# exactly ONE overlay value (`lb-mgmt-controller-cert`); the other four must come out
+# BYTE-IDENTICAL, which the surgery proof measures rather than assumes.
+#
+# PRECISION ABOUT THAT CLAIM (2026-07-30). What is PROVEN is byte-identity of the RESULT:
+# the proof is a line diff, so it establishes that the other four values are unchanged, not
+# that they were never rewritten. Both are true here -- the surgery carries the original
+# lines through untouched and re-derives nothing -- but only the first is measured, and
+# "byte-identical" and "untouched" are different claims. Stated so a future reader does not
+# infer a guarantee the check cannot make: an implementation that re-encoded a value to
+# coincidentally identical bytes would pass this proof, and the thing that actually rules
+# it out is that the surgery never opens the other four (the plaintext passphrase among
+# them), which is a code property, not a test property.
+#
+# WHY IT EXISTS. F9: the controller certs on both DCs carry `dc0.vr0` names -- CN and both
+# DNS SANs -- from a literal paste in 1.0-GEN.c. They are inert only while
+# os-public-hostname is unset (B5 IP-only), and A12/A13 arm themselves the moment that
+# changes. An armed assertion with no way to ACT on it is a tripwire with nothing behind
+# it, so the fix has to be executable and it has to be reproducible.
+#
+# THE DISCIPLINE, WHICH IS THE POINT. Every precondition runs BEFORE any side effect;
+# HOST AUTHORITY runs before ANY file or directory is created and `--force` does not
+# bypass it; a full backup is taken before the first byte is minted; the mint happens in a
+# STAGING directory and is asserted there; promotion is the LAST thing that moves. F8 is
+# the reason the openssl config is built one `printf` at a time and then asserted
+# STRUCTURALLY: an indented heredoc terminator silently produced a SAN-less certificate on
+# live material on 2026-07-29, and every command in that chain still printed OK.
+#
+# EXIT: 0 ok/dry-run | 1 FAIL (measured defect, or a staged assertion failed -- nothing
+# promoted) | 2 bad args | 3 REFUSE (could not evaluate, or could not make it safe) |
+# 4 REFUSE, already correct | 5 PARTIAL, rollback required.
+STG=""; PROMOTING=0; RESTORE_CMD=""
+SELF="${BASH_SOURCE[0]}"
+
+cleanup_stg() {
+  # `set -u` safe and idempotent: the trap is armed for the whole run, and STG is empty
+  # until staging actually exists.
+  if [ -n "${STG:-}" ] && [ -d "${STG:-}" ]; then rm -rf "${STG:-}"; fi
+  return 0
+}
+on_signal() {
+  cleanup_stg
+  # A signal DURING promotion is the one case that leaves a half-moved workspace. It gets
+  # the PARTIAL code and the restore command, not a generic abort -- exit status is how the
+  # caller learns whether it must roll back.
+  if [ "${PROMOTING:-0}" = 1 ]; then
+    echo "octavia-pki reissue ($SITE): PARTIAL -- interrupted DURING promotion; rollback required"
+    echo "  restore: $RESTORE_CMD"
+    exit 5
+  fi
+  echo "octavia-pki reissue ($SITE): REFUSE -- interrupted before promotion; nothing was promoted"
+  exit 3
+}
+
+# Terminal helpers. Each states WHERE the run stopped, because "FAIL" alone does not tell
+# the operator whether anything moved.
+rfail() { nfail "$1"; echo "octavia-pki reissue ($SITE): FAIL -- measured defect; NOTHING was minted, promoted or rewritten"; exit 1; }
+rref()  { nrefuse "$1"; echo "octavia-pki reissue ($SITE): REFUSE -- could not evaluate or could not make it safe; NOTHING was minted"; exit 3; }
+sfail() { nfail "$1"; echo "octavia-pki reissue ($SITE): FAIL -- a STAGED assertion failed; staging discarded, NOTHING promoted"; exit 1; }
+pfail() { nfail "$1"; echo "octavia-pki reissue ($SITE): PARTIAL -- promotion was interrupted; rollback REQUIRED"; echo "  restore: $RESTORE_CMD"; exit 5; }
+
+# Hex serials compare as INTEGERS, never as strings: '0x9' and '0x10' order backwards
+# lexically, and openssl pads inconsistently across versions.
+norm_hex() { printf '%s' "${1:-}" | tr -d ' \t\r\n' | tr 'a-f' 'A-F' | sed 's/^0*//;s/^$/0/'; }
+
+do_reissue() {
+  echo "=== octavia-pki reissue: $SITE ==="
+  if [ "$DRYRUN" = 1 ]; then echo "  (--dry-run: nothing will be created, minted, promoted or rewritten)"; fi
+  if [ "$FORCE" = 1 ]; then echo "  (--force: overrides the already-correct REFUSE and NOTHING else -- host authority, the backup and every assertion still apply)"; fi
+
+  # ------------------------------------------------------------------ P0 tools (REFUSE 3)
+  command -v openssl >/dev/null 2>&1 || nrefuse "openssl is not on PATH -- cannot mint or evaluate any certificate (this is a MISSING TOOL, not a bad PKI)"
+  command -v python3 >/dev/null 2>&1 || nrefuse "python3 is not on PATH -- needed to parse the VIP overlay, normalise IPv6 literals and rewrite the deploy overlay"
+  command -v tar     >/dev/null 2>&1 || nrefuse "tar is not on PATH -- the pre-mint backup cannot be taken, and this minter does not proceed without one"
+  if [ "$NREFUSE" -ne 0 ]; then
+    echo "octavia-pki reissue ($SITE): REFUSE -- preconditions unmet; NOTHING was minted"; exit 3
+  fi
+
+  # ---------------------------------------------- P1 HOST AUTHORITY, before ANY side effect
+  # FIRST among substantive checks and BEFORE any file or directory is created. A minter
+  # that discovers it is on the wrong machine after taking a backup has already written to
+  # a filesystem it had no authority over. `--force` does not reach this: --force overrides
+  # the already-correct refusal only.
+  if ! assert_host_authority; then
+    echo "octavia-pki reissue ($SITE): REFUSE -- not the declared headend; NOTHING was created, minted or promoted"; exit 3
+  fi
+
+  W="$PKI_HOME/octavia-pki/$SITE"
+  ISS_CERT="$W/issuing-ca/issuing-ca.cert.pem"
+  CA_CERT="$W/controller-ca/controller-ca.cert.pem"
+  CA_KEY="$W/controller-ca/controller-ca.key.enc"
+  CA_PASS="$W/controller-ca/passphrase.txt"
+  CA_SRL="$W/controller-ca/controller-ca.cert.srl"
+  CON_CERT="$W/controller/controller.cert.pem"
+  CON_KEY="$W/controller/controller.key"
+  CON_BUNDLE="$W/controller/controller.bundle.pem"
+  OVERLAY="$REPO_ROOT/overlays/${SITE}-octavia-pki.yaml"
+  OVL_TMP="${OVERLAY}.tmp"
+
+  # ------------------------------------------------------- P2 the workspace (FAIL 1)
+  # Absence is CONCLUSIVE -- we looked and it is not there -- so this FAILS rather than
+  # refusing, matching A1/A2's ruling in `verify`.
+  [ -d "$W" ] || rfail "P2 workspace $W does not exist -- this DC's PKI has never been generated, and reissue replaces; it does not create"
+  MISSING=()
+  for rel in issuing-ca/passphrase.txt issuing-ca/issuing-ca.key.enc issuing-ca/issuing-ca.cert.pem \
+             controller-ca/passphrase.txt controller-ca/controller-ca.key.enc controller-ca/controller-ca.cert.pem \
+             controller-ca/controller-ca.cert.srl \
+             controller/controller.key controller/controller.cert.pem controller/controller.bundle.pem; do
+    [ -f "$W/$rel" ] || MISSING+=("$rel")
+  done
+  [ "${#MISSING[@]}" -eq 0 ] || rfail "P2 missing ${#MISSING[@]} expected artifact(s): ${MISSING[*]} -- reissue will not run against a partial workspace"
+  ok "P2 all 10 workspace artifacts present"
+
+  # ----------------------------------------- P3 the SIGNING CA's material (FAIL 1/REFUSE 3)
+  # PRESENT-BUT-UNREADABLE is a different fact from ABSENT and gets a different verdict:
+  # "could not look" is never "nothing there".
+  for f in "$CA_CERT" "$CA_KEY" "$CA_PASS"; do
+    [ -f "$f" ] || rfail "P3 controller-CA material absent at $f -- the EXISTING CA signs this certificate and is never regenerated here"
+    [ -r "$f" ] || rref  "P3 controller-CA material present but UNREADABLE at $f (permissions?) -- refusing rather than half-evaluating the CA we are about to sign with"
+  done
+  # BY LENGTH, NEVER BY VALUE. 1.0-GEN.b asserts the same 44 (openssl rand -base64 32,
+  # newline stripped). The passphrase is never read into this process: openssl consumes it
+  # directly via `-passin file:`.
+  PASSLEN="$(wc -c < "$CA_PASS" 2>/dev/null | tr -d ' ')"
+  [ "${PASSLEN:-0}" = "44" ] || rfail "P3 controller-CA passphrase file is ${PASSLEN:-0} bytes, expected 44 (the same number 1.0-GEN.b asserts) -- checked by LENGTH; the value is never printed or read into this process"
+  ok "P3 controller-CA cert/key/passphrase present and readable; passphrase is 44 bytes (verified by length, never printed)"
+
+  # ------------------------------------------------- P4 the CA is the RIGHT CA (FAIL 1)
+  derive_dc_label
+  openssl verify -CAfile "$CA_CERT" "$CA_CERT" >/dev/null 2>&1 \
+    || rfail "P4 the controller CA does NOT verify against itself -- refusing to sign anything with a CA that fails its own signature check"
+  CA_SUBJ="$(openssl x509 -in "$CA_CERT" -noout -subject 2>/dev/null)"
+  # SUBSTRING on the DC-label token, identical to A5's check_subject: the full subject also
+  # carries O=Neumatrix, so literal equality of the whole subject can never hold.
+  case "$CA_SUBJ" in
+    *"$DC_LABEL Omega Cloud Octavia Controller CA"*)
+      ok "P4 signing CA self-verifies and its subject names THIS DC ('$DC_LABEL Omega Cloud Octavia Controller CA')" ;;
+    *)
+      rfail "P4 the signing CA's subject does NOT contain '$DC_LABEL Omega Cloud Octavia Controller CA' -- got: ${CA_SUBJ#subject=}; this is F1's cross-DC mix-up and signing would bind this DC's cert to another DC's root" ;;
+  esac
+
+  # -------------------------------------------------------- P5 CA issuance STATE (FAIL 1)
+  # This minter signs with `-CAserial` and NOT `-CAcreateserial`, deliberately: with
+  # -CAserial alone openssl FAILS on a missing serial file, whereas -CAcreateserial would
+  # silently start a fresh random sequence and let the same CA issue a DUPLICATE serial.
+  # The gate is here as well as in the flag so the operator gets a sentence, not a stack.
+  [ -f "$CA_SRL" ] || rfail "P5 controller-ca.cert.srl is ABSENT -- the CA's issuance state is gone; minting now risks a DUPLICATE serial from this CA. Restore it before reissuing"
+  SRL_BEFORE="$(norm_hex "$(tr -d ' \t\r\n' < "$CA_SRL")")"
+  [ -n "$SRL_BEFORE" ] || rfail "P5 controller-ca.cert.srl is EMPTY -- openssl cannot continue a sequence that has no current value"
+  ok "P5 CA serial file present (current $SRL_BEFORE); signing with -CAserial, never -CAcreateserial"
+
+  # ------------------------------------------------- P6 the expected IP SANs (REFUSE 3)
+  derive_vips || { echo "octavia-pki reissue ($SITE): REFUSE -- the expected IP SANs could not be derived; NOTHING was minted"; exit 3; }
+
+  # ---------------------------------------------------------- P7 VIP plausibility
+  # Keystone's provider v4 leg is the reference prefix. Selected BY ADDRESS FAMILY, not by
+  # position: 1.0-GEN.c's own gate takes `.split()[0]`, which is only correct while the v4
+  # leg happens to be listed first. Both DCs satisfy that today, so the divergence is
+  # invisible right now -- which is exactly when it is cheap to fix.
+  # A PARSE failure REFUSES (we could not look); a parsed address OUTSIDE the prefix FAILS
+  # (we looked, and it is wrong).
+  VIPCHK="$(python3 - "$VIP_OVERLAY" "$EXP_V4" <<'PY'
+import sys, ipaddress, yaml
+try:
+    v = yaml.safe_load(open(sys.argv[1]))["applications"]["keystone"]["options"]["vip"].split()
+except Exception:
+    print("PARSE_FAIL"); sys.exit(0)
+k4 = next((a for a in v if ipaddress.ip_address(a).version == 4), "")
+if not k4:
+    print("PARSE_FAIL"); sys.exit(0)
+try:
+    o4 = ipaddress.ip_address(sys.argv[2])
+except ValueError:
+    print("PARSE_FAIL"); sys.exit(0)
+net = ipaddress.ip_network(k4 + "/24", strict=False)
+print(("OK " if o4 in net else "OUTSIDE ") + str(net))
+PY
+)"
+  case "$VIPCHK" in
+    "OK "*)      ok "P7 octavia's provider v4 VIP $EXP_V4 sits inside keystone's provider prefix ${VIPCHK#OK }" ;;
+    "OUTSIDE "*) rfail "P7 octavia's provider v4 VIP $EXP_V4 is OUTSIDE keystone's provider prefix ${VIPCHK#OUTSIDE } -- an implausible VIP would be baked into the certificate as an IP SAN" ;;
+    *)           rref  "P7 could not derive keystone's provider v4 VIP from $VIP_OVERLAY -- refusing to sanity-check the SAN against an expectation we could not read" ;;
+  esac
+
+  # ------------------------------- P8 there must be something to REISSUE (REFUSE 3)
+  # THE GENERATE FIREWALL. reissue REPLACES; it does not CREATE. Without this, a workspace
+  # missing only its leaf certificate would quietly get a first-ever mint from a script
+  # whose whole charter says minting a first cert belongs to `generate` -- which is
+  # deliberately unimplemented pending D-137 open fork 1.
+  # NOTE (found, not changed): P2 above already FAILs 1 when controller.cert.pem is absent,
+  # per the ruled ordering, so this REFUSE is reachable only for a cert that is PRESENT but
+  # unparseable. It is kept as its own gate anyway -- the firewall should be stated where a
+  # future reader looks for it, not left implicit in another check's artifact list.
+  OLD_CN="$(cn_of "$CON_CERT")"
+  OLD_SERIAL="$(openssl x509 -in "$CON_CERT" -noout -serial 2>/dev/null | sed 's/^serial=//')"
+  if [ -z "$OLD_SERIAL" ]; then
+    rref "P8 there is no READABLE existing controller certificate at $CON_CERT. Minting a FIRST certificate is 'generate', which is deliberately unimplemented (D-137 open fork 1) -- reissue does not become a generate backdoor by accident"
+  fi
+  OLD_PUB="$(openssl x509 -in "$CON_CERT" -noout -pubkey 2>/dev/null | openssl pkey -pubin -pubout -outform DER 2>/dev/null | sha256sum | cut -d' ' -f1)"
+  ok "P8 an existing controller certificate is present and readable (serial $(norm_hex "$OLD_SERIAL")) -- this is a REPLACEMENT"
+
+  # ------------------------------------------------------ P9 the names, derived (FAIL 1)
+  derive_zone
+  NEW_CN="octavia-controller.${EXP_ZONE}"
+  NEW_DNS1="$NEW_CN"
+  NEW_DNS2="octavia.${EXP_ZONE}"
+  # X.509 caps commonName at 64 characters (ub-common-name). Past that openssl truncates or
+  # errors depending on version, and a truncated CN is a name that silently means something
+  # else. Checked BEFORE anything is created because it is a property of the derived zone.
+  [ "${#NEW_CN}" -le 64 ] || rfail "P9 the derived CN '$NEW_CN' is ${#NEW_CN} characters, over X.509's 64-character commonName limit -- the zone is too long to name this way"
+  ok "P9 derived zone '$EXP_ZONE'; CN '$NEW_CN' is ${#NEW_CN} chars (<= 64)"
+
+  # ------------------------------------- P10 the deploy overlay, BEFORE the mint (FAIL 1)
+  # F4 TIMING. These are the same checks A10 makes, hoisted to run BEFORE anything is
+  # minted. Order is the whole point: discovering after promotion that the overlay is not
+  # gitignored means a CA private key is committable AND the workspace has already moved.
+  [ -f "$OVERLAY" ] || rfail "P10 deploy overlay absent at overlays/${SITE}-octavia-pki.yaml -- reissue rewrites one value in it and will not create it"
+  OVL_MODE="$(stat -c '%a' "$OVERLAY" 2>/dev/null)"
+  [ "$OVL_MODE" = "600" ] || rfail "P10 overlay is $OVL_MODE -- it carries CA key blobs plus a plaintext passphrase and must be 0600 BEFORE we write to it"
+  OVL_KEYS="$(grep -c 'lb-mgmt-' "$OVERLAY" 2>/dev/null || true)"
+  [ "$OVL_KEYS" = "5" ] || rfail "P10 overlay declares $OVL_KEYS lb-mgmt-* key(s), expected 5 -- refusing to operate on an overlay whose shape we do not recognise"
+  if LC_ALL=C grep -qP '[^\x00-\x7F]' "$OVERLAY" 2>/dev/null; then
+    rfail "P10 overlay contains non-ASCII bytes -- the surgery reads and rewrites it as ASCII and would corrupt it"
+  fi
+  git -C "$REPO_ROOT" check-ignore -q "$OVERLAY" 2>/dev/null \
+    || rfail "P10 overlay is NOT gitignored -- a CA private key is committable RIGHT NOW (F4); refusing to write MORE secret material into a committable file"
+  # The TEMP path is gated too, and gated HERE rather than at the write. check-ignore is
+  # pure pattern matching and needs no file to exist, so there is no reason to learn this
+  # after promotion -- when the answer would arrive as an exit-5 partial instead of a clean
+  # refusal with nothing touched.
+  git -C "$REPO_ROOT" check-ignore -q "$OVL_TMP" 2>/dev/null \
+    || rfail "P10 the surgery's temp path ${OVL_TMP##*/} is NOT gitignored -- it briefly holds the same CA key blobs as the overlay; add a rule covering it before reissuing"
+  # A leftover temp file means a previous run died mid-surgery. O_EXCL would fail on it
+  # later; it is REFUSED here instead, and deliberately NOT deleted -- silently removing the
+  # evidence of a half-finished write is how the O_EXCL guard gets defeated.
+  if [ -e "$OVL_TMP" ]; then
+    rref "P10 a STALE temp file is present at $OVL_TMP -- a previous surgery did not finish. Inspect and remove it deliberately; this script will not delete it for you"
+  fi
+  # THE TWO CHECKS THE SURGERY'S OWN PROOF USED TO MAKE *AFTER* PROMOTION (added 2026-07-30).
+  # FOUND BY ADVERSARIAL REVIEW. Both are pure functions of state that exists BEFORE this run
+  # starts, yet they were only discovered by the post-surgery proof -- so a pre-existing
+  # overlay defect produced exit 5 (PARTIAL, roll back) with the workspace already promoted
+  # and a CA serial burned, when the honest answer was "your overlay was already wrong,
+  # nothing was touched". This script's own rule is every precondition before any side
+  # effect; these two were on the wrong side of it.
+  #   (a) EXACTLY ONE lb-mgmt-controller-cert line. The surgery requires hits==1. A file with
+  #       two would satisfy P10's `lb-mgmt-` count of 5 only if another key were missing --
+  #       but the count cannot tell those apart, which is precisely why it is not sufficient.
+  #   (b) lb-mgmt-controller-cacert must ALREADY decode to THIS DC's controller CA. If it
+  #       does not, the overlay belongs to another DC or another generation (the F1 cross-DC
+  #       mix-up), and rewriting one value in it would produce a file whose cert and CA come
+  #       from different trust domains -- deployable, and broken at the amphora handshake.
+  OVL_PRE="$(python3 - "$OVERLAY" "$CA_CERT" <<'PY' 2>/dev/null || true
+import base64, hashlib, sys, yaml
+n = sum(1 for l in open(sys.argv[1], encoding="ascii", errors="replace")
+        if l.lstrip().startswith("lb-mgmt-controller-cert:"))
+try:
+    o = yaml.safe_load(open(sys.argv[1]))["applications"]["octavia"]["options"]
+except Exception:
+    print("LINES=%d CACERT=UNREADABLE" % n); raise SystemExit(0)
+v = o.get("lb-mgmt-controller-cacert")
+tag = "ABSENT"
+if v:
+    try:
+        tag = "OK" if hashlib.sha256(base64.b64decode(v, validate=True)).hexdigest() == \
+                       hashlib.sha256(open(sys.argv[2], "rb").read()).hexdigest() else "MISMATCH"
+    except Exception:
+        tag = "UNDECODABLE"
+print("LINES=%d CACERT=%s" % (n, tag))
+PY
+)"
+  case "$OVL_PRE" in
+    "LINES=1 CACERT=OK") : ;;
+    LINES=1*CACERT=MISMATCH)
+      rfail "P10 the overlay's lb-mgmt-controller-cacert does NOT decode to this DC's controller CA -- this overlay does not belong to $SITE (the F1 cross-DC mix-up). Rewriting one value in it would ship a cert and a CA from different trust domains; nothing minted" ;;
+    LINES=1*)
+      rfail "P10 could not confirm the overlay's controller CA value ($OVL_PRE) -- refusing to mint against an overlay whose existing contents we cannot read" ;;
+    "")
+      rref "P10 could not evaluate the overlay's pre-state -- no conclusion drawn, nothing minted" ;;
+    *)
+      rfail "P10 the overlay carries a lb-mgmt-controller-cert line count that is not 1 ($OVL_PRE) -- the surgery rewrites exactly one line and will not guess which; nothing minted" ;;
+  esac
+  ok "P10 overlay pre-checks pass (0600, 5 keys, ASCII, gitignored, temp path ignored, exactly one controller-cert line, and its CA value already matches this DC), all BEFORE the mint"
+
+  # ==================================================== THE RE-RUN GUARD (REFUSE 4)
+  # Reissuing a certificate that is ALREADY correct rotates a key for nothing, burns a CA
+  # serial and rewrites a deploy overlay -- three mutations with no defect behind them.
+  #
+  # THE VACUOUS-TRUTH GUARD IS THE LOAD-BEARING PART. The obvious implementation walks the
+  # DNS SANs and refuses if none is wrong. On a cert with ZERO DNS SANs that loop iterates
+  # zero times, finds nothing wrong, and REFUSES -- on the single WORST certificate the
+  # estate can hold, which is F8's exact output. So the count is asserted FIRST: "already
+  # correct" requires exactly 2 DNS SANs that ARE the expected pair, plus a matching CN.
+  OLD_DNS="$(openssl x509 -in "$CON_CERT" -noout -ext subjectAltName 2>/dev/null | grep -oE 'DNS:[^,[:space:]]+' | sed 's/^DNS://')"
+  OLD_DNS_N="$(printf '%s\n' "$OLD_DNS" | grep -c . || true)"
+  ALREADY=0
+  if [ "$OLD_DNS_N" = "2" ] && [ "$OLD_CN" = "$NEW_CN" ]; then
+    G1=0; G2=0
+    for n in $OLD_DNS; do
+      if [ "$n" = "$NEW_DNS1" ]; then G1=1; fi
+      if [ "$n" = "$NEW_DNS2" ]; then G2=1; fi
+    done
+    if [ "$G1" = 1 ] && [ "$G2" = 1 ]; then ALREADY=1; fi
+  fi
+  # THE GUARD IS THE WHOLE PREDICATE, NOT JUST THE NAMES (hardened 2026-07-30).
+  # FOUND BY ADVERSARIAL REVIEW. The name comparison above answers "are the names right?",
+  # and the first version treated that as "is the certificate right?". Measured consequence:
+  # a certificate whose CN and DNS SANs matched but whose IP SAN was stale made `verify`
+  # FAIL while `reissue` exited 4 saying "nothing to fix" -- the remedy refusing the exact
+  # defect the checker had just reported, in the same workspace, seconds apart.
+  # It does not bite on the CURRENT reissue (today the names ARE wrong, so it proceeds), but
+  # it bites on every run afterwards -- including the 2-year renewal this reissue starts the
+  # clock on, where an EXPIRED cert with correct names would be refused as "already correct".
+  # SO: "already correct" now means the names match AND `verify` returns clean. verify is the
+  # repo's own definition of a healthy PKI, so this cannot drift from it -- and A16/A17 (new
+  # today) mean expiry and overlay desync are inside that definition rather than outside it.
+  if [ "$ALREADY" = 1 ]; then
+    if OCTAVIA_PKI_REPO="$REPO_ROOT" OCTAVIA_PKI_HOME="$PKI_HOME" \
+       OCTAVIA_PKI_THIS_HOST="$THIS_HOST" bash "$SELF" verify "$SITE" >/dev/null 2>&1; then
+      : # names right AND verify clean -- genuinely nothing to do
+    else
+      ALREADY=0
+      ok "re-run guard: the NAMES already match '$EXP_ZONE', but 'verify' does NOT return clean -- something else about this certificate is wrong (stale IP SAN, expiry, key/cert mismatch, overlay desync). Reissue is warranted; run 'verify' afterwards to confirm what remains"
+    fi
+  fi
+  if [ "$ALREADY" = 1 ] && [ "$FORCE" != 1 ]; then
+    ok "re-run guard: CN and both DNS SANs already match the derived zone '$EXP_ZONE', and verify returns clean"
+    echo "octavia-pki reissue ($SITE): REFUSE (already correct) -- nothing to fix, so nothing is rotated. Use --force to reissue anyway (it overrides THIS check only)"
+    exit 4
+  fi
+  if [ "$ALREADY" = 1 ]; then
+    ok "re-run guard: the certificate is already correct, but --force was given -- reissuing anyway"
+  else
+    ok "re-run guard: reissue is warranted (CN '$OLD_CN' and/or the $OLD_DNS_N DNS SAN(s) do not match the derived zone '$EXP_ZONE')"
+  fi
+
+  # ============================================== BACKUP, BEFORE THE FIRST BYTE IS MINTED
+  # umask FIRST: the archive is the first thing created and it contains CA private keys, so
+  # it must never exist group/world-readable even for the instant before chmod.
+  umask 077
+  ARCH=""; ARCH_SHA=""
+  # DELIBERATE DEVIATION: --dry-run takes NO backup. A backup exists to make a mutation
+  # reversible, and a dry run has nothing to reverse -- so the archive would be a pure
+  # addition of a second at-rest copy of CA private keys plus a plaintext passphrase, for no
+  # benefit. This repo has already ruled on that exact trade: 1.0-GEN.b's note records the
+  # operator DECLINING a second at-rest copy on the grounds that it "widens the exposure".
+  # A dry run that quietly writes a tarball of CA keys is also just a lie about its name.
+  if [ "$DRYRUN" = 1 ]; then
+    ok "backup: SKIPPED -- --dry-run mutates nothing, so there is nothing to roll back and no reason to write a second copy of this DC's CA keys to disk"
+  else
+  BKDIR="$PKI_HOME/octavia-pki/backups"
+  mkdir -p "$BKDIR" || rref "backup: could not create $BKDIR -- refusing to mint without a restorable pre-image"
+  # THE NAME MUST BE UNIQUE, NOT MERELY TIMESTAMPED (hardened 2026-07-30, found by adversarial
+  # review). The stamp is 1-second granular and `tar czf` OVERWRITES: 12 consecutive runs were
+  # measured producing only 9 archives, silently destroying 3 pre-images. That bites hardest in
+  # exactly the sequence where it matters -- an exit-5 partial followed by a quick retry, where
+  # the overwritten archive is the only copy of the pre-reissue overlay. $$ disambiguates, and
+  # the existence check below refuses rather than clobbering if it somehow still collides.
+  ARCH="$BKDIR/${SITE}-octavia-pki-$(date -u +%Y%m%dT%H%M%SZ)-$$.tar.gz"
+  [ -e "$ARCH" ] && rref "backup: $ARCH already exists -- refusing to overwrite a restore point"
+  # BOTH halves of the state this run can change: the workspace AND the deploy overlay.
+  # Backing up only the workspace would leave the overlay unrecoverable, and the overlay is
+  # the half that actually reaches the cloud.
+  tar czf "$ARCH" -C "$PKI_HOME/octavia-pki" "$SITE" -C "$REPO_ROOT" "overlays/${SITE}-octavia-pki.yaml" 2>/dev/null \
+    || rref "backup: tar FAILED -- refusing to mint without a restorable pre-image"
+  chmod 600 "$ARCH" || rref "backup: could not chmod 600 $ARCH -- it contains CA private keys"
+  ARCH_SHA="$(sha256sum "$ARCH" | cut -d' ' -f1)"
+  ARCH_ENTS="$(tar tzf "$ARCH" 2>/dev/null)"
+  ARCH_N="$(printf '%s\n' "$ARCH_ENTS" | grep -c . || true)"
+  # A backup is only a backup if it demonstrably contains the things it is supposed to. An
+  # archive that tar created happily but that holds three files is not a rollback.
+  [ "${ARCH_N:-0}" -ge 11 ] || rref "backup: the archive lists only ${ARCH_N:-0} entries, expected at least 11 (10 artifacts + the overlay) -- refusing to mint behind an incomplete backup"
+  grep -Fxq "overlays/${SITE}-octavia-pki.yaml" <<<"$ARCH_ENTS" \
+    || rref "backup: the archive does NOT contain overlays/${SITE}-octavia-pki.yaml -- the half that reaches the cloud would be unrecoverable"
+  RESTORE_CMD="tar xzf $ARCH -C $PKI_HOME/octavia-pki $SITE && tar xzf $ARCH -C $REPO_ROOT overlays/${SITE}-octavia-pki.yaml"
+  ok "backup: $ARCH ($ARCH_N entries, 0600)"
+  echo "  sha256:  $ARCH_SHA"
+  echo "  restore: $RESTORE_CMD"
+  fi
+
+  # =========================================================== STAGING + THE F8 CONFIG
+  # A LEFTOVER STAGING DIR IS REPORTED, NOT IGNORED (added 2026-07-30, found by adversarial
+  # review). SIGKILL between signing and promotion leaves a staging dir holding a VALID
+  # CA-signed certificate and a fresh UNENCRYPTED private key, 0600, with a serial already
+  # consumed for it -- a live credential outside the D-137 register that `verify` does not
+  # mention and that a later run neither noticed nor cleaned. The stale-temp-file gate in
+  # P10 already applies this discipline to the overlay's `.tmp`; staging was the gap.
+  # REPORTED, NOT DELETED, and deliberately not fatal: the material is the operator's to
+  # inspect, and silently removing evidence of a half-finished mint is how the guard gets
+  # defeated. Naming it is what makes it actionable.
+  STALE_STG="$(find "$PKI_HOME/octavia-pki" -maxdepth 1 -type d -name ".reissue-${SITE}.*" 2>/dev/null | head -5)"
+  if [ -n "$STALE_STG" ]; then
+    echo "  NOTE    a previous reissue left staging director(ies) behind -- each may hold a CA-signed"
+    echo "          certificate and an unencrypted private key that no register declares. Inspect and"
+    echo "          remove them deliberately; this run will not touch them:"
+    printf '%s\n' "$STALE_STG" | sed 's/^/            /'
+  fi
+  STG="$(mktemp -d "$PKI_HOME/octavia-pki/.reissue-${SITE}.XXXXXX" 2>/dev/null)" \
+    || rref "staging: could not create a staging directory beside the workspace"
+  trap cleanup_stg EXIT
+  trap on_signal INT TERM HUP
+
+  # ONE printf PER LINE, APPENDING. NO HEREDOC. This is the F8 payoff: on 2026-07-29 an
+  # INDENTED heredoc terminator in 1.0-GEN.c silently yielded a config with no [alt_names]
+  # section and therefore a certificate with NO SANs AT ALL, while every command in the
+  # chain printed OK. A heredoc's correctness depends on invisible leading whitespace on a
+  # line nobody reads; a printf's does not.
+  # Values are passed as %s ARGUMENTS, never interpolated into the format string -- a '%' in
+  # a hostname or an address must be data, not a directive.
+  CNF="$STG/controller.cnf"
+  : > "$CNF"
+  printf '%s\n' '[req]'                                                  >> "$CNF"
+  printf '%s\n' 'distinguished_name = req_distinguished_name'            >> "$CNF"
+  printf '%s\n' 'req_extensions = v3_req'                                >> "$CNF"
+  printf '%s\n' 'prompt = no'                                            >> "$CNF"
+  printf '\n'                                                            >> "$CNF"
+  printf '%s\n' '[req_distinguished_name]'                               >> "$CNF"
+  printf 'CN = %s\n' "$NEW_CN"                                           >> "$CNF"
+  printf '%s\n' 'O = Neumatrix'                                          >> "$CNF"
+  printf '\n'                                                            >> "$CNF"
+  printf '%s\n' '[v3_req]'                                               >> "$CNF"
+  printf '%s\n' 'keyUsage = critical, digitalSignature, keyEncipherment' >> "$CNF"
+  printf '%s\n' 'extendedKeyUsage = clientAuth, serverAuth'              >> "$CNF"
+  printf '%s\n' 'subjectAltName = @alt_names'                            >> "$CNF"
+  printf '\n'                                                            >> "$CNF"
+  printf '%s\n' '[alt_names]'                                            >> "$CNF"
+  printf 'DNS.1 = %s\n' "$NEW_DNS1"                                      >> "$CNF"
+  printf 'DNS.2 = %s\n' "$NEW_DNS2"                                      >> "$CNF"
+  printf 'IP.1 = %s\n' "$EXP_V4"                                         >> "$CNF"
+  # `if/fi`, never `[ -n "$EXP_V6" ] && printf ...`: a bare && as a function's LAST statement
+  # returns the test's status, so a v4-only DC would make this function "fail" on success.
+  if [ -n "$EXP_V6" ]; then
+    printf 'IP.2 = %s\n' "$EXP_V6"                                       >> "$CNF"
+  fi
+
+  # ASSERT THE CONFIG STRUCTURALLY, BEFORE SIGNING. F8's lesson is not "use printf" -- it is
+  # that the config was never CHECKED. Building it correctly and verifying it are two
+  # different claims, and only the second one survives a future edit.
+  for sec in '[req]' '[req_distinguished_name]' '[v3_req]' '[alt_names]'; do
+    grep -Fqx "$sec" "$CNF" || rfail "config assertion: section $sec is MISSING from the generated config -- this is F8's failure mode and the mint stops here"
+  done
+  grep -Fqx 'subjectAltName = @alt_names' "$CNF" || rfail "config assertion: subjectAltName is not wired to @alt_names -- the [alt_names] section would be inert and the cert would have NO SANs (F8)"
+  grep -Fqx "CN = $NEW_CN"        "$CNF" || rfail "config assertion: CN line is not exactly 'CN = $NEW_CN'"
+  grep -Fqx "DNS.1 = $NEW_DNS1"   "$CNF" || rfail "config assertion: DNS.1 is not exactly '$NEW_DNS1'"
+  grep -Fqx "DNS.2 = $NEW_DNS2"   "$CNF" || rfail "config assertion: DNS.2 is not exactly '$NEW_DNS2'"
+  CFG_NDNS="$(grep -c '^DNS\.' "$CNF" || true)"
+  # EXACTLY 2. A9 requires exactly two DNS SANs, so reissue REPLACES the pair and never adds
+  # a third: a cert that speaks for one more name than the gate expects fails that gate.
+  [ "$CFG_NDNS" = "2" ] || rfail "config assertion: the config carries $CFG_NDNS DNS entries, expected exactly 2 (A9's contract -- replace the pair, never append)"
+  grep -Fqx "IP.1 = $EXP_V4" "$CNF" || rfail "config assertion: IP.1 is not exactly this DC's provider v4 VIP '$EXP_V4'"
+  CFG_NIP="$(grep -c '^IP\.' "$CNF" || true)"
+  if [ -n "$EXP_V6" ]; then
+    grep -Fqx "IP.2 = $EXP_V6" "$CNF" || rfail "config assertion: the overlay declares a v6 provider leg but IP.2 is not exactly '$EXP_V6' (D-109 ruling note 2026-07-29)"
+    [ "$CFG_NIP" = "2" ] || rfail "config assertion: the config carries $CFG_NIP IP entries, expected exactly 2 (v4 + v6)"
+  else
+    [ "$CFG_NIP" = "1" ] || rfail "config assertion: the config carries $CFG_NIP IP entries but the overlay declares NO v6 leg, so exactly 1 is expected"
+  fi
+  ok "config assertions: 4 sections present, subjectAltName wired, CN + exactly 2 DNS + exactly $CFG_NIP IP SAN(s), all exact"
+
+  # ------------------------------------------------------------------------ --dry-run
+  if [ "$DRYRUN" = 1 ]; then
+    echo
+    echo "  --- the openssl config that WOULD be used (entirely PUBLIC: names and VIPs only) ---"
+    sed 's/^/  | /' "$CNF"
+    echo "  --- what a real run WOULD create/replace ---"
+    echo "  |  $CON_KEY     (fresh EC P-256 private key)"
+    echo "  |  $CON_CERT    (CN $NEW_CN, 730 days, signed by this DC's controller CA)"
+    echo "  |  $CON_BUNDLE  (cert + key)"
+    echo "  |  $OVERLAY     (lb-mgmt-controller-cert ONLY; the other four values unchanged)"
+    echo "  |  and it would consume CA serial $SRL_BEFORE"
+    echo "  |  a real run would FIRST write a 0600 backup archive under $PKI_HOME/octavia-pki/backups"
+    cleanup_stg
+    echo
+    echo "octavia-pki reissue ($SITE): DRY-RUN OK -- nothing was minted, promoted or rewritten"
+    exit 0
+  fi
+
+  # ==================================================================== THE MINT (staging)
+  # In a STAGING directory, never in place. The workspace's current material stays valid and
+  # untouched until every assertion below has passed; a mint that fails half way leaves the
+  # DC exactly as it was.
+  openssl genpkey -algorithm EC -pkeyopt ec_paramgen_curve:P-256 -out "$STG/controller.key" 2>/dev/null \
+    || rref "mint: could not generate a fresh EC P-256 private key -- nothing minted"
+  chmod 600 "$STG/controller.key" 2>/dev/null || true
+  # THE CURVE IS ASSERTED VIA THE PUBLIC KEY ONLY. `openssl pkey -text` on the PRIVATE key
+  # would print the private scalar; the public half proves the curve just as well and
+  # carries no secret.
+  openssl pkey -in "$STG/controller.key" -pubout -out "$STG/controller.pub" 2>/dev/null \
+    || rref "mint: could not extract the public half of the freshly generated key"
+  PUBTXT="$(openssl pkey -pubin -in "$STG/controller.pub" -noout -text 2>/dev/null)"
+  case "$PUBTXT" in
+    *prime256v1*) ok "mint: fresh private key is EC P-256 (asserted via the PUBLIC key only)" ;;
+    *)            sfail "mint: the freshly generated key is not on curve prime256v1 -- nothing promoted" ;;
+  esac
+
+  openssl req -new -sha256 -key "$STG/controller.key" -config "$CNF" -out "$STG/controller.csr" 2>/dev/null \
+    || rref "mint: openssl req could not build the CSR -- nothing minted"
+  # The CSR is self-signed by the key we just made; verifying it proves the key works and
+  # that the request was not mangled between build and sign.
+  openssl req -in "$STG/controller.csr" -noout -verify >/dev/null 2>&1 \
+    || sfail "mint: the CSR's self-signature does NOT verify -- nothing promoted"
+  CSRTXT="$(openssl req -in "$STG/controller.csr" -noout -text 2>/dev/null)"
+  CSR_NDNS="$(printf '%s\n' "$CSRTXT" | grep -oE 'DNS:[^,[:space:]]+' | wc -l | tr -d ' ')"
+  # Asserted on the CSR as well as on the config and again on the certificate: F8 proved
+  # that a config can be right and the artifact still wrong, so each transformation is
+  # checked on its own output rather than trusted because the input was good.
+  [ "$CSR_NDNS" = "2" ] || sfail "mint: the CSR carries $CSR_NDNS DNS SAN(s), expected 2 -- the request did not pick up [alt_names] (F8); nothing promoted"
+  ok "mint: CSR built, self-signature verifies, carries 2 DNS SANs"
+
+  openssl x509 -req -sha256 -in "$STG/controller.csr" \
+    -CA "$CA_CERT" -CAkey "$CA_KEY" -passin file:"$CA_PASS" \
+    -CAserial "$CA_SRL" -days 730 \
+    -extfile "$CNF" -extensions v3_req -out "$STG/controller.cert.pem" >/dev/null 2>&1 \
+    || rfail "mint: the controller CA REFUSED to sign -- the usual causes are a WRONG passphrase, an unreadable CA key, or a missing serial file. Nothing was promoted and the workspace is untouched"
+  NEWC="$STG/controller.cert.pem"
+  ok "mint: signed by this DC's controller CA (730 days, serial taken from the CA's own sequence)"
+
+  # ============================ POST-MINT ASSERTIONS, IN STAGING, BEFORE PROMOTION
+  # Any failure below exits 1 with NOTHING promoted. This is where a minter earns the right
+  # to move files: the artifact is measured, not assumed, and it is measured before it can
+  # do any harm.
+  openssl verify -CAfile "$CA_CERT" "$NEWC" >/dev/null 2>&1 \
+    || sfail "post-mint: the new certificate does NOT verify against the controller CA that just signed it"
+  # THE NEGATIVE MATTERS AS MUCH AS THE POSITIVE (A8's reasoning): the two CAs are distinct
+  # trust domains, and a chain accidentally built against the issuing CA would still look
+  # like a working 'verify OK' if only the positive case were checked.
+  # A NEGATIVE ASSERTION MUST PROVE ITS INSTRUMENT FIRST (hardened 2026-07-30, found by
+  # adversarial review). `openssl verify -CAfile X cert` exits non-zero for "does not verify"
+  # AND for "could not load X" -- so a corrupt or truncated issuing-CA file makes the check
+  # below PASS VACUOUSLY and print a reassuring line about distinct trust domains. Measured:
+  # with a corrupted issuing-ca.cert.pem the run printed "correctly does NOT verify against
+  # the issuing CA" and promoted. So: prove the CA file LOADS before drawing any conclusion
+  # from its failure to verify something.
+  openssl x509 -in "$ISS_CERT" -noout >/dev/null 2>&1 \
+    || rfail "post-mint: the issuing CA certificate could not be PARSED, so 'does not verify against it' would prove nothing about trust-domain separation -- refusing rather than concluding; nothing promoted"
+  if openssl verify -CAfile "$ISS_CERT" "$NEWC" >/dev/null 2>&1; then
+    sfail "post-mint: the new certificate ALSO verifies against the ISSUING CA -- the two CAs are not distinct trust domains; nothing promoted"
+  fi
+  ok "post-mint: verifies against the CONTROLLER CA and correctly does NOT verify against the issuing CA"
+
+  GOT_CN="$(cn_of "$NEWC")"
+  [ "$GOT_CN" = "$NEW_CN" ] || sfail "post-mint: the new certificate's CN is '$GOT_CN', expected exactly '$NEW_CN' -- nothing promoted"
+  NEW_SAN="$(openssl x509 -in "$NEWC" -noout -ext subjectAltName 2>/dev/null)"
+  [ -n "$NEW_SAN" ] || sfail "post-mint: the new certificate has NO subjectAltName extension at all -- F8's failure mode reproduced; nothing promoted"
+  GOT_DNS="$(printf '%s' "$NEW_SAN" | grep -oE 'DNS:[^,[:space:]]+' | sed 's/^DNS://')"
+  GOT_NDNS="$(printf '%s\n' "$GOT_DNS" | grep -c . || true)"
+  [ "$GOT_NDNS" = "2" ] || sfail "post-mint: the new certificate carries $GOT_NDNS DNS SAN(s), expected exactly 2 -- nothing promoted"
+  H1=0; H2=0
+  for n in $GOT_DNS; do
+    if [ "$n" = "$NEW_DNS1" ]; then H1=1; fi
+    if [ "$n" = "$NEW_DNS2" ]; then H2=1; fi
+  done
+  if [ "$H1" != 1 ] || [ "$H2" != 1 ]; then
+    sfail "post-mint: the new certificate's DNS SANs are not exactly '$NEW_DNS1' and '$NEW_DNS2' -- got: $(printf '%s' "$GOT_DNS" | tr '\n' ' '); nothing promoted"
+  fi
+  ok "post-mint: CN and both DNS SANs are exactly the derived names"
+
+  GOT_IPS="$(printf '%s' "$NEW_SAN" | grep -oE 'IP Address:[0-9A-Fa-f:.]+' | sed 's/^IP Address://')"
+  GOT_NORM="$(printf '%s\n' "$GOT_IPS" | norm_ips)"
+  GOT_NIP="$(printf '%s\n' "$GOT_NORM" | grep -c . || true)"
+  EXP_NIP=1; if [ -n "$EXP_V6" ]; then EXP_NIP=2; fi
+  grep -Fqx "$EXP_V4" <<<"$GOT_NORM" || sfail "post-mint: the new certificate is MISSING this DC's provider v4 VIP ($EXP_V4) -- nothing promoted"
+  if [ -n "$EXP_V6" ]; then
+    grep -Fqx "$EXP_V6" <<<"$GOT_NORM" || sfail "post-mint: the new certificate is MISSING this DC's provider v6 VIP ($EXP_V6) -- nothing promoted"
+  fi
+  # AND NOTHING ELSE. An EXTRA IP SAN is a name this certificate can speak for that nobody
+  # ruled it should -- the same class of defect as a missing one, and invisible to a check
+  # that only asks "is the expected address present?".
+  [ "$GOT_NIP" = "$EXP_NIP" ] || sfail "post-mint: the new certificate carries $GOT_NIP IP SAN(s), expected exactly $EXP_NIP -- an extra address is a name this cert should not be able to speak for; nothing promoted"
+  ok "post-mint: IP SANs are exactly this DC's provider leg(s) -- $EXP_V4${EXP_V6:+ and $EXP_V6}, and nothing else"
+
+  # KEY USAGE + EXTENDED KEY USAGE, ASSERTED ON THE ISSUED CERTIFICATE (2026-07-30).
+  # FOUND BY MUTATION TESTING, and it was the worst hole in this file: deleting BOTH the
+  # keyUsage and extendedKeyUsage lines from the config builder produced a certificate with
+  # NO Key Usage and NO Extended Key Usage that minted, promoted, and left the harness at
+  # 38/38 PASS. Until this block, `keyUsage` appeared EXACTLY ONCE in the whole script --
+  # the printf that writes it -- and in no assertion anywhere, in reissue or in verify.
+  # WHY IT MATTERS OPERATIONALLY: the controller certificate is used in BOTH directions
+  # against amphora agents, so losing `clientAuth` breaks the amphora->controller handshake
+  # while `serverAuth` still works. That is a one-directional TLS failure at LB-create time
+  # with every gate reading PASS -- the hardest possible shape to debug.
+  # Asserted on the CERT, never on the config: -extfile/-extensions is what actually decides
+  # the issued extension set, so a config that says the right thing proves nothing.
+  NEW_KU="$(openssl x509 -in "$NEWC" -noout -ext keyUsage 2>/dev/null || true)"
+  NEW_EKU="$(openssl x509 -in "$NEWC" -noout -ext extendedKeyUsage 2>/dev/null || true)"
+  printf '%s' "$NEW_KU" | grep -q 'Digital Signature' \
+    || sfail "post-mint: the new certificate's keyUsage does not carry Digital Signature -- nothing promoted"
+  printf '%s' "$NEW_KU" | grep -q 'Key Encipherment' \
+    || sfail "post-mint: the new certificate's keyUsage does not carry Key Encipherment -- nothing promoted"
+  printf '%s' "$NEW_KU" | grep -q 'critical' \
+    || sfail "post-mint: the new certificate's keyUsage is not marked CRITICAL -- nothing promoted"
+  printf '%s' "$NEW_EKU" | grep -q 'TLS Web Client Authentication' \
+    || sfail "post-mint: the new certificate has no clientAuth EKU -- amphora->controller mTLS would fail in ONE direction only; nothing promoted"
+  printf '%s' "$NEW_EKU" | grep -q 'TLS Web Server Authentication' \
+    || sfail "post-mint: the new certificate has no serverAuth EKU -- controller->amphora TLS would fail; nothing promoted"
+  ok "post-mint: keyUsage (critical: digitalSignature, keyEncipherment) and EKU (clientAuth, serverAuth) are present ON THE ISSUED CERT"
+
+  NEW_PUB="$(openssl x509 -in "$NEWC" -noout -pubkey 2>/dev/null | openssl pkey -pubin -pubout -outform DER 2>/dev/null | sha256sum | cut -d' ' -f1)"
+  STG_KPUB="$(openssl pkey -in "$STG/controller.key" -pubout -outform DER 2>/dev/null | sha256sum | cut -d' ' -f1)"
+  [ "$NEW_PUB" = "$STG_KPUB" ] || sfail "post-mint: the new certificate's public key does NOT match the staged private key -- they are not a pair; nothing promoted"
+  # PROVES THE KEY ACTUALLY ROTATED. A reissue that re-certified the OLD key would satisfy
+  # every name assertion above and still leave the original private key in service, which is
+  # not what "fresh EC P-256 key on every mint" means.
+  [ "$NEW_PUB" != "$OLD_PUB" ] || sfail "post-mint: the new certificate carries the SAME public key as the old one -- the key did NOT rotate; nothing promoted"
+  ok "post-mint: cert and staged key are a pair, and the public key DIFFERS from the outgoing certificate's (the key really rotated)"
+
+  NEW_SERIAL="$(openssl x509 -in "$NEWC" -noout -serial 2>/dev/null | sed 's/^serial=//')"
+  OLD_SER_N="$(norm_hex "$OLD_SERIAL")"; NEW_SER_N="$(norm_hex "$NEW_SERIAL")"
+  SRL_AFTER="$(norm_hex "$(tr -d ' \t\r\n' < "$CA_SRL")")"
+  [ "$NEW_SER_N" != "$OLD_SER_N" ] || sfail "post-mint: the new certificate's serial equals the old one's ($NEW_SER_N) -- the same CA issuing a duplicate serial is exactly what the .srl gate exists to prevent; nothing promoted"
+  # MEASURED, NOT ASSUMED (OpenSSL 3.0.13, 2026-07-30): with -CAserial, openssl issues the
+  # cert with the INCREMENTED value and writes that same value back, so the new serial is
+  # the POST-mint file content, NOT the pre-mint content. Both inequality gates below hold
+  # on any sane implementation; an equality gate against the PRE-mint value would be wrong
+  # on this build, so it is deliberately not shipped.
+  ADV="$(python3 -c 'import sys; print("YES" if int(sys.argv[2],16) > int(sys.argv[1],16) else "NO")' "$SRL_BEFORE" "$SRL_AFTER" 2>/dev/null || true)"
+  [ "$ADV" = "YES" ] || sfail "post-mint: the CA serial file did not ADVANCE ($SRL_BEFORE -> $SRL_AFTER) -- the CA's issuance state is not tracking what it issued; nothing promoted"
+  ok "post-mint: serial $OLD_SER_N -> $NEW_SER_N, and the CA's serial file advanced $SRL_BEFORE -> $SRL_AFTER"
+
+  # VALIDITY BOUNDS, both sides. `-checkend N` exits 0 when the cert will NOT expire within
+  # N seconds, so 729d must pass and 731d must fail: that brackets ~730 days without
+  # parsing a date format that varies by locale and openssl version.
+  openssl x509 -in "$NEWC" -noout -checkend $((729 * 86400)) >/dev/null 2>&1 \
+    || sfail "post-mint: the new certificate expires within 729 days -- shorter than the ruled 730; nothing promoted"
+  if openssl x509 -in "$NEWC" -noout -checkend $((731 * 86400)) >/dev/null 2>&1; then
+    sfail "post-mint: the new certificate does not expire within 731 days -- longer than the ruled 730; nothing promoted"
+  fi
+  ok "post-mint: validity brackets ~730 days (not expiring within 729d, expiring within 731d)"
+
+  # THE BUNDLE IS BUILT IN STAGING TOO, and held to A14's invariant before it moves.
+  cat "$NEWC" "$STG/controller.key" > "$STG/controller.bundle.pem" \
+    || sfail "post-mint: could not assemble the bundle in staging; nothing promoted"
+  chmod 600 "$STG/controller.bundle.pem" "$NEWC" "$STG/controller.key" 2>/dev/null || true
+  SB_NC="$(grep -c -- '-----BEGIN CERTIFICATE-----' "$STG/controller.bundle.pem" || true)"
+  SB_NK="$(grep -cE -- '-----BEGIN [A-Z ]*PRIVATE KEY-----' "$STG/controller.bundle.pem" || true)"
+  { [ "$SB_NC" = "1" ] && [ "$SB_NK" = "1" ]; } \
+    || sfail "post-mint: the staged bundle carries $SB_NC CERTIFICATE and $SB_NK PRIVATE KEY block(s), expected 1 and 1; nothing promoted"
+  ok "post-mint: staged bundle carries exactly one CERTIFICATE block and one PRIVATE KEY block"
+
+  # ================================================================== PROMOTION (exit 5)
+  # From here on, a failure has left the workspace partly changed. mv is per file and each
+  # one is checked, because "it probably worked" is not a state an operator can act on.
+  PROMOTING=1
+  for f in controller.key controller.cert.pem controller.bundle.pem; do
+    mv -f "$STG/$f" "$W/controller/$f" \
+      || pfail "promotion: mv of $f into $W/controller FAILED -- the workspace is now PARTLY updated"
+    chmod 600 "$W/controller/$f" \
+      || pfail "promotion: chmod 600 of $W/controller/$f FAILED -- private material may be readable"
+  done
+  ok "promotion: controller.key, controller.cert.pem and controller.bundle.pem are in place, all 0600"
+
+  # ============================================================ OVERLAY SURGERY, LAST
+  # python3 READS BOTH FILES ITSELF. The value is NEVER passed in argv and NEVER handed to
+  # sed/awk, because the bundle contains an UNENCRYPTED private key and /proc/<pid>/cmdline
+  # is world-readable -- an argument would publish the key to every local user for the
+  # lifetime of the process. Only PATHS cross the boundary.
+  SURG="$(python3 - "$OVERLAY" "$CON_BUNDLE" "$OVL_TMP" <<'PY' 2>&1
+import base64, os, sys
+ovl, bundle, tmp = sys.argv[1], sys.argv[2], sys.argv[3]
+b64 = base64.b64encode(open(bundle, "rb").read()).decode("ascii")
+lines = open(ovl, "r", encoding="ascii").read().splitlines(True)
+# The COLON is load-bearing: 'lb-mgmt-controller-cert:' cannot match
+# 'lb-mgmt-controller-cacert:', which is a different value carrying the CA certificate.
+hits = [i for i, l in enumerate(lines) if l.lstrip().startswith("lb-mgmt-controller-cert:")]
+if len(hits) != 1:
+    print("SURGERY_FAIL expected exactly 1 lb-mgmt-controller-cert line, found %d" % len(hits))
+    sys.exit(1)
+i = hits[0]
+old = lines[i]
+indent = old[:len(old) - len(old.lstrip())]
+eol = "\n" if old.endswith("\n") else ""
+lines[i] = '%slb-mgmt-controller-cert: "%s"%s' % (indent, b64, eol)
+# O_EXCL so a leftover temp from a crashed run is a hard error rather than a silent
+# overwrite; 0600 at CREATION time, not after, so the secret is never briefly world-readable.
+fd = os.open(tmp, os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o600)
+try:
+    with os.fdopen(fd, "w", encoding="ascii") as fh:
+        fh.write("".join(lines))
+except Exception:
+    os.unlink(tmp)
+    raise
+os.replace(tmp, ovl)   # atomic within the directory: readers see old or new, never partial
+os.chmod(ovl, 0o600)
+print("SURGERY_OK")
+PY
+)"
+  case "$SURG" in
+    *SURGERY_OK*) ok "overlay surgery: lb-mgmt-controller-cert rewritten via O_EXCL temp + atomic os.replace (value never touched argv)" ;;
+    *)            pfail "overlay surgery FAILED: $SURG" ;;
+  esac
+
+  # ======================================================= PROVE THE SURGERY (exit 5)
+  # The pre-image comes from the ARCHIVE -- the only copy of the overlay as it was. Read
+  # straight out of the tarball in memory rather than extracted to disk: extracting would
+  # put a second copy of the CA key blobs on the filesystem to prove they had not changed.
+  # VERDICT TOKENS ONLY. No value from either file is ever printed.
+  PROOF="$(python3 - "$ARCH" "$OVERLAY" "$CON_BUNDLE" "$CA_CERT" "overlays/${SITE}-octavia-pki.yaml" <<'PY' 2>&1
+import base64, hashlib, sys, tarfile
+arch, ovl, bundle, cacert, member = sys.argv[1:6]
+def sha(b): return hashlib.sha256(b).hexdigest()
+pre = tarfile.open(arch, "r:gz").extractfile(member).read().decode("ascii").splitlines(True)
+post = open(ovl, "r", encoding="ascii").read().splitlines(True)
+if len(pre) != len(post):
+    print("PROOF_FAIL linecount pre=%d post=%d" % (len(pre), len(post))); sys.exit(1)
+changed = [i for i in range(len(pre)) if pre[i] != post[i]]
+if len(changed) != 1:
+    print("PROOF_FAIL changed_lines=%d expected=1" % len(changed)); sys.exit(1)
+if not post[changed[0]].lstrip().startswith("lb-mgmt-controller-cert:"):
+    print("PROOF_FAIL the changed line is not lb-mgmt-controller-cert"); sys.exit(1)
+def kv(lines):
+    d = {}
+    for l in lines:
+        s = l.strip()
+        if s.startswith("lb-mgmt-") and ":" in s:
+            k, v = s.split(":", 1)
+            d[k.strip()] = v.strip().strip('"')
+    return d
+a, b = kv(pre), kv(post)
+if set(a) != set(b):
+    print("PROOF_FAIL the lb-mgmt-* key SET changed"); sys.exit(1)
+for k in sorted(a):
+    if k != "lb-mgmt-controller-cert" and a[k] != b[k]:
+        print("PROOF_FAIL value changed for " + k); sys.exit(1)
+try:
+    dec = base64.b64decode(b["lb-mgmt-controller-cert"], validate=True)
+except Exception:
+    print("PROOF_FAIL the new value is not valid base64"); sys.exit(1)
+if sha(dec) != sha(open(bundle, "rb").read()):
+    print("PROOF_FAIL the new value does not decode to the promoted bundle"); sys.exit(1)
+try:
+    cad = base64.b64decode(b.get("lb-mgmt-controller-cacert", ""), validate=True)
+except Exception:
+    print("PROOF_FAIL lb-mgmt-controller-cacert is not valid base64"); sys.exit(1)
+if sha(cad) != sha(open(cacert, "rb").read()):
+    print("PROOF_FAIL lb-mgmt-controller-cacert no longer decodes to the controller CA cert"); sys.exit(1)
+print("PROOF_OK other_values_identical=%d changed_lines=1 line_count=%d" % (len(a) - 1, len(post)))
+PY
+)"
+  case "$PROOF" in
+    PROOF_OK*) ok "surgery proof: $PROOF -- the new value decodes to the promoted bundle, and lb-mgmt-controller-cacert still decodes to this DC's controller CA" ;;
+    # The overlay HAS been rewritten by this point, so exit 5's "rollback required" is the
+    # honest verdict even though its usual phrasing assumes the overlay was not reached.
+    *)         pfail "surgery proof FAILED: $PROOF -- the overlay HAS been rewritten and the new files ARE promoted" ;;
+  esac
+  PROMOTING=0
+
+  # ============================================== FINAL: the independent gate must agree
+  # A minter grading its own homework is not a gate. `verify` is re-run as a SEPARATE
+  # process over the same site, and every one of its assertions must pass.
+  echo
+  VOUT="$(bash "$SELF" verify "$SITE" 2>&1)"; VRC=$?
+  if [ "$VRC" -ne 0 ]; then
+    printf '%s\n' "$VOUT" | sed 's/^/  | /'
+    nfail "post-reissue verify did NOT pass (exit $VRC)"
+    echo "octavia-pki reissue ($SITE): FAIL -- the mint completed and IS promoted, but the independent verify gate disagrees. This is a defect in the RESULT, not a refusal to act; roll back with:"
+    echo "  restore: $RESTORE_CMD"
+    exit 1
+  fi
+  ok "post-reissue verify: PASS -- an independent re-run of every assertion for $SITE reports 0 failures"
+
+  echo
+  echo "octavia-pki reissue ($SITE): OK"
+  echo "  serial:   $OLD_SER_N -> $NEW_SER_N   (CA serial file $SRL_BEFORE -> $SRL_AFTER)"
+  echo "  CN:       $NEW_CN"
+  echo "  DNS SANs: $NEW_DNS1, $NEW_DNS2"
+  echo "  IP SANs:  $EXP_V4${EXP_V6:+, $EXP_V6}"
+  echo "  backup:   $ARCH"
+  echo "  sha256:   $ARCH_SHA"
+  echo "  restore:  $RESTORE_CMD"
+  exit 0
+}
+
+if [ "$ACTION" = "reissue" ]; then do_reissue; fi
+
+echo "=== octavia-pki verify: $SITE ==="
+
+# ---------------------------------------------------------------- preconditions (REFUSE)
+command -v openssl >/dev/null 2>&1 || nrefuse "openssl is not on PATH -- cannot evaluate any certificate (this is a MISSING TOOL, not a bad PKI)"
+command -v python3 >/dev/null 2>&1 || nrefuse "python3 is not on PATH -- needed to normalise IPv6 literals and parse the VIP overlay"
+
+assert_host_authority
+
+if [ "$NREFUSE" -ne 0 ]; then
+  echo "octavia-pki verify ($SITE): REFUSE -- preconditions unmet; this is NOT a pass"; exit 3
+fi
+
+# ---------------------------------------------------------------- expected values, DERIVED
+derive_vips || { echo "octavia-pki verify ($SITE): REFUSE"; exit 3; }
 # DC_LABEL is the CA-subject token the generator bakes. Derived the same way the runbook
 # derives it, so a mismatch here means the generator ran with an unset/wrong DC_LABEL --
 # which is F8's sibling defect (the runbook guards ${DC:?} but NOT ${DC_LABEL}).
-DC_LABEL="$(printf '%s' "$SITE" | tr 'a-z-' 'A-Z ')"
+derive_dc_label
 echo "  (expect CA label '$DC_LABEL'; provider VIP v4=$EXP_V4 v6=${EXP_V6:-<none>})"
 
 W="$PKI_HOME/octavia-pki/$SITE"
@@ -236,7 +1141,13 @@
   else
     nfail "A8 controller cert does NOT verify against the controller CA -- chain is wrong"
   fi
-  if openssl verify -CAfile "$ISS_CERT" "$CON_CERT" >/dev/null 2>&1; then
+  # THE NEGATIVE PROVES ITS INSTRUMENT FIRST (hardened 2026-07-30). `openssl verify -CAfile X`
+  # exits non-zero both for "does not verify" and for "could not load X", so a corrupt or
+  # truncated issuing-CA file would make this negative pass VACUOUSLY and print a reassuring
+  # line about distinct trust domains. "Could not look" is never "nothing there".
+  if ! openssl x509 -in "$ISS_CERT" -noout >/dev/null 2>&1; then
+    nrefuse "A8 the issuing CA certificate could not be PARSED -- 'does not verify against it' would prove nothing about trust-domain separation; no conclusion drawn"
+  elif openssl verify -CAfile "$ISS_CERT" "$CON_CERT" >/dev/null 2>&1; then
     nfail "A8 controller cert ALSO verifies against the ISSUING CA -- the two CAs are not distinct trust domains"
   else
     ok "A8 controller cert correctly does NOT verify against the issuing CA"
@@ -262,14 +1173,7 @@
     [ "$NDNS" -eq 2 ] && ok "A9 SAN carries 2 DNS names" \
                       || nfail "A9 SAN carries $NDNS DNS name(s), expected 2"
     GOT_IPS="$(printf '%s' "$SAN_RAW" | grep -oE 'IP Address:[0-9A-Fa-f:.]+' | sed 's/^IP Address://')"
-    NORM="$(printf '%s\n' "$GOT_IPS" | python3 -c '
-import sys, ipaddress
-for line in sys.stdin:
-    s = line.strip()
-    if not s: continue
-    try: print(ipaddress.ip_address(s).compressed)
-    except ValueError: print("UNPARSEABLE:"+s)
-')"
+    NORM="$(printf '%s\n' "$GOT_IPS" | norm_ips)"
     printf '%s\n' "$NORM" | grep -qx "$EXP_V4" \
       && ok "A9 SAN carries this DC's provider v4 VIP ($EXP_V4)" \
       || nfail "A9 SAN is MISSING this DC's provider v4 VIP ($EXP_V4) -- got: $(printf '%s' "$NORM" | tr '\n' ' ')"
@@ -304,20 +1208,16 @@
 # `dc1`/`dc2` labels are retired in favour of `dc0`/`dc1`". D-106 read as un-annotated because
 # D-117's annotation half was never executed; both are fixed as of DOCFIX-205.
 #
-# So the expected zone is fully derivable from the site token and is NEVER typed:
-#   REGION    = ${SITE%%-*}   vr1-dc0 -> vr1     (D-008 <region>)
-#   DC_DNS    = ${SITE#*-}    vr1-dc0 -> dc0     (D-008 <dc>, 0-indexed per D-117)
-#   zone      = omega.<dc>.<region>.cloud.neumatrix.local
-# `omega` is D-008's <cloud> label, carried unchanged by D-106's VR1 instantiation.
+# So the expected zone is fully derivable from the site token and is NEVER typed -- the
+# derivation itself now lives in derive_zone() above, because `reissue` MINTS the names this
+# assertion CHECKS and the two must not be able to disagree.
 #
 # Deliberately NOT collapsed to D-119's single `vr1-dc0` token: D-119's bare-dcN rule targets a
 # token read ALONE ("a reader who does not know which cloud the sentence is about") and here the
 # next label IS the region; D-119 completes D-117 rather than reversing it, and D-117's own
 # replacement labels are bare `dc0`/`dc1`. Collapsing would also amend D-008's ratified shape.
 if [ -f "$CON_CERT" ]; then
-  REGION="${SITE%%-*}"                      # vr1-dc0 -> vr1  (derived, never typed)
-  DC_DNS="${SITE#*-}"                       # vr1-dc0 -> dc0  (derived, never typed)
-  EXP_ZONE="omega.${DC_DNS}.${REGION}.cloud.neumatrix.local"
+  derive_zone                               # sets REGION / DC_DNS / EXP_ZONE (hoisted; see above)
   # Is the posture armed? Look for a real option KEY in the merged input, not prose.
   ARMED=0
   for f in "$REPO_ROOT/bundle.yaml" "$REPO_ROOT/overlays/${SITE}-vips.yaml" \
@@ -335,6 +1235,20 @@
     if [ -n "$DNSN" ] && [ "$BAD" -ne 0 ]; then
       ok "A12 (recorded, not failed) the DNS SANs are not in this DC's expected zone '$EXP_ZONE' -- harmless while inert, and F9's reissue obligation"
     fi
+    # GAP FIX (2026-07-30, measured): this branch had NO POSITIVE LINE. It printed the INERT
+    # banner unconditionally and, when the names were WRONG, a "(recorded, not failed)" line
+    # -- so a CORRECT cert and an INCORRECT one were indistinguishable in the unarmed posture
+    # except by counting assertions. That matters now: `reissue` MINTS zone-correct names and
+    # the live posture is unarmed, so without this line the minter's own success could not be
+    # demonstrated from `verify` output at all. The string is the SAME one the armed branch
+    # prints, so acceptance is provable by ONE grep in EITHER posture.
+    # `-n "$DNSN"` is load-bearing: with ZERO DNS SANs the loop above never runs, BAD stays 0,
+    # and a vacuous "all of them are correct" would be printed for the WORST possible cert
+    # (F8's exact output). The armed branch nfails on empty, so requiring non-empty here is
+    # what makes the two branches genuinely symmetric rather than merely similar.
+    if [ -n "$DNSN" ] && [ "$BAD" -eq 0 ]; then
+      ok "A12 DNS SANs are all in this DC's expected zone '$EXP_ZONE'"
+    fi
   else
     # Armed: the names are now load-bearing.
     BAD=0
@@ -349,6 +1263,133 @@
     done
     [ "$BAD" -eq 0 ] && ok "A12 DNS SANs are all in this DC's expected zone '$EXP_ZONE'"
   fi
+
+  # ------------------------------------------------ A13 the controller cert's SUBJECT CN
+  # NEW 2026-07-30. NOTHING asserted this before: check_subject() runs on the two CAs only,
+  # so the leaf's own name was unmeasured. It is not cosmetic -- 1.0-GEN.c bakes
+  # `CN = octavia-controller.omega.dc0.vr0.cloud.neumatrix.local` as a LITERAL, on BOTH DCs,
+  # from the same paste as the DNS SANs. A12 catches the SANs; the CN sat in the same block
+  # and nothing looked at it.
+  #
+  # ARMED BY THE SAME POSTURE AS A12, DELIBERATELY. The CN is a DNS name serving exactly the
+  # F9 role the SANs do, and it is wrong in exactly the same way on exactly the same certs.
+  # Making it an UNCONDITIONAL failure would flip the live gate from PASS to FAIL for the
+  # very condition A12 was designed to RECORD rather than fail -- a posture change smuggled
+  # in as an assertion. Two consequences worth stating: (1) it arms itself, so D-106's
+  # hostname work cannot land without this becoming load-bearing; (2) the UNCONDITIONAL CN
+  # gate does exist -- it is `reissue`'s post-mint assertion, which refuses to promote a
+  # certificate whose CN is not `octavia-controller.$EXP_ZONE`. Anything this script MINTS
+  # is held to the exact name; anything it merely FINDS is held to the ruled posture.
+  EXP_CN="octavia-controller.${EXP_ZONE}"
+  GOT_CN="$(cn_of "$CON_CERT")"
+  if [ -z "$GOT_CN" ]; then
+    nrefuse "A13 controller cert subject CN unreadable -- no conclusion drawn"
+  elif [ "$GOT_CN" = "$EXP_CN" ]; then
+    ok "A13 controller cert CN is '$EXP_CN'"
+  elif [ "$ARMED" -eq 0 ]; then
+    ok "A13 (recorded, not failed) controller cert CN is '$GOT_CN', not '$EXP_CN' -- harmless while inert, and F9's reissue obligation"
+  else
+    nfail "A13 os-public-hostname IS SET, so the subject CN is load-bearing -- it is '$GOT_CN', not '$EXP_CN' (D-008 shape, D-117 labels; F9); the certificate must be reissued"
+  fi
+fi
+
+# --------------------------------------------- A14 cert<->key pairing + bundle integrity
+# NEW 2026-07-30. Every existing assertion reads the CERTIFICATE. None of them proves the
+# controller's PRIVATE KEY belongs to it, nor that the BUNDLE Octavia is actually handed
+# matches either file. That is a real hole, not a theoretical one: `reissue` rotates all
+# three, and a promotion that moved two of the three would leave a chain that still
+# `verify`s (A8 reads only the cert) while the amphora TLS handshake fails at runtime with
+# a key/cert mismatch -- the worst kind of defect, invisible to the gate that exists.
+#
+# NEVER PRINTS KEY MATERIAL. The private bytes flow into `sha256sum` and nowhere else; only
+# the digests are compared and only a verdict is printed. That property is asserted
+# executably by the harness's no-leak case, not merely claimed here.
+CON_KEY="$W/controller/controller.key"
+CON_BUNDLE="$W/controller/controller.bundle.pem"
+if [ -f "$CON_KEY" ] && [ -f "$CON_CERT" ]; then
+  KPUB="$(openssl pkey -in "$CON_KEY" -pubout -outform DER 2>/dev/null | sha256sum | cut -d' ' -f1)"
+  CPUB="$(openssl x509 -in "$CON_CERT" -noout -pubkey 2>/dev/null \
+          | openssl pkey -pubin -pubout -outform DER 2>/dev/null | sha256sum | cut -d' ' -f1)"
+  # An EMPTY digest is sha256 of nothing, which two unreadable files would MATCH -- that is
+  # a checker that cannot fail, so it REFUSES instead of agreeing with itself.
+  EMPTY_SHA="$(printf '' | sha256sum | cut -d' ' -f1)"
+  if [ "$KPUB" = "$EMPTY_SHA" ] || [ "$CPUB" = "$EMPTY_SHA" ]; then
+    nrefuse "A14 could not extract a public key from the controller key and/or cert -- no pairing conclusion drawn"
+  elif [ "$KPUB" = "$CPUB" ]; then
+    ok "A14 controller.key and controller.cert.pem carry the SAME public key (they are a pair)"
+  else
+    nfail "A14 controller.key does NOT match controller.cert.pem -- the certificate was issued for a DIFFERENT key; amphora TLS cannot complete"
+  fi
+else
+  nfail "A14 cannot evaluate cert<->key pairing -- controller.key and/or controller.cert.pem absent"
+fi
+if [ -f "$CON_BUNDLE" ] && [ -f "$CON_CERT" ] && [ -f "$CON_KEY" ]; then
+  NC="$(grep -c -- '-----BEGIN CERTIFICATE-----' "$CON_BUNDLE" 2>/dev/null || true)"
+  NK="$(grep -cE -- '-----BEGIN [A-Z ]*PRIVATE KEY-----' "$CON_BUNDLE" 2>/dev/null || true)"
+  if [ "$NC" = "1" ] && [ "$NK" = "1" ]; then
+    ok "A14 bundle carries exactly one CERTIFICATE block and one PRIVATE KEY block"
+  else
+    nfail "A14 bundle carries $NC CERTIFICATE block(s) and $NK PRIVATE KEY block(s), expected 1 and 1 -- a stray extra key or a concatenated chain changes what the charm installs"
+  fi
+  BC="$(awk '/-----BEGIN CERTIFICATE-----/,/-----END CERTIFICATE-----/' "$CON_BUNDLE" | sha256sum | cut -d' ' -f1)"
+  FC="$(sha256sum < "$CON_CERT" | cut -d' ' -f1)"
+  [ "$BC" = "$FC" ] && ok "A14 the bundle's CERTIFICATE block is byte-identical to controller.cert.pem" \
+                    || nfail "A14 the bundle's CERTIFICATE block DIFFERS from controller.cert.pem -- the deployed cert is not the one every other assertion just measured"
+  BK="$(awk '/-----BEGIN [A-Z ]*PRIVATE KEY-----/,/-----END [A-Z ]*PRIVATE KEY-----/' "$CON_BUNDLE" | sha256sum | cut -d' ' -f1)"
+  FK="$(sha256sum < "$CON_KEY" | cut -d' ' -f1)"
+  [ "$BK" = "$FK" ] && ok "A14 the bundle's PRIVATE KEY block is byte-identical to controller.key" \
+                    || nfail "A14 the bundle's PRIVATE KEY block DIFFERS from controller.key -- the deployed key is not the one paired above"
+else
+  nfail "A14 cannot evaluate bundle integrity -- controller.bundle.pem, controller.cert.pem and/or controller.key absent"
+fi
+
+# ------------------------------------- A15 keyUsage / EKU on the controller cert (2026-07-30)
+# FOUND BY MUTATION TESTING. Before this, `verify` asserted NOTHING about the issued
+# extension set: a certificate with no keyUsage and no extendedKeyUsage passed every gate in
+# this file. `reissue` now asserts them post-mint, but that only protects certs THIS SCRIPT
+# mints -- the two live certs were minted by 1.0-GEN.c's copy-paste chain, which is exactly
+# the path that produced F8's SAN-less cert. A gate that only checks its own output is not
+# a gate on the estate.
+# WHY THESE TWO EKUs SPECIFICALLY: the controller cert is used in BOTH directions against
+# amphora agents. Losing clientAuth breaks amphora->controller only; losing serverAuth breaks
+# controller->amphora only. Either is a one-directional TLS failure, which is why the set is
+# asserted rather than merely its presence.
+if [ -f "$CON_CERT" ]; then
+  KU="$(openssl x509 -in "$CON_CERT" -noout -ext keyUsage 2>/dev/null || true)"
+  EKU="$(openssl x509 -in "$CON_CERT" -noout -ext extendedKeyUsage 2>/dev/null || true)"
+  KUBAD=""
+  printf '%s' "$KU"  | grep -q 'Digital Signature'              || KUBAD="$KUBAD digitalSignature"
+  printf '%s' "$KU"  | grep -q 'Key Encipherment'               || KUBAD="$KUBAD keyEncipherment"
+  printf '%s' "$KU"  | grep -q 'critical'                       || KUBAD="$KUBAD critical-flag"
+  printf '%s' "$EKU" | grep -q 'TLS Web Client Authentication'  || KUBAD="$KUBAD clientAuth"
+  printf '%s' "$EKU" | grep -q 'TLS Web Server Authentication'  || KUBAD="$KUBAD serverAuth"
+  if [ -z "$KU$EKU" ]; then
+    nfail "A15 the controller cert carries NEITHER keyUsage NOR extendedKeyUsage -- amphora mTLS cannot be relied on in either direction"
+  elif [ -n "$KUBAD" ]; then
+    nfail "A15 the controller cert's usage extensions are missing:$KUBAD -- a missing EKU breaks mTLS in ONE direction only, which fails at LB-create time, not here"
+  else
+    ok "A15 controller cert carries keyUsage (critical: digitalSignature, keyEncipherment) and EKU (clientAuth, serverAuth)"
+  fi
+fi
+
+# --------------------------------------- A16 the controller cert is not expiring (2026-07-30)
+# FOUND BY MUTATION TESTING, and it was the headline hole: dropping `-days 730` makes openssl
+# default to THIRTY DAYS, and a 30-day controller certificate passed every gate in this repo
+# forever -- `checkend`, `notAfter` and `enddate` appeared ZERO times in the verify half.
+# This is not hypothetical for the estate: the live certs came from a hand-pasted runbook
+# block where the flag is one token on a long line.
+# The floor is deliberately generous (30 days) rather than a 730-day bracket: verify grades
+# certificates of any age, including ones legitimately part-way through their life, so it
+# asserts "this will not lapse under us", not "this was minted yesterday". reissue keeps the
+# tight 729/731 bracket for what IT mints.
+if [ -f "$CON_CERT" ]; then
+  if ! openssl x509 -in "$CON_CERT" -noout -checkend 0 >/dev/null 2>&1; then
+    nfail "A16 the controller cert has ALREADY EXPIRED -- amphora TLS is broken now; reissue is required"
+  elif ! openssl x509 -in "$CON_CERT" -noout -checkend $((30 * 86400)) >/dev/null 2>&1; then
+    nfail "A16 the controller cert expires within 30 days -- reissue before it lapses (a short-dated cert is what a missing '-days 730' produces)"
+  else
+    ok "A16 controller cert is valid and not expiring within 30 days"
+  fi
 fi
 
 # ---------------------------------------------------------------- A10 the deploy overlay
@@ -369,6 +1410,56 @@
   else
     nfail "A10 overlay is NOT gitignored -- a CA private key is committable RIGHT NOW (F4)"
   fi
+
+  # A17 -- THE OVERLAY MUST CARRY THE MATERIAL THIS WORKSPACE HOLDS (NEW 2026-07-30).
+  # FOUND BY ADVERSARIAL REVIEW, and it is the assertion that makes every other one mean
+  # something. Until now A10 graded the overlay's SHAPE -- mode, key count, ASCII, gitignore
+  # -- and never its VALUES, while A1-A16 graded the workspace. Nothing joined them. Measured
+  # consequence: an overlay whose embedded cert decoded to a DIFFERENT bundle than the one on
+  # disk reported PASS, 0 failed. The overlay is what actually reaches the charm, so that is
+  # the copy that matters; the workspace is just where it was made.
+  # HOW IT HAPPENS: `reissue` promotes the workspace and rewrites the overlay as two steps
+  # (exit 5 exists for the gap between them), a partial restore can extract one tar member
+  # and not the other, and 1.0-GEN.d writes the overlay from a `cd`-relative path that F12
+  # records as biting repeatedly. All three land here.
+  # Compares DIGESTS of decoded bytes; no value is ever printed.
+  if [ -f "$CON_BUNDLE" ] && [ -f "$CON_CACERT" ]; then
+    OVLCMP="$(python3 - "$OVERLAY" "$CON_BUNDLE" "$CON_CACERT" <<'PY' 2>/dev/null || true
+import base64, hashlib, sys, yaml
+def d(b): return hashlib.sha256(b).hexdigest()
+try:
+    o = yaml.safe_load(open(sys.argv[1]))["applications"]["octavia"]["options"]
+except Exception:
+    print("UNREADABLE"); raise SystemExit(0)
+out = []
+for key, path, tag in (("lb-mgmt-controller-cert", sys.argv[2], "CERT"),
+                       ("lb-mgmt-controller-cacert", sys.argv[3], "CACERT")):
+    v = o.get(key)
+    if not v:
+        out.append(tag + "_EMPTY"); continue
+    try:
+        raw = base64.b64decode(v, validate=True)
+    except Exception:
+        out.append(tag + "_UNDECODABLE"); continue
+    out.append(tag + ("_OK" if d(raw) == d(open(path, "rb").read()) else "_MISMATCH"))
+print(" ".join(out))
+PY
+)"
+    case "$OVLCMP" in
+      "CERT_OK CACERT_OK")
+        ok "A17 the overlay's controller cert and CA values decode byte-identically to this workspace's bundle and controller CA" ;;
+      ""|UNREADABLE)
+        nrefuse "A17 could not parse the overlay as YAML -- no conclusion drawn about whether it matches this workspace" ;;
+      *CERT_MISMATCH*)
+        nfail "A17 the overlay's lb-mgmt-controller-cert does NOT decode to controller.bundle.pem -- THE DEPLOYED MATERIAL IS NOT WHAT THIS WORKSPACE HOLDS. Every other assertion here graded the workspace copy; the charm gets this one ($OVLCMP)" ;;
+      *CACERT_MISMATCH*)
+        nfail "A17 the overlay's lb-mgmt-controller-cacert does NOT decode to this DC's controller CA -- the charm would trust the wrong CA ($OVLCMP)" ;;
+      *EMPTY*)
+        nfail "A17 an overlay value is EMPTY -- a truncated write leaves the key present (so A10's count still reads 5) with nothing in it ($OVLCMP)" ;;
+      *)
+        nfail "A17 an overlay value is not valid base64 ($OVLCMP)" ;;
+    esac
+  fi
 fi
 
 # ---------------------------------------------------------------- A11 cross-DC independence
diff --git a/tests/octavia-pki/run-tests.sh b/tests/octavia-pki/run-tests.sh
index 381a0ca..be3dc85 100755
--- a/tests/octavia-pki/run-tests.sh
+++ b/tests/octavia-pki/run-tests.sh
@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# tests/octavia-pki/run-tests.sh -- harness for scripts/octavia-pki.sh verify
+# tests/octavia-pki/run-tests.sh -- harness for scripts/octavia-pki.sh (verify + reissue)
 #
 # WHAT THIS HARNESS IS FOR. The script asserts things the runbook only hoped for, so the
 # assertions themselves must be proven capable of FAILING -- "a checker that cannot fail is
@@ -18,6 +18,13 @@
 # Fixtures are thrown away. Nothing here touches the real ~/octavia-pki or the real repo:
 # the script's OCTAVIA_PKI_HOME / OCTAVIA_PKI_REPO / OCTAVIA_PKI_THIS_HOST overrides exist
 # for exactly this reason.
+#
+# T22..T36 cover `reissue`, and they are the ONLY sanctioned way to exercise a real mint:
+# the fixtures are throwaway CAs under $TMPROOT, so a mint here signs nothing that matters.
+# THE RULE THOSE CASES FOLLOW: assert the resulting ARTIFACT, never `verify`'s verdict. In
+# the live (unarmed) posture A12/A13 RECORD rather than fail, so a `verify` PASS is
+# perfectly compatible with the wrong-zone certificate reissue exists to replace -- taking
+# PASS as proof would make this harness a checker that cannot fail.
 
 set -uo pipefail
 SCRIPT_DIR="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
@@ -35,15 +42,28 @@
 KV4="10.12.4.50"
 
 # Build a throwaway fixture: a fake repo (git-initialised so check-ignore works) plus a
-# per-DC PKI workspace. $1=env name  $2=site  $3=CA label  $4=SAN mode
+# per-DC PKI workspace. $1=env name  $2=site  $3=CA label  $4=SAN mode  $5=dns base
+#   $6=caenc: encrypt the CONTROLLER CA key for real (default `no`)
 #   SAN mode: full | none | v4only | wrongv4
+#
+# caenc=yes exists for the reissue cases. The default fixture CA key is `-nodes`
+# (unencrypted), which cannot distinguish a minter that handles the passphrase correctly
+# from one that ignores it entirely -- openssl accepts `-passin` against an unencrypted key
+# and simply never consults it. With caenc=yes the passphrase becomes load-bearing, so
+# T31 can prove the WRONG one fails. Default `no` keeps every pre-existing case
+# behaviourally identical.
 mkfix() {
-  local name="$1" site="$2" label="$3" sanmode="$4" dnsbase="${5:-example}"
+  local name="$1" site="$2" label="$3" sanmode="$4" dnsbase="${5:-example}" caenc="${6:-no}"
   local E="$TMPROOT/$name"; local R="$E/repo"; local W="$E/home/octavia-pki/$site"
   mkdir -p "$R/overlays" "$R/creds-manifests" "$W/issuing-ca" "$W/controller-ca" "$W/controller"
 
   printf 'headend fixturehost\n' > "$R/creds-manifests/host-identity"
-  printf 'overlays/*octavia-pki.yaml\n' > "$R/.gitignore"
+  # BOTH rules, mirroring the real repo's .gitignore: the overlay glob (F4) AND `*.tmp`,
+  # because `reissue` writes `<overlay>.tmp` before os.replace() and gates on that path
+  # being ignored too. The real repo covers it with a root `*.tmp` rule; a fixture carrying
+  # only the overlay glob would make the minter refuse for a reason the live tree does not
+  # have -- and T7/T30 still empty this file wholesale, so the F4 case keeps its teeth.
+  printf 'overlays/*octavia-pki.yaml\n*.tmp\n' > "$R/.gitignore"
   git -C "$R" init -q 2>/dev/null; git -C "$R" add -A >/dev/null 2>&1 || true
 
   cat > "$R/overlays/${site}-vips.yaml" <<YML
@@ -64,16 +84,35 @@
     printf '0123456789012345678901234567890123456789012\n' > passphrase.txt
     chmod 600 passphrase.txt issuing-ca.key.enc; chmod 644 issuing-ca.cert.pem )
   ( cd "$W/controller-ca"
-    openssl req -new -x509 -newkey ec -pkeyopt ec_paramgen_curve:P-384 -sha384 -nodes \
-      -days 3650 -subj "/CN=${label} Omega Cloud Octavia Controller CA/O=Neumatrix" \
-      -keyout controller-ca.key.enc -out controller-ca.cert.pem >/dev/null 2>&1
+    # The passphrase is written FIRST because caenc=yes consumes it while making the key.
+    # 43 chars + LF = 44 bytes, matching what `openssl rand -base64 32 | tr -d '\n'` yields
+    # and what 1.0-GEN.b (and the reissue precondition) assert by length.
     printf '0123456789012345678901234567890123456789012\n' > passphrase.txt
+    if [ "$caenc" = "yes" ]; then
+      # genpkey-then-req, which is the RUNBOOK's own shape (1.0-GEN.b). `openssl req` on
+      # OpenSSL 3.0.13 rejects a cipher option outright ("Unknown option or message digest:
+      # aes-256-cbc"), so the encryption has to happen at key-generation time.
+      openssl genpkey -algorithm EC -pkeyopt ec_paramgen_curve:P-384 -aes-256-cbc \
+        -pass file:passphrase.txt -out controller-ca.key.enc >/dev/null 2>&1
+      openssl req -new -x509 -sha384 -key controller-ca.key.enc -passin file:passphrase.txt \
+        -days 3650 -subj "/CN=${label} Omega Cloud Octavia Controller CA/O=Neumatrix" \
+        -out controller-ca.cert.pem >/dev/null 2>&1
+    else
+      openssl req -new -x509 -newkey ec -pkeyopt ec_paramgen_curve:P-384 -sha384 -nodes \
+        -days 3650 -subj "/CN=${label} Omega Cloud Octavia Controller CA/O=Neumatrix" \
+        -keyout controller-ca.key.enc -out controller-ca.cert.pem >/dev/null 2>&1
+    fi
     chmod 600 passphrase.txt controller-ca.key.enc; chmod 644 controller-ca.cert.pem )
 
   ( cd "$W/controller"
     openssl genpkey -algorithm EC -pkeyopt ec_paramgen_curve:P-256 -out controller.key >/dev/null 2>&1
     chmod 600 controller.key
-    { printf '[req]\ndistinguished_name=dn\nreq_extensions=v3_req\nprompt=no\n\n[dn]\nCN=octavia-controller.example\nO=Neumatrix\n\n[v3_req]\nkeyUsage=critical,digitalSignature,keyEncipherment\nextendedKeyUsage=clientAuth,serverAuth\n'
+    # CN TRACKS $dnsbase (2026-07-30). It used to be the literal `octavia-controller.example`
+    # regardless of the SAN zone, which made every fixture's CN wrong-by-construction and left
+    # the new A13 subject-CN assertion untestable in its PASSING direction. The live generator
+    # builds the CN and the two DNS SANs from the SAME paste (1.0-GEN.c), so a fixture whose
+    # CN and SANs disagree does not model any certificate this repo can actually produce.
+    { printf '[req]\ndistinguished_name=dn\nreq_extensions=v3_req\nprompt=no\n\n[dn]\nCN=octavia-controller.%s\nO=Neumatrix\n\n[v3_req]\nkeyUsage=critical,digitalSignature,keyEncipherment\nextendedKeyUsage=clientAuth,serverAuth\n' "$dnsbase"
       case "$sanmode" in
         none) : ;;   # F8's failure mode: NO subjectAltName at all
         *) printf 'subjectAltName=@alt_names\n\n[alt_names]\nDNS.1=octavia-controller.%s\nDNS.2=octavia.%s\n' "$dnsbase" "$dnsbase" ;;
@@ -85,8 +124,11 @@
       esac
     } > controller.cnf
     openssl req -new -sha256 -key controller.key -config controller.cnf -out controller.csr >/dev/null 2>&1
+    # -passin is passed unconditionally: openssl ignores it on an unencrypted key, so one
+    # code path serves both caenc modes.
     openssl x509 -req -sha256 -in controller.csr -CA ../controller-ca/controller-ca.cert.pem \
-      -CAkey ../controller-ca/controller-ca.key.enc -CAcreateserial -days 730 \
+      -CAkey ../controller-ca/controller-ca.key.enc -passin file:../controller-ca/passphrase.txt \
+      -CAcreateserial -days 730 \
       -extfile controller.cnf -extensions v3_req -out controller.cert.pem >/dev/null 2>&1
     # 600 on the certs AND the serial, matching the generator's E2 fix at source. The serial is
     # created by -CAcreateserial at the inherited umask, so it must be tightened explicitly --
@@ -94,11 +136,20 @@
     chmod 600 controller.cert.pem ../controller-ca/controller-ca.cert.srl
     cat controller.cert.pem controller.key > controller.bundle.pem; chmod 600 controller.bundle.pem )
 
-  # the deploy overlay: 5 keys, ASCII, 0600, and gitignored by the fixture .gitignore
+  # The deploy overlay: 5 keys, ASCII, 0600, gitignored -- modelled on 1.0-GEN.d, which
+  # writes four base64(PEM) values plus the issuing-CA passphrase as a PLAIN string.
+  # REAL VALUES (2026-07-30), not the former "QUJD" placeholders: reissue's surgery proof
+  # asserts that lb-mgmt-controller-cacert STILL decodes to the controller CA certificate
+  # after the rewrite, and that the new lb-mgmt-controller-cert decodes to the promoted
+  # bundle. A placeholder can satisfy neither, and a fixture that cannot model the real
+  # file cannot prove a gate against it.
   { echo "applications:"; echo "  octavia:"; echo "    options:"
-    for k in issuing-cacert issuing-ca-private-key issuing-ca-key-passphrase controller-cacert controller-cert; do
-      echo "      lb-mgmt-${k}: \"QUJD\""
-    done; } > "$R/overlays/${site}-octavia-pki.yaml"
+    echo "      lb-mgmt-issuing-cacert: \"$(base64 -w0 < "$W/issuing-ca/issuing-ca.cert.pem")\""
+    echo "      lb-mgmt-issuing-ca-private-key: \"$(base64 -w0 < "$W/issuing-ca/issuing-ca.key.enc")\""
+    echo "      lb-mgmt-issuing-ca-key-passphrase: \"$(head -1 "$W/issuing-ca/passphrase.txt")\""
+    echo "      lb-mgmt-controller-cacert: \"$(base64 -w0 < "$W/controller-ca/controller-ca.cert.pem")\""
+    echo "      lb-mgmt-controller-cert: \"$(base64 -w0 < "$W/controller/controller.bundle.pem")\""
+  } > "$R/overlays/${site}-octavia-pki.yaml"
   chmod 600 "$R/overlays/${site}-octavia-pki.yaml"
   echo "$E"
 }
@@ -109,6 +160,36 @@
         bash "$CHECK" verify "$site" 2>&1)"; RC=$?
 }
 
+# run_reissue <env-dir> <site> <host> [flags...] -> sets RC, OUT
+# Mirrors run(), but the host is POSITIONAL AND REQUIRED rather than defaulted: reissue
+# takes flags after the site, so a trailing optional host would be ambiguous with them, and
+# T26's whole point is passing a wrong host deliberately.
+run_reissue() {
+  local E="$1" site="$2" host="$3"; shift 3
+  OUT="$(OCTAVIA_PKI_REPO="$E/repo" OCTAVIA_PKI_HOME="$E/home" OCTAVIA_PKI_THIS_HOST="$host" \
+        bash "$CHECK" reissue "$site" "$@" 2>&1)"; RC=$?
+}
+
+# Digest the four things a reissue may change, so a case can assert that NOTHING moved.
+# Files that do not exist hash as the literal "-", which is still a stable comparand.
+sha_state() {  # sha_state <env-dir> <site>
+  local E="$1" site="$2" f
+  for f in "$E/home/octavia-pki/$site/controller/controller.key" \
+           "$E/home/octavia-pki/$site/controller/controller.cert.pem" \
+           "$E/home/octavia-pki/$site/controller/controller.bundle.pem" \
+           "$E/repo/overlays/${site}-octavia-pki.yaml"; do
+    if [ -f "$f" ]; then sha256sum < "$f" | cut -d' ' -f1; else echo "-"; fi
+  done
+}
+
+# The CN and the DNS SAN list of a certificate, read DIRECTLY. The reissue cases assert on
+# these rather than on `verify` PASS, because in the live (unarmed) posture A12/A13 record
+# rather than fail -- so a PASS from verify is NOT evidence the names are right.
+cert_cn()   { openssl x509 -in "$1" -noout -subject -nameopt multiline 2>/dev/null | sed -n 's/^ *commonName *= *//p' | head -1; }
+cert_dns()  { openssl x509 -in "$1" -noout -ext subjectAltName 2>/dev/null | grep -oE 'DNS:[^,[:space:]]+' | sed 's/^DNS://' | sort | tr '\n' ' '; }
+cert_ser()  { openssl x509 -in "$1" -noout -serial 2>/dev/null | sed 's/^serial=//'; }
+cert_pub()  { openssl x509 -in "$1" -noout -pubkey 2>/dev/null | openssl pkey -pubin -pubout -outform DER 2>/dev/null | sha256sum | cut -d' ' -f1; }
+
 echo "=== octavia-pki harness ==="
 
 # T1 -- NON-ZERO FLOOR. A correct fixture must PASS, or nothing below proves anything.
@@ -296,6 +377,464 @@
 RC=0; bash "$CHECK" generate vr1-dc0 >/dev/null 2>&1 || RC=$?
 [ "$RC" = 2 ] && ok "T15 'generate' exits 2 -- unimplemented pending the D-137 fork-1 ruling" || no "T15 generate must exit 2 (rc=$RC)"
 
+# =========================================================== reissue: the minting half ===
+# EVERY CASE BELOW ASSERTS THE RESULTING ARTIFACT, NOT `verify`'s VERDICT. In the live
+# (unarmed) posture A12 and A13 RECORD rather than fail, so a `verify` PASS is compatible
+# with a certificate whose names are completely wrong -- which is precisely the certificate
+# reissue exists to replace. A harness that accepted PASS as proof would be a checker that
+# cannot fail, and this repo has measured that failure mode twice already.
+
+DC0_ZONE="omega.dc0.vr1.cloud.neumatrix.local"
+DC1_ZONE="omega.dc1.vr1.cloud.neumatrix.local"
+FIXPASS="0123456789012345678901234567890123456789012"
+
+# T22 -- POSITIVE FLOOR for the minter. The default fixture's names are `*.example`, so a
+# reissue must land the DERIVED zone. Asserted by reading the certificate directly.
+E=$(mkfix reissue_ok vr1-dc0 "VR1 DC0" full); CERT="$E/home/octavia-pki/vr1-dc0/controller/controller.cert.pem"
+run_reissue "$E" vr1-dc0 fixturehost
+GOTDNS="$(cert_dns "$CERT")"; GOTCN="$(cert_cn "$CERT")"
+if [ "$RC" = 0 ] && [ "$GOTCN" = "octavia-controller.$DC0_ZONE" ] \
+   && [ "$GOTDNS" = "octavia-controller.$DC0_ZONE octavia.$DC0_ZONE " ]; then
+  ok "T22 reissue MINTS the derived zone: CN + both DNS SANs read back correct from the cert itself"
+else
+  no "T22 reissue must mint the derived zone (rc=$RC cn='$GOTCN' dns='$GOTDNS')"; printf '%s\n' "$OUT" | sed 's/^/       /'
+fi
+
+# T23 -- THE RE-RUN GUARD. A second reissue must REFUSE 4 and change NOTHING. The sha
+# comparison is the real assertion: an implementation that rotated the key BEFORE evaluating
+# the guard would still exit 4, and only the digests would show it.
+BEFORE="$(sha_state "$E" vr1-dc0)"
+run_reissue "$E" vr1-dc0 fixturehost
+AFTER="$(sha_state "$E" vr1-dc0)"
+if [ "$RC" = 4 ] && [ "$BEFORE" = "$AFTER" ]; then
+  ok "T23 a second reissue REFUSES 4 (already correct) and key/cert/bundle/overlay are ALL byte-unchanged"
+else
+  no "T23 re-run guard must refuse 4 and change nothing (rc=$RC, state changed: $([ "$BEFORE" = "$AFTER" ] && echo no || echo YES))"
+  printf '%s\n' "$OUT" | sed 's/^/       /'
+fi
+
+# T24 -- --force overrides the guard and really re-mints. PUBKEY change is the load-bearing
+# half: a new serial alone would be satisfied by re-certifying the SAME key.
+OLDSER="$(cert_ser "$CERT")"; OLDPUB="$(cert_pub "$CERT")"
+run_reissue "$E" vr1-dc0 fixturehost --force
+NEWSER="$(cert_ser "$CERT")"; NEWPUB="$(cert_pub "$CERT")"
+if [ "$RC" = 0 ] && [ "$OLDSER" != "$NEWSER" ] && [ "$OLDPUB" != "$NEWPUB" ]; then
+  ok "T24 --force reissues an already-correct cert: serial CHANGED and the public key CHANGED (a genuinely fresh key)"
+else
+  no "T24 --force must re-mint with a fresh key (rc=$RC ser $OLDSER->$NEWSER pubchanged=$([ "$OLDPUB" != "$NEWPUB" ] && echo yes || echo NO))"
+  printf '%s\n' "$OUT" | sed 's/^/       /'
+fi
+
+# T25 -- VACUOUS TRUTH. A cert with ZERO DNS SANs is the WORST case in the estate (F8's
+# output). A naive guard walks the SAN list, finds nothing wrong because there is nothing
+# there, and REFUSES to fix it. This case pins that reissue proceeds.
+E=$(mkfix reissue_nosan vr1-dc0 "VR1 DC0" none); CERT="$E/home/octavia-pki/vr1-dc0/controller/controller.cert.pem"
+run_reissue "$E" vr1-dc0 fixturehost
+if [ "$RC" = 0 ] && [ "$(cert_dns "$CERT")" = "octavia-controller.$DC0_ZONE octavia.$DC0_ZONE " ]; then
+  ok "T25 a SAN-LESS cert is REISSUED (rc 0), not refused as 'already correct' -- the vacuous-truth guard holds"
+else
+  no "T25 a SAN-less cert must be reissued, not refused (rc=$RC dns='$(cert_dns "$CERT")')"; printf '%s\n' "$OUT" | sed 's/^/       /'
+fi
+
+# T26 -- WRONG HOST. Host authority runs FIRST, before any file or directory is created, so
+# the assertion is not merely rc 3 but that the filesystem is untouched -- no archive, no
+# staging dir, nothing newer anywhere. Repeated with --force, which must NOT bypass it.
+E=$(mkfix reissue_wronghost vr1-dc0 "VR1 DC0" full)
+MARK="$TMPROOT/reissue_wronghost.mark"; : > "$MARK"; sleep 1
+run_reissue "$E" vr1-dc0 someotherhost
+NEWER1="$(find "$E" -newer "$MARK" 2>/dev/null | wc -l | tr -d ' ')"; RC1=$RC
+run_reissue "$E" vr1-dc0 someotherhost --force
+NEWER2="$(find "$E" -newer "$MARK" 2>/dev/null | wc -l | tr -d ' ')"; RC2=$RC
+if [ "$RC1" = 3 ] && [ "$RC2" = 3 ] && [ "$NEWER1" = 0 ] && [ "$NEWER2" = 0 ]; then
+  ok "T26 a run on the wrong host REFUSES 3 and creates NOTHING (no archive, no staging) -- and --force does not bypass it"
+else
+  no "T26 wrong host must refuse 3 with nothing created (rc=$RC1/$RC2 newer=$NEWER1/$NEWER2)"; printf '%s\n' "$OUT" | sed 's/^/       /'
+fi
+
+# T27 -- the CA serial file is issuance STATE. Without it this minter cannot continue the
+# CA's sequence, and -CAcreateserial would silently start a new random one (duplicate-serial
+# risk). It must stop BEFORE minting, with the workspace untouched.
+E=$(mkfix reissue_noserial vr1-dc0 "VR1 DC0" full)
+rm -f "$E/home/octavia-pki/vr1-dc0/controller-ca/controller-ca.cert.srl"
+BEFORE="$(sha_state "$E" vr1-dc0)"; run_reissue "$E" vr1-dc0 fixturehost; AFTER="$(sha_state "$E" vr1-dc0)"
+# The message asserted here comes from the ARTIFACT-SET check (P2), not the dedicated serial
+# gate (P5): under the ruled precondition ordering P2 runs first and catches the same
+# absence. P5 is kept anyway so a future reader finds the -CAserial reasoning stated where
+# they will look for it. The assertion is on the file being NAMED, which holds either way.
+if [ "$RC" != 0 ] && [ "$BEFORE" = "$AFTER" ] && printf '%s' "$OUT" | grep -q "controller-ca.cert.srl"; then
+  ok "T27 a missing CA serial STOPS the reissue (rc=$RC) with nothing minted or changed"
+else
+  no "T27 missing serial must stop the mint (rc=$RC)"; printf '%s\n' "$OUT" | sed 's/^/       /'
+fi
+
+# T28 -- the serial is genuinely CONSUMED from the CA's own sequence.
+# MEASURED (OpenSSL 3.0.13): -CAserial issues with the INCREMENTED value and writes that
+# same value back, so the new certificate's serial equals the POST-mint file content, NOT
+# the pre-mint content. The brief's suggested "new == pre-mint .srl" equality is therefore
+# FALSE on this build and is deliberately NOT shipped; the two inequality gates below are
+# what actually holds -- and they are what matters, since the defect being guarded is a
+# reused or unrecorded serial.
+E=$(mkfix reissue_serial vr1-dc0 "VR1 DC0" full)
+CERT="$E/home/octavia-pki/vr1-dc0/controller/controller.cert.pem"
+SRLF="$E/home/octavia-pki/vr1-dc0/controller-ca/controller-ca.cert.srl"
+OLDSER="$(cert_ser "$CERT")"; SRL_PRE="$(tr -d ' \t\r\n' < "$SRLF")"
+run_reissue "$E" vr1-dc0 fixturehost
+NEWSER="$(cert_ser "$CERT")"; SRL_POST="$(tr -d ' \t\r\n' < "$SRLF")"
+ADV="$(python3 -c 'import sys;print("YES" if int(sys.argv[2],16)>int(sys.argv[1],16) else "NO")' "$SRL_PRE" "$SRL_POST" 2>/dev/null || echo NO)"
+if [ "$RC" = 0 ] && [ "$OLDSER" != "$NEWSER" ] && [ "$ADV" = "YES" ]; then
+  ok "T28 the new serial DIFFERS from the old and the CA serial file ADVANCED ($SRL_PRE -> $SRL_POST)"
+else
+  no "T28 serial must be consumed from the CA sequence (rc=$RC old=$OLDSER new=$NEWSER srl $SRL_PRE->$SRL_POST adv=$ADV)"
+  printf '%s\n' "$OUT" | sed 's/^/       /'
+fi
+
+# T29 -- OVERLAY SURGERY. Exactly one value may move. The other four carry CA private-key
+# blobs and the issuing-CA passphrase; a rewrite that disturbed them would be a silent
+# credential corruption that no other gate reads.
+E=$(mkfix reissue_surgery vr1-dc0 "VR1 DC0" full)
+OVL="$E/repo/overlays/vr1-dc0-octavia-pki.yaml"; cp "$OVL" "$TMPROOT/ovl.pre"
+run_reissue "$E" vr1-dc0 fixturehost
+SURG="$(python3 - "$TMPROOT/ovl.pre" "$OVL" "$E/home/octavia-pki/vr1-dc0/controller/controller.bundle.pem" \
+        "$E/home/octavia-pki/vr1-dc0/controller-ca/controller-ca.cert.pem" <<'PY' 2>&1
+import base64, hashlib, sys
+pre = open(sys.argv[1]).read().splitlines(True)
+post = open(sys.argv[2]).read().splitlines(True)
+if len(pre) != len(post): print("FAIL linecount"); sys.exit()
+ch = [i for i in range(len(pre)) if pre[i] != post[i]]
+if len(ch) != 1: print("FAIL changed=%d" % len(ch)); sys.exit()
+def kv(ls):
+    d = {}
+    for l in ls:
+        s = l.strip()
+        if s.startswith("lb-mgmt-") and ":" in s:
+            k, v = s.split(":", 1); d[k.strip()] = v.strip().strip('"')
+    return d
+a, b = kv(pre), kv(post)
+if set(a) != set(b): print("FAIL keyset"); sys.exit()
+for k in a:
+    if k != "lb-mgmt-controller-cert" and a[k] != b[k]: print("FAIL other " + k); sys.exit()
+if a["lb-mgmt-controller-cert"] == b["lb-mgmt-controller-cert"]: print("FAIL value unchanged"); sys.exit()
+sha = lambda x: hashlib.sha256(x).hexdigest()
+if sha(base64.b64decode(b["lb-mgmt-controller-cert"])) != sha(open(sys.argv[3], "rb").read()):
+    print("FAIL decode!=bundle"); sys.exit()
+if sha(base64.b64decode(b["lb-mgmt-controller-cacert"])) != sha(open(sys.argv[4], "rb").read()):
+    print("FAIL cacert"); sys.exit()
+print("OK")
+PY
+)"
+if [ "$RC" = 0 ] && [ "$SURG" = "OK" ]; then
+  ok "T29 surgery changes EXACTLY ONE line: other four values byte-identical, line count preserved, new value decodes to the bundle, cacert still decodes to the controller CA"
+else
+  no "T29 overlay surgery must change exactly one value (rc=$RC surg=$SURG)"; printf '%s\n' "$OUT" | sed 's/^/       /'
+fi
+
+# T30 -- F4 TIMING, the case that decides whether the F4 gate is worth anything. An
+# un-gitignored overlay must stop the run BEFORE the mint, not after: learning it afterwards
+# means a CA private key is committable AND the workspace has already moved.
+E=$(mkfix reissue_f4 vr1-dc0 "VR1 DC0" full)
+: > "$E/repo/.gitignore"
+BEFORE="$(sha_state "$E" vr1-dc0)"; run_reissue "$E" vr1-dc0 fixturehost; AFTER="$(sha_state "$E" vr1-dc0)"
+NBK="$(find "$E/home/octavia-pki/backups" -type f 2>/dev/null | wc -l | tr -d ' ')"
+if [ "$RC" = 1 ] && [ "$BEFORE" = "$AFTER" ] && [ "$NBK" = 0 ] && printf '%s' "$OUT" | grep -q "NOT gitignored"; then
+  ok "T30 an un-gitignored overlay FAILS 1 BEFORE the mint -- nothing minted, nothing changed, not even a backup taken (F4 timing)"
+else
+  no "T30 F4 must stop the run before minting (rc=$RC changed=$([ "$BEFORE" = "$AFTER" ] && echo no || echo YES) backups=$NBK)"
+  printf '%s\n' "$OUT" | sed 's/^/       /'
+fi
+
+# T31 -- WRONG CA PASSPHRASE, against a REAL encrypted CA key (caenc=yes). Without a real
+# encryption this case cannot exist: openssl accepts -passin on an unencrypted key and never
+# consults it, so a minter that mishandled the passphrase would pass silently.
+E=$(mkfix reissue_badpass vr1-dc0 "VR1 DC0" full example yes)
+printf 'wrongwrongwrongwrongwrongwrongwrongwrongwro\n' > "$E/home/octavia-pki/vr1-dc0/controller-ca/passphrase.txt"
+chmod 600 "$E/home/octavia-pki/vr1-dc0/controller-ca/passphrase.txt"
+BEFORE="$(sha_state "$E" vr1-dc0)"; run_reissue "$E" vr1-dc0 fixturehost; AFTER="$(sha_state "$E" vr1-dc0)"
+NSTG="$(find "$E/home/octavia-pki" -maxdepth 1 -name '.reissue-*' 2>/dev/null | wc -l | tr -d ' ')"
+if [ "$RC" = 1 ] && [ "$BEFORE" = "$AFTER" ] && [ "$NSTG" = 0 ] && printf '%s' "$OUT" | grep -q "REFUSED to sign"; then
+  ok "T31 a WRONG CA passphrase FAILS 1 against a really-encrypted CA key: nothing promoted, no staging left behind"
+else
+  no "T31 wrong passphrase must fail with nothing promoted (rc=$RC changed=$([ "$BEFORE" = "$AFTER" ] && echo no || echo YES) staging=$NSTG)"
+  printf '%s\n' "$OUT" | sed 's/^/       /'
+fi
+
+# T32 -- VIP plausibility, both verdicts. A VIP that PARSES but sits outside this DC's
+# provider prefix is a measured defect (FAIL 1); a VIP that cannot be read at all is a
+# refusal to look (REFUSE 3). Conflating the two is what "could not look is never nothing
+# there" exists to prevent.
+E=$(mkfix reissue_vipbad vr1-dc0 "VR1 DC0" full)
+sed -i 's/vip: "10.12.4.50 /vip: "10.99.0.50 /' "$E/repo/overlays/vr1-dc0-vips.yaml"
+BEFORE="$(sha_state "$E" vr1-dc0)"; run_reissue "$E" vr1-dc0 fixturehost; AFTER="$(sha_state "$E" vr1-dc0)"
+RC_OUT=$RC; OK_OUT=0
+[ "$RC_OUT" = 1 ] && [ "$BEFORE" = "$AFTER" ] && printf '%s' "$OUT" | grep -q "OUTSIDE keystone's provider prefix" && OK_OUT=1
+E=$(mkfix reissue_vipgone vr1-dc0 "VR1 DC0" full)
+printf 'applications:\n  keystone:\n    options:\n      vip: "10.12.4.50"\n' > "$E/repo/overlays/vr1-dc0-vips.yaml"
+run_reissue "$E" vr1-dc0 fixturehost
+if [ "$OK_OUT" = 1 ] && [ "$RC" = 3 ]; then
+  ok "T32 a VIP outside this DC's prefix FAILS 1 (measured defect); an unreadable octavia VIP block REFUSES 3 (could not look)"
+else
+  no "T32 VIP gates must split FAIL vs REFUSE (outside rc=$RC_OUT ok=$OK_OUT, missing rc=$RC)"; printf '%s\n' "$OUT" | sed 's/^/       /'
+fi
+
+# T33 -- vr1-dc1 derives its OWN zone through the MINTER, not just the checker. Proves the
+# names are computed per-DC rather than being a dc0 constant wearing a variable.
+E=$(mkfix reissue_dc1 vr1-dc1 "VR1 DC1" full); CERT="$E/home/octavia-pki/vr1-dc1/controller/controller.cert.pem"
+run_reissue "$E" vr1-dc1 fixturehost
+if [ "$RC" = 0 ] && [ "$(cert_cn "$CERT")" = "octavia-controller.$DC1_ZONE" ] \
+   && [ "$(cert_dns "$CERT")" = "octavia-controller.$DC1_ZONE octavia.$DC1_ZONE " ]; then
+  ok "T33 reissuing vr1-dc1 mints dc1.vr1 names -- the minter derives per-DC, it does not carry a dc0 constant"
+else
+  no "T33 vr1-dc1 must mint its own zone (rc=$RC cn='$(cert_cn "$CERT")')"; printf '%s\n' "$OUT" | sed 's/^/       /'
+fi
+
+# T34 -- --dry-run must build and ASSERT the config, print it, and mint nothing at all.
+E=$(mkfix reissue_dry vr1-dc0 "VR1 DC0" full)
+BEFORE="$(sha_state "$E" vr1-dc0)"; run_reissue "$E" vr1-dc0 fixturehost --dry-run; AFTER="$(sha_state "$E" vr1-dc0)"
+NBK="$(find "$E/home/octavia-pki/backups" -type f 2>/dev/null | wc -l | tr -d ' ')"
+NSTG="$(find "$E/home/octavia-pki" -maxdepth 1 -name '.reissue-*' 2>/dev/null | wc -l | tr -d ' ')"
+if [ "$RC" = 0 ] && [ "$BEFORE" = "$AFTER" ] && [ "$NBK" = 0 ] && [ "$NSTG" = 0 ] \
+   && printf '%s' "$OUT" | grep -q "subjectAltName = @alt_names" \
+   && printf '%s' "$OUT" | grep -q "DNS.1 = octavia-controller.$DC0_ZONE"; then
+  ok "T34 --dry-run prints the asserted config and mints NOTHING (no key, no cert, no backup, no staging)"
+else
+  no "T34 --dry-run must mint nothing (rc=$RC changed=$([ "$BEFORE" = "$AFTER" ] && echo no || echo YES) backups=$NBK staging=$NSTG)"
+  printf '%s\n' "$OUT" | sed 's/^/       /'
+fi
+
+# T35 -- NO LEAK. The script's own header claims it never prints key material; this is that
+# claim in executable form, over the FULL stdout+stderr of a SUCCESSFUL run (the run that
+# handles the most secret material). Three probes: PEM headers, the fixture's CA
+# passphrase, and any long run of base64-alphabet characters.
+# The 64-hex exclusion is deliberate and narrow: a sha256 digest is exactly 64 characters
+# drawn from the base64 alphabet, and the archive's digest is printed ON PURPOSE (it is how
+# an operator identifies the backup). Excluding ONLY /^[0-9a-f]{64}$/ keeps the probe's
+# teeth -- a base64 PEM body line is 64 chars but is not pure lowercase hex, and the overlay
+# value is thousands of characters long.
+E=$(mkfix reissue_leak vr1-dc0 "VR1 DC0" full example yes)
+run_reissue "$E" vr1-dc0 fixturehost
+LEAK=""
+printf '%s' "$OUT" | grep -q -- "-----BEGIN" && LEAK="$LEAK PEM-header"
+printf '%s' "$OUT" | grep -qF "$FIXPASS" && LEAK="$LEAK passphrase"
+B64="$(printf '%s' "$OUT" | grep -Eo '[A-Za-z0-9+/=]{64,}' | grep -vE '^[0-9a-f]{64}$' | head -1 || true)"
+[ -n "$B64" ] && LEAK="$LEAK base64-run"
+if [ "$RC" = 0 ] && [ -z "$LEAK" ]; then
+  ok "T35 a SUCCESSFUL reissue leaks nothing: no PEM header, no passphrase, no long base64 run in stdout+stderr"
+else
+  no "T35 reissue output must carry no key material (rc=$RC leaks:$LEAK)"; printf '%s\n' "$OUT" | sed 's/^/       /'
+fi
+
+# T36 -- EXIT 5, the PARTIAL code. Every other exit path is reachable by a bad input; this
+# one only happens when promotion itself fails part way, and an untested rollback path is a
+# rollback path nobody has ever seen work. Forced by making the controller directory
+# unwritable AFTER every precondition has passed, so the run gets all the way to `mv`.
+# The assertion that matters is that the operator is handed a RESTORE COMMAND, not just a
+# number: exit 5 means "something moved and you must put it back".
+if [ "$(id -u)" = 0 ]; then
+  ok "T36 SKIPPED (running as root: directory permissions cannot force a promotion failure)"
+else
+  E=$(mkfix reissue_partial vr1-dc0 "VR1 DC0" full)
+  chmod 555 "$E/home/octavia-pki/vr1-dc0/controller"
+  run_reissue "$E" vr1-dc0 fixturehost
+  chmod 755 "$E/home/octavia-pki/vr1-dc0/controller"
+  if [ "$RC" = 5 ] && printf '%s' "$OUT" | grep -q "PARTIAL" && printf '%s' "$OUT" | grep -q "restore: tar xzf"; then
+    ok "T36 a promotion that fails part way exits 5 (PARTIAL) and prints the exact restore command"
+  else
+    no "T36 a failed promotion must exit 5 with a restore command (rc=$RC)"; printf '%s\n' "$OUT" | sed 's/^/       /'
+  fi
+fi
+
+# =====================================================================================
+# T37..T43 -- THE ASSERTIONS MUTATION TESTING PROVED COULD NOT FAIL (added 2026-07-30)
+#
+# WHY THESE EXIST, stated plainly because it is the lesson: on 2026-07-30 a mutation pass
+# broke or DELETED A13, A14 and A12's inert positive one at a time and the harness stayed
+# at 38/38 PASS every time. Assertions with no failing-direction fixture are decoration --
+# "a checker that cannot fail is not a gate" applies to the harness itself, not just to the
+# script. Each case below breaks exactly one property and requires the named assertion to
+# catch it. Two of them (T37, T38) pin properties that had NO assertion at all until today,
+# and both were reachable by dropping a single token from the runbook's hand-pasted mint.
+#
+# resign(): re-issue an existing fixture's controller cert with a custom [v3_req] body and
+# lifetime, reusing that fixture's CA. This is how a defect is INTRODUCED into an otherwise
+# healthy workspace, so each case isolates one property.
+resign() {  # resign <env> <site> <v3_req-body> <days> [keyfile]
+  local E="$1" site="$2" body="$3" days="$4" keyf="${5:-controller.key}"
+  local W="$E/home/octavia-pki/$site"
+  ( cd "$W/controller" || exit 1
+    { printf '[req]\ndistinguished_name=dn\nreq_extensions=v3_req\nprompt=no\n\n[dn]\nCN=octavia-controller.%s\nO=Neumatrix\n\n[v3_req]\n' "example"
+      printf '%s\n' "$body"
+      printf '\n[alt_names]\nDNS.1=octavia-controller.example\nDNS.2=octavia.example\nIP.1 = %s\nIP.2 = %s\n' "$V4" "$V6"
+    } > re.cnf
+    openssl req -new -sha256 -key "$keyf" -config re.cnf -out re.csr >/dev/null 2>&1
+    openssl x509 -req -sha256 -in re.csr -CA ../controller-ca/controller-ca.cert.pem \
+      -CAkey ../controller-ca/controller-ca.key.enc -passin file:../controller-ca/passphrase.txt \
+      -CAcreateserial -days "$days" -extfile re.cnf -extensions v3_req \
+      -out controller.cert.pem >/dev/null 2>&1
+    chmod 600 controller.cert.pem
+    cat controller.cert.pem "$keyf" > controller.bundle.pem; chmod 600 controller.bundle.pem
+    rm -f re.cnf re.csr )
+}
+
+# T37 -- A15. A certificate with NO keyUsage and NO extendedKeyUsage. MEASURED 2026-07-30:
+# before A15 this minted, promoted and left the harness at 38/38. Losing clientAuth breaks
+# amphora->controller mTLS ONLY, so it fails at LB-create time with every gate reading PASS.
+E=$(mkfix noeku vr1-dc0 "VR1 DC0" full)
+resign "$E" vr1-dc0 'subjectAltName=@alt_names' 730
+run "$E" vr1-dc0
+[ "$RC" = 1 ] && printf '%s' "$OUT" | grep -q 'A15 the controller cert carries NEITHER' \
+  && ok "T37 a cert with NO keyUsage and NO EKU FAILS (A15) -- the mTLS break that read PASS until today" \
+  || { no "T37 A15 must fail a cert with no usage extensions (rc=$RC)"; printf '%s\n' "$OUT" | sed 's/^/       /'; }
+
+# T37b -- A15, the PARTIAL loss, which is the nastier one: serverAuth present, clientAuth
+# gone. TLS works in one direction, so a smoke test that only talks TO the controller passes.
+E=$(mkfix noclientauth vr1-dc0 "VR1 DC0" full)
+resign "$E" vr1-dc0 'keyUsage=critical,digitalSignature,keyEncipherment
+extendedKeyUsage=serverAuth
+subjectAltName=@alt_names' 730
+run "$E" vr1-dc0
+[ "$RC" = 1 ] && printf '%s' "$OUT" | grep -q 'clientAuth' \
+  && ok "T37b a cert missing ONLY clientAuth FAILS (A15) -- one-directional mTLS, the hardest shape to debug" \
+  || { no "T37b A15 must fail a partial EKU set (rc=$RC)"; printf '%s\n' "$OUT" | sed 's/^/       /'; }
+
+# T38 -- A16. THE HEADLINE HOLE: `openssl x509 -req` defaults to -days 30. Dropping that one
+# token from the runbook's hand-pasted block yields a 30-day controller certificate that
+# passed every gate in this repo FOREVER -- `checkend`/`notAfter`/`enddate` appeared zero
+# times in the verify half until A16.
+E=$(mkfix shortdated vr1-dc0 "VR1 DC0" full)
+resign "$E" vr1-dc0 'keyUsage=critical,digitalSignature,keyEncipherment
+extendedKeyUsage=clientAuth,serverAuth
+subjectAltName=@alt_names' 20
+run "$E" vr1-dc0
+[ "$RC" = 1 ] && printf '%s' "$OUT" | grep -q 'A16 the controller cert expires within 30 days' \
+  && ok "T38 a short-dated (20-day) cert FAILS (A16) -- what a missing '-days 730' actually produces" \
+  || { no "T38 A16 must fail a short-dated cert (rc=$RC)"; printf '%s\n' "$OUT" | sed 's/^/       /'; }
+
+# T39 -- A17. The overlay is what reaches the charm; the workspace is only where it was made.
+# MEASURED: an overlay whose embedded cert decoded to a DIFFERENT bundle reported PASS 34/0.
+# This is reachable by a SIGKILL between promotion and surgery, by a half-completed restore,
+# and by 1.0-GEN.d's cwd-relative reads (F12).
+E=$(mkfix ovldesync vr1-dc0 "VR1 DC0" full)
+OTHERB="$(mkfix ovldesync2 vr1-dc1 "VR1 DC1" full)"
+python3 - "$E/repo/overlays/vr1-dc0-octavia-pki.yaml" \
+          "$OTHERB/home/octavia-pki/vr1-dc1/controller/controller.bundle.pem" <<'PY'
+import base64, sys
+p, other = sys.argv[1], sys.argv[2]
+v = base64.b64encode(open(other, "rb").read()).decode()
+out = []
+for l in open(p):
+    if l.lstrip().startswith("lb-mgmt-controller-cert:"):
+        out.append('      lb-mgmt-controller-cert: "%s"\n' % v)
+    else:
+        out.append(l)
+open(p, "w").writelines(out)
+PY
+run "$E" vr1-dc0
+[ "$RC" = 1 ] && printf '%s' "$OUT" | grep -q 'A17 the overlay.*does NOT decode to controller.bundle.pem' \
+  && ok "T39 an overlay carrying a DIFFERENT bundle FAILS (A17) -- workspace and deploy input can no longer silently disagree" \
+  || { no "T39 A17 must fail an overlay/workspace desync (rc=$RC)"; printf '%s\n' "$OUT" | sed 's/^/       /'; }
+
+# T39b -- A17, the EMPTY value. A truncated write leaves the KEY present, so A10's count still
+# reads 5 and every shape check passes. GEN.d has no non-empty guard on its five captures.
+E=$(mkfix ovlempty vr1-dc0 "VR1 DC0" full)
+sed -i 's|^      lb-mgmt-controller-cert: .*|      lb-mgmt-controller-cert: ""|' \
+  "$E/repo/overlays/vr1-dc0-octavia-pki.yaml"
+run "$E" vr1-dc0
+[ "$RC" = 1 ] && printf '%s' "$OUT" | grep -q 'A17 an overlay value is EMPTY' \
+  && ok "T39b an EMPTY overlay value FAILS (A17) -- A10's 5-key count cannot see it" \
+  || { no "T39b A17 must fail an empty overlay value (rc=$RC)"; printf '%s\n' "$OUT" | sed 's/^/       /'; }
+
+# T40 -- A14's FAILING direction. Mutation testing deleted A14 wholesale and the harness
+# stayed green: it had no negative fixture at all. A cert issued for a DIFFERENT key is the
+# state a partial promotion leaves (2 of 3 files moved).
+E=$(mkfix keymismatch vr1-dc0 "VR1 DC0" full)
+openssl genpkey -algorithm EC -pkeyopt ec_paramgen_curve:P-256 \
+  -out "$E/home/octavia-pki/vr1-dc0/controller/controller.key" >/dev/null 2>&1
+chmod 600 "$E/home/octavia-pki/vr1-dc0/controller/controller.key"
+run "$E" vr1-dc0
+[ "$RC" = 1 ] && printf '%s' "$OUT" | grep -q 'A14 controller.key does NOT match' \
+  && ok "T40 a key that does not match the cert FAILS (A14) -- the partial-promotion state" \
+  || { no "T40 A14 must fail a cert/key mismatch (rc=$RC)"; printf '%s\n' "$OUT" | sed 's/^/       /'; }
+
+# T41 -- A13's FAILING direction, armed. Mutation testing showed A13 was pinned only in its
+# PASSING direction (as collateral of T21c). Correct SANs, wrong CN: the exact half-fix an
+# implementer produces by editing [alt_names] and forgetting [req_distinguished_name], which
+# are different sections of the same config.
+E=$(mkfix cnwrong vr1-dc0 "VR1 DC0" full "omega.dc0.vr1.cloud.neumatrix.local")
+( cd "$E/home/octavia-pki/vr1-dc0/controller" || exit 1
+  { printf '[req]\ndistinguished_name=dn\nreq_extensions=v3_req\nprompt=no\n\n[dn]\nCN=octavia-controller.omega.dc0.vr0.cloud.neumatrix.local\nO=Neumatrix\n\n[v3_req]\nkeyUsage=critical,digitalSignature,keyEncipherment\nextendedKeyUsage=clientAuth,serverAuth\nsubjectAltName=@alt_names\n\n[alt_names]\nDNS.1=octavia-controller.omega.dc0.vr1.cloud.neumatrix.local\nDNS.2=octavia.omega.dc0.vr1.cloud.neumatrix.local\nIP.1 = %s\nIP.2 = %s\n' "$V4" "$V6"
+  } > cn.cnf
+  openssl req -new -sha256 -key controller.key -config cn.cnf -out cn.csr >/dev/null 2>&1
+  openssl x509 -req -sha256 -in cn.csr -CA ../controller-ca/controller-ca.cert.pem \
+    -CAkey ../controller-ca/controller-ca.key.enc -passin file:../controller-ca/passphrase.txt \
+    -CAcreateserial -days 730 -extfile cn.cnf -extensions v3_req -out controller.cert.pem >/dev/null 2>&1
+  chmod 600 controller.cert.pem
+  cat controller.cert.pem controller.key > controller.bundle.pem; chmod 600 controller.bundle.pem
+  rm -f cn.cnf cn.csr )
+printf '      os-public-hostname: keystone.omega.dc0.vr1.cloud.neumatrix.local\n' \
+  >> "$E/repo/overlays/vr1-dc0-vips.yaml"
+run "$E" vr1-dc0
+[ "$RC" = 1 ] && printf '%s' "$OUT" | grep -q 'A13 os-public-hostname IS SET' \
+  && ok "T41 ARMED + correct SANs but WRONG CN FAILS (A13) -- the half-fix, now pinned in its failing direction" \
+  || { no "T41 A13 must fail a wrong CN when armed (rc=$RC)"; printf '%s\n' "$OUT" | sed 's/^/       /'; }
+
+# T42 -- A12/A13's INERT POSITIVE must not be VACUOUS. Mutation testing made the positive
+# unconditional and nothing failed: a SAN-LESS certificate -- F8's exact output -- collected
+# "DNS SANs are all in this DC's expected zone". A positive that a zero-name cert can earn is
+# worse than no positive at all, because it reads as confirmation.
+E=$(mkfix inertvacuous vr1-dc0 "VR1 DC0" none)
+run "$E" vr1-dc0
+printf '%s' "$OUT" | grep -q 'DNS SANs are all in this DC.s expected zone' \
+  && { no "T42 a SAN-less cert must NOT earn A12's positive zone line"; printf '%s\n' "$OUT" | sed 's/^/       /'; } \
+  || ok "T42 a SAN-less cert earns NO positive zone line -- the inert positive is not vacuous"
+
+# T43 -- the re-run guard's COUNT half. Mutation testing refuted the assumption that T25
+# covered this: on a zero-SAN cert the loop simply never sets a hit, so the count guard is
+# not what saves it. The count's real teeth are the THREE-SAN case -- two correct names plus
+# a stale one. Without the count check, reissue REFUSES 4 and the stale third name survives.
+E=$(mkfix threesan vr1-dc0 "VR1 DC0" full "omega.dc0.vr1.cloud.neumatrix.local")
+( cd "$E/home/octavia-pki/vr1-dc0/controller" || exit 1
+  { printf '[req]\ndistinguished_name=dn\nreq_extensions=v3_req\nprompt=no\n\n[dn]\nCN=octavia-controller.omega.dc0.vr1.cloud.neumatrix.local\nO=Neumatrix\n\n[v3_req]\nkeyUsage=critical,digitalSignature,keyEncipherment\nextendedKeyUsage=clientAuth,serverAuth\nsubjectAltName=@alt_names\n\n[alt_names]\nDNS.1=octavia-controller.omega.dc0.vr1.cloud.neumatrix.local\nDNS.2=octavia.omega.dc0.vr1.cloud.neumatrix.local\nDNS.3=octavia.omega.dc0.vr0.cloud.neumatrix.local\nIP.1 = %s\nIP.2 = %s\n' "$V4" "$V6"
+  } > t3.cnf
+  openssl req -new -sha256 -key controller.key -config t3.cnf -out t3.csr >/dev/null 2>&1
+  openssl x509 -req -sha256 -in t3.csr -CA ../controller-ca/controller-ca.cert.pem \
+    -CAkey ../controller-ca/controller-ca.key.enc -passin file:../controller-ca/passphrase.txt \
+    -CAcreateserial -days 730 -extfile t3.cnf -extensions v3_req -out controller.cert.pem >/dev/null 2>&1
+  chmod 600 controller.cert.pem
+  cat controller.cert.pem controller.key > controller.bundle.pem; chmod 600 controller.bundle.pem
+  rm -f t3.cnf t3.csr )
+run_reissue "$E" vr1-dc0 fixturehost
+if [ "$RC" = 4 ]; then
+  no "T43 a THREE-SAN cert must NOT be treated as already-correct (rc=4 leaves the stale third name)"
+else
+  D3="$(OCTAVIA_PKI_REPO="$E/repo" OCTAVIA_PKI_HOME="$E/home" OCTAVIA_PKI_THIS_HOST=fixturehost \
+        bash "$CHECK" verify vr1-dc0 2>&1 | grep -c 'A9 SAN carries 2 DNS names' || true)"
+  [ "$RC" = 0 ] && [ "$D3" = "1" ] \
+    && ok "T43 a cert with a stale THIRD DNS SAN is REISSUED down to exactly 2 -- the count guard has teeth" \
+    || { no "T43 three-SAN cert must reissue to exactly 2 names (rc=$RC, twoname=$D3)"; }
+fi
+
+# T44 -- THE RE-RUN GUARD MUST NOT REFUSE A CERTIFICATE `verify` REJECTS.
+# FOUND BY ADVERSARIAL REVIEW, and it is the defect that would have bitten at the 2-year
+# renewal rather than today. Names correct, IP SAN stale (the exact DOCFIX-067 scenario the
+# runbook already recorded once, when R14 moved the VIPs off 10.12.4.233): the FIRST version
+# of the guard compared names only, so `verify` FAILED while `reissue` exited 4 saying
+# "nothing to fix". The remedy refused the defect the checker had just reported.
+# The guard now requires verify to return clean as well, so the two can never disagree.
+E=$(mkfix guardstale vr1-dc0 "VR1 DC0" wrongv4 "omega.dc0.vr1.cloud.neumatrix.local")
+run "$E" vr1-dc0
+if [ "$RC" != 1 ]; then
+  no "T44 setup: the stale-IP fixture should make verify FAIL (rc=$RC)"
+else
+  run_reissue "$E" vr1-dc0 fixturehost
+  if [ "$RC" = 4 ]; then
+    no "T44 the guard REFUSED a cert that verify FAILS -- the remedy is refusing the reported defect"
+  else
+    OCTAVIA_PKI_REPO="$E/repo" OCTAVIA_PKI_HOME="$E/home" OCTAVIA_PKI_THIS_HOST=fixturehost \
+      bash "$CHECK" verify vr1-dc0 >/dev/null 2>&1 \
+      && ok "T44 names-correct-but-verify-FAILS is reissued, not refused -- and verify is clean afterwards" \
+      || { no "T44 reissue ran (rc=$RC) but verify is still not clean afterwards"; }
+  fi
+fi
+
 echo
 if [ "$F" = 0 ]; then echo "octavia-pki: $P/$P PASS"; exit 0; fi
 echo "octavia-pki: FAILURES: $F (passed $P)"; exit 1